Edit tour

Windows Analysis Report
Server1.exe

Overview

General Information

Sample name:	Server1.exe
Analysis ID:	1575627
MD5:	71b3810a22e1b51e8b88cd63b5e23ba0
SHA1:	7ac4ab80301dcabcc97ec68093ed775d148946de
SHA256:	57bf3ab110dc44c56ed5a53b02b8c9ccc24054cf9c9a5aacc72f71a992138a3f
Tags:	exeNjRATuser-lontze7
Infos:

Detection

Njrat

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Njrat

.NET source code contains potential unpacker

AI detected suspicious sample

Contains functionality to disable the Task Manager (.Net Source)

Contains functionality to spread to USB devices (.Net source)

Disables zone checking for all users

Machine Learning detection for sample

Modifies the windows firewall

Uses netsh to modify the Windows network and firewall settings

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Creates a window with clipboard capturing capabilities

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May infect USB drives

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Yara signature match

Classification

Process Tree

System is w10x64

Server1.exe (PID: 6388 cmdline: "C:\Users\user\Desktop\Server1.exe" MD5: 71B3810A22E1B51E8B88CD63B5E23BA0)

netsh.exe (PID: 7388 cmdline: netsh firewall add allowedprogram "C:\Users\user\Desktop\Server1.exe" "Server1.exe" ENABLE MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

conhost.exe (PID: 7396 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
NjRAT	RedPacket Security describes NJRat as "a remote access trojan (RAT) has capabilities to log keystrokes, access the victim's camera, steal credentials stored in browsers, open a reverse shell, upload/download files, view the victim's desktop, perform process, file, and registry manipulations, and capabilities to let the attacker update, uninstall, restart, close, disconnect the RAT and rename its campaign ID. Through the Command & Control (CnC) server software, the attacker has capabilities to create and configure the malware to spread through USB drives."It is supposedly popular with actors in the Middle East. Similar to other RATs, many leaked builders may be backdoored.	AQUATIC PANDA Earth Lusca Operation C-Major The Gorgon Group	http://blog.trendmicro.com/trendlabs-security-intelligence/new-rats-emerge-from-leaked-njw0rm-source-code/ http://blogs.360.cn/post/analysis-of-apt-c-37.html http://threatgeek.typepad.com/files/fta-1009---njrat-uncovered-1.pdf https://about.fb.com/news/2021/04/taking-action-against-hackers-in-palestine/ https://asec.ahnlab.com/1369	https://malpedia.caad.fkie.fraunhofer.de/details/win.njrat

Malware Configuration

Threatname: Njrat

{"Campaign ID": "HacKed", "Version": "0.7d", "Install Name": "f41ac0c2ea25f3f8b0a75a7371d6b015", "Install Dir": "Adobe Update", "Registry Value": "Software\\Microsoft\\Windows\\CurrentVersion\\Run", "Network Seprator": "|'|'|"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
Server1.exe	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
Server1.exe	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x115d2:$a1: get_Registry 0x15a4f:$a2: SEE_MASK_NOZONECHECKS 0x156f1:$a3: Download ERROR 0x15ca1:$a4: cmd.exe /c ping 0 -n 2 & del " 0x13c2e:$a5: netsh firewall delete allowedprogram "
Server1.exe	CN_disclosed_20180208_c	Detects malware from disclosed CN malware set	Florian Roth	0x15ca1:$x1: cmd.exe /c ping 0 -n 2 & del " 0x137ba:$s1: winmgmts:\\.\root\SecurityCenter2 0x1570f:$s3: Executed As 0x124f0:$s5: Stub.exe 0x156f1:$s6: Download ERROR 0x1377c:$s8: Select * From AntiVirusProduct
Server1.exe	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x15a4f:$reg: SEE_MASK_NOZONECHECKS 0x156d5:$msg: Execute ERROR 0x15729:$msg: Execute ERROR 0x15ca1:$ping: cmd.exe /c ping 0 -n 2 & del
Server1.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x13c2e:$s1: netsh firewall delete allowedprogram 0x13c80:$s2: netsh firewall add allowedprogram 0x15ca1:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x156d5:$s4: Execute ERROR 0x15729:$s4: Execute ERROR 0x156f1:$s5: Download ERROR

Memory Dumps

Source	Rule	Description	Author	Strings
00000005.00000000.1270611811.0000000000982000.00000002.00000001.01000000.00000004.sdmp	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
00000005.00000000.1270611811.0000000000982000.00000002.00000001.01000000.00000004.sdmp	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x113d2:$a1: get_Registry 0x1584f:$a2: SEE_MASK_NOZONECHECKS 0x154f1:$a3: Download ERROR 0x15aa1:$a4: cmd.exe /c ping 0 -n 2 & del " 0x13a2e:$a5: netsh firewall delete allowedprogram "
00000005.00000000.1270611811.0000000000982000.00000002.00000001.01000000.00000004.sdmp	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x1584f:$reg: SEE_MASK_NOZONECHECKS 0x154d5:$msg: Execute ERROR 0x15529:$msg: Execute ERROR 0x15aa1:$ping: cmd.exe /c ping 0 -n 2 & del
00000005.00000002.3710332991.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
Process Memory Space: Server1.exe PID: 6388	JoeSecurity_Njrat	Yara detected Njrat	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
5.0.Server1.exe.980000.0.unpack	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
5.0.Server1.exe.980000.0.unpack	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x115d2:$a1: get_Registry 0x15a4f:$a2: SEE_MASK_NOZONECHECKS 0x156f1:$a3: Download ERROR 0x15ca1:$a4: cmd.exe /c ping 0 -n 2 & del " 0x13c2e:$a5: netsh firewall delete allowedprogram "
5.0.Server1.exe.980000.0.unpack	CN_disclosed_20180208_c	Detects malware from disclosed CN malware set	Florian Roth	0x15ca1:$x1: cmd.exe /c ping 0 -n 2 & del " 0x137ba:$s1: winmgmts:\\.\root\SecurityCenter2 0x1570f:$s3: Executed As 0x124f0:$s5: Stub.exe 0x156f1:$s6: Download ERROR 0x1377c:$s8: Select * From AntiVirusProduct
5.0.Server1.exe.980000.0.unpack	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x15a4f:$reg: SEE_MASK_NOZONECHECKS 0x156d5:$msg: Execute ERROR 0x15729:$msg: Execute ERROR 0x15ca1:$ping: cmd.exe /c ping 0 -n 2 & del
5.0.Server1.exe.980000.0.unpack	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x13c2e:$s1: netsh firewall delete allowedprogram 0x13c80:$s2: netsh firewall add allowedprogram 0x15ca1:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x156d5:$s4: Execute ERROR 0x15729:$s4: Execute ERROR 0x156f1:$s5: Download ERROR

Suricata Signatures

ET MALWARE Bladabindi/njRAT CnC Command (ll)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T07:23:58.698019+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.7	49701	147.185.221.17	30620	TCP
2024-12-16T07:24:22.650603+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.7	49751	147.185.221.17	30620	TCP
2024-12-16T07:24:46.687454+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.7	49803	147.185.221.17	30620	TCP
2024-12-16T07:25:10.750212+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.7	49859	147.185.221.17	30620	TCP
2024-12-16T07:25:34.794300+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.7	49912	147.185.221.17	30620	TCP
2024-12-16T07:25:58.829680+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.7	49965	147.185.221.17	30620	TCP
2024-12-16T07:26:23.028794+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.7	49978	147.185.221.17	30620	TCP
2024-12-16T07:26:47.155397+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.7	49979	147.185.221.17	30620	TCP
2024-12-16T07:27:11.200852+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.7	49980	147.185.221.17	30620	TCP
2024-12-16T07:27:35.232085+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.7	49981	147.185.221.17	30620	TCP

ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T07:23:58.698019+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.7	49701	147.185.221.17	30620	TCP
2024-12-16T07:24:22.650603+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.7	49751	147.185.221.17	30620	TCP
2024-12-16T07:24:46.687454+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.7	49803	147.185.221.17	30620	TCP
2024-12-16T07:25:10.750212+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.7	49859	147.185.221.17	30620	TCP
2024-12-16T07:25:34.794300+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.7	49912	147.185.221.17	30620	TCP
2024-12-16T07:25:58.829680+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.7	49965	147.185.221.17	30620	TCP
2024-12-16T07:26:23.028794+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.7	49978	147.185.221.17	30620	TCP
2024-12-16T07:26:47.155397+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.7	49979	147.185.221.17	30620	TCP
2024-12-16T07:27:11.200852+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.7	49980	147.185.221.17	30620	TCP
2024-12-16T07:27:35.232085+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.7	49981	147.185.221.17	30620	TCP

ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T07:24:04.876444+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49701	147.185.221.17	30620	TCP
2024-12-16T07:24:47.828553+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49803	147.185.221.17	30620	TCP
2024-12-16T07:26:27.000700+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49978	147.185.221.17	30620	TCP
2024-12-16T07:26:49.016502+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49979	147.185.221.17	30620	TCP
2024-12-16T07:27:41.446148+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49981	147.185.221.17	30620	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Server1.exe

Avira: detected

Found malware configuration

Source: 5.0.Server1.exe.980000.0.unpack

Malware Configuration Extractor: Njrat {"Campaign ID": "HacKed", "Version": "0.7d", "Install Name": "f41ac0c2ea25f3f8b0a75a7371d6b015", "Install Dir": "Adobe Update", "Registry Value": "Software\\Microsoft\\Windows\\CurrentVersion\\Run", "Network Seprator": "|'|'|"}

Multi AV Scanner detection for submitted file

Source: Server1.exe

ReversingLabs: Detection: 86%

Yara detected Njrat

Source: Yara match	File source: Server1.exe, type: SAMPLE
Source: Yara match	File source: 5.0.Server1.exe.980000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000000.1270611811.0000000000982000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3710332991.0000000002F91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Server1.exe PID: 6388, type: MEMORYSTR

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: Server1.exe

Joe Sandbox ML: detected

Source: Server1.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\Server1.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

Jump to behavior

Source: Server1.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Spreading

Contains functionality to spread to USB devices (.Net source)

Source: Server1.exe, Usb1.cs

.Net Code: infect

Source: Server1.exe, 00000005.00000000.1270611811.0000000000982000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: \autorun.inf
Source: Server1.exe, 00000005.00000000.1270611811.0000000000982000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: [autorun]
Source: Server1.exe, 00000005.00000000.1270611811.0000000000982000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: autorun.inf
Source: Server1.exe	Binary or memory string: \autorun.inf
Source: Server1.exe	Binary or memory string: [autorun]
Source: Server1.exe	Binary or memory string: autorun.inf

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.7:49701 -> 147.185.221.17:30620
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.7:49701 -> 147.185.221.17:30620
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.7:49701 -> 147.185.221.17:30620
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.7:49751 -> 147.185.221.17:30620
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.7:49751 -> 147.185.221.17:30620
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.7:49803 -> 147.185.221.17:30620
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.7:49803 -> 147.185.221.17:30620
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.7:49803 -> 147.185.221.17:30620
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.7:49859 -> 147.185.221.17:30620
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.7:49859 -> 147.185.221.17:30620
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.7:49912 -> 147.185.221.17:30620
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.7:49912 -> 147.185.221.17:30620
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.7:49965 -> 147.185.221.17:30620
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.7:49965 -> 147.185.221.17:30620
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.7:49981 -> 147.185.221.17:30620
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.7:49981 -> 147.185.221.17:30620
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.7:49979 -> 147.185.221.17:30620
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.7:49979 -> 147.185.221.17:30620
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.7:49981 -> 147.185.221.17:30620
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.7:49979 -> 147.185.221.17:30620
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.7:49978 -> 147.185.221.17:30620
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.7:49980 -> 147.185.221.17:30620
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.7:49978 -> 147.185.221.17:30620
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.7:49980 -> 147.185.221.17:30620
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.7:49978 -> 147.185.221.17:30620

Source: global traffic

TCP traffic: 192.168.2.7:49701 -> 147.185.221.17:30620

Source: Joe Sandbox View

IP Address: 147.185.221.17 147.185.221.17

Source: Joe Sandbox View

ASN Name: SALSGIVERUS SALSGIVERUS

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: exchange-reasonably.gl.at.ply.gg

Source: Server1.exe, 00000005.00000002.3709532390.0000000000F19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://go.microsoft.
Source: Server1.exe, 00000005.00000002.3709532390.0000000000F19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://go.microsoft.LinkId=42127

Source: C:\Users\user\Desktop\Server1.exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

E-Banking Fraud

Yara detected Njrat

Source: Yara match	File source: Server1.exe, type: SAMPLE
Source: Yara match	File source: 5.0.Server1.exe.980000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000000.1270611811.0000000000982000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3710332991.0000000002F91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Server1.exe PID: 6388, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: Server1.exe, type: SAMPLE	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: Server1.exe, type: SAMPLE	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: Server1.exe, type: SAMPLE	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: Server1.exe, type: SAMPLE	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 5.0.Server1.exe.980000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 5.0.Server1.exe.980000.0.unpack, type: UNPACKEDPE	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: 5.0.Server1.exe.980000.0.unpack, type: UNPACKEDPE	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 5.0.Server1.exe.980000.0.unpack, type: UNPACKEDPE	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 00000005.00000000.1270611811.0000000000982000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 00000005.00000000.1270611811.0000000000982000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group

Source: C:\Users\user\Desktop\Server1.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\Server1.exe	Code function: 5_2_01182BD1	5_2_01182BD1
Source: C:\Users\user\Desktop\Server1.exe	Code function: 5_2_05154298	5_2_05154298
Source: C:\Users\user\Desktop\Server1.exe	Code function: 5_2_05155000	5_2_05155000
Source: C:\Users\user\Desktop\Server1.exe	Code function: 5_2_0515470F	5_2_0515470F
Source: C:\Users\user\Desktop\Server1.exe	Code function: 5_2_05154936	5_2_05154936
Source: C:\Users\user\Desktop\Server1.exe	Code function: 5_2_05154630	5_2_05154630
Source: C:\Users\user\Desktop\Server1.exe	Code function: 5_2_05154F2F	5_2_05154F2F
Source: C:\Users\user\Desktop\Server1.exe	Code function: 5_2_0515505D	5_2_0515505D
Source: C:\Users\user\Desktop\Server1.exe	Code function: 5_2_05155459	5_2_05155459
Source: C:\Users\user\Desktop\Server1.exe	Code function: 5_2_05154B5B	5_2_05154B5B
Source: C:\Users\user\Desktop\Server1.exe	Code function: 5_2_05154544	5_2_05154544
Source: C:\Users\user\Desktop\Server1.exe	Code function: 5_2_0515536F	5_2_0515536F
Source: C:\Users\user\Desktop\Server1.exe	Code function: 5_2_0515499D	5_2_0515499D
Source: C:\Users\user\Desktop\Server1.exe	Code function: 5_2_05154F9D	5_2_05154F9D
Source: C:\Users\user\Desktop\Server1.exe	Code function: 5_2_05154287	5_2_05154287
Source: C:\Users\user\Desktop\Server1.exe	Code function: 5_2_05154C8F	5_2_05154C8F
Source: C:\Users\user\Desktop\Server1.exe	Code function: 5_2_051547D4	5_2_051547D4
Source: C:\Users\user\Desktop\Server1.exe	Code function: 5_2_051544F1	5_2_051544F1
Source: C:\Users\user\Desktop\Server1.exe	Code function: 5_2_051549F9	5_2_051549F9
Source: C:\Users\user\Desktop\Server1.exe	Code function: 5_2_051550E3	5_2_051550E3

Source: Server1.exe, 00000005.00000002.3709532390.0000000000E8E000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: OriginalFilenamemscorwks.dllT vs Server1.exe

Source: Server1.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: Server1.exe, type: SAMPLE	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: Server1.exe, type: SAMPLE	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: Server1.exe, type: SAMPLE	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: Server1.exe, type: SAMPLE	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 5.0.Server1.exe.980000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 5.0.Server1.exe.980000.0.unpack, type: UNPACKEDPE	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 5.0.Server1.exe.980000.0.unpack, type: UNPACKEDPE	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 5.0.Server1.exe.980000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 00000005.00000000.1270611811.0000000000982000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 00000005.00000000.1270611811.0000000000982000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan

Source: classification engine

Classification label: mal100.spre.phis.troj.evad.winEXE@4/2@1/1

Source: C:\Users\user\Desktop\Server1.exe	Code function: 5_2_052C24BE AdjustTokenPrivileges,		5_2_052C24BE
Source: C:\Users\user\Desktop\Server1.exe	Code function: 5_2_052C2487 AdjustTokenPrivileges,		5_2_052C2487

Source: C:\Users\user\Desktop\Server1.exe

File created: C:\Users\user\AppData\Roaming\app

Jump to behavior

Source: C:\Users\user\Desktop\Server1.exe	Mutant created: \Sessions\1\BaseNamedObjects\f41ac0c2ea25f3f8b0a75a7371d6b015
Source: C:\Users\user\Desktop\Server1.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7396:120:WilError_03
Source: C:\Users\user\Desktop\Server1.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\.net clr networking

Source: C:\Users\user\Desktop\Server1.exe

File created: C:\Users\user\AppData\Local\Temp\FransescoPast.txt

Jump to behavior

Source: Server1.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Server1.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\Server1.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Server1.exe

ReversingLabs: Detection: 86%

Source: unknown	Process created: C:\Users\user\Desktop\Server1.exe "C:\Users\user\Desktop\Server1.exe"
Source: C:\Users\user\Desktop\Server1.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Users\user\Desktop\Server1.exe" "Server1.exe" ENABLE
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Server1.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Users\user\Desktop\Server1.exe" "Server1.exe" ENABLE	Jump to behavior

Source: C:\Users\user\Desktop\Server1.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Server1.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Server1.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Server1.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Server1.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Server1.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Server1.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Server1.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Server1.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Server1.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\Server1.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Server1.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Server1.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Server1.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Server1.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Server1.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Server1.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Server1.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Server1.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Server1.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\Server1.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Server1.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ifmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasmontr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mfc42u.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: authfwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcmonitor.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3cfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3api.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: onex.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappprxy.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: hnetmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netshell.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netsetupapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netiohlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: httpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: polstore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshwfp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2pnetsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2p.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rpcnsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: whhelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlancfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlanapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wshelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: peerdistsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wcmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mobilenetworking.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprmsg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: msasn1.dll	Jump to behavior

Source: C:\Users\user\Desktop\Server1.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\Server1.exe

File opened: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll

Jump to behavior

Source: Server1.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: C:\Users\user\Desktop\Server1.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

Jump to behavior

Source: Server1.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains potential unpacker

Source: Server1.exe, Fransesco.cs

.Net Code: Plugin System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\Desktop\Server1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\Server1.exe	Memory allocated: 1230000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Server1.exe	Memory allocated: 2F90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Server1.exe	Memory allocated: 4F90000 memory commit \| memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\Server1.exe	Window / User API: threadDelayed 917	Jump to behavior
Source: C:\Users\user\Desktop\Server1.exe	Window / User API: threadDelayed 5448	Jump to behavior
Source: C:\Users\user\Desktop\Server1.exe	Window / User API: threadDelayed 3020	Jump to behavior
Source: C:\Users\user\Desktop\Server1.exe	Window / User API: foregroundWindowGot 774	Jump to behavior
Source: C:\Users\user\Desktop\Server1.exe	Window / User API: foregroundWindowGot 774	Jump to behavior

