Play interactive tour

Edit tour

Windows Analysis Report njw.exe

Overview

General Information

Sample Name:	njw.exe
Analysis ID:	511823
MD5:	3f91f84924d1db7ace9ad307fcae35d1
SHA1:	50e790e2b3324c1b3805916c5a3c323ed8a7305f
SHA256:	a0254e8580186ca146fcc6082a6110888ac0cc3c7f733e760ad7a655bd2a0503
Infos:
Most interesting Screenshot:

Detection

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Tries to steal Mail credentials (via file registry)

Machine Learning detection for sample

PE file has nameless sections

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Contains functionality to query locales information (e.g. system language)

Uses code obfuscation techniques (call, push, ret)

PE file contains sections with non-standard names

Detected potential crypto function

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Found potential string decryption / allocating functions

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

JA3 SSL client fingerprint seen in connection with other malware

Contains functionality to call native functions

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Uses the system / local time for branch decision (may execute only at specific dates)

IP address seen in connection with other malware

Abnormal high CPU Usage

Creates a DirectInput object (often for capturing keystrokes)

Queries information about the installed CPU (vendor, model number etc)

PE file contains an invalid checksum

PE file contains strange resources

Allocates memory with a write watch (potentially for evading sandboxes)

Uses a known web browser user agent for HTTP communication

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Installs a global mouse hook

Found evaded block containing many API calls

PE file contains more sections than normal

Contains functionality for read data from the clipboard

Classification

Process Tree

System is w10x64

njw.exe (PID: 7120 cmdline: 'C:\Users\user\Desktop\njw.exe' MD5: 3F91F84924D1DB7ACE9AD307FCAE35D1)

cleanup

Malware Configuration

No configs have been found

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.njw.exe.400000.0.unpack	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Multi AV Scanner detection for submitted file

Show sources

Source: njw.exe

Virustotal: Detection: 11%

Perma Link

Machine Learning detection for sample

Show sources

Source: njw.exe

Joe Sandbox ML: detected

Source: njw.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, BYTES_REVERSED_LO, EXECUTABLE_IMAGE, DEBUG_STRIPPED, LINE_NUMS_STRIPPED, BYTES_REVERSED_HI, RELOCS_STRIPPED

Source: unknown	HTTPS traffic detected: 87.250.251.119:443 -> 192.168.2.4:49791 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 87.250.251.119:443 -> 192.168.2.4:49790 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 88.212.201.198:443 -> 192.168.2.4:49792 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 88.212.201.198:443 -> 192.168.2.4:49793 version: TLS 1.2

Source: C:\Users\user\Desktop\njw.exe	Code function: 0_2_0068FDFC FindFirstFileA,		0_2_0068FDFC
Source: C:\Users\user\Desktop\njw.exe	Code function: 0_2_0068D8ED FindFirstFileA,GetTempPathA,DeleteFileA,FindNextFileA,		0_2_0068D8ED

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Joe Sandbox View	IP Address: 88.212.201.198 88.212.201.198
Source: Joe Sandbox View	IP Address: 87.250.251.119 87.250.251.119

Source: global traffic	HTTP traffic detected: GET /metrika/watch.js HTTP/1.1Accept: /Referer: http://www.all-bearings.narod.ru/secondpage.htmlAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Connection: Keep-AliveHost: mc.yandex.ru
Source: global traffic	HTTP traffic detected: GET /hit;counter1?r;s1280102432;uhttp%3A//www.all-bearings.narod.ru/secondpage.html;0.5443641556055339 HTTP/1.1Accept: /Referer: http://www.all-bearings.narod.ru/secondpage.htmlAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Connection: Keep-AliveHost: counter.yadro.ru
Source: global traffic	HTTP traffic detected: GET /metrika/watch.js HTTP/1.1Accept: /Referer: http://www.all-bearings.narod.ru/firstpage.htmlAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Connection: Keep-AliveHost: mc.yandex.ru
Source: global traffic	HTTP traffic detected: GET /hit;counter1?r;s1280102432;uhttp%3A//www.all-bearings.narod.ru/firstpage.html;0.34476715437082456 HTTP/1.1Accept: /Referer: http://www.all-bearings.narod.ru/firstpage.htmlAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Connection: Keep-AliveHost: counter.yadro.ru
Source: global traffic	HTTP traffic detected: GET /hit;counter1?q;r;s1280102432;uhttp%3A//www.all-bearings.narod.ru/firstpage.html;0.34476715437082456 HTTP/1.1Accept: /Referer: http://www.all-bearings.narod.ru/firstpage.htmlAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Connection: Keep-AliveHost: counter.yadro.ruCookie: FTID=1XV1Xy3Wb9uB1XV1Xy001EiW
Source: global traffic	HTTP traffic detected: GET /hit;counter1?q;r;s1280102432;uhttp%3A//www.all-bearings.narod.ru/secondpage.html;0.5443641556055339 HTTP/1.1Accept: /Referer: http://www.all-bearings.narod.ru/secondpage.htmlAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Connection: Keep-AliveHost: counter.yadro.ruCookie: FTID=1XV1Xy3Wb9uB1XV1Xy001Ei9
Source: global traffic	HTTP traffic detected: GET /watch/14153041?callback=_ymjsp303195921&page-url=http%3A%2F%2Fwww.all-bearings.narod.ru%2Fsecondpage.html&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3A9ezyymqkmijljhdjn%3Afp%3A1976%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A680%3Acn%3A1%3Adp%3A0%3Als%3A1156845228070%3Ahid%3A271984739%3Az%3A120%3Ai%3A202101029175118%3Aet%3A1635522678%3Ac%3A1%3Arn%3A1015963535%3Au%3A1635522678322622628%3Aw%3A148x55%3As%3A1280x1024x32%3Aifr%3A1%3Aj%3A1%3Ans%3A1635522674734%3Ads%3A0%2C0%2C0%2C0%2C0%2C0%2C%2C128%2C0%2C1973%2C1975%2C0%2C1973%3Aco%3A0%3Arqnl%3A1%3Ast%3A1635522680%3At%3AHTTP%20404%20Resource%20not%20found&t=gdpr(14)ti(3)&wmode=5 HTTP/1.1Accept: /Referer: http://www.all-bearings.narod.ru/secondpage.htmlAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: mc.yandex.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /watch/14153041?callback=_ymjsp355627947&page-url=http%3A%2F%2Fwww.all-bearings.narod.ru%2Ffirstpage.html&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3A9ezyymqkmijljhdjn%3Afp%3A1930%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A680%3Acn%3A1%3Adp%3A0%3Als%3A732524701665%3Ahid%3A87010386%3Az%3A120%3Ai%3A202101029175120%3Aet%3A1635522680%3Ac%3A1%3Arn%3A244404675%3Au%3A1635522678322622628%3Aw%3A148x47%3As%3A1280x1024x32%3Aifr%3A1%3Aj%3A1%3Ans%3A1635522674781%3Ads%3A0%2C0%2C0%2C0%2C0%2C0%2C%2C155%2C0%2C2520%2C2521%2C0%2C2520%3Aco%3A0%3Arqnl%3A1%3Ast%3A1635522681%3At%3AHTTP%20404%20Resource%20not%20found&t=gdpr(14)ti(3)&wmode=5 HTTP/1.1Accept: /Referer: http://www.all-bearings.narod.ru/firstpage.htmlAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: mc.yandex.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /metrika/advert.gif?t=ti(4) HTTP/1.1Accept: /Referer: http://www.all-bearings.narod.ru/secondpage.htmlAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: mc.yandex.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /watch/14153041/1?callback=_ymjsp303195921&page-url=http%3A%2F%2Fwww.all-bearings.narod.ru%2Fsecondpage.html&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3A9ezyymqkmijljhdjn%3Afp%3A1976%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A680%3Acn%3A1%3Adp%3A0%3Als%3A1156845228070%3Ahid%3A271984739%3Az%3A120%3Ai%3A202101029175118%3Aet%3A1635522678%3Ac%3A1%3Arn%3A1015963535%3Au%3A1635522678322622628%3Aw%3A148x55%3As%3A1280x1024x32%3Aifr%3A1%3Aj%3A1%3Ans%3A1635522674734%3Ads%3A0%2C0%2C0%2C0%2C0%2C0%2C%2C128%2C0%2C1973%2C1975%2C0%2C1973%3Aco%3A0%3Arqnl%3A1%3Ast%3A1635522680%3At%3AHTTP%20404%20Resource%20not%20found&t=gdpr%2814%29ti%283%29&wmode=5 HTTP/1.1Accept: /Referer: http://www.all-bearings.narod.ru/secondpage.htmlAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: mc.yandex.ruConnection: Keep-AliveCookie: yandexuid=847304281635522680; i=vL1T7ICVuHRXpyNPzwMzlaKjl/D94ryPalEPO4xIx2pX5AZpVtBfDP0muIercdmDCjCbNqUK2tSOHbHUPiY/6ZY1euA=; ymex=1667058680.yrts.1635522680#1667058680.yrtsi.1635522680; yabs-sid=2327043721635522680
Source: global traffic	HTTP traffic detected: GET /watch/14153041/1?callback=_ymjsp355627947&page-url=http%3A%2F%2Fwww.all-bearings.narod.ru%2Ffirstpage.html&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3A9ezyymqkmijljhdjn%3Afp%3A1930%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A680%3Acn%3A1%3Adp%3A0%3Als%3A732524701665%3Ahid%3A87010386%3Az%3A120%3Ai%3A202101029175120%3Aet%3A1635522680%3Ac%3A1%3Arn%3A244404675%3Au%3A1635522678322622628%3Aw%3A148x47%3As%3A1280x1024x32%3Aifr%3A1%3Aj%3A1%3Ans%3A1635522674781%3Ads%3A0%2C0%2C0%2C0%2C0%2C0%2C%2C155%2C0%2C2520%2C2521%2C0%2C2520%3Aco%3A0%3Arqnl%3A1%3Ast%3A1635522681%3At%3AHTTP%20404%20Resource%20not%20found&t=gdpr%2814%29ti%283%29&wmode=5 HTTP/1.1Accept: /Referer: http://www.all-bearings.narod.ru/firstpage.htmlAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: mc.yandex.ruConnection: Keep-AliveCookie: yandexuid=3723159021635522681; i=yROKAQCkQEDp/MhTCtujtSWzFSx7PgG/2QZgPGeQuaYkCYGk4Lr5g33sdF0NzFWf3pPBk9Yj1OF7cHnVzZMM+SWO+Mc=; ymex=1667058681.yrts.1635522681#1667058681.yrtsi.1635522681; yabs-sid=702787781635522681
Source: global traffic	HTTP traffic detected: GET /metrika/advert.gif?t=ti(4) HTTP/1.1Accept: /Referer: http://www.all-bearings.narod.ru/firstpage.htmlAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: mc.yandex.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /secondpage.html HTTP/1.1Accept: /Accept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: www.all-bearings.narod.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /firstpage.html HTTP/1.1Accept: /Accept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: www.all-bearings.narod.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /hit;counter1?r;s1280102432;uhttp%3A//www.all-bearings.narod.ru/firstpage.html;0.34476715437082456 HTTP/1.1Accept: /Referer: http://www.all-bearings.narod.ru/firstpage.htmlAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: counter.yadro.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /metrika/watch.js HTTP/1.1Accept: /Referer: http://www.all-bearings.narod.ru/secondpage.htmlAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: mc.yandex.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /metrika/watch.js HTTP/1.1Accept: /Referer: http://www.all-bearings.narod.ru/firstpage.htmlAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: mc.yandex.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /hit;counter1?r;s1280102432;uhttp%3A//www.all-bearings.narod.ru/secondpage.html;0.5443641556055339 HTTP/1.1Accept: /Referer: http://www.all-bearings.narod.ru/secondpage.htmlAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: counter.yadro.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /.s/img/err/button.png HTTP/1.1Accept: /Referer: http://www.all-bearings.narod.ru/secondpage.htmlAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: www.all-bearings.narod.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /.s/img/err/404-header-line.gif HTTP/1.1Accept: /Referer: http://www.all-bearings.narod.ru/secondpage.htmlAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: www.all-bearings.narod.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /.s/img/err/404-arrow.png HTTP/1.1Accept: /Referer: http://www.all-bearings.narod.ru/secondpage.htmlAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: www.all-bearings.narod.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /.s/img/err/404-logo.png HTTP/1.1Accept: /Referer: http://www.all-bearings.narod.ru/secondpage.htmlAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: www.all-bearings.narod.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /.s/img/err/404.png HTTP/1.1Accept: /Referer: http://www.all-bearings.narod.ru/secondpage.htmlAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: www.all-bearings.narod.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /.s/img/err/button.png HTTP/1.1Accept: /Referer: http://www.all-bearings.narod.ru/firstpage.htmlAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: www.all-bearings.narod.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /.s/img/err/404-header-line.gif HTTP/1.1Accept: /Referer: http://www.all-bearings.narod.ru/firstpage.htmlAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: www.all-bearings.narod.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /.s/img/err/404-logo.png HTTP/1.1Accept: /Referer: http://www.all-bearings.narod.ru/firstpage.htmlAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: www.all-bearings.narod.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /.s/img/err/404-arrow.png HTTP/1.1Accept: /Referer: http://www.all-bearings.narod.ru/firstpage.htmlAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: www.all-bearings.narod.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /.s/img/err/404.png HTTP/1.1Accept: /Referer: http://www.all-bearings.narod.ru/firstpage.htmlAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: www.all-bearings.narod.ruConnection: Keep-Alive

Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 29 Oct 2021 15:51:16 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: keep-aliveKeep-Alive: timeout=15ETag: W/"611e66ad-1ad5"Content-Encoding: gzipData Raw: 61 30 31 0d 0a 1f 8b 08 00 00 00 00 00 00 03 9d 59 fb 6f db 38 12 fe 3d 7f 05 ab e0 60 bb 89 25 bf 92 a6 7e 15 6d da c5 2e 90 6e 7b bb e9 1d 8a a2 28 68 89 b6 d8 48 a2 4a 52 71 bc d9 fc ef 37 43 ea 65 5b 4e ba 67 a1 91 c4 c7 70 e6 9b 99 8f 43 75 fa ec ed 87 cb eb cf 1f df 91 50 c7 d1 fc 68 5a dc 18 0d e6 47 04 7e d3 98 69 0a bd 3a ed b2 1f 19 bf 9d 39 be 48 34 4b 74 57 6f 52 e6 90 fc 6d e6 68 76 a7 3d 9c 3e 21 7e 48 a5 62 7a 96 e9 65 f7 c2 21 5e 2e 49 73 1d b1 f9 af d7 d7 1f c9 a8 37 22 7f 30 25 32 e9 33 92 08 4d 96 22 4b 82 a9 67 87 1c 4d 95 de 44 8c e0 0a b9 60 5f 29 67 7e b4 10 c1 86 dc c7 54 ae 78 32 26 bd 09 49 69 10 f0 64 65 9e 17 d4 bf 59 49 94 33 26 c7 cb e5 72 02 42 13 3d 26 fd 41 7a e7 0d e0 0f 69 fd 87 c9 80 26 b4 05 2a 8a 48 48 18 77 7e 81 d7 e4 c1 8a a6 e4 be e8 18 0e e8 c0 07 19 b8 7a 37 60 be 90 54 73 01 ab 82 7c 26 23 9e b0 72 d2 38 14 b7 4c 92 fb bd a1 89 30 a3 74 70 4a 78 92 66 fa 94 28 16 31 1f ee 38 94 4a 06 eb 55 3a 92 a7 95 74 fd 88 51 58 c9 dc c6 64 21 74 68 5a ad 0f c8 fd 9a 07 3a 1c 93 17 c3 b3 f4 6e 42 0a 9c 68 a6 05 0c f3 9e 77 f3 1f 7a 97 49 fb fc dc 3b 3a b6 ef e4 3e 64 7c 15 82 36 67 66 7a 1d cf 4c 46 6d cf 55 1e 8f 57 1e 93 d2 03 ff 15 52 10 0a 77 c5 97 1d 22 59 ca a8 ee de 91 1e f8 17 24 3c 1c 1d 47 62 25 c0 c6 48 50 10 1b b1 a5 ae b4 aa 7b 6f 70 9e e2 ac 1e 36 e6 36 8c 86 a8 43 a1 d1 e0 45 4d 1e a0 16 70 95 46 74 03 10 44 c2 bf a9 c7 01 79 89 f3 0e 0b 21 e8 2b 50 68 3d 26 21 0f 02 96 40 4b a6 d1 88 dc 5f d6 e3 1c bc 8c 8e e9 be 84 df 2e 1a 18 5d 8d 90 a0 7a 6e 9a ac 3a 20 aa 6b e1 20 3e c8 01 70 ed 0d bd a5 b8 66 5d 1f 9c af 59 09 8d 44 0d 2b 6c ea 78 3c 62 ea 99 19 d5 37 de ca e3 a8 8f b1 7e 7e 20 8c 5e f8 3d 36 f8 49 53 a8 94 62 bd 6b 0b 7a 90 f4 ad 6f ab 70 aa ff 20 9c aa 8e 98 f2 a4 d6 71 8c ef e4 be 34 e0 ac 67 f4 3f 33 66 20 32 66 bc 59 63 3b 64 72 6f f6 cf 71 65 eb 1f 1a f1 15 00 55 a1 0a 7a 0b 69 e8 a3 cc a9 0b c4 62 d4 8c c5 0b b6 18 05 83 72 a2 2f 02 56 11 4b df 2a 36 b0 8a 95 cb db b4 28 a2 e9 fc fc 27 92 64 07 40 5c 2f a5 2b 06 8c 67 08 af 54 75 84 aa f6 0e a9 8a d7 de 54 9a 13 8e 96 34 51 4b 21 63 50 20 4d 99 f4 a9 62 4d 76 1a 70 4d 9c 35 a3 3b 7a b9 45 1a 26 fa c8 85 f5 75 7d 72 38 dc 62 e0 1a c7 22 e0 4d 06 0c 86 78 95 62 4a b6 6a 62 82 fe b0 8c fc dd f1 59 54 4d 19 96 91 0f 19 8a 6a d7 37 82 88 2b dd 35 3b 48 49 c1 c7 0a 08 d3 0f c9 3d e6 9f 79 5c 0b 19 94 84 39 7c d1 db 16 42 b6 5c 3d 30 bd c8 11 dd ed a6 1d e6 58 80 4c 06 16 43 12 12 25 22 1e 90 63 7f 89 57 d1 d5 95 34 e0 99 1a 5b f1 40 44 9a fb 34 2a 82 39 06 3e 8a 8c a3 ad 8a 6a 11 3f 1a 20 a5 2e 03 94 56 a0 7d 36 a2 41 b9 71 a9 90 06 48 75 3d a3 13 fe b3 3b 63 cd 52 23 15 37 1e 6b 52 93 0d 43 bc c8 33 1e a7 90 62 34 d1 cd e6 6c d1 0a bb c0 6b 2f 25 16 99 d6 22 b1 59 51 6c 17 a0 7a 26 15 ea 9e 0a 6
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 29 Oct 2021 15:51:16 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: keep-aliveKeep-Alive: timeout=15ETag: W/"611e66ad-1ad5"Content-Encoding: gzipData Raw: 61 30 31 0d 0a 1f 8b 08 00 00 00 00 00 00 03 9d 59 fb 6f db 38 12 fe 3d 7f 05 ab e0 60 bb 89 25 bf 92 a6 7e 15 6d da c5 2e 90 6e 7b bb e9 1d 8a a2 28 68 89 b6 d8 48 a2 4a 52 71 bc d9 fc ef 37 43 ea 65 5b 4e ba 67 a1 91 c4 c7 70 e6 9b 99 8f 43 75 fa ec ed 87 cb eb cf 1f df 91 50 c7 d1 fc 68 5a dc 18 0d e6 47 04 7e d3 98 69 0a bd 3a ed b2 1f 19 bf 9d 39 be 48 34 4b 74 57 6f 52 e6 90 fc 6d e6 68 76 a7 3d 9c 3e 21 7e 48 a5 62 7a 96 e9 65 f7 c2 21 5e 2e 49 73 1d b1 f9 af d7 d7 1f c9 a8 37 22 7f 30 25 32 e9 33 92 08 4d 96 22 4b 82 a9 67 87 1c 4d 95 de 44 8c e0 0a b9 60 5f 29 67 7e b4 10 c1 86 dc c7 54 ae 78 32 26 bd 09 49 69 10 f0 64 65 9e 17 d4 bf 59 49 94 33 26 c7 cb e5 72 02 42 13 3d 26 fd 41 7a e7 0d e0 0f 69 fd 87 c9 80 26 b4 05 2a 8a 48 48 18 77 7e 81 d7 e4 c1 8a a6 e4 be e8 18 0e e8 c0 07 19 b8 7a 37 60 be 90 54 73 01 ab 82 7c 26 23 9e b0 72 d2 38 14 b7 4c 92 fb bd a1 89 30 a3 74 70 4a 78 92 66 fa 94 28 16 31 1f ee 38 94 4a 06 eb 55 3a 92 a7 95 74 fd 88 51 58 c9 dc c6 64 21 74 68 5a ad 0f c8 fd 9a 07 3a 1c 93 17 c3 b3 f4 6e 42 0a 9c 68 a6 05 0c f3 9e 77 f3 1f 7a 97 49 fb fc dc 3b 3a b6 ef e4 3e 64 7c 15 82 36 67 66 7a 1d cf 4c 46 6d cf 55 1e 8f 57 1e 93 d2 03 ff 15 52 10 0a 77 c5 97 1d 22 59 ca a8 ee de 91 1e f8 17 24 3c 1c 1d 47 62 25 c0 c6 48 50 10 1b b1 a5 ae b4 aa 7b 6f 70 9e e2 ac 1e 36 e6 36 8c 86 a8 43 a1 d1 e0 45 4d 1e a0 16 70 95 46 74 03 10 44 c2 bf a9 c7 01 79 89 f3 0e 0b 21 e8 2b 50 68 3d 26 21 0f 02 96 40 4b a6 d1 88 dc 5f d6 e3 1c bc 8c 8e e9 be 84 df 2e 1a 18 5d 8d 90 a0 7a 6e 9a ac 3a 20 aa 6b e1 20 3e c8 01 70 ed 0d bd a5 b8 66 5d 1f 9c af 59 09 8d 44 0d 2b 6c ea 78 3c 62 ea 99 19 d5 37 de ca e3 a8 8f b1 7e 7e 20 8c 5e f8 3d 36 f8 49 53 a8 94 62 bd 6b 0b 7a 90 f4 ad 6f ab 70 aa ff 20 9c aa 8e 98 f2 a4 d6 71 8c ef e4 be 34 e0 ac 67 f4 3f 33 66 20 32 66 bc 59 63 3b 64 72 6f f6 cf 71 65 eb 1f 1a f1 15 00 55 a1 0a 7a 0b 69 e8 a3 cc a9 0b c4 62 d4 8c c5 0b b6 18 05 83 72 a2 2f 02 56 11 4b df 2a 36 b0 8a 95 cb db b4 28 a2 e9 fc fc 27 92 64 07 40 5c 2f a5 2b 06 8c 67 08 af 54 75 84 aa f6 0e a9 8a d7 de 54 9a 13 8e 96 34 51 4b 21 63 50 20 4d 99 f4 a9 62 4d 76 1a 70 4d 9c 35 a3 3b 7a b9 45 1a 26 fa c8 85 f5 75 7d 72 38 dc 62 e0 1a c7 22 e0 4d 06 0c 86 78 95 62 4a b6 6a 62 82 fe b0 8c fc dd f1 59 54 4d 19 96 91 0f 19 8a 6a d7 37 82 88 2b dd 35 3b 48 49 c1 c7 0a 08 d3 0f c9 3d e6 9f 79 5c 0b 19 94 84 39 7c d1 db 16 42 b6 5c 3d 30 bd c8 11 dd ed a6 1d e6 58 80 4c 06 16 43 12 12 25 22 1e 90 63 7f 89 57 d1 d5 95 34 e0 99 1a 5b f1 40 44 9a fb 34 2a 82 39 06 3e 8a 8c a3 ad 8a 6a 11 3f 1a 20 a5 2e 03 94 56 a0 7d 36 a2 41 b9 71 a9 90 06 48 75 3d a3 13 fe b3 3b 63 cd 52 23 15 37 1e 6b 52 93 0d 43 bc c8 33 1e a7 90 62 34 d1 cd e6 6c d1 0a bb c0 6b 2f 25 16 99 d6 22 b1 59 51 6c 17 a0 7a 26 15 ea 9e 0a 6

Source: njw.exe, 00000000.00000002.932537112.0000000000A0D000.00000004.00000020.sdmp	String found in binary or memory: <li><a href="http://www.facebook.com/ucoz.web.builder" target="_blank">Facebook</a></li> equals www.facebook.com (Facebook)
Source: njw.exe, 00000000.00000002.935398970.0000000006AB2000.00000004.00000001.sdmp	String found in binary or memory: Phttp://www.facebook.com/ucoz.web.builder75.1 equals www.facebook.com (Facebook)
Source: njw.exe, 00000000.00000002.935398970.0000000006AB2000.00000004.00000001.sdmp	String found in binary or memory: Phttp://www.facebook.com/ucoz.web.builderhtml equals www.facebook.com (Facebook)
Source: njw.exe, 00000000.00000002.932431127.000000000099B000.00000004.00000020.sdmp	String found in binary or memory: http://www.facebook.com/ucoz.web.builder equals www.facebook.com (Facebook)
Source: njw.exe, 00000000.00000002.936889233.000000000B821000.00000004.00000001.sdmp	String found in binary or memory: http://www.facebook.com/ucoz.web.builder7 equals www.facebook.com (Facebook)
Source: njw.exe, 00000000.00000002.932431127.000000000099B000.00000004.00000020.sdmp	String found in binary or memory: http://www.facebook.com/ucoz.web.buildert equals www.facebook.com (Facebook)
Source: njw.exe, 00000000.00000002.934975035.0000000006A40000.00000004.00000001.sdmp	String found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)
Source: njw.exe, 00000000.00000002.934975035.0000000006A40000.00000004.00000001.sdmp	String found in binary or memory: www.facebook.comi equals www.facebook.com (Facebook)

