Edit tour

Windows Analysis Report
Server.exe

Overview

General Information

Sample name:	Server.exe
Analysis ID:	1649453
MD5:	b639b796e755ba9a04a6a5f2900fc084
SHA1:	e1f8a378c4b2c46c873ae77453399b1e9dc01b14
SHA256:	6d498dd502299432d28c52c34726738dac6f0466e12caf4240e09231a00b0d01
Tags:	exeuser-BastianHein
Infos:

Detection

Njrat

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected Njrat

.NET source code contains potential unpacker

Contains functionality to disable the Task Manager (.Net Source)

Contains functionality to spread to USB devices (.Net source)

Disables zone checking for all users

Drops PE files to the startup folder

Joe Sandbox ML detected suspicious sample

Modifies the windows firewall

Uses netsh to modify the Windows network and firewall settings

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality to call native functions

Contains long sleeps (>= 3 min)

Creates a start menu entry (Start Menu\Programs\Startup)

Creates a window with clipboard capturing capabilities

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

May infect USB drives

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Startup Folder File Write

Stores files to the Windows start menu directory

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

Server.exe (PID: 8740 cmdline: "C:\Users\user\Desktop\Server.exe" MD5: B639B796E755BA9A04A6A5F2900FC084)

netsh.exe (PID: 8816 cmdline: netsh firewall add allowedprogram "C:\Users\user\Desktop\Server.exe" "Server.exe" ENABLE MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

conhost.exe (PID: 8832 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
NjRAT	RedPacket Security describes NJRat as "a remote access trojan (RAT) has capabilities to log keystrokes, access the victim's camera, steal credentials stored in browsers, open a reverse shell, upload/download files, view the victim's desktop, perform process, file, and registry manipulations, and capabilities to let the attacker update, uninstall, restart, close, disconnect the RAT and rename its campaign ID. Through the Command & Control (CnC) server software, the attacker has capabilities to create and configure the malware to spread through USB drives."It is supposedly popular with actors in the Middle East. Similar to other RATs, many leaked builders may be backdoored.	AQUATIC PANDA Earth Lusca Operation C-Major The Gorgon Group	http://blog.trendmicro.com/trendlabs-security-intelligence/new-rats-emerge-from-leaked-njw0rm-source-code/ http://blogs.360.cn/post/analysis-of-apt-c-37.html http://threatgeek.typepad.com/files/fta-1009---njrat-uncovered-1.pdf https://about.fb.com/news/2021/04/taking-action-against-hackers-in-palestine/ https://asec.ahnlab.com/1369	https://malpedia.caad.fkie.fraunhofer.de/details/win.njrat

Malware Configuration

Threatname: Njrat

{
  "Campaign ID": "Runtim14531oker.exe",
  "Version": "0.7d",
  "Install Name": "18f92744a712890ce1a5852179df81aa",
  "Install Dir": "Adobe Update",
  "Registry Value": "Software\\Microsoft\\Windows\\CurrentVersion\\Run",
  "Network Seprator": "|'|'|"
}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
Server.exe	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
Server.exe	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x115d2:$a1: get_Registry 0x15a7b:$a2: SEE_MASK_NOZONECHECKS 0x1571d:$a3: Download ERROR 0x15ccd:$a4: cmd.exe /c ping 0 -n 2 & del " 0x13c5a:$a5: netsh firewall delete allowedprogram "
Server.exe	CN_disclosed_20180208_c	Detects malware from disclosed CN malware set	Florian Roth	0x15ccd:$x1: cmd.exe /c ping 0 -n 2 & del " 0x137e6:$s1: winmgmts:\\.\root\SecurityCenter2 0x1573b:$s3: Executed As 0x124f0:$s5: Stub.exe 0x1571d:$s6: Download ERROR 0x137a8:$s8: Select * From AntiVirusProduct
Server.exe	crimeware_njrat_strings	Detects njRAT based on some strings	Sekoia.io	0x154bf:$: set cdaudio door closed 0x15483:$: set cdaudio door open 0x15ce3:$: ping 0 0x13412:$: [endof] 0x132cc:$: TiGeR-Firewall 0x132fa:$: NetSnifferCs 0x132b8:$: IPBlocker 0x13314:$: Sandboxie Control
Server.exe	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x15a7b:$reg: SEE_MASK_NOZONECHECKS 0x15701:$msg: Execute ERROR 0x15755:$msg: Execute ERROR 0x15ccd:$ping: cmd.exe /c ping 0 -n 2 & del
Server.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x13c5a:$s1: netsh firewall delete allowedprogram 0x13cac:$s2: netsh firewall add allowedprogram 0x15ccd:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x15701:$s4: Execute ERROR 0x15755:$s4: Execute ERROR 0x1571d:$s5: Download ERROR
Click to see the 1 entries

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\18f92744a712890ce1a5852179df81aaWindows Update.exe	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\18f92744a712890ce1a5852179df81aaWindows Update.exe	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x115d2:$a1: get_Registry 0x15a7b:$a2: SEE_MASK_NOZONECHECKS 0x1571d:$a3: Download ERROR 0x15ccd:$a4: cmd.exe /c ping 0 -n 2 & del " 0x13c5a:$a5: netsh firewall delete allowedprogram "
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\18f92744a712890ce1a5852179df81aaWindows Update.exe	CN_disclosed_20180208_c	Detects malware from disclosed CN malware set	Florian Roth	0x15ccd:$x1: cmd.exe /c ping 0 -n 2 & del " 0x137e6:$s1: winmgmts:\\.\root\SecurityCenter2 0x1573b:$s3: Executed As 0x124f0:$s5: Stub.exe 0x1571d:$s6: Download ERROR 0x137a8:$s8: Select * From AntiVirusProduct
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\18f92744a712890ce1a5852179df81aaWindows Update.exe	crimeware_njrat_strings	Detects njRAT based on some strings	Sekoia.io	0x154bf:$: set cdaudio door closed 0x15483:$: set cdaudio door open 0x15ce3:$: ping 0 0x13412:$: [endof] 0x132cc:$: TiGeR-Firewall 0x132fa:$: NetSnifferCs 0x132b8:$: IPBlocker 0x13314:$: Sandboxie Control
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\18f92744a712890ce1a5852179df81aaWindows Update.exe	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x15a7b:$reg: SEE_MASK_NOZONECHECKS 0x15701:$msg: Execute ERROR 0x15755:$msg: Execute ERROR 0x15ccd:$ping: cmd.exe /c ping 0 -n 2 & del
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\18f92744a712890ce1a5852179df81aaWindows Update.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x13c5a:$s1: netsh firewall delete allowedprogram 0x13cac:$s2: netsh firewall add allowedprogram 0x15ccd:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x15701:$s4: Execute ERROR 0x15755:$s4: Execute ERROR 0x1571d:$s5: Download ERROR
Click to see the 1 entries

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000000.1289812590.0000000000F02000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
00000000.00000000.1289812590.0000000000F02000.00000002.00000001.01000000.00000003.sdmp	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x113d2:$a1: get_Registry 0x1587b:$a2: SEE_MASK_NOZONECHECKS 0x1551d:$a3: Download ERROR 0x15acd:$a4: cmd.exe /c ping 0 -n 2 & del " 0x13a5a:$a5: netsh firewall delete allowedprogram "
00000000.00000000.1289812590.0000000000F02000.00000002.00000001.01000000.00000003.sdmp	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x1587b:$reg: SEE_MASK_NOZONECHECKS 0x15501:$msg: Execute ERROR 0x15555:$msg: Execute ERROR 0x15acd:$ping: cmd.exe /c ping 0 -n 2 & del
Process Memory Space: Server.exe PID: 8740	JoeSecurity_Njrat	Yara detected Njrat	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.Server.exe.f00000.0.unpack	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
0.0.Server.exe.f00000.0.unpack	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x115d2:$a1: get_Registry 0x15a7b:$a2: SEE_MASK_NOZONECHECKS 0x1571d:$a3: Download ERROR 0x15ccd:$a4: cmd.exe /c ping 0 -n 2 & del " 0x13c5a:$a5: netsh firewall delete allowedprogram "
0.0.Server.exe.f00000.0.unpack	CN_disclosed_20180208_c	Detects malware from disclosed CN malware set	Florian Roth	0x15ccd:$x1: cmd.exe /c ping 0 -n 2 & del " 0x137e6:$s1: winmgmts:\\.\root\SecurityCenter2 0x1573b:$s3: Executed As 0x124f0:$s5: Stub.exe 0x1571d:$s6: Download ERROR 0x137a8:$s8: Select * From AntiVirusProduct
0.0.Server.exe.f00000.0.unpack	crimeware_njrat_strings	Detects njRAT based on some strings	Sekoia.io	0x154bf:$: set cdaudio door closed 0x15483:$: set cdaudio door open 0x15ce3:$: ping 0 0x13412:$: [endof] 0x132cc:$: TiGeR-Firewall 0x132fa:$: NetSnifferCs 0x132b8:$: IPBlocker 0x13314:$: Sandboxie Control
0.0.Server.exe.f00000.0.unpack	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x15a7b:$reg: SEE_MASK_NOZONECHECKS 0x15701:$msg: Execute ERROR 0x15755:$msg: Execute ERROR 0x15ccd:$ping: cmd.exe /c ping 0 -n 2 & del
0.0.Server.exe.f00000.0.unpack	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x13c5a:$s1: netsh firewall delete allowedprogram 0x13cac:$s2: netsh firewall add allowedprogram 0x15ccd:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x15701:$s4: Execute ERROR 0x15755:$s4: Execute ERROR 0x1571d:$s5: Download ERROR
Click to see the 1 entries

Sigma Signatures

System Summary

Sigma detected: Startup Folder File Write

Source: File created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Users\user\Desktop\Server.exe, ProcessId: 8740, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\18f92744a712890ce1a5852179df81aaWindows Update.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Server.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\18f92744a712890ce1a5852179df81aaWindows Update.exe

Avira: detection malicious, Label: TR/Dropper.Gen

Found malware configuration

Source: 0.0.Server.exe.f00000.0.unpack

Malware Configuration Extractor: Njrat {"Campaign ID": "Runtim14531oker.exe", "Version": "0.7d", "Install Name": "18f92744a712890ce1a5852179df81aa", "Install Dir": "Adobe Update", "Registry Value": "Software\\Microsoft\\Windows\\CurrentVersion\\Run", "Network Seprator": "|'|'|"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\18f92744a712890ce1a5852179df81aaWindows Update.exe	ReversingLabs: Detection: 86%
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\18f92744a712890ce1a5852179df81aaWindows Update.exe	Virustotal: Detection: 71%			Perma Link

Multi AV Scanner detection for submitted file

Source: Server.exe	Virustotal: Detection: 71%			Perma Link
Source: Server.exe	ReversingLabs: Detection: 86%

Yara detected Njrat

Source: Yara match	File source: Server.exe, type: SAMPLE
Source: Yara match	File source: 0.0.Server.exe.f00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1289812590.0000000000F02000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Server.exe PID: 8740, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\18f92744a712890ce1a5852179df81aaWindows Update.exe, type: DROPPED

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Neural Call Log Analysis: 88.7%

Source: Server.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\Server.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

Jump to behavior

Source: Server.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Spreading

Contains functionality to spread to USB devices (.Net source)

Source: Server.exe, Usb1.cs	.Net Code: infect
Source: 18f92744a712890ce1a5852179df81aaWindows Update.exe.0.dr, Usb1.cs	.Net Code: infect

Source: Server.exe, 00000000.00000000.1289812590.0000000000F02000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: \autorun.inf
Source: Server.exe, 00000000.00000000.1289812590.0000000000F02000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: [autorun]
Source: Server.exe, 00000000.00000000.1289812590.0000000000F02000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: autorun.inf
Source: Server.exe	Binary or memory string: \autorun.inf
Source: Server.exe	Binary or memory string: [autorun]
Source: Server.exe	Binary or memory string: autorun.inf
Source: 18f92744a712890ce1a5852179df81aaWindows Update.exe.0.dr	Binary or memory string: \autorun.inf
Source: 18f92744a712890ce1a5852179df81aaWindows Update.exe.0.dr	Binary or memory string: [autorun]
Source: 18f92744a712890ce1a5852179df81aaWindows Update.exe.0.dr	Binary or memory string: autorun.inf

Source: C:\Users\user\Desktop\Server.exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

E-Banking Fraud

Yara detected Njrat

Source: Yara match	File source: Server.exe, type: SAMPLE
Source: Yara match	File source: 0.0.Server.exe.f00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1289812590.0000000000F02000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Server.exe PID: 8740, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\18f92744a712890ce1a5852179df81aaWindows Update.exe, type: DROPPED

System Summary

Malicious sample detected (through community Yara rule)

Source: Server.exe, type: SAMPLE	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: Server.exe, type: SAMPLE	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: Server.exe, type: SAMPLE	Matched rule: Detects njRAT based on some strings Author: Sekoia.io
Source: Server.exe, type: SAMPLE	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: Server.exe, type: SAMPLE	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 0.0.Server.exe.f00000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 0.0.Server.exe.f00000.0.unpack, type: UNPACKEDPE	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: 0.0.Server.exe.f00000.0.unpack, type: UNPACKEDPE	Matched rule: Detects njRAT based on some strings Author: Sekoia.io
Source: 0.0.Server.exe.f00000.0.unpack, type: UNPACKEDPE	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 0.0.Server.exe.f00000.0.unpack, type: UNPACKEDPE	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 00000000.00000000.1289812590.0000000000F02000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 00000000.00000000.1289812590.0000000000F02000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\18f92744a712890ce1a5852179df81aaWindows Update.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\18f92744a712890ce1a5852179df81aaWindows Update.exe, type: DROPPED	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\18f92744a712890ce1a5852179df81aaWindows Update.exe, type: DROPPED	Matched rule: Detects njRAT based on some strings Author: Sekoia.io
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\18f92744a712890ce1a5852179df81aaWindows Update.exe, type: DROPPED	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\18f92744a712890ce1a5852179df81aaWindows Update.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen

Source: C:\Users\user\Desktop\Server.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\Server.exe	Code function: 0_2_014DBDB2 NtQuerySystemInformation,		0_2_014DBDB2
Source: C:\Users\user\Desktop\Server.exe	Code function: 0_2_014DBD81 NtQuerySystemInformation,		0_2_014DBD81

Source: C:\Users\user\Desktop\Server.exe	Code function: 0_2_01C77347	0_2_01C77347
Source: C:\Users\user\Desktop\Server.exe	Code function: 0_2_01C77780	0_2_01C77780
Source: C:\Users\user\Desktop\Server.exe	Code function: 0_2_01C74298	0_2_01C74298
Source: C:\Users\user\Desktop\Server.exe	Code function: 0_2_01C74269	0_2_01C74269

Source: Server.exe, 00000000.00000002.3751449361.000000000157E000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: OriginalFilenamemscorwks.dllT vs Server.exe