Source: C:\Users\user\Desktop\Server1.exe TID: 6012	Thread sleep count: 917 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Server1.exe TID: 6012	Thread sleep time: -91700s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Server1.exe TID: 7096	Thread sleep count: 5448 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Server1.exe TID: 7096	Thread sleep time: -5448000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Server1.exe TID: 7096	Thread sleep count: 3020 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Server1.exe TID: 7096	Thread sleep time: -3020000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: Server1.exe, 00000005.00000002.3709532390.0000000000F19000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000008.00000003.1315148518.0000000001341000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\Server1.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\Server1.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 05:50:33 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/08 \| 13:04:24 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/08 \| 13:35:07 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 20:39:59 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 20:47:00 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/17 \| 00:49:18 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/08 \| 13:25:48 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 05:14:32 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/08 \| 12:48:27 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 05:29:08 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 07:58:26 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 07:43:50 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 08:35:47 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/17 \| 03:29:15 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 04:37:11 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 08:45:06 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 06:06:29 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 05:35:56 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/01 \| 13:00:13 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/01 \| 13:20:07 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 07:37:02 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 08:14:23 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 06:22:36 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 08:15:53 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 05:19:49 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 22:52:37 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 05:34:26 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 08:50:24 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/08 \| 13:20:31 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 06:07:59 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/17 \| 01:05:15 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 05:09:14 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/08 \| 14:12:28 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 07:59:56 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/21 \| 11:55:36 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/28 \| 00:35:04 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 06:55:40 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/08 \| 13:58:52 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/30 \| 08:11:34 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 04:26:22 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/21 \| 11:34:12 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 04:47:46 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/08 \| 14:01:39 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 03:49:01 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 03:41:09 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 03:39:42 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/08 \| 13:36:37 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 06:02:42 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/08 \| 14:09:31 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/30 \| 06:52:51 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 22:07:13 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/21 \| 10:59:51 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 07:47:37 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 04:31:40 - Program Manager
Source: Server1.exe, 00000005.00000002.3710332991.0000000003031000.00000004.00000800.00020000.00000000.sdmp, Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 17:10:24 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/30 \| 08:06:16 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 04:58:35 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 04:57:05 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/01 \| 13:38:34 - Program Manager
Source: Server1.exe, 00000005.00000002.3710332991.00000000031E3000.00000004.00000800.00020000.00000000.sdmp, Server1.exe, 00000005.00000002.3710332991.0000000003075000.00000004.00000800.00020000.00000000.sdmp, Server1.exe, 00000005.00000002.3710332991.0000000003387000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 16:42:08 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 20:44:01 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 18:24:36 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/17 \| 01:22:52 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 19:03:41 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/08 \| 12:43:10 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/17 \| 01:32:11 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 22:21:54 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/28 \| 00:41:52 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/17 \| 02:30:56 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 20:45:31 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 08:26:42 - Program Manager
Source: Server1.exe, 00000005.00000002.3710332991.00000000031E3000.00000004.00000800.00020000.00000000.sdmp, Server1.exe, 00000005.00000002.3710332991.0000000003075000.00000004.00000800.00020000.00000000.sdmp, Server1.exe, 00000005.00000002.3710332991.0000000003387000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 16:54:27 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/01 \| 15:40:20 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/30 \| 06:59:52 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 06:54:49 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 07:49:21 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 03:59:36 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 05:56:04 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/21 \| 11:54:06 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 07:31:31 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 06:33:25 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 04:04:07 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 06:39:33 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 07:41:29 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/30 \| 06:15:59 - Program Manager
Source: Server1.exe, 00000005.00000002.3710332991.00000000031E3000.00000004.00000800.00020000.00000000.sdmp, Server1.exe, 00000005.00000002.3710332991.0000000003075000.00000004.00000800.00020000.00000000.sdmp, Server1.exe, 00000005.00000002.3710332991.0000000003387000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 16:29:52 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/08 \| 12:49:57 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 04:20:14 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/08 \| 14:03:23 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 05:18:19 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/01 \| 16:17:01 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/30 \| 04:45:11 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 17:47:15 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 22:43:32 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/08 \| 12:59:16 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/17 \| 01:38:58 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/17 \| 01:30:27 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/08 \| 13:14:59 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 03:32:04 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/28 \| 00:14:56 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 04:30:49 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/08 \| 13:24:18 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 06:13:31 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 03:38:12 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/08 \| 12:39:22 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/08 \| 12:41:26 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 04:40:08 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 07:05:28 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/01 \| 16:28:29 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/01 \| 16:01:34 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 06:21:06 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 08:02:04 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 22:06:59 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/08 \| 13:32:50 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 07:00:11 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/08 \| 14:34:06 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/30 \| 05:27:49 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 22:54:40 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 06:43:21 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/01 \| 15:50:55 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/21 \| 12:17:04 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/08 \| 13:16:43 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 17:41:44 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 22:38:33 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/28 \| 00:16:40 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/08 \| 14:24:47 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 03:53:28 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/08 \| 12:53:45 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 04:48:00 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 04:38:41 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 21:24:21 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 05:03:43 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 04:50:04 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 05:13:02 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 20:47:39 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/17 \| 01:59:06 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 07:11:00 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/08 \| 13:15:50 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/30 \| 06:19:07 - Program Manager
Source: Server1.exe, 00000005.00000002.3710332991.00000000031E3000.00000004.00000800.00020000.00000000.sdmp, Server1.exe, 00000005.00000002.3710332991.0000000003075000.00000004.00000800.00020000.00000000.sdmp, Server1.exe, 00000005.00000002.3710332991.0000000003387000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 16:48:16 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/17 \| 01:49:47 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/01 \| 13:28:38 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/08 \| 14:23:54 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 04:52:27 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/08 \| 14:33:13 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 03:39:05 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/08 \| 12:42:19 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/21 \| 10:52:13 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 05:37:40 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/01 \| 13:23:21 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 18:58:33 - Program Manager
Source: Server1.exe, 00000005.00000002.3710332991.00000000031E3000.00000004.00000800.00020000.00000000.sdmp, Server1.exe, 00000005.00000002.3710332991.0000000003075000.00000004.00000800.00020000.00000000.sdmp, Server1.exe, 00000005.00000002.3710332991.0000000003387000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 15:58:42 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/17 \| 02:31:10 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 04:47:09 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 23:58:19 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/30 \| 07:12:35 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 05:56:41 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 05:11:18 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/08 \| 13:27:32 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/30 \| 06:26:48 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/17 \| 02:40:52 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 05:01:59 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/08 \| 12:43:49 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 07:01:41 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 04:01:50 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 06:44:14 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/08 \| 12:53:08 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 07:42:59 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/30 \| 08:00:08 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/23 \| 17:09:32 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 07:52:18 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 04:20:51 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 07:12:30 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 08:37:31 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 04:41:38 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 06:37:49 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 05:04:36 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/08 \| 13:38:21 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/23 \| 16:59:46 - Program Manager
Source: Server1.exe, 00000005.00000002.3710332991.00000000031E3000.00000004.00000800.00020000.00000000.sdmp, Server1.exe, 00000005.00000002.3710332991.0000000003075000.00000004.00000800.00020000.00000000.sdmp, Server1.exe, 00000005.00000002.3710332991.0000000003387000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 16:46:52 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 05:39:04 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/08 \| 13:57:22 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/08 \| 14:00:09 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 08:20:34 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 04:30:10 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/08 \| 13:14:20 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 07:07:12 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 03:36:28 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 03:44:23 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 05:26:51 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/17 \| 00:11:34 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 21:29:19 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 08:05:57 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/19 \| 07:33:36 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 05:36:10 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 23:36:02 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/08 \| 14:22:24 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 06:34:55 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/08 \| 13:31:20 - Program Manager
Source: Server1.exe, 00000005.00000002.3710332991.00000000031E3000.00000004.00000800.00020000.00000000.sdmp, Server1.exe, 00000005.00000002.3710332991.0000000003075000.00000004.00000800.00020000.00000000.sdmp, Server1.exe, 00000005.00000002.3710332991.0000000003387000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 16:42:45 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 17:52:33 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 04:57:42 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/08 \| 14:29:25 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 04:48:39 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 05:00:29 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/30 \| 07:35:06 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 06:00:58 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/08 \| 13:19:37 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/08 \| 13:05:17 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 06:12:01 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 07:10:46 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/17 \| 03:46:52 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 08:11:09 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/01 \| 18:04:49 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 07:20:05 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 05:02:13 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 05:51:26 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/01 \| 17:30:23 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 23:39:55 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 07:36:48 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 03:11:19 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 04:05:37 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/23 \| 16:48:57 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 06:28:44 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 06:38:03 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/08 \| 12:58:23 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 21:44:33 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 22:28:18 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 07:06:58 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 22:37:03 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 06:08:13 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 04:00:20 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/30 \| 08:53:43 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/08 \| 13:52:07 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/08 \| 14:31:29 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 05:45:15 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/08 \| 13:42:48 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 20:38:34 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/01 \| 14:58:57 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 06:53:19 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/19 \| 07:31:13 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/01 \| 16:29:59 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 07:59:19 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 20:38:29 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 03:05:08 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 23:53:02 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 08:03:34 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 07:40:36 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 07:38:32 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 17:28:14 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 05:16:55 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 08:32:53 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 07:11:39 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/01 \| 14:24:21 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 08:54:48 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 08:33:24 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/08 \| 13:02:01 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 04:08:51 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 02:32:12 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 05:52:56 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/08 \| 13:01:30 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 04:39:34 - Program Manager
Source: Server1.exe, 00000005.00000002.3710332991.00000000031E3000.00000004.00000800.00020000.00000000.sdmp, Server1.exe, 00000005.00000002.3710332991.0000000003387000.00000004.00000800.00020000.00000000.sdmp, Server1.exe, 00000005.00000002.3710332991.00000000032C2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 17:02:29 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 08:18:47 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 05:53:27 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/30 \| 04:46:04 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/21 \| 12:25:16 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 04:45:23 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/08 \| 13:32:13 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/21 \| 12:03:21 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 03:40:16 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 04:44:52 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 05:32:03 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 05:33:33 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/08 \| 13:07:18 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 08:26:05 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 04:09:22 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/08 \| 14:10:05 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/01 \| 16:47:50 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 02:26:23 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/01 \| 13:03:07 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 05:17:26 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/01 \| 13:57:35 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/08 \| 13:06:47 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 06:24:59 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 02:52:06 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 08:13:30 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/08 \| 14:04:16 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 07:26:50 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/30 \| 07:36:36 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/01 \| 12:49:31 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 05:36:49 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 08:52:47 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 06:05:36 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 07:18:01 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/30 \| 06:28:32 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/30 \| 06:59:15 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 17:56:57 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 07:44:43 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 05:01:20 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/23 \| 17:00:30 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/08 \| 13:17:36 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 04:12:19 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 05:28:15 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 08:48:59 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 22:24:31 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/01 \| 12:46:39 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/08 \| 13:54:08 - Program Manager
Source: Server1.exe	Binary or memory string: Shell_traywnd+MostrarBarraDeTarefas
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/08 \| 14:28:32 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/08 \| 13:39:51 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/08 \| 12:46:04 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 08:29:36 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 08:02:41 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/17 \| 02:38:11 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 05:47:38 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/01 \| 15:51:48 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 05:20:43 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/23 \| 16:02:02 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 06:58:34 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/30 \| 05:43:19 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 08:34:54 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 17:40:51 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 22:17:29 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/17 \| 01:42:09 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 03:26:30 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 04:13:10 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/21 \| 11:42:24 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 06:31:02 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/01 \| 18:08:34 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/08 \| 14:26:31 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 07:14:31 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/08 \| 14:17:43 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 06:27:51 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 06:15:54 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 09:06:57 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 08:45:43 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/08 \| 13:49:49 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 08:22:35 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/17 \| 02:11:55 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/08 \| 14:01:00 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/21 \| 10:49:55 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/08 \| 14:20:23 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 04:53:57 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/01 \| 13:24:51 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 05:42:38 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 07:19:48 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 04:22:37 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 04:54:28 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 05:59:57 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/30 \| 09:01:08 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 04:28:45 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/17 \| 01:36:35 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/28 \| 00:41:15 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/08 \| 13:41:18 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/01 \| 12:37:34 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 06:50:25 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 04:32:33 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/01 \| 14:22:20 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 05:42:21 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/01 \| 17:19:53 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 07:27:06 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 08:43:59 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 07:57:33 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 06:46:37 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/08 \| 13:53:37 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/21 \| 11:57:59 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/08 \| 13:59:45 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 06:25:50 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/30 \| 08:58:21 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/08 \| 14:16:35 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 06:19:02 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 05:38:33 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 08:43:42 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 21:49:11 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/08 \| 13:34:14 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 06:27:14 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 21:06:50 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 04:56:12 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/08 \| 13:10:35 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/08 \| 13:18:07 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 05:19:10 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 23:03:35 - Program Manager
Source: Server1.exe, 00000005.00000002.3710332991.00000000031E3000.00000004.00000800.00020000.00000000.sdmp, Server1.exe, 00000005.00000002.3710332991.0000000003075000.00000004.00000800.00020000.00000000.sdmp, Server1.exe, 00000005.00000002.3710332991.0000000003387000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 15:30:19 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 06:03:35 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 05:28:52 - Program Manager
Source: Server1.exe, 00000005.00000002.3710332991.00000000031E3000.00000004.00000800.00020000.00000000.sdmp, Server1.exe, 00000005.00000002.3710332991.0000000003075000.00000004.00000800.00020000.00000000.sdmp, Server1.exe, 00000005.00000002.3710332991.0000000003387000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 16:47:45 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 06:48:38 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 04:07:38 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/30 \| 05:44:10 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 07:34:47 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 05:05:29 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/21 \| 12:01:37 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 07:35:18 - Program Manager
Source: Server1.exe, 00000005.00000002.3710332991.00000000031E3000.00000004.00000800.00020000.00000000.sdmp, Server1.exe, 00000005.00000002.3710332991.0000000003075000.00000004.00000800.00020000.00000000.sdmp, Server1.exe, 00000005.00000002.3710332991.0000000003387000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 15:39:41 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/17 \| 02:02:50 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/30 \| 08:57:13 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 08:56:32 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 08:00:57 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 17:25:37 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/23 \| 16:22:18 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/01 \| 16:35:48 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 04:14:03 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 20:09:15 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/01 \| 15:07:50 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/08 \| 13:55:21 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/30 \| 09:06:45 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 18:59:04 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 04:02:21 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/01 \| 13:33:56 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/30 \| 06:22:02 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/30 \| 09:18:27 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/08 \| 13:18:44 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/08 \| 14:27:24 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 08:44:50 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/08 \| 14:15:42 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/01 \| 15:59:57 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 05:52:19 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 19:38:48 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 08:23:28 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 08:01:33 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 20:39:27 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/01 \| 17:03:27 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 03:45:53 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/17 \| 00:49:55 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 06:37:32 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/01 \| 14:32:18 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/08 \| 13:09:02 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 21:12:02 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/30 \| 09:17:34 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/08 \| 13:30:29 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 19:56:02 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 05:55:11 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/08 \| 13:33:21 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/08 \| 14:17:06 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 04:29:38 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 21:41:38 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 06:47:45 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 07:08:59 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 18:08:29 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/17 \| 03:43:38 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 04:33:26 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 07:55:49 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/08 \| 12:57:30 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 18:32:48 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 05:22:07 - Program Manager
Source: Server1.exe, 00000005.00000002.3710332991.00000000031E3000.00000004.00000800.00020000.00000000.sdmp, Server1.exe, 00000005.00000002.3710332991.0000000003075000.00000004.00000800.00020000.00000000.sdmp, Server1.exe, 00000005.00000002.3710332991.0000000003387000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 15:53:42 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 06:41:20 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 07:30:01 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 03:36:11 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 06:07:20 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/30 \| 05:28:40 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 07:15:24 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 08:36:01 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 06:26:43 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/08 \| 14:04:53 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/21 \| 12:40:30 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/08 \| 14:06:17 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/21 \| 12:16:11 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/08 \| 12:56:22 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 06:54:10 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/01 \| 13:23:38 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/01 \| 17:36:31 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 05:32:40 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/08 \| 12:54:38 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 07:26:13 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/08 \| 13:11:06 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/08 \| 13:52:44 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/08 \| 13:28:25 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 19:27:59 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 21:42:14 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/30 \| 06:48:26 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 03:51:05 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/01 \| 12:52:11 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/28 \| 01:13:18 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 03:56:42 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 05:49:39 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 07:01:58 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 08:34:17 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 08:10:38 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/01 \| 15:31:17 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 07:45:36 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/01 \| 16:24:59 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/08 \| 14:32:20 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/01 \| 12:40:09 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 04:23:08 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 06:30:31 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/21 \| 12:35:34 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 07:50:32 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/17 \| 03:57:04 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 03:34:27 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/08 \| 14:31:12 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 22:25:02 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/17 \| 03:53:56 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 03:57:50 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/17 \| 00:53:43 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 03:58:06 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 04:35:10 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 05:10:25 - Program Manager
Source: Server1.exe, 00000005.00000002.3711358659.0000000003F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/06 \| 03:54:58 - Program Manager

Source: C:\Windows\SysWOW64\netsh.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\Server1.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Contains functionality to disable the Task Manager (.Net Source)

Source: Server1.exe, Fransesco.cs

.Net Code: INS

Disables zone checking for all users

Source: C:\Users\user\Desktop\Server1.exe

Registry value created: HKEY_CURRENT_USER\Environment SEE_MASK_NOZONECHECKS

Jump to behavior

Modifies the windows firewall

Source: C:\Users\user\Desktop\Server1.exe

Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Users\user\Desktop\Server1.exe" "Server1.exe" ENABLE

Uses netsh to modify the Windows network and firewall settings

Source: C:\Users\user\Desktop\Server1.exe

Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Users\user\Desktop\Server1.exe" "Server1.exe" ENABLE

Stealing of Sensitive Information

Yara detected Njrat

Source: Yara match	File source: Server1.exe, type: SAMPLE
Source: Yara match	File source: 5.0.Server1.exe.980000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000000.1270611811.0000000000982000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3710332991.0000000002F91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Server1.exe PID: 6388, type: MEMORYSTR

Remote Access Functionality

Yara detected Njrat

Source: Yara match	File source: Server1.exe, type: SAMPLE
Source: Yara match	File source: 5.0.Server1.exe.980000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000000.1270611811.0000000000982000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3710332991.0000000002F91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Server1.exe PID: 6388, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	11 Replication Through Removable Media	Windows Management Instrumentation	1 DLL Side-Loading	1 Access Token Manipulation	1 Masquerading	OS Credential Dumping	1 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	2 Process Injection	2 Virtualization/Sandbox Evasion	LSASS Memory	2 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Clipboard Data	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	41 Disable or Modify Tools	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Access Token Manipulation	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	1 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Process Injection	LSA Secrets	1 Peripheral Device Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Software Packing	Cached Domain Credentials	12 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
Server1.exe	87%	ReversingLabs	ByteCode-MSIL.Backdoor.njRAT
Server1.exe	100%	Avira	TR/Dropper.Gen
Server1.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
http://go.microsoft.LinkId=42127	0%	Avira URL Cloud	safe
http://go.microsoft.	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
exchange-reasonably.gl.at.ply.gg	147.185.221.17	true	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://go.microsoft.	Server1.exe, 00000005.00000002.3709532390.0000000000F19000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://go.microsoft.LinkId=42127	Server1.exe, 00000005.00000002.3709532390.0000000000F19000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
147.185.221.17	exchange-reasonably.gl.at.ply.gg	United States		12087	SALSGIVERUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1575627
Start date and time:	2024-12-16 07:22:54 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 44s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Server1.exe
Detection:	MAL
Classification:	mal100.spre.phis.troj.evad.winEXE@4/2@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 98% Number of executed functions: 119 Number of non-executed functions: 12
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240s for sample files taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, sppsvc.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 13.107.246.63, 172.202.163.200
Excluded domains from analysis (whitelisted): otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: Server1.exe

Simulations

Behavior and APIs

Time	Type	Description
03:19:11	API Interceptor	526247x Sleep call for process: Server1.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
147.185.221.17	5q4X9fRo4b.exe	Get hash	malicious	AsyncRAT, XWorm	Browse
	IWsK3V2Ul9.exe	Get hash	malicious	ArrowRAT	Browse
	SecuriteInfo.com.Trojan.Siggen29.35475.19245.6407.exe	Get hash	malicious	SheetRat	Browse
	80c619d931fa4e5c89fe87aac0b6b143.exe	Get hash	malicious	XWorm	Browse
	6ab092aeab924edb854b3ff21ea579df.exe	Get hash	malicious	XWorm	Browse
	Hoodbyunlock.exe	Get hash	malicious	XWorm	Browse
	x.exe	Get hash	malicious	XWorm	Browse
	cougif6lqM.exe	Get hash	malicious	DCRat, XWorm	Browse
	FUDE.bin.exe	Get hash	malicious	XWorm	Browse
	system47.exe	Get hash	malicious	XWorm	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SALSGIVERUS	njSilent.exe	Get hash	malicious	Njrat	Browse	147.185.221.19
	Minet.exe	Get hash	malicious	Njrat	Browse	147.185.221.22
	Discordd.exe	Get hash	malicious	AsyncRAT	Browse	147.185.221.18
	Discord2.exe	Get hash	malicious	AsyncRAT	Browse	147.185.221.18
	Discord3.exe	Get hash	malicious	AsyncRAT	Browse	147.185.221.18
	Loader.exe	Get hash	malicious	AsyncRAT	Browse	147.185.221.20
	72OWK7wBVH.exe	Get hash	malicious	XWorm	Browse	147.185.221.24
	aZDwfEKorn.exe	Get hash	malicious	XWorm	Browse	147.185.221.24
	HdTSntLSMB.exe	Get hash	malicious	XWorm	Browse	147.185.221.24
	7laJ4zKd8O.exe	Get hash	malicious	XWorm	Browse	147.185.221.18

Process:	C:\Users\user\Desktop\Server1.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with no line terminators
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:1n:1
MD5:	02B81B0CBE1FAAA1FA62D5FC876AB443
SHA1:	D473CFE21FB1F188689415B0BDD239688F8FDDD9
SHA-256:	E7E9E2C247BC872BACCE77661C78F001A17D70EE3130A9016A5818DA9DA00CDB
SHA-512:	592AB5B200D4C560951CB70288DC1B7A562F0CBFAEE01CE03076B6934D537B88575C2E1E0FEDCC05DB95E6C224CA739923E7D74F9165E683F3FBAD7BBF641784
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	.16

\Device\ConDrv

Download File

Process:	C:\Windows\SysWOW64\netsh.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	313
Entropy (8bit):	4.971939296804078
Encrypted:	false
SSDEEP:	6:/ojfKsUTGN8Ypox42k9L+DbGMKeQE+vigqAZs2E+AYeDPO+Yswyha:wjPIGNrkHk9iaeIM6ADDPOHyha
MD5:	689E2126A85BF55121488295EE068FA1
SHA1:	09BAAA253A49D80C18326DFBCA106551EBF22DD6
SHA-256:	D968A966EF474068E41256321F77807A042F1965744633D37A203A705662EC25
SHA-512:	C3736A8FC7E6573FA1B26FE6A901C05EE85C55A4A276F8F569D9EADC9A58BEC507D1BB90DBF9EA62AE79A6783178C69304187D6B90441D82E46F5F56172B5C5C
Malicious:	false
Reputation:	high, very likely benign file
Preview:	..IMPORTANT: Command executed successfully...However, "netsh firewall" is deprecated;..use "netsh advfirewall firewall" instead...For more information on using "netsh advfirewall firewall" commands..instead of "netsh firewall", see KB article 947709..at https://go.microsoft.com/fwlink/?linkid=121488 .....Ok.....