Source: njw.exe, 00000000.00000002.932431127.000000000099B000.00000004.00000020.sdmp	String found in binary or memory: http://book.ucoz.com
Source: njw.exe, 00000000.00000002.936865761.000000000B811000.00000004.00000001.sdmp	String found in binary or memory: http://book.ucoz.com/
Source: njw.exe, 00000000.00000002.935398970.0000000006AB2000.00000004.00000001.sdmp	String found in binary or memory: http://counter.yadro.ru/
Source: njw.exe, 00000000.00000002.932537112.0000000000A0D000.00000004.00000020.sdmp	String found in binary or memory: http://counter.yadro.ru/hit;counter1?r
Source: njw.exe, 00000000.00000002.935239138.0000000006A8C000.00000004.00000001.sdmp	String found in binary or memory: http://counter.yadro.ru/hit;counter1?r;s1280
Source: njw.exe, 00000000.00000003.754055959.000000000B75B000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: njw.exe, 00000000.00000002.932537112.0000000000A0D000.00000004.00000020.sdmp, njw.exe, 00000000.00000002.932431127.000000000099B000.00000004.00000020.sdmp	String found in binary or memory: http://faq.ucoz.com/
Source: njw.exe, 00000000.00000002.936865761.000000000B811000.00000004.00000001.sdmp	String found in binary or memory: http://faq.ucoz.com/iCy
Source: njw.exe, 00000000.00000002.932431127.000000000099B000.00000004.00000020.sdmp	String found in binary or memory: http://faq.ucoz.com/z
Source: njw.exe, 00000000.00000002.932537112.0000000000A0D000.00000004.00000020.sdmp, njw.exe, 00000000.00000002.932431127.000000000099B000.00000004.00000020.sdmp	String found in binary or memory: http://forum.ucoz.com/
Source: njw.exe, 00000000.00000002.932431127.000000000099B000.00000004.00000020.sdmp	String found in binary or memory: http://forum.ucoz.com/)
Source: njw.exe, 00000000.00000002.936889233.000000000B821000.00000004.00000001.sdmp	String found in binary or memory: http://forum.ucoz.com/r4r
Source: njw.exe, 00000000.00000002.932537112.0000000000A0D000.00000004.00000020.sdmp, njw.exe, 00000000.00000002.935452329.0000000006ADC000.00000004.00000001.sdmp	String found in binary or memory: http://google.com/search
Source: njw.exe, 00000000.00000002.935398970.0000000006AB2000.00000004.00000001.sdmp	String found in binary or memory: http://google.com/searchb
Source: njw.exe, 00000000.00000002.935398970.0000000006AB2000.00000004.00000001.sdmp	String found in binary or memory: http://google.com/searchr-c
Source: njw.exe	String found in binary or memory: http://madExcept.com
Source: njw.exe, 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp	String found in binary or memory: http://madExcept.comU
Source: njw.exe, 00000000.00000002.932537112.0000000000A0D000.00000004.00000020.sdmp, njw.exe, 00000000.00000002.932431127.000000000099B000.00000004.00000020.sdmp, njw.exe, 00000000.00000002.936889233.000000000B821000.00000004.00000001.sdmp	String found in binary or memory: http://top.ucoz.com/
Source: njw.exe, 00000000.00000002.932431127.000000000099B000.00000004.00000020.sdmp	String found in binary or memory: http://top.ucoz.com/Ita
Source: njw.exe, 00000000.00000002.932537112.0000000000A0D000.00000004.00000020.sdmp, njw.exe, 00000000.00000002.936702634.000000000B7B1000.00000004.00000001.sdmp	String found in binary or memory: http://ucoz.com
Source: njw.exe, 00000000.00000002.932537112.0000000000A0D000.00000004.00000020.sdmp	String found in binary or memory: http://ucoz.com/register/
Source: njw.exe, 00000000.00000002.935398970.0000000006AB2000.00000004.00000001.sdmp	String found in binary or memory: http://ucoz.com/register/n:
Source: njw.exe, 00000000.00000002.935398970.0000000006AB2000.00000004.00000001.sdmp	String found in binary or memory: http://ucoz.com/register/x;Z
Source: njw.exe, 00000000.00000002.932537112.0000000000A0D000.00000004.00000020.sdmp	String found in binary or memory: http://ucoz.com/register/~
Source: njw.exe, 00000000.00000002.934975035.0000000006A40000.00000004.00000001.sdmp	String found in binary or memory: http://ucoz.com/s
Source: njw.exe, 00000000.00000002.935016714.0000000006A58000.00000004.00000001.sdmp	String found in binary or memory: http://ucoz.com:
Source: njw.exe, 00000000.00000002.935016714.0000000006A58000.00000004.00000001.sdmp	String found in binary or memory: http://ucoz.comN
Source: njw.exe, 00000000.00000002.934808825.00000000067D8000.00000004.00000001.sdmp	String found in binary or memory: http://w3.o
Source: njw.exe, 00000000.00000002.935398970.0000000006AB2000.00000004.00000001.sdmp	String found in binary or memory: http://www.all-bearings.
Source: njw.exe, 00000000.00000002.935353424.0000000006AA7000.00000004.00000001.sdmp	String found in binary or memory: http://www.all-bearings.d
Source: njw.exe, 00000000.00000002.935398970.0000000006AB2000.00000004.00000001.sdmp	String found in binary or memory: http://www.all-bearings.naro:
Source: njw.exe, 00000000.00000002.935398970.0000000006AB2000.00000004.00000001.sdmp	String found in binary or memory: http://www.all-bearings.narod
Source: njw.exe, 00000000.00000002.935398970.0000000006AB2000.00000004.00000001.sdmp	String found in binary or memory: http://www.all-bearings.narod.r
Source: njw.exe	String found in binary or memory: http://www.all-bearings.narod.ru
Source: njw.exe, 00000000.00000002.935452329.0000000006ADC000.00000004.00000001.sdmp, njw.exe, 00000000.00000002.934046409.0000000004004000.00000004.00000001.sdmp	String found in binary or memory: http://www.all-bearings.narod.ru/
Source: njw.exe, 00000000.00000002.936702634.000000000B7B1000.00000004.00000001.sdmp	String found in binary or memory: http://www.all-bearings.narod.ru/$
Source: njw.exe, 00000000.00000003.754245026.0000000006B19000.00000004.00000001.sdmp	String found in binary or memory: http://www.all-bearings.narod.ru/.s/img/err/404-arrow.png
Source: njw.exe, 00000000.00000002.932537112.0000000000A0D000.00000004.00000020.sdmp	String found in binary or memory: http://www.all-bearings.narod.ru/.s/img/err/404-arrow.png$yE
Source: njw.exe, 00000000.00000002.932537112.0000000000A0D000.00000004.00000020.sdmp	String found in binary or memory: http://www.all-bearings.narod.ru/.s/img/err/404-arrow.png4yU
Source: njw.exe, 00000000.00000002.932537112.0000000000A0D000.00000004.00000020.sdmp	String found in binary or memory: http://www.all-bearings.narod.ru/.s/img/err/404-arrow.pngDye
Source: njw.exe, 00000000.00000002.932537112.0000000000A0D000.00000004.00000020.sdmp	String found in binary or memory: http://www.all-bearings.narod.ru/.s/img/err/404-arrow.pngDze
Source: njw.exe, 00000000.00000002.932537112.0000000000A0D000.00000004.00000020.sdmp	String found in binary or memory: http://www.all-bearings.narod.ru/.s/img/err/404-arrow.pngTDu
Source: njw.exe, 00000000.00000002.932537112.0000000000A0D000.00000004.00000020.sdmp	String found in binary or memory: http://www.all-bearings.narod.ru/.s/img/err/404-arrow.pngg
Source: njw.exe, 00000000.00000002.936702634.000000000B7B1000.00000004.00000001.sdmp	String found in binary or memory: http://www.all-bearings.narod.ru/.s/img/err/404-arrow.pngu
Source: njw.exe, 00000000.00000003.754055959.000000000B75B000.00000004.00000001.sdmp	String found in binary or memory: http://www.all-bearings.narod.ru/.s/img/err/404-arrow.pngx
Source: njw.exe, 00000000.00000002.932325468.0000000000948000.00000004.00000020.sdmp	String found in binary or memory: http://www.all-bearings.narod.ru/.s/img/err/404-arrow.pngz
Source: njw.exe, 00000000.00000003.754055959.000000000B75B000.00000004.00000001.sdmp	String found in binary or memory: http://www.all-bearings.narod.ru/.s/img/err/404-header-line.gif
Source: njw.exe, 00000000.00000002.932537112.0000000000A0D000.00000004.00000020.sdmp, njw.exe, 00000000.00000002.936684119.000000000B79C000.00000004.00000001.sdmp	String found in binary or memory: http://www.all-bearings.narod.ru/.s/img/err/404-header-line.gif...
Source: njw.exe, 00000000.00000002.935398970.0000000006AB2000.00000004.00000001.sdmp	String found in binary or memory: http://www.all-bearings.narod.ru/.s/img/err/404-header-line.gif.dll
Source: njw.exe, 00000000.00000002.935452329.0000000006ADC000.00000004.00000001.sdmp	String found in binary or memory: http://www.all-bearings.narod.ru/.s/img/err/404-header-line.gifQ
Source: njw.exe, 00000000.00000002.935452329.0000000006ADC000.00000004.00000001.sdmp	String found in binary or memory: http://www.all-bearings.narod.ru/.s/img/err/404-header-line.gifT
Source: njw.exe, 00000000.00000002.935452329.0000000006ADC000.00000004.00000001.sdmp	String found in binary or memory: http://www.all-bearings.narod.ru/.s/img/err/404-header-line.gifW
Source: njw.exe, 00000000.00000003.754332572.000000000B7CE000.00000004.00000001.sdmp	String found in binary or memory: http://www.all-bearings.narod.ru/.s/img/err/404-header-line.gifY
Source: njw.exe, 00000000.00000002.935452329.0000000006ADC000.00000004.00000001.sdmp	String found in binary or memory: http://www.all-bearings.narod.ru/.s/img/err/404-header-line.gifg
Source: njw.exe, 00000000.00000003.754055959.000000000B75B000.00000004.00000001.sdmp, njw.exe, 00000000.00000002.932537112.0000000000A0D000.00000004.00000020.sdmp	String found in binary or memory: http://www.all-bearings.narod.ru/.s/img/err/404-logo.png
Source: njw.exe, 00000000.00000002.932537112.0000000000A0D000.00000004.00000020.sdmp	String found in binary or memory: http://www.all-bearings.narod.ru/.s/img/err/404-logo.png$zE
Source: njw.exe, 00000000.00000002.932537112.0000000000A0D000.00000004.00000020.sdmp	String found in binary or memory: http://www.all-bearings.narod.ru/.s/img/err/404-logo.png4
Source: njw.exe, 00000000.00000002.932537112.0000000000A0D000.00000004.00000020.sdmp	String found in binary or memory: http://www.all-bearings.narod.ru/.s/img/err/404-logo.png4DU
Source: njw.exe, 00000000.00000002.932537112.0000000000A0D000.00000004.00000020.sdmp	String found in binary or memory: http://www.all-bearings.narod.ru/.s/img/err/404-logo.pngD
Source: njw.exe, 00000000.00000002.932537112.0000000000A0D000.00000004.00000020.sdmp	String found in binary or memory: http://www.all-bearings.narod.ru/.s/img/err/404-logo.pngTzu
Source: njw.exe, 00000000.00000002.932537112.0000000000A0D000.00000004.00000020.sdmp	String found in binary or memory: http://www.all-bearings.narod.ru/.s/img/err/404-logo.pngd
Source: njw.exe, 00000000.00000002.932537112.0000000000A0D000.00000004.00000020.sdmp	String found in binary or memory: http://www.all-bearings.narod.ru/.s/img/err/404-logo.pngdD
Source: njw.exe, 00000000.00000002.935452329.0000000006ADC000.00000004.00000001.sdmp	String found in binary or memory: http://www.all-bearings.narod.ru/.s/img/err/404-logo.pngt
Source: njw.exe, 00000000.00000003.754088792.000000000B79C000.00000004.00000001.sdmp, njw.exe, 00000000.00000002.935383674.0000000006AAD000.00000004.00000001.sdmp	String found in binary or memory: http://www.all-bearings.narod.ru/.s/img/err/404.png
Source: njw.exe, 00000000.00000002.935353424.0000000006AA7000.00000004.00000001.sdmp	String found in binary or memory: http://www.all-bearings.narod.ru/.s/img/err/404.png07
Source: njw.exe, 00000000.00000003.754088792.000000000B79C000.00000004.00000001.sdmp	String found in binary or memory: http://www.all-bearings.narod.ru/.s/img/err/404.png?X
Source: njw.exe, 00000000.00000002.935353424.0000000006AA7000.00000004.00000001.sdmp	String found in binary or memory: http://www.all-bearings.narod.ru/.s/img/err/404.pngB7
Source: njw.exe, 00000000.00000002.934975035.0000000006A40000.00000004.00000001.sdmp	String found in binary or memory: http://www.all-bearings.narod.ru/.s/img/err/404.pngg/
Source: njw.exe, 00000000.00000002.935353424.0000000006AA7000.00000004.00000001.sdmp	String found in binary or memory: http://www.all-bearings.narod.ru/.s/img/err/404.pngv6
Source: njw.exe, 00000000.00000003.754332572.000000000B7CE000.00000004.00000001.sdmp, njw.exe, 00000000.00000002.935452329.0000000006ADC000.00000004.00000001.sdmp	String found in binary or memory: http://www.all-bearings.narod.ru/.s/img/err/button.png
Source: njw.exe, 00000000.00000003.754316994.000000000B7B1000.00000004.00000001.sdmp	String found in binary or memory: http://www.all-bearings.narod.ru/.s/img/err/button.png&
Source: njw.exe, 00000000.00000002.934975035.0000000006A40000.00000004.00000001.sdmp	String found in binary or memory: http://www.all-bearings.narod.ru/.s/img/err/button.png-c
Source: njw.exe, 00000000.00000003.754037157.000000000B828000.00000004.00000001.sdmp	String found in binary or memory: http://www.all-bearings.narod.ru/.s/img/err/button.png...
Source: njw.exe, 00000000.00000002.935383674.0000000006AAD000.00000004.00000001.sdmp	String found in binary or memory: http://www.all-bearings.narod.ru/.s/img/err/button.png5?
Source: njw.exe, 00000000.00000002.935383674.0000000006AAD000.00000004.00000001.sdmp	String found in binary or memory: http://www.all-bearings.narod.ru/.s/img/err/button.pngT8T
Source: njw.exe, 00000000.00000003.754332572.000000000B7CE000.00000004.00000001.sdmp	String found in binary or memory: http://www.all-bearings.narod.ru/.s/img/err/button.pngX
Source: njw.exe, 00000000.00000002.932537112.0000000000A0D000.00000004.00000020.sdmp	String found in binary or memory: http://www.all-bearings.narod.ru/.s/img/err/button.pnges
Source: njw.exe, 00000000.00000002.935452329.0000000006ADC000.00000004.00000001.sdmp	String found in binary or memory: http://www.all-bearings.narod.ru/.s/img/err/button.pngf
Source: njw.exe, 00000000.00000002.935383674.0000000006AAD000.00000004.00000001.sdmp	String found in binary or memory: http://www.all-bearings.narod.ru/.s/img/err/button.pngg8g
Source: njw.exe, 00000000.00000003.754519394.000000000B7CE000.00000004.00000001.sdmp	String found in binary or memory: http://www.all-bearings.narod.ru/.s/img/err/button.pngj
Source: njw.exe, 00000000.00000002.932537112.0000000000A0D000.00000004.00000020.sdmp	String found in binary or memory: http://www.all-bearings.narod.ru/.s/img/err/button.pngt
Source: njw.exe, 00000000.00000002.935398970.0000000006AB2000.00000004.00000001.sdmp	String found in binary or memory: http://www.all-bearings.narod.ru/B
Source: njw.exe, 00000000.00000002.935452329.0000000006ADC000.00000004.00000001.sdmp	String found in binary or memory: http://www.all-bearings.narod.ru/F
Source: njw.exe, 00000000.00000002.935655115.0000000006B19000.00000004.00000001.sdmp	String found in binary or memory: http://www.all-bearings.narod.ru/firstpage.html
Source: njw.exe, 00000000.00000002.932520416.00000000009F9000.00000004.00000020.sdmp	String found in binary or memory: http://www.all-bearings.narod.ru/firstpage.html-bearings.narod.ru/firstpage.html...
Source: njw.exe, 00000000.00000002.932520416.00000000009F9000.00000004.00000020.sdmp	String found in binary or memory: http://www.all-bearings.narod.ru/firstpage.html...
Source: njw.exe, 00000000.00000002.932431127.000000000099B000.00000004.00000020.sdmp	String found in binary or memory: http://www.all-bearings.narod.ru/firstpage.html/
Source: njw.exe, 00000000.00000002.936702634.000000000B7B1000.00000004.00000001.sdmp	String found in binary or memory: http://www.all-bearings.narod.ru/firstpage.html1
Source: njw.exe, 00000000.00000003.754245026.0000000006B19000.00000004.00000001.sdmp	String found in binary or memory: http://www.all-bearings.narod.ru/firstpage.html2
Source: njw.exe, 00000000.00000002.940327666.000000000DF70000.00000004.00000010.sdmp	String found in binary or memory: http://www.all-bearings.narod.ru/firstpage.html4E
Source: njw.exe, 00000000.00000002.932431127.000000000099B000.00000004.00000020.sdmp	String found in binary or memory: http://www.all-bearings.narod.ru/firstpage.html7
Source: njw.exe, 00000000.00000002.936631044.000000000B76B000.00000004.00000001.sdmp	String found in binary or memory: http://www.all-bearings.narod.ru/firstpage.htmlGix
Source: njw.exe, 00000000.00000002.932537112.0000000000A0D000.00000004.00000020.sdmp	String found in binary or memory: http://www.all-bearings.narod.ru/firstpage.htmlHIe
Source: njw.exe, 00000000.00000002.932431127.000000000099B000.00000004.00000020.sdmp	String found in binary or memory: http://www.all-bearings.narod.ru/firstpage.htmlI
Source: njw.exe, 00000000.00000002.932431127.000000000099B000.00000004.00000020.sdmp	String found in binary or memory: http://www.all-bearings.narod.ru/firstpage.htmlO
Source: njw.exe, 00000000.00000002.934975035.0000000006A40000.00000004.00000001.sdmp	String found in binary or memory: http://www.all-bearings.narod.ru/firstpage.htmlQ
Source: njw.exe, 00000000.00000003.754245026.0000000006B19000.00000004.00000001.sdmp	String found in binary or memory: http://www.all-bearings.narod.ru/firstpage.htmlU:
Source: njw.exe, 00000000.00000003.754245026.0000000006B19000.00000004.00000001.sdmp	String found in binary or memory: http://www.all-bearings.narod.ru/firstpage.htmlWK
Source: njw.exe, 00000000.00000003.754316994.000000000B7B1000.00000004.00000001.sdmp	String found in binary or memory: http://www.all-bearings.narod.ru/firstpage.htmleople
Source: njw.exe, 00000000.00000002.932431127.000000000099B000.00000004.00000020.sdmp	String found in binary or memory: http://www.all-bearings.narod.ru/firstpage.htmlg
Source: njw.exe, 00000000.00000002.936034770.000000000A077000.00000004.00000001.sdmp	String found in binary or memory: http://www.all-bearings.narod.ru/firstpage.htmlhttp://www.all-bearings.narod.ru/firstpage.html
Source: njw.exe, 00000000.00000002.935398970.0000000006AB2000.00000004.00000001.sdmp	String found in binary or memory: http://www.all-bearings.narod.ru/firstpage.htmlk
Source: njw.exe, 00000000.00000003.754037157.000000000B828000.00000004.00000001.sdmp	String found in binary or memory: http://www.all-bearings.narod.ru/firstpage.htmlk4y
Source: njw.exe, 00000000.00000002.932431127.000000000099B000.00000004.00000020.sdmp	String found in binary or memory: http://www.all-bearings.narod.ru/firstpage.htmly
Source: njw.exe, 00000000.00000002.935452329.0000000006ADC000.00000004.00000001.sdmp	String found in binary or memory: http://www.all-bearings.narod.ru/n
Source: njw.exe, 00000000.00000002.935398970.0000000006AB2000.00000004.00000001.sdmp	String found in binary or memory: http://www.all-bearings.narod.ru/secondp
Source: njw.exe, 00000000.00000002.932431127.000000000099B000.00000004.00000020.sdmp, njw.exe, 00000000.00000002.940355610.000000000DF90000.00000004.00000010.sdmp, njw.exe, 00000000.00000002.935655115.0000000006B19000.00000004.00000001.sdmp	String found in binary or memory: http://www.all-bearings.narod.ru/secondpage.html
Source: njw.exe, 00000000.00000003.754245026.0000000006B19000.00000004.00000001.sdmp	String found in binary or memory: http://www.all-bearings.narod.ru/secondpage.html(
Source: njw.exe, 00000000.00000002.937283236.000000000BAF0000.00000004.00000001.sdmp	String found in binary or memory: http://www.all-bearings.narod.ru/secondpage.html-Aloud
Source: njw.exe, 00000000.00000002.932520416.00000000009F9000.00000004.00000020.sdmp	String found in binary or memory: http://www.all-bearings.narod.ru/secondpage.html...
Source: njw.exe, 00000000.00000002.932431127.000000000099B000.00000004.00000020.sdmp	String found in binary or memory: http://www.all-bearings.narod.ru/secondpage.html3
Source: njw.exe, 00000000.00000003.754088792.000000000B79C000.00000004.00000001.sdmp	String found in binary or memory: http://www.all-bearings.narod.ru/secondpage.html6
Source: njw.exe, 00000000.00000002.935398970.0000000006AB2000.00000004.00000001.sdmp	String found in binary or memory: http://www.all-bearings.narod.ru/secondpage.htmlF
Source: njw.exe, 00000000.00000002.932431127.000000000099B000.00000004.00000020.sdmp	String found in binary or memory: http://www.all-bearings.narod.ru/secondpage.htmlK
Source: njw.exe, 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp	String found in binary or memory: http://www.all-bearings.narod.ru/secondpage.htmlU
Source: njw.exe, 00000000.00000002.936631044.000000000B76B000.00000004.00000001.sdmp	String found in binary or memory: http://www.all-bearings.narod.ru/secondpage.htmlX
Source: njw.exe, 00000000.00000002.932431127.000000000099B000.00000004.00000020.sdmp	String found in binary or memory: http://www.all-bearings.narod.ru/secondpage.htmlY
Source: njw.exe, 00000000.00000002.932431127.000000000099B000.00000004.00000020.sdmp	String found in binary or memory: http://www.all-bearings.narod.ru/secondpage.htmletCookies
Source: njw.exe, 00000000.00000002.936631044.000000000B76B000.00000004.00000001.sdmp	String found in binary or memory: http://www.all-bearings.narod.ru/secondpage.htmlh
Source: njw.exe, 00000000.00000002.936009031.000000000A063000.00000004.00000001.sdmp	String found in binary or memory: http://www.all-bearings.narod.ru/secondpage.htmlhttp://www.all-bearings.narod.ru/secondpage.html
Source: njw.exe, 00000000.00000002.932431127.000000000099B000.00000004.00000020.sdmp	String found in binary or memory: http://www.all-bearings.narod.ru/secondpage.htmllU
Source: njw.exe, 00000000.00000002.932431127.000000000099B000.00000004.00000020.sdmp	String found in binary or memory: http://www.all-bearings.narod.ru/secondpage.htmllq
Source: njw.exe, 00000000.00000002.932520416.00000000009F9000.00000004.00000020.sdmp	String found in binary or memory: http://www.all-bearings.narod.ru/secondpage.htmlndpage.html...rstpage.html
Source: njw.exe, 00000000.00000002.932312200.0000000000940000.00000004.00000020.sdmp	String found in binary or memory: http://www.all-bearings.narod.ru/secondpage.htmlng.pnge.gifE5
Source: njw.exe, 00000000.00000002.932520416.00000000009F9000.00000004.00000020.sdmp	String found in binary or memory: http://www.all-bearings.narod.ru/secondpage.htmlngs.narod.ru/secondpage.html
Source: njw.exe, 00000000.00000002.932431127.000000000099B000.00000004.00000020.sdmp	String found in binary or memory: http://www.all-bearings.narod.ru/secondpage.htmls
Source: njw.exe, 00000000.00000002.932431127.000000000099B000.00000004.00000020.sdmp	String found in binary or memory: http://www.all-bearings.narod.ru/secondpage.htmlsk
Source: njw.exe, 00000000.00000003.754055959.000000000B75B000.00000004.00000001.sdmp	String found in binary or memory: http://www.all-bearings.narod.ru/secondpage.htmlu6
Source: njw.exe, 00000000.00000002.936702634.000000000B7B1000.00000004.00000001.sdmp	String found in binary or memory: http://www.all-bearings.narod.ru/sl
Source: njw.exe, njw.exe, 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp	String found in binary or memory: http://www.all-bearings.narod.ru/webhelp.html
Source: njw.exe, 00000000.00000002.940327666.000000000DF70000.00000004.00000010.sdmp	String found in binary or memory: http://www.all-bearings.narod.ruL
Source: njw.exe, 00000000.00000002.935398970.0000000006AB2000.00000004.00000001.sdmp	String found in binary or memory: http://www.all-bearings.narod.ruc
Source: njw.exe, 00000000.00000002.934975035.0000000006A40000.00000004.00000001.sdmp	String found in binary or memory: http://www.all-bearings.narod.rud
Source: njw.exe, 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp	String found in binary or memory: http://www.all-bearings.narod.ruopenS
Source: njw.exe, 00000000.00000003.751994283.00000000067C9000.00000004.00000001.sdmp, njw.exe, 00000000.00000003.753243308.000000000680B000.00000004.00000001.sdmp, ga[1].js.0.dr	String found in binary or memory: http://www.google-analytics.com
Source: njw.exe, 00000000.00000002.935398970.0000000006AB2000.00000004.00000001.sdmp	String found in binary or memory: http://www.google-analytics.com/
Source: njw.exe, 00000000.00000002.935398970.0000000006AB2000.00000004.00000001.sdmp	String found in binary or memory: http://www.google-analytics.com/32
Source: njw.exe, 00000000.00000002.935315308.0000000006A9C000.00000004.00000001.sdmp	String found in binary or memory: http://www.google-analytics.com/7
Source: njw.exe, 00000000.00000003.754245026.0000000006B19000.00000004.00000001.sdmp	String found in binary or memory: http://www.google-analytics.com/__utm.gif?utmwv=5.7.2&utms=2&utmn=1625169737&utmhn=www.all-bearings.
Source: njw.exe, 00000000.00000003.754245026.0000000006B19000.00000004.00000001.sdmp	String found in binary or memory: http://www.google-analytics.com/ga.js
Source: njw.exe, 00000000.00000003.754316994.000000000B7B1000.00000004.00000001.sdmp	String found in binary or memory: http://www.google-analytics.com/ga.js)
Source: njw.exe, 00000000.00000002.932431127.000000000099B000.00000004.00000020.sdmp	String found in binary or memory: http://www.google-analytics.com/ga.js-1002c
Source: njw.exe, 00000000.00000003.754332572.000000000B7CE000.00000004.00000001.sdmp	String found in binary or memory: http://www.google-analytics.com/ga.js021
Source: njw.exe, 00000000.00000002.936009031.000000000A063000.00000004.00000001.sdmp	String found in binary or memory: http://www.google-analytics.com/ga.jsV
Source: njw.exe, 00000000.00000002.932431127.000000000099B000.00000004.00000020.sdmp	String found in binary or memory: http://www.google-analytics.com/ga.jscrC:
Source: njw.exe, 00000000.00000002.932431127.000000000099B000.00000004.00000020.sdmp	String found in binary or memory: http://www.google-analytics.com/ga.jsitC:
Source: njw.exe, 00000000.00000003.754265887.0000000006B3A000.00000004.00000001.sdmp, njw.exe, 00000000.00000003.754055959.000000000B75B000.00000004.00000001.sdmp, njw.exe, 00000000.00000003.754332572.000000000B7CE000.00000004.00000001.sdmp	String found in binary or memory: http://www.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=1923535507&utmhn=www.all-bearing
Source: njw.exe, 00000000.00000002.936009031.000000000A063000.00000004.00000001.sdmp, njw.exe, 00000000.00000002.937344665.000000000BB25000.00000004.00000001.sdmp	String found in binary or memory: http://www.google-analytics.comwww.google-analytics.com
Source: njw.exe, 00000000.00000002.938239805.000000000D9C0000.00000004.00000040.sdmp	String found in binary or memory: http://www.macromedia.com
Source: njw.exe	String found in binary or memory: http://www.remserviss.ru
Source: njw.exe, 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp	String found in binary or memory: http://www.remserviss.ruopen
Source: njw.exe, 00000000.00000002.936854078.000000000B80E000.00000004.00000001.sdmp, njw.exe, 00000000.00000002.932537112.0000000000A0D000.00000004.00000020.sdmp	String found in binary or memory: http://www.ucoz.com/pricing/
Source: njw.exe, 00000000.00000002.935353424.0000000006AA7000.00000004.00000001.sdmp	String found in binary or memory: http://www.ucoz.com/pricing/.5
Source: njw.exe, 00000000.00000002.936854078.000000000B80E000.00000004.00000001.sdmp	String found in binary or memory: http://www.ucoz.com/pricing/Iy
Source: njw.exe, 00000000.00000002.936854078.000000000B80E000.00000004.00000001.sdmp, njw.exe, 00000000.00000002.932537112.0000000000A0D000.00000004.00000020.sdmp, njw.exe, 00000000.00000002.935353424.0000000006AA7000.00000004.00000001.sdmp	String found in binary or memory: http://www.ucoz.com/privacy/
Source: njw.exe, 00000000.00000002.936854078.000000000B80E000.00000004.00000001.sdmp	String found in binary or memory: http://www.ucoz.com/privacy/%y
Source: njw.exe, 00000000.00000002.936854078.000000000B80E000.00000004.00000001.sdmp	String found in binary or memory: http://www.ucoz.com/privacy/dyb
Source: njw.exe, 00000000.00000002.932537112.0000000000A0D000.00000004.00000020.sdmp, njw.exe, 00000000.00000002.936702634.000000000B7B1000.00000004.00000001.sdmp	String found in binary or memory: http://www.ucoz.com/terms/
Source: njw.exe, 00000000.00000002.935398970.0000000006AB2000.00000004.00000001.sdmp	String found in binary or memory: http://www.ucoz.com/terms/j
Source: njw.exe, 00000000.00000002.935398970.0000000006AB2000.00000004.00000001.sdmp	String found in binary or memory: http://www.ucoz.com/terms/s
Source: njw.exe, 00000000.00000002.932537112.0000000000A0D000.00000004.00000020.sdmp, njw.exe, 00000000.00000002.936702634.000000000B7B1000.00000004.00000001.sdmp	String found in binary or memory: http://www.ucoz.com/tour/
Source: njw.exe, 00000000.00000002.935398970.0000000006AB2000.00000004.00000001.sdmp	String found in binary or memory: http://www.ucoz.com/tour/8a
Source: njw.exe, 00000000.00000002.935398970.0000000006AB2000.00000004.00000001.sdmp	String found in binary or memory: http://www.ucoz.com/tour/px
Source: njw.exe, 00000000.00000002.936702634.000000000B7B1000.00000004.00000001.sdmp	String found in binary or memory: http://www.ucoz.com/tour/q
Source: njw.exe, 00000000.00000002.932537112.0000000000A0D000.00000004.00000020.sdmp	String found in binary or memory: https://counter.yadro.ru/
Source: njw.exe, 00000000.00000002.932537112.0000000000A0D000.00000004.00000020.sdmp	String found in binary or memory: https://counter.yadro.ru/&
Source: njw.exe, 00000000.00000003.754332572.000000000B7CE000.00000004.00000001.sdmp, njw.exe, 00000000.00000002.935516918.0000000006AF2000.00000004.00000001.sdmp	String found in binary or memory: https://counter.yadro.ru/hit;counter1?q;r;s1280
Source: njw.exe, 00000000.00000002.935452329.0000000006ADC000.00000004.00000001.sdmp	String found in binary or memory: https://counter.yadro.ru/hit;counter1?r;s1280
Source: njw.exe, 00000000.00000003.792685337.000000000F5D7000.00000004.00000001.sdmp, njw.exe, 00000000.00000003.774568164.000000000E05A000.00000004.00000010.sdmp, njw.exe, 00000000.00000002.937010137.000000000B8DE000.00000004.00000001.sdmp, njw.exe, 00000000.00000003.756432489.000000000684E000.00000004.00000001.sdmp, watch[1].js.0.dr	String found in binary or memory: https://iframe-toloka.com/
Source: njw.exe, 00000000.00000002.932520416.00000000009F9000.00000004.00000020.sdmp	String found in binary or memory: https://login.live.comt
Source: njw.exe, 00000000.00000002.935488975.0000000006AEB000.00000004.00000001.sdmp	String found in binary or memory: https://mc.y
Source: njw.exe, 00000000.00000002.936702634.000000000B7B1000.00000004.00000001.sdmp	String found in binary or memory: https://mc.y0
Source: njw.exe, 00000000.00000002.937010137.000000000B8DE000.00000004.00000001.sdmp, watch[1].js.0.dr	String found in binary or memory: https://mc.yandex.
Source: njw.exe, 00000000.00000003.782452215.000000000DF16000.00000004.00000010.sdmp	String found in binary or memory: https://mc.yandex.:
Source: njw.exe, 00000000.00000002.937010137.000000000B8DE000.00000004.00000001.sdmp, watch[1].js.0.dr	String found in binary or memory: https://mc.yandex.md/cc
Source: njw.exe, 00000000.00000003.789755108.000000000F548000.00000004.00000001.sdmp	String found in binary or memory: https://mc.yandex.md/ccPageView.
Source: njw.exe, 00000000.00000003.756432489.000000000684E000.00000004.00000001.sdmp	String found in binary or memory: https://mc.yandex.md/ccba
Source: njw.exe, 00000000.00000003.756492906.0000000006831000.00000004.00000001.sdmp	String found in binary or memory: https://mc.yandex.pK
Source: njw.exe, 00000000.00000002.937010137.000000000B8DE000.00000004.00000001.sdmp, njw.exe, 00000000.00000003.756432489.000000000684E000.00000004.00000001.sdmp, watch[1].js.0.dr	String found in binary or memory: https://s3.mds.yandex.net/internal-metrika-betas
Source: njw.exe, 00000000.00000003.790985819.000000000F57D000.00000004.00000001.sdmp	String found in binary or memory: https://s3.mds.yandex.net/internal-metrika-betasS
Source: njw.exe, 00000000.00000002.936009031.000000000A063000.00000004.00000001.sdmp, njw.exe, 00000000.00000003.751994283.00000000067C9000.00000004.00000001.sdmp, njw.exe, 00000000.00000003.753243308.000000000680B000.00000004.00000001.sdmp, njw.exe, 00000000.00000002.937440425.000000000BB68000.00000004.00000001.sdmp, ga[1].js.0.dr	String found in binary or memory: https://ssl.google-analytics.com
Source: njw.exe, 00000000.00000002.936009031.000000000A063000.00000004.00000001.sdmp, njw.exe, 00000000.00000003.751994283.00000000067C9000.00000004.00000001.sdmp, njw.exe, 00000000.00000003.753243308.000000000680B000.00000004.00000001.sdmp, ga[1].js.0.dr	String found in binary or memory: https://ssl.google-analytics.com/j/__utm.gif
Source: njw.exe, 00000000.00000002.936233347.000000000A330000.00000004.00000001.sdmp	String found in binary or memory: https://ssl.google-analytics.com/j/__utm.gifpN3
Source: njw.exe, 00000000.00000002.936009031.000000000A063000.00000004.00000001.sdmp, njw.exe, 00000000.00000003.751994283.00000000067C9000.00000004.00000001.sdmp, njw.exe, 00000000.00000003.753243308.000000000680B000.00000004.00000001.sdmp, ga[1].js.0.dr	String found in binary or memory: https://stats.g.doubleclick.net/j/collect?
Source: njw.exe, 00000000.00000002.936889233.000000000B821000.00000004.00000001.sdmp	String found in binary or memory: https://twitter.com/
Source: njw.exe, 00000000.00000002.935353424.0000000006AA7000.00000004.00000001.sdmp	String found in binary or memory: https://twitter.com/#
Source: njw.exe, 00000000.00000002.936889233.000000000B821000.00000004.00000001.sdmp	String found in binary or memory: https://twitter.com/k4y
Source: ga[1].js.0.dr	String found in binary or memory: https://www.google.%/ads/ga-audiences?
Source: njw.exe, 00000000.00000002.936009031.000000000A063000.00000004.00000001.sdmp, njw.exe, 00000000.00000003.751994283.00000000067C9000.00000004.00000001.sdmp, njw.exe, 00000000.00000003.753243308.000000000680B000.00000004.00000001.sdmp, ga[1].js.0.dr	String found in binary or memory: https://www.google.com/analytics/web/inpage/pub/inpage.js?
Source: njw.exe, 00000000.00000002.938239805.000000000D9C0000.00000004.00000040.sdmp	String found in binary or memory: https://www.macromedia.com/support/flashplayer/sys/
Source: njw.exe, 00000000.00000002.937010137.000000000B8DE000.00000004.00000001.sdmp, njw.exe, 00000000.00000003.785521786.000000000ECC0000.00000004.00000010.sdmp, njw.exe, 00000000.00000002.940327666.000000000DF70000.00000004.00000010.sdmp, njw.exe, 00000000.00000003.756492906.0000000006831000.00000004.00000001.sdmp, watch[1].js.0.dr	String found in binary or memory: https://yastatic.net/s3/gdpr/popup/v2/
Source: njw.exe, 00000000.00000003.792685337.000000000F5D7000.00000004.00000001.sdmp, njw.exe, 00000000.00000002.937010137.000000000B8DE000.00000004.00000001.sdmp, njw.exe, 00000000.00000003.756432489.000000000684E000.00000004.00000001.sdmp, watch[1].js.0.dr	String found in binary or memory: https://yastatic.net/s3/metrika
Source: njw.exe, 00000000.00000003.774568164.000000000E05A000.00000004.00000010.sdmp, njw.exe, 00000000.00000002.937010137.000000000B8DE000.00000004.00000001.sdmp, watch[1].js.0.dr	String found in binary or memory: https://ymetrica1.com/watch/3/1