Source: Server.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: Server.exe, type: SAMPLE	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: Server.exe, type: SAMPLE	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: Server.exe, type: SAMPLE	Matched rule: crimeware_njrat_strings author = Sekoia.io, description = Detects njRAT based on some strings, creation_date = 2022-08-22, classification = TLP:CLEAR, version = 1.0, id = 215807ae-fbcb-478d-8941-e0787b883669
Source: Server.exe, type: SAMPLE	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: Server.exe, type: SAMPLE	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 0.0.Server.exe.f00000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 0.0.Server.exe.f00000.0.unpack, type: UNPACKEDPE	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.0.Server.exe.f00000.0.unpack, type: UNPACKEDPE	Matched rule: crimeware_njrat_strings author = Sekoia.io, description = Detects njRAT based on some strings, creation_date = 2022-08-22, classification = TLP:CLEAR, version = 1.0, id = 215807ae-fbcb-478d-8941-e0787b883669
Source: 0.0.Server.exe.f00000.0.unpack, type: UNPACKEDPE	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 0.0.Server.exe.f00000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 00000000.00000000.1289812590.0000000000F02000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 00000000.00000000.1289812590.0000000000F02000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\18f92744a712890ce1a5852179df81aaWindows Update.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\18f92744a712890ce1a5852179df81aaWindows Update.exe, type: DROPPED	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\18f92744a712890ce1a5852179df81aaWindows Update.exe, type: DROPPED	Matched rule: crimeware_njrat_strings author = Sekoia.io, description = Detects njRAT based on some strings, creation_date = 2022-08-22, classification = TLP:CLEAR, version = 1.0, id = 215807ae-fbcb-478d-8941-e0787b883669
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\18f92744a712890ce1a5852179df81aaWindows Update.exe, type: DROPPED	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\18f92744a712890ce1a5852179df81aaWindows Update.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi

Source: classification engine

Classification label: mal100.spre.phis.troj.adwa.evad.winEXE@4/4@0/0

Source: C:\Users\user\Desktop\Server.exe	Code function: 0_2_014DBC36 AdjustTokenPrivileges,		0_2_014DBC36
Source: C:\Users\user\Desktop\Server.exe	Code function: 0_2_014DBBFF AdjustTokenPrivileges,		0_2_014DBBFF

Source: C:\Users\user\Desktop\Server.exe

File created: C:\Users\user\AppData\Roaming\app

Jump to behavior

Source: C:\Users\user\Desktop\Server.exe	Mutant created: NULL
Source: C:\Users\user\Desktop\Server.exe	Mutant created: \Sessions\1\BaseNamedObjects\18f92744a712890ce1a5852179df81aa
Source: C:\Users\user\Desktop\Server.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\.net clr networking
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8832:120:WilError_03

Source: C:\Users\user\Desktop\Server.exe

File created: C:\Users\user\AppData\Local\Temp\FransescoPast.txt

Jump to behavior

Source: Server.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Server.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\Server.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Server.exe	Virustotal: Detection: 71%
Source: Server.exe	ReversingLabs: Detection: 86%

Source: C:\Users\user\Desktop\Server.exe

File read: C:\Users\user\Desktop\Server.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Server.exe "C:\Users\user\Desktop\Server.exe"
Source: C:\Users\user\Desktop\Server.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Users\user\Desktop\Server.exe" "Server.exe" ENABLE
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Server.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Users\user\Desktop\Server.exe" "Server.exe" ENABLE	Jump to behavior

Source: C:\Users\user\Desktop\Server.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ifmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasmontr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mfc42u.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: authfwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcmonitor.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3cfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3api.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: onex.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappprxy.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: hnetmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netshell.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netsetupapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netiohlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: httpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: polstore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshwfp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2pnetsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2p.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rpcnsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: whhelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlancfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlanapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wshelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: peerdistsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wcmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mobilenetworking.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprmsg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: msasn1.dll	Jump to behavior

Source: C:\Users\user\Desktop\Server.exe

File opened: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll

Jump to behavior

Source: Server.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: C:\Users\user\Desktop\Server.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

Jump to behavior

Source: Server.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains potential unpacker

Source: Server.exe, Fransesco.cs	.Net Code: Plugin System.Reflection.Assembly.Load(byte[])
Source: 18f92744a712890ce1a5852179df81aaWindows Update.exe.0.dr, Fransesco.cs	.Net Code: Plugin System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\Desktop\Server.exe	Code function: 0_2_014D2C58 pushad ; ret	0_2_014D2C5A
Source: C:\Users\user\Desktop\Server.exe	Code function: 0_2_014D3024 push edx; ret	0_2_014D3032
Source: C:\Users\user\Desktop\Server.exe	Code function: 0_2_014D269C push dword ptr [edx]; ret	0_2_014D26A6

Source: C:\Users\user\Desktop\Server.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\18f92744a712890ce1a5852179df81aaWindows Update.exe

Jump to dropped file

Boot Survival

Drops PE files to the startup folder

Source: C:\Users\user\Desktop\Server.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\18f92744a712890ce1a5852179df81aaWindows Update.exe

Jump to dropped file

Source: C:\Users\user\Desktop\Server.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\18f92744a712890ce1a5852179df81aaWindows Update.exe

Jump to behavior

Source: C:\Users\user\Desktop\Server.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\18f92744a712890ce1a5852179df81aaWindows Update.exe			Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\18f92744a712890ce1a5852179df81aaWindows Update.exe\:Zone.Identifier:$DATA			Jump to behavior

Source: C:\Users\user\Desktop\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\Server.exe	Memory allocated: 1560000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Memory allocated: 36C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Memory allocated: 16B0000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Memory allocated: 65E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Memory allocated: 75E0000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Memory allocated: 7910000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Memory allocated: 8910000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Memory allocated: 8D60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Memory allocated: 9D60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Memory allocated: AD60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Memory allocated: BD60000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Memory allocated: C1F0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\Server.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\Server.exe	Window / User API: threadDelayed 525	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Window / User API: threadDelayed 471	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Window / User API: threadDelayed 413	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Window / User API: foregroundWindowGot 577	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Window / User API: foregroundWindowGot 591	Jump to behavior

Source: C:\Users\user\Desktop\Server.exe TID: 8764	Thread sleep count: 55 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe TID: 8888	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe TID: 8744	Thread sleep count: 169 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe TID: 8744	Thread sleep time: -169000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe TID: 8896	Thread sleep count: 525 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe TID: 8896	Thread sleep time: -1050000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe TID: 8908	Thread sleep count: 107 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe TID: 8908	Thread sleep time: -53500s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe TID: 8896	Thread sleep count: 471 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe TID: 8896	Thread sleep time: -942000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe TID: 8744	Thread sleep count: 413 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe TID: 8744	Thread sleep time: -413000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe TID: 8908	Thread sleep count: 306 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe TID: 8908	Thread sleep time: -153000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\Server.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: Server.exe, 00000000.00000002.3751449361.000000000162E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWeutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=MSIL"/>
Source: Server.exe, 00000000.00000002.3751449361.000000000162E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllK
Source: netsh.exe, 00000001.00000003.1331588191.0000000000731000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll$

Source: C:\Users\user\Desktop\Server.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Server.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\Server.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 15:06:12 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 20:32:38 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 18:09:02 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 13:13:11 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 16:46:52 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 04:37:36 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 00:42:20 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 10:41:31 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 00:58:24 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 14:44:48 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 04:25:01 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 13:10:14 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 10:03:32 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 10:32:44 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 08:11:02 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 16:37:36 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp, Server.exe, 00000000.00000002.3752141392.00000000036CE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 09:03:28 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 03:51:00 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp, Server.exe, 00000000.00000002.3752141392.00000000036CE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 08:27:33 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 13:24:47 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 05:54:54 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 16:50:17 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 17:17:56 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 19:39:27 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 22:33:14 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 11:43:45 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 07:51:38 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp, Server.exe, 00000000.00000002.3752141392.00000000036CE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 09:21:33 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 19:38:55 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 14:44:19 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 20:40:53 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 16:45:24 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp, Server.exe, 00000000.00000002.3752141392.00000000036CE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 09:09:24 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 08:11:31 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 23:43:45 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp, Server.exe, 00000000.00000002.3752141392.00000000036CE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 09:05:55 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp, Server.exe, 00000000.00000002.3752141392.00000000036CE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 09:11:43 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 03:00:16 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp, Server.exe, 00000000.00000002.3752141392.00000000036CE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 09:13:16 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 06:45:01 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 01:35:18 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 14:43:47 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 14:49:18 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 17:11:40 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 21:58:22 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 07:50:35 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 07:21:23 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 04:29:17 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 14:43:00 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 19:38:59 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 17:09:08 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 17:40:25 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 04:18:14 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 03:51:49 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 20:03:24 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 12:19:17 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 19:40:02 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 23:01:01 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 07:12:07 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 05:56:27 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 08:03:10 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 19:50:08 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 00:12:13 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 10:05:03 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 22:38:11 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 05:16:24 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 15:32:56 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp, Server.exe, 00000000.00000002.3752141392.00000000036CE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 09:20:03 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 03:35:53 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 21:36:19 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 18:59:05 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 23:30:13 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 04:14:45 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 01:11:55 - Program Manager
Source: Server.exe, 00000000.00000002.3753449179.000000000B0C2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager\O"l
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 07:03:45 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 02:11:07 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 11:00:31 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 20:15:43 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 14:44:30 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 00:42:38 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 21:30:36 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 06:25:40 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 10:48:15 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 14:44:01 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 01:46:48 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 21:36:44 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 23:56:34 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 14:43:02 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 21:40:22 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 10:07:46 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp, Server.exe, 00000000.00000002.3752141392.00000000036CE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 09:19:26 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 06:56:23 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp, Server.exe, 00000000.00000002.3752141392.00000000036CE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 09:17:18 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 01:54:26 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 17:28:57 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 21:13:51 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 00:27:49 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp, Server.exe, 00000000.00000002.3752141392.00000000036CE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 09:02:40 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 23:42:13 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 00:04:25 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 18:31:01 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 16:35:34 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 20:07:57 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 04:55:28 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 10:54:22 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 04:26:45 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 20:36:03 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 06:17:39 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 02:34:40 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 06:30:47 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 17:45:32 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 04:17:48 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 19:13:35 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 19:39:25 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 16:38:00 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 07:27:27 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 22:56:01 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 18:55:20 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 22:13:26 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp, Server.exe, 00000000.00000002.3752141392.00000000036CE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 08:50:16 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 00:45:04 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 03:02:18 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 00:44:05 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 14:46:11 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 10:05:09 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 02:24:58 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 14:44:11 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 02:06:00 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 06:27:11 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 20:57:56 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 03:51:08 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 00:12:44 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 16:48:56 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 00:04:52 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 00:16:15 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 05:31:07 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 13:10:18 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 19:43:19 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 11:31:14 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 04:21:36 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 04:24:35 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 20:18:15 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 09:48:34 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 20:47:27 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 21:06:04 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 03:52:03 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 17:54:15 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 02:45:06 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 20:28:32 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp, Server.exe, 00000000.00000002.3752141392.00000000036CE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 09:14:27 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 19:28:57 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 07:26:59 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 00:05:05 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 04:02:20 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 02:27:59 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 17:04:05 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 23:30:48 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 03:28:21 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 21:06:25 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 21:06:52 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 10:19:22 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 13:12:00 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 21:38:34 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 23:05:29 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 10:56:24 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 23:53:45 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 10:55:23 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 11:03:07 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 00:32:17 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 22:30:34 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 08:08:48 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 18:01:54 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 19:47:32 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 20:46:32 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 20:50:53 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 06:57:24 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp, Server.exe, 00000000.00000002.3752141392.00000000036CE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 08:39:27 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 16:38:49 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 00:07:55 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 03:18:37 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 05:46:00 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 20:42:07 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 23:23:28 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 06:57:03 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 00:16:46 - Program Manager
Source: Server.exe, 00000000.00000002.3752141392.00000000036CE000.00000004.00000800.00020000.00000000.sdmp, Server.exe, 00000000.00000002.3753449179.000000000B0C2000.00000004.00000800.00020000.00000000.sdmp, Server.exe, 00000000.00000002.3753449179.000000000AE27000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 17:43:34 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 02:00:21 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 22:09:34 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 06:46:37 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 11:13:44 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 02:03:07 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 19:39:44 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 12:44:13 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 01:21:26 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 03:59:02 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 21:54:43 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 01:33:02 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 21:25:28 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 22:37:26 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 17:13:17 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 01:04:25 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 03:22:25 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 21:36:30 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 15:24:33 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 07:22:45 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 10:35:18 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 03:21:36 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 21:44:32 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 19:39:50 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 11:44:23 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 04:28:57 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 19:09:53 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 04:41:49 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 09:58:38 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 20:42:59 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 12:54:38 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 01:20:17 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 05:36:08 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 06:37:46 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 11:19:03 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 02:58:11 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 15:35:28 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp, Server.exe, 00000000.00000002.3752141392.00000000036CE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 08:18:27 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 20:15:28 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 21:55:39 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 20:53:13 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 23:11:13 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp, Server.exe, 00000000.00000002.3752141392.00000000036CE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 08:28:26 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 20:41:50 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 03:12:59 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 01:34:30 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 10:13:09 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 21:30:51 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 02:40:17 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 21:39:02 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 15:35:34 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 00:28:36 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 05:20:18 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 03:52:15 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 17:33:48 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 05:39:34 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 19:49:09 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 20:09:36 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 20:32:07 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 05:29:48 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 20:27:24 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 05:48:18 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 03:50:24 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 13:12:47 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 20:50:28 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 21:05:24 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 04:42:11 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 10:43:33 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 19:51:46 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 19:39:23 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 02:01:09 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 01:26:21 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 10:05:34 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 07:24:16 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 22:17:42 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 01:44:09 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 02:35:07 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 20:00:31 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 22:17:12 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 04:30:18 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 16:35:41 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 19:12:40 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 01:56:43 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 17:37:54 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 14:43:23 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 21:36:23 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 20:59:02 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 01:31:23 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 23:24:16 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 02:59:55 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 22:48:23 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 06:54:16 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 14:43:22 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 02:05:25 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 08:16:52 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 04:50:20 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 19:12:11 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 13:09:42 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp, Server.exe, 00000000.00000002.3752141392.00000000036CE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 09:17:08 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 03:52:27 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 14:44:23 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 02:11:15 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 19:12:41 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 18:15:44 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 21:20:21 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 22:32:20 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 03:08:07 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 11:14:57 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 02:30:38 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 05:07:14 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 05:30:59 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 11:59:51 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 14:43:21 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 19:09:21 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 05:27:09 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 02:02:57 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp, Server.exe, 00000000.00000002.3752141392.00000000036CE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 09:02:07 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 05:32:28 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 10:29:17 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 22:33:20 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 06:08:26 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 15:48:08 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 04:14:20 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 04:18:34 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 09:45:19 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 02:03:57 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 00:11:38 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 20:55:08 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 10:21:30 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 07:05:54 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 06:24:35 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp, Server.exe, 00000000.00000002.3752141392.00000000036CE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 09:19:03 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 16:25:56 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 12:43:31 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 00:55:49 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 04:17:36 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 19:12:42 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 06:50:01 - Program Manager
Source: Server.exe, 18f92744a712890ce1a5852179df81aaWindows Update.exe.0.dr	Binary or memory string: Shell_traywnd+MostrarBarraDeTarefas
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 07:23:45 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 14:43:25 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp, Server.exe, 00000000.00000002.3752141392.00000000036CE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 09:21:10 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 12:11:20 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 19:03:27 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 23:02:21 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 23:17:53 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 15:50:27 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 08:11:24 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 11:37:31 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 02:35:38 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp, Server.exe, 00000000.00000002.3752141392.00000000036CE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 08:27:58 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 05:54:05 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 03:46:34 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp, Server.exe, 00000000.00000002.3752141392.00000000036CE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 09:08:47 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 19:12:44 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 19:17:40 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 01:23:08 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 05:30:42 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 06:57:59 - Program Manager
Source: Server.exe, 00000000.00000002.3751449361.00000000015F2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Rh Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 19:38:49 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 00:36:50 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 19:44:54 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 00:44:11 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 14:47:53 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 03:03:23 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 14:44:27 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 22:03:53 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 01:33:56 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 00:43:10 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 01:19:49 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 02:07:39 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp, Server.exe, 00000000.00000002.3752141392.00000000036CE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 09:13:51 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 11:56:59 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 20:57:49 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 10:31:25 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 16:58:38 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 17:46:47 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 10:59:25 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 21:22:35 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 23:01:39 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 07:23:06 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 04:16:23 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 19:12:43 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 06:51:04 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 14:43:26 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 11:06:53 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 23:03:09 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 07:26:48 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 23:13:28 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 14:43:59 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 08:08:36 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 22:51:12 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 07:24:04 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 14:44:24 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 06:50:32 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 07:56:59 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 22:04:22 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 23:44:04 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 21:34:54 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 00:47:14 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp, Server.exe, 00000000.00000002.3752141392.00000000036CE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 09:20:44 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 09:42:46 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 07:45:21 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 17:15:45 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 09:43:08 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 21:35:26 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 20:28:24 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 22:06:26 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 17:25:54 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 16:42:31 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 18:03:54 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 12:25:21 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 00:02:45 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 00:05:14 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 03:19:50 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 21:12:39 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 05:39:29 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 19:11:28 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 04:00:48 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 20:09:32 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 21:42:26 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 15:27:23 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 16:25:39 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 04:46:36 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 07:57:42 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 23:36:42 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 16:35:25 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 15:48:21 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 07:58:39 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 06:51:34 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 06:55:55 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 21:02:28 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 13:11:55 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 18:57:53 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 06:46:14 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 00:02:37 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 02:37:21 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 07:27:59 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 21:05:55 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 14:45:35 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 11:14:18 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 06:47:15 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 05:27:53 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 11:43:33 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 00:40:08 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 12:14:33 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp, Server.exe, 00000000.00000002.3752141392.00000000036CE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 08:18:57 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp, Server.exe, 00000000.00000002.3752141392.00000000036CE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 08:35:10 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 23:02:05 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 11:01:59 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 20:55:46 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 09:46:33 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 03:56:11 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 02:29:06 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 05:03:03 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 06:58:28 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp, Server.exe, 00000000.00000002.3752141392.00000000036CE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 08:40:58 - Program Manager
Source: Server.exe, 18f92744a712890ce1a5852179df81aaWindows Update.exe.0.dr	Binary or memory string: ProgMan
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 15:38:36 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 17:28:02 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 00:07:59 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 14:44:32 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 04:31:34 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 23:24:55 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 05:41:09 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 09:48:03 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 00:05:30 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 04:11:28 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 21:46:46 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 05:31:43 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 22:24:13 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 01:12:59 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 21:38:04 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 14:45:40 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 07:49:28 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 20:30:59 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 14:46:04 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 01:35:34 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 02:56:51 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 20:15:25 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 23:02:11 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp, Server.exe, 00000000.00000002.3752141392.00000000036CE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 08:38:09 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 12:01:01 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 12:45:37 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 11:34:09 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 15:46:46 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 07:26:09 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 21:43:19 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 17:17:08 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp, Server.exe, 00000000.00000002.3752141392.00000000036CE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 08:23:20 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 19:10:30 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 03:48:38 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp, Server.exe, 00000000.00000002.3752141392.00000000036CE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 08:49:36 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp, Server.exe, 00000000.00000002.3752141392.00000000036CE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 08:47:25 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 11:58:28 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 17:17:47 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 20:03:34 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 15:47:13 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 19:09:09 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 18:11:31 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 03:32:33 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 16:57:01 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 20:50:18 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 13:09:38 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 13:18:08 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 22:20:25 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/26 \| 15:35:30 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 09:51:21 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 02:02:20 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 00:54:09 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 05:56:16 - Program Manager
Source: Server.exe, 00000000.00000002.3752220072.00000000046E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/27 \| 05:57:31 - Program Manager