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.566845908613344
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	Server1.exe
File size:	95'232 bytes
MD5:	71b3810a22e1b51e8b88cd63b5e23ba0
SHA1:	7ac4ab80301dcabcc97ec68093ed775d148946de
SHA256:	57bf3ab110dc44c56ed5a53b02b8c9ccc24054cf9c9a5aacc72f71a992138a3f
SHA512:	85ddc05305902ed668981b2c33bab16f8e5a5d9db9ff1cee4d4a06c917075e7d59776bebfb3a3128ec4432db63f07c593af6f4907a5b75c9027f1bc9538612e8
SSDEEP:	1536:PUNJD/HBZbszKu9AZpE7r1jEwzGi1dDWDtgS:PUUzK4AZCHCi1dA6
TLSH:	7D93E94977E52524E0BF56F75471F2014E34B48B1612E39D58F219AA0B33AC48F8AFEB
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....be.................p............... ........@.. ....................................@................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x418f1e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x656291C7 [Sun Nov 26 00:31:03 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x18ed0	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1a000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x16f24	0x17000	c577ce6089fb21c8c7c8fb2b5f3c04a1	False	0.3683975883152174	data	5.598588890470676	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.reloc	0x1a000	0xc	0x200	9dc49a004fa3bd643fadc899ad4fdf5d	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-16T07:23:58.698019+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.7	49701	147.185.221.17	30620	TCP
2024-12-16T07:23:58.698019+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.7	49701	147.185.221.17	30620	TCP
2024-12-16T07:24:04.876444+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49701	147.185.221.17	30620	TCP
2024-12-16T07:24:22.650603+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.7	49751	147.185.221.17	30620	TCP
2024-12-16T07:24:22.650603+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.7	49751	147.185.221.17	30620	TCP
2024-12-16T07:24:46.687454+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.7	49803	147.185.221.17	30620	TCP
2024-12-16T07:24:46.687454+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.7	49803	147.185.221.17	30620	TCP
2024-12-16T07:24:47.828553+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49803	147.185.221.17	30620	TCP
2024-12-16T07:25:10.750212+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.7	49859	147.185.221.17	30620	TCP
2024-12-16T07:25:10.750212+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.7	49859	147.185.221.17	30620	TCP
2024-12-16T07:25:34.794300+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.7	49912	147.185.221.17	30620	TCP
2024-12-16T07:25:34.794300+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.7	49912	147.185.221.17	30620	TCP
2024-12-16T07:25:58.829680+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.7	49965	147.185.221.17	30620	TCP
2024-12-16T07:25:58.829680+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.7	49965	147.185.221.17	30620	TCP
2024-12-16T07:26:23.028794+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.7	49978	147.185.221.17	30620	TCP
2024-12-16T07:26:23.028794+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.7	49978	147.185.221.17	30620	TCP
2024-12-16T07:26:27.000700+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49978	147.185.221.17	30620	TCP
2024-12-16T07:26:47.155397+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.7	49979	147.185.221.17	30620	TCP
2024-12-16T07:26:47.155397+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.7	49979	147.185.221.17	30620	TCP
2024-12-16T07:26:49.016502+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49979	147.185.221.17	30620	TCP
2024-12-16T07:27:11.200852+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.7	49980	147.185.221.17	30620	TCP
2024-12-16T07:27:11.200852+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.7	49980	147.185.221.17	30620	TCP
2024-12-16T07:27:35.232085+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.7	49981	147.185.221.17	30620	TCP
2024-12-16T07:27:35.232085+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.7	49981	147.185.221.17	30620	TCP
2024-12-16T07:27:41.446148+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49981	147.185.221.17	30620	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 16, 2024 07:23:58.500833988 CET	49701	30620	192.168.2.7	147.185.221.17
Dec 16, 2024 07:23:58.622582912 CET	30620	49701	147.185.221.17	192.168.2.7
Dec 16, 2024 07:23:58.622661114 CET	49701	30620	192.168.2.7	147.185.221.17
Dec 16, 2024 07:23:58.698019028 CET	49701	30620	192.168.2.7	147.185.221.17
Dec 16, 2024 07:23:58.817837954 CET	30620	49701	147.185.221.17	192.168.2.7
Dec 16, 2024 07:23:58.817893028 CET	49701	30620	192.168.2.7	147.185.221.17
Dec 16, 2024 07:23:58.937846899 CET	30620	49701	147.185.221.17	192.168.2.7
Dec 16, 2024 07:24:04.876444101 CET	49701	30620	192.168.2.7	147.185.221.17
Dec 16, 2024 07:24:04.996191978 CET	30620	49701	147.185.221.17	192.168.2.7
Dec 16, 2024 07:24:20.503690958 CET	30620	49701	147.185.221.17	192.168.2.7
Dec 16, 2024 07:24:20.503818035 CET	49701	30620	192.168.2.7	147.185.221.17
Dec 16, 2024 07:24:22.528219938 CET	49701	30620	192.168.2.7	147.185.221.17
Dec 16, 2024 07:24:22.529797077 CET	49751	30620	192.168.2.7	147.185.221.17
Dec 16, 2024 07:24:22.647969961 CET	30620	49701	147.185.221.17	192.168.2.7
Dec 16, 2024 07:24:22.649504900 CET	30620	49751	147.185.221.17	192.168.2.7
Dec 16, 2024 07:24:22.649575949 CET	49751	30620	192.168.2.7	147.185.221.17
Dec 16, 2024 07:24:22.650603056 CET	49751	30620	192.168.2.7	147.185.221.17
Dec 16, 2024 07:24:22.770282030 CET	30620	49751	147.185.221.17	192.168.2.7
Dec 16, 2024 07:24:22.770363092 CET	49751	30620	192.168.2.7	147.185.221.17
Dec 16, 2024 07:24:22.890125990 CET	30620	49751	147.185.221.17	192.168.2.7
Dec 16, 2024 07:24:44.550930023 CET	30620	49751	147.185.221.17	192.168.2.7
Dec 16, 2024 07:24:44.551035881 CET	49751	30620	192.168.2.7	147.185.221.17
Dec 16, 2024 07:24:46.563450098 CET	49751	30620	192.168.2.7	147.185.221.17
Dec 16, 2024 07:24:46.566596031 CET	49803	30620	192.168.2.7	147.185.221.17
Dec 16, 2024 07:24:46.683432102 CET	30620	49751	147.185.221.17	192.168.2.7
Dec 16, 2024 07:24:46.686357975 CET	30620	49803	147.185.221.17	192.168.2.7
Dec 16, 2024 07:24:46.686561108 CET	49803	30620	192.168.2.7	147.185.221.17
Dec 16, 2024 07:24:46.687453985 CET	49803	30620	192.168.2.7	147.185.221.17
Dec 16, 2024 07:24:46.807226896 CET	30620	49803	147.185.221.17	192.168.2.7
Dec 16, 2024 07:24:46.807332993 CET	49803	30620	192.168.2.7	147.185.221.17
Dec 16, 2024 07:24:46.927201986 CET	30620	49803	147.185.221.17	192.168.2.7
Dec 16, 2024 07:24:47.828552961 CET	49803	30620	192.168.2.7	147.185.221.17
Dec 16, 2024 07:24:47.948384047 CET	30620	49803	147.185.221.17	192.168.2.7
Dec 16, 2024 07:25:08.618840933 CET	30620	49803	147.185.221.17	192.168.2.7
Dec 16, 2024 07:25:08.618974924 CET	49803	30620	192.168.2.7	147.185.221.17
Dec 16, 2024 07:25:10.625458002 CET	49803	30620	192.168.2.7	147.185.221.17
Dec 16, 2024 07:25:10.626734972 CET	49859	30620	192.168.2.7	147.185.221.17
Dec 16, 2024 07:25:10.745336056 CET	30620	49803	147.185.221.17	192.168.2.7
Dec 16, 2024 07:25:10.746530056 CET	30620	49859	147.185.221.17	192.168.2.7
Dec 16, 2024 07:25:10.746624947 CET	49859	30620	192.168.2.7	147.185.221.17
Dec 16, 2024 07:25:10.750211954 CET	49859	30620	192.168.2.7	147.185.221.17
Dec 16, 2024 07:25:10.869990110 CET	30620	49859	147.185.221.17	192.168.2.7
Dec 16, 2024 07:25:10.870165110 CET	49859	30620	192.168.2.7	147.185.221.17
Dec 16, 2024 07:25:10.990340948 CET	30620	49859	147.185.221.17	192.168.2.7
Dec 16, 2024 07:25:32.665421963 CET	30620	49859	147.185.221.17	192.168.2.7
Dec 16, 2024 07:25:32.665591955 CET	49859	30620	192.168.2.7	147.185.221.17
Dec 16, 2024 07:25:34.672353029 CET	49859	30620	192.168.2.7	147.185.221.17
Dec 16, 2024 07:25:34.673355103 CET	49912	30620	192.168.2.7	147.185.221.17
Dec 16, 2024 07:25:34.792296886 CET	30620	49859	147.185.221.17	192.168.2.7
Dec 16, 2024 07:25:34.793104887 CET	30620	49912	147.185.221.17	192.168.2.7
Dec 16, 2024 07:25:34.793239117 CET	49912	30620	192.168.2.7	147.185.221.17
Dec 16, 2024 07:25:34.794300079 CET	49912	30620	192.168.2.7	147.185.221.17
Dec 16, 2024 07:25:34.914026976 CET	30620	49912	147.185.221.17	192.168.2.7
Dec 16, 2024 07:25:34.914119005 CET	49912	30620	192.168.2.7	147.185.221.17
Dec 16, 2024 07:25:35.033868074 CET	30620	49912	147.185.221.17	192.168.2.7
Dec 16, 2024 07:25:56.697138071 CET	30620	49912	147.185.221.17	192.168.2.7
Dec 16, 2024 07:25:56.697336912 CET	49912	30620	192.168.2.7	147.185.221.17
Dec 16, 2024 07:25:58.703730106 CET	49912	30620	192.168.2.7	147.185.221.17
Dec 16, 2024 07:25:58.705298901 CET	49965	30620	192.168.2.7	147.185.221.17
Dec 16, 2024 07:25:58.823873997 CET	30620	49912	147.185.221.17	192.168.2.7
Dec 16, 2024 07:25:58.825046062 CET	30620	49965	147.185.221.17	192.168.2.7
Dec 16, 2024 07:25:58.828310013 CET	49965	30620	192.168.2.7	147.185.221.17
Dec 16, 2024 07:25:58.829679966 CET	49965	30620	192.168.2.7	147.185.221.17
Dec 16, 2024 07:25:58.949562073 CET	30620	49965	147.185.221.17	192.168.2.7
Dec 16, 2024 07:25:58.949655056 CET	49965	30620	192.168.2.7	147.185.221.17
Dec 16, 2024 07:25:59.069861889 CET	30620	49965	147.185.221.17	192.168.2.7
Dec 16, 2024 07:26:20.881879091 CET	30620	49965	147.185.221.17	192.168.2.7
Dec 16, 2024 07:26:20.881993055 CET	49965	30620	192.168.2.7	147.185.221.17
Dec 16, 2024 07:26:22.906776905 CET	49965	30620	192.168.2.7	147.185.221.17
Dec 16, 2024 07:26:22.907991886 CET	49978	30620	192.168.2.7	147.185.221.17
Dec 16, 2024 07:26:23.026712894 CET	30620	49965	147.185.221.17	192.168.2.7
Dec 16, 2024 07:26:23.027715921 CET	30620	49978	147.185.221.17	192.168.2.7
Dec 16, 2024 07:26:23.027816057 CET	49978	30620	192.168.2.7	147.185.221.17
Dec 16, 2024 07:26:23.028794050 CET	49978	30620	192.168.2.7	147.185.221.17
Dec 16, 2024 07:26:23.148524046 CET	30620	49978	147.185.221.17	192.168.2.7
Dec 16, 2024 07:26:23.148665905 CET	49978	30620	192.168.2.7	147.185.221.17
Dec 16, 2024 07:26:23.268637896 CET	30620	49978	147.185.221.17	192.168.2.7
Dec 16, 2024 07:26:27.000699997 CET	49978	30620	192.168.2.7	147.185.221.17
Dec 16, 2024 07:26:27.120793104 CET	30620	49978	147.185.221.17	192.168.2.7
Dec 16, 2024 07:26:44.944425106 CET	30620	49978	147.185.221.17	192.168.2.7
Dec 16, 2024 07:26:44.944509983 CET	49978	30620	192.168.2.7	147.185.221.17
Dec 16, 2024 07:26:47.032155037 CET	49978	30620	192.168.2.7	147.185.221.17
Dec 16, 2024 07:26:47.034704924 CET	49979	30620	192.168.2.7	147.185.221.17
Dec 16, 2024 07:26:47.152295113 CET	30620	49978	147.185.221.17	192.168.2.7
Dec 16, 2024 07:26:47.154401064 CET	30620	49979	147.185.221.17	192.168.2.7
Dec 16, 2024 07:26:47.154516935 CET	49979	30620	192.168.2.7	147.185.221.17
Dec 16, 2024 07:26:47.155396938 CET	49979	30620	192.168.2.7	147.185.221.17
Dec 16, 2024 07:26:47.275249958 CET	30620	49979	147.185.221.17	192.168.2.7
Dec 16, 2024 07:26:47.275397062 CET	49979	30620	192.168.2.7	147.185.221.17
Dec 16, 2024 07:26:47.395294905 CET	30620	49979	147.185.221.17	192.168.2.7
Dec 16, 2024 07:26:49.016501904 CET	49979	30620	192.168.2.7	147.185.221.17
Dec 16, 2024 07:26:49.136557102 CET	30620	49979	147.185.221.17	192.168.2.7
Dec 16, 2024 07:27:09.069859028 CET	30620	49979	147.185.221.17	192.168.2.7
Dec 16, 2024 07:27:09.070014000 CET	49979	30620	192.168.2.7	147.185.221.17
Dec 16, 2024 07:27:11.078763962 CET	49979	30620	192.168.2.7	147.185.221.17
Dec 16, 2024 07:27:11.079936981 CET	49980	30620	192.168.2.7	147.185.221.17
Dec 16, 2024 07:27:11.198924065 CET	30620	49979	147.185.221.17	192.168.2.7
Dec 16, 2024 07:27:11.199647903 CET	30620	49980	147.185.221.17	192.168.2.7
Dec 16, 2024 07:27:11.199760914 CET	49980	30620	192.168.2.7	147.185.221.17
Dec 16, 2024 07:27:11.200851917 CET	49980	30620	192.168.2.7	147.185.221.17
Dec 16, 2024 07:27:11.320852995 CET	30620	49980	147.185.221.17	192.168.2.7
Dec 16, 2024 07:27:11.320913076 CET	49980	30620	192.168.2.7	147.185.221.17
Dec 16, 2024 07:27:11.440854073 CET	30620	49980	147.185.221.17	192.168.2.7
Dec 16, 2024 07:27:33.105031967 CET	30620	49980	147.185.221.17	192.168.2.7
Dec 16, 2024 07:27:33.105175018 CET	49980	30620	192.168.2.7	147.185.221.17
Dec 16, 2024 07:27:35.110023975 CET	49980	30620	192.168.2.7	147.185.221.17
Dec 16, 2024 07:27:35.111274958 CET	49981	30620	192.168.2.7	147.185.221.17
Dec 16, 2024 07:27:35.230189085 CET	30620	49980	147.185.221.17	192.168.2.7
Dec 16, 2024 07:27:35.231062889 CET	30620	49981	147.185.221.17	192.168.2.7
Dec 16, 2024 07:27:35.231206894 CET	49981	30620	192.168.2.7	147.185.221.17
Dec 16, 2024 07:27:35.232084990 CET	49981	30620	192.168.2.7	147.185.221.17
Dec 16, 2024 07:27:35.353245020 CET	30620	49981	147.185.221.17	192.168.2.7
Dec 16, 2024 07:27:35.353308916 CET	49981	30620	192.168.2.7	147.185.221.17
Dec 16, 2024 07:27:35.474486113 CET	30620	49981	147.185.221.17	192.168.2.7
Dec 16, 2024 07:27:41.446147919 CET	49981	30620	192.168.2.7	147.185.221.17
Dec 16, 2024 07:27:41.566370964 CET	30620	49981	147.185.221.17	192.168.2.7
Dec 16, 2024 07:27:57.128995895 CET	30620	49981	147.185.221.17	192.168.2.7
Dec 16, 2024 07:27:57.129071951 CET	49981	30620	192.168.2.7	147.185.221.17

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 16, 2024 07:23:58.236129045 CET	49990	53	192.168.2.7	1.1.1.1
Dec 16, 2024 07:23:58.485513926 CET	53	49990	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 16, 2024 07:23:58.236129045 CET	192.168.2.7	1.1.1.1	0x7fb5	Standard query (0)	exchange-reasonably.gl.at.ply.gg	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 16, 2024 07:23:58.485513926 CET	1.1.1.1	192.168.2.7	0x7fb5	No error (0)	exchange-reasonably.gl.at.ply.gg		147.185.221.17	A (IP address)	IN (0x0001)	false

Target ID:	5
Start time:	01:23:50
Start date:	16/12/2024
Path:	C:\Users\user\Desktop\Server1.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Server1.exe"
Imagebase:	0x980000
File size:	95'232 bytes
MD5 hash:	71B3810A22E1B51E8B88CD63B5E23BA0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: 00000005.00000000.1270611811.0000000000982000.00000002.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: 00000005.00000000.1270611811.0000000000982000.00000002.00000001.01000000.00000004.sdmp, Author: unknown Rule: Njrat, Description: detect njRAT in memory, Source: 00000005.00000000.1270611811.0000000000982000.00000002.00000001.01000000.00000004.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: 00000005.00000002.3710332991.0000000002F91000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	01:23:53
Start date:	16/12/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh firewall add allowedprogram "C:\Users\user\Desktop\Server1.exe" "Server1.exe" ENABLE
Imagebase:	0x1770000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	01:23:53
Start date:	16/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	11.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	3.1%
Total number of Nodes:	96
Total number of Limit Nodes:	6

Executed Functions

Function 05154298 Relevance: 10.7, Strings: 7, Instructions: 1950
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

:@cl, xrefs: 05154CF3
:@cl, xrefs: 05156CF5
:@cl, xrefs: 05154E43
:@cl, xrefs: 05154D9A
:@cl, xrefs: 05154582
:@cl, xrefs: 05155541
@, xrefs: 05154C24

Memory Dump Source

Source File: 00000005.00000002.3713741754.0000000005150000.00000040.00000800.00020000.00000000.sdmp, Offset: 05150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5150000_Server1.jbxd

Similarity

API ID:
String ID: :@cl$:@cl$:@cl$:@cl$:@cl$:@cl$@
API String ID: 0-2663817365
Opcode ID: 8716b966bc84396fbdf390ee2ca3a74b4001dce554ad42bfa6d03585a2f4da8b
Instruction ID: 936051756fddfda9b1227880c10bf5c2366fc27379e57c12aa3dcf773101a0ae
Opcode Fuzzy Hash: 8716b966bc84396fbdf390ee2ca3a74b4001dce554ad42bfa6d03585a2f4da8b
Instruction Fuzzy Hash: 6B233A74A0122CCFDB25EF34D9A4BA9B7B2BB88308F4040EAD91967394DB355E85CF50

Function 05154287 Relevance: 10.5, Strings: 7, Instructions: 1751
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 05154BC4
:@cl, xrefs: 05154CF3
:@cl, xrefs: 05156CF5
:@cl, xrefs: 05154E43
:@cl, xrefs: 05154D9A
:@cl, xrefs: 05154582
:@cl, xrefs: 05155541

Memory Dump Source

Source File: 00000005.00000002.3713741754.0000000005150000.00000040.00000800.00020000.00000000.sdmp, Offset: 05150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5150000_Server1.jbxd

Similarity

API ID:
String ID: $:@cl$:@cl$:@cl$:@cl$:@cl$:@cl
API String ID: 0-1110365883
Opcode ID: 2f0e9060797203ad09426a05b98e8d6d056fbb20dd398c45279d2cef4a1b40b7
Instruction ID: 1d28ed24fb5c33ae85d644ebe7d4cf7ed32fbcff690556408ee2c136354ca7af
Opcode Fuzzy Hash: 2f0e9060797203ad09426a05b98e8d6d056fbb20dd398c45279d2cef4a1b40b7
Instruction Fuzzy Hash: 4B132874A01228CFDB25EF34D9A4BA9B7B2FB48308F4041EAD91967398DB715E85CF50

Function 051544F1 Relevance: 10.4, Strings: 7, Instructions: 1624
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 05154BC4
:@cl, xrefs: 05154CF3
:@cl, xrefs: 05156CF5
:@cl, xrefs: 05154E43
:@cl, xrefs: 05154D9A
:@cl, xrefs: 05154582
:@cl, xrefs: 05155541

Memory Dump Source

Source File: 00000005.00000002.3713741754.0000000005150000.00000040.00000800.00020000.00000000.sdmp, Offset: 05150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5150000_Server1.jbxd

Similarity

API ID:
String ID: $:@cl$:@cl$:@cl$:@cl$:@cl$:@cl
API String ID: 0-1110365883
Opcode ID: 6d93ff4309f9bdd3d12412c1edd72a203f08ac263d112eed760899ab70f41cf9
Instruction ID: 871ee089454f7a4e3fabcfcc83b3cd13f39cf680a6a9c42119edbe3e2d2ef1cc
Opcode Fuzzy Hash: 6d93ff4309f9bdd3d12412c1edd72a203f08ac263d112eed760899ab70f41cf9
Instruction Fuzzy Hash: 9C033774A0122CCFDB25EF34D9A4BA9B7B2BB48308F4041EAD91967398DB715E85CF50

Function 05154544 Relevance: 10.4, Strings: 7, Instructions: 1618
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 05154BC4
:@cl, xrefs: 05154CF3
:@cl, xrefs: 05156CF5
:@cl, xrefs: 05154E43
:@cl, xrefs: 05154D9A
:@cl, xrefs: 05154582
:@cl, xrefs: 05155541