Source: unknown

DNS traffic detected: queries for: www.all-bearings.narod.ru

Source: global traffic	HTTP traffic detected: GET /metrika/watch.js HTTP/1.1Accept: /Referer: http://www.all-bearings.narod.ru/secondpage.htmlAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Connection: Keep-AliveHost: mc.yandex.ru
Source: global traffic	HTTP traffic detected: GET /hit;counter1?r;s1280102432;uhttp%3A//www.all-bearings.narod.ru/secondpage.html;0.5443641556055339 HTTP/1.1Accept: /Referer: http://www.all-bearings.narod.ru/secondpage.htmlAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Connection: Keep-AliveHost: counter.yadro.ru
Source: global traffic	HTTP traffic detected: GET /metrika/watch.js HTTP/1.1Accept: /Referer: http://www.all-bearings.narod.ru/firstpage.htmlAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Connection: Keep-AliveHost: mc.yandex.ru
Source: global traffic	HTTP traffic detected: GET /hit;counter1?r;s1280102432;uhttp%3A//www.all-bearings.narod.ru/firstpage.html;0.34476715437082456 HTTP/1.1Accept: /Referer: http://www.all-bearings.narod.ru/firstpage.htmlAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Connection: Keep-AliveHost: counter.yadro.ru
Source: global traffic	HTTP traffic detected: GET /hit;counter1?q;r;s1280102432;uhttp%3A//www.all-bearings.narod.ru/firstpage.html;0.34476715437082456 HTTP/1.1Accept: /Referer: http://www.all-bearings.narod.ru/firstpage.htmlAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Connection: Keep-AliveHost: counter.yadro.ruCookie: FTID=1XV1Xy3Wb9uB1XV1Xy001EiW
Source: global traffic	HTTP traffic detected: GET /hit;counter1?q;r;s1280102432;uhttp%3A//www.all-bearings.narod.ru/secondpage.html;0.5443641556055339 HTTP/1.1Accept: /Referer: http://www.all-bearings.narod.ru/secondpage.htmlAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Connection: Keep-AliveHost: counter.yadro.ruCookie: FTID=1XV1Xy3Wb9uB1XV1Xy001Ei9
Source: global traffic	HTTP traffic detected: GET /watch/14153041?callback=_ymjsp303195921&page-url=http%3A%2F%2Fwww.all-bearings.narod.ru%2Fsecondpage.html&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3A9ezyymqkmijljhdjn%3Afp%3A1976%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A680%3Acn%3A1%3Adp%3A0%3Als%3A1156845228070%3Ahid%3A271984739%3Az%3A120%3Ai%3A202101029175118%3Aet%3A1635522678%3Ac%3A1%3Arn%3A1015963535%3Au%3A1635522678322622628%3Aw%3A148x55%3As%3A1280x1024x32%3Aifr%3A1%3Aj%3A1%3Ans%3A1635522674734%3Ads%3A0%2C0%2C0%2C0%2C0%2C0%2C%2C128%2C0%2C1973%2C1975%2C0%2C1973%3Aco%3A0%3Arqnl%3A1%3Ast%3A1635522680%3At%3AHTTP%20404%20Resource%20not%20found&t=gdpr(14)ti(3)&wmode=5 HTTP/1.1Accept: /Referer: http://www.all-bearings.narod.ru/secondpage.htmlAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: mc.yandex.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /watch/14153041?callback=_ymjsp355627947&page-url=http%3A%2F%2Fwww.all-bearings.narod.ru%2Ffirstpage.html&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3A9ezyymqkmijljhdjn%3Afp%3A1930%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A680%3Acn%3A1%3Adp%3A0%3Als%3A732524701665%3Ahid%3A87010386%3Az%3A120%3Ai%3A202101029175120%3Aet%3A1635522680%3Ac%3A1%3Arn%3A244404675%3Au%3A1635522678322622628%3Aw%3A148x47%3As%3A1280x1024x32%3Aifr%3A1%3Aj%3A1%3Ans%3A1635522674781%3Ads%3A0%2C0%2C0%2C0%2C0%2C0%2C%2C155%2C0%2C2520%2C2521%2C0%2C2520%3Aco%3A0%3Arqnl%3A1%3Ast%3A1635522681%3At%3AHTTP%20404%20Resource%20not%20found&t=gdpr(14)ti(3)&wmode=5 HTTP/1.1Accept: /Referer: http://www.all-bearings.narod.ru/firstpage.htmlAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: mc.yandex.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /metrika/advert.gif?t=ti(4) HTTP/1.1Accept: /Referer: http://www.all-bearings.narod.ru/secondpage.htmlAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: mc.yandex.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /watch/14153041/1?callback=_ymjsp303195921&page-url=http%3A%2F%2Fwww.all-bearings.narod.ru%2Fsecondpage.html&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3A9ezyymqkmijljhdjn%3Afp%3A1976%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A680%3Acn%3A1%3Adp%3A0%3Als%3A1156845228070%3Ahid%3A271984739%3Az%3A120%3Ai%3A202101029175118%3Aet%3A1635522678%3Ac%3A1%3Arn%3A1015963535%3Au%3A1635522678322622628%3Aw%3A148x55%3As%3A1280x1024x32%3Aifr%3A1%3Aj%3A1%3Ans%3A1635522674734%3Ads%3A0%2C0%2C0%2C0%2C0%2C0%2C%2C128%2C0%2C1973%2C1975%2C0%2C1973%3Aco%3A0%3Arqnl%3A1%3Ast%3A1635522680%3At%3AHTTP%20404%20Resource%20not%20found&t=gdpr%2814%29ti%283%29&wmode=5 HTTP/1.1Accept: /Referer: http://www.all-bearings.narod.ru/secondpage.htmlAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: mc.yandex.ruConnection: Keep-AliveCookie: yandexuid=847304281635522680; i=vL1T7ICVuHRXpyNPzwMzlaKjl/D94ryPalEPO4xIx2pX5AZpVtBfDP0muIercdmDCjCbNqUK2tSOHbHUPiY/6ZY1euA=; ymex=1667058680.yrts.1635522680#1667058680.yrtsi.1635522680; yabs-sid=2327043721635522680
Source: global traffic	HTTP traffic detected: GET /watch/14153041/1?callback=_ymjsp355627947&page-url=http%3A%2F%2Fwww.all-bearings.narod.ru%2Ffirstpage.html&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3A9ezyymqkmijljhdjn%3Afp%3A1930%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A680%3Acn%3A1%3Adp%3A0%3Als%3A732524701665%3Ahid%3A87010386%3Az%3A120%3Ai%3A202101029175120%3Aet%3A1635522680%3Ac%3A1%3Arn%3A244404675%3Au%3A1635522678322622628%3Aw%3A148x47%3As%3A1280x1024x32%3Aifr%3A1%3Aj%3A1%3Ans%3A1635522674781%3Ads%3A0%2C0%2C0%2C0%2C0%2C0%2C%2C155%2C0%2C2520%2C2521%2C0%2C2520%3Aco%3A0%3Arqnl%3A1%3Ast%3A1635522681%3At%3AHTTP%20404%20Resource%20not%20found&t=gdpr%2814%29ti%283%29&wmode=5 HTTP/1.1Accept: /Referer: http://www.all-bearings.narod.ru/firstpage.htmlAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: mc.yandex.ruConnection: Keep-AliveCookie: yandexuid=3723159021635522681; i=yROKAQCkQEDp/MhTCtujtSWzFSx7PgG/2QZgPGeQuaYkCYGk4Lr5g33sdF0NzFWf3pPBk9Yj1OF7cHnVzZMM+SWO+Mc=; ymex=1667058681.yrts.1635522681#1667058681.yrtsi.1635522681; yabs-sid=702787781635522681
Source: global traffic	HTTP traffic detected: GET /metrika/advert.gif?t=ti(4) HTTP/1.1Accept: /Referer: http://www.all-bearings.narod.ru/firstpage.htmlAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: mc.yandex.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /secondpage.html HTTP/1.1Accept: /Accept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: www.all-bearings.narod.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /firstpage.html HTTP/1.1Accept: /Accept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: www.all-bearings.narod.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /hit;counter1?r;s1280102432;uhttp%3A//www.all-bearings.narod.ru/firstpage.html;0.34476715437082456 HTTP/1.1Accept: /Referer: http://www.all-bearings.narod.ru/firstpage.htmlAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: counter.yadro.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /metrika/watch.js HTTP/1.1Accept: /Referer: http://www.all-bearings.narod.ru/secondpage.htmlAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: mc.yandex.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /metrika/watch.js HTTP/1.1Accept: /Referer: http://www.all-bearings.narod.ru/firstpage.htmlAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: mc.yandex.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /hit;counter1?r;s1280102432;uhttp%3A//www.all-bearings.narod.ru/secondpage.html;0.5443641556055339 HTTP/1.1Accept: /Referer: http://www.all-bearings.narod.ru/secondpage.htmlAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: counter.yadro.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /.s/img/err/button.png HTTP/1.1Accept: /Referer: http://www.all-bearings.narod.ru/secondpage.htmlAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: www.all-bearings.narod.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /.s/img/err/404-header-line.gif HTTP/1.1Accept: /Referer: http://www.all-bearings.narod.ru/secondpage.htmlAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: www.all-bearings.narod.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /.s/img/err/404-arrow.png HTTP/1.1Accept: /Referer: http://www.all-bearings.narod.ru/secondpage.htmlAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: www.all-bearings.narod.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /.s/img/err/404-logo.png HTTP/1.1Accept: /Referer: http://www.all-bearings.narod.ru/secondpage.htmlAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: www.all-bearings.narod.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /.s/img/err/404.png HTTP/1.1Accept: /Referer: http://www.all-bearings.narod.ru/secondpage.htmlAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: www.all-bearings.narod.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /.s/img/err/button.png HTTP/1.1Accept: /Referer: http://www.all-bearings.narod.ru/firstpage.htmlAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: www.all-bearings.narod.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /.s/img/err/404-header-line.gif HTTP/1.1Accept: /Referer: http://www.all-bearings.narod.ru/firstpage.htmlAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: www.all-bearings.narod.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /.s/img/err/404-logo.png HTTP/1.1Accept: /Referer: http://www.all-bearings.narod.ru/firstpage.htmlAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: www.all-bearings.narod.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /.s/img/err/404-arrow.png HTTP/1.1Accept: /Referer: http://www.all-bearings.narod.ru/firstpage.htmlAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: www.all-bearings.narod.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /.s/img/err/404.png HTTP/1.1Accept: /Referer: http://www.all-bearings.narod.ru/firstpage.htmlAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: www.all-bearings.narod.ruConnection: Keep-Alive

Source: unknown	HTTPS traffic detected: 87.250.251.119:443 -> 192.168.2.4:49791 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 87.250.251.119:443 -> 192.168.2.4:49790 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 88.212.201.198:443 -> 192.168.2.4:49792 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 88.212.201.198:443 -> 192.168.2.4:49793 version: TLS 1.2

Source: njw.exe, 00000000.00000002.932325468.0000000000948000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

Source: C:\Users\user\Desktop\njw.exe

Windows user hook set: 0 mouse low level C:\Windows\system32\dinput8.dll

Jump to behavior

Source: C:\Users\user\Desktop\njw.exe

Code function: 0_2_0042CB18 OpenClipboard,EmptyClipboard,CloseClipboard,OpenClipboard,GlobalAlloc,GlobalFix,GlobalUnWire,SetClipboardData,CloseClipboard,

0_2_0042CB18

System Summary:

PE file has nameless sections

Show sources

Source: njw.exe	Static PE information: section name:
Source: njw.exe	Static PE information: section name:
Source: njw.exe	Static PE information: section name:
Source: njw.exe	Static PE information: section name:
Source: njw.exe	Static PE information: section name:
Source: njw.exe	Static PE information: section name:
Source: njw.exe	Static PE information: section name:
Source: njw.exe	Static PE information: section name:
Source: njw.exe	Static PE information: section name:
Source: njw.exe	Static PE information: section name:
Source: njw.exe	Static PE information: section name:
Source: njw.exe	Static PE information: section name:

Source: njw.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, BYTES_REVERSED_LO, EXECUTABLE_IMAGE, DEBUG_STRIPPED, LINE_NUMS_STRIPPED, BYTES_REVERSED_HI, RELOCS_STRIPPED

Source: C:\Users\user\Desktop\njw.exe	Code function: 0_2_00410CCC	0_2_00410CCC
Source: C:\Users\user\Desktop\njw.exe	Code function: 0_2_00418068	0_2_00418068
Source: C:\Users\user\Desktop\njw.exe	Code function: 0_2_00412120	0_2_00412120
Source: C:\Users\user\Desktop\njw.exe	Code function: 0_2_00415330	0_2_00415330
Source: C:\Users\user\Desktop\njw.exe	Code function: 0_2_0043F454	0_2_0043F454
Source: C:\Users\user\Desktop\njw.exe	Code function: 0_2_00416554	0_2_00416554
Source: C:\Users\user\Desktop\njw.exe	Code function: 0_2_0069251E	0_2_0069251E
Source: C:\Users\user\Desktop\njw.exe	Code function: 0_2_004247D8	0_2_004247D8
Source: C:\Users\user\Desktop\njw.exe	Code function: 0_2_004177E8	0_2_004177E8
Source: C:\Users\user\Desktop\njw.exe	Code function: 0_2_0040D97C	0_2_0040D97C
Source: C:\Users\user\Desktop\njw.exe	Code function: 0_2_00414938	0_2_00414938
Source: C:\Users\user\Desktop\njw.exe	Code function: 0_2_00427A5C	0_2_00427A5C
Source: C:\Users\user\Desktop\njw.exe	Code function: 0_2_00690DFF	0_2_00690DFF

Source: C:\Users\user\Desktop\njw.exe	Code function: String function: 00436A94 appears 46 times
Source: C:\Users\user\Desktop\njw.exe	Code function: String function: 00404C04 appears 35 times

Source: C:\Users\user\Desktop\njw.exe	Code function: 0_2_0040B8E8 NtdllDefWindowProc_A,WaitForSingleObject,ReleaseMutex,	0_2_0040B8E8
Source: C:\Users\user\Desktop\njw.exe	Code function: 0_2_0042AC1C GetModuleHandleA,GetModuleHandleA,GetModuleHandleA,GetCurrentProcessId,GetModuleHandleA,NtQuerySystemInformation,LocalFree,LocalAlloc,LocalAlloc,NtQuerySystemInformation,GetCurrentProcessId,LocalFree,	0_2_0042AC1C
Source: C:\Users\user\Desktop\njw.exe	Code function: 0_2_0043F454 NtdllDefWindowProc_A,LoadCursorA,SetCursor,NtdllDefWindowProc_A,BeginPaint,GetClientRect,GetSysColor,GetSysColor,SelectObject,GetTextExtentPoint32A,SetTextColor,GetSysColor,SetTextColor,GetSysColor,SetBkColor,TextOutA,SelectObject,EndPaint,NtdllDefWindowProc_A,InvalidateRect,NtdllDefWindowProc_A,ShellExecuteA,NtdllDefWindowProc_A,NtdllDefWindowProc_A,GetFocus,KillTimer,InvalidateRect,GetSysColor,GetSysColor,Sleep,GetSysColor,GetSysColor,GetSysColor,GetSysColor,GetSysColor,GetClientRect,PostMessageA,GetSysColor,GetSysColor,KillTimer,GetSysColor,GetSysColor,GetSysColor,GetSysColor,GetSysColor,GetSysColor,GetSysColor,GetSysColor,NtdllDefWindowProc_A,GetWindowRect,GetWindowPlacement,SetWindowPos,GetWindowPlacement,SetWindowPos,GetWindowPlacement,SetWindowPos,GetWindowPlacement,SetWindowPos,GetWindowPlacement,SetWindowPos,GetClientRect,InvalidateRect,NtdllDefWindowProc_A,	0_2_0043F454
Source: C:\Users\user\Desktop\njw.exe	Code function: 0_2_00427A5C GetCursorPos,ScreenToClient,IsWindowEnabled,LoadCursorA,SetCursor,NtdllDefWindowProc_A,SetCapture,ReleaseCapture,GetSysColor,GetSysColor,GetSysColor,GetSysColor,GetSysColor,GetSysColor,GetSysColor,GetSysColor,GetSysColor,GetSysColor,BeginPaint,EndPaint,SetTextColor,SetTextColor,SetTextColor,SetTextColor,GetSysColorBrush,GetClientRect,GetFocus,SetFocus,KillTimer,NtdllDefWindowProc_A,NtdllDefWindowProc_A,GetWindowRect,ScreenToClient,ScreenToClient,InflateRect,InvalidateRect,InvalidateRect,InvalidateRect,InvalidateRect,GetWindowLongA,PostMessageA,GetFocus,KillTimer,NtdllDefWindowProc_A,	0_2_00427A5C
Source: C:\Users\user\Desktop\njw.exe	Code function: 0_2_00408BAC GetWindowLongA,GetWindowLongA,NtdllDefWindowProc_A,	0_2_00408BAC

Source: C:\Users\user\Desktop\njw.exe

Process Stats: CPU usage > 98%

Source: njw.exe	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: njw.exe	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: njw.exe	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: njw.exe	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: njw.exe	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: njw.exe	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: njw.exe	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: njw.exe	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: njw.exe	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: njw.exe	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: njw.exe	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: njw.exe	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: njw.exe	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: njw.exe	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: njw.exe	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: njw.exe	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: njw.exe	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: njw.exe	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: njw.exe	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: njw.exe	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: njw.exe	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: njw.exe	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: njw.exe	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: njw.exe	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: njw.exe	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: njw.exe	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST

Source: njw.exe

Static PE information: Number of sections : 12 > 10

Source: njw.exe

Static PE information: Section: ZLIB complexity 1.0021484375

Source: njw.exe

Virustotal: Detection: 11%

Source: C:\Users\user\Desktop\njw.exe

File read: C:\Users\user\Desktop\njw.exe

Jump to behavior

Source: C:\Users\user\Desktop\njw.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\njw.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8856F961-340A-11D0-A96B-00C04FD705A2}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\njw.exe

File created: C:\Users\user\Desktop\bugreport.txt

Jump to behavior

Source: C:\Users\user\Desktop\njw.exe

File created: C:\Users\user\AppData\Local\Temp\njw.madExcept

Jump to behavior

Source: classification engine

Classification label: mal60.spyw.winEXE@1/17@4/3

Source: C:\Users\user\Desktop\njw.exe

Code function: 0_2_0068ED30 GetLastError,FormatMessageA,wsprintfA,

0_2_0068ED30

Source: C:\Users\user\Desktop\njw.exe

Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Jump to behavior

Source: njw.exe

Joe Sandbox Cloud Basic: Detection: clean Score: 0

Perma Link

Source: C:\Users\user\Desktop\njw.exe	Mutant created: \Sessions\1\BaseNamedObjects\madExceptSettingsMtx$1bd0
Source: C:\Users\user\Desktop\njw.exe	Mutant created: \Sessions\1\BaseNamedObjects\madToolsMsgHandlerMutex$1bd4$40ba70

Source: C:\Users\user\Desktop\njw.exe

Code function: 0_2_0042E204 FindResourceA,

0_2_0042E204

Source: Yara match	File source: 0.2.njw.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\njw.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\Desktop\njw.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: C:\Users\user\Desktop\njw.exe

Window found: window name: TEdit

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: njw.exe

Static file information: File size 1694802 > 1048576

Source: C:\Users\user\Desktop\njw.exe	Code function: 0_2_00446FC4 push ecx; mov dword ptr [esp], edx	0_2_00446FC5
Source: C:\Users\user\Desktop\njw.exe	Code function: 0_2_00407128 push 00407154h; ret	0_2_0040714C
Source: C:\Users\user\Desktop\njw.exe	Code function: 0_2_0040B13C push 0040B168h; ret	0_2_0040B160
Source: C:\Users\user\Desktop\njw.exe	Code function: 0_2_00408184 push 004081B0h; ret	0_2_004081A8
Source: C:\Users\user\Desktop\njw.exe	Code function: 0_2_0042A240 push 0042A26Ch; ret	0_2_0042A264
Source: C:\Users\user\Desktop\njw.exe	Code function: 0_2_0040926C push 00409298h; ret	0_2_00409290
Source: C:\Users\user\Desktop\njw.exe	Code function: 0_2_00408348 push 00408374h; ret	0_2_0040836C
Source: C:\Users\user\Desktop\njw.exe	Code function: 0_2_00408310 push 0040833Ch; ret	0_2_00408334
Source: C:\Users\user\Desktop\njw.exe	Code function: 0_2_0041331C push 00413348h; ret	0_2_00413340
Source: C:\Users\user\Desktop\njw.exe	Code function: 0_2_0042A3D8 push 0042A404h; ret	0_2_0042A3FC
Source: C:\Users\user\Desktop\njw.exe	Code function: 0_2_00418390 push 004183BCh; ret	0_2_004183B4
Source: C:\Users\user\Desktop\njw.exe	Code function: 0_2_004583B8 push ecx; mov dword ptr [esp], edx	0_2_004583BD
Source: C:\Users\user\Desktop\njw.exe	Code function: 0_2_0042A458 push 0042A484h; ret	0_2_0042A47C
Source: C:\Users\user\Desktop\njw.exe	Code function: 0_2_0042A420 push 0042A44Ch; ret	0_2_0042A444
Source: C:\Users\user\Desktop\njw.exe	Code function: 0_2_0042A4C8 push 0042A4F4h; ret	0_2_0042A4EC
Source: C:\Users\user\Desktop\njw.exe	Code function: 0_2_0042A490 push 0042A4BCh; ret	0_2_0042A4B4
Source: C:\Users\user\Desktop\njw.exe	Code function: 0_2_0042A550 push 0042A57Ch; ret	0_2_0042A574
Source: C:\Users\user\Desktop\njw.exe	Code function: 0_2_0042A500 push 0042A52Ch; ret	0_2_0042A524
Source: C:\Users\user\Desktop\njw.exe	Code function: 0_2_004285B8 push ecx; mov dword ptr [esp], ecx	0_2_004285BD
Source: C:\Users\user\Desktop\njw.exe	Code function: 0_2_00417784 push 004177B0h; ret	0_2_004177A8
Source: C:\Users\user\Desktop\njw.exe	Code function: 0_2_0042A8E0 push 0042A90Ch; ret	0_2_0042A904
Source: C:\Users\user\Desktop\njw.exe	Code function: 0_2_004098AC push ecx; mov dword ptr [esp], edx	0_2_004098B1
Source: C:\Users\user\Desktop\njw.exe	Code function: 0_2_0041C968 push 0041C9ADh; ret	0_2_0041C9A5
Source: C:\Users\user\Desktop\njw.exe	Code function: 0_2_00423968 push 00423994h; ret	0_2_0042398C
Source: C:\Users\user\Desktop\njw.exe	Code function: 0_2_00409914 push ecx; mov dword ptr [esp], edx	0_2_00409919
Source: C:\Users\user\Desktop\njw.exe	Code function: 0_2_0041C920 push 0041C963h; ret	0_2_0041C95B
Source: C:\Users\user\Desktop\njw.exe	Code function: 0_2_0042A988 push 0042A9B4h; ret	0_2_0042A9AC
Source: C:\Users\user\Desktop\njw.exe	Code function: 0_2_0040CB58 push 0040CB85h; ret	0_2_0040CB7D
Source: C:\Users\user\Desktop\njw.exe	Code function: 0_2_0040CB00 push 0040CB53h; ret	0_2_0040CB4B
Source: C:\Users\user\Desktop\njw.exe	Code function: 0_2_00406DF4 push 00406E45h; ret	0_2_00406E3D

Source: njw.exe	Static PE information: section name:
Source: njw.exe	Static PE information: section name:
Source: njw.exe	Static PE information: section name:
Source: njw.exe	Static PE information: section name:
Source: njw.exe	Static PE information: section name:
Source: njw.exe	Static PE information: section name:
Source: njw.exe	Static PE information: section name:
Source: njw.exe	Static PE information: section name:
Source: njw.exe	Static PE information: section name:
Source: njw.exe	Static PE information: section name:
Source: njw.exe	Static PE information: section name:
Source: njw.exe	Static PE information: section name:

Source: njw.exe

Static PE information: real checksum: 0x287c15 should be: 0x1a3590

Source: initial sample

Static PE information: section name: entropy: 7.97472353809

Source: C:\Users\user\Desktop\njw.exe	Code function: 0_2_00429058 IsWindowEnabled,EnableWindow,CreateCompatibleDC,SelectObject,DeleteDC,GetWindowRect,GetClientRect,GetSystemMetrics,GetSystemMetrics,SetWindowPos,ShowWindow,IsIconic,ShowWindow,BringWindowToTop,SetForegroundWindow,SetTimer,GetKeyState,IsDialogMessage,TranslateMessage,DispatchMessageA,IsWindow,GetMessageA,VirtualFree,EnableWindow,SetActiveWindow,	0_2_00429058
Source: C:\Users\user\Desktop\njw.exe	Code function: 0_2_004234B8 GetWindowThreadProcessId,GetCurrentProcessId,IsWindowVisible,IsIconic,GetWindowRect,OffsetRect,	0_2_004234B8
Source: C:\Users\user\Desktop\njw.exe	Code function: 0_2_0042354C GetWindowThreadProcessId,GetCurrentProcessId,IsWindowVisible,IsIconic,GetWindowRect,OffsetRect,CreateRectRgnIndirect,CombineRgn,DeleteObject,	0_2_0042354C

Source: C:\Users\user\Desktop\njw.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\njw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\njw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\njw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\njw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\njw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\njw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\njw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\njw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\njw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\njw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\njw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\njw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\njw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\njw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\njw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\njw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\njw.exe

Code function: 0_2_0042AC1C GetModuleHandleA,GetModuleHandleA,GetModuleHandleA,GetCurrentProcessId,GetModuleHandleA,NtQuerySystemInformation,LocalFree,LocalAlloc,LocalAlloc,NtQuerySystemInformation,GetCurrentProcessId,LocalFree,

0_2_0042AC1C

Source: C:\Users\user\Desktop\njw.exe

Code function: 0_2_0068A2D1 GetSystemTimeAsFileTime followed by cmp: cmp dword ptr [ebp-4ch], 03h and CTI: jnc 0068A3BEh

0_2_0068A2D1

Source: C:\Users\user\Desktop\njw.exe	Memory allocated: 3F70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\njw.exe	Memory allocated: A110000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\njw.exe	Memory allocated: A2B0000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\njw.exe	Memory allocated: A2D0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\njw.exe	Evaded block: after key decision			graph_0-25519
Source: C:\Users\user\Desktop\njw.exe	Evaded block: after key decision			graph_0-26181

Source: C:\Users\user\Desktop\njw.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\njw.exe	Code function: 0_2_0068FDFC FindFirstFileA,		0_2_0068FDFC
Source: C:\Users\user\Desktop\njw.exe	Code function: 0_2_0068D8ED FindFirstFileA,GetTempPathA,DeleteFileA,FindNextFileA,		0_2_0068D8ED

Source: C:\Users\user\Desktop\njw.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: njw.exe, 00000000.00000003.738298118.00000000009A7000.00000004.00000001.sdmp	Binary or memory string: 1&0SWD\MSRRAS\MS_AGILEVPNMINIPORTROOT\CompositeBus\0000ROOT\vdrvroot\0000ROOT\spaceport\0000ACPI\PNP0B00\4&1bd7f811&0ROOT\KDNIC\0000ACPI\PNP0303\4&1bd7f811&0USB\VID_0E0F&PID_0003&MI_01\7&1ffda586&0&0001SWD\PRINTENUM\{76EAF5AF-D6EB-4F92-BEE0-755C2D4343CA}SWD\PRINTENUM\{AD489F8D-3BDF-4E8D-B3D2-2E65A589368B}PCI\VEN_8086&DEV_07A0&SUBSYS_07A015AD&REV_01\3&61aaa01&0&A8PCI\VEN_8086&DEV_07A0&SUBSYS_07A015AD&REV_01\3&61aaa01&0&A9PCI\VEN_8086&DEV_07A0&SUBSYS_07A015AD&REV_01\3&61aaa01&0&AAPCI\VEN_8086&DEV_07A0&SUBSYS_07A015AD&REV_01\3&61aaa01&0&ABPCI\VEN_8086&DEV_07A0&SUBSYS_07A015AD&REV_01\3&61aaa01&0&ACPCI\VEN_8086&DEV_07A0&SUBSYS_07A015AD&REV_01\3&61aaa01&0&ADPCI\VEN_8086&DEV_07A0&SUBSYS_07A015AD&REV_01\3&61aaa01&0&AEPCI\VEN_8086&DEV_07A0&SUBSYS_07A015AD&REV_01\3&61aaa01&0&AFPCI\VEN_8086&DEV_07A0&SUBSYS_07A015AD&REV_01\3&61aaa01&0&B0PCI\VEN_8086&DEV_07A0&SUBSYS_07A015AD&REV_01\3&61aaa01&0&B1PCI\VEN_8086&DEV_07A0&SUBSYS_07A015AD&REV_01\3&61aaa01&0&B2PCI\VEN_8086&DEV_07A0&SUBSYS_07A015AD&REV_01\3&61aaa01&0&B3PCI\VEN_8086&DEV_07A0&SUBSYS_07A015AD&REV_01\3&61aaa01&0&B4PCI\VEN_8086&DEV_07A0&SUBSYS_07A015AD&REV_01\3&61aaa01&0&B5PCI\VEN_8086&DEV_07A0&SUBSYS_07A015AD&REV_01\3&61aaa01&0&B6PCI\VEN_8086&DEV_07A0&SUBSYS_07A015AD&REV_01\3&61aaa01&0&B7PCI\VEN_15AD&DEV_07A0&SUBSYS_07A015AD&REV_01\3&61aaa01&0&B8PCI\VEN_15AD&DEV_07A0&SUBSYS_07A015AD&REV_01\3&61aaa01&0&B9PCI\VEN_15AD&DEV_07A0&SUBSYS_07A015AD&REV_01\3&61aaa01&0&BAPCI\VEN_15AD&DEV_07A0&SUBSYS_07A015AD&REV_01\3&61aaa01&0&BBPCI\VEN_15AD&DEV_07A0&SUBSYS_07A015AD&REV_01\3&61aaa01&0&BCPCI\VEN_15AD&DEV_07A0&SUBSYS_07A015AD&REV_01\3&61aaa01&0&BDPCI\VEN_15AD&DEV_07A0&SUBSYS_07A015AD&REV_01\3&61aaa01&0&BEPCI\VEN_15AD&DEV_07A0&SUBSYS_07A015AD&REV_01\3&61aaa01&0&BFPCI\VEN_15AD&DEV_07A0&SUBSYS_07A015AD&REV_01\3&61aaa01&0&C0PCI\VEN_15AD&DEV_07A0&SUBSYS_07A015AD&REV_01\3&61aaa01&0&C1PCI\VEN_15AD&DEV_07A0&SUBSYS_07A015AD&REV_01\3&61aaa01&0&C2PCI\VEN_15AD&DEV_07A0&SUBSYS_07A015AD&REV_01\3&61aaa01&0&C3PCI\VEN_15AD&DEV_07A0&SUBSYS_07A015AD&REV_01\3&61aaa01&0&C4PCI\VEN_15AD&DEV_07A0&SUBSYS_07A015AD&REV_01\3&61aaa01&0&C5PCI\VEN_15AD&DEV_07A0&SUBSYS_07A015AD&REV_01\3&61aaa01&0&C6PCI\VEN_15AD&DEV_07A0&SUBSYS_07A015AD&REV_01\3&61aaa01&0&C7ACPI\PNP0200\4&1bd7f811&0ROOT\UMBUS\0000SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000ROOT\ACPI_HAL\0000SWD\MSRRAS\MS_NDISWANBHSWD\MSRRAS\MS_NDISWANIPPCI\VEN_15AD&DEV_1977&SUBSYS_197715AD&REV_09\4&bbf9765&0&0088ACPI_HAL\PNP0C08\0HTREE\ROOT\0ROOT\BasicRender\0000SWD\MSRRAS\MS_SSTPMINIPORTSCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000PCI\VEN_15AD&DEV_0740&SUBSYS_074015AD&REV_10\3&61aaa01&0&3FSWD\PRINTENUM\{56829D9F-AB04-4336-A25A-0504A6D184EC}ACPI\FixedButton\2&daba3ff&0PCI\VEN_8086&DEV_7110&SUBSYS_197615AD&REV_08\3&61aaa01&0&38ACPI\PNP0C02\1fHID\VID_0E0F&PID_0003&MI_00\8&1230c469&0&0000PCI\VEN_15AD&DEV_0779&SUBSYS_077915AD&REV_00\4&3b50545d&0&00B8STORAGE\Volume\{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000SWD\MMDEVAPI\{0.0.1.00000000}.{fcb8848f-2374-48ab-94
Source: njw.exe, 00000000.00000003.738345129.000000000099F000.00000004.00000001.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\5&1EC51BF7&0&000000C=C
Source: njw.exe, 00000000.00000003.738345129.000000000099F000.00000004.00000001.sdmp	Binary or memory string: AS\MS_AGILEVPNMINIPORTROOT\CompositeBus\0000ROOT\vdrvroot\0000ROOT\spaceport\0000ACPI\PNP0B00\4&1bd7f811&0ROOT\KDNIC\0000ACPI\PNP0303\4&1bd7f811&0USB\VID_0E0F&PID_0003&MI_01\7&1ffda586&0&0001SWD\PRINTENUM\{76EAF5AF-D6EB-4F92-BEE0-755C2D4343CA}SWD\PRINTENUM\{AD489F8D-3BDF-4E8D-B3D2-2E65A589368B}PCI\VEN_8086&DEV_07A0&SUBSYS_07A015AD&REV_01\3&61aaa01&0&A8PCI\VEN_8086&DEV_07A0&SUBSYS_07A015AD&REV_01\3&61aaa01&0&A9PCI\VEN_8086&DEV_07A0&SUBSYS_07A015AD&REV_01\3&61aaa01&0&AAPCI\VEN_8086&DEV_07A0&SUBSYS_07A015AD&REV_01\3&61aaa01&0&ABPCI\VEN_8086&DEV_07A0&SUBSYS_07A015AD&REV_01\3&61aaa01&0&ACPCI\VEN_8086&DEV_07A0&SUBSYS_07A015AD&REV_01\3&61aaa01&0&ADPCI\VEN_8086&DEV_07A0&SUBSYS_07A015AD&REV_01\3&61aaa01&0&AEPCI\VEN_8086&DEV_07A0&SUBSYS_07A015AD&REV_01\3&61aaa01&0&AFPCI\VEN_8086&DEV_07A0&SUBSYS_07A015AD&REV_01\3&61aaa01&0&B0PCI\VEN_8086&DEV_07A0&SUBSYS_07A015AD&REV_01\3&61aaa01&0&B1PCI\VEN_8086&DEV_07A0&SUBSYS_07A015AD&REV_01\3&61aaa01&0&B2PCI\VEN_8086&DEV_07A0&SUBSYS_07A015AD&REV_01\3&61aaa01&0&B3PCI\VEN_8086&DEV_07A0&SUBSYS_07A015AD&REV_01\3&61aaa01&0&B4PCI\VEN_8086&DEV_07A0&SUBSYS_07A015AD&REV_01\3&61aaa01&0&B5PCI\VEN_8086&DEV_07A0&SUBSYS_07A015AD&REV_01\3&61aaa01&0&B6PCI\VEN_8086&DEV_07A0&SUBSYS_07A015AD&REV_01\3&61aaa01&0&B7PCI\VEN_15AD&DEV_07A0&SUBSYS_07A015AD&REV_01\3&61aaa01&0&B8PCI\VEN_15AD&DEV_07A0&SUBSYS_07A015AD&REV_01\3&61aaa01&0&B9PCI\VEN_15AD&DEV_07A0&SUBSYS_07A015AD&REV_01\3&61aaa01&0&BAPCI\VEN_15AD&DEV_07A0&SUBSYS_07A015AD&REV_01\3&61aaa01&0&BBPCI\VEN_15AD&DEV_07A0&SUBSYS_07A015AD&REV_01\3&61aaa01&0&BCPCI\VEN_15AD&DEV_07A0&SUBSYS_07A015AD&REV_01\3&61aaa01&0&BDPCI\VEN_15AD&DEV_07A0&SUBSYS_07A015AD&REV_01\3&61aaa01&0&BEPCI\VEN_15AD&DEV_07A0&SUBSYS_07A015AD&REV_01\3&61aaa01&0&BFPCI\VEN_15AD&DEV_07A0&SUBSYS_07A015AD&REV_01\3&61aaa01&0&C0PCI\VEN_15AD&DEV_07A0&SUBSYS_07A015AD&REV_01\3&61aaa01&0&C1PCI\VEN_15AD&DEV_07A0&SUBSYS_07A015AD&REV_01\3&61aaa01&0&C2PCI\VEN_15AD&DEV_07A0&SUBSYS_07A015AD&REV_01\3&61aaa01&0&C3PCI\VEN_15AD&DEV_07A0&SUBSYS_07A015AD&REV_01\3&61aaa01&0&C4PCI\VEN_15AD&DEV_07A0&SUBSYS_07A015AD&REV_01\3&61aaa01&0&C5PCI\VEN_15AD&DEV_07A0&SUBSYS_07A015AD&REV_01\3&61aaa01&0&C6PCI\VEN_15AD&DEV_07A0&SUBSYS_07A015AD&REV_01\3&61aaa01&0&C7ACPI\PNP0200\4&1bd7f811&0ROOT\UMBUS\0000SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000ROOT\ACPI_HAL\0000SWD\MSRRAS\MS_NDISWANBHSWD\MSRRAS\MS_NDISWANIPPCI\VEN_15AD&DEV_1977&SUBSYS_197715AD&REV_09\4&bbf9765&0&0088ACPI_HAL\PNP0C08\0HTREE\ROOT\0ROOT\BasicRender\0000SWD\MSRRAS\MS_SSTPMINIPORTSCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000PCI\VEN_15AD&DEV_0740&SUBSYS_074015AD&REV_10\3&61aaa01&0&3FSWD\PRINTENUM\{56829D9F-AB04-4336-A25A-0504A6D184EC}ACPI\FixedButton\2&daba3ff&0PCI\VEN_8086&DEV_7110&SUBSYS_197615AD&REV_08\3&61aaa01&0&38ACPI\PNP0C02\1fHID\VID_0E0F&PID_0003&MI_00\8&1230c469&0&0000PCI\VEN_15AD&DEV_0779&SUBSYS_077915AD&REV_00\4&3b50545d&0&00B8STORAGE\Volume\{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000SWD\MMDEVAPI\{0.0.1.00000000}.{fcb8848f-2374-48ab-9412-fa1c511f
Source: njw.exe, 00000000.00000002.932537112.0000000000A0D000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAW
Source: njw.exe, 00000000.00000003.738345129.000000000099F000.00000004.00000001.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000
Source: njw.exe, 00000000.00000002.932431127.000000000099B000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAWh
Source: njw.exe, 00000000.00000003.742405334.0000000002658000.00000004.00000001.sdmp, bugreport.txt.0.dr	Binary or memory string: - Microsoft Hyper-V Generation Counter