Source: C:\Windows\SysWOW64\netsh.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\Server.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Contains functionality to disable the Task Manager (.Net Source)

Source: Server.exe, Fransesco.cs	.Net Code: INS
Source: 18f92744a712890ce1a5852179df81aaWindows Update.exe.0.dr, Fransesco.cs	.Net Code: INS

Disables zone checking for all users

Source: C:\Users\user\Desktop\Server.exe

Registry value created: HKEY_CURRENT_USER\Environment SEE_MASK_NOZONECHECKS

Jump to behavior

Modifies the windows firewall

Source: C:\Users\user\Desktop\Server.exe

Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Users\user\Desktop\Server.exe" "Server.exe" ENABLE

Uses netsh to modify the Windows network and firewall settings

Source: C:\Users\user\Desktop\Server.exe

Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Users\user\Desktop\Server.exe" "Server.exe" ENABLE

Stealing of Sensitive Information

Yara detected Njrat

Source: Yara match	File source: Server.exe, type: SAMPLE
Source: Yara match	File source: 0.0.Server.exe.f00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1289812590.0000000000F02000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Server.exe PID: 8740, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\18f92744a712890ce1a5852179df81aaWindows Update.exe, type: DROPPED

Remote Access Functionality

Yara detected Njrat

Source: Yara match	File source: Server.exe, type: SAMPLE
Source: Yara match	File source: 0.0.Server.exe.f00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1289812590.0000000000F02000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Server.exe PID: 8740, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\18f92744a712890ce1a5852179df81aaWindows Update.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	11 Replication Through Removable Media	Windows Management Instrumentation	12 Registry Run Keys / Startup Folder	1 Access Token Manipulation	1 Masquerading	OS Credential Dumping	11 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	2 Process Injection	41 Disable or Modify Tools	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	1 Clipboard Data	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	12 Registry Run Keys / Startup Folder	31 Virtualization/Sandbox Evasion	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	1 Access Token Manipulation	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Process Injection	LSA Secrets	1 Peripheral Device Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Obfuscated Files or Information	Cached Domain Credentials	12 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Server.exe	71%	Virustotal		Browse
Server.exe	86%	ReversingLabs	ByteCode-MSIL.Backdoor.njRAT
Server.exe	100%	Avira	TR/Dropper.Gen
SAMPLE	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\18f92744a712890ce1a5852179df81aaWindows Update.exe	100%	Avira	TR/Dropper.Gen
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\18f92744a712890ce1a5852179df81aaWindows Update.exe	86%	ReversingLabs	ByteCode-MSIL.Backdoor.njRAT
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\18f92744a712890ce1a5852179df81aaWindows Update.exe	71%	Virustotal		Browse

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1649453
Start date and time:	2025-03-26 19:42:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 40s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Server.exe
Detection:	MAL
Classification:	mal100.spre.phis.troj.adwa.evad.winEXE@4/4@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 98% Number of executed functions: 92 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240s for sample files taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, BackgroundTransferHost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 23.9.183.29, 20.12.23.50, 20.96.153.111, 150.171.28.10, 23.44.203.188
Excluded domains from analysis (whitelisted): www.bing.com, fs.microsoft.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, g.bing.com, prod.fs.microsoft.com.akadns.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, e16604.dscf.akamaiedge.net, arc.msn.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
14:43:39	API Interceptor	149533x Sleep call for process: Server.exe modified
19:43:07	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\18f92744a712890ce1a5852179df81aaWindows Update.exe

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\18f92744a712890ce1a5852179df81aaWindows Update.exe

Download File

Process:	C:\Users\user\Desktop\Server.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	95232
Entropy (8bit):	5.567043009046237
Encrypted:	false
SSDEEP:	1536:mU+8mGnrQr1EsOoYdsjEwzGi1dDmDFgS:mUvnrQr11r2i1doS
MD5:	B639B796E755BA9A04A6A5F2900FC084
SHA1:	E1F8A378C4B2C46C873AE77453399B1E9DC01B14
SHA-256:	6D498DD502299432D28C52C34726738DAC6F0466E12CAF4240E09231A00B0D01
SHA-512:	CC0E3C2FC6BBC0FC0C4B490D46090B7AB4BC3538784BCFBAD46D93B064A938C6D80EA20628EAE2AFCAE74410477AF7522AB7B00807A6DC991B372B8CDD99BE9F
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\18f92744a712890ce1a5852179df81aaWindows Update.exe, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\18f92744a712890ce1a5852179df81aaWindows Update.exe, Author: unknown Rule: CN_disclosed_20180208_c, Description: Detects malware from disclosed CN malware set, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\18f92744a712890ce1a5852179df81aaWindows Update.exe, Author: Florian Roth Rule: crimeware_njrat_strings, Description: Detects njRAT based on some strings, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\18f92744a712890ce1a5852179df81aaWindows Update.exe, Author: Sekoia.io Rule: Njrat, Description: detect njRAT in memory, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\18f92744a712890ce1a5852179df81aaWindows Update.exe, Author: JPCERT/CC Incident Response Group Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\18f92744a712890ce1a5852179df81aaWindows Update.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 86% Antivirus: Virustotal, Detection: 71%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......g.................p..........N.... ........@.. ....................................@.....................................O.................................................................................... ............... ..H............text...To... ...p.................. ..`.reloc...............r..............@..B........................................................0.......H......................................................................&.(......*..(.......s.........s ........s!........s"..........0...........~....o#....+...0...........~....o$....+...0...........~....o%....+...0...........~....o&....+...0.............(....(.....+.....0............(.....+...0................(.....+...0............(.....+...0.. ...................,.(...+.+.+....+....0...........................*..(..........0..&........~..............,.(...+.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\18f92744a712890ce1a5852179df81aaWindows Update.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\Server.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Roaming\app

Download File

Process:	C:\Users\user\Desktop\Server.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with no line terminators
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:g:g
MD5:	5014379CF5FA31DB8A73D68D6353A145
SHA1:	2A1A5138E8C9E7547CAAE1C9FB223AFBF714ED00
SHA-256:	538B830838CBF62E6CE267B48E2EB165030686E5B6317F0B1E9205A3E08C73B8
SHA-512:	5091A16EF7730449601A70B5EF5512A93C98C76BEB8CFEE1ADC9D39780C49B1D712E764720B04E44E18C7B08633C5D453793462C18DC6BEF14D82BF69892E18F
Malicious:	false
Reputation:	low
Preview:	.26

\Device\ConDrv

Download File

Process:	C:\Windows\SysWOW64\netsh.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	313
Entropy (8bit):	4.971939296804078
Encrypted:	false
SSDEEP:	6:/ojfKsUTGN8Ypox42k9L+DbGMKeQE+vigqAZs2E+AYeDPO+Yswyha:wjPIGNrkHk9iaeIM6ADDPOHyha
MD5:	689E2126A85BF55121488295EE068FA1
SHA1:	09BAAA253A49D80C18326DFBCA106551EBF22DD6
SHA-256:	D968A966EF474068E41256321F77807A042F1965744633D37A203A705662EC25
SHA-512:	C3736A8FC7E6573FA1B26FE6A901C05EE85C55A4A276F8F569D9EADC9A58BEC507D1BB90DBF9EA62AE79A6783178C69304187D6B90441D82E46F5F56172B5C5C
Malicious:	false
Reputation:	high, very likely benign file
Preview:	..IMPORTANT: Command executed successfully...However, "netsh firewall" is deprecated;..use "netsh advfirewall firewall" instead...For more information on using "netsh advfirewall firewall" commands..instead of "netsh firewall", see KB article 947709..at https://go.microsoft.com/fwlink/?linkid=121488 .....Ok.....

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.567043009046237
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	Server.exe
File size:	95'232 bytes
MD5:	b639b796e755ba9a04a6a5f2900fc084
SHA1:	e1f8a378c4b2c46c873ae77453399b1e9dc01b14
SHA256:	6d498dd502299432d28c52c34726738dac6f0466e12caf4240e09231a00b0d01
SHA512:	cc0e3c2fc6bbc0fc0c4b490d46090b7ab4bc3538784bcfbad46d93b064a938c6d80ea20628eae2afcae74410477af7522ab7b00807a6dc991b372b8cdd99be9f
SSDEEP:	1536:mU+8mGnrQr1EsOoYdsjEwzGi1dDmDFgS:mUvnrQr11r2i1doS
TLSH:	6E93D84977E56524E0BF56F79471F2015F34B48B1602E39E48F219EA0A33AC44F89FEA
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......g.................p..........N.... ........@.. ....................................@................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x418f4e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x67E30BB4 [Tue Mar 25 20:01:56 2025 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x18efc	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1a000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x16f54	0x17000	e7ae314033e236a5c484db28d903d2fa	False	0.368705417798913	data	5.598732992436973	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.reloc	0x1a000	0xc	0x200	dddee5b48052d5dc59ff07bd5a224610	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Download Network PCAP: filtered – full

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 26, 2025 19:43:44.116897106 CET	53	52868	162.159.36.2	192.168.2.5

Statistics

CPU Usage

• Server.exe
• netsh.exe
• conhost.exe

Click to jump to process

Memory Usage

• Server.exe
• netsh.exe
• conhost.exe

Click to jump to process

High Level Behavior Distribution

• File
• Registry

Click to dive into process behavior distribution

Click to jump to process

Target ID:	0
Start time:	14:42:59
Start date:	26/03/2025
Path:	C:\Users\user\Desktop\Server.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Server.exe"
Imagebase:	0xf00000
File size:	95'232 bytes
MD5 hash:	B639B796E755BA9A04A6A5F2900FC084
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: 00000000.00000000.1289812590.0000000000F02000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: 00000000.00000000.1289812590.0000000000F02000.00000002.00000001.01000000.00000003.sdmp, Author: unknown Rule: Njrat, Description: detect njRAT in memory, Source: 00000000.00000000.1289812590.0000000000F02000.00000002.00000001.01000000.00000003.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	14:43:01
Start date:	26/03/2025
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh firewall add allowedprogram "C:\Users\user\Desktop\Server.exe" "Server.exe" ENABLE
Imagebase:	0x970000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	14:43:01
Start date:	26/03/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7e2000000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage

Dynamic/Packed Code Coverage

Signature Coverage

Execution Coverage:	14.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	11.3%
Total number of Nodes:	115
Total number of Limit Nodes:	4

Executed Functions

Function 01C74298 Relevance: 5.7, Strings: 3, Instructions: 1950
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

@, xrefs: 01C74C24
2"l, xrefs: 01C7541D
\O"l, xrefs: 01C76AF9

Memory Dump Source

Source File: 00000000.00000002.3751977000.0000000001C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 01C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c70000_Server.jbxd

Similarity

API ID:
String ID: @$\O"l$2"l
API String ID: 0-4205763654
Opcode ID: 579949a5330409ed0dcbb6493d26ccffe652a3acb098dbd7c56511b14cd66643
Instruction ID: d759e34a2e09bc53a4bac5143eb1a615c2694d597f50dbd9fc31e36c099ebcbf
Opcode Fuzzy Hash: 579949a5330409ed0dcbb6493d26ccffe652a3acb098dbd7c56511b14cd66643
Instruction Fuzzy Hash: 43235874A01228CFDB25DF24D964BE9B7B2FB49308F0040EAD919A7791DB799E85CF40

Function 01C74269 Relevance: 5.5, Strings: 3, Instructions: 1773COMMON

Download Yara Rule

Strings

2"l, xrefs: 01C7541D
\O"l, xrefs: 01C76AF9
, xrefs: 01C74BC4

Memory Dump Source

Source File: 00000000.00000002.3751977000.0000000001C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 01C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c70000_Server.jbxd