Memory Dump Source

Source File: 00000005.00000002.3713741754.0000000005150000.00000040.00000800.00020000.00000000.sdmp, Offset: 05150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5150000_Server1.jbxd

Similarity

API ID:
String ID: $:@cl$:@cl$:@cl$:@cl$:@cl$:@cl
API String ID: 0-1110365883
Opcode ID: 77efdd1b56ba3b5c8ceec74117290ed0ad3e327e42b04de345740ff589cd27b4
Instruction ID: 696f06d979d53b7e25ccc91ae045fdada09000495927ed8f3d19699cf16f6757
Opcode Fuzzy Hash: 77efdd1b56ba3b5c8ceec74117290ed0ad3e327e42b04de345740ff589cd27b4
Instruction Fuzzy Hash: 6B033874A0122CCFDB25EF34D9A4BA9B7B2BB48308F4041EAD91967398DB715E85CF50

Function 05154630 Relevance: 9.1, Strings: 6, Instructions: 1579
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

:@cl, xrefs: 05154CF3
, xrefs: 05154BC4
:@cl, xrefs: 05156CF5
:@cl, xrefs: 05154E43
:@cl, xrefs: 05154D9A
:@cl, xrefs: 05155541

Memory Dump Source

Source File: 00000005.00000002.3713741754.0000000005150000.00000040.00000800.00020000.00000000.sdmp, Offset: 05150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5150000_Server1.jbxd

Similarity

API ID:
String ID: $:@cl$:@cl$:@cl$:@cl$:@cl
API String ID: 0-3491856805
Opcode ID: 56dfeec3e48b47e9ee37506378c12e17a91098bb992a304edffd5e97ee75801d
Instruction ID: c887cca3963aa9510f242f934ecc9af2703b679d7f097971264ef30aa1efdd8f
Opcode Fuzzy Hash: 56dfeec3e48b47e9ee37506378c12e17a91098bb992a304edffd5e97ee75801d
Instruction Fuzzy Hash: 8C033874A0122CCFDB25EF34D9A4BA9B7B2BB48308F4041EAD91967398DB715E85CF50

Function 0515470F Relevance: 9.0, Strings: 6, Instructions: 1544
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

:@cl, xrefs: 05154CF3
, xrefs: 05154BC4
:@cl, xrefs: 05156CF5
:@cl, xrefs: 05154E43
:@cl, xrefs: 05154D9A
:@cl, xrefs: 05155541

Memory Dump Source

Source File: 00000005.00000002.3713741754.0000000005150000.00000040.00000800.00020000.00000000.sdmp, Offset: 05150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5150000_Server1.jbxd

Similarity

API ID:
String ID: $:@cl$:@cl$:@cl$:@cl$:@cl
API String ID: 0-3491856805
Opcode ID: 56c04a5a5b7c1e8bd1fa8031c28370accb0a0b2d2a36b85622cb514f37e582a9
Instruction ID: 89a92991667c4c9504644157269c139173bed297703e687c8fc20ad824294726
Opcode Fuzzy Hash: 56c04a5a5b7c1e8bd1fa8031c28370accb0a0b2d2a36b85622cb514f37e582a9
Instruction Fuzzy Hash: F5F23874A0122CCFDB25EF34D9A4BA9B7B2BB48308F4041EAD91967398DB715E85CF50

Function 051547D4 Relevance: 9.0, Strings: 6, Instructions: 1513
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

:@cl, xrefs: 05154CF3
, xrefs: 05154BC4
:@cl, xrefs: 05156CF5
:@cl, xrefs: 05154E43
:@cl, xrefs: 05154D9A
:@cl, xrefs: 05155541

Memory Dump Source

Source File: 00000005.00000002.3713741754.0000000005150000.00000040.00000800.00020000.00000000.sdmp, Offset: 05150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5150000_Server1.jbxd

Similarity

API ID:
String ID: $:@cl$:@cl$:@cl$:@cl$:@cl
API String ID: 0-3491856805
Opcode ID: 2c012ce08219601548ee84e804b6378c2c524313c7079c0c1cec75175efd090e
Instruction ID: 97e8e49075d1f7bedded5a1ef6d3b598369db94f542eed0cf586d4a1e50ef0f6
Opcode Fuzzy Hash: 2c012ce08219601548ee84e804b6378c2c524313c7079c0c1cec75175efd090e
Instruction Fuzzy Hash: 17F23874A0122CCFDB25EF34D9A4BA9B7B2BB48308F4040EAD91967398DB755E85CF50

Function 05154936 Relevance: 9.0, Strings: 6, Instructions: 1456
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

:@cl, xrefs: 05154CF3
, xrefs: 05154BC4
:@cl, xrefs: 05156CF5
:@cl, xrefs: 05154E43
:@cl, xrefs: 05154D9A
:@cl, xrefs: 05155541

Memory Dump Source

Source File: 00000005.00000002.3713741754.0000000005150000.00000040.00000800.00020000.00000000.sdmp, Offset: 05150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5150000_Server1.jbxd

Similarity

API ID:
String ID: $:@cl$:@cl$:@cl$:@cl$:@cl
API String ID: 0-3491856805
Opcode ID: 81f03355fd48a31ab08684f812fbbca85646a8cf7cf80cef99a26b4a92ef9441
Instruction ID: e4d6e9bd69fe74ecc205095957e590e4852a511a0e347cac7ba000637257b89f
Opcode Fuzzy Hash: 81f03355fd48a31ab08684f812fbbca85646a8cf7cf80cef99a26b4a92ef9441
Instruction Fuzzy Hash: C8F23974A0122CCFDB25EF34D9A4BA9B7B2BB48308F4041EAD91967398DB715E85CF50

Function 052C2487 Relevance: 1.6, APIs: 1, Instructions: 75COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.KERNELBASE(?,?,?,?,?,?), ref: 052C2507

Memory Dump Source

Source File: 00000005.00000002.3713847871.00000000052C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_52c0000_Server1.jbxd

Similarity

API ID: AdjustPrivilegesToken
String ID:
API String ID: 2874748243-0
Opcode ID: 99646e5d0b48a6944c789119b957e4e734f82ac9583f6e756cebf955344106d2
Instruction ID: 6b29c16ea3ba32595e0b20359bac1149da2e15ba1a8eaef115d3d551464a8c16
Opcode Fuzzy Hash: 99646e5d0b48a6944c789119b957e4e734f82ac9583f6e756cebf955344106d2
Instruction Fuzzy Hash: 1E219F765097809FDB228F25DC45B62BFB4EF06210F0885DAE9898B163D275E908DB62

Function 052C24BE Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.KERNELBASE(?,?,?,?,?,?), ref: 052C2507

Memory Dump Source

Source File: 00000005.00000002.3713847871.00000000052C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_52c0000_Server1.jbxd

Similarity

API ID: AdjustPrivilegesToken
String ID:
API String ID: 2874748243-0
Opcode ID: 5639e6e861f3921e30c412f0ba4a13cd0963b68efc2ba262135f153fc14ad8e9
Instruction ID: 9d68ba5c438bef18f630c9ca1def023ea4a3103d4856479bf83cc51372ef9a77
Opcode Fuzzy Hash: 5639e6e861f3921e30c412f0ba4a13cd0963b68efc2ba262135f153fc14ad8e9
Instruction Fuzzy Hash: C2119E76500200DFDB20CF15D844B62FBE5EF04220F08C5AEED8A8B662D775E418CB62

Function 051575C9 Relevance: 3.7, Strings: 2, Instructions: 1242COMMON

Download Yara Rule

Strings

:@cl, xrefs: 0515783E
:@cl, xrefs: 0515782D

Memory Dump Source

Source File: 00000005.00000002.3713741754.0000000005150000.00000040.00000800.00020000.00000000.sdmp, Offset: 05150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5150000_Server1.jbxd

Similarity

API ID:
String ID: :@cl$:@cl
API String ID: 0-1618611328
Opcode ID: 947f4f51c3cb07aab98327c590d76ca405cf069e0cd5bb974d65c65d21c71ef2
Instruction ID: 9456d987c9dd7899448c80b275f33062bf09316ce450ba6357966211f0d1846d
Opcode Fuzzy Hash: 947f4f51c3cb07aab98327c590d76ca405cf069e0cd5bb974d65c65d21c71ef2
Instruction Fuzzy Hash: 04C26C34B0816ADFDB299F35D831B797BB2BB48304F1140AB9969933A8CB758D45DF20

Function 05157644 Relevance: 3.6, Strings: 2, Instructions: 1079COMMON

Download Yara Rule

Strings

:@cl, xrefs: 0515783E
:@cl, xrefs: 0515782D

Memory Dump Source

Source File: 00000005.00000002.3713741754.0000000005150000.00000040.00000800.00020000.00000000.sdmp, Offset: 05150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5150000_Server1.jbxd

Similarity

API ID:
String ID: :@cl$:@cl
API String ID: 0-1618611328
Opcode ID: b18d9536bb4a851e12ecfc884622dda6a37728d9f230e75770e889e5fb9a0764
Instruction ID: a4524e2e8ce52f86645c528510f9c1961dd850aee33fdb7706a353ea3368b1b6
Opcode Fuzzy Hash: b18d9536bb4a851e12ecfc884622dda6a37728d9f230e75770e889e5fb9a0764
Instruction Fuzzy Hash: 3C92EE34708169DBDF29AF35D831B797BA7BB88308F11407B986A93398CB758D45DB20

Function 0515767E Relevance: 3.6, Strings: 2, Instructions: 1076COMMON

Download Yara Rule

Strings

:@cl, xrefs: 0515783E
:@cl, xrefs: 0515782D

Memory Dump Source

Source File: 00000005.00000002.3713741754.0000000005150000.00000040.00000800.00020000.00000000.sdmp, Offset: 05150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5150000_Server1.jbxd

Similarity

API ID:
String ID: :@cl$:@cl
API String ID: 0-1618611328
Opcode ID: 84f2dd72cec057a6ee1d589915e4409458165c65acf29ed75c6e1f12877e4710
Instruction ID: b86d5f415483e93e20aa849f2e525028562e861adb5ccfcd409703fa87513732
Opcode Fuzzy Hash: 84f2dd72cec057a6ee1d589915e4409458165c65acf29ed75c6e1f12877e4710
Instruction Fuzzy Hash: 1D92EF34708169DBDF29AF31D831B797BA7BB88308F11407B996A93398CB758D45DB20

Function 051576AD Relevance: 3.6, Strings: 2, Instructions: 1075COMMON

Download Yara Rule

Strings

:@cl, xrefs: 0515783E
:@cl, xrefs: 0515782D

Memory Dump Source

Source File: 00000005.00000002.3713741754.0000000005150000.00000040.00000800.00020000.00000000.sdmp, Offset: 05150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5150000_Server1.jbxd

Similarity

API ID:
String ID: :@cl$:@cl
API String ID: 0-1618611328
Opcode ID: e1b8b8a695c1140a5a5328fd5cc830327deec81648f29609c38d7e80753a8157
Instruction ID: 0f367f51a1fb924d20c17257d23e6e5b5727816546683e03c5823b883cf9a88c
Opcode Fuzzy Hash: e1b8b8a695c1140a5a5328fd5cc830327deec81648f29609c38d7e80753a8157
Instruction Fuzzy Hash: 9292EF34708169DBDF29AF31D831B797BA7BB88308F11407B996A93398CB758D45DB20

Function 052C1F5E Relevance: 1.6, APIs: 1, Instructions: 130
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCreateKeyExW.KERNELBASE(?,00000E24), ref: 052C2059

Memory Dump Source

Source File: 00000005.00000002.3713847871.00000000052C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_52c0000_Server1.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: ce92c1f931651aebf4408ecd1753c142f4b7662f066affb5e8400e28eb52cf0f
Instruction ID: eb6a0a91a357967e6e628e1230629b071528e281f4bc0313f47ae8a2debe67f0
Opcode Fuzzy Hash: ce92c1f931651aebf4408ecd1753c142f4b7662f066affb5e8400e28eb52cf0f
Instruction Fuzzy Hash: 99414D75149384AFE7238B218C54F62BFB8AF06214F0985DBE9C5CB163D664A809CB71

Function 052C04FF Relevance: 1.6, APIs: 1, Instructions: 98
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,?,?), ref: 052C05C6

Memory Dump Source

Source File: 00000005.00000002.3713847871.00000000052C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_52c0000_Server1.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 19753479b9b561eada231597a5036daf80bb0bb0851161f44114c7c809791a9c
Instruction ID: 9560d40a56e7e66934ca109031849cf09644c11750fa6ca2897a581bd0b7615e
Opcode Fuzzy Hash: 19753479b9b561eada231597a5036daf80bb0bb0851161f44114c7c809791a9c
Instruction Fuzzy Hash: A5318D6510E3C0AFD3138B218C65A61BFB4EF47610F0E85CBD8848F6A3D2596809D7B2

Function 0118B296 Relevance: 1.6, APIs: 1, Instructions: 97
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(?,00000E24), ref: 0118B341

Memory Dump Source

Source File: 00000005.00000002.3709941862.000000000118A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0118A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_118a000_Server1.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: eb958d9ee1970e6760aa7953d5b82075fb13d41051d60eb5320156b7b1f67263
Instruction ID: a6905052f4b5515c0a580827bdd6960b1822625c3c060974d29240d8ce3b2c52
Opcode Fuzzy Hash: eb958d9ee1970e6760aa7953d5b82075fb13d41051d60eb5320156b7b1f67263
Instruction Fuzzy Hash: EE31847240D3846FE7228B65CC45FA6FFB8EF06214F0885ABE9849B153D364A509CB75

Function 052C11EC Relevance: 1.6, APIs: 1, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getaddrinfo.WS2_32(?,00000E24), ref: 052C12B3

Memory Dump Source

Source File: 00000005.00000002.3713847871.00000000052C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_52c0000_Server1.jbxd

Similarity

API ID: getaddrinfo
String ID:
API String ID: 300660673-0
Opcode ID: c08ec894c1fe951505cbebf686a4decde6c9f061fb57eb168a56406f59c33265
Instruction ID: 55d6c549fa17adf4026f469731c20a6b30feabda1a36062ff5537534a65bf135
Opcode Fuzzy Hash: c08ec894c1fe951505cbebf686a4decde6c9f061fb57eb168a56406f59c33265
Instruction Fuzzy Hash: 0731A4B2544344AFE721CB50CC85FA7FBACEF04314F0445AAFA489B192D375A949CB71

Function 0118AB25 Relevance: 1.6, APIs: 1, Instructions: 92
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 0118ABD5

Memory Dump Source

Source File: 00000005.00000002.3709941862.000000000118A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0118A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_118a000_Server1.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 1bea77c62e91648c87b81c1e9e1a0acc48724d5bea6e4d76a2428a57c709debe
Instruction ID: c725792a78e08eb2b0e0cda3782d696aaaaa630c92576201da664c29438d2d9b
Opcode Fuzzy Hash: 1bea77c62e91648c87b81c1e9e1a0acc48724d5bea6e4d76a2428a57c709debe
Instruction Fuzzy Hash: 41318371509384AFE721CF65DC85F66FFF8EF05210F0988AEE9858B252D365E809CB61

Function 052C10E4 Relevance: 1.6, APIs: 1, Instructions: 89timeCOMMON

Download Yara Rule

APIs

GetProcessTimes.KERNELBASE(?,00000E24,5B627023,00000000,00000000,00000000,00000000), ref: 052C1181

Memory Dump Source

Source File: 00000005.00000002.3713847871.00000000052C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_52c0000_Server1.jbxd

Similarity

API ID: ProcessTimes
String ID:
API String ID: 1995159646-0
Opcode ID: d25231b5b147d2cb651b38e4f85f7394df86824bc493d8a87ac1958695756761
Instruction ID: 5d7f88a1c0e5d6ccb032973f9daeb1729f8b0d319f47f6bbec551aecbfef7dbf
Opcode Fuzzy Hash: d25231b5b147d2cb651b38e4f85f7394df86824bc493d8a87ac1958695756761
Instruction Fuzzy Hash: 2231C5B25097806FE7128F50DC45F66BFB8EF06324F0985DAE9848F193D264A909CB71

Function 052C09E0 Relevance: 1.6, APIs: 1, Instructions: 89COMMON

Download Yara Rule

APIs

ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(?,00000E24), ref: 052C0A77

Memory Dump Source

Source File: 00000005.00000002.3713847871.00000000052C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_52c0000_Server1.jbxd

Similarity

API ID: DescriptorSecurity$ConvertString
String ID:
API String ID: 3907675253-0
Opcode ID: ad305ff94acb5b50bb931193e9aa7f494cf506a73a36bfd57de4269584a4de52
Instruction ID: fd270d7a0e85ccd54b38ee73a418be92b41ef03f68ca3a441a69f7e17bb85fc7
Opcode Fuzzy Hash: ad305ff94acb5b50bb931193e9aa7f494cf506a73a36bfd57de4269584a4de52
Instruction Fuzzy Hash: 66318172509385AFE721CB64DC45F67BFA8EF05214F0984AAE944CB252D364A909CB61

Function 0118B389 Relevance: 1.6, APIs: 1, Instructions: 89
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,5B627023,00000000,00000000,00000000,00000000), ref: 0118B444

Memory Dump Source

Source File: 00000005.00000002.3709941862.000000000118A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0118A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_118a000_Server1.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: c57b4cbecd0a51774b6496a3989de683584a5e6387a5064489892dd25d1c1990
Instruction ID: 945426c4057f63ee58718f7bc073eff2f066310d6594793162df5f8a5a5d8bd4
Opcode Fuzzy Hash: c57b4cbecd0a51774b6496a3989de683584a5e6387a5064489892dd25d1c1990
Instruction Fuzzy Hash: E231B176509384AFE722CF25CC45F62BFB8EF06210F08849AE985CB193D364E949CB75

Function 0118B0E6 Relevance: 1.6, APIs: 1, Instructions: 89
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexW.KERNELBASE(?,?), ref: 0118B18D

Memory Dump Source

Source File: 00000005.00000002.3709941862.000000000118A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0118A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_118a000_Server1.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: aec5dad3fd4c17efda17b62fa8f517559d807e6368a0a4edefd1af76167d4d0e
Instruction ID: d69cd7e063c7b936e02ec9240e3217dfcccbedfd692918d655750d5ab98a2090
Opcode Fuzzy Hash: aec5dad3fd4c17efda17b62fa8f517559d807e6368a0a4edefd1af76167d4d0e
Instruction Fuzzy Hash: E631B5715093845FE711CB25DC45B56FFF8EF06210F08849AE984CF293D364E809CB65

Function 052C1FBE Relevance: 1.6, APIs: 1, Instructions: 86registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.KERNELBASE(?,00000E24), ref: 052C2059

Memory Dump Source

Source File: 00000005.00000002.3713847871.00000000052C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_52c0000_Server1.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 9f171e630052ab3aeeb4909492ac08549ca52d0a92f4166f4f86a34b35b527d0
Instruction ID: 47608fa01dfde4ace6ac32dfba6645b1e53c35d2786004f7a081dc491445831f
Opcode Fuzzy Hash: 9f171e630052ab3aeeb4909492ac08549ca52d0a92f4166f4f86a34b35b527d0
Instruction Fuzzy Hash: B8219E76504208AFEB21DB25CC40F67FBECEF18214F04896AEA8AC6252D770E408CA61

Function 05158BF0 Relevance: 1.6, Strings: 1, Instructions: 335COMMON

Download Yara Rule

Strings

:@cl, xrefs: 051590BB

Memory Dump Source

Source File: 00000005.00000002.3713741754.0000000005150000.00000040.00000800.00020000.00000000.sdmp, Offset: 05150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5150000_Server1.jbxd

Similarity

API ID:
String ID: :@cl
API String ID: 0-3298582286
Opcode ID: be8dfe5401066b16afb75517f028067724b07f7321f1944b752ff9aaebf8c342
Instruction ID: 99986f3b8b8eae1f73269ac5634a7f0d761d475235a8143ae38b3f199a4a91b7
Opcode Fuzzy Hash: be8dfe5401066b16afb75517f028067724b07f7321f1944b752ff9aaebf8c342
Instruction Fuzzy Hash: CBD18131A0020DEFCB19EF75E4649AD77B2BF88358B51853AE81697768DF35AC02CB50

Function 0118A6CE Relevance: 1.6, APIs: 1, Instructions: 85comclipboardCOMMON

Download Yara Rule

APIs

OleGetClipboard.OLE32(?,00000E24,?,?), ref: 0118A77E

Memory Dump Source

Source File: 00000005.00000002.3709941862.000000000118A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0118A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_118a000_Server1.jbxd

Similarity

API ID: Clipboard
String ID:
API String ID: 220874293-0
Opcode ID: 2bb5dbb70e108571d0078a0828232fab6ed46b66ce8da362e1a203ed333bc2eb
Instruction ID: 49e561e1f15ffe253f34a0f8e36c05c217779339483ea2b9bfef15ad0c0f5bd8
Opcode Fuzzy Hash: 2bb5dbb70e108571d0078a0828232fab6ed46b66ce8da362e1a203ed333bc2eb
Instruction Fuzzy Hash: 0431717504D3C06FD3138B259C61B61BFB4EF47610F0A80DBD884CB5A3D2656919D7B2

Function 052C120E Relevance: 1.6, APIs: 1, Instructions: 84COMMON

Download Yara Rule

APIs

getaddrinfo.WS2_32(?,00000E24), ref: 052C12B3

Memory Dump Source

Source File: 00000005.00000002.3713847871.00000000052C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_52c0000_Server1.jbxd