Source: C:\Users\user\Desktop\njw.exe

Code function: 0_2_0042BA90 VirtualProtect 00000000,00000004,00607910,00607910,00000000,00000004,00000040,00607910,00000000,00000001,00000000

0_2_0042BA90

Source: C:\Users\user\Desktop\njw.exe

0_2_0042AC1C

Source: C:\Users\user\Desktop\njw.exe	Code function: 0_2_0068EF5E SetUnhandledExceptionFilter,		0_2_0068EF5E
Source: C:\Users\user\Desktop\njw.exe	Code function: 0_2_0068F6E2 EnterCriticalSection,SetUnhandledExceptionFilter,SetUnhandledExceptionFilter,		0_2_0068F6E2

Source: C:\Users\user\Desktop\njw.exe

Code function: 0_2_0042B7EC InitializeSecurityDescriptor,SetSecurityDescriptorDacl,

0_2_0042B7EC

Source: njw.exe, 00000000.00000002.932618181.0000000000ED0000.00000002.00020000.sdmp	Binary or memory string: Program Manager
Source: njw.exe, 00000000.00000002.932618181.0000000000ED0000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: njw.exe, 00000000.00000002.932618181.0000000000ED0000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: njw.exe, 00000000.00000002.932618181.0000000000ED0000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\njw.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\njw.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\njw.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\njw.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\njw.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\njw.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\njw.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\njw.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\njw.exe	Queries volume information: C:\Windows\SysWOW64\Macromed\Flash\activex.vch VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\njw.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\njw.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\njw.exe	Code function: GetModuleFileNameA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpyn,GetThreadLocale,GetLocaleInfoA,lstrlen,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,	0_2_0040648C
Source: C:\Users\user\Desktop\njw.exe	Code function: lstrcpyn,GetThreadLocale,GetLocaleInfoA,lstrlen,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,	0_2_00406598
Source: C:\Users\user\Desktop\njw.exe	Code function: GetThreadLocale,GetLocaleInfoA,	0_2_0040AB10

Source: C:\Users\user\Desktop\njw.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\njw.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\njw.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\njw.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Jump to behavior
Source: C:\Users\user\Desktop\njw.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Jump to behavior
Source: C:\Users\user\Desktop\njw.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Jump to behavior

Source: C:\Users\user\Desktop\njw.exe

Code function: 0_2_0068A2D1 GetSystemTimeAsFileTime,SetFilePointer,ReadFile,GetSystemTimeAsFileTime,

0_2_0068A2D1

Source: C:\Users\user\Desktop\njw.exe

Code function: 0_2_0041CE14 RtlValidSecurityDescriptor,VirtualQuery,GetVersion,GetModuleHandleA,

0_2_0041CE14

Stealing of Sensitive Information:

Tries to steal Mail credentials (via file registry)

Show sources

Source: C:\Users\user\Desktop\njw.exe	Code function: EnterCriticalSection,LocalAlloc,LeaveCriticalSection, SmtpPassword	0_2_0042EB98
Source: C:\Users\user\Desktop\njw.exe	Code function: EnterCriticalSection,LocalAlloc,LeaveCriticalSection, SmtpPassword	0_2_0042EB98
Source: C:\Users\user\Desktop\njw.exe	Code function: SmtpPassword	0_2_00435178

Source: C:\Users\user\Desktop\njw.exe

Code function: 0_2_00439C00 socket,bind,htons,sendto,select,closesocket,

0_2_00439C00

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Native API1	Path Interception	Process Injection1	Masquerading1	Input Capture2	System Time Discovery11	Remote Services	Input Capture2	Exfiltration Over Other Network Medium	Encrypted Channel11	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Disable or Modify Tools1	Credentials in Registry1	Security Software Discovery11	Remote Desktop Protocol	Archive Collected Data1	Exfiltration Over Bluetooth	Ingress Tool Transfer3	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Virtualization/Sandbox Evasion1	Security Account Manager	Virtualization/Sandbox Evasion1	SMB/Windows Admin Shares	Clipboard Data1	Automated Exfiltration	Non-Application Layer Protocol3	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Process Injection1	NTDS	Process Discovery2	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol14	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Deobfuscate/Decode Files or Information1	LSA Secrets	Application Window Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Obfuscated Files or Information3	Cached Domain Credentials	Remote System Discovery1	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Software Packing2	DCSync	File and Directory Discovery1	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	System Information Discovery34	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Link
njw.exe	11%	Virustotal	Browse
njw.exe	4%	ReversingLabs
njw.exe	100%	Joe Sandbox ML

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Download
0.2.njw.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
0.0.njw.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
0.1.njw.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File

Domains

Source	Detection	Scanner	Label	Link
counter.yadro.ru	3%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://counter.yadro.ru/hit;counter1?r	1%	Virustotal		Browse
http://counter.yadro.ru/hit;counter1?r	0%	Avira URL Cloud	safe
http://www.all-bearings.narod	0%	Avira URL Cloud	safe
http://counter.yadro.ru/hit;counter1?r;s1280102432;uhttp%3A//www.all-bearings.narod.ru/secondpage.html;0.5443641556055339	0%	Avira URL Cloud	safe
https://counter.yadro.ru/	0%	Avira URL Cloud	safe
https://mc.yandex.	0%	URL Reputation	safe
https://mc.yandex.:	0%	Avira URL Cloud	safe
http://www.all-bearings.narod.ruc	0%	Avira URL Cloud	safe
http://www.all-bearings.narod.rud	0%	Avira URL Cloud	safe
https://mc.y	0%	Avira URL Cloud	safe
https://mc.y0	0%	Avira URL Cloud	safe
https://counter.yadro.ru/&	0%	Avira URL Cloud	safe
http://www.all-bearings.narod.ruopenS	0%	Avira URL Cloud	safe
https://mc.yandex.md/cc	0%	URL Reputation	safe
https://mc.yandex.pK	0%	Avira URL Cloud	safe
https://counter.yadro.ru/hit;counter1?q;r;s1280	0%	Avira URL Cloud	safe
http://w3.o	0%	Avira URL Cloud	safe
http://www.remserviss.ruopen	0%	Avira URL Cloud	safe
http://counter.yadro.ru/hit;counter1?r;s1280	0%	Avira URL Cloud	safe
https://counter.yadro.ru/hit;counter1?q;r;s1280102432;uhttp%3A//www.all-bearings.narod.ru/firstpage.html;0.34476715437082456	0%	Avira URL Cloud	safe
http://www.remserviss.ru	0%	Avira URL Cloud	safe
https://mc.yandex.md/ccPageView.	0%	Avira URL Cloud	safe
https://iframe-toloka.com/	0%	Avira URL Cloud	safe
http://www.all-bearings.d	0%	Avira URL Cloud	safe
http://counter.yadro.ru/	0%	Avira URL Cloud	safe
https://mc.yandex.md/ccba	0%	Avira URL Cloud	safe
http://www.all-bearings.	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
mc.yandex.ru	87.250.251.119	true	false		high
counter.yadro.ru	88.212.201.198	true	false	3%, Virustotal, Browse	unknown
www-google-analytics.l.google.com	142.250.203.110	true	false		high
www.all-bearings.narod.ru	193.109.247.229	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://counter.yadro.ru/hit;counter1?r;s1280102432;uhttp%3A//www.all-bearings.narod.ru/secondpage.html;0.5443641556055339	false	Avira URL Cloud: safe	unknown
http://www.all-bearings.narod.ru/.s/img/err/404-arrow.png	false		high
https://mc.yandex.ru/watch/14153041?callback=_ymjsp355627947&page-url=http%3A%2F%2Fwww.all-bearings.narod.ru%2Ffirstpage.html&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3A9ezyymqkmijljhdjn%3Afp%3A1930%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A680%3Acn%3A1%3Adp%3A0%3Als%3A732524701665%3Ahid%3A87010386%3Az%3A120%3Ai%3A202101029175120%3Aet%3A1635522680%3Ac%3A1%3Arn%3A244404675%3Au%3A1635522678322622628%3Aw%3A148x47%3As%3A1280x1024x32%3Aifr%3A1%3Aj%3A1%3Ans%3A1635522674781%3Ads%3A0%2C0%2C0%2C0%2C0%2C0%2C%2C155%2C0%2C2520%2C2521%2C0%2C2520%3Aco%3A0%3Arqnl%3A1%3Ast%3A1635522681%3At%3AHTTP%20404%20Resource%20not%20found&t=gdpr(14)ti(3)&wmode=5	false		high
http://www.all-bearings.narod.ru/.s/img/err/404-logo.png	false		high
https://mc.yandex.ru/metrika/advert.gif?t=ti(4)	false		high
http://www.all-bearings.narod.ru/.s/img/err/404.png	false		high
http://www.all-bearings.narod.ru/.s/img/err/404-header-line.gif	false		high
http://mc.yandex.ru/metrika/watch.js	false		high
http://www.all-bearings.narod.ru/.s/img/err/button.png	false		high
https://counter.yadro.ru/hit;counter1?q;r;s1280102432;uhttp%3A//www.all-bearings.narod.ru/firstpage.html;0.34476715437082456	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://counter.yadro.ru/hit;counter1?r	njw.exe, 00000000.00000002.932537112.0000000000A0D000.00000004.00000020.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://google.com/search	njw.exe, 00000000.00000002.932537112.0000000000A0D000.00000004.00000020.sdmp, njw.exe, 00000000.00000002.935452329.0000000006ADC000.00000004.00000001.sdmp	false		high
http://ucoz.com/register/x;Z	njw.exe, 00000000.00000002.935398970.0000000006AB2000.00000004.00000001.sdmp	false		high
http://www.all-bearings.narod	njw.exe, 00000000.00000002.935398970.0000000006AB2000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.all-bearings.narod.ru/secondpage.htmlngs.narod.ru/secondpage.html	njw.exe, 00000000.00000002.932520416.00000000009F9000.00000004.00000020.sdmp	false		high
https://twitter.com/#	njw.exe, 00000000.00000002.935353424.0000000006AA7000.00000004.00000001.sdmp	false		high
http://www.all-bearings.narod.ru/.s/img/err/404-header-line.gifg	njw.exe, 00000000.00000002.935452329.0000000006ADC000.00000004.00000001.sdmp	false		high
http://www.all-bearings.narod.ru/firstpage.htmly	njw.exe, 00000000.00000002.932431127.000000000099B000.00000004.00000020.sdmp	false		high
http://www.macromedia.com	njw.exe, 00000000.00000002.938239805.000000000D9C0000.00000004.00000040.sdmp	false		high
http://www.all-bearings.narod.ru/B	njw.exe, 00000000.00000002.935398970.0000000006AB2000.00000004.00000001.sdmp	false		high
http://www.ucoz.com/tour/8a	njw.exe, 00000000.00000002.935398970.0000000006AB2000.00000004.00000001.sdmp	false		high
http://www.all-bearings.narod.ru/F	njw.exe, 00000000.00000002.935452329.0000000006ADC000.00000004.00000001.sdmp	false		high
http://www.all-bearings.narod.ru/.s/img/err/404-arrow.pngDye	njw.exe, 00000000.00000002.932537112.0000000000A0D000.00000004.00000020.sdmp	false		high
http://www.all-bearings.narod.ru/secondpage.htmllU	njw.exe, 00000000.00000002.932431127.000000000099B000.00000004.00000020.sdmp	false		high
https://counter.yadro.ru/	njw.exe, 00000000.00000002.932537112.0000000000A0D000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
http://ucoz.com/register/	njw.exe, 00000000.00000002.932537112.0000000000A0D000.00000004.00000020.sdmp	false		high
http://www.all-bearings.narod.ru/secondpage.htmllq	njw.exe, 00000000.00000002.932431127.000000000099B000.00000004.00000020.sdmp	false		high
http://faq.ucoz.com/iCy	njw.exe, 00000000.00000002.936865761.000000000B811000.00000004.00000001.sdmp	false		high
http://www.all-bearings.narod.ru/.s/img/err/404-header-line.gifT	njw.exe, 00000000.00000002.935452329.0000000006ADC000.00000004.00000001.sdmp	false		high
https://mc.yandex.	njw.exe, 00000000.00000002.937010137.000000000B8DE000.00000004.00000001.sdmp, watch[1].js.0.dr	false	URL Reputation: safe	unknown
http://www.all-bearings.narod.ru/.s/img/err/button.pnges	njw.exe, 00000000.00000002.932537112.0000000000A0D000.00000004.00000020.sdmp	false		high
http://www.all-bearings.narod.ru/.s/img/err/404-header-line.gifW	njw.exe, 00000000.00000002.935452329.0000000006ADC000.00000004.00000001.sdmp	false		high
http://www.all-bearings.narod.ru/firstpage.htmlhttp://www.all-bearings.narod.ru/firstpage.html	njw.exe, 00000000.00000002.936034770.000000000A077000.00000004.00000001.sdmp	false		high
http://www.all-bearings.narod.ru/.s/img/err/404-header-line.gifY	njw.exe, 00000000.00000003.754332572.000000000B7CE000.00000004.00000001.sdmp	false		high
http://www.all-bearings.narod.ru/.s/img/err/button.png5?	njw.exe, 00000000.00000002.935383674.0000000006AAD000.00000004.00000001.sdmp	false		high
http://www.all-bearings.narod.ru/.s/img/err/404.pngg/	njw.exe, 00000000.00000002.934975035.0000000006A40000.00000004.00000001.sdmp	false		high
https://mc.yandex.:	njw.exe, 00000000.00000003.782452215.000000000DF16000.00000004.00000010.sdmp	false	Avira URL Cloud: safe	unknown
http://www.all-bearings.narod.ruc	njw.exe, 00000000.00000002.935398970.0000000006AB2000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.all-bearings.narod.ru/.s/img/err/button.png...	njw.exe, 00000000.00000003.754037157.000000000B828000.00000004.00000001.sdmp	false		high
http://www.all-bearings.narod.rud	njw.exe, 00000000.00000002.934975035.0000000006A40000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.ucoz.com/pricing/Iy	njw.exe, 00000000.00000002.936854078.000000000B80E000.00000004.00000001.sdmp	false		high
https://mc.y	njw.exe, 00000000.00000002.935488975.0000000006AEB000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.all-bearings.narod.ru/$	njw.exe, 00000000.00000002.936702634.000000000B7B1000.00000004.00000001.sdmp	false		high
https://mc.y0	njw.exe, 00000000.00000002.936702634.000000000B7B1000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.ucoz.com/terms/	njw.exe, 00000000.00000002.932537112.0000000000A0D000.00000004.00000020.sdmp, njw.exe, 00000000.00000002.936702634.000000000B7B1000.00000004.00000001.sdmp	false		high
https://s3.mds.yandex.net/internal-metrika-betasS	njw.exe, 00000000.00000003.790985819.000000000F57D000.00000004.00000001.sdmp	false		high
http://www.all-bearings.narod.ru/firstpage.htmlg	njw.exe, 00000000.00000002.932431127.000000000099B000.00000004.00000020.sdmp	false		high
http://www.all-bearings.narod.ru/.s/img/err/404-arrow.png4yU	njw.exe, 00000000.00000002.932537112.0000000000A0D000.00000004.00000020.sdmp	false		high
https://counter.yadro.ru/&	njw.exe, 00000000.00000002.932537112.0000000000A0D000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
http://www.all-bearings.narod.ru/.s/img/err/404-header-line.gifQ	njw.exe, 00000000.00000002.935452329.0000000006ADC000.00000004.00000001.sdmp	false		high
http://www.all-bearings.narod.ru/.s/img/err/button.pngX	njw.exe, 00000000.00000003.754332572.000000000B7CE000.00000004.00000001.sdmp	false		high
http://www.all-bearings.narod.ru/.s/img/err/404.pngv6	njw.exe, 00000000.00000002.935353424.0000000006AA7000.00000004.00000001.sdmp	false		high
http://www.all-bearings.narod.ru/.s/img/err/button.pngf	njw.exe, 00000000.00000002.935452329.0000000006ADC000.00000004.00000001.sdmp	false		high
http://www.all-bearings.narod.ruopenS	njw.exe, 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp	false	Avira URL Cloud: safe	unknown
https://s3.mds.yandex.net/internal-metrika-betas	njw.exe, 00000000.00000002.937010137.000000000B8DE000.00000004.00000001.sdmp, njw.exe, 00000000.00000003.756432489.000000000684E000.00000004.00000001.sdmp, watch[1].js.0.dr	false		high
http://www.all-bearings.narod.ru/firstpage.htmlk	njw.exe, 00000000.00000002.935398970.0000000006AB2000.00000004.00000001.sdmp	false		high
https://yastatic.net/s3/metrika	njw.exe, 00000000.00000003.792685337.000000000F5D7000.00000004.00000001.sdmp, njw.exe, 00000000.00000002.937010137.000000000B8DE000.00000004.00000001.sdmp, njw.exe, 00000000.00000003.756432489.000000000684E000.00000004.00000001.sdmp, watch[1].js.0.dr	false		high
http://www.ucoz.com/privacy/%y	njw.exe, 00000000.00000002.936854078.000000000B80E000.00000004.00000001.sdmp	false		high
https://mc.yandex.md/cc	njw.exe, 00000000.00000002.937010137.000000000B8DE000.00000004.00000001.sdmp, watch[1].js.0.dr	false	URL Reputation: safe	unknown
http://www.all-bearings.narod.ru/.s/img/err/button.pngj	njw.exe, 00000000.00000003.754519394.000000000B7CE000.00000004.00000001.sdmp	false		high
http://www.all-bearings.narod.ru/secondpage.html...	njw.exe, 00000000.00000002.932520416.00000000009F9000.00000004.00000020.sdmp	false		high
https://mc.yandex.pK	njw.exe, 00000000.00000003.756492906.0000000006831000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.all-bearings.narod.ru/firstpage.htmleople	njw.exe, 00000000.00000003.754316994.000000000B7B1000.00000004.00000001.sdmp	false		high
https://counter.yadro.ru/hit;counter1?q;r;s1280	njw.exe, 00000000.00000003.754332572.000000000B7CE000.00000004.00000001.sdmp, njw.exe, 00000000.00000002.935516918.0000000006AF2000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.all-bearings.narod.ru/.s/img/err/button.png-c	njw.exe, 00000000.00000002.934975035.0000000006A40000.00000004.00000001.sdmp	false		high
http://www.all-bearings.narod.ru/.s/img/err/404-arrow.png$yE	njw.exe, 00000000.00000002.932537112.0000000000A0D000.00000004.00000020.sdmp	false		high
http://www.all-bearings.narod.ru/secondpage.html-Aloud	njw.exe, 00000000.00000002.937283236.000000000BAF0000.00000004.00000001.sdmp	false		high
http://w3.o	njw.exe, 00000000.00000002.934808825.00000000067D8000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.remserviss.ruopen	njw.exe, 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.all-bearings.narod.ru/firstpage.htmlU:	njw.exe, 00000000.00000003.754245026.0000000006B19000.00000004.00000001.sdmp	false		high
http://top.ucoz.com/	njw.exe, 00000000.00000002.932537112.0000000000A0D000.00000004.00000020.sdmp, njw.exe, 00000000.00000002.932431127.000000000099B000.00000004.00000020.sdmp, njw.exe, 00000000.00000002.936889233.000000000B821000.00000004.00000001.sdmp	false		high
http://www.all-bearings.narod.ru/.s/img/err/button.pngT8T	njw.exe, 00000000.00000002.935383674.0000000006AAD000.00000004.00000001.sdmp	false		high
http://counter.yadro.ru/hit;counter1?r;s1280	njw.exe, 00000000.00000002.935239138.0000000006A8C000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.all-bearings.narod.ru/.s/img/err/404-logo.png$zE	njw.exe, 00000000.00000002.932537112.0000000000A0D000.00000004.00000020.sdmp	false		high
http://forum.ucoz.com/r4r	njw.exe, 00000000.00000002.936889233.000000000B821000.00000004.00000001.sdmp	false		high
http://ucoz.com/register/n:	njw.exe, 00000000.00000002.935398970.0000000006AB2000.00000004.00000001.sdmp	false		high
https://stats.g.doubleclick.net/j/collect?	njw.exe, 00000000.00000002.936009031.000000000A063000.00000004.00000001.sdmp, njw.exe, 00000000.00000003.751994283.00000000067C9000.00000004.00000001.sdmp, njw.exe, 00000000.00000003.753243308.000000000680B000.00000004.00000001.sdmp, ga[1].js.0.dr	false		high
http://www.all-bearings.narod.ru/firstpage.html4E	njw.exe, 00000000.00000002.940327666.000000000DF70000.00000004.00000010.sdmp	false		high
http://www.all-bearings.narod.ru	njw.exe	false		high
http://www.ucoz.com/tour/px	njw.exe, 00000000.00000002.935398970.0000000006AB2000.00000004.00000001.sdmp	false		high
http://www.remserviss.ru	njw.exe	false	Avira URL Cloud: safe	unknown
http://www.all-bearings.narod.ru/.s/img/err/button.png&	njw.exe, 00000000.00000003.754316994.000000000B7B1000.00000004.00000001.sdmp	false		high
http://www.all-bearings.narod.ru/.s/img/err/404-header-line.gif.dll	njw.exe, 00000000.00000002.935398970.0000000006AB2000.00000004.00000001.sdmp	false		high
http://www.all-bearings.narod.ru/n	njw.exe, 00000000.00000002.935452329.0000000006ADC000.00000004.00000001.sdmp	false		high
http://book.ucoz.com	njw.exe, 00000000.00000002.932431127.000000000099B000.00000004.00000020.sdmp	false		high
https://mc.yandex.md/ccPageView.	njw.exe, 00000000.00000003.789755108.000000000F548000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.all-bearings.narod.ru/.s/img/err/404-arrow.pngTDu	njw.exe, 00000000.00000002.932537112.0000000000A0D000.00000004.00000020.sdmp	false		high
https://iframe-toloka.com/	njw.exe, 00000000.00000003.792685337.000000000F5D7000.00000004.00000001.sdmp, njw.exe, 00000000.00000003.774568164.000000000E05A000.00000004.00000010.sdmp, njw.exe, 00000000.00000002.937010137.000000000B8DE000.00000004.00000001.sdmp, njw.exe, 00000000.00000003.756432489.000000000684E000.00000004.00000001.sdmp, watch[1].js.0.dr	false	Avira URL Cloud: safe	unknown
http://forum.ucoz.com/)	njw.exe, 00000000.00000002.932431127.000000000099B000.00000004.00000020.sdmp	false		high
http://www.all-bearings.d	njw.exe, 00000000.00000002.935353424.0000000006AA7000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://www.macromedia.com/support/flashplayer/sys/	njw.exe, 00000000.00000002.938239805.000000000D9C0000.00000004.00000040.sdmp	false		high
http://www.all-bearings.narod.ru/secondpage.htmls	njw.exe, 00000000.00000002.932431127.000000000099B000.00000004.00000020.sdmp	false		high
http://counter.yadro.ru/	njw.exe, 00000000.00000002.935398970.0000000006AB2000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://mc.yandex.md/ccba	njw.exe, 00000000.00000003.756432489.000000000684E000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.all-bearings.narod.ru/firstpage.html...	njw.exe, 00000000.00000002.932520416.00000000009F9000.00000004.00000020.sdmp	false		high
http://www.all-bearings.narod.ru/.s/img/err/404-logo.pngTzu	njw.exe, 00000000.00000002.932537112.0000000000A0D000.00000004.00000020.sdmp	false		high
https://twitter.com/k4y	njw.exe, 00000000.00000002.936889233.000000000B821000.00000004.00000001.sdmp	false		high
http://www.all-bearings.	njw.exe, 00000000.00000002.935398970.0000000006AB2000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.all-bearings.narod.ru/secondpage.htmlng.pnge.gifE5	njw.exe, 00000000.00000002.932312200.0000000000940000.00000004.00000020.sdmp	false		high
http://forum.ucoz.com/	njw.exe, 00000000.00000002.932537112.0000000000A0D000.00000004.00000020.sdmp, njw.exe, 00000000.00000002.932431127.000000000099B000.00000004.00000020.sdmp	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
88.212.201.198	counter.yadro.ru	Russian Federation	39134	UNITEDNETRU	false
87.250.251.119	mc.yandex.ru	Russian Federation	13238	YANDEXRU	false
193.109.247.229	www.all-bearings.narod.ru	Virgin Islands (BRITISH)	204343	COMPUBYTE-ASRU	false