Similarity

API ID:
String ID: $\O"l$2"l
API String ID: 0-4099737112
Opcode ID: 3afb900ef3b6a516715216f34f9ef7e19138b3b756a4429d045c6482943f5edd
Instruction ID: 2c6ce1f372bd98b0e74c619e8473c508b51f0dee889ef5c2a95d6bf12519b382
Opcode Fuzzy Hash: 3afb900ef3b6a516715216f34f9ef7e19138b3b756a4429d045c6482943f5edd
Instruction Fuzzy Hash: B2135974A01228CFDB25DF25D964BE8BBB2FB49304F0040EAD919A7791DB799E85CF40

Function 01C77780 Relevance: 3.3, Strings: 2, Instructions: 765COMMON

Download Yara Rule

Strings

}Xfk^, xrefs: 01C780D8
2"l, xrefs: 01C780E0

Memory Dump Source

Source File: 00000000.00000002.3751977000.0000000001C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 01C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c70000_Server.jbxd

Similarity

API ID:
String ID: 2"l$}Xfk^
API String ID: 0-1076500745
Opcode ID: 950fe6f9f6e2797607c87827c2c7e43a57e44e5060070cf08894631a55f76eb0
Instruction ID: e74a40e70dd7a9946625c948a727baad63aa8f7beca46d464f7f6becc3257cdd
Opcode Fuzzy Hash: 950fe6f9f6e2797607c87827c2c7e43a57e44e5060070cf08894631a55f76eb0
Instruction Fuzzy Hash: FC422332600321CBDB29CB3AD85827CB7A2BF813547154539D5529B2E1EFBDED41CB91

Function 01C77347 Relevance: 1.9, Strings: 1, Instructions: 669COMMON

Download Yara Rule

Strings

L."l, xrefs: 01C773B3

Memory Dump Source

Source File: 00000000.00000002.3751977000.0000000001C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 01C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c70000_Server.jbxd

Similarity

API ID:
String ID: L."l
API String ID: 0-568539168
Opcode ID: 7347ddeafd2df410f3f9a619961c5bf997d1c8de47525b3c41f1b8dcc3337b70
Instruction ID: 9c2653fec2090357e010b0aedc3ba9d0737023b70d49ae20c5f57c3f02d4f8f6
Opcode Fuzzy Hash: 7347ddeafd2df410f3f9a619961c5bf997d1c8de47525b3c41f1b8dcc3337b70
Instruction Fuzzy Hash: A6323131601322CBDB26DB36D49427DB6E2BF84254B15807AE455CB2D6EF7CDD82CB90

Function 014DBBFF Relevance: 1.6, APIs: 1, Instructions: 75COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.KERNELBASE(?,?,?,?,?,?), ref: 014DBC7F

Memory Dump Source

Source File: 00000000.00000002.3751200947.00000000014DA000.00000040.00000800.00020000.00000000.sdmp, Offset: 014DA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14da000_Server.jbxd

Similarity

API ID: AdjustPrivilegesToken
String ID:
API String ID: 2874748243-0
Opcode ID: b116f55026709b636514b146cee02bba5c094ee61d602847ed01d3ab64dd61d0
Instruction ID: ec397b649625f2ac0f6dc6d6bb873381705749cd80f45380a3a36535dbc5e291
Opcode Fuzzy Hash: b116f55026709b636514b146cee02bba5c094ee61d602847ed01d3ab64dd61d0
Instruction Fuzzy Hash: 5D21BF765097809FDB238F25DC54B52BFF4EF06310F0984DBE9858B263D6719808DB61

Function 014DBD81 Relevance: 1.6, APIs: 1, Instructions: 57nativeCOMMON

Download Yara Rule

APIs

NtQuerySystemInformation.NTDLL ref: 014DBDED

Memory Dump Source

Source File: 00000000.00000002.3751200947.00000000014DA000.00000040.00000800.00020000.00000000.sdmp, Offset: 014DA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14da000_Server.jbxd

Similarity

API ID: InformationQuerySystem
String ID:
API String ID: 3562636166-0
Opcode ID: cd0725acd42f3f720c1968aa3b0886c5a07dc4f7d33002c2bd75d92654f2175c
Instruction ID: fbd0b59181d55f39794fb50d97b4c0f243ab71933452f73b1297b1cfd8856891
Opcode Fuzzy Hash: cd0725acd42f3f720c1968aa3b0886c5a07dc4f7d33002c2bd75d92654f2175c
Instruction Fuzzy Hash: A9118B764093C09FDB228F14DC45A92FFF4EF46324F0984DAE9848B263D275A91CDB62

Function 014DBC36 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.KERNELBASE(?,?,?,?,?,?), ref: 014DBC7F

Memory Dump Source

Source File: 00000000.00000002.3751200947.00000000014DA000.00000040.00000800.00020000.00000000.sdmp, Offset: 014DA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14da000_Server.jbxd

Similarity

API ID: AdjustPrivilegesToken
String ID:
API String ID: 2874748243-0
Opcode ID: a07748b33391018db5e3f6706bcae657cfbb5af2b229934a82755f8922e85752
Instruction ID: 4b3d0e2cefe895509004b02ad039f893d3ad8780b5004c262fdc33c9d1534d13
Opcode Fuzzy Hash: a07748b33391018db5e3f6706bcae657cfbb5af2b229934a82755f8922e85752
Instruction Fuzzy Hash: 26119E765002409FEB21CF55D884B66FBE4FF05620F08C8AEED858B762D771E418DB61

Function 014DBDB2 Relevance: 1.5, APIs: 1, Instructions: 38nativeCOMMON

Download Yara Rule

APIs

NtQuerySystemInformation.NTDLL ref: 014DBDED

Memory Dump Source

Source File: 00000000.00000002.3751200947.00000000014DA000.00000040.00000800.00020000.00000000.sdmp, Offset: 014DA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14da000_Server.jbxd

Similarity

API ID: InformationQuerySystem
String ID:
API String ID: 3562636166-0
Opcode ID: d490c8f9e111f5819547851c75dd978d5e3404f282a29c070bb4abaff79475e6
Instruction ID: ed6893d33e4883fac850608acbe24434ef3aa06dd4a0c18ec28bd7406892d7e1
Opcode Fuzzy Hash: d490c8f9e111f5819547851c75dd978d5e3404f282a29c070bb4abaff79475e6
Instruction Fuzzy Hash: 54018B364002409FDB218F05DD85B66FBE0EF49224F08C49ADE894B762D375A429CF62

Function 01C700B8 Relevance: 5.1, Strings: 4, Instructions: 103
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

E]fk^, xrefs: 01C70140, 01C70145
2"l, xrefs: 01C70154
2"l, xrefs: 01C701A8
5]fk^, xrefs: 01C70194, 01C70199

Memory Dump Source

Source File: 00000000.00000002.3751977000.0000000001C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 01C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c70000_Server.jbxd

Similarity

API ID:
String ID: 2"l$2"l$5]fk^$E]fk^
API String ID: 0-2178416371
Opcode ID: 149b88a8f76bb2a91c7a0d0e6c770d2c167dcee0f3429cffff8a8925a15316c8
Instruction ID: 9c6510ce55cee86b4a3cd9a12425f5375aa28c1569990d7d3d38dbb156132d1b
Opcode Fuzzy Hash: 149b88a8f76bb2a91c7a0d0e6c770d2c167dcee0f3429cffff8a8925a15316c8
Instruction Fuzzy Hash: D731F2317043945FD7069B7598607BE7BA7ABC3208B0484AEE441CF792DF799C098791

Function 01C70118 Relevance: 5.1, Strings: 4, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

E]fk^, xrefs: 01C70140, 01C70145
2"l, xrefs: 01C70154
2"l, xrefs: 01C701A8
5]fk^, xrefs: 01C70194, 01C70199

Memory Dump Source

Source File: 00000000.00000002.3751977000.0000000001C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 01C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c70000_Server.jbxd

Similarity

API ID:
String ID: 2"l$2"l$5]fk^$E]fk^
API String ID: 0-2178416371
Opcode ID: fe4db39be80a37b7c966e1a65c7f054af2e8ace64521095528515a049199a8ee
Instruction ID: c37d1c85b3f4267d7b911300f13c46415dee0581440d0776e145a7b4ec857c0f
Opcode Fuzzy Hash: fe4db39be80a37b7c966e1a65c7f054af2e8ace64521095528515a049199a8ee
Instruction Fuzzy Hash: D711A0317002944FD716EB79A4607FD67EBABD3208748446EE001CFB52DFB98C098B92

Function 01C737E1 Relevance: 3.0, Strings: 2, Instructions: 514
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

2"l, xrefs: 01C73C2E
\O"l, xrefs: 01C73885

Memory Dump Source

Source File: 00000000.00000002.3751977000.0000000001C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 01C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c70000_Server.jbxd

Similarity

API ID:
String ID: \O"l$2"l
API String ID: 0-954685956
Opcode ID: 1c9775e0f68db2a26e871d3c581de5de547c58e68fe2abcae730b157e019d125
Instruction ID: 3ea9c0d3effa1a5119ad4a0f35a321630dcf4c88c1ab74d491070094b6f3ab08
Opcode Fuzzy Hash: 1c9775e0f68db2a26e871d3c581de5de547c58e68fe2abcae730b157e019d125
Instruction Fuzzy Hash: 22322430A00258CFDB24DF74D854BEDBBB2EB49308F1041AAD509AB794EB799E85CF40

Function 01731C3D Relevance: 1.6, APIs: 1, Instructions: 106
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getaddrinfo.WS2_32(?,00000E24), ref: 01731D1F

Memory Dump Source

Source File: 00000000.00000002.3751709172.0000000001730000.00000040.00000800.00020000.00000000.sdmp, Offset: 01730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1730000_Server.jbxd

Similarity

API ID: getaddrinfo
String ID:
API String ID: 300660673-0
Opcode ID: b67e38abd7d6c8e6c1c0c006b3ef2c4980ec719d41c19f8284e7e178aaf91670
Instruction ID: a66803a7f6f6ce366017e783f8f31b14439c569d834542e64132c44df1a90d56
Opcode Fuzzy Hash: b67e38abd7d6c8e6c1c0c006b3ef2c4980ec719d41c19f8284e7e178aaf91670
Instruction Fuzzy Hash: 3331C3B2504380AFE722DB60DC44FA6FFA8EF06314F0444DAE9449B292D375A949CB71

Function 01730DB7 Relevance: 1.6, APIs: 1, Instructions: 98
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,?,?), ref: 01730E7E

Memory Dump Source

Source File: 00000000.00000002.3751709172.0000000001730000.00000040.00000800.00020000.00000000.sdmp, Offset: 01730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1730000_Server.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: aa700aad644fd0abdd433871bed3426c7aef0f82e651c997c8fb1d8cf7dc64c9
Instruction ID: c0b9c4014d291e859d0c85e1a08c7bc5c48be4c9d37adac09264c9f1575f86c2
Opcode Fuzzy Hash: aa700aad644fd0abdd433871bed3426c7aef0f82e651c997c8fb1d8cf7dc64c9
Instruction Fuzzy Hash: F0316D6510E3C06FD3138B258C65A61BFB4EF87610B0E45CBE8C49F6A3D6296919C7B2

Function 014DB1E6 Relevance: 1.6, APIs: 1, Instructions: 97
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(?,00000E24), ref: 014DB291

Memory Dump Source

Source File: 00000000.00000002.3751200947.00000000014DA000.00000040.00000800.00020000.00000000.sdmp, Offset: 014DA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14da000_Server.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: e761ab240f49061189beede00e9ab045f436693617ef574a995d84effa4ee8f2
Instruction ID: 372eccd25d0c6d98a9ebfdbb026db69385a8d45d19083f355a440e206c2adacc
Opcode Fuzzy Hash: e761ab240f49061189beede00e9ab045f436693617ef574a995d84effa4ee8f2
Instruction Fuzzy Hash: 623184725093846FD7228B65DC55FABBFB8EF06210F08849BE984DB663D364A40DC771

Function 014DAA75 Relevance: 1.6, APIs: 1, Instructions: 92
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 014DAB25

Memory Dump Source

Source File: 00000000.00000002.3751200947.00000000014DA000.00000040.00000800.00020000.00000000.sdmp, Offset: 014DA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14da000_Server.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: cb20efd358b526cbec0fbc9195497523322c96ef1dff2c9b13f44d0ad11ad505
Instruction ID: 6299c56cff2d63daadc20cf4d3b8b52fe7b3fc5fbd759da3a4f7f71f53ae7b34
Opcode Fuzzy Hash: cb20efd358b526cbec0fbc9195497523322c96ef1dff2c9b13f44d0ad11ad505
Instruction Fuzzy Hash: 6A316071505380AFE722CF65DC85F56BFF8EF05210F08889EE9858B662D375E809CB61

Function 014DB2D9 Relevance: 1.6, APIs: 1, Instructions: 89
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,AC92A64E,00000000,00000000,00000000,00000000), ref: 014DB394

Memory Dump Source

Source File: 00000000.00000002.3751200947.00000000014DA000.00000040.00000800.00020000.00000000.sdmp, Offset: 014DA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14da000_Server.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: fc1f9f70a5106e6b9962ee55a38ec272469a53fcd627d7650d01198852475c6d
Instruction ID: 46d9ca030b659a9bee7db55689e1227a58da4724a196fee2e5a84978c18ee06b
Opcode Fuzzy Hash: fc1f9f70a5106e6b9962ee55a38ec272469a53fcd627d7650d01198852475c6d
Instruction Fuzzy Hash: 9131A1765053806FEB22CB65CC44F97BFE8EF06214F09849AE9858B263D664E54CCB61

Function 014DB036 Relevance: 1.6, APIs: 1, Instructions: 89
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexW.KERNELBASE(?,?), ref: 014DB0DD

Memory Dump Source

Source File: 00000000.00000002.3751200947.00000000014DA000.00000040.00000800.00020000.00000000.sdmp, Offset: 014DA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14da000_Server.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: ea7134c3ddc550b54377d7f46707165485182a49f41aeeb16b271223610749ea
Instruction ID: efc4fa48c643a517e7eaf97a5096fc53a47429cf33f39dcd8f338d0230e74c4c
Opcode Fuzzy Hash: ea7134c3ddc550b54377d7f46707165485182a49f41aeeb16b271223610749ea
Instruction Fuzzy Hash: 103193B55093805FE712CB25DC55B96BFF8EF06210F09849BE984CB293D375E908CB62

Function 017312D0 Relevance: 1.6, APIs: 1, Instructions: 89
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(?,00000E24), ref: 01731367

Memory Dump Source

Source File: 00000000.00000002.3751709172.0000000001730000.00000040.00000800.00020000.00000000.sdmp, Offset: 01730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1730000_Server.jbxd

Similarity

API ID: DescriptorSecurity$ConvertString
String ID:
API String ID: 3907675253-0
Opcode ID: 5c1c66bb69954541143132fbbc6a46e611e15c8166c395663f82192da902e6c8
Instruction ID: f86bbbae0158c98db8249f7c884d52511a1805607531f66a18fb88c265785ddc
Opcode Fuzzy Hash: 5c1c66bb69954541143132fbbc6a46e611e15c8166c395663f82192da902e6c8
Instruction Fuzzy Hash: BC317372504384AFE721CF65DC45FA7FFE8EF45610F0884AAE944DB652D364E809CB61

Function 017319D4 Relevance: 1.6, APIs: 1, Instructions: 87
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessTimes.KERNELBASE(?,00000E24,AC92A64E,00000000,00000000,00000000,00000000), ref: 01731A71