Similarity

API ID: getaddrinfo
String ID:
API String ID: 300660673-0
Opcode ID: 357e07a892f54991e65b5b5ae8305008d52cfb1c1c566d96f42241b6289a75b3
Instruction ID: dfbcb194c5e450f392321ca1913caa8d7972a6b64694113bc3bc46088618bc69
Opcode Fuzzy Hash: 357e07a892f54991e65b5b5ae8305008d52cfb1c1c566d96f42241b6289a75b3
Instruction Fuzzy Hash: 6521D372544208AEF720DF10CC85FB6FBACEF04314F0489AAFA499A182D3B5A548CB71

Function 0118B578 Relevance: 1.6, APIs: 1, Instructions: 82windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutA.USER32(?,00000E24), ref: 0118B621

Memory Dump Source

Source File: 00000005.00000002.3709941862.000000000118A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0118A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_118a000_Server1.jbxd

Similarity

API ID: MessageSendTimeout
String ID:
API String ID: 1599653421-0
Opcode ID: b7b70cff22f3160ac707003a08b396059d566492a4edf384613a675f4e2448ce
Instruction ID: cf6dd71ab2e660f786d09b8b266cf17bce24779707dc1bc08946ee582437dc61
Opcode Fuzzy Hash: b7b70cff22f3160ac707003a08b396059d566492a4edf384613a675f4e2448ce
Instruction Fuzzy Hash: E921D672509384AFE7228F51DC45FA2FFB8EF46314F18849AFA844F162D375A409CB65

Function 052C2231 Relevance: 1.6, APIs: 1, Instructions: 80COMMON

Download Yara Rule

APIs

select.WS2_32(?,?,?,?,?), ref: 052C22C0

Memory Dump Source

Source File: 00000005.00000002.3713847871.00000000052C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_52c0000_Server1.jbxd

Similarity

API ID: select
String ID:
API String ID: 1274211008-0
Opcode ID: d4bc8607da3a0fcbca0da0a5257372861cdac6b79488b23c5beefe1d9907ff91
Instruction ID: 46ff7abdec1005a3ddad28117e58236f7057b5d90d6e2197a7fd7531c5d77d52
Opcode Fuzzy Hash: d4bc8607da3a0fcbca0da0a5257372861cdac6b79488b23c5beefe1d9907ff91
Instruction Fuzzy Hash: 132159755093809FDB22CF25DC44A62BFF8EF06210F0985DAE989CB163D265A909DB62

Function 052C2609 Relevance: 1.6, APIs: 1, Instructions: 79COMMON

Download Yara Rule

APIs

GetExitCodeProcess.KERNELBASE(?,00000E24,5B627023,00000000,00000000,00000000,00000000), ref: 052C2690

Memory Dump Source

Source File: 00000005.00000002.3713847871.00000000052C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_52c0000_Server1.jbxd

Similarity

API ID: CodeExitProcess
String ID:
API String ID: 3861947596-0
Opcode ID: 45ab3251a0d19d2a722fdcb0deec8569208189a6223aa8773c2c30fe9881b5b1
Instruction ID: b0a7215dc14768e060fa7f0277609092e1c7edc7e6ea6350697f70fac660d800
Opcode Fuzzy Hash: 45ab3251a0d19d2a722fdcb0deec8569208189a6223aa8773c2c30fe9881b5b1
Instruction Fuzzy Hash: 6721A4765093846FE712CB15DC45FA6BFA8EF06224F1984EAE984CF193D264A908C771

Function 0118AF27 Relevance: 1.6, APIs: 1, Instructions: 78fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,00000E24,5B627023,00000000,00000000,00000000,00000000), ref: 0118AFBD

Memory Dump Source

Source File: 00000005.00000002.3709941862.000000000118A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0118A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_118a000_Server1.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 11cc0595cb7d23949dc7ef9e5021703e61df385e9c8f83669cef32ccf4b56851
Instruction ID: d1d1d509829a41bc15e5183f7e32e7c784f6d2bd46a4f873f13e02a2277070f1
Opcode Fuzzy Hash: 11cc0595cb7d23949dc7ef9e5021703e61df385e9c8f83669cef32ccf4b56851
Instruction Fuzzy Hash: C621A3B6409384AFD722CB51DC44F66FFB8EF06314F19849AE9848F163D364A509CB72

Function 052C0B96 Relevance: 1.6, APIs: 1, Instructions: 77fileCOMMON

Download Yara Rule

APIs

MapViewOfFile.KERNELBASE ref: 052C0C2A

Memory Dump Source

Source File: 00000005.00000002.3713847871.00000000052C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_52c0000_Server1.jbxd

Similarity

API ID: FileView
String ID:
API String ID: 3314676101-0
Opcode ID: 8d9aa4dedd782c9f913bdebb7bd76ae0f3bf6d76348adccba1500fc06c5e3e0a
Instruction ID: a2f3f4f2e82262b66177e3ee9f6c08b9c98e35720253b0921e533efb519ff150
Opcode Fuzzy Hash: 8d9aa4dedd782c9f913bdebb7bd76ae0f3bf6d76348adccba1500fc06c5e3e0a
Instruction Fuzzy Hash: F421A372409384AFE722CF55CC45F66FFF8EF09224F04859EE9858B152D365A508CB62

Function 052C05F2 Relevance: 1.6, APIs: 1, Instructions: 77networkCOMMON

Download Yara Rule

APIs

WSASocketW.WS2_32(?,?,?,?,?), ref: 052C067E

Memory Dump Source

Source File: 00000005.00000002.3713847871.00000000052C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_52c0000_Server1.jbxd

Similarity

API ID: Socket
String ID:
API String ID: 38366605-0
Opcode ID: 89c045f31f9f14856e14e8605c36055382807d7a55d135ca94f73d032736537b
Instruction ID: cf9c8031afeb84199b0d516078e826748592dd8677e14998bb31a9095e4b02b9
Opcode Fuzzy Hash: 89c045f31f9f14856e14e8605c36055382807d7a55d135ca94f73d032736537b
Instruction Fuzzy Hash: D9218071509784AFE721CF51DC45F66FFF8EF05214F0888AEE9858B652D375A408CB62

Function 0118B49A Relevance: 1.6, APIs: 1, Instructions: 77registryCOMMON

Download Yara Rule

APIs

RegSetValueExW.KERNELBASE(?,00000E24,5B627023,00000000,00000000,00000000,00000000), ref: 0118B530

Memory Dump Source

Source File: 00000005.00000002.3709941862.000000000118A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0118A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_118a000_Server1.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: b7fde33a9603dfd24a1fefd297e5e47599e78dc8972849cdf8b413d83da7e6a0
Instruction ID: 84720a5555e6e7826c4623b5525de756b4778b8b669a9f132ace82754e21efce
Opcode Fuzzy Hash: b7fde33a9603dfd24a1fefd297e5e47599e78dc8972849cdf8b413d83da7e6a0
Instruction Fuzzy Hash: FF2190B65097846FE7228F15DC44F63FFB8EF46220F08849AE9858B252D364E909CB75

Function 052C0A06 Relevance: 1.6, APIs: 1, Instructions: 76COMMON

Download Yara Rule

APIs

ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(?,00000E24), ref: 052C0A77

Memory Dump Source

Source File: 00000005.00000002.3713847871.00000000052C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_52c0000_Server1.jbxd

Similarity

API ID: DescriptorSecurity$ConvertString
String ID:
API String ID: 3907675253-0
Opcode ID: 71968e03f0a88128006d114885bcf84fea81e9a74a82cc11f613eac60932f5cc
Instruction ID: 9dba4aef3b88f92974a14a04481f6c72b6288b154a74502a977761b927bdf317
Opcode Fuzzy Hash: 71968e03f0a88128006d114885bcf84fea81e9a74a82cc11f613eac60932f5cc
Instruction Fuzzy Hash: 2221CF72505205AFEB20DB25DC45F6BFBECEF04214F0884AAEE44CB252D374E508CA72

Function 052C08EE Relevance: 1.6, APIs: 1, Instructions: 76registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,5B627023,00000000,00000000,00000000,00000000), ref: 052C098C

Memory Dump Source

Source File: 00000005.00000002.3713847871.00000000052C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_52c0000_Server1.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 0ac27ac86a93bba7ad486f179c23ea1c55cfdcab991a49bf309a4274f63dca8b
Instruction ID: f540b657f545924d41bf75e55533ecaa82fb9acee23fa688df2b7536edf18238
Opcode Fuzzy Hash: 0ac27ac86a93bba7ad486f179c23ea1c55cfdcab991a49bf309a4274f63dca8b
Instruction Fuzzy Hash: 29219172509784AFE722CB51CC84F66FFF8EF45610F08859AE9859B192D364E908CB71

Function 0118A9BF Relevance: 1.6, APIs: 1, Instructions: 76COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,?), ref: 0118AA4A

Memory Dump Source

Source File: 00000005.00000002.3709941862.000000000118A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0118A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_118a000_Server1.jbxd

Similarity

API ID: LongNamePath
String ID:
API String ID: 82841172-0
Opcode ID: 8e9b19bd2979f2a750c64f952cc7a01c17c1d338f44a6d089351738b73e6cd9f
Instruction ID: 833201bc42071b6aa60a2e5617a35287ceec3707a1652b0df287af1271083023
Opcode Fuzzy Hash: 8e9b19bd2979f2a750c64f952cc7a01c17c1d338f44a6d089351738b73e6cd9f
Instruction Fuzzy Hash: 0531377540E7C09FD7138B64DC55A52BFB4EF07220B0A84EBD9848F5A3D2689849CB72

Function 0118AB56 Relevance: 1.6, APIs: 1, Instructions: 76fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 0118ABD5

Memory Dump Source

Source File: 00000005.00000002.3709941862.000000000118A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0118A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_118a000_Server1.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 21ce8d06c33836c57cea9ded4857f8871a12aa1ff8e1a63d9934ef50e1dc971b
Instruction ID: bc7d267bbc7665c1c77c0b22a13338cfbbb8e6519aa9647222176579e0e9ecfd
Opcode Fuzzy Hash: 21ce8d06c33836c57cea9ded4857f8871a12aa1ff8e1a63d9934ef50e1dc971b
Instruction Fuzzy Hash: 6C21B071504244AFE725DF65DD85F66FBE8EF08220F08C86AEA458B651D375E404CF72

Function 0118B2C2 Relevance: 1.6, APIs: 1, Instructions: 74registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(?,00000E24), ref: 0118B341

Memory Dump Source

Source File: 00000005.00000002.3709941862.000000000118A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0118A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_118a000_Server1.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 6d864e237da8292fd2b660270de378c3e3b44f597d087af9dd4ce846a9edceea
Instruction ID: 5eb12bc0d777c18f17ff299aa075bfd19aef9b4d7397d4e0cd9dc72276b9a981
Opcode Fuzzy Hash: 6d864e237da8292fd2b660270de378c3e3b44f597d087af9dd4ce846a9edceea
Instruction Fuzzy Hash: 7421A172508204AEE7219F15DC84F7BFBECEF08224F04846AEE459B252D374E5088EB6

Function 052C26F3 Relevance: 1.6, APIs: 1, Instructions: 73COMMON

Download Yara Rule

APIs

GetProcessWorkingSetSize.KERNEL32(?,00000E24,5B627023,00000000,00000000,00000000,00000000), ref: 052C276F

Memory Dump Source

Source File: 00000005.00000002.3713847871.00000000052C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_52c0000_Server1.jbxd

Similarity

API ID: ProcessSizeWorking
String ID:
API String ID: 3584180929-0
Opcode ID: 2b386afb938d2756b6194e94bd8757cf0ee11f406d51d1b5e93deb0c70fc68a6
Instruction ID: de9475db4686f06ec8cd9dd28c5e292b0cd6757ff6096da122888248c0757cb4
Opcode Fuzzy Hash: 2b386afb938d2756b6194e94bd8757cf0ee11f406d51d1b5e93deb0c70fc68a6
Instruction Fuzzy Hash: BD21A4765093846FD722CB11DC85F66FFB8EF45220F08C4AAED84CB152D364A908CB76

Function 052C27D7 Relevance: 1.6, APIs: 1, Instructions: 73COMMON

Download Yara Rule

APIs

SetProcessWorkingSetSize.KERNEL32(?,00000E24,5B627023,00000000,00000000,00000000,00000000), ref: 052C2853

Memory Dump Source

Source File: 00000005.00000002.3713847871.00000000052C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_52c0000_Server1.jbxd

Similarity

API ID: ProcessSizeWorking
String ID:
API String ID: 3584180929-0
Opcode ID: 2b386afb938d2756b6194e94bd8757cf0ee11f406d51d1b5e93deb0c70fc68a6
Instruction ID: 95699dde84ea6f9d3d57d8ade2aaf8ac5b54052d083e1d25320f2a0f34852c96
Opcode Fuzzy Hash: 2b386afb938d2756b6194e94bd8757cf0ee11f406d51d1b5e93deb0c70fc68a6
Instruction Fuzzy Hash: 3521A4765093846FD722CB11DC49F66FFA8EF45220F08C5AAE984DB192D364A908CB76

Function 0118ACE7 Relevance: 1.6, APIs: 1, Instructions: 73COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE(?,00000E24,5B627023,00000000,00000000,00000000,00000000), ref: 0118AD6D

Memory Dump Source

Source File: 00000005.00000002.3709941862.000000000118A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0118A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_118a000_Server1.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 6077725a5d8a4d4e5caf9f419b78184b05f0a9104ac4967f31e6b9c0e1923f00
Instruction ID: 2e990f9c7bc2a0f9c82d40ed9cf334b84c8a0f2d339c7acf9917111034f1e69b
Opcode Fuzzy Hash: 6077725a5d8a4d4e5caf9f419b78184b05f0a9104ac4967f31e6b9c0e1923f00
Instruction Fuzzy Hash: E121C3B64093846FE7128B11DC44BA6BFA8DF46324F0980DBE9848B193D264A909CB72

Function 052C0E2D Relevance: 1.6, APIs: 1, Instructions: 72COMMON

Download Yara Rule

APIs

shutdown.WS2_32(?,00000E24,5B627023,00000000,00000000,00000000,00000000), ref: 052C0EB0

Memory Dump Source

Source File: 00000005.00000002.3713847871.00000000052C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_52c0000_Server1.jbxd

Similarity

API ID: shutdown
String ID:
API String ID: 2510479042-0
Opcode ID: 1da96d6540d4cdcb3fd760d7f2d008f8a6ecf4c682ae54c4bc8c45356661a3e3
Instruction ID: 7a083346ef22c4cbb223e64cad679b021e2aeeea65d41cd5260475a22173432a
Opcode Fuzzy Hash: 1da96d6540d4cdcb3fd760d7f2d008f8a6ecf4c682ae54c4bc8c45356661a3e3
Instruction Fuzzy Hash: 052192B1449384AFD712CB10DC45F66FFB8EF46220F0885EAE9849F152C368A948CB72

Function 0118B11A Relevance: 1.6, APIs: 1, Instructions: 72synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexW.KERNELBASE(?,?), ref: 0118B18D

Memory Dump Source

Source File: 00000005.00000002.3709941862.000000000118A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0118A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_118a000_Server1.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: 7a9f627076477f3f27d1390b194c9f940664a0987eb8ed24232324abf6a126a4
Instruction ID: fa8a2088e12c63a3947ba2a430d37d5ded6039f178a5a5a4d2ac9511de4be34e
Opcode Fuzzy Hash: 7a9f627076477f3f27d1390b194c9f940664a0987eb8ed24232324abf6a126a4
Instruction Fuzzy Hash: 61218E71509244AFE724DB25DD85B66FBE8EF04224F08C46AEE448F641D375E804CEA6

Function 0118A140 Relevance: 1.6, APIs: 1, Instructions: 72networkCOMMON

Download Yara Rule

APIs

send.WS2_32(?,?,?,?), ref: 0118A1C1

Memory Dump Source

Source File: 00000005.00000002.3709941862.000000000118A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0118A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_118a000_Server1.jbxd

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: a824ef4d78a18f306e18bd68104e2fa0a14933005443fd07afdcdf8c54311835
Instruction ID: fdab531f1713c71b43fd9afb7fd42930f5ed19f2a3375a4ba83cafa056c85982
Opcode Fuzzy Hash: a824ef4d78a18f306e18bd68104e2fa0a14933005443fd07afdcdf8c54311835
Instruction Fuzzy Hash: 4F21AC7640D3C09FDB238B25DC54A52FFB4EF47220F0984DBD9848F5A3C269A819CB62

Function 052C216B Relevance: 1.6, APIs: 1, Instructions: 69COMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32(?,00000E24,5B627023,00000000,00000000,00000000,00000000), ref: 052C21E7

Memory Dump Source

Source File: 00000005.00000002.3713847871.00000000052C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_52c0000_Server1.jbxd

Similarity

API ID: ioctlsocket
String ID:
API String ID: 3577187118-0
Opcode ID: 8d713334daedcf585e9b52de95d851d8946c040815fe9fbbcdfd57b29677cba6
Instruction ID: 3ccafdc1ac56cc13ba13182295e0a82fe5fa29930f2c70c1d0d986779d2be518
Opcode Fuzzy Hash: 8d713334daedcf585e9b52de95d851d8946c040815fe9fbbcdfd57b29677cba6
Instruction Fuzzy Hash: 9921C376409384AFD722CF50DC44F66FFB8EF45220F0884AAE9859B152D374A508CBB2

Function 0118B3CA Relevance: 1.6, APIs: 1, Instructions: 69registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,5B627023,00000000,00000000,00000000,00000000), ref: 0118B444

Memory Dump Source

Source File: 00000005.00000002.3709941862.000000000118A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0118A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_118a000_Server1.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 65445f8038263c2def85e1a0256730eebdb9b497c0147b3a7cb1c0296556d81c
Instruction ID: 985dbb398225eb68d348f6d336fcb6e83c4843893ebf4160610be19449a6eeb0
Opcode Fuzzy Hash: 65445f8038263c2def85e1a0256730eebdb9b497c0147b3a7cb1c0296556d81c
Instruction Fuzzy Hash: A421AE76604204AFE721DF19DC81F62F7ECEF04610F08C06AEE468B291D364E848CAB6

Function 052C0612 Relevance: 1.6, APIs: 1, Instructions: 67networkCOMMON

Download Yara Rule

APIs

WSASocketW.WS2_32(?,?,?,?,?), ref: 052C067E

Memory Dump Source

Source File: 00000005.00000002.3713847871.00000000052C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_52c0000_Server1.jbxd

Similarity

API ID: Socket
String ID:
API String ID: 38366605-0
Opcode ID: f14c977d84ac79df4f99f1f1aa2d75ed44dca7d16c18929095bd2f435fdc61e0
Instruction ID: 0464e1ed0a6c5e5807b1859baf62a6118d80056981a1937a25944a9d3dce4d7c
Opcode Fuzzy Hash: f14c977d84ac79df4f99f1f1aa2d75ed44dca7d16c18929095bd2f435fdc61e0
Instruction Fuzzy Hash: D0210171404240AFEB20CF15CC45F6AFBE4EF04324F1488AEEE858B252C372A408CB72

Function 052C13BE Relevance: 1.6, APIs: 1, Instructions: 67networkCOMMON

Download Yara Rule

APIs

WSAConnect.WS2_32(?,?,?,?,?,?,?), ref: 052C143A

Memory Dump Source

Source File: 00000005.00000002.3713847871.00000000052C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_52c0000_Server1.jbxd

Similarity

API ID: Connect
String ID:
API String ID: 3144859779-0
Opcode ID: eace728f27cb37398172ef92f406582f2882d248e9c774483185a780bab1ff47
Instruction ID: 681ce6be217966aa4300bd07bfd8653207670910602c20a21362500d1e92b522
Opcode Fuzzy Hash: eace728f27cb37398172ef92f406582f2882d248e9c774483185a780bab1ff47
Instruction Fuzzy Hash: 14216F75409380AFDB228F55DC45B62FFF4EF06210F0885DAE9858B163D375A819DB62

Function 052C0BB6 Relevance: 1.6, APIs: 1, Instructions: 67fileCOMMON

Download Yara Rule

APIs

MapViewOfFile.KERNELBASE ref: 052C0C2A

Memory Dump Source

Source File: 00000005.00000002.3713847871.00000000052C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_52c0000_Server1.jbxd

Similarity

API ID: FileView
String ID:
API String ID: 3314676101-0
Opcode ID: 30a7e16d667284c9bad1e837eb74018adf53a025956dd8bcd155b67901ef7be9
Instruction ID: 20b90bcae1533616c0108720d29f2b4f81923e974cf93dc47a65cee10885e909
Opcode Fuzzy Hash: 30a7e16d667284c9bad1e837eb74018adf53a025956dd8bcd155b67901ef7be9
Instruction Fuzzy Hash: 8D21F372404204AFE721CF15DC85F6AFBE8EF08724F0484ADEA898B251D375E508CBB2

Function 052C167A Relevance: 1.6, APIs: 1, Instructions: 66libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,00000E24), ref: 052C1703

Memory Dump Source

Source File: 00000005.00000002.3713847871.00000000052C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_52c0000_Server1.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 8664b91117267a012c4b05dc31483d9489dd6a97b4403f0f2620062f660a7d3d
Instruction ID: e87de0b6899bbee69e50ec07e3c0663e0d9deff497595b8a99f43f68fb57a065
Opcode Fuzzy Hash: 8664b91117267a012c4b05dc31483d9489dd6a97b4403f0f2620062f660a7d3d
Instruction Fuzzy Hash: BE11E4714493446FE721CB11CC85FB2FFA8EF05320F04809AF9484B192C364A948CB62

Function 0118B5A6 Relevance: 1.6, APIs: 1, Instructions: 66windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutA.USER32(?,00000E24), ref: 0118B621

Memory Dump Source

Source File: 00000005.00000002.3709941862.000000000118A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0118A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_118a000_Server1.jbxd