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	511823
Start date:	29.10.2021
Start time:	17:49:38
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 7m 6s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	njw.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal60.spyw.winEXE@1/17@4/3
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 5% (good quality ratio 4.6%) Quality average: 68.6% Quality standard deviation: 30.2%
HCA Information:	Failed
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, backgroundTaskHost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 23.211.6.115, 204.79.197.200, 13.107.21.200, 20.82.209.183, 142.250.203.110, 20.54.110.249, 40.91.112.76, 40.112.88.60, 80.67.82.211, 80.67.82.235, 20.82.210.154 Excluded domains from analysis (whitelisted): displaycatalog-rp-uswest.md.mp.microsoft.com.akadns.net, store-images.s-microsoft.com-c.edgekey.net, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, wus2-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, a1449.dscg2.akamai.net, arc.msn.com, e12564.dspb.akamaiedge.net, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, www-bing-com.dual-a-0001.a-msedge.net, arc.trafficmanager.net, consumer-displaycatalogrp-aks2aks-uswest.md.mp.microsoft.com.akadns.net, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, www.google-analytics.com, www.bing.com, iris-de-prod-azsc-neu.northeurope.cloudapp.azure.com, dual-a-0001.a-msedge.net, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, neu-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, ris-prod.trafficmanager.net, asf-ris-prod-neu.northeurope.cloudapp.azure.com, ris.api.iris.microsoft.com, a-0001.a-afdentry.net.trafficmanager.net, store-images.s-microsoft.com, displaycatalog-rp.md.mp.microsoft.com.akadns.net Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtDeviceIoControlFile calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found. Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
17:51:14	API Interceptor	956x Sleep call for process: njw.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
88.212.201.198	bEzxgfoo6O.rtf	Get hash	malicious	Browse
	http://3ladies.su	Get hash	malicious	Browse
	https://u.to/r9nvGQ	Get hash	malicious	Browse
	http://videomytube.cf	Get hash	malicious	Browse
	https://u.to/ofqqGA	Get hash	malicious	Browse
	https://xurl.es/bz56k	Get hash	malicious	Browse
	https://u.to/MM3SFw	Get hash	malicious	Browse
	https://u.to/SBTlFg	Get hash	malicious	Browse
	https://u.to/JGK-Fg	Get hash	malicious	Browse
	https://u.to/YxOpFg&umid=a2728f18-d3ff-4aef-921f-5b5203212a15&auth=0bf7e98084f3624f56880a7a00d412c1d514f34b-95e09708099e407ce94156c8921315b6f95a718e	Get hash	malicious	Browse
87.250.251.119	http://www.cennikiexcel.ru	Get hash	malicious	Browse	mc.yandex.ru/metrika/watch.js
	http://An-Crimea.ru	Get hash	malicious	Browse	mc.yandex.ru/metrika/watch.js
	http://./Documents/2019-01	Get hash	malicious	Browse	mc.yandex.ru/metrika/watch.js

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
mc.yandex.ru	Open B024L128 .xhtml	Get hash	malicious	Browse	87.250.251.119
	uFvG6DlSUpNCq_0a0Y3vNrYQ.exe	Get hash	malicious	Browse	93.158.134.119
	MYUNG IN QUotation request.docx	Get hash	malicious	Browse	77.88.21.119
	t37BGZn2O1.msi	Get hash	malicious	Browse	87.250.250.119
	Elon Musk Site CI6501 .htm	Get hash	malicious	Browse	87.250.251.119
	Elon Musk Invite EZ2375 .htm	Get hash	malicious	Browse	77.88.21.119
	28jJSvNzXz.exe	Get hash	malicious	Browse	87.250.251.119
	Elon Musk Club - 024705 .htm	Get hash	malicious	Browse	87.250.251.119
	Bonus Bitcoin - 065540 .htm	Get hash	malicious	Browse	87.250.250.119
	DriverPack-17-Online_749652650.1631058953__eqiqpdyx4midqk9.exe	Get hash	malicious	Browse	87.250.250.119
	qB6P2WfUjb.exe	Get hash	malicious	Browse	87.250.251.119
	IDWCH2.exe	Get hash	malicious	Browse	93.158.134.119
	LJSFz5iuuf.exe	Get hash	malicious	Browse	93.158.134.119
	OPEN AO-8820 .html	Get hash	malicious	Browse	93.158.134.119
	DriverPack-17-Online_174007544.1629221836__itapkqvv6k3n1w8.exe	Get hash	malicious	Browse	87.250.250.119
	lo3H2fUlKG.exe	Get hash	malicious	Browse	87.250.251.119
	Setup.exe	Get hash	malicious	Browse	87.250.251.119
	YWBLA3LR.htm	Get hash	malicious	Browse	93.158.134.119
	J7yWiSGmFh.exe	Get hash	malicious	Browse	87.250.250.119
	GIJ0V7s4DG.doc	Get hash	malicious	Browse	77.88.21.119
counter.yadro.ru	Elon Musk Club - 024705 .htm	Get hash	malicious	Browse	88.212.201.204
	Bonus Bitcoin - 065540 .htm	Get hash	malicious	Browse	88.212.201.210
	zw0w9vn3tl.exe	Get hash	malicious	Browse	88.212.201.216
	bEzxgfoo6O.rtf	Get hash	malicious	Browse	88.212.201.198
	bEzxgfoo6O.rtf	Get hash	malicious	Browse	88.212.201.204
	iqKNGLP6PS.exe	Get hash	malicious	Browse	88.212.201.216
	Ve8rhkTls5.exe	Get hash	malicious	Browse	88.212.201.216
	dPWf8DPe5x.exe	Get hash	malicious	Browse	88.212.201.216
	http://browsermine.com	Get hash	malicious	Browse	88.212.201.210
	https://bajashpna.site/Koyo-Oil-Seal-Cross-Reference-Chart/doc	Get hash	malicious	Browse	88.212.201.216
	https://ofd.beeline.ru/check-order/oxjsoinmq	Get hash	malicious	Browse	88.212.201.210
	http://barddistocor.com/mozglue.dll	Get hash	malicious	Browse	88.212.201.210
	http://www.2926659.ru/	Get hash	malicious	Browse	88.212.201.216
	http://www.emergys.com.mx	Get hash	malicious	Browse	88.212.201.216
	https://xmastertrk.com:443	Get hash	malicious	Browse	88.212.201.204
	http://3ladies.su	Get hash	malicious	Browse	88.212.201.198
	https://loptrk.com	Get hash	malicious	Browse	88.212.201.204
	https://u.to/r9nvGQ	Get hash	malicious	Browse	88.212.201.198
	https://pdfdocdownloadspanel.site/c6092ba97dfbd305a5bbf77d7de3d86e/Assurant-Trade-In-Value-Phone/doc/capxqjxzbj	Get hash	malicious	Browse	88.212.201.216
	https://www.google.com/url?q=https://www.google.com/url?q%3Dhttps://www.google.com/url?q%253Dhttps%25253A%25252F%25252Ffree-porno.site%25252Fsestra-porno-komiks-incest%2526sa%253DD%2526sntz%253D1%2526usg%253DAFQjCNH31NWj_BM8nKT1IECA8pWwYU8jkQ%26amp;sa%3DD%26amp;ust%3D1600094899031000%26amp;usg%3DAOvVaw07fZ2B1xkNEovI70NLM1Sd&sa=D&ust=1600094899044000&usg=AFQjCNFDsSWFDQJ9fjo9ZnFaOp1n4lUx9g	Get hash	malicious	Browse	88.212.201.216

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
UNITEDNETRU	zCS6X4TGYb	Get hash	malicious	Browse	88.212.199.3
	Elon Musk Club - 024705 .htm	Get hash	malicious	Browse	88.212.201.204
	Bonus Bitcoin - 065540 .htm	Get hash	malicious	Browse	88.212.201.210
	zw0w9vn3tl.exe	Get hash	malicious	Browse	88.212.201.216
	bEzxgfoo6O.rtf	Get hash	malicious	Browse	88.212.201.198
	bEzxgfoo6O.rtf	Get hash	malicious	Browse	88.212.201.204
	iqKNGLP6PS.exe	Get hash	malicious	Browse	88.212.201.216
	http://browsermine.com	Get hash	malicious	Browse	88.212.201.210
	https://bajashpna.site/Koyo-Oil-Seal-Cross-Reference-Chart/doc	Get hash	malicious	Browse	88.212.201.216
	https://ofd.beeline.ru/check-order/oxjsoinmq	Get hash	malicious	Browse	88.212.201.210
	http://coronavir-novosti.ru	Get hash	malicious	Browse	88.212.201.210
	http://barddistocor.com/mozglue.dll	Get hash	malicious	Browse	88.212.201.210
	http://www.2926659.ru/	Get hash	malicious	Browse	88.212.201.216
	http://www.emergys.com.mx	Get hash	malicious	Browse	88.212.201.216
	https://xmastertrk.com:443	Get hash	malicious	Browse	88.212.201.204
	http://3ladies.su	Get hash	malicious	Browse	88.212.201.198
	https://loptrk.com	Get hash	malicious	Browse	88.212.201.204
	https://u.to/r9nvGQ	Get hash	malicious	Browse	88.212.201.198
	https://www.google.com/url?q=https://www.google.com/url?q%3Dhttps://www.google.com/url?q%253Dhttps%25253A%25252F%25252Ffree-porno.site%25252Fsestra-porno-komiks-incest%2526sa%253DD%2526sntz%253D1%2526usg%253DAFQjCNH31NWj_BM8nKT1IECA8pWwYU8jkQ%26amp;sa%3DD%26amp;ust%3D1600094899031000%26amp;usg%3DAOvVaw07fZ2B1xkNEovI70NLM1Sd&sa=D&ust=1600094899044000&usg=AFQjCNFDsSWFDQJ9fjo9ZnFaOp1n4lUx9g	Get hash	malicious	Browse	88.212.201.216
	http://videomytube.cf	Get hash	malicious	Browse	88.212.201.198
YANDEXRU	SecuriteInfo.com.Trojan.GenericKD.47272401.17364.exe	Get hash	malicious	Browse	77.88.21.158
	SecuriteInfo.com.Gen.Variant.Nemesis.1785.13723.exe	Get hash	malicious	Browse	77.88.21.158
	PO 407274.doc	Get hash	malicious	Browse	77.88.21.158
	PO 407274.xlsx	Get hash	malicious	Browse	77.88.21.158
	PO.08996.exe	Get hash	malicious	Browse	77.88.21.158
	New Purchase Order.exe	Get hash	malicious	Browse	77.88.21.158
	Swift USD PDF.exe	Get hash	malicious	Browse	77.88.21.158
	Open B024L128 .xhtml	Get hash	malicious	Browse	87.250.251.119
	Payment PDF.exe	Get hash	malicious	Browse	77.88.21.158
	uFvG6DlSUpNCq_0a0Y3vNrYQ.exe	Get hash	malicious	Browse	87.250.251.119
	MYUNG IN QUotation request.docx	Get hash	malicious	Browse	77.88.21.119
	kutipan langsung.14.10.2021.xlxs.exe	Get hash	malicious	Browse	77.88.21.158
	SecuriteInfo.com.Suspicious.Win32.Save.a.20932.exe	Get hash	malicious	Browse	77.88.21.158
	sora.x86	Get hash	malicious	Browse	95.108.149.15
	sora.arm	Get hash	malicious	Browse	100.43.91.162
	Petikan segera.12.10.2021.xlxs.exe	Get hash	malicious	Browse	77.88.21.158
	Purchase_Order_QBO6814_from_Salvona_Technologies.exe	Get hash	malicious	Browse	77.88.21.158
	RFQ-117404.doc	Get hash	malicious	Browse	77.88.21.158
	Petikan segera.08.10.2021.xlxs.exe	Get hash	malicious	Browse	77.88.21.158
	t37BGZn2O1.msi	Get hash	malicious	Browse	77.88.21.119

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
37f463bf4616ecd445d4a1937da06e19	jWuh2gZyOs.exe	Get hash	malicious	Browse	87.250.251.119 88.212.201.198
	SEMqjw.exe	Get hash	malicious	Browse	87.250.251.119 88.212.201.198
	New Fax Message from 120283803.html	Get hash	malicious	Browse	87.250.251.119 88.212.201.198
	fax45367876545678.exe	Get hash	malicious	Browse	87.250.251.119 88.212.201.198
	gemfs.co.uk (1).html	Get hash	malicious	Browse	87.250.251.119 88.212.201.198
	instruction.dll	Get hash	malicious	Browse	87.250.251.119 88.212.201.198
	stash-9131480.xls	Get hash	malicious	Browse	87.250.251.119 88.212.201.198
	oCN3rc0FzJ.exe	Get hash	malicious	Browse	87.250.251.119 88.212.201.198
	cjzu7hTifh.exe	Get hash	malicious	Browse	87.250.251.119 88.212.201.198
	e0PXyEbkUg.exe	Get hash	malicious	Browse	87.250.251.119 88.212.201.198
	#Ud83d#Udd0a VM 9193407174.wav.html	Get hash	malicious	Browse	87.250.251.119 88.212.201.198
	PL5m30TFgh.exe	Get hash	malicious	Browse	87.250.251.119 88.212.201.198
	Hgny9xwmj6.exe	Get hash	malicious	Browse	87.250.251.119 88.212.201.198
	Pv9fSenm0V.exe	Get hash	malicious	Browse	87.250.251.119 88.212.201.198
	stash-1675061873.xls	Get hash	malicious	Browse	87.250.251.119 88.212.201.198
	stash-1822309505.xls	Get hash	malicious	Browse	87.250.251.119 88.212.201.198
	stash-1817904387.xls	Get hash	malicious	Browse	87.250.251.119 88.212.201.198
	stash-1675061873.xls	Get hash	malicious	Browse	87.250.251.119 88.212.201.198
	Casting Invite.-06503_20211027.xlsb	Get hash	malicious	Browse	87.250.251.119 88.212.201.198
	0x000500000001abb1-152.exe	Get hash	malicious	Browse	87.250.251.119 88.212.201.198

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DOMStore\E5F0NRSV\www.all-bearings.narod[1].xml Download File
Process:	C:\Users\user\Desktop\njw.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.469670487371862
Encrypted:	false
SSDEEP:	3:D90aKb:JFKb
MD5:	C1DDEA3EF6BBEF3E7060A1A9AD89E4C5
SHA1:	35E3224FCBD3E1AF306F2B6A2C6BBEA9B0867966
SHA-256:	B71E4D17274636B97179BA2D97C742735B6510EB54F22893D3A2DAFF2CEB28DB
SHA-512:	6BE8CEC7C862AFAE5B37AA32DC5BB45912881A3276606DA41BF808A4EF92C318B355E616BF45A257B995520D72B7C08752C0BE445DCEADE5CF79F73480910FED
Malicious:	false
Reputation:	high, very likely benign file
Preview:	<root></root>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\404-arrow[1].png Download File
Process:	C:\Users\user\Desktop\njw.exe
File Type:	PNG image data, 6 x 9, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1169
Entropy (8bit):	6.375857124482774
Encrypted:	false
SSDEEP:	24:zS1he91Wwh82lYSKw7+H1V/uT3cyJ3V2r7hGQ9/9mekJ:MqQvnL8q1durJ3Gh5/Y5J
MD5:	F491D002C601CED0C0BC19994B89CDDC
SHA1:	65B26746EC3BF706DFED1CA6D81BEF6211D15FEF
SHA-256:	BA146CE6FB6E788B50E02B45B72835450B513EC744B2F8DE1DD85589B42F8F05
SHA-512:	0E96575D89DFDE823A577EAF6D4CB4EFAB56C37875B7E5955F7F9FF759B67805FF0013DEDC1C98A73616F7C55CEEBBD5222C0A1EF2F17A936CAE36425E129887
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...............].....tEXtSoftware.Adobe ImageReadyq.e<...diTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:9A714C550974E111987BC97C16A991C4" xmpMM:DocumentID="xmp.did:8F1EEDA87F2611E18D85EF20DD25A302" xmpMM:InstanceID="xmp.iid:8F1EEDA77F2611E18D85EF20DD25A302" xmp:CreatorTool="Adobe Photoshop CS4 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:92ED5C9A097FE111BC73B13FF08B8A3F" stRef:documentID="xmp.did:9A714C550974E111987BC97C16A991C4"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>...r....IDATx.b..t.r..G....g.b..f..aW8......w\........

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\404[1].png Download File
Process:	C:\Users\user\Desktop\njw.exe
File Type:	PNG image data, 155 x 66, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4451
Entropy (8bit):	7.815188084249031
Encrypted:	false
SSDEEP:	48:mqQvnL8QsrJ3GhrwUC5CY1s7P5ShGRQvQCfCWzSWAnXmeQkzkCgDoSbKVRVbGeLG:XQoL0hrYg9yXvjdSWAWeQlFCXukVaa16
MD5:	9684186972F20E829835912A9FF55F3A
SHA1:	ACA5BF4DE51319525F1DB749DC0825CA8E1C06C1
SHA-256:	389267599E2B30CDA3F0091BCDAA856C39E38543038A52955EBA5B048E915742
SHA-512:	31BBD89B9801E09EA5BFA25FDA51FFFDD765C8BEA4BD7FFC80C89750220F99AC35616BDB8146044F69E948424468C3E8691871D6AA2E5C0C27730BFC6AE8AED0
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.......B.....@P.k....tEXtSoftware.Adobe ImageReadyq.e<...diTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:9A714C550974E111987BC97C16A991C4" xmpMM:DocumentID="xmp.did:A2E971A17F2C11E19D72841B70F96071" xmpMM:InstanceID="xmp.iid:A2E971A07F2C11E19D72841B70F96071" xmp:CreatorTool="Adobe Photoshop CS4 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:92ED5C9A097FE111BC73B13FF08B8A3F" stRef:documentID="xmp.did:9A714C550974E111987BC97C16A991C4"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>N.....IDATx..].r...........f...[...<@..G.....J...V

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\ga[1].js Download File
Process:	C:\Users\user\Desktop\njw.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	46274
Entropy (8bit):	5.48786904450865
Encrypted:	false
SSDEEP:	768:aqNVrKn0VGhn+K7U1r2p/Y60fyy3/g3OMZht1z1prkfw1+9NZ5VA:RHrLVGhnpIwp/Y7cnz1RkLL5m
MD5:	E9372F0EBBCF71F851E3D321EF2A8E5A
SHA1:	2C7D19D1AF7D97085C977D1B69DCB8B84483D87C
SHA-256:	1259EA99BD76596239BFD3102C679EB0A5052578DC526B0452F4D42F8BCDD45F
SHA-512:	C3A1C74AC968FC2FA366D9C25442162773DB9AF1289ADFB165FC71E7750A7E62BD22F424F241730F3C2427AFFF8A540C214B3B97219A360A231D4875E6DDEE6F
Malicious:	false
Reputation:	high, very likely benign file
Preview:	(function(){var E;var g=window,n=document,p=function(a){var b=g._gaUserPrefs;if(b&&b.ioo&&b.ioo()\|\|a&&!0===g["ga-disable-"+a])return!0;try{var c=g.external;if(c&&c._gaUserPrefs&&"oo"==c._gaUserPrefs)return!0}catch(f){}a=[];b=n.cookie.split(";");c=/^\sAMP_TOKEN=\s(.?)\s$/;for(var d=0;d<b.length;d++){var e=b[d].match(c);e&&a.push(e[1])}for(b=0;b<a.length;b++)if("$OPT_OUT"==decodeURIComponent(a[b]))return!0;return!1};var q=function(a){return encodeURIComponent?encodeURIComponent(a).replace(/$/g,"%28").replace(/$/g,"%29"):a},r=/^(www\.)?google(\.com?)?(\.[a-z]{2})?$/,u=/(^\|\.)doubleclick\.net$/i;function Aa(a,b){switch(b){case 0:return""+a;case 1:return 1a;case 2:return!!a;case 3:return 1E3a}return a}function Ba(a){return"function"==typeof a}function Ca(a){return void 0!=a&&-1<(a.constructor+"").indexOf("String")}function F(a,b){return void 0==a\|\|"-"==a&&!b\|\|""==a}function Da(a){if(!a\|\|""==a)return"";for(;a&&-1<" \n\r\t".indexOf(a.charAt(0));)a=a.substring(1);for(;a&&-1<" \n\r\t".i

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\ga[2].js Download File
Process:	C:\Users\user\Desktop\njw.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	46274
Entropy (8bit):	5.48786904450865
Encrypted:	false
SSDEEP:	768:aqNVrKn0VGhn+K7U1r2p/Y60fyy3/g3OMZht1z1prkfw1+9NZ5VA:RHrLVGhnpIwp/Y7cnz1RkLL5m
MD5:	E9372F0EBBCF71F851E3D321EF2A8E5A
SHA1:	2C7D19D1AF7D97085C977D1B69DCB8B84483D87C
SHA-256:	1259EA99BD76596239BFD3102C679EB0A5052578DC526B0452F4D42F8BCDD45F
SHA-512:	C3A1C74AC968FC2FA366D9C25442162773DB9AF1289ADFB165FC71E7750A7E62BD22F424F241730F3C2427AFFF8A540C214B3B97219A360A231D4875E6DDEE6F
Malicious:	false
Reputation:	high, very likely benign file
Preview:	(function(){var E;var g=window,n=document,p=function(a){var b=g._gaUserPrefs;if(b&&b.ioo&&b.ioo()\|\|a&&!0===g["ga-disable-"+a])return!0;try{var c=g.external;if(c&&c._gaUserPrefs&&"oo"==c._gaUserPrefs)return!0}catch(f){}a=[];b=n.cookie.split(";");c=/^\sAMP_TOKEN=\s(.?)\s$/;for(var d=0;d<b.length;d++){var e=b[d].match(c);e&&a.push(e[1])}for(b=0;b<a.length;b++)if("$OPT_OUT"==decodeURIComponent(a[b]))return!0;return!1};var q=function(a){return encodeURIComponent?encodeURIComponent(a).replace(/$/g,"%28").replace(/$/g,"%29"):a},r=/^(www\.)?google(\.com?)?(\.[a-z]{2})?$/,u=/(^\|\.)doubleclick\.net$/i;function Aa(a,b){switch(b){case 0:return""+a;case 1:return 1a;case 2:return!!a;case 3:return 1E3a}return a}function Ba(a){return"function"==typeof a}function Ca(a){return void 0!=a&&-1<(a.constructor+"").indexOf("String")}function F(a,b){return void 0==a\|\|"-"==a&&!b\|\|""==a}function Da(a){if(!a\|\|""==a)return"";for(;a&&-1<" \n\r\t".indexOf(a.charAt(0));)a=a.substring(1);for(;a&&-1<" \n\r\t".i

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\advert[1].gif Download File
Process:	C:\Users\user\Desktop\njw.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	43
Entropy (8bit):	2.7374910194847146
Encrypted:	false
SSDEEP:	3:CU9yltxlHh/:m/
MD5:	DF3E567D6F16D040326C7A0EA29A4F41
SHA1:	EA7DF583983133B62712B5E73BFFBCD45CC53736
SHA-256:	548F2D6F4D0D820C6C5FFBEFFCBD7F0E73193E2932EEFE542ACCC84762DEEC87
SHA-512:	B2CA25A3311DC42942E046EB1A27038B71D689925B7D6B3EBB4D7CD2C7B9A0C7DE3D10175790AC060DC3F8ACF3C1708C336626BE06879097F4D0ECAA7F567041
Malicious:	false
Reputation:	high, very likely benign file
Preview:	GIF89a.............!.......,...........D..;

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\404-arrow[1].png Download File
Process:	C:\Users\user\Desktop\njw.exe
File Type:	PNG image data, 6 x 9, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1169
Entropy (8bit):	6.375857124482774
Encrypted:	false
SSDEEP:	24:zS1he91Wwh82lYSKw7+H1V/uT3cyJ3V2r7hGQ9/9mekJ:MqQvnL8q1durJ3Gh5/Y5J
MD5:	F491D002C601CED0C0BC19994B89CDDC
SHA1:	65B26746EC3BF706DFED1CA6D81BEF6211D15FEF
SHA-256:	BA146CE6FB6E788B50E02B45B72835450B513EC744B2F8DE1DD85589B42F8F05
SHA-512:	0E96575D89DFDE823A577EAF6D4CB4EFAB56C37875B7E5955F7F9FF759B67805FF0013DEDC1C98A73616F7C55CEEBBD5222C0A1EF2F17A936CAE36425E129887
Malicious:	false
Preview:	.PNG........IHDR...............].....tEXtSoftware.Adobe ImageReadyq.e<...diTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:9A714C550974E111987BC97C16A991C4" xmpMM:DocumentID="xmp.did:8F1EEDA87F2611E18D85EF20DD25A302" xmpMM:InstanceID="xmp.iid:8F1EEDA77F2611E18D85EF20DD25A302" xmp:CreatorTool="Adobe Photoshop CS4 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:92ED5C9A097FE111BC73B13FF08B8A3F" stRef:documentID="xmp.did:9A714C550974E111987BC97C16A991C4"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>...r....IDATx.b..t.r..G....g.b..f..aW8......w\........