Memory Dump Source

Source File: 00000000.00000002.3751709172.0000000001730000.00000040.00000800.00020000.00000000.sdmp, Offset: 01730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1730000_Server.jbxd

Similarity

API ID: ProcessTimes
String ID:
API String ID: 1995159646-0
Opcode ID: 1b3875ba9912cbd7a351a7640b2c76f4c80c7becc08051a74bb436874a6c5a84
Instruction ID: f4eadf9e0441d5639d165b072496214c622c5c306bec78e46afdab1998c1f886
Opcode Fuzzy Hash: 1b3875ba9912cbd7a351a7640b2c76f4c80c7becc08051a74bb436874a6c5a84
Instruction Fuzzy Hash: 682106725057806FD712CF50DC45B96BFB8EF46310F08849BE984CB193D324A909CB75

Function 01731E2A Relevance: 1.6, APIs: 1, Instructions: 86
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FormatMessageW.KERNELBASE(?,00000E24,?,?), ref: 01731EDA

Memory Dump Source

Source File: 00000000.00000002.3751709172.0000000001730000.00000040.00000800.00020000.00000000.sdmp, Offset: 01730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1730000_Server.jbxd

Similarity

API ID: FormatMessage
String ID:
API String ID: 1306739567-0
Opcode ID: 446facb16f242ba82349ee7d532ce55233a495e39ec0a8374719445db794af27
Instruction ID: e84ab98de13dd5a895cdd95a4939b15e818ced99f1a183f171fc881d446bbae0
Opcode Fuzzy Hash: 446facb16f242ba82349ee7d532ce55233a495e39ec0a8374719445db794af27
Instruction Fuzzy Hash: BB318F7154D3C45FD3138B658C65B66BFB4EF87610F0A80DBD884CF2A3D6246919C7A2

Function 014DA6CE Relevance: 1.6, APIs: 1, Instructions: 85
comclipboardCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OleGetClipboard.OLE32(?,00000E24,?,?), ref: 014DA77E

Memory Dump Source

Source File: 00000000.00000002.3751200947.00000000014DA000.00000040.00000800.00020000.00000000.sdmp, Offset: 014DA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14da000_Server.jbxd

Similarity

API ID: Clipboard
String ID:
API String ID: 220874293-0
Opcode ID: ab389fe276b00c942dcbf0df013bbc3e3622c2bf6db4d487f9577c7d562f17e9
Instruction ID: 6e5fc7ddbb56c2913bb317f639305a18a17387ea58910ccb87c8d2c2d2b9117b
Opcode Fuzzy Hash: ab389fe276b00c942dcbf0df013bbc3e3622c2bf6db4d487f9577c7d562f17e9
Instruction Fuzzy Hash: 2231717514D3C06FD3138B259C61B61BFB4EF87610F0A40DBD884CB6A3D2256819D772

Function 01731C7A Relevance: 1.6, APIs: 1, Instructions: 84
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getaddrinfo.WS2_32(?,00000E24), ref: 01731D1F

Memory Dump Source

Source File: 00000000.00000002.3751709172.0000000001730000.00000040.00000800.00020000.00000000.sdmp, Offset: 01730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1730000_Server.jbxd

Similarity

API ID: getaddrinfo
String ID:
API String ID: 300660673-0
Opcode ID: 3326737bf503638de7e521075047aeaa08da45fce5268d97d820c415b8e5ae24
Instruction ID: fc0ce0c31184ebf219575a2ca744904e7fa091995f08145ef49e0ebc28d2758a
Opcode Fuzzy Hash: 3326737bf503638de7e521075047aeaa08da45fce5268d97d820c415b8e5ae24
Instruction Fuzzy Hash: A821D371100200AEFB21DF60DC45FAAFBACEF44714F04885AFA499A681D775A54C8B75

Function 014DB4C8 Relevance: 1.6, APIs: 1, Instructions: 82windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutA.USER32(?,00000E24), ref: 014DB571

Memory Dump Source

Source File: 00000000.00000002.3751200947.00000000014DA000.00000040.00000800.00020000.00000000.sdmp, Offset: 014DA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14da000_Server.jbxd

Similarity

API ID: MessageSendTimeout
String ID:
API String ID: 1599653421-0
Opcode ID: 5712f7802cf91ee18c7622cd2ff6dce9bc46c34b4dc30a6f5ad878e0e4f9ce1a
Instruction ID: 81d686ee03ca698ad3f50f03f2f570e042b4072cfd93115fe981c4c57aab3941
Opcode Fuzzy Hash: 5712f7802cf91ee18c7622cd2ff6dce9bc46c34b4dc30a6f5ad878e0e4f9ce1a
Instruction Fuzzy Hash: 7621F672104780AFEB228F51DC54FA7FFB8EF46310F08849AF9858B662D375A418CB65

Function 014DAE77 Relevance: 1.6, APIs: 1, Instructions: 78fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(?,00000E24,AC92A64E,00000000,00000000,00000000,00000000), ref: 014DAF0D

Memory Dump Source

Source File: 00000000.00000002.3751200947.00000000014DA000.00000040.00000800.00020000.00000000.sdmp, Offset: 014DA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14da000_Server.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: aaf99aff9f6b7124881f933555c0dd3222d2f99511926fe40d9313e06ef578b7
Instruction ID: 942360c395a188486068d3109a0dcdad770f8f25c05b94921d6b67a90dd198ed
Opcode Fuzzy Hash: aaf99aff9f6b7124881f933555c0dd3222d2f99511926fe40d9313e06ef578b7
Instruction Fuzzy Hash: 6D2191B2409380AFDB22CB51DD44F96BFB8EF46314F0984DBE9849B1A3D274A50CCB65

Function 014DB3EA Relevance: 1.6, APIs: 1, Instructions: 77registryCOMMON

Download Yara Rule

APIs

RegSetValueExW.KERNELBASE(?,00000E24,AC92A64E,00000000,00000000,00000000,00000000), ref: 014DB480

Memory Dump Source

Source File: 00000000.00000002.3751200947.00000000014DA000.00000040.00000800.00020000.00000000.sdmp, Offset: 014DA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14da000_Server.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: b60235005febee717772c8d83ca07595e5a75ca7b72ea6c22c174122533dadad
Instruction ID: d4686bc2f0d99db973e66f4591d1d3dd61ec409a980e408326a62983f7e6b178
Opcode Fuzzy Hash: b60235005febee717772c8d83ca07595e5a75ca7b72ea6c22c174122533dadad
Instruction Fuzzy Hash: 5D21AE765047806FDB22CF15DC44FA7BFB8EF46220F08849AE9858B262D264E808CB75

Function 01730EAA Relevance: 1.6, APIs: 1, Instructions: 77networkCOMMON

Download Yara Rule

APIs

WSASocketW.WS2_32(?,?,?,?,?), ref: 01730F36

Memory Dump Source

Source File: 00000000.00000002.3751709172.0000000001730000.00000040.00000800.00020000.00000000.sdmp, Offset: 01730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1730000_Server.jbxd

Similarity

API ID: Socket
String ID:
API String ID: 38366605-0
Opcode ID: 04adeb4b4417c95ec1cd8a32d1cc0c45672e049459a70af1164a73fc51b84a2b
Instruction ID: 8b62734308af53794fc1cbdbbfe7c18b5e1441791ae68371bc5a2aef97189d67
Opcode Fuzzy Hash: 04adeb4b4417c95ec1cd8a32d1cc0c45672e049459a70af1164a73fc51b84a2b
Instruction Fuzzy Hash: 84218D71509380AFE722CF55DC49F96FFF8EF45220F08889EE9858B652D375A408CB62

Function 01731486 Relevance: 1.6, APIs: 1, Instructions: 77fileCOMMON

Download Yara Rule

APIs

MapViewOfFile.KERNELBASE ref: 0173151A

Memory Dump Source

Source File: 00000000.00000002.3751709172.0000000001730000.00000040.00000800.00020000.00000000.sdmp, Offset: 01730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1730000_Server.jbxd

Similarity

API ID: FileView
String ID:
API String ID: 3314676101-0
Opcode ID: c73e7fbd8b7f2ef96355da2ab9b985b1555c17cf512d08cad359e251c5700bd2
Instruction ID: e85df837f353f5eca991ff9d218527817d6fe7cecbe8e35941720301fe2e9910
Opcode Fuzzy Hash: c73e7fbd8b7f2ef96355da2ab9b985b1555c17cf512d08cad359e251c5700bd2
Instruction Fuzzy Hash: 7B21AD72505380AFE722CB55CC44F96FBF8EF49224F08849AE9858B292D365A508CB66

Function 014DBEE0 Relevance: 1.6, APIs: 1, Instructions: 76COMMON

Download Yara Rule

APIs

K32EnumProcesses.KERNEL32(?,?,?,AC92A64E,00000000,?,?,?,?,?,?,?,?,6CB53C58), ref: 014DBF66

Memory Dump Source

Source File: 00000000.00000002.3751200947.00000000014DA000.00000040.00000800.00020000.00000000.sdmp, Offset: 014DA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14da000_Server.jbxd

Similarity

API ID: EnumProcesses
String ID:
API String ID: 84517404-0
Opcode ID: 9a51a8149a5f9e5bc08b3cf747eec6f9c61b52af24db434ab09e7243a3187b0a
Instruction ID: d3ca77875d2f78ebed1e10962e229ec7d1713b07a3005bfc7d2d1c3b5ff60dbe
Opcode Fuzzy Hash: 9a51a8149a5f9e5bc08b3cf747eec6f9c61b52af24db434ab09e7243a3187b0a
Instruction Fuzzy Hash: FA216D715093C09FDB138B65DC55A92BFB4EF47210F0E84DBD984CB1A3D2259918CB61

Function 014DAAA6 Relevance: 1.6, APIs: 1, Instructions: 76fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 014DAB25

Memory Dump Source

Source File: 00000000.00000002.3751200947.00000000014DA000.00000040.00000800.00020000.00000000.sdmp, Offset: 014DA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14da000_Server.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 9603e7fc71410ab18bfcc4529cd5dca28bd903ce5502667c0039ebba769c09ee
Instruction ID: 71608c39b35060abcbf68550c32d901522636c294cf0797a5016145acfda3f74
Opcode Fuzzy Hash: 9603e7fc71410ab18bfcc4529cd5dca28bd903ce5502667c0039ebba769c09ee
Instruction Fuzzy Hash: EC219271600240AFEB21CF65DC45F6AFBE8EF04314F18885AEA458B761D775E409CB75

Function 017312F6 Relevance: 1.6, APIs: 1, Instructions: 76COMMON

Download Yara Rule

APIs

ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(?,00000E24), ref: 01731367

Memory Dump Source

Source File: 00000000.00000002.3751709172.0000000001730000.00000040.00000800.00020000.00000000.sdmp, Offset: 01730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1730000_Server.jbxd

Similarity

API ID: DescriptorSecurity$ConvertString
String ID:
API String ID: 3907675253-0
Opcode ID: 97a4ca6284ff180fecb0e3656c47879b84cf6055aaef5470573e1d6fd74c5054
Instruction ID: 7c4d610ed74926bdd4ef122cef6354638df821ba51eef73b67ac21703f1b93c1
Opcode Fuzzy Hash: 97a4ca6284ff180fecb0e3656c47879b84cf6055aaef5470573e1d6fd74c5054
Instruction Fuzzy Hash: 1B21D472600244AFE721DF25DC45FABFBECEF44614F08846AE944DBA52D774E4088A71

Function 017311DE Relevance: 1.6, APIs: 1, Instructions: 76registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,AC92A64E,00000000,00000000,00000000,00000000), ref: 0173127C

Memory Dump Source

Source File: 00000000.00000002.3751709172.0000000001730000.00000040.00000800.00020000.00000000.sdmp, Offset: 01730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1730000_Server.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: f4b9f777cebdbf2b1053efcd368b2f0dd7943447ef71d61be1078e60f6ba34b2
Instruction ID: 57e02b355ada1a81958df505dc2bad750fd1f3805762225b10905cfd22ce9e82
Opcode Fuzzy Hash: f4b9f777cebdbf2b1053efcd368b2f0dd7943447ef71d61be1078e60f6ba34b2
Instruction Fuzzy Hash: 8F21A3B2508780AFE722CB55CC44F57FFF8AF45310F08849AE945DB292D364E808CB65

Function 014DB212 Relevance: 1.6, APIs: 1, Instructions: 74registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(?,00000E24), ref: 014DB291

Memory Dump Source

Source File: 00000000.00000002.3751200947.00000000014DA000.00000040.00000800.00020000.00000000.sdmp, Offset: 014DA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14da000_Server.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: f9893208331bf1efbc0a67c82cb03f4e9a2bb263fac2776b1071fc40f5e5c08c
Instruction ID: db95534b366f3fcdbc2b9314256299de89a08c408c2831f38bfdd8f314755b44
Opcode Fuzzy Hash: f9893208331bf1efbc0a67c82cb03f4e9a2bb263fac2776b1071fc40f5e5c08c
Instruction Fuzzy Hash: 2E21F376500204AEEB21CF55DC48FABFBECEF05314F08845AE9458B752D774E40C8AB6

Function 014DAC37 Relevance: 1.6, APIs: 1, Instructions: 73COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE(?,00000E24,AC92A64E,00000000,00000000,00000000,00000000), ref: 014DACBD

Memory Dump Source

Source File: 00000000.00000002.3751200947.00000000014DA000.00000040.00000800.00020000.00000000.sdmp, Offset: 014DA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14da000_Server.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 6e2c670b90fbc6d2e9145e78da5c6b9e0e5eae5cb6ba7805d8f2d73982b15430
Instruction ID: 240d1d8e568804b25eaeee23e3e187c287505f14ff3ac9415380370f5f98e7b0
Opcode Fuzzy Hash: 6e2c670b90fbc6d2e9145e78da5c6b9e0e5eae5cb6ba7805d8f2d73982b15430
Instruction Fuzzy Hash: DD21D8B54093C06FE7128B11DC50BA6BFB8DF46724F0880D7E9848B293D264A90DD776

Function 01731FEB Relevance: 1.6, APIs: 1, Instructions: 73COMMON

Download Yara Rule

APIs

GetProcessWorkingSetSize.KERNEL32(?,00000E24,AC92A64E,00000000,00000000,00000000,00000000), ref: 01732067

Memory Dump Source

Source File: 00000000.00000002.3751709172.0000000001730000.00000040.00000800.00020000.00000000.sdmp, Offset: 01730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1730000_Server.jbxd

Similarity

API ID: ProcessSizeWorking
String ID:
API String ID: 3584180929-0
Opcode ID: e450052e65b07f07daff59937c1975e49c71bdc94dc78020b4c11107e3cca348
Instruction ID: 4389fb6c059b52ad53edf3c86bf938989b16f17061eca0920c61914ca3e22e02
Opcode Fuzzy Hash: e450052e65b07f07daff59937c1975e49c71bdc94dc78020b4c11107e3cca348
Instruction Fuzzy Hash: 0821C2725043806FD722CB25DC45FABFFA8EF45220F0884AAE944CB252D374A808CB66

Function 017320CF Relevance: 1.6, APIs: 1, Instructions: 73COMMON

Download Yara Rule

APIs

SetProcessWorkingSetSize.KERNEL32(?,00000E24,AC92A64E,00000000,00000000,00000000,00000000), ref: 0173214B

Memory Dump Source

Source File: 00000000.00000002.3751709172.0000000001730000.00000040.00000800.00020000.00000000.sdmp, Offset: 01730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1730000_Server.jbxd