Similarity

API ID: MessageSendTimeout
String ID:
API String ID: 1599653421-0
Opcode ID: d6d3bd58f6d1ebf1cd7a9064330b8595babcc1f4ff46812f635c082176f19e3b
Instruction ID: 1c4a0d74d55be7ab92e72ecc6b10af411beaa0deeb9b3ac93dcac072d9f11115
Opcode Fuzzy Hash: d6d3bd58f6d1ebf1cd7a9064330b8595babcc1f4ff46812f635c082176f19e3b
Instruction Fuzzy Hash: 9721AF72504604AFEB319F11DC41F66FBA8EF04714F18C46AFE454A691D375A418CFB6

Function 052C091A Relevance: 1.6, APIs: 1, Instructions: 65registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,5B627023,00000000,00000000,00000000,00000000), ref: 052C098C

Memory Dump Source

Source File: 00000005.00000002.3713847871.00000000052C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_52c0000_Server1.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: bfd6481ecbc22b7f8a701059fa70861119b42e0249f758a060e51e4c099d5d13
Instruction ID: 10bce2530e8818276d5e65e65438c3f2e30500e01143f74b930ad752c20f7f2c
Opcode Fuzzy Hash: bfd6481ecbc22b7f8a701059fa70861119b42e0249f758a060e51e4c099d5d13
Instruction Fuzzy Hash: A011B172504604EFE721CF11DC89F67FBE8EF04620F0485AAEA458B252D374E404CAB2

Function 0118B4BE Relevance: 1.6, APIs: 1, Instructions: 65registryCOMMON

Download Yara Rule

APIs

RegSetValueExW.KERNELBASE(?,00000E24,5B627023,00000000,00000000,00000000,00000000), ref: 0118B530

Memory Dump Source

Source File: 00000005.00000002.3709941862.000000000118A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0118A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_118a000_Server1.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 0cd2c81aaf6f83a226292869785ddacac032fc8cf14b1fb8b2749ccf21e1c723
Instruction ID: 818a959e1935c10792d1640698fcdbd8370e1a762d839bd429f8e15aba299c69
Opcode Fuzzy Hash: 0cd2c81aaf6f83a226292869785ddacac032fc8cf14b1fb8b2749ccf21e1c723
Instruction Fuzzy Hash: 2C11BEB6504604AFE7219F15DC80F67FBE8EF04720F08C46AEE458A252D370E5048AB6

Function 052C1122 Relevance: 1.6, APIs: 1, Instructions: 64timeCOMMON

Download Yara Rule

APIs

GetProcessTimes.KERNELBASE(?,00000E24,5B627023,00000000,00000000,00000000,00000000), ref: 052C1181

Memory Dump Source

Source File: 00000005.00000002.3713847871.00000000052C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_52c0000_Server1.jbxd

Similarity

API ID: ProcessTimes
String ID:
API String ID: 1995159646-0
Opcode ID: a8c44cb49d6d552b46676d4265c17611008ae4662d553c8889d5c201ea0b2818
Instruction ID: 2404c394d029f286ad4fa93ce974e40007865156c2712c1cb6528f1f5c6fde79
Opcode Fuzzy Hash: a8c44cb49d6d552b46676d4265c17611008ae4662d553c8889d5c201ea0b2818
Instruction Fuzzy Hash: 28119072504604AFEB21CF55DC85F66FBE8EF04224F04C5AAEE458B252D3B4A554CBB2

Function 052C2716 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

GetProcessWorkingSetSize.KERNEL32(?,00000E24,5B627023,00000000,00000000,00000000,00000000), ref: 052C276F

Memory Dump Source

Source File: 00000005.00000002.3713847871.00000000052C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_52c0000_Server1.jbxd

Similarity

API ID: ProcessSizeWorking
String ID:
API String ID: 3584180929-0
Opcode ID: 27daf56fb9f83ab44c9022c2b9fbd3cc0a745a12adcb6d358cb8b5c7ede7ccdb
Instruction ID: a021db3505944da1bed06a0194444162dcae3e9b70775a6d7fb3b1238bccc3aa
Opcode Fuzzy Hash: 27daf56fb9f83ab44c9022c2b9fbd3cc0a745a12adcb6d358cb8b5c7ede7ccdb
Instruction Fuzzy Hash: D81194765042449FEB21CF15DC85F76FBA8EF04224F04C5AAEE45CB241D774A548CBB5

Function 052C27FA Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

SetProcessWorkingSetSize.KERNEL32(?,00000E24,5B627023,00000000,00000000,00000000,00000000), ref: 052C2853

Memory Dump Source

Source File: 00000005.00000002.3713847871.00000000052C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_52c0000_Server1.jbxd

Similarity

API ID: ProcessSizeWorking
String ID:
API String ID: 3584180929-0
Opcode ID: 27daf56fb9f83ab44c9022c2b9fbd3cc0a745a12adcb6d358cb8b5c7ede7ccdb
Instruction ID: 67d7cfcbd74b4855fe6327a8fa6021bf9bd859d281b4243e22f627c1d7131d11
Opcode Fuzzy Hash: 27daf56fb9f83ab44c9022c2b9fbd3cc0a745a12adcb6d358cb8b5c7ede7ccdb
Instruction Fuzzy Hash: 2E11BF76504204AFEB21CB15DC85B6AFBA8EF04224F04C5AAEE459B241D774A904CBB6

Function 052C263A Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetExitCodeProcess.KERNELBASE(?,00000E24,5B627023,00000000,00000000,00000000,00000000), ref: 052C2690

Memory Dump Source

Source File: 00000005.00000002.3713847871.00000000052C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_52c0000_Server1.jbxd

Similarity

API ID: CodeExitProcess
String ID:
API String ID: 3861947596-0
Opcode ID: 44ba99c114a8cfd012e14f6321485cf5072f5041bf4c9e87f08bb33bfd20a228
Instruction ID: 3972402ed976690f32b29c758bd0ce9d324e92b0e9fe8811f150f918b2708594
Opcode Fuzzy Hash: 44ba99c114a8cfd012e14f6321485cf5072f5041bf4c9e87f08bb33bfd20a228
Instruction Fuzzy Hash: 9D11A375504244AFEB21CB15DC85B76FB98EF04624F14C4AAEE45CB241D7B4A9448BB1

Function 0118A573 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0118A5DE

Memory Dump Source

Source File: 00000005.00000002.3709941862.000000000118A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0118A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_118a000_Server1.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 5b6f58a2287b16da59033a6ad31cfa654ed23de0ba7d18ff60dd668a6dabdd5e
Instruction ID: eba8afa1eab2a2557f754ff58b862f210b321a7ec0678f94bd5d945228b1d571
Opcode Fuzzy Hash: 5b6f58a2287b16da59033a6ad31cfa654ed23de0ba7d18ff60dd668a6dabdd5e
Instruction Fuzzy Hash: 05117272409780AFDB228F55DC44B62FFF4EF4A210F0888DAE9858B563C375A419DB62

Function 0118AA8A Relevance: 1.6, APIs: 1, Instructions: 60COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(?), ref: 0118AAF4

Memory Dump Source

Source File: 00000005.00000002.3709941862.000000000118A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0118A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_118a000_Server1.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 48082e445a9a0f4a5d47bc1eb2e1acaf43ed2b90c7eec11d69bd5e733a7b9c2a
Instruction ID: 0cd1e41b4e50e5163f7b7fbb1c7c24d65d6a7e4fd4a58b50e214534ffe25d0c4
Opcode Fuzzy Hash: 48082e445a9a0f4a5d47bc1eb2e1acaf43ed2b90c7eec11d69bd5e733a7b9c2a
Instruction Fuzzy Hash: 15113AB24093C45FDB138B25EC54A61BFB4DF47214F0984DBED848B2A3D2656909DB62

Function 0118AF5E Relevance: 1.6, APIs: 1, Instructions: 60fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,00000E24,5B627023,00000000,00000000,00000000,00000000), ref: 0118AFBD

Memory Dump Source

Source File: 00000005.00000002.3709941862.000000000118A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0118A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_118a000_Server1.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: b089ee016956656f69759b546fa91909c92f6bf0763315347b6fba0d2327b751
Instruction ID: 6c6782cbe4e85ebd810b97a6441f0cb2fa0ecb9f228377cafee2bf94e0615180
Opcode Fuzzy Hash: b089ee016956656f69759b546fa91909c92f6bf0763315347b6fba0d2327b751
Instruction Fuzzy Hash: 9511B272404204AFEB219F55DC84F6AFBE8EF04324F14C46AEE458B151D374A4458BB6

Function 052C218E Relevance: 1.6, APIs: 1, Instructions: 58COMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32(?,00000E24,5B627023,00000000,00000000,00000000,00000000), ref: 052C21E7

Memory Dump Source

Source File: 00000005.00000002.3713847871.00000000052C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_52c0000_Server1.jbxd

Similarity

API ID: ioctlsocket
String ID:
API String ID: 3577187118-0
Opcode ID: cdb15532181190b0a805603fb8a43af9f456b214d4f4348c13ea500bf44f3973
Instruction ID: aab354c7dfba07c941b86eb6e756b9c40cd302e5563c52f20eb86f9096910d9e
Opcode Fuzzy Hash: cdb15532181190b0a805603fb8a43af9f456b214d4f4348c13ea500bf44f3973
Instruction Fuzzy Hash: 0611A376904244AFE721CF55DC85F66FBA8EF04324F04C4AAEE458B242D7B5A5048BB6

Function 052C15C5 Relevance: 1.6, APIs: 1, Instructions: 58COMMON

Download Yara Rule

APIs

CoGetObjectContext.COMBASE(?,?), ref: 052C1637

Memory Dump Source

Source File: 00000005.00000002.3713847871.00000000052C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_52c0000_Server1.jbxd

Similarity

API ID: ContextObject
String ID:
API String ID: 3343934925-0
Opcode ID: b3613b09c9ba0a2893195c1f0212cfc5d10dc92faf308425da6a6c0fbc80bd85
Instruction ID: 0c9687f337211dc163b7a26a7b41109100b9d9b21af718f10b9d57a34078910c
Opcode Fuzzy Hash: b3613b09c9ba0a2893195c1f0212cfc5d10dc92faf308425da6a6c0fbc80bd85
Instruction Fuzzy Hash: 4E11BE714083809FD7128F25C849A62FFB0EF06220F0981DEDD844F2A3D279A909DB62

Function 052C0E5A Relevance: 1.6, APIs: 1, Instructions: 57COMMON

Download Yara Rule

APIs

shutdown.WS2_32(?,00000E24,5B627023,00000000,00000000,00000000,00000000), ref: 052C0EB0

Memory Dump Source

Source File: 00000005.00000002.3713847871.00000000052C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_52c0000_Server1.jbxd

Similarity

API ID: shutdown
String ID:
API String ID: 2510479042-0
Opcode ID: 12b1d92370928ed7ae71281391d538dad7bb61fa3f6d7cba466b8e93c8a44290
Instruction ID: 0db3147f1321b290998b2a46d52001db29a58659c92fbbe2d774a3fb8b39a68e
Opcode Fuzzy Hash: 12b1d92370928ed7ae71281391d538dad7bb61fa3f6d7cba466b8e93c8a44290
Instruction Fuzzy Hash: 5811C271544244AFEB21CF15DC85F7AFBA8EF05724F18C4AAEE448B242D3B5A5048AB2

Function 052C169A Relevance: 1.6, APIs: 1, Instructions: 56libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,00000E24), ref: 052C1703

Memory Dump Source

Source File: 00000005.00000002.3713847871.00000000052C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_52c0000_Server1.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 7ae28cce8cc6b0f0b74c632e2e45eef6ad0bc2de63006d564e3d22f87f396cc4
Instruction ID: 7c8bc64f792b5ea88eb2db78dd23fce1c4f5e0ff6f645d0df2492310b35f721c
Opcode Fuzzy Hash: 7ae28cce8cc6b0f0b74c632e2e45eef6ad0bc2de63006d564e3d22f87f396cc4
Instruction Fuzzy Hash: 2F11E575554204AEE720CB11DC86FB6FBA8DF04724F14809AFE484A286D3B4A948CAA6

Function 052C226A Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

select.WS2_32(?,?,?,?,?), ref: 052C22C0

Memory Dump Source

Source File: 00000005.00000002.3713847871.00000000052C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_52c0000_Server1.jbxd

Similarity

API ID: select
String ID:
API String ID: 1274211008-0
Opcode ID: 2e12bc475724b96f81896612bba2ca8678088522fc18697930d51022d5ed2f62
Instruction ID: a9fd49c184ac500aa0fa88af9c3ccf27ab7d14f6c176bcd83a284da8115be124
Opcode Fuzzy Hash: 2e12bc475724b96f81896612bba2ca8678088522fc18697930d51022d5ed2f62
Instruction Fuzzy Hash: 04114F79514240DFEB20CF55D884F62FBE8FF04610F0885AADD8ACB652D775E448CB62

Function 0118AD1A Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE(?,00000E24,5B627023,00000000,00000000,00000000,00000000), ref: 0118AD6D

Memory Dump Source

Source File: 00000005.00000002.3709941862.000000000118A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0118A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_118a000_Server1.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 95dc4be3dfc799eb9f7d194761e42cb9f71b399ff677919a636de6a23d98ceba
Instruction ID: 2462cb3c8751c67cddabb194bb1d24b5c720ad99244e02f3af69534181c85ce6
Opcode Fuzzy Hash: 95dc4be3dfc799eb9f7d194761e42cb9f71b399ff677919a636de6a23d98ceba
Instruction Fuzzy Hash: 6701D272504244AFE725DF05EC85B7AFBE8DF04624F08C0A6EE448B241D374E948CEB6

Function 052C13EE Relevance: 1.5, APIs: 1, Instructions: 49networkCOMMON

Download Yara Rule

APIs

WSAConnect.WS2_32(?,?,?,?,?,?,?), ref: 052C143A

Memory Dump Source

Source File: 00000005.00000002.3713847871.00000000052C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_52c0000_Server1.jbxd

Similarity

API ID: Connect
String ID:
API String ID: 3144859779-0
Opcode ID: e8f3bf4a122125925c1a850ef4f01d0f14430f496e00fd8662508a4aebe287a1
Instruction ID: 078797013bf648896fea04afcc20d0c07924a91c427473bf2d3fac433011b3f3
Opcode Fuzzy Hash: e8f3bf4a122125925c1a850ef4f01d0f14430f496e00fd8662508a4aebe287a1
Instruction Fuzzy Hash: 3E115A765042409FDB20CF55D845B62FBE5EF08220F0885EAEE898B623D375E458CB62

Function 0118A59A Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0118A5DE

Memory Dump Source

Source File: 00000005.00000002.3709941862.000000000118A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0118A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_118a000_Server1.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 074ecf61475570019f4994931bf65c214a3dd8a607f3000402b1f332892e5fb0
Instruction ID: 6177778d65bea1b84af1a2a3d07b759d59ee739f4f6403ff6395c1d7de23046e
Opcode Fuzzy Hash: 074ecf61475570019f4994931bf65c214a3dd8a607f3000402b1f332892e5fb0
Instruction Fuzzy Hash: C1018C724047409FDB219F55E944B22FFE4EF48320F08C8AAEE494B656C376E458DFA2

Function 052C0576 Relevance: 1.5, APIs: 1, Instructions: 43registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,?,?), ref: 052C05C6

Memory Dump Source

Source File: 00000005.00000002.3713847871.00000000052C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_52c0000_Server1.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: b2fe2ce1fe4c5eccd2ab75d9593db2ecc3096cf1871e4bdd409510090c520dfe
Instruction ID: a57f2c89d986662608d2108d55031b0eac18feeaa9839647b7fa34f72dd348d0
Opcode Fuzzy Hash: b2fe2ce1fe4c5eccd2ab75d9593db2ecc3096cf1871e4bdd409510090c520dfe
Instruction Fuzzy Hash: 7201A272540204ABD214DF16CC86B26FBE8FB88A20F14811AED085B741D771F955CBE6

Function 0118A72E Relevance: 1.5, APIs: 1, Instructions: 43comclipboardCOMMON

Download Yara Rule

APIs

OleGetClipboard.OLE32(?,00000E24,?,?), ref: 0118A77E

Memory Dump Source

Source File: 00000005.00000002.3709941862.000000000118A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0118A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_118a000_Server1.jbxd

Similarity

API ID: Clipboard
String ID:
API String ID: 220874293-0
Opcode ID: 435ea1211c1ec0c1c57e5e6ab7f514d1ec7212b3a9071b6629e732004995a08f
Instruction ID: c381a8529cd8ce1c12d9b10880ec0a73408442efde2765c166ad729b429d90b9
Opcode Fuzzy Hash: 435ea1211c1ec0c1c57e5e6ab7f514d1ec7212b3a9071b6629e732004995a08f
Instruction Fuzzy Hash: 3B01A271540200ABD214DF16CC86B26FBE8FB88A20F148159ED085B741D771F955CBE6

Function 0118A186 Relevance: 1.5, APIs: 1, Instructions: 42networkCOMMON

Download Yara Rule

APIs

send.WS2_32(?,?,?,?), ref: 0118A1C1

Memory Dump Source

Source File: 00000005.00000002.3709941862.000000000118A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0118A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_118a000_Server1.jbxd

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: eed932d0535279362f0b27a8a5cf991d747501815a0bc4a9a06cfcdecc040fa6
Instruction ID: cc950592f1aca609c4bf632cf9e78a9717b12d4e6b9f6a520fc7c3ee94152b3c
Opcode Fuzzy Hash: eed932d0535279362f0b27a8a5cf991d747501815a0bc4a9a06cfcdecc040fa6
Instruction Fuzzy Hash: 4801B1724042409FDB20DF55E844B22FBE4EF04320F08C4AADD494B612C375A448CFA2

Function 0118AA12 Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,?), ref: 0118AA4A

Memory Dump Source

Source File: 00000005.00000002.3709941862.000000000118A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0118A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_118a000_Server1.jbxd

Similarity

API ID: LongNamePath
String ID:
API String ID: 82841172-0
Opcode ID: ff48ad53cabd8dec6885d4680bffc50e4c130beb35338d81fda12d16d9161036
Instruction ID: 3678295d45aeb2513adac2672c23deccd81489957753c699097dec730064ae7e
Opcode Fuzzy Hash: ff48ad53cabd8dec6885d4680bffc50e4c130beb35338d81fda12d16d9161036
Instruction Fuzzy Hash: C601BC764042408FDB20DF15E985B26FBE4EF08220F08C4AAEE498B612C375A408CF62

Function 052C1602 Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

CoGetObjectContext.COMBASE(?,?), ref: 052C1637

Memory Dump Source

Source File: 00000005.00000002.3713847871.00000000052C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_52c0000_Server1.jbxd

Similarity

API ID: ContextObject
String ID:
API String ID: 3343934925-0
Opcode ID: 94ea968e59b209f6636334104d0dc1cf581e507f42b3ca3b7035436360019489
Instruction ID: 2bd8f691b063d0bff2aa67cbf16ad3737c075af6da580adad94591c1bee4fc7b
Opcode Fuzzy Hash: 94ea968e59b209f6636334104d0dc1cf581e507f42b3ca3b7035436360019489
Instruction Fuzzy Hash: C9F069754142409FEB20CF05D886B25FFA1EF09220F18C1DEEE494B257D3B9A468CEA2

Function 0118AAC2 Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(?), ref: 0118AAF4

Memory Dump Source

Source File: 00000005.00000002.3709941862.000000000118A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0118A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_118a000_Server1.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: cb306edb1e43453f49431c468747984368664dc8a29128ae70b9dcd93e33ff29
Instruction ID: c76d251c098e1a8c8e9f86bd7416db0520867426e4ad26d8c372052302ba5958
Opcode Fuzzy Hash: cb306edb1e43453f49431c468747984368664dc8a29128ae70b9dcd93e33ff29
Instruction Fuzzy Hash: 7DF0C2755046409FDB24DF06E885B22FBE0EF04224F08C4DBDE094F756D3B9A848CEA2

Function 05158BDF Relevance: 1.5, Strings: 1, Instructions: 269COMMON

Download Yara Rule

Strings

:@cl, xrefs: 051590BB

Memory Dump Source

Source File: 00000005.00000002.3713741754.0000000005150000.00000040.00000800.00020000.00000000.sdmp, Offset: 05150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5150000_Server1.jbxd

Similarity

API ID:
String ID: :@cl
API String ID: 0-3298582286
Opcode ID: 454fd712afe0109645bfb0443f92cbd4e7ad37e1e215242aec5bd37779df1653
Instruction ID: 496f028af0559370aaf52680ffbb272da95537b660bb66befb02a5710d5f87d6
Opcode Fuzzy Hash: 454fd712afe0109645bfb0443f92cbd4e7ad37e1e215242aec5bd37779df1653
Instruction Fuzzy Hash: FAA16E31A0020DEFCB19EF75E46496D77B2BF88358B51853AE816977A8DF35AC02CB50

Function 05158CF5 Relevance: 1.5, Strings: 1, Instructions: 232COMMON

Download Yara Rule

Strings

:@cl, xrefs: 051590BB

Memory Dump Source

Source File: 00000005.00000002.3713741754.0000000005150000.00000040.00000800.00020000.00000000.sdmp, Offset: 05150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5150000_Server1.jbxd

Similarity

API ID:
String ID: :@cl
API String ID: 0-3298582286
Opcode ID: b738265c92bcd33ee70761128c41bfe488e3a4529daf0784900750955eb8b8f0
Instruction ID: fbea5d828dd06d31396f9d4d0203ef4297dcd4e43428931a9480cde3dab66c31
Opcode Fuzzy Hash: b738265c92bcd33ee70761128c41bfe488e3a4529daf0784900750955eb8b8f0
Instruction Fuzzy Hash: EA917E31A0020DEFCB19EF75E4649AD77B2BF88358B51853AE816977A8DF359C02CB50