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\404-header-line[1].gif Download File
Process:	C:\Users\user\Desktop\njw.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	1161
Entropy (8bit):	6.66123176440527
Encrypted:	false
SSDEEP:	24:4al1he91Wwh82lYSKw7+AVRT3cyJ3V2r7hGY8D:RqQvnL8rjrJ3GhL8D
MD5:	5B4E842D2F840996ECB19B6AE635E873
SHA1:	EE82D94636E4393AAF6E97931793975950A82CA6
SHA-256:	AC9C14376FAC0CD59069AEEF8D7667E6A85DAD3BA0379DC2A6026A20DB18DF1A
SHA-512:	8E0061925AF72421F8F003F22FC51D284B7F97FBCA3D4A5525CB3411485946CC0738066AE0A88B9D2BA8C4252DB20A69F64E9748BE03FF97AAB7EE2347C4A88D
Malicious:	false
Preview:	GIF89a.............!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:9A714C550974E111987BC97C16A991C4" xmpMM:DocumentID="xmp.did:4C014FE07F2611E19F57DEAD3C227423" xmpMM:InstanceID="xmp.iid:4C014FDF7F2611E19F57DEAD3C227423" xmp:CreatorTool="Adobe Photoshop CS4 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:92ED5C9A097FE111BC73B13FF08B8A3F" stRef:documentID="xmp.did:9A714C550974E111987BC97C16A991C4"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.........................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\404-header-line[2].gif Download File
Process:	C:\Users\user\Desktop\njw.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	1161
Entropy (8bit):	6.66123176440527
Encrypted:	false
SSDEEP:	24:4al1he91Wwh82lYSKw7+AVRT3cyJ3V2r7hGY8D:RqQvnL8rjrJ3GhL8D
MD5:	5B4E842D2F840996ECB19B6AE635E873
SHA1:	EE82D94636E4393AAF6E97931793975950A82CA6
SHA-256:	AC9C14376FAC0CD59069AEEF8D7667E6A85DAD3BA0379DC2A6026A20DB18DF1A
SHA-512:	8E0061925AF72421F8F003F22FC51D284B7F97FBCA3D4A5525CB3411485946CC0738066AE0A88B9D2BA8C4252DB20A69F64E9748BE03FF97AAB7EE2347C4A88D
Malicious:	false
Preview:	GIF89a.............!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:9A714C550974E111987BC97C16A991C4" xmpMM:DocumentID="xmp.did:4C014FE07F2611E19F57DEAD3C227423" xmpMM:InstanceID="xmp.iid:4C014FDF7F2611E19F57DEAD3C227423" xmp:CreatorTool="Adobe Photoshop CS4 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:92ED5C9A097FE111BC73B13FF08B8A3F" stRef:documentID="xmp.did:9A714C550974E111987BC97C16A991C4"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.........................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\404-logo[1].png Download File
Process:	C:\Users\user\Desktop\njw.exe
File Type:	PNG image data, 43 x 27, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2152
Entropy (8bit):	7.4508196985650255
Encrypted:	false
SSDEEP:	48:4wqQvnL8HZ3rJ3Gh0NNeqNwzja90uVfAZO6UE:4BQot0h0rSja90uFAhP
MD5:	62A569EF932D3AA5B44BBC515DF09653
SHA1:	E910390D6A312FA9F4B222AEEA3226C1F7EA7FA0
SHA-256:	0945354CAD56584EB978AFC9800BC9BD8D24DF25FBFE063573A0511AF5138E8B
SHA-512:	5FD5A2236ACF1E1BB72A12C74FB00C6FB8A3B8D084F513867EA8FAAC1E76027A7CE342A0054B0F873440B7B083551A218324012E021EE343F2FC0CDE03DF94F5
Malicious:	false
Preview:	.PNG........IHDR...+..........'vm....tEXtSoftware.Adobe ImageReadyq.e<...diTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:9A714C550974E111987BC97C16A991C4" xmpMM:DocumentID="xmp.did:6A7BBACF7F2611E19F01EE589B08C430" xmpMM:InstanceID="xmp.iid:6A7BBACE7F2611E19F01EE589B08C430" xmp:CreatorTool="Adobe Photoshop CS4 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:92ED5C9A097FE111BC73B13FF08B8A3F" stRef:documentID="xmp.did:9A714C550974E111987BC97C16A991C4"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.O.....IDATx..{lTE....EZjC....j..h.....b..!b*/.c...W

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\404-logo[2].png Download File
Process:	C:\Users\user\Desktop\njw.exe
File Type:	PNG image data, 43 x 27, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2152
Entropy (8bit):	7.4508196985650255
Encrypted:	false
SSDEEP:	48:4wqQvnL8HZ3rJ3Gh0NNeqNwzja90uVfAZO6UE:4BQot0h0rSja90uFAhP
MD5:	62A569EF932D3AA5B44BBC515DF09653
SHA1:	E910390D6A312FA9F4B222AEEA3226C1F7EA7FA0
SHA-256:	0945354CAD56584EB978AFC9800BC9BD8D24DF25FBFE063573A0511AF5138E8B
SHA-512:	5FD5A2236ACF1E1BB72A12C74FB00C6FB8A3B8D084F513867EA8FAAC1E76027A7CE342A0054B0F873440B7B083551A218324012E021EE343F2FC0CDE03DF94F5
Malicious:	false
Preview:	.PNG........IHDR...+..........'vm....tEXtSoftware.Adobe ImageReadyq.e<...diTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:9A714C550974E111987BC97C16A991C4" xmpMM:DocumentID="xmp.did:6A7BBACF7F2611E19F01EE589B08C430" xmpMM:InstanceID="xmp.iid:6A7BBACE7F2611E19F01EE589B08C430" xmp:CreatorTool="Adobe Photoshop CS4 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:92ED5C9A097FE111BC73B13FF08B8A3F" stRef:documentID="xmp.did:9A714C550974E111987BC97C16A991C4"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.O.....IDATx..{lTE....EZjC....j..h.....b..!b*/.c...W

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\404[1].png Download File
Process:	C:\Users\user\Desktop\njw.exe
File Type:	PNG image data, 155 x 66, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4451
Entropy (8bit):	7.815188084249031
Encrypted:	false
SSDEEP:	48:mqQvnL8QsrJ3GhrwUC5CY1s7P5ShGRQvQCfCWzSWAnXmeQkzkCgDoSbKVRVbGeLG:XQoL0hrYg9yXvjdSWAWeQlFCXukVaa16
MD5:	9684186972F20E829835912A9FF55F3A
SHA1:	ACA5BF4DE51319525F1DB749DC0825CA8E1C06C1
SHA-256:	389267599E2B30CDA3F0091BCDAA856C39E38543038A52955EBA5B048E915742
SHA-512:	31BBD89B9801E09EA5BFA25FDA51FFFDD765C8BEA4BD7FFC80C89750220F99AC35616BDB8146044F69E948424468C3E8691871D6AA2E5C0C27730BFC6AE8AED0
Malicious:	false
Preview:	.PNG........IHDR.......B.....@P.k....tEXtSoftware.Adobe ImageReadyq.e<...diTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:9A714C550974E111987BC97C16A991C4" xmpMM:DocumentID="xmp.did:A2E971A17F2C11E19D72841B70F96071" xmpMM:InstanceID="xmp.iid:A2E971A07F2C11E19D72841B70F96071" xmp:CreatorTool="Adobe Photoshop CS4 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:92ED5C9A097FE111BC73B13FF08B8A3F" stRef:documentID="xmp.did:9A714C550974E111987BC97C16A991C4"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>N.....IDATx..].r...........f...[...<@..G.....J...V

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\button[2].png Download File
Process:	C:\Users\user\Desktop\njw.exe
File Type:	PNG image data, 1 x 20, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	1036
Entropy (8bit):	6.003417494129505
Encrypted:	false
SSDEEP:	24:PQJ1he91Wwh82lYSKw7+AzVvT3cyJ3V2r7hGAOK7:qqQvnL83RrJ3GhOQ
MD5:	20ECCCF80B7CCE904C2EE06F65007306
SHA1:	951474262705F3D4C58E3E937DAF03A9D0BFC7FA
SHA-256:	DB06224375A1362DE84DA041DB7BD476C60267D1E7D24A8569F967CE0C07EF05
SHA-512:	692DDE2E59BBB0DE8411E46787DDCDE95156F0E15994219194105CFE3CBDA9A666FAC512DD059297BD5560B6117D0D15DFCC657A431187161F887A525821AE9F
Malicious:	false
Preview:	.PNG........IHDR..............l......tEXtSoftware.Adobe ImageReadyq.e<...diTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:9A714C550974E111987BC97C16A991C4" xmpMM:DocumentID="xmp.did:3331FF467FCD11E18838E5F708B7572B" xmpMM:InstanceID="xmp.iid:3331FF457FCD11E18838E5F708B7572B" xmp:CreatorTool="Adobe Photoshop CS4 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:92ED5C9A097FE111BC73B13FF08B8A3F" stRef:documentID="xmp.did:9A714C550974E111987BC97C16A991C4"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..L....>IDATx.l....!.....KS...P"..70.{.*.9..L".....;

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\watch[1].js Download File
Process:	C:\Users\user\Desktop\njw.exe
File Type:	UTF-8 Unicode (with BOM) text, with very long lines
Category:	dropped
Size (bytes):	132911
Entropy (8bit):	5.575537014376501
Encrypted:	false
SSDEEP:	1536:gSYWWEU3rdOKg7spQAFdmxdoxUxZ2mCeEo/sS8r7kuuDvWvzODHIbkZUQ1mOTMnF:g5WWboAnmxYztM4cMpNO5K
MD5:	ECA5C7083EF9B406373D0C3399A909DF
SHA1:	186F214942A03FAEBAEE065A9AD6C44509FD595C
SHA-256:	D583F0408C31E539635F93EA833DA6D7FFF4707B3B17679A16B16FD24D639864
SHA-512:	4B63B57801F39D330626588816E5550619EDE8611E1CB22013EA8DB79BA6F643383BB69D57D0168BD2946F7B88DA048E60719B2E7648D201643DF5094DDB5059
Malicious:	false
Preview:	.(function(){try{(function(Jc){function Hi(a){return a.replace(Ii,function(b,c,d,e){return""+c+e})}function Kc(a,b){if(!b)return!1;var c=M(a);return(new RegExp(b)).test(""+c.pathname+c.hash+c.search)}function Ji(a,b){return Da(a,b,function(c){var d=n(c,"settings.dr");return{rc:Ki(a,d),isEnabled:n(c,"settings.auto_goals")}})}function Li(a,b){function c(){var m=l+"0",p=l+"1";h[m]?h[p]?(l=l.slice(0,-1),--k):(g[p]=e(8),h[p]=1):(g[m]=e(8),h[m]=1)}function d(){var m=l+"1";h[l+"0"]?h[m]?(l=l.slice(0,-1),--k):(l+="1",.h[l]=1):(l+="0",h[l]=1)}function e(m){void 0===m&&(m=1);var p=f.slice(k,k+m);k+=m;return p}for(var f=Ye(a,b,""),g={},h={},k=1,l="";k<f.length-1;)("0"===e()?d:c)();return g}function Mi(a,b,c,d,e){c=Dd(a,a.document.body,c);d=Dd(a,a.document.body,d);N(e.target,[c,d])&&Ed(a,b)}function Ze(a,b,c,d){(c=Ni(a,d,c))&&Ed(a,b,c)}function $e(a,b){var c=af(a,b);return Oi(a,c)}function af(a,b){var c=Dd(a,a.document.body,b);return c?Pi(a,c):""}function Ed(a,b,c){(b=Ea(a,b))&&b.params(cc(["__y

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\watch[2].js Download File
Process:	C:\Users\user\Desktop\njw.exe
File Type:	UTF-8 Unicode (with BOM) text, with very long lines
Category:	dropped
Size (bytes):	132911
Entropy (8bit):	5.575537014376501
Encrypted:	false
SSDEEP:	1536:gSYWWEU3rdOKg7spQAFdmxdoxUxZ2mCeEo/sS8r7kuuDvWvzODHIbkZUQ1mOTMnF:g5WWboAnmxYztM4cMpNO5K
MD5:	ECA5C7083EF9B406373D0C3399A909DF
SHA1:	186F214942A03FAEBAEE065A9AD6C44509FD595C
SHA-256:	D583F0408C31E539635F93EA833DA6D7FFF4707B3B17679A16B16FD24D639864
SHA-512:	4B63B57801F39D330626588816E5550619EDE8611E1CB22013EA8DB79BA6F643383BB69D57D0168BD2946F7B88DA048E60719B2E7648D201643DF5094DDB5059
Malicious:	false
Preview:	.(function(){try{(function(Jc){function Hi(a){return a.replace(Ii,function(b,c,d,e){return""+c+e})}function Kc(a,b){if(!b)return!1;var c=M(a);return(new RegExp(b)).test(""+c.pathname+c.hash+c.search)}function Ji(a,b){return Da(a,b,function(c){var d=n(c,"settings.dr");return{rc:Ki(a,d),isEnabled:n(c,"settings.auto_goals")}})}function Li(a,b){function c(){var m=l+"0",p=l+"1";h[m]?h[p]?(l=l.slice(0,-1),--k):(g[p]=e(8),h[p]=1):(g[m]=e(8),h[m]=1)}function d(){var m=l+"1";h[l+"0"]?h[m]?(l=l.slice(0,-1),--k):(l+="1",.h[l]=1):(l+="0",h[l]=1)}function e(m){void 0===m&&(m=1);var p=f.slice(k,k+m);k+=m;return p}for(var f=Ye(a,b,""),g={},h={},k=1,l="";k<f.length-1;)("0"===e()?d:c)();return g}function Mi(a,b,c,d,e){c=Dd(a,a.document.body,c);d=Dd(a,a.document.body,d);N(e.target,[c,d])&&Ed(a,b)}function Ze(a,b,c,d){(c=Ni(a,d,c))&&Ed(a,b,c)}function $e(a,b){var c=af(a,b);return Oi(a,c)}function af(a,b){var c=Dd(a,a.document.body,b);return c?Pi(a,c):""}function Ed(a,b,c){(b=Ea(a,b))&&b.params(cc(["__y

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\advert[1].gif Download File
Process:	C:\Users\user\Desktop\njw.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	43
Entropy (8bit):	2.7374910194847146
Encrypted:	false
SSDEEP:	3:CU9yltxlHh/:m/
MD5:	DF3E567D6F16D040326C7A0EA29A4F41
SHA1:	EA7DF583983133B62712B5E73BFFBCD45CC53736
SHA-256:	548F2D6F4D0D820C6C5FFBEFFCBD7F0E73193E2932EEFE542ACCC84762DEEC87
SHA-512:	B2CA25A3311DC42942E046EB1A27038B71D689925B7D6B3EBB4D7CD2C7B9A0C7DE3D10175790AC060DC3F8ACF3C1708C336626BE06879097F4D0ECAA7F567041
Malicious:	false
Preview:	GIF89a.............!.......,...........D..;

C:\Users\user\Desktop\bugreport.txt Download File
Process:	C:\Users\user\Desktop\njw.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	18164
Entropy (8bit):	4.9882772544962215
Encrypted:	false
SSDEEP:	384:f9rMWwQN3CxK+8T6zPtw1c5bgrwuBG5bgqO4pPQCAK3JEaKmI6xYVGnbYWEdOaCN:JwQN3Cg+8T6zPu1c5bgrwuBG5bgqO4pZ
MD5:	C1757ECB255B635D6BA341EF72AF480D
SHA1:	87D16FC44477F4F06640B02D27674BBD228614CA
SHA-256:	7A96B64D191CF08F88C8C21DAE04C0A925E7893D8919BD94CCD14AA7527963AC
SHA-512:	2005270175A3C936A9AB9D17265AAF63C629287ED634E581E0F9DA56200174401B31DC3D03EBBF0A7F44CA20C322A2B62AA4E3257863D274A32F5434EFA64E0D
Malicious:	false
Preview:	date/time : 2021-10-29, 17:51:08, 31ms..computer name : 114127..user name : user <admin>..operating system : Windows NT New build 9200..system language : English..system up time : 1 hour 43 minutes..program up time : 5 seconds..processors : 2x Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz..physical memory : 2743/8191 MB (free/total)..free disk space : (C:) 79.99 GB..display mode : 1280x1024, 32 bit..process id : $1bd0..allocated memory : 39.16 MB..executable : njw.exe..exec. date/time : 2021-10-29 17:50..madExcept version : 3.0b..callstack crc : $1a0983a1, $6b1df792, $6b1df792..exception number : 1..exception class : EDatabaseError..exception message : Cannot open file bearingdb.tdb.....main thread ($1bd4):..004ca780 +074 njw.exe DB DatabaseError..004ca7e9 +031 njw.exe DB DatabaseErrorFmt..004f0e72 +06e njw.exe TinyDB 6042 +9 TTinyDBFileIO.Open..004f79ba +07e njw.exe

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Entropy (8bit):	7.935591299650064
TrID:	Win32 Executable (generic) a (10002005/4) 99.81% Windows Screen Saver (13104/52) 0.13% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02%
File name:	njw.exe
File size:	1694802
MD5:	3f91f84924d1db7ace9ad307fcae35d1
SHA1:	50e790e2b3324c1b3805916c5a3c323ed8a7305f
SHA256:	a0254e8580186ca146fcc6082a6110888ac0cc3c7f733e760ad7a655bd2a0503
SHA512:	fda6aeccba43b923567ca1e662f31526a5458dc74df356f077116b0a6300f2e7ac0ce3af8ae81a18064048279c1a231d94c2f5a6c66e5dd210363e6bcf734218
SSDEEP:	49152:iOv9gx8KFwoDGqqO3XG00ASL6/PaSm9eMqDsnF0v:i8GxP+qquXGtLsXaeMqDUF2
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	6860d1e434cc7c80

Static PE Info

General
Entrypoint:	0x68861c
Entrypoint Section:
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, BYTES_REVERSED_LO, EXECUTABLE_IMAGE, DEBUG_STRIPPED, LINE_NUMS_STRIPPED, BYTES_REVERSED_HI, RELOCS_STRIPPED
DLL Characteristics:
Time Stamp:	0x2A425E19 [Fri Jun 19 22:22:17 1992 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	09240fdb1ba0c5773dfe515581b453b6

Entrypoint Preview

Instruction
pushad
call 00007FF550801894h
inc edx
outsd
stosb
adc eax, 1AB8D87Bh
add ah, dh
sbb ecx, dword ptr [eax+3Bh]
stosd
in eax, 2Eh
jc 00007FF55080180Eh
cmp dword ptr [edx+162584A0h], esi
int3
jno 00007FF55080186Fh
inc ebp
jne 00007FF5508017FDh
pop esp
xchg eax, esi
mov ch, 3Eh
sbb al, B8h
pop ebp
cmp dword ptr [ecx-6BF631BBh], edx
jc 00007FF550801859h
int1
inc ecx
mov al, byte ptr [2C11AFFAh]
dec esp
int1
inc ecx
mov al, byte ptr [2C11AFFAh]
dec esp
jmp 00007FF550804901h
jmp 00007FF550804915h
jmp 00007FF550804910h
call 00007FF55080178Fh
stc
outsb
salc
or byte ptr [edx+70h], bh
mov byte ptr [95782E22h], al
and edx, dword ptr [edx+2FFC7C9Ah]
or dword ptr [eax], esp
pop dword ptr [ebx]
mov ebx, B9CF5065h
push dword ptr [eax+0Ch]
stosd
cwde
test eax, 10F2044Eh
sti
xlatb
sti
adc eax, ebx
cmp byte ptr [ecx+2Ah], 0000001Ch
and eax, 06860821h
jnl 00007FF55080184Eh
cmp dword ptr [ebx], edx
mov esi, dword ptr [663AC317h]
jnl 00007FF5508017EAh
cmp al, 1Ah
cmp dword ptr [edi+4Eh], ecx
shr byte ptr [ebx], cl
lahf
dec byte ptr [ebp+6Ch]
cmp ebx, esi
cmp bh, dh
add al, D1h
cmc
imul ecx, dword ptr [edx+ebp*4], C6h
jne 00007FF55080181Eh
pop ebx
pushad
or byte ptr [ebx], bh
sub dl, byte ptr [eax-14h]
xchg eax, esi
movsd
xchg eax, ebx
sbb byte ptr [C14FCB1Fh], FFFFFF96h
and al, byte ptr [00000075h]