Similarity

API ID: ProcessSizeWorking
String ID:
API String ID: 3584180929-0
Opcode ID: e450052e65b07f07daff59937c1975e49c71bdc94dc78020b4c11107e3cca348
Instruction ID: a3601fc25168c5d6e83980344b1dc265f1de707e747dbcda4cb0046b2795bf36
Opcode Fuzzy Hash: e450052e65b07f07daff59937c1975e49c71bdc94dc78020b4c11107e3cca348
Instruction Fuzzy Hash: 6421D4765043806FD722CF15DC45FABFFA8EF45220F0884ABE944CB252D374A808CBA6

Function 014DB06A Relevance: 1.6, APIs: 1, Instructions: 72synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexW.KERNELBASE(?,?), ref: 014DB0DD

Memory Dump Source

Source File: 00000000.00000002.3751200947.00000000014DA000.00000040.00000800.00020000.00000000.sdmp, Offset: 014DA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14da000_Server.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: 6812c340dcccb1d0cccd2c1c1e114d04864f0d13d54390c56f7d03ebeafe37f5
Instruction ID: a3bf825a6da0a22107ae8dcc0f322371415f24fa6dbab28d2297037db468ba5c
Opcode Fuzzy Hash: 6812c340dcccb1d0cccd2c1c1e114d04864f0d13d54390c56f7d03ebeafe37f5
Instruction Fuzzy Hash: 3B21C2B16012409FEB21DF25DC45BAAFBE8EF05214F08846AE9458B751D774E408CB76

Function 01731F10 Relevance: 1.6, APIs: 1, Instructions: 72COMMON

Download Yara Rule

APIs

GetExitCodeProcess.KERNELBASE(?,00000E24,AC92A64E,00000000,00000000,00000000,00000000), ref: 01731F88

Memory Dump Source

Source File: 00000000.00000002.3751709172.0000000001730000.00000040.00000800.00020000.00000000.sdmp, Offset: 01730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1730000_Server.jbxd

Similarity

API ID: CodeExitProcess
String ID:
API String ID: 3861947596-0
Opcode ID: e177074418f52314c8e336999b8469320b56c132b9dc3868d6212e8748f53188
Instruction ID: ab085764bb19331e994985549ddf867bc3d943156b08c6c5b39352a63e2f1f60
Opcode Fuzzy Hash: e177074418f52314c8e336999b8469320b56c132b9dc3868d6212e8748f53188
Instruction Fuzzy Hash: B721C3725053846FE712CB55DC45FAAFFA8EF45320F0884AAE945CB292D364A908CB65

Function 014DA9BF Relevance: 1.6, APIs: 1, Instructions: 71COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(?), ref: 014DAA44

Memory Dump Source

Source File: 00000000.00000002.3751200947.00000000014DA000.00000040.00000800.00020000.00000000.sdmp, Offset: 014DA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14da000_Server.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 55b5420da7707e8fe43005aeeb4ebea56d31412dd6efd5889d9e59e019be8792
Instruction ID: 68876bd751d0494d1926d7f7c648a32ab541c353608caf4306871c37161dbe38
Opcode Fuzzy Hash: 55b5420da7707e8fe43005aeeb4ebea56d31412dd6efd5889d9e59e019be8792
Instruction Fuzzy Hash: 8A215C6540E7C09FD7138B259D60A52BFB4EF43620F0E81DBD8848F6A3C268580CCB72

Function 014DB31A Relevance: 1.6, APIs: 1, Instructions: 69registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,AC92A64E,00000000,00000000,00000000,00000000), ref: 014DB394

Memory Dump Source

Source File: 00000000.00000002.3751200947.00000000014DA000.00000040.00000800.00020000.00000000.sdmp, Offset: 014DA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14da000_Server.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 169a2c52bf136977e95f6c8f3a48846db77f1196e8a7772bb35d08a30327be4b
Instruction ID: f56f7c6fe57b2370e80dfe81bf3c46f90c7a9fca1606e3652f25cbbb9225e9d1
Opcode Fuzzy Hash: 169a2c52bf136977e95f6c8f3a48846db77f1196e8a7772bb35d08a30327be4b
Instruction Fuzzy Hash: 39219D76600240AEEB21CF55CC44FA7BBE8EF05610F08845AED458B761DB70E808DAB1

Function 014DB7B5 Relevance: 1.6, APIs: 1, Instructions: 69fileCOMMON

Download Yara Rule

APIs

CopyFileW.KERNELBASE(?,?,?), ref: 014DB82A

Memory Dump Source

Source File: 00000000.00000002.3751200947.00000000014DA000.00000040.00000800.00020000.00000000.sdmp, Offset: 014DA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14da000_Server.jbxd

Similarity

API ID: CopyFile
String ID:
API String ID: 1304948518-0
Opcode ID: 541d1dbf56b9e4df011687acddb5c05ad84e511977db8ebba29d01aafc9df760
Instruction ID: 729be70b64be38561d83036dcb51211e10949bc3b64a9bd496017feead15767a
Opcode Fuzzy Hash: 541d1dbf56b9e4df011687acddb5c05ad84e511977db8ebba29d01aafc9df760
Instruction Fuzzy Hash: 752181725053809FDB22CF29DC55B93BFE8EF46610F0884DAED85CB262D675E408CB61

Function 01730ECA Relevance: 1.6, APIs: 1, Instructions: 67networkCOMMON

Download Yara Rule

APIs

WSASocketW.WS2_32(?,?,?,?,?), ref: 01730F36

Memory Dump Source

Source File: 00000000.00000002.3751709172.0000000001730000.00000040.00000800.00020000.00000000.sdmp, Offset: 01730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1730000_Server.jbxd

Similarity

API ID: Socket
String ID:
API String ID: 38366605-0
Opcode ID: cb9c4e484bfcd8c38696d130ba391a0754801542a196318dfec33f1b2bfa4667
Instruction ID: dee94fbc701bf5b9ad20defcb2f32c11a3412a5b401d8fb23d63455b9e634afa
Opcode Fuzzy Hash: cb9c4e484bfcd8c38696d130ba391a0754801542a196318dfec33f1b2bfa4667
Instruction Fuzzy Hash: 6D21A171500240AFEB21CF55DC45BAAFBE4EF48324F08889EF9858B652D375E418CB76

Function 017314A6 Relevance: 1.6, APIs: 1, Instructions: 67fileCOMMON

Download Yara Rule

APIs

MapViewOfFile.KERNELBASE ref: 0173151A

Memory Dump Source

Source File: 00000000.00000002.3751709172.0000000001730000.00000040.00000800.00020000.00000000.sdmp, Offset: 01730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1730000_Server.jbxd

Similarity

API ID: FileView
String ID:
API String ID: 3314676101-0
Opcode ID: c3e2618a0ef5144185ec443b2210add70bf3f1d4b512f95967c47313395ece52
Instruction ID: f5484c262b801c8084cc84c86aae5e29409d0f0c203f76d2bc6bcbb463e6f69d
Opcode Fuzzy Hash: c3e2618a0ef5144185ec443b2210add70bf3f1d4b512f95967c47313395ece52
Instruction Fuzzy Hash: B721F372500240AFE721CF15CC45F9AFBE8EF48324F088499E9468B692D375E40CCB76

Function 014DB4F6 Relevance: 1.6, APIs: 1, Instructions: 66windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutA.USER32(?,00000E24), ref: 014DB571

Memory Dump Source

Source File: 00000000.00000002.3751200947.00000000014DA000.00000040.00000800.00020000.00000000.sdmp, Offset: 014DA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14da000_Server.jbxd

Similarity

API ID: MessageSendTimeout
String ID:
API String ID: 1599653421-0
Opcode ID: c904bd833b8b5b9fd7d7577ca3344bf93fe3c8352be0132b1ae249cb77e768e7
Instruction ID: 56431411fb426bac1514f83cc6555cf9cb63da062f6a182e6489cafa7eb4b541
Opcode Fuzzy Hash: c904bd833b8b5b9fd7d7577ca3344bf93fe3c8352be0132b1ae249cb77e768e7
Instruction Fuzzy Hash: 7921E176500600AFEB31CF51DC41FAAFBE8EF04714F08885AEE459A6A1D375E418CBB5

Function 014DB40E Relevance: 1.6, APIs: 1, Instructions: 65registryCOMMON

Download Yara Rule

APIs

RegSetValueExW.KERNELBASE(?,00000E24,AC92A64E,00000000,00000000,00000000,00000000), ref: 014DB480

Memory Dump Source

Source File: 00000000.00000002.3751200947.00000000014DA000.00000040.00000800.00020000.00000000.sdmp, Offset: 014DA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14da000_Server.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 651a6d8acff959c2b8108e1300a3a464c7b4777cb5ac21ee6aa00f7de2c0d3c6
Instruction ID: 7ce3800143766135d177d1f3d250485fa88eb329636cedbc532e572f1c9d0fe7
Opcode Fuzzy Hash: 651a6d8acff959c2b8108e1300a3a464c7b4777cb5ac21ee6aa00f7de2c0d3c6
Instruction Fuzzy Hash: C211D376600644AFEB21CF15DC41FA7FBECEF05614F08846AED458A762D774E408CAB5

Function 0173120A Relevance: 1.6, APIs: 1, Instructions: 65registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,AC92A64E,00000000,00000000,00000000,00000000), ref: 0173127C

Memory Dump Source

Source File: 00000000.00000002.3751709172.0000000001730000.00000040.00000800.00020000.00000000.sdmp, Offset: 01730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1730000_Server.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 06cd8be0f8a9776688498a2e1ab54c13b2935d44b68fabbfd941e54ec6b77ca7
Instruction ID: 8e34001a2d2639fad1c311545492c5969a5213116f7d6e6bc9739bc56f537c5a
Opcode Fuzzy Hash: 06cd8be0f8a9776688498a2e1ab54c13b2935d44b68fabbfd941e54ec6b77ca7
Instruction Fuzzy Hash: 7611B1B6604644AFE721CF15CC84FA7FBE8EF88720F08845AE945CB652D760E408CAB5

Function 014DBA96 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(?,?,?), ref: 014DBAFE

Memory Dump Source

Source File: 00000000.00000002.3751200947.00000000014DA000.00000040.00000800.00020000.00000000.sdmp, Offset: 014DA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14da000_Server.jbxd

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: b68cac7fd11c6916286515e495951201aee110b84d6c621f824cfc6d6ee86432
Instruction ID: be40b6d80f5f0c7140facbe1fe39f613958e9f54c6c3f18244f0ff7e3447ebcf
Opcode Fuzzy Hash: b68cac7fd11c6916286515e495951201aee110b84d6c621f824cfc6d6ee86432
Instruction Fuzzy Hash: 531151726043809FDB21CF19DC55B53BFE8EF46620F0884AAED85DB752D275E808CB61

Function 01731A12 Relevance: 1.6, APIs: 1, Instructions: 64timeCOMMON

Download Yara Rule

APIs

GetProcessTimes.KERNELBASE(?,00000E24,AC92A64E,00000000,00000000,00000000,00000000), ref: 01731A71

Memory Dump Source

Source File: 00000000.00000002.3751709172.0000000001730000.00000040.00000800.00020000.00000000.sdmp, Offset: 01730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1730000_Server.jbxd

Similarity

API ID: ProcessTimes
String ID:
API String ID: 1995159646-0
Opcode ID: d161cf1a660c4a9daec4b554a2ffc1035719365bbbaf7b4e896f139b73e40e9a
Instruction ID: d694648510b5ded18a10c25557cf9f23c9c9333f3677e5188211afa9f1c4b276
Opcode Fuzzy Hash: d161cf1a660c4a9daec4b554a2ffc1035719365bbbaf7b4e896f139b73e40e9a
Instruction Fuzzy Hash: D211E272600240AFEB21CF55DC45FAAFBE8EF44324F08C46AE9458B652D774E508CBB6

Function 0173200E Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

GetProcessWorkingSetSize.KERNEL32(?,00000E24,AC92A64E,00000000,00000000,00000000,00000000), ref: 01732067

Memory Dump Source

Source File: 00000000.00000002.3751709172.0000000001730000.00000040.00000800.00020000.00000000.sdmp, Offset: 01730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1730000_Server.jbxd

Similarity

API ID: ProcessSizeWorking
String ID:
API String ID: 3584180929-0
Opcode ID: 22c56e7378e0bc47a25c0b5bd84ed8e64ce9ed27f2c780736beb17f76584acb2
Instruction ID: 7666ab3467333a2ddb6a5e5a6f9db9a32ffba704bf1dbf72e9dcc9c4ec6cc5a4
Opcode Fuzzy Hash: 22c56e7378e0bc47a25c0b5bd84ed8e64ce9ed27f2c780736beb17f76584acb2
Instruction Fuzzy Hash: DA11C4766002409FE721CF55DC45BAAF7E8EF44324F08846AED45CB652D774E40CCAB6

Function 017320F2 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

SetProcessWorkingSetSize.KERNEL32(?,00000E24,AC92A64E,00000000,00000000,00000000,00000000), ref: 0173214B

Memory Dump Source

Source File: 00000000.00000002.3751709172.0000000001730000.00000040.00000800.00020000.00000000.sdmp, Offset: 01730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1730000_Server.jbxd

Similarity

API ID: ProcessSizeWorking
String ID:
API String ID: 3584180929-0
Opcode ID: 22c56e7378e0bc47a25c0b5bd84ed8e64ce9ed27f2c780736beb17f76584acb2
Instruction ID: df349bcc4b682cd0752666c5728b45083db841ffc1e2f03f619e8a49f54bd786
Opcode Fuzzy Hash: 22c56e7378e0bc47a25c0b5bd84ed8e64ce9ed27f2c780736beb17f76584acb2
Instruction Fuzzy Hash: 17110476500240AFE721CF14DD45BABFBE8EF44324F08846AEE05CB652D774A4088AB5

Function 014DA573 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 014DA5DE

Memory Dump Source

Source File: 00000000.00000002.3751200947.00000000014DA000.00000040.00000800.00020000.00000000.sdmp, Offset: 014DA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14da000_Server.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 2b75059814da9331e09c240aeaf5a1e63b5841bd08249cf66897a92a4d0dacdb
Instruction ID: 4f98e3f9e56cc1e817dcfb57d9ca03155777848cd4b9658ea838932470c663f9
Opcode Fuzzy Hash: 2b75059814da9331e09c240aeaf5a1e63b5841bd08249cf66897a92a4d0dacdb
Instruction Fuzzy Hash: D6117272409380AFDB228F55DC44A62FFF4EF4A310F0888DAE9858B662D375A418DB61

Function 01731F32 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetExitCodeProcess.KERNELBASE(?,00000E24,AC92A64E,00000000,00000000,00000000,00000000), ref: 01731F88

Memory Dump Source

Source File: 00000000.00000002.3751709172.0000000001730000.00000040.00000800.00020000.00000000.sdmp, Offset: 01730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1730000_Server.jbxd

Similarity

API ID: CodeExitProcess
String ID:
API String ID: 3861947596-0
Opcode ID: 592db234f3b53112f78c16e77d8640ae3f5f71aab8831077a89c75c1ca61edcd
Instruction ID: 38559ed5c6998cc9813974b976ea44014408fa7325afee15373f6b5937b6b68b
Opcode Fuzzy Hash: 592db234f3b53112f78c16e77d8640ae3f5f71aab8831077a89c75c1ca61edcd
Instruction Fuzzy Hash: F9110676601240AFEB11CF15DC85BAAF7ECEF44324F0884AAED45CB642D774E408CAB5