Function 05158D53 Relevance: 1.5, Strings: 1, Instructions: 221COMMON

Download Yara Rule

Strings

:@cl, xrefs: 051590BB

Memory Dump Source

Source File: 00000005.00000002.3713741754.0000000005150000.00000040.00000800.00020000.00000000.sdmp, Offset: 05150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5150000_Server1.jbxd

Similarity

API ID:
String ID: :@cl
API String ID: 0-3298582286
Opcode ID: 46632512c7a5c146fe496fe343f53e5c10a3a92b82e41a86f0c0447efbacbf2d
Instruction ID: 3a7105a9459512157b07f072ff2924fffe444bd3a7e952d29a76e08b7f8a96f4
Opcode Fuzzy Hash: 46632512c7a5c146fe496fe343f53e5c10a3a92b82e41a86f0c0447efbacbf2d
Instruction Fuzzy Hash: 12915D34A0020DEFCB19EF75E46496D77B2BF88358B51853AE816977A8DF359C02CB50

Function 05158DA3 Relevance: 1.5, Strings: 1, Instructions: 214COMMON

Download Yara Rule

Strings

:@cl, xrefs: 051590BB

Memory Dump Source

Source File: 00000005.00000002.3713741754.0000000005150000.00000040.00000800.00020000.00000000.sdmp, Offset: 05150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5150000_Server1.jbxd

Similarity

API ID:
String ID: :@cl
API String ID: 0-3298582286
Opcode ID: 6a81430a7b75be90c3f76cc4e783cfed431d787be5470bded748259390bf74a3
Instruction ID: 1ad3c66c6edaae908c9296cbb8bb89cb3ab5beccb8d195492b87740d501346ed
Opcode Fuzzy Hash: 6a81430a7b75be90c3f76cc4e783cfed431d787be5470bded748259390bf74a3
Instruction Fuzzy Hash: D1814C30A00209EFCB19EF75E464A6D77B2BF88358B51853AE916977A8DB359C02CB50

Function 05158E25 Relevance: 1.4, Strings: 1, Instructions: 193COMMON

Download Yara Rule

Strings

:@cl, xrefs: 051590BB

Memory Dump Source

Source File: 00000005.00000002.3713741754.0000000005150000.00000040.00000800.00020000.00000000.sdmp, Offset: 05150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5150000_Server1.jbxd

Similarity

API ID:
String ID: :@cl
API String ID: 0-3298582286
Opcode ID: ecc497c46ff58d3a93acb99730028df6ed0ce954a5b958aae9ecc8865a01950d
Instruction ID: 39a3771f5c2fdf178bbe1471219c51c243d28f5defd4bfca6db3f679bffa2469
Opcode Fuzzy Hash: ecc497c46ff58d3a93acb99730028df6ed0ce954a5b958aae9ecc8865a01950d
Instruction Fuzzy Hash: 21715D30A00209EFCB19EF75E464A6D77B3BF88358B61853AE915977A8DB359C02CB50

Function 05158F15 Relevance: 1.4, Strings: 1, Instructions: 146COMMON

Download Yara Rule

Strings

:@cl, xrefs: 051590BB

Memory Dump Source

Source File: 00000005.00000002.3713741754.0000000005150000.00000040.00000800.00020000.00000000.sdmp, Offset: 05150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5150000_Server1.jbxd

Similarity

API ID:
String ID: :@cl
API String ID: 0-3298582286
Opcode ID: 970a14583c1d526cf2d8d3f20d3fd42a1f7d3a2b11acb78804ec7975498c1b66
Instruction ID: 18b7e7dd15dcc32084483ef41d198417c2455abd8c891f9a596bf5d5a8927738
Opcode Fuzzy Hash: 970a14583c1d526cf2d8d3f20d3fd42a1f7d3a2b11acb78804ec7975498c1b66
Instruction Fuzzy Hash: 12518331B00218DFCB18EF75E464A6D73A2BF88358F11853AE9169B7A8DF399C01CB50

Function 05150958 Relevance: 1.4, Strings: 1, Instructions: 109COMMON

Download Yara Rule

Strings

:@cl, xrefs: 05150A05

Memory Dump Source

Source File: 00000005.00000002.3713741754.0000000005150000.00000040.00000800.00020000.00000000.sdmp, Offset: 05150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5150000_Server1.jbxd

Similarity

API ID:
String ID: :@cl
API String ID: 0-3298582286
Opcode ID: c56afb7991ee073205f43020d284ea73a99885d191978b979b7f7da56e5b774d
Instruction ID: 8f20fd40475d2854118cc09247977679e268439ed93beb9588a53c96b0cc709f
Opcode Fuzzy Hash: c56afb7991ee073205f43020d284ea73a99885d191978b979b7f7da56e5b774d
Instruction Fuzzy Hash: 08312430B012199FCB48FB75D82577E37A7EB88218F01443AD515DB3A9EF789D0687A1

Function 0118AC2C Relevance: 1.3, APIs: 1, Instructions: 69COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 0118ACA0

Memory Dump Source

Source File: 00000005.00000002.3709941862.000000000118A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0118A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_118a000_Server1.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: b88bcd429a40229ed956d2aaaeffdbec409239b6f304472e3ad6bcd2fbeb1f3d
Instruction ID: 4e0d13c760a5c051ff1a7768123211f5c92638d109819444a40547dd265cc47f
Opcode Fuzzy Hash: b88bcd429a40229ed956d2aaaeffdbec409239b6f304472e3ad6bcd2fbeb1f3d
Instruction Fuzzy Hash: 4421F6755093C05FD7128F25DC95752BFA8EF07220F0980EBED858F293D2649908CB62

Function 0118A61E Relevance: 1.3, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 0118A690

Memory Dump Source

Source File: 00000005.00000002.3709941862.000000000118A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0118A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_118a000_Server1.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: c89bd0914f7e21716f64e780d08b5d757b496c0f578a341c9009410c4da498b8
Instruction ID: fdd3220059d6cda702894a1e001ae97eda41c0f2441cdf4e4ec316dc5fcf6da4
Opcode Fuzzy Hash: c89bd0914f7e21716f64e780d08b5d757b496c0f578a341c9009410c4da498b8
Instruction Fuzzy Hash: D3215C714093C05FDB128B25DC95B52BFB4DF47224F0984DBED849F1A7D2699908CBB2

Function 0118AC6E Relevance: 1.3, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 0118ACA0

Memory Dump Source

Source File: 00000005.00000002.3709941862.000000000118A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0118A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_118a000_Server1.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 0363ce36101b221c58b77d197d41669e1ca59f761721641a50550a894b8a98d0
Instruction ID: 04a6681635b6cca8563c5e0b40ba1880f3a47eb9c93199b1256c24d22d014476
Opcode Fuzzy Hash: 0363ce36101b221c58b77d197d41669e1ca59f761721641a50550a894b8a98d0
Instruction Fuzzy Hash: 5001D6755042408FDB54DF19E985766FBE4EF04220F08C4ABDD098F656D379E448CFA2

Function 0118A65E Relevance: 1.3, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 0118A690

Memory Dump Source

Source File: 00000005.00000002.3709941862.000000000118A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0118A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_118a000_Server1.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: a84ef0eeed7e502c9babba449110e19b1cdcdb9fac3410d87dc99b5ea11fa8c4
Instruction ID: e517de57fe568d74297d99e9cc5b378952c4f061448f2c4788f0da236911607e
Opcode Fuzzy Hash: a84ef0eeed7e502c9babba449110e19b1cdcdb9fac3410d87dc99b5ea11fa8c4
Instruction Fuzzy Hash: 7201D1B58042408FDB10DF16E885766FBE4EF44324F19C4ABDD088F25AD379A448CFA2

Function 05153802 Relevance: .5, Instructions: 500COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3713741754.0000000005150000.00000040.00000800.00020000.00000000.sdmp, Offset: 05150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5150000_Server1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24ae16bf1e8a523d51e9ee3e6c02d38741bf6a78416b343ecd36b603c60cbc55
Instruction ID: f9e378c22176ceb3a56693ad9a562895f249003e7d896f9dcebba382d3187184
Opcode Fuzzy Hash: 24ae16bf1e8a523d51e9ee3e6c02d38741bf6a78416b343ecd36b603c60cbc55
Instruction Fuzzy Hash: 75323634A00219CFCB28EF74D954BEDB7B2BB49308F1045AAD519AB398DB759E85CF40

Function 05157190 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3713741754.0000000005150000.00000040.00000800.00020000.00000000.sdmp, Offset: 05150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5150000_Server1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 719f5d241665860b508f99c45c031e63afab53ccbce902f9fd403cdbf143ce31
Instruction ID: 5198f96a03788b212e721608de1709a1cf38e293810dd9b5801ee1aca0a5a61b
Opcode Fuzzy Hash: 719f5d241665860b508f99c45c031e63afab53ccbce902f9fd403cdbf143ce31
Instruction Fuzzy Hash: 9BA11330704216CBDB28EB34C856B6876E2FB842A8F558579E8329B3E4DB75DC01CB50

Function 05153DCC Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3713741754.0000000005150000.00000040.00000800.00020000.00000000.sdmp, Offset: 05150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5150000_Server1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea26f70bf480077af22d59ffcfb94d447d4437fb15a56c06c0c4fa7a4a9161d0
Instruction ID: d47ec564c7a85bf8d78a85c5a9d288c06a2908bfcef4d9036c2be9615eeb05f9
Opcode Fuzzy Hash: ea26f70bf480077af22d59ffcfb94d447d4437fb15a56c06c0c4fa7a4a9161d0
Instruction Fuzzy Hash: 1CA1E534A0121DCFCB25EF74D954AECB7B2BB48318F1041AAD919AB358DB356E81CF40

Function 051539BF Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3713741754.0000000005150000.00000040.00000800.00020000.00000000.sdmp, Offset: 05150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5150000_Server1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc66639c6906931bfecc6bf953d81fd7ce0f0505e86b205f76de7e6d6a3e589e
Instruction ID: bb9e1742aba486c5f823db1df3b8eae6ad458239e968ede303ad1e8195b020e9
Opcode Fuzzy Hash: dc66639c6906931bfecc6bf953d81fd7ce0f0505e86b205f76de7e6d6a3e589e
Instruction Fuzzy Hash: 2D815C30A01218CFDB28EFB4D954BEDB7B2BF49308F4044AAD519AB298DB755E84CF51

Function 0515717B Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3713741754.0000000005150000.00000040.00000800.00020000.00000000.sdmp, Offset: 05150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5150000_Server1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b01dd4fdd259cafb4d4e28d2c001d0c7fd2375ce4b28a09dd621dd63129de41d
Instruction ID: 2ef956228d8f63729f577926e8f61ed6b23e4df089cd22109ef02f39a4d26f70
Opcode Fuzzy Hash: b01dd4fdd259cafb4d4e28d2c001d0c7fd2375ce4b28a09dd621dd63129de41d
Instruction Fuzzy Hash: A351043060420ADFD729DB36D8017A937E2FB443A4F998175E872DB2E1DB35C942CB60

Function 0515756E Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3713741754.0000000005150000.00000040.00000800.00020000.00000000.sdmp, Offset: 05150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5150000_Server1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3dbe536fbc2c90350617e8b7e728c6a7f92dcce9e05c9e4b1d2ead3870a7f85
Instruction ID: d7af91646b139d7dfc541ff84babbf892bb52e6e09d9d657b457dd247696172f
Opcode Fuzzy Hash: a3dbe536fbc2c90350617e8b7e728c6a7f92dcce9e05c9e4b1d2ead3870a7f85
Instruction Fuzzy Hash: 8441E73060421ADBDB29DB35D80277836E2FB443A4F998175E872DB2E4DF35C942CB60

Function 05153B18 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3713741754.0000000005150000.00000040.00000800.00020000.00000000.sdmp, Offset: 05150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5150000_Server1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da8df47c8c11334697e1553cefa626af582ab97fc8332984a8bab120cf386ed6
Instruction ID: 7a95ba09d577b059936aa3adab090184eb6a1aa7d7752d22a7455f1e66f55fa9
Opcode Fuzzy Hash: da8df47c8c11334697e1553cefa626af582ab97fc8332984a8bab120cf386ed6
Instruction Fuzzy Hash: 1E417F34A00218CFDB28EFB4D954BECB7B2BF49308F4144AAD419AB698DBB45E44CF51

Function 051594F0 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3713741754.0000000005150000.00000040.00000800.00020000.00000000.sdmp, Offset: 05150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5150000_Server1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c654a0f93e67cc660bda2eecb55ec221d98f21ee4513cf390337cc45ee1bef88
Instruction ID: cba9dadf2e9e311b7885b9ee80a8e8d96dcb16809279501ae9566d17251b7fac
Opcode Fuzzy Hash: c654a0f93e67cc660bda2eecb55ec221d98f21ee4513cf390337cc45ee1bef88
Instruction Fuzzy Hash: 8C31D130B00205DFDB14DF75D954BAEBBE6BF88224F14407AE925EB3A4DB709808CB91

Function 051500B8 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3713741754.0000000005150000.00000040.00000800.00020000.00000000.sdmp, Offset: 05150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5150000_Server1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a808254037761e2d578127a37ecda85ee56c53422f4f485a55ff09ed8f227bf4
Instruction ID: b9f9404d90143ec82422928ba11cde265d1e4a7c3df2199f077d4aac43f5d96f
Opcode Fuzzy Hash: a808254037761e2d578127a37ecda85ee56c53422f4f485a55ff09ed8f227bf4
Instruction Fuzzy Hash: 713126317443089FC719E77498617AE3B67ABC2218B4484BAD004CB685DF758C0AC7D1

Function 051536F0 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3713741754.0000000005150000.00000040.00000800.00020000.00000000.sdmp, Offset: 05150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5150000_Server1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db0bbcd4e83cb9429c074201a1a2f562601053adbb98f4a38f1818d641a4845e
Instruction ID: de6396cb272cef11f096f537b7e57de7d7b894357781ed3260158772a52712f4
Opcode Fuzzy Hash: db0bbcd4e83cb9429c074201a1a2f562601053adbb98f4a38f1818d641a4845e
Instruction Fuzzy Hash: 2821D675B002499FEB24DF79C840B6A77E6FF89244F144828EA16EB344D770EC008790

Function 05159210 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3713741754.0000000005150000.00000040.00000800.00020000.00000000.sdmp, Offset: 05150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5150000_Server1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b543405f0cd9f6f61612a19d17a29e8c0ff73e9249a41ecdbe9ae7857e26089f
Instruction ID: 71ab6f72363bd4d6832676b605af476e9f049f02b8bcebb528295711fbb929a0
Opcode Fuzzy Hash: b543405f0cd9f6f61612a19d17a29e8c0ff73e9249a41ecdbe9ae7857e26089f
Instruction Fuzzy Hash: BB1120B1A002199FCF54EFB8D8088AE77F6EBCD254711857AC409E7344EB368D12CB90

Function 05961F4C Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3714124114.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5960000_Server1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7954b5277f6f7a5d4ca6312d1974a4a5ebb73c753423b573e40d194998f3acd
Instruction ID: 3477b87066c61cdc0a25cdff1e6837aa0487d1f7cad69d346bba191c3bd270d7
Opcode Fuzzy Hash: f7954b5277f6f7a5d4ca6312d1974a4a5ebb73c753423b573e40d194998f3acd
Instruction Fuzzy Hash: 1611BAB5908341AFD350CF19D841A5BFBE4FB88664F04895EF998D7311D371EA088FA2

Function 011907DE Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3709963575.0000000001190000.00000040.00000020.00020000.00000000.sdmp, Offset: 01190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1190000_Server1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5aed96359eac27e682a64566e61cfe463141fcdcbc9697897430d7a8e45b3d32
Instruction ID: fed7ce195f1ce8179384e788fb501672bbf8df430c13a4cd3e12bce0c7a2430f
Opcode Fuzzy Hash: 5aed96359eac27e682a64566e61cfe463141fcdcbc9697897430d7a8e45b3d32
Instruction Fuzzy Hash: 29214C3150D3C08FCB178B64C850B61BFB1AF4B208F1989EED4848F6A3C73A9846DB52

Function 01190814 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3709963575.0000000001190000.00000040.00000020.00020000.00000000.sdmp, Offset: 01190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1190000_Server1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 114923fd920787aacf434ab2073ff553e34300a1975944ed40985b549a480b95
Instruction ID: e3062a95846b39913cc150c4092fba56f226d07f74927e6d06d7e39e8af695c6
Opcode Fuzzy Hash: 114923fd920787aacf434ab2073ff553e34300a1975944ed40985b549a480b95
Instruction Fuzzy Hash: 3D11E431B082409FDB19CB14D540B26FBA9AB8C708F24C9ACF5490F653C77BD853CA82

Function 05150118 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3713741754.0000000005150000.00000040.00000800.00020000.00000000.sdmp, Offset: 05150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5150000_Server1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f247c0b030da36bc35cab95874bdd8035d7ec0a4de6bbdb5c0a880bd6b66fb2
Instruction ID: b0e2ffb0219d069e346d44d32eefe021d2a74a7976e94073fb66193f8c9aebd2
Opcode Fuzzy Hash: 1f247c0b030da36bc35cab95874bdd8035d7ec0a4de6bbdb5c0a880bd6b66fb2
Instruction Fuzzy Hash: 2E11C6353442484FC36DB779A5617AD3BA66BC621C385C87ED005CBB49DFB58C0A87D2

Function 011AB0B4 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3710022950.00000000011AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 011AA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11aa000_Server1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3cb425c2bffb30fcfe76fcdeeb1795adfd98949d3edaf9d1e4fe5d5217db42b7
Instruction ID: 13faf705c1e670a954234dd02fe848ee1b8368e3a167045baafbcea542b23002
Opcode Fuzzy Hash: 3cb425c2bffb30fcfe76fcdeeb1795adfd98949d3edaf9d1e4fe5d5217db42b7
Instruction Fuzzy Hash: 3F11CCB6908301AFD350CF09DC45E57FBE8EB88660F04891EF95997311D371E9088FA2

Function 05961DF0 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3714124114.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5960000_Server1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84392e91524c4e8ab888e8cb499d979ebd282ec17c2a103f7447b143e2cf02d1
Instruction ID: b80e0595fbdb7483624ef9673a5847e78644b56bb264a2b8c5cc4bd8a8070642
Opcode Fuzzy Hash: 84392e91524c4e8ab888e8cb499d979ebd282ec17c2a103f7447b143e2cf02d1
Instruction Fuzzy Hash: 8511CCB6908301AFD350CF19DC85E57FBE9EB88660F04891EF95997311D371E9088FA2

Function 011905E0 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3709963575.0000000001190000.00000040.00000020.00020000.00000000.sdmp, Offset: 01190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1190000_Server1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34e5063364d83d86c2f0c9ae785514cf96f9e65888ed9a82ebd17e85ddecf0f5
Instruction ID: 47507ee7df34f1f8e3ae0a48dccfa09773d49c2ce6bd3a7aa15be275a9a780ec
Opcode Fuzzy Hash: 34e5063364d83d86c2f0c9ae785514cf96f9e65888ed9a82ebd17e85ddecf0f5
Instruction Fuzzy Hash: 14F0F4B65093806FD7118F06EC40873FFB8EF86620709C0AFEC498B612D265B808CB72

Function 05150879 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3713741754.0000000005150000.00000040.00000800.00020000.00000000.sdmp, Offset: 05150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5150000_Server1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7113afd54fda93c82d1b9f143074fc79eb01030cb9dc5fc1ab6c3f61a607fa31
Instruction ID: 1af35a6a1d7984a58a55df5637b20806b35cea36565c4966f109f3e35c46b051
Opcode Fuzzy Hash: 7113afd54fda93c82d1b9f143074fc79eb01030cb9dc5fc1ab6c3f61a607fa31
Instruction Fuzzy Hash: 6F018074609246DFC749FB78D15841DBFE2EF84208BA4C82DE5658B319EBB89805CF43

Function 051500A8 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3713741754.0000000005150000.00000040.00000800.00020000.00000000.sdmp, Offset: 05150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5150000_Server1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd34c8ea77baea1f46b90140d0ece78170bc5f6caf5fa8ddf0c932b90d365c36
Instruction ID: 208023b8e4d86f43ad07cf96bae159eeec130fd354c68037bbceb099cd68f181
Opcode Fuzzy Hash: dd34c8ea77baea1f46b90140d0ece78170bc5f6caf5fa8ddf0c932b90d365c36
Instruction Fuzzy Hash: B0F0AF76A40304AFEB089F709C52BAE7B72AB82724F1485AE9941DB2D1DA3598418790

Function 0515001B Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3713741754.0000000005150000.00000040.00000800.00020000.00000000.sdmp, Offset: 05150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5150000_Server1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3805bba155c3bffac174a9341833bb5f6351dddc1bb87dff225c4901b00978fa
Instruction ID: 5caa679ea95691d3522bc34f7f1d8d05bed20c94216fdcdf68bafada43b9e141
Opcode Fuzzy Hash: 3805bba155c3bffac174a9341833bb5f6351dddc1bb87dff225c4901b00978fa
Instruction Fuzzy Hash: EB01F66101E3C69FC3439774DC60B417F70AB57209F8A45E7D090CB1ABD3AC5809D762

Function 011908D0 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3709963575.0000000001190000.00000040.00000020.00020000.00000000.sdmp, Offset: 01190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1190000_Server1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00fa7d26781d4bf7e28ed3f778328433ff1ca568d933e56f906ecfa426652f5c
Instruction ID: aa47cd5dbd905efb65d650e776f35fb0305ca29b9ea02f3569f85b0278bdf99e
Opcode Fuzzy Hash: 00fa7d26781d4bf7e28ed3f778328433ff1ca568d933e56f906ecfa426652f5c
Instruction Fuzzy Hash: 39F01D35604644DFC716CF04D580B25FBA6EB89718F24CAADE9491B762C737D813DA81