Function 014DAEAE Relevance: 1.6, APIs: 1, Instructions: 60fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(?,00000E24,AC92A64E,00000000,00000000,00000000,00000000), ref: 014DAF0D

Memory Dump Source

Source File: 00000000.00000002.3751200947.00000000014DA000.00000040.00000800.00020000.00000000.sdmp, Offset: 014DA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14da000_Server.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: e60814a8c3b229ee605cc43727a8ee566806785018c72a0b00863917d228fded
Instruction ID: 92f5d8cd6fc9750a1b7e1be2722dbead19427b7389572a66947f511c525387cd
Opcode Fuzzy Hash: e60814a8c3b229ee605cc43727a8ee566806785018c72a0b00863917d228fded
Instruction Fuzzy Hash: 5311B272500240AFEB21CF55DC45FAAFBE8EF44314F18849AE9459B651D774E4088BB6

Function 014DB885 Relevance: 1.6, APIs: 1, Instructions: 59fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(?), ref: 014DB8E4

Memory Dump Source

Source File: 00000000.00000002.3751200947.00000000014DA000.00000040.00000800.00020000.00000000.sdmp, Offset: 014DA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14da000_Server.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 2214af46193f52bfdfd6d5ee73127bd8b68f1abafd48c0d29934c418870bdbe9
Instruction ID: 7c88a281734d04cd877511df6aebf8078000dc985c1aa3d31a9f4421cbf4faa8
Opcode Fuzzy Hash: 2214af46193f52bfdfd6d5ee73127bd8b68f1abafd48c0d29934c418870bdbe9
Instruction Fuzzy Hash: 3C1163729053805FDB11CB65DC55B57BFE8EF46220F0984EBE985CB263D274E848CB61

Function 014DB7E2 Relevance: 1.6, APIs: 1, Instructions: 53fileCOMMON

Download Yara Rule

APIs

CopyFileW.KERNELBASE(?,?,?), ref: 014DB82A

Memory Dump Source

Source File: 00000000.00000002.3751200947.00000000014DA000.00000040.00000800.00020000.00000000.sdmp, Offset: 014DA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14da000_Server.jbxd

Similarity

API ID: CopyFile
String ID:
API String ID: 1304948518-0
Opcode ID: b8d4455afd2277dc0604831933c0c3e77ec5b0976d1b5f41c96a8defd8c2b7ce
Instruction ID: 80bb2ff1a0720665fceeb353645b43fd7f587daf29ae6d33f2c586ae0ad3765c
Opcode Fuzzy Hash: b8d4455afd2277dc0604831933c0c3e77ec5b0976d1b5f41c96a8defd8c2b7ce
Instruction Fuzzy Hash: CE115276A002408FEB20CF19DC86B57FBD8EF05610F08C4AAED45CB762D774D408CA61

Function 014DBAB6 Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(?,?,?), ref: 014DBAFE

Memory Dump Source

Source File: 00000000.00000002.3751200947.00000000014DA000.00000040.00000800.00020000.00000000.sdmp, Offset: 014DA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14da000_Server.jbxd

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: b8d4455afd2277dc0604831933c0c3e77ec5b0976d1b5f41c96a8defd8c2b7ce
Instruction ID: 9181e899e7c0e857402ebbf2690a627cd41cdbfbacfb59129cd2899d0bb6b708
Opcode Fuzzy Hash: b8d4455afd2277dc0604831933c0c3e77ec5b0976d1b5f41c96a8defd8c2b7ce
Instruction Fuzzy Hash: 731130766002409FEB20CF19DD55B57FBD8EB45210F0884ABDD55CB756D674E408CB61

Function 014DAC6A Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE(?,00000E24,AC92A64E,00000000,00000000,00000000,00000000), ref: 014DACBD

Memory Dump Source

Source File: 00000000.00000002.3751200947.00000000014DA000.00000040.00000800.00020000.00000000.sdmp, Offset: 014DA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14da000_Server.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 7351f69b2ba9827ffca2203ab88eef8958c34f68f5ef3bb4cb0a9034e65f111f
Instruction ID: 24fe6f1406d23ca79d9e30f5ba81695110c74defabc71c1314aefe5a8855ccac
Opcode Fuzzy Hash: 7351f69b2ba9827ffca2203ab88eef8958c34f68f5ef3bb4cb0a9034e65f111f
Instruction Fuzzy Hash: 43010076500240AFEB218F05DC85BAABBA8DF44624F188096ED058B792D774A40C8AA6

Function 014DBF26 Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

K32EnumProcesses.KERNEL32(?,?,?,AC92A64E,00000000,?,?,?,?,?,?,?,?,6CB53C58), ref: 014DBF66

Memory Dump Source

Source File: 00000000.00000002.3751200947.00000000014DA000.00000040.00000800.00020000.00000000.sdmp, Offset: 014DA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14da000_Server.jbxd

Similarity

API ID: EnumProcesses
String ID:
API String ID: 84517404-0
Opcode ID: 8d220577d162e9bac28ed2bea949b1482266dc249a0e1c1cca9222c8257ad6ef
Instruction ID: b12ab307d61bba9a522bf1770afa1dcfdcbe676df45283b83b0337614c1fb211
Opcode Fuzzy Hash: 8d220577d162e9bac28ed2bea949b1482266dc249a0e1c1cca9222c8257ad6ef
Instruction Fuzzy Hash: 50118E756002448FDB11CF29D895B96FBE4EF45220F08C4AEDD49CB662D771E408CE61

Function 014DB8AA Relevance: 1.5, APIs: 1, Instructions: 47fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(?), ref: 014DB8E4

Memory Dump Source

Source File: 00000000.00000002.3751200947.00000000014DA000.00000040.00000800.00020000.00000000.sdmp, Offset: 014DA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14da000_Server.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 772513c79a8f4fad5b6352e759d9f965ccfa3d5b252abdb2741819d56e4506e4
Instruction ID: 217d3e3fc2dc05a1dd26296d2d9201c769f1e4bfa001660f4c7045b714d61385
Opcode Fuzzy Hash: 772513c79a8f4fad5b6352e759d9f965ccfa3d5b252abdb2741819d56e4506e4
Instruction Fuzzy Hash: CD015276A002449FEB10CF29D8957A6BBD4EF45620F08C4ABDD45CB756D674D408CB61

Function 01731E8A Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

FormatMessageW.KERNELBASE(?,00000E24,?,?), ref: 01731EDA

Memory Dump Source

Source File: 00000000.00000002.3751709172.0000000001730000.00000040.00000800.00020000.00000000.sdmp, Offset: 01730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1730000_Server.jbxd

Similarity

API ID: FormatMessage
String ID:
API String ID: 1306739567-0
Opcode ID: 0aa8c0fb6f2f773dc7f4faf30ba9b31c543e50e123390ef07cb1a7463332973b
Instruction ID: d4623cde58dc3c2dcff7fde793928959128dd4fc917430274d82633f609c6c23
Opcode Fuzzy Hash: 0aa8c0fb6f2f773dc7f4faf30ba9b31c543e50e123390ef07cb1a7463332973b
Instruction Fuzzy Hash: A5015E71640200ABD310DF16DC46B76FBE8EB88A20F14856AED099B741D731B915CBE6

Function 014DA59A Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 014DA5DE

Memory Dump Source

Source File: 00000000.00000002.3751200947.00000000014DA000.00000040.00000800.00020000.00000000.sdmp, Offset: 014DA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14da000_Server.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: ab2b58b10ec9a5b31ed11c0d19ae9d59b555dc5c96b86fdd885a539f9d1d1213
Instruction ID: 5311ef10932c778be8749f793db35b9ff870514534a96f1e35372b3182f146c0
Opcode Fuzzy Hash: ab2b58b10ec9a5b31ed11c0d19ae9d59b555dc5c96b86fdd885a539f9d1d1213
Instruction Fuzzy Hash: 3E015B76400640DFDF218F55D945B56FBE0EF48320F08889AEE894B662D376E418DF62

Function 014DA72E Relevance: 1.5, APIs: 1, Instructions: 43comclipboardCOMMON

Download Yara Rule

APIs

OleGetClipboard.OLE32(?,00000E24,?,?), ref: 014DA77E

Memory Dump Source

Source File: 00000000.00000002.3751200947.00000000014DA000.00000040.00000800.00020000.00000000.sdmp, Offset: 014DA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14da000_Server.jbxd

Similarity

API ID: Clipboard
String ID:
API String ID: 220874293-0
Opcode ID: bd08df1696732c7a68ca60e65e21dc2dff1b671ac8e6e1d30cf93412029a1fb2
Instruction ID: 5951fe48d8fbf7a6d8d97eeedc9eb9ffd479540d60063fb7ad9803a3286baab8
Opcode Fuzzy Hash: bd08df1696732c7a68ca60e65e21dc2dff1b671ac8e6e1d30cf93412029a1fb2
Instruction Fuzzy Hash: 80014F71640600ABD210DF16DC46B66FBE8EB88A20F148159ED089BB41D775B915CAE6

Function 01730E2E Relevance: 1.5, APIs: 1, Instructions: 43registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,?,?), ref: 01730E7E

Memory Dump Source

Source File: 00000000.00000002.3751709172.0000000001730000.00000040.00000800.00020000.00000000.sdmp, Offset: 01730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1730000_Server.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 60e0c05ccd11cdae16cb62495c309f47d633ff26e3ff33f0a6717e8ff907a3b6
Instruction ID: 17392081458d3c89549eeda2da7c2d97c66196d2484d91afffca64f42981ffa2
Opcode Fuzzy Hash: 60e0c05ccd11cdae16cb62495c309f47d633ff26e3ff33f0a6717e8ff907a3b6
Instruction Fuzzy Hash: C6018F71640200ABD210DF16CC46F66FBE8EB88A20F14811AEC089BB41D771B915CAE6

Function 014DAA12 Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(?), ref: 014DAA44

Memory Dump Source

Source File: 00000000.00000002.3751200947.00000000014DA000.00000040.00000800.00020000.00000000.sdmp, Offset: 014DA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14da000_Server.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: d6769bf0c85b75bfa84e6e7b45bd49bb6f1aa1eb9104ba6e01ba27634da06fa5
Instruction ID: 9cb3f43c2bb70fcf50f3de7a4e2c3079099266b86ed97872a8bc0b687a01d3fe
Opcode Fuzzy Hash: d6769bf0c85b75bfa84e6e7b45bd49bb6f1aa1eb9104ba6e01ba27634da06fa5
Instruction Fuzzy Hash: 6DF0AF358006849FDB218F05DA85BA6FBE0EF44624F1CC19ADD494B762D379A908CEA2

Function 01C739BF Relevance: 1.4, Strings: 1, Instructions: 182COMMON

Download Yara Rule

Strings

2"l, xrefs: 01C73C2E

Memory Dump Source

Source File: 00000000.00000002.3751977000.0000000001C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 01C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c70000_Server.jbxd

Similarity

API ID:
String ID: 2"l
API String ID: 0-4010171355
Opcode ID: 5a06ef20068e778b76c49ed1145fc420a6d49a93de0a9b6f61a87e577ed6b963
Instruction ID: 315b01109e27b13abdeccdfd09ce8f0d00cb47bb8a10af997caf01805942cf36
Opcode Fuzzy Hash: 5a06ef20068e778b76c49ed1145fc420a6d49a93de0a9b6f61a87e577ed6b963
Instruction Fuzzy Hash: 7B813770A00258CFDB14EFB5C854BEDB7B2BF85308F4040AA951AAB694DB798E45CF51

Function 01C73B18 Relevance: 1.4, Strings: 1, Instructions: 111COMMON

Download Yara Rule

Strings

2"l, xrefs: 01C73C2E

Memory Dump Source

Source File: 00000000.00000002.3751977000.0000000001C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 01C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c70000_Server.jbxd

Similarity

API ID:
String ID: 2"l
API String ID: 0-4010171355
Opcode ID: f48e1b6bced1db151ba72b5f0dab845aec42f72f88db1559bb8f4e6d375b2d40
Instruction ID: 604185ea050e100ffbce6e626ca82e91f087aed2dd1285942b09489493e72e26
Opcode Fuzzy Hash: f48e1b6bced1db151ba72b5f0dab845aec42f72f88db1559bb8f4e6d375b2d40
Instruction Fuzzy Hash: C9410670A00258CFDB14EFA5D854BECB7B2FB85308F4041AAD419AB694DB758E48CF51

Function 014DAB7C Relevance: 1.3, APIs: 1, Instructions: 69COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 014DABF0

Memory Dump Source

Source File: 00000000.00000002.3751200947.00000000014DA000.00000040.00000800.00020000.00000000.sdmp, Offset: 014DA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14da000_Server.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: b6d5e1b25abcd093c0961e7f4f7fc8bd6dfb4df093551113cba0109f19e14bc6
Instruction ID: 9418383ca01a4536e59f59ac39eb9f8b712c0f1e77c26c4ff14ea71bfcabfe08
Opcode Fuzzy Hash: b6d5e1b25abcd093c0961e7f4f7fc8bd6dfb4df093551113cba0109f19e14bc6
Instruction Fuzzy Hash: 5521C3755093C09FDB128F25DD95792BFA8EF07220F0984DBED858B2A3D2749908CB61

Function 014DBCCC Relevance: 1.3, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 014DBD38

Memory Dump Source

Source File: 00000000.00000002.3751200947.00000000014DA000.00000040.00000800.00020000.00000000.sdmp, Offset: 014DA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14da000_Server.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: e2f2fcd2e7e233634323569d4a46ec94ca3f86bd5cac12f1c9a1a491f1c5d7b7
Instruction ID: bbcb46f64f274e29983c2839ce366d559617beedf0c9f6f4dd2bc9dff2f64812
Opcode Fuzzy Hash: e2f2fcd2e7e233634323569d4a46ec94ca3f86bd5cac12f1c9a1a491f1c5d7b7
Instruction Fuzzy Hash: 24219D725093C09FDB128B25DD55B92BFA4AF47224F0984DAE8858F663D274A908CB62

Function 014DA61E Relevance: 1.3, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 014DA690

Memory Dump Source

Source File: 00000000.00000002.3751200947.00000000014DA000.00000040.00000800.00020000.00000000.sdmp, Offset: 014DA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14da000_Server.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 6c6d5c8b8197673786efe1be9550acb5b63a96c20805c3b463709847351feb5f
Instruction ID: 2ac9fead381ebbae36da3ec34faa8b7d31b183d5f645af0bdece5c06c3347f65
Opcode Fuzzy Hash: 6c6d5c8b8197673786efe1be9550acb5b63a96c20805c3b463709847351feb5f
Instruction Fuzzy Hash: 2521387140D3C49FDB138B259C95A92BFB4DF47220F0984DBD9858F2A3D2699908CBB2

Function 014DBD06 Relevance: 1.3, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 014DBD38

Memory Dump Source

Source File: 00000000.00000002.3751200947.00000000014DA000.00000040.00000800.00020000.00000000.sdmp, Offset: 014DA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14da000_Server.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: b098bf622cbf42eafdf76c5cc153b0fdb3b8fcb3ec4372d751fb77d795ba3d4b
Instruction ID: acef18663b4bcf9b321f158e5c9ef7feb2dbcec115d0cd7f09eaf93ca26ec53b
Opcode Fuzzy Hash: b098bf622cbf42eafdf76c5cc153b0fdb3b8fcb3ec4372d751fb77d795ba3d4b
Instruction Fuzzy Hash: 6101DF769002408FDB10CF19D985B96FBE4EF41220F08C4ABDC4A8B766D774E408CEA2

Function 014DABBE Relevance: 1.3, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 014DABF0

Memory Dump Source

Source File: 00000000.00000002.3751200947.00000000014DA000.00000040.00000800.00020000.00000000.sdmp, Offset: 014DA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14da000_Server.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 0fbf1a3fce8826160142dced14c78154a8a742c5bff69d3a4d9909b9887fc727
Instruction ID: 19e3b2f43314e47f9324ab88965d0222e67e1425bfc47bd867ccb2f0cd359fb6
Opcode Fuzzy Hash: 0fbf1a3fce8826160142dced14c78154a8a742c5bff69d3a4d9909b9887fc727
Instruction Fuzzy Hash: B501DF769042408FDB10CF19E9857A6FBE4EF00620F08C8ABDD098F762D775E408CA61

Function 01530802 Relevance: 1.3, Strings: 1, Instructions: 43COMMON

Download Yara Rule

Strings

j, xrefs: 01530804

Memory Dump Source

Source File: 00000000.00000002.3751417233.0000000001530000.00000040.00000020.00020000.00000000.sdmp, Offset: 01530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1530000_Server.jbxd

Similarity

API ID:
String ID: j
API String ID: 0-2137352139
Opcode ID: c23bfd368dc57970109384c3f9600d5a21a4c0cbc762eca5d4a1c26ad049ad23
Instruction ID: 7869458661d892ba9b1b4f90b7343f12d597d2e47aa89a822a6967dbcff2e5b1
Opcode Fuzzy Hash: c23bfd368dc57970109384c3f9600d5a21a4c0cbc762eca5d4a1c26ad049ad23
Instruction Fuzzy Hash: 56113335509380CFC716CB10D590B15FBB1BB86718F28C6EDE8495B6A3C3369816DB41

Function 014DA65E Relevance: 1.3, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 014DA690

Memory Dump Source

Source File: 00000000.00000002.3751200947.00000000014DA000.00000040.00000800.00020000.00000000.sdmp, Offset: 014DA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14da000_Server.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 6d2b28ab4c21cb414c8703c829949307ce4c193b77d0840e5457185d0c6c2475
Instruction ID: 30d57d70cac0443c7ad5a14f48e47ce11566041b9a9af15d5fdf22c3e3d59bf2
Opcode Fuzzy Hash: 6d2b28ab4c21cb414c8703c829949307ce4c193b77d0840e5457185d0c6c2475
Instruction Fuzzy Hash: F901AD75800240CFDB10CF59D9857A6FBE4EF84220F18C8ABDD898F362D375A408CEA2

Function 01C78210 Relevance: 1.2, Instructions: 1249COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3751977000.0000000001C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 01C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c70000_Server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b23632a7206b09a7243e7c0e5d0ead9e05ff77ffc19d95dc91e6f25aad30dd96
Instruction ID: 0f4573e08c425876168909db4d6cc7dfdeaf8328c8f2fcbef43f0ea9703c0683
Opcode Fuzzy Hash: b23632a7206b09a7243e7c0e5d0ead9e05ff77ffc19d95dc91e6f25aad30dd96
Instruction Fuzzy Hash: B3C247B4B001A5CBEB118F25E8107BD7BF6EB89308F0050AB984997795EB78CD55DFA0

Function 01C7828C Relevance: 1.1, Instructions: 1079COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3751977000.0000000001C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 01C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c70000_Server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 568b7b04a6b2bae24edee038822ece39c16a628cce7ff38dc2a77c3b3a3d2c25
Instruction ID: 68e841157dc2fa91ae4f6ec7ee3db88689f04bd23d926afe20212d8d1c6b73d6
Opcode Fuzzy Hash: 568b7b04a6b2bae24edee038822ece39c16a628cce7ff38dc2a77c3b3a3d2c25
Instruction Fuzzy Hash: 5D9278F4B001A0DBEF118F25D8207BD7BE6EB89308F0050AA994997795DB78CD66DF60

Function 01C782C6 Relevance: 1.1, Instructions: 1076COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3751977000.0000000001C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 01C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c70000_Server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b7e428ee9684d4ad6f2124df89eadbb68937570a1b167d324391cbb6f564fed
Instruction ID: 86a580052e01ab6e6c68a517792bca5e0ad693b8ee9e077981198cbab23b5be2
Opcode Fuzzy Hash: 1b7e428ee9684d4ad6f2124df89eadbb68937570a1b167d324391cbb6f564fed
Instruction Fuzzy Hash: 2F9278F4B001A4DBEF118F25D8207BD7BE6EB88308F0050AA994997795DB78CD66DF60

Function 01C782F5 Relevance: 1.1, Instructions: 1075COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3751977000.0000000001C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 01C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c70000_Server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8616e290449325a0678f489eff53e3386029e8ad9030a9a363593874087fdc65
Instruction ID: 7d7ca3c6c9ec2312debad01c5835fcc006b331a2b2f14bbff838cafc7f0db4e9
Opcode Fuzzy Hash: 8616e290449325a0678f489eff53e3386029e8ad9030a9a363593874087fdc65
Instruction Fuzzy Hash: 019278F4B001A4DBEF118F25D8207BD7BE6EB88308F0050AA994997795DB78CD66DF60

Function 01C781B6 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3751977000.0000000001C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 01C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c70000_Server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f18ad122d9ff0f4283d0ce6f9cb4faba05f2335df86570a273d2b3da080b3e72
Instruction ID: 6424c029f1f55674117451ae0efc226fde0759724e57a4b03584ec83f7ffb781
Opcode Fuzzy Hash: f18ad122d9ff0f4283d0ce6f9cb4faba05f2335df86570a273d2b3da080b3e72
Instruction Fuzzy Hash: F5418B30A00305CFEB15CF3AD9197AD36E2AB45359F1885A9D511DB2E1EFB8DE02CB20

Function 01C70958 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3751977000.0000000001C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 01C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c70000_Server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f304992e16d0bd6b2d2918c03b9fd3a849edd2e01a86f49072a129332ddc1de7
Instruction ID: 1b81cab57ffe3742958bc647b996bbe442c4be3dbc29290258e3f51b0611b927
Opcode Fuzzy Hash: f304992e16d0bd6b2d2918c03b9fd3a849edd2e01a86f49072a129332ddc1de7
Instruction Fuzzy Hash: 5531ADB0B002118FDB04AB75D8127BE33A6EB89208F50503AE415D77A5EF7D8D2ACB91

Function 01C7717B Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3751977000.0000000001C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 01C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c70000_Server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ace48963dc228d4c2fe0733a14657dbe3f6bbc5077f78f7f3f1ac07b3e440ac2
Instruction ID: 77401dc4f725bd0a78485e3ac0c71b700872e5bc9a3a8b236262852188d3573b
Opcode Fuzzy Hash: ace48963dc228d4c2fe0733a14657dbe3f6bbc5077f78f7f3f1ac07b3e440ac2
Instruction Fuzzy Hash: 6B2108306093818FC7165778B8680B93BF2EF9710971944AFD485CB7A3DBB98C55C792

Function 01530814 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3751417233.0000000001530000.00000040.00000020.00020000.00000000.sdmp, Offset: 01530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1530000_Server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8320e2a5e30fcf2948e18a6503c79a8e733472e922bba61845e2ec1c9e33dd5d
Instruction ID: 391b60a45053e7d24634cbb9eef37eeb9216a1121b886e245f9302f2caa8e5ee
Opcode Fuzzy Hash: 8320e2a5e30fcf2948e18a6503c79a8e733472e922bba61845e2ec1c9e33dd5d
Instruction Fuzzy Hash: 8011A2316043849FD715CB14D940B29FBE5BBC8708F28C9ACE9495BA93C77BD817CA81

Function 01C771C8 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3751977000.0000000001C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 01C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c70000_Server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63d01cc77ca05032b9189bef9c4c3984cfa457b40c78ff40d647faf72ae5c195
Instruction ID: 1075e5cca39c848996d2a41293647ef6c543399be2e6d75de772296e2fb1f331
Opcode Fuzzy Hash: 63d01cc77ca05032b9189bef9c4c3984cfa457b40c78ff40d647faf72ae5c195
Instruction Fuzzy Hash: 3801DF346083908BC71A6778A8642BA37A6EBC714A31480ABD4819B393DFBD8C56C791

Function 01C70014 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3751977000.0000000001C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 01C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c70000_Server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7dbdfcae2606820926c948395ace1b022786d59aa78c8f7d69ae669214389465
Instruction ID: d1e0534d2ddfb2978824888976bcdc9d711e1a8d7d759ecbe6dfd5e9cc459a36
Opcode Fuzzy Hash: 7dbdfcae2606820926c948395ace1b022786d59aa78c8f7d69ae669214389465
Instruction Fuzzy Hash: E101E46140E3C19FD3038B70DC646957FB0AF57208B8E41CBD080CF2A7E6AD8919CB62

Function 015305DF Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3751417233.0000000001530000.00000040.00000020.00020000.00000000.sdmp, Offset: 01530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1530000_Server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3cb1f9e5a49cb8b6a15456c642c4f429d1d78d5e36829073e268f7e8a0623ad
Instruction ID: 509cddff1b907698f5587a84f1f1383631eb1b7058298bc06ae81fefaf79d551
Opcode Fuzzy Hash: c3cb1f9e5a49cb8b6a15456c642c4f429d1d78d5e36829073e268f7e8a0623ad
Instruction Fuzzy Hash: DA0186B65093845FD7118F06EC41867FFE8DB86620709C49FFC498B712D625A808CBA5

Function 01C70879 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3751977000.0000000001C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 01C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c70000_Server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 392459acdef8915cd954b99fb113a716c966bb983ac9f1bd4689a97b4cead891
Instruction ID: d0effba3ee4bc3673a11755d62577a03e22aaa1de19b041d9d0ecee5fab6bffc
Opcode Fuzzy Hash: 392459acdef8915cd954b99fb113a716c966bb983ac9f1bd4689a97b4cead891
Instruction Fuzzy Hash: 79016D34606342CFCF41EF75E4688AD77E1EF95209B44882DE585CB329EB748C048F92

Function 01C700A8 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3751977000.0000000001C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 01C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c70000_Server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5860694bc12a0fe68c398c037dc35386b8052ac44ef5afc5c01b0dcb204f376c
Instruction ID: 58a127f6013baa274fbb44f1a3865dc4697576bf4febdc67c8cede0968bd4359
Opcode Fuzzy Hash: 5860694bc12a0fe68c398c037dc35386b8052ac44ef5afc5c01b0dcb204f376c
Instruction Fuzzy Hash: EFF0FC71A003446BEB04DFB1CC517AE7FB7DB82624F00856EE5459B2D1EA759D41C750

Function 015308D0 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3751417233.0000000001530000.00000040.00000020.00020000.00000000.sdmp, Offset: 01530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1530000_Server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34f7cc177ec357e4be824001698e3cc6f925d319bee30944042fc642ffdb53de
Instruction ID: 4692f20dc1d6ed8e655fec2097d09ef396255aafd03f92597cfa4d30803b3070
Opcode Fuzzy Hash: 34f7cc177ec357e4be824001698e3cc6f925d319bee30944042fc642ffdb53de
Instruction Fuzzy Hash: F8F01935108644DFC706CF04D980B15FBA2FB89718F24CAADE9491BB62C737E813DA81

Function 01530606 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3751417233.0000000001530000.00000040.00000020.00020000.00000000.sdmp, Offset: 01530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1530000_Server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efb3410565da6819008be2ea32fc0047b9cf861a1fcfa0c274541cfe7a47fdc9
Instruction ID: 8545174295a750f1f6985cb9e5bca2e2e4e26ebdec1856ade8e7ff28573400e6
Opcode Fuzzy Hash: efb3410565da6819008be2ea32fc0047b9cf861a1fcfa0c274541cfe7a47fdc9
Instruction Fuzzy Hash: A5E092B66006444B9750CF0BFC41492F7D8EB84630B08C07FDC0D8BB11E635B508CEA5

Function 01C736A8 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3751977000.0000000001C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 01C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c70000_Server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fdf734598f7b1738432dd1181a0930ec057f52903a6a37d9fad1be47c974fb17
Instruction ID: 68f3ad6c2953e36b1d1b4d78baefae42c6b3a42149fc881b479b659b424e8db4
Opcode Fuzzy Hash: fdf734598f7b1738432dd1181a0930ec057f52903a6a37d9fad1be47c974fb17
Instruction Fuzzy Hash: 08E06D3154A3908FCB27677458284A93BB1AA4320875414EED086CA2ABE67AD846CB00

Function 01C74200 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3751977000.0000000001C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 01C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c70000_Server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77ecb9c4e7718d0d4eb42e64b684145dd0b55bcc6dc2311886e537f309285890
Instruction ID: e818a36aab97d0b6b4ef6a9b2e238210efd5646a350e897fe65f2e9793603eff
Opcode Fuzzy Hash: 77ecb9c4e7718d0d4eb42e64b684145dd0b55bcc6dc2311886e537f309285890
Instruction Fuzzy Hash: F6E09270D1E384AFC706CFB89C115A97FF49B03209B0601EBC889CB2A3E5354E04CB92

Function 014D23F4 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3751187688.00000000014D2000.00000040.00000800.00020000.00000000.sdmp, Offset: 014D2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14d2000_Server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89aea26db1ac460339a2b4cf7ada90841acc24a5c1d2283334d2bd175086bbad
Instruction ID: ca3a4c2867d34a2e21e8081f7bccd4edf341281f5453f4f9161380ed76c801b2
Opcode Fuzzy Hash: 89aea26db1ac460339a2b4cf7ada90841acc24a5c1d2283334d2bd175086bbad
Instruction Fuzzy Hash: 2DD05E792066D14FE7179A1CD1B4F9A3BE4AB51714F4A44FAEC008B773C7A8D5C1D600

Function 014D23BC Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3751187688.00000000014D2000.00000040.00000800.00020000.00000000.sdmp, Offset: 014D2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14d2000_Server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dafbbaaf5c9aecbb2aeb49b8dcf9766f972fbfbc0a7d7beb466428206a93be92
Instruction ID: 6412adf4e5e6f3e87ec55c47c22d1666c53922f8ea6a6f3005836e2b6c97161a
Opcode Fuzzy Hash: dafbbaaf5c9aecbb2aeb49b8dcf9766f972fbfbc0a7d7beb466428206a93be92
Instruction Fuzzy Hash: F2D05E342012814BDB16DA1CD2E4F5A3BD4AB84714F0644E9AC108B772CBB4D8C0CA00

Function 01C74210 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3751977000.0000000001C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 01C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c70000_Server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f86a2771b9185f5ab300b35d952cbe8fe2eb197a86ac308e67e77b873257b0ff
Instruction ID: 2793cfb3f49248703ee44ea936c8b5c90263a452de123b2c885412cd86605e12
Opcode Fuzzy Hash: f86a2771b9185f5ab300b35d952cbe8fe2eb197a86ac308e67e77b873257b0ff
Instruction Fuzzy Hash: B6D0A930E0120CEF8700DFA8EC0089DB7F8EB05204B0000AAA80DC7320EE311E00DB91

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Server.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Njrat

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\18f92744a712890ce1a5852179df81aaWindows Update.exe

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\18f92744a712890ce1a5852179df81aaWindows Update.exe:Zone.Identifier

C:\Users\user\AppData\Roaming\app

\Device\ConDrv

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Windows Analysis Report
Server.exe