Function 01190606 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3709963575.0000000001190000.00000040.00000020.00020000.00000000.sdmp, Offset: 01190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1190000_Server1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 588c3d8b3cee9ea6585cf121763234aac77e0b03286d13bf8a0c806a697de4fd
Instruction ID: a2f13fc3a9ab371f3c346e4473423958c3f7f7c4fb83a24202bfe5127118da5e
Opcode Fuzzy Hash: 588c3d8b3cee9ea6585cf121763234aac77e0b03286d13bf8a0c806a697de4fd
Instruction Fuzzy Hash: 65E092B66046044B9650CF0BFC41462F7D8EB88630708C07FDC0D8B701D675B908CEA6

Function 011AB103 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3710022950.00000000011AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 011AA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11aa000_Server1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f07f17fc5395ae78036b0cfb81ca5613ff004b0e56c0ad014ed6f46533af6b4e
Instruction ID: 55155da31035e46656af423f74e65303bc4f4731d553dd7c916c5096027d9fa2
Opcode Fuzzy Hash: f07f17fc5395ae78036b0cfb81ca5613ff004b0e56c0ad014ed6f46533af6b4e
Instruction Fuzzy Hash: 01E0D8F294020467D2508E06EC46F22FB98DB44971F04C557EE081B701D271750889F5

Function 05961FB7 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3714124114.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5960000_Server1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf74a82b59ac29bb0aedf8a6cacfb42a7f19f905f54ed4c0592bb374384c3375
Instruction ID: 22fdb4096304b511be499e314f30e78abf01c0255bac10bd4c3ecaf10d65f8d2
Opcode Fuzzy Hash: cf74a82b59ac29bb0aedf8a6cacfb42a7f19f905f54ed4c0592bb374384c3375
Instruction Fuzzy Hash: 24E0D8F294020067D2508E06EC46F22FB98DB44970F04C567ED081B741D271761889F6

Function 05961E3F Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3714124114.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5960000_Server1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e713220272846841b24f21465132edb45c65267c1cb19dafe06c32f9ff151a4d
Instruction ID: 172dee084d061a58dc6b028bf3bad2f4bb64c89d66b1a49ac4c4596f51bb2c13
Opcode Fuzzy Hash: e713220272846841b24f21465132edb45c65267c1cb19dafe06c32f9ff151a4d
Instruction Fuzzy Hash: FDE0D8F290020467D2509E06EC46F23FB98DB44930F04C557EE081B702E272760489F5

Function 05961863 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3714124114.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5960000_Server1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eed0fc26c5ea7c55adf4ea0eb30246332f6f4a050d30022c2c6db96969483196
Instruction ID: 050db322d1b16b2a0074eafffb00452c39c39da878cd989b5077ba1259f1bea5
Opcode Fuzzy Hash: eed0fc26c5ea7c55adf4ea0eb30246332f6f4a050d30022c2c6db96969483196
Instruction Fuzzy Hash: A8E0D8F290060067D2509E06EC46F23FB98DB44930F04C567EE081B701D1727614CDF5

Function 05154200 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3713741754.0000000005150000.00000040.00000800.00020000.00000000.sdmp, Offset: 05150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5150000_Server1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 697ae23b51f3393d1a06173c1b49b26cb3b9d69b6784333a6b2d67f7366ff17d
Instruction ID: 9c4b72d917f41628ddadb36848b3dccf00cbf25cff5c8ea2f8ac78b9083168a4
Opcode Fuzzy Hash: 697ae23b51f3393d1a06173c1b49b26cb3b9d69b6784333a6b2d67f7366ff17d
Instruction Fuzzy Hash: 46E04F70949288AFC745CFB49C118D97BB8DF06214B1641F9D889C7652EA351E05CB92

Function 051536A8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3713741754.0000000005150000.00000040.00000800.00020000.00000000.sdmp, Offset: 05150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5150000_Server1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb5969f7620870069e5d3e3492d76114f1f3319e81c648902618848e2622d0fb
Instruction ID: 06224a37e19faabd8ac3cf04556f7012869f954342a583799c0a7a2700ebc574
Opcode Fuzzy Hash: eb5969f7620870069e5d3e3492d76114f1f3319e81c648902618848e2622d0fb
Instruction Fuzzy Hash: ACE0C230146344CFC70A3BB4A42841C3BB9AB4721834408FDC0528E766EB3EA882CB50

Function 051594AF Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3713741754.0000000005150000.00000040.00000800.00020000.00000000.sdmp, Offset: 05150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5150000_Server1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ead4377eb64ef19d4979808de5f70cfb3bb3716c5671ea658a894a075ab37a18
Instruction ID: caaf3db457d51fa573fe3ffe628c06925318fbd7f2609151c175c89a47876d2b
Opcode Fuzzy Hash: ead4377eb64ef19d4979808de5f70cfb3bb3716c5671ea658a894a075ab37a18
Instruction Fuzzy Hash: 43E0C2706483CCDFCB069BF0D91549C3FB4CA0321071400FEC85597253DA391A1CC742

Function 011823F4 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3709920113.0000000001182000.00000040.00000800.00020000.00000000.sdmp, Offset: 01182000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1182000_Server1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c12d7678bc677d10bfc4a41be17345743eac46b955147fd08ba1cce9d33de60
Instruction ID: 66ba0346bb8872d6566aee1c210b51131eb482a17c3fb78bb1d672dae56cd89b
Opcode Fuzzy Hash: 3c12d7678bc677d10bfc4a41be17345743eac46b955147fd08ba1cce9d33de60
Instruction Fuzzy Hash: B2D05E79345A814FE31BAE1CC2A4B953BE4AB51714F5A84FAA8008B763C768D581DA10

Function 011823BC Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3709920113.0000000001182000.00000040.00000800.00020000.00000000.sdmp, Offset: 01182000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1182000_Server1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea781cbd51fb86f42b840b1dbf8c69f46d5b85f38fc9d0a74542cd9cbbb13af9
Instruction ID: 98df374650514ca5f016b8d254164424370c92c6cc4c92954c8a596d661bdc49
Opcode Fuzzy Hash: ea781cbd51fb86f42b840b1dbf8c69f46d5b85f38fc9d0a74542cd9cbbb13af9
Instruction Fuzzy Hash: E4D05E342442814BE71AEE0CC2E4F5937D4AB44B14F0684E8BC108B662C7B8D9C0CE00

Function 05154210 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3713741754.0000000005150000.00000040.00000800.00020000.00000000.sdmp, Offset: 05150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5150000_Server1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a8617a2d3af941b447cdb052db17a4e1eb0b302a50ffbb4b80fc97263efdd15
Instruction ID: dac317087aacee0da8184a854a2582bf544ffd73f18578c58eb736233a8fa3f8
Opcode Fuzzy Hash: 9a8617a2d3af941b447cdb052db17a4e1eb0b302a50ffbb4b80fc97263efdd15
Instruction Fuzzy Hash: 13D0C971A15208EF8754DFA8D9018DDBBF9EB45215B1541B9E80DD3650EE715E00DB81

Non-executed Functions

Function 0515499D Relevance: 8.9, Strings: 6, Instructions: 1447COMMON

Download Yara Rule

Strings

:@cl, xrefs: 05154CF3
, xrefs: 05154BC4
:@cl, xrefs: 05156CF5
:@cl, xrefs: 05154E43
:@cl, xrefs: 05154D9A
:@cl, xrefs: 05155541

Memory Dump Source

Source File: 00000005.00000002.3713741754.0000000005150000.00000040.00000800.00020000.00000000.sdmp, Offset: 05150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5150000_Server1.jbxd

Similarity

API ID:
String ID: $:@cl$:@cl$:@cl$:@cl$:@cl
API String ID: 0-3491856805
Opcode ID: 773b593aac9ec1aa79d7e979502438c8b13e0a32d2c885bb5125b9eaaafebe84
Instruction ID: d2cc8fd66c107c610a9cb3b3bf214a416ac89efe90a83b32860daa4a8383c358
Opcode Fuzzy Hash: 773b593aac9ec1aa79d7e979502438c8b13e0a32d2c885bb5125b9eaaafebe84
Instruction Fuzzy Hash: 41F23974A0122CCFDB25EF34D9A4BA9B7B2BB48308F4041EAD91967398DB715E85CF50

Function 051549F9 Relevance: 8.9, Strings: 6, Instructions: 1440COMMON

Download Yara Rule

Strings

:@cl, xrefs: 05154CF3
, xrefs: 05154BC4
:@cl, xrefs: 05156CF5
:@cl, xrefs: 05154E43
:@cl, xrefs: 05154D9A
:@cl, xrefs: 05155541

Memory Dump Source

Source File: 00000005.00000002.3713741754.0000000005150000.00000040.00000800.00020000.00000000.sdmp, Offset: 05150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5150000_Server1.jbxd

Similarity

API ID:
String ID: $:@cl$:@cl$:@cl$:@cl$:@cl
API String ID: 0-3491856805
Opcode ID: 7c7e32c0c8b0a42340f18d327fc9e552d10c6f8889c5ca52a3b710d635f92727
Instruction ID: 52519ca5b5a1546ffa9e08ba5b9718bf5a4ee3ff82e26e0d42c29262065ca49a
Opcode Fuzzy Hash: 7c7e32c0c8b0a42340f18d327fc9e552d10c6f8889c5ca52a3b710d635f92727
Instruction Fuzzy Hash: AAF22974A0122CCFDB25EF34D9A4BA9B7B2BB48308F4041EAD91967394DB715E85CF50

Function 05154B5B Relevance: 8.9, Strings: 6, Instructions: 1383COMMON

Download Yara Rule

Strings

:@cl, xrefs: 05154CF3
, xrefs: 05154BC4
:@cl, xrefs: 05156CF5
:@cl, xrefs: 05154E43
:@cl, xrefs: 05154D9A
:@cl, xrefs: 05155541

Memory Dump Source

Source File: 00000005.00000002.3713741754.0000000005150000.00000040.00000800.00020000.00000000.sdmp, Offset: 05150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5150000_Server1.jbxd

Similarity

API ID:
String ID: $:@cl$:@cl$:@cl$:@cl$:@cl
API String ID: 0-3491856805
Opcode ID: 9c3f3369f9416042debad6bb8ea8679f1c5ae8fb819b9d4a49dbaf805b815970
Instruction ID: 20aab6629eb51622bea30faceba1ea10b7d2e59f06880fa0a1c4f56b804072da
Opcode Fuzzy Hash: 9c3f3369f9416042debad6bb8ea8679f1c5ae8fb819b9d4a49dbaf805b815970
Instruction Fuzzy Hash: F4E23974A0122CCFDB25EF34D9A4BA9B7B2BB48308F4081EAD91967394DB355E85CF50

Function 05154C8F Relevance: 7.6, Strings: 5, Instructions: 1362COMMON

Download Yara Rule

Strings

:@cl, xrefs: 05154CF3
:@cl, xrefs: 05156CF5
:@cl, xrefs: 05154E43
:@cl, xrefs: 05154D9A
:@cl, xrefs: 05155541

Memory Dump Source

Source File: 00000005.00000002.3713741754.0000000005150000.00000040.00000800.00020000.00000000.sdmp, Offset: 05150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5150000_Server1.jbxd

Similarity

API ID:
String ID: :@cl$:@cl$:@cl$:@cl$:@cl
API String ID: 0-407519521
Opcode ID: 364fb94b64b791ce79a7151ac0a6160c1b30fa472f881217a972bcf901dec83c
Instruction ID: 0f15d8b3389ae26e4f0377dcc4fc295514b94f1be2b014865713562cdfcefe5d
Opcode Fuzzy Hash: 364fb94b64b791ce79a7151ac0a6160c1b30fa472f881217a972bcf901dec83c
Instruction Fuzzy Hash: 3FE22974A0122CCFDB25EF34D9A4BA9B7B2BB48308F4081EAD91967394DB355E85CF50

Function 05154F2F Relevance: 3.7, Strings: 2, Instructions: 1245COMMON

Download Yara Rule

Strings

:@cl, xrefs: 05156CF5
:@cl, xrefs: 05155541

Memory Dump Source

Source File: 00000005.00000002.3713741754.0000000005150000.00000040.00000800.00020000.00000000.sdmp, Offset: 05150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5150000_Server1.jbxd

Similarity

API ID:
String ID: :@cl$:@cl
API String ID: 0-1618611328
Opcode ID: d491f47b3419614b61317226af11b7a820b78555bf65b8c049ef267f8c3764f9
Instruction ID: edbdd45a66f181203b5d233969ecd33aa388313ac2bef3a7f87bdb06ec4ac63d
Opcode Fuzzy Hash: d491f47b3419614b61317226af11b7a820b78555bf65b8c049ef267f8c3764f9
Instruction Fuzzy Hash: 70D22974A0122CCFDB25EF34D9A4BA9BBB2BB48308F4041EAD91967394DB355E85CF50

Function 05154F9D Relevance: 3.7, Strings: 2, Instructions: 1236COMMON

Download Yara Rule

Strings

:@cl, xrefs: 05156CF5
:@cl, xrefs: 05155541

Memory Dump Source

Source File: 00000005.00000002.3713741754.0000000005150000.00000040.00000800.00020000.00000000.sdmp, Offset: 05150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5150000_Server1.jbxd

Similarity

API ID:
String ID: :@cl$:@cl
API String ID: 0-1618611328
Opcode ID: cdb941f5994a0380830c236d0e1a4c7a94a4ac040a143b9cb0116978844087e3
Instruction ID: ae2cc679fb63780d8740c73ec9afcfe48acf2e1eda87d7b5d4d5f191d5682d1d
Opcode Fuzzy Hash: cdb941f5994a0380830c236d0e1a4c7a94a4ac040a143b9cb0116978844087e3
Instruction Fuzzy Hash: C4D21974A0122CCFDB25EF34D9A4BA9BBB2BB49308F4041EAD91967394DB315E85CF50

Function 05155000 Relevance: 3.7, Strings: 2, Instructions: 1230COMMON

Download Yara Rule

Strings

:@cl, xrefs: 05156CF5
:@cl, xrefs: 05155541

Memory Dump Source

Source File: 00000005.00000002.3713741754.0000000005150000.00000040.00000800.00020000.00000000.sdmp, Offset: 05150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5150000_Server1.jbxd

Similarity

API ID:
String ID: :@cl$:@cl
API String ID: 0-1618611328
Opcode ID: 78382e598d94fbbf706c8ff79349c11ae9376c0243c471f2a8ad6e518a244031
Instruction ID: d0ad5876326832ddd159ed8f537cde188b181c589eb1c181db83b0e87f1ba0f4
Opcode Fuzzy Hash: 78382e598d94fbbf706c8ff79349c11ae9376c0243c471f2a8ad6e518a244031
Instruction Fuzzy Hash: 42D21974A0122CCFDB25EF34D9A4BA9BBB2BB49308F4041EAD91967394DB315E85CF50

Function 0515505D Relevance: 3.7, Strings: 2, Instructions: 1225COMMON

Download Yara Rule

Strings

:@cl, xrefs: 05156CF5
:@cl, xrefs: 05155541

Memory Dump Source

Source File: 00000005.00000002.3713741754.0000000005150000.00000040.00000800.00020000.00000000.sdmp, Offset: 05150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5150000_Server1.jbxd

Similarity

API ID:
String ID: :@cl$:@cl
API String ID: 0-1618611328
Opcode ID: d98703a6af8a39e676f650554cbdfc879f2a3abbf60387fe40c3f4330dd1d383
Instruction ID: bfe698ec4075947f30db9182d053be52398e11f150d410d02f7c3523108e1f3b
Opcode Fuzzy Hash: d98703a6af8a39e676f650554cbdfc879f2a3abbf60387fe40c3f4330dd1d383
Instruction Fuzzy Hash: 6FD21974A0122CCFDB25EF34D9A4BA9BBB2BB49308F4041EAD91967394DB315E85CF50

Function 051550E3 Relevance: 3.7, Strings: 2, Instructions: 1210COMMON

Download Yara Rule

Strings

:@cl, xrefs: 05156CF5
:@cl, xrefs: 05155541

Memory Dump Source

Source File: 00000005.00000002.3713741754.0000000005150000.00000040.00000800.00020000.00000000.sdmp, Offset: 05150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5150000_Server1.jbxd

Similarity

API ID:
String ID: :@cl$:@cl
API String ID: 0-1618611328
Opcode ID: 3e2c9177e959489de891b78570fcc1d9239c20f3b234031a16e0a66825569958
Instruction ID: 2223efa5a1d5e5c78bb089a81e8c3e28ea8801b8dce7fd6f21ef6adbe057c3d2
Opcode Fuzzy Hash: 3e2c9177e959489de891b78570fcc1d9239c20f3b234031a16e0a66825569958
Instruction Fuzzy Hash: 86D21974A0122CCFDB25EF34D9A4BA9B7B2BB49308F4081EAD91967394DB315E85CF50

Function 0515536F Relevance: 3.6, Strings: 2, Instructions: 1071COMMON

Download Yara Rule

Strings

:@cl, xrefs: 05156CF5
:@cl, xrefs: 05155541

Memory Dump Source

Source File: 00000005.00000002.3713741754.0000000005150000.00000040.00000800.00020000.00000000.sdmp, Offset: 05150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5150000_Server1.jbxd

Similarity

API ID:
String ID: :@cl$:@cl
API String ID: 0-1618611328
Opcode ID: 1d5744054854ebe8d4cb654e7219c97fba4724545955fbb5c368a243d5cac0c8
Instruction ID: 2344775d373a80ec6609cef37a877dcb6b328a8bb7832c015f5b94764bb87026
Opcode Fuzzy Hash: 1d5744054854ebe8d4cb654e7219c97fba4724545955fbb5c368a243d5cac0c8
Instruction Fuzzy Hash: B3C21974A0122CCFDB25EF24D968BA9B7B2FB48308F5081EAD91967394DB315E85CF50

Function 05155459 Relevance: 3.5, Strings: 2, Instructions: 1040COMMON

Download Yara Rule

Strings

:@cl, xrefs: 05156CF5
:@cl, xrefs: 05155541

Memory Dump Source

Source File: 00000005.00000002.3713741754.0000000005150000.00000040.00000800.00020000.00000000.sdmp, Offset: 05150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5150000_Server1.jbxd

Similarity

API ID:
String ID: :@cl$:@cl
API String ID: 0-1618611328
Opcode ID: 9185fd5d80428fd62322fec3df3d17c5ebbb263e5bc5f1419b3a649365bc10d6
Instruction ID: 5853bb5de2039d0e4db71dfbb8b5a3ee3b584efdceaffe57fb2dcc660f13f0aa
Opcode Fuzzy Hash: 9185fd5d80428fd62322fec3df3d17c5ebbb263e5bc5f1419b3a649365bc10d6
Instruction Fuzzy Hash: 18C2097490122CCFDB25EF20D9A8BA9B7B2FB48308F5081EAD91967394DB715E85CF50

Function 01182BD1 Relevance: 2.8, Strings: 2, Instructions: 314COMMON

Download Yara Rule

Strings

fl, xrefs: 01182DE9
fl, xrefs: 01182DDD

Memory Dump Source

Source File: 00000005.00000002.3709920113.0000000001182000.00000040.00000800.00020000.00000000.sdmp, Offset: 01182000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1182000_Server1.jbxd

Similarity

API ID:
String ID: fl$fl
API String ID: 0-3913757221
Opcode ID: f8cad4c968f30b56dfc4f45826acaa4aaf70df32db4dc0c87c6a6d53661b73ca
Instruction ID: 0aa1d2b080edfdcafe3245035d92cbe814a7cf32e798287714fd0eb75fbc982f
Opcode Fuzzy Hash: f8cad4c968f30b56dfc4f45826acaa4aaf70df32db4dc0c87c6a6d53661b73ca
Instruction Fuzzy Hash: 3491226940F7C55FCB075B308C662967F719E03604B0E86DBC990CF5A3D22A6D0EE7A2

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Server1.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Njrat

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\app

\Device\ConDrv

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

Windows Analysis Report
Server1.exe

Function 05154298 Relevance: 10.7, Strings: 7, Instructions: 1950
COMMON

Function 05154287 Relevance: 10.5, Strings: 7, Instructions: 1751
COMMON

Function 051544F1 Relevance: 10.4, Strings: 7, Instructions: 1624
COMMON

Function 05154544 Relevance: 10.4, Strings: 7, Instructions: 1618
COMMON

Function 05154630 Relevance: 9.1, Strings: 6, Instructions: 1579
COMMON

Function 0515470F Relevance: 9.0, Strings: 6, Instructions: 1544
COMMON

Function 051547D4 Relevance: 9.0, Strings: 6, Instructions: 1513
COMMON

Function 05154936 Relevance: 9.0, Strings: 6, Instructions: 1456
COMMON

Function 052C1F5E Relevance: 1.6, APIs: 1, Instructions: 130
registryCOMMON

Function 052C04FF Relevance: 1.6, APIs: 1, Instructions: 98
registryCOMMON

Function 0118B296 Relevance: 1.6, APIs: 1, Instructions: 97
registryCOMMON

Function 052C11EC Relevance: 1.6, APIs: 1, Instructions: 93
COMMON

Function 0118AB25 Relevance: 1.6, APIs: 1, Instructions: 92
fileCOMMON

Function 0118B389 Relevance: 1.6, APIs: 1, Instructions: 89
registryCOMMON

Function 0118B0E6 Relevance: 1.6, APIs: 1, Instructions: 89
synchronizationCOMMON