Data Directories

Name	Virtual Address	Virtual Size
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2937b0	0x50
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x237000	0x5061c
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x20f000	0x18
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x293000	0x128
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
0x1000	0x1f8a34	0xf6200	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
0x1fa000	0xba1c	0x5a00	False	0.982118055556	data	7.98180899146	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
0x206000	0x2489	0x0	False	0	empty	0.0	IMAGE_SCN_MEM_WRITE, IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ
0x209000	0x32e2	0x1400	False	0.93984375	data	7.89313292742	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
0x20d000	0x51	0x200	False	0.193359375	data	3.96131250875	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
0x20e000	0xf0	0x0	False	0	empty	0.0	IMAGE_SCN_MEM_WRITE, IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ
0x20f000	0x18	0x200	False	0.048828125	data	0.19667565744	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
0x210000	0x26d28	0x0	False	0	empty	0.0	IMAGE_SCN_MEM_WRITE, IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ
0x237000	0x5061c	0x50800	False	0.749223602484	data	7.33188771893	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
0x288000	0xab9c	0x7200	False	0.985094572368	data	7.97472353809	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
0x293000	0xe2c	0x1000	False	0.3603515625	data	4.53691628835	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
0x294000	0x615a	0x1400	False	1.0021484375	data	7.96644681101	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
MAD	0x239ba4	0x14	data
MAD	0x239bb8	0x31788	data
RT_CURSOR	0x26b340	0x134	data
RT_CURSOR	0x26b474	0x134	data
RT_CURSOR	0x26b5a8	0x134	data
RT_CURSOR	0x26b6dc	0x134	data
RT_CURSOR	0x26b810	0x134	data	English	United States
RT_CURSOR	0x26b944	0x134	data
RT_CURSOR	0x26ba78	0x134	data
RT_CURSOR	0x26bbac	0x134	AmigaOS bitmap font	Russian	Russia
RT_CURSOR	0x26bce0	0x134	data	English	United States
RT_CURSOR	0x26be14	0x134	data	English	United States
RT_CURSOR	0x26bf48	0x134	AmigaOS bitmap font	Russian	Russia
RT_CURSOR	0x26c07c	0x134	data	Russian	Russia
RT_CURSOR	0x26c1b0	0x134	data	Russian	Russia
RT_CURSOR	0x26c2e4	0x134	data	Russian	Russia
RT_CURSOR	0x26c418	0x134	AmigaOS bitmap font	Russian	Russia
RT_CURSOR	0x26c54c	0x134	data	English	United States
RT_CURSOR	0x26c680	0x134	AmigaOS bitmap font	Russian	Russia
RT_CURSOR	0x26c7b4	0x134	data	Russian	Russia
RT_CURSOR	0x26c8e8	0x134	data	Russian	Russia
RT_CURSOR	0x26ca1c	0x134	AmigaOS bitmap font	Russian	Russia
RT_CURSOR	0x26cb50	0x134	AmigaOS bitmap font	Russian	Russia
RT_CURSOR	0x26cc84	0x134	AmigaOS bitmap font
RT_CURSOR	0x26cdb8	0x134	data
RT_CURSOR	0x26ceec	0x134	data
RT_BITMAP	0x26d020	0x1d0	data
RT_BITMAP	0x26d1f0	0x1e4	data
RT_BITMAP	0x26d3d4	0x1d0	data
RT_BITMAP	0x26d5a4	0x1d0	data
RT_BITMAP	0x26d774	0x1d0	data
RT_BITMAP	0x26d944	0x1d0	data
RT_BITMAP	0x26db14	0x1d0	data
RT_BITMAP	0x26dce4	0x1d0	data
RT_BITMAP	0x26deb4	0x1d0	data
RT_BITMAP	0x26e084	0x1d0	data
RT_BITMAP	0x26e254	0xc0	GLS_BINARY_LSB_FIRST
RT_BITMAP	0x26e314	0xe0	GLS_BINARY_LSB_FIRST
RT_BITMAP	0x26e3f4	0xe0	GLS_BINARY_LSB_FIRST
RT_BITMAP	0x26e4d4	0x128	data	English	United States
RT_BITMAP	0x26e5fc	0x128	data	English	United States
RT_BITMAP	0x26e724	0x128	data	English	United States
RT_BITMAP	0x26e84c	0x128	data	English	United States
RT_BITMAP	0x26e974	0x128	data	English	United States
RT_BITMAP	0x26ea9c	0x128	data	English	United States
RT_BITMAP	0x26ebc4	0x128	data	English	United States
RT_BITMAP	0x26ecec	0x128	data	English	United States
RT_BITMAP	0x26ee14	0xe8	GLS_BINARY_LSB_FIRST	English	United States
RT_BITMAP	0x26eefc	0xe8	GLS_BINARY_LSB_FIRST	English	United States
RT_BITMAP	0x26efe4	0xe8	GLS_BINARY_LSB_FIRST	English	United States
RT_BITMAP	0x26f0cc	0xe8	GLS_BINARY_LSB_FIRST	English	United States
RT_BITMAP	0x26f1b4	0xe8	GLS_BINARY_LSB_FIRST	English	United States
RT_BITMAP	0x26f29c	0xe8	GLS_BINARY_LSB_FIRST	English	United States
RT_BITMAP	0x26f384	0x8c	data
RT_BITMAP	0x26f410	0x8c	data
RT_BITMAP	0x26f49c	0x238	data
RT_BITMAP	0x26f6d4	0x238	data
RT_BITMAP	0x26f90c	0x8c	data
RT_BITMAP	0x26f998	0x8c	data
RT_BITMAP	0x26fa24	0x8c	data
RT_BITMAP	0x26fab0	0x238	data
RT_BITMAP	0x26fce8	0x5c	data
RT_BITMAP	0x26fd44	0x5c	data
RT_BITMAP	0x26fda0	0x5c	data
RT_BITMAP	0x26fdfc	0x5c	data
RT_BITMAP	0x26fe58	0x5c	data
RT_BITMAP	0x26feb4	0x138	data
RT_BITMAP	0x26ffec	0x138	data
RT_BITMAP	0x270124	0x138	data
RT_BITMAP	0x27025c	0x138	data
RT_BITMAP	0x270394	0x138	data
RT_BITMAP	0x2704cc	0x138	data
RT_BITMAP	0x270604	0x104	data
RT_BITMAP	0x270708	0x138	data
RT_BITMAP	0x270840	0x104	data
RT_BITMAP	0x270944	0x138	data
RT_BITMAP	0x270a7c	0xe0	GLS_BINARY_LSB_FIRST
RT_BITMAP	0x270b5c	0xc0	GLS_BINARY_LSB_FIRST
RT_BITMAP	0x270c1c	0xc0	GLS_BINARY_LSB_FIRST
RT_BITMAP	0x270cdc	0xe0	GLS_BINARY_LSB_FIRST
RT_BITMAP	0x270dbc	0x1028	dBase IV DBT, block length 4096, next free block index 40, next free block 0, next used block 0
RT_BITMAP	0x271de4	0x428	GLS_BINARY_LSB_FIRST
RT_BITMAP	0x27220c	0x428	GLS_BINARY_LSB_FIRST
RT_BITMAP	0x272634	0x428	GLS_BINARY_LSB_FIRST
RT_BITMAP	0x272a5c	0x1028	dBase IV DBT, block length 4096, next free block index 40, next free block 0, next used block 0
RT_BITMAP	0x273a84	0x428	GLS_BINARY_LSB_FIRST
RT_BITMAP	0x273eac	0x428	GLS_BINARY_LSB_FIRST
RT_BITMAP	0x2742d4	0x428	GLS_BINARY_LSB_FIRST
RT_BITMAP	0x2746fc	0x428	GLS_BINARY_LSB_FIRST
RT_BITMAP	0x274b24	0x1028	dBase IV DBT, block length 4096, next free block index 40, next free block 0, next used block 0
RT_BITMAP	0x275b4c	0x428	GLS_BINARY_LSB_FIRST
RT_BITMAP	0x275f74	0xc0	GLS_BINARY_LSB_FIRST
RT_BITMAP	0x276034	0xe0	GLS_BINARY_LSB_FIRST
RT_BITMAP	0x276114	0xe8	GLS_BINARY_LSB_FIRST
RT_BITMAP	0x2761fc	0xc0	GLS_BINARY_LSB_FIRST
RT_BITMAP	0x2762bc	0xe0	GLS_BINARY_LSB_FIRST
RT_ICON	0x27639c	0x10a8	dBase III DBT, version number 0, next free block index 40	Russian	Russia
RT_DIALOG	0x277444	0x52	data
RT_STRING	0x277498	0x1d8	data
RT_STRING	0x277670	0x2c	data
RT_STRING	0x27769c	0xb0	data
RT_STRING	0x27774c	0x1f0	data
RT_STRING	0x27793c	0x24c	data
RT_STRING	0x277b88	0x1ac	data
RT_STRING	0x277d34	0x380	data
RT_STRING	0x2780b4	0x410	data
RT_STRING	0x2784c4	0x794	data
RT_STRING	0x278c58	0xf8	data
RT_STRING	0x278d50	0x128	data
RT_STRING	0x278e78	0x318	data
RT_STRING	0x279190	0x2a4	data
RT_STRING	0x279434	0x178	data
RT_STRING	0x2795ac	0x1f4	data
RT_STRING	0x2797a0	0x450	data
RT_STRING	0x279bf0	0x4e0	data
RT_STRING	0x27a0d0	0x380	data
RT_STRING	0x27a450	0x528	data
RT_STRING	0x27a978	0x58c	data
RT_STRING	0x27af04	0x478	data
RT_STRING	0x27b37c	0x23c	data
RT_STRING	0x27b5b8	0xd4	data
RT_STRING	0x27b68c	0x110	data
RT_STRING	0x27b79c	0x24c	data
RT_STRING	0x27b9e8	0x414	data
RT_STRING	0x27bdfc	0x3b4	data
RT_STRING	0x27c1b0	0x3a0	data
RT_STRING	0x27c550	0x388	data
RT_STRING	0x27c8d8	0x234	data
RT_STRING	0x27cb0c	0xec	data
RT_STRING	0x27cbf8	0x1f0	data
RT_STRING	0x27cde8	0x41c	data
RT_STRING	0x27d204	0x378	data
RT_STRING	0x27d57c	0x308	data
RT_STRING	0x27d884	0x370	data
RT_RCDATA	0x27dbf4	0x10	data
RT_RCDATA	0x27dc04	0xa84	data
RT_RCDATA	0x27e688	0x6fd	Delphi compiled form 'TcxFilterDialog'
RT_RCDATA	0x27ed88	0x772	Delphi compiled form 'TfmFilterControlDialog'
RT_RCDATA	0x27f4fc	0x5be3	Delphi compiled form 'TForm1'
RT_RCDATA	0x2850e0	0x45c	Delphi compiled form 'TForm2'
RT_RCDATA	0x28553c	0x41f	Delphi compiled form 'TForm3'
RT_RCDATA	0x28595c	0x494	Delphi compiled form 'TLoginDialog'
RT_RCDATA	0x285df0	0xa57	Delphi compiled form 'TMadExcept'
RT_RCDATA	0x286848	0x34e	Delphi compiled form 'TMEContactForm'
RT_RCDATA	0x286b98	0x228	Delphi compiled form 'TMEDetailsForm'
RT_RCDATA	0x286dc0	0x2a3	Delphi compiled form 'TMEScrShotForm'
RT_RCDATA	0x287064	0x3c4	Delphi compiled form 'TPasswordDialog'
RT_GROUP_CURSOR	0x287428	0x14	data
RT_GROUP_CURSOR	0x28743c	0x14	data
RT_GROUP_CURSOR	0x287450	0x14	data
RT_GROUP_CURSOR	0x287464	0x14	data
RT_GROUP_CURSOR	0x287478	0x14	data
RT_GROUP_CURSOR	0x28748c	0x14	data
RT_GROUP_CURSOR	0x2874a0	0x14	data
RT_GROUP_CURSOR	0x2874b4	0x14	data
RT_GROUP_CURSOR	0x2874c8	0x14	data
RT_GROUP_CURSOR	0x2874dc	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States
RT_GROUP_CURSOR	0x2874f0	0x14	data
RT_GROUP_CURSOR	0x287504	0x14	data
RT_GROUP_CURSOR	0x287518	0x14	data
RT_GROUP_CURSOR	0x28752c	0x14	data
RT_GROUP_CURSOR	0x287540	0x14	data
RT_GROUP_CURSOR	0x287554	0x14	Lotus unknown worksheet or configuration, revision 0x1
RT_GROUP_CURSOR	0x287568	0x14	Lotus unknown worksheet or configuration, revision 0x1
RT_GROUP_CURSOR	0x28757c	0x14	Lotus unknown worksheet or configuration, revision 0x1
RT_GROUP_CURSOR	0x287590	0x14	Lotus unknown worksheet or configuration, revision 0x1
RT_GROUP_CURSOR	0x2875a4	0x14	Lotus unknown worksheet or configuration, revision 0x1
RT_GROUP_CURSOR	0x2875b8	0x14	Lotus unknown worksheet or configuration, revision 0x1
RT_GROUP_CURSOR	0x2875cc	0x14	Lotus unknown worksheet or configuration, revision 0x1
RT_GROUP_CURSOR	0x2875e0	0x14	Lotus unknown worksheet or configuration, revision 0x1
RT_GROUP_CURSOR	0x2875f4	0x14	Lotus unknown worksheet or configuration, revision 0x1
RT_GROUP_ICON	0x287608	0x14	data	Russian	Russia

Imports

DLL	Import
KERNEL32.dll	MapViewOfFile, CreateFileA, InitializeCriticalSection, GetProcAddress, GetCurrentProcess, LocalFree, RaiseException, LocalAlloc, GetVersionExA, TerminateProcess, Sleep, WaitForSingleObject, GetExitCodeProcess, LeaveCriticalSection, EnterCriticalSection, SetLastError, GetFullPathNameA, DeleteFileA, WriteFile, GetTempFileNameA, GetTempPathA, VirtualFree, VirtualProtect, SetFilePointer, VirtualAlloc, DuplicateHandle, ReadFile, CreateFileMappingA, GetFileSize, LoadLibraryA, FlushFileBuffers, FindNextFileA, GetModuleFileNameA, ResumeThread, WriteProcessMemory, GetCurrentProcessId, CreateProcessA, HeapAlloc, HeapCreate, HeapFree, FormatMessageA, GetLastError, SetUnhandledExceptionFilter, VirtualQuery, CreateFileW, WideCharToMultiByte, GetFileAttributesA, CreateFileMappingW, FreeLibrary, LoadLibraryW, GetModuleHandleW, ExitProcess, FindClose, UnmapViewOfFile, CloseHandle, GetModuleHandleA, GetFileTime, GetSystemTimeAsFileTime, FindFirstFileA, RtlUnwind
USER32.dll	wvsprintfA, wsprintfA, ChangeDisplaySettingsA, MessageBoxA, CharUpperBuffA, LoadImageA
GDI32.dll	AddFontResourceA, RemoveFontResourceA, DeleteDC, CreateDIBSection, CreateCompatibleDC

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States
Russian	Russia

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
10/29/21-17:51:14.924932	ICMP	402	ICMP Destination Unreachable Port Unreachable			192.168.2.4	8.8.8.8
10/29/21-17:51:15.851555	TCP	2925	INFO web bug 0x0 gif attempt	80	49782	193.109.247.229	192.168.2.4
10/29/21-17:51:16.067758	TCP	2925	INFO web bug 0x0 gif attempt	80	49782	193.109.247.229	192.168.2.4
10/29/21-17:51:16.429861	TCP	2925	INFO web bug 0x0 gif attempt	80	49784	142.250.203.110	192.168.2.4
10/29/21-17:51:16.523030	TCP	2925	INFO web bug 0x0 gif attempt	80	49784	142.250.203.110	192.168.2.4

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 29, 2021 17:51:14.912357092 CEST	49782	80	192.168.2.4	193.109.247.229
Oct 29, 2021 17:51:14.912494898 CEST	49783	80	192.168.2.4	193.109.247.229
Oct 29, 2021 17:51:14.978293896 CEST	80	49782	193.109.247.229	192.168.2.4
Oct 29, 2021 17:51:14.979026079 CEST	49782	80	192.168.2.4	193.109.247.229
Oct 29, 2021 17:51:14.979448080 CEST	49782	80	192.168.2.4	193.109.247.229
Oct 29, 2021 17:51:14.979504108 CEST	80	49783	193.109.247.229	192.168.2.4
Oct 29, 2021 17:51:14.979582071 CEST	49783	80	192.168.2.4	193.109.247.229
Oct 29, 2021 17:51:15.015364885 CEST	49783	80	192.168.2.4	193.109.247.229
Oct 29, 2021 17:51:15.045166969 CEST	80	49782	193.109.247.229	192.168.2.4
Oct 29, 2021 17:51:15.045492887 CEST	80	49782	193.109.247.229	192.168.2.4
Oct 29, 2021 17:51:15.045532942 CEST	80	49782	193.109.247.229	192.168.2.4
Oct 29, 2021 17:51:15.045563936 CEST	80	49782	193.109.247.229	192.168.2.4
Oct 29, 2021 17:51:15.045583963 CEST	49782	80	192.168.2.4	193.109.247.229
Oct 29, 2021 17:51:15.045619011 CEST	49782	80	192.168.2.4	193.109.247.229
Oct 29, 2021 17:51:15.045627117 CEST	49782	80	192.168.2.4	193.109.247.229
Oct 29, 2021 17:51:15.082608938 CEST	80	49783	193.109.247.229	192.168.2.4
Oct 29, 2021 17:51:15.082951069 CEST	80	49783	193.109.247.229	192.168.2.4
Oct 29, 2021 17:51:15.082993984 CEST	80	49783	193.109.247.229	192.168.2.4
Oct 29, 2021 17:51:15.083020926 CEST	80	49783	193.109.247.229	192.168.2.4
Oct 29, 2021 17:51:15.083029985 CEST	49783	80	192.168.2.4	193.109.247.229
Oct 29, 2021 17:51:15.083064079 CEST	49783	80	192.168.2.4	193.109.247.229
Oct 29, 2021 17:51:15.083074093 CEST	49783	80	192.168.2.4	193.109.247.229
Oct 29, 2021 17:51:15.365300894 CEST	49786	80	192.168.2.4	88.212.201.198
Oct 29, 2021 17:51:15.365367889 CEST	49787	80	192.168.2.4	88.212.201.198
Oct 29, 2021 17:51:15.383512020 CEST	49788	80	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:15.384476900 CEST	49789	80	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:15.422493935 CEST	80	49787	88.212.201.198	192.168.2.4
Oct 29, 2021 17:51:15.422600031 CEST	49787	80	192.168.2.4	88.212.201.198
Oct 29, 2021 17:51:15.424932003 CEST	80	49788	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:15.425023079 CEST	49788	80	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:15.425867081 CEST	80	49789	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:15.425956011 CEST	49789	80	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:15.426867962 CEST	80	49786	88.212.201.198	192.168.2.4
Oct 29, 2021 17:51:15.426937103 CEST	49786	80	192.168.2.4	88.212.201.198
Oct 29, 2021 17:51:15.440135956 CEST	49787	80	192.168.2.4	88.212.201.198
Oct 29, 2021 17:51:15.440211058 CEST	49788	80	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:15.440260887 CEST	49789	80	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:15.440336943 CEST	49786	80	192.168.2.4	88.212.201.198
Oct 29, 2021 17:51:15.481651068 CEST	80	49788	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:15.481686115 CEST	80	49789	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:15.481770992 CEST	80	49788	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:15.481829882 CEST	49788	80	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:15.482186079 CEST	80	49789	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:15.482260942 CEST	49789	80	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:15.496105909 CEST	49788	80	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:15.497661114 CEST	49790	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:15.497730017 CEST	443	49790	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:15.497819901 CEST	49790	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:15.499608040 CEST	80	49787	88.212.201.198	192.168.2.4
Oct 29, 2021 17:51:15.499747038 CEST	49787	80	192.168.2.4	88.212.201.198
Oct 29, 2021 17:51:15.503304958 CEST	80	49786	88.212.201.198	192.168.2.4
Oct 29, 2021 17:51:15.503382921 CEST	49786	80	192.168.2.4	88.212.201.198
Oct 29, 2021 17:51:15.522010088 CEST	49789	80	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:15.523943901 CEST	49791	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:15.524008989 CEST	443	49791	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:15.524115086 CEST	49791	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:15.540247917 CEST	80	49788	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:15.540335894 CEST	49788	80	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:15.551465988 CEST	49786	80	192.168.2.4	88.212.201.198
Oct 29, 2021 17:51:15.551891088 CEST	49787	80	192.168.2.4	88.212.201.198
Oct 29, 2021 17:51:15.556516886 CEST	49792	443	192.168.2.4	88.212.201.198
Oct 29, 2021 17:51:15.556557894 CEST	443	49792	88.212.201.198	192.168.2.4
Oct 29, 2021 17:51:15.556633949 CEST	49792	443	192.168.2.4	88.212.201.198
Oct 29, 2021 17:51:15.560092926 CEST	49793	443	192.168.2.4	88.212.201.198
Oct 29, 2021 17:51:15.560134888 CEST	443	49793	88.212.201.198	192.168.2.4
Oct 29, 2021 17:51:15.560204983 CEST	49793	443	192.168.2.4	88.212.201.198
Oct 29, 2021 17:51:15.564116001 CEST	80	49789	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:15.564204931 CEST	49789	80	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:15.567859888 CEST	49790	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:15.567904949 CEST	443	49790	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:15.568025112 CEST	49791	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:15.568064928 CEST	443	49791	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:15.568361998 CEST	49792	443	192.168.2.4	88.212.201.198
Oct 29, 2021 17:51:15.568391085 CEST	443	49792	88.212.201.198	192.168.2.4
Oct 29, 2021 17:51:15.568624973 CEST	49793	443	192.168.2.4	88.212.201.198
Oct 29, 2021 17:51:15.568664074 CEST	443	49793	88.212.201.198	192.168.2.4
Oct 29, 2021 17:51:15.609721899 CEST	80	49787	88.212.201.198	192.168.2.4
Oct 29, 2021 17:51:15.609771013 CEST	80	49787	88.212.201.198	192.168.2.4
Oct 29, 2021 17:51:15.609843016 CEST	49787	80	192.168.2.4	88.212.201.198
Oct 29, 2021 17:51:15.612982988 CEST	80	49786	88.212.201.198	192.168.2.4
Oct 29, 2021 17:51:15.613230944 CEST	80	49786	88.212.201.198	192.168.2.4
Oct 29, 2021 17:51:15.613354921 CEST	49786	80	192.168.2.4	88.212.201.198
Oct 29, 2021 17:51:15.666100025 CEST	443	49791	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:15.666202068 CEST	49791	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:15.667665958 CEST	443	49790	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:15.667776108 CEST	49790	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:15.759294987 CEST	443	49792	88.212.201.198	192.168.2.4
Oct 29, 2021 17:51:15.759428024 CEST	49792	443	192.168.2.4	88.212.201.198
Oct 29, 2021 17:51:15.769058943 CEST	443	49793	88.212.201.198	192.168.2.4
Oct 29, 2021 17:51:15.769156933 CEST	49793	443	192.168.2.4	88.212.201.198
Oct 29, 2021 17:51:15.785171032 CEST	49783	80	192.168.2.4	193.109.247.229
Oct 29, 2021 17:51:15.785819054 CEST	49782	80	192.168.2.4	193.109.247.229
Oct 29, 2021 17:51:15.851555109 CEST	80	49782	193.109.247.229	192.168.2.4
Oct 29, 2021 17:51:15.851598978 CEST	80	49782	193.109.247.229	192.168.2.4
Oct 29, 2021 17:51:15.851619005 CEST	49782	80	192.168.2.4	193.109.247.229
Oct 29, 2021 17:51:15.851660967 CEST	49782	80	192.168.2.4	193.109.247.229
Oct 29, 2021 17:51:15.852315903 CEST	80	49783	193.109.247.229	192.168.2.4
Oct 29, 2021 17:51:15.852349997 CEST	80	49783	193.109.247.229	192.168.2.4
Oct 29, 2021 17:51:15.852401018 CEST	49783	80	192.168.2.4	193.109.247.229
Oct 29, 2021 17:51:15.852443933 CEST	49783	80	192.168.2.4	193.109.247.229
Oct 29, 2021 17:51:15.858786106 CEST	49783	80	192.168.2.4	193.109.247.229
Oct 29, 2021 17:51:15.859746933 CEST	49782	80	192.168.2.4	193.109.247.229
Oct 29, 2021 17:51:15.925540924 CEST	80	49782	193.109.247.229	192.168.2.4
Oct 29, 2021 17:51:15.925595999 CEST	80	49782	193.109.247.229	192.168.2.4
Oct 29, 2021 17:51:15.925632954 CEST	80	49782	193.109.247.229	192.168.2.4
Oct 29, 2021 17:51:15.925658941 CEST	49782	80	192.168.2.4	193.109.247.229
Oct 29, 2021 17:51:15.925693989 CEST	49782	80	192.168.2.4	193.109.247.229
Oct 29, 2021 17:51:15.925700903 CEST	49782	80	192.168.2.4	193.109.247.229
Oct 29, 2021 17:51:15.925990105 CEST	80	49783	193.109.247.229	192.168.2.4
Oct 29, 2021 17:51:15.926028013 CEST	80	49783	193.109.247.229	192.168.2.4
Oct 29, 2021 17:51:15.926078081 CEST	49783	80	192.168.2.4	193.109.247.229
Oct 29, 2021 17:51:15.926124096 CEST	49783	80	192.168.2.4	193.109.247.229
Oct 29, 2021 17:51:15.932754993 CEST	49782	80	192.168.2.4	193.109.247.229
Oct 29, 2021 17:51:15.933043003 CEST	49783	80	192.168.2.4	193.109.247.229
Oct 29, 2021 17:51:15.992491007 CEST	49790	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:15.992551088 CEST	443	49790	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:15.992872953 CEST	49792	443	192.168.2.4	88.212.201.198
Oct 29, 2021 17:51:15.992913008 CEST	443	49792	88.212.201.198	192.168.2.4
Oct 29, 2021 17:51:15.993001938 CEST	443	49790	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:15.993077040 CEST	49790	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:15.993448019 CEST	443	49792	88.212.201.198	192.168.2.4
Oct 29, 2021 17:51:15.993534088 CEST	49792	443	192.168.2.4	88.212.201.198
Oct 29, 2021 17:51:15.995634079 CEST	49790	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:15.996196032 CEST	49792	443	192.168.2.4	88.212.201.198
Oct 29, 2021 17:51:15.998469114 CEST	80	49782	193.109.247.229	192.168.2.4
Oct 29, 2021 17:51:15.998507023 CEST	80	49782	193.109.247.229	192.168.2.4
Oct 29, 2021 17:51:15.998537064 CEST	80	49782	193.109.247.229	192.168.2.4
Oct 29, 2021 17:51:15.998560905 CEST	80	49782	193.109.247.229	192.168.2.4
Oct 29, 2021 17:51:15.998564959 CEST	49782	80	192.168.2.4	193.109.247.229
Oct 29, 2021 17:51:15.998579979 CEST	80	49782	193.109.247.229	192.168.2.4
Oct 29, 2021 17:51:15.998594999 CEST	49782	80	192.168.2.4	193.109.247.229
Oct 29, 2021 17:51:15.998601913 CEST	49782	80	192.168.2.4	193.109.247.229
Oct 29, 2021 17:51:15.998606920 CEST	49782	80	192.168.2.4	193.109.247.229
Oct 29, 2021 17:51:15.998631001 CEST	49782	80	192.168.2.4	193.109.247.229
Oct 29, 2021 17:51:15.999679089 CEST	49791	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:15.999715090 CEST	443	49791	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:15.999856949 CEST	49793	443	192.168.2.4	88.212.201.198
Oct 29, 2021 17:51:15.999886036 CEST	443	49793	88.212.201.198	192.168.2.4
Oct 29, 2021 17:51:16.000112057 CEST	80	49783	193.109.247.229	192.168.2.4
Oct 29, 2021 17:51:16.000145912 CEST	80	49783	193.109.247.229	192.168.2.4
Oct 29, 2021 17:51:16.000178099 CEST	49783	80	192.168.2.4	193.109.247.229
Oct 29, 2021 17:51:16.000216007 CEST	49783	80	192.168.2.4	193.109.247.229
Oct 29, 2021 17:51:16.000237942 CEST	443	49791	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:16.000302076 CEST	49791	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:16.000386953 CEST	443	49793	88.212.201.198	192.168.2.4
Oct 29, 2021 17:51:16.000467062 CEST	49793	443	192.168.2.4	88.212.201.198
Oct 29, 2021 17:51:16.001530886 CEST	49791	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:16.001703024 CEST	49793	443	192.168.2.4	88.212.201.198
Oct 29, 2021 17:51:16.002221107 CEST	49782	80	192.168.2.4	193.109.247.229
Oct 29, 2021 17:51:16.003344059 CEST	49783	80	192.168.2.4	193.109.247.229
Oct 29, 2021 17:51:16.036875963 CEST	443	49792	88.212.201.198	192.168.2.4
Oct 29, 2021 17:51:16.036895037 CEST	443	49790	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:16.039311886 CEST	443	49790	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:16.039371967 CEST	443	49790	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:16.039388895 CEST	49790	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:16.039413929 CEST	443	49790	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:16.039444923 CEST	49790	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:16.039479017 CEST	49790	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:16.044728994 CEST	443	49791	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:16.044826031 CEST	49791	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:16.044888020 CEST	443	49793	88.212.201.198	192.168.2.4
Oct 29, 2021 17:51:16.044991016 CEST	443	49791	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:16.045074940 CEST	49791	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:16.055838108 CEST	443	49792	88.212.201.198	192.168.2.4
Oct 29, 2021 17:51:16.055977106 CEST	443	49792	88.212.201.198	192.168.2.4
Oct 29, 2021 17:51:16.056112051 CEST	49792	443	192.168.2.4	88.212.201.198
Oct 29, 2021 17:51:16.057167053 CEST	49792	443	192.168.2.4	88.212.201.198
Oct 29, 2021 17:51:16.057198048 CEST	443	49792	88.212.201.198	192.168.2.4
Oct 29, 2021 17:51:16.059412956 CEST	49794	443	192.168.2.4	88.212.201.198
Oct 29, 2021 17:51:16.059463024 CEST	443	49794	88.212.201.198	192.168.2.4
Oct 29, 2021 17:51:16.059540033 CEST	49794	443	192.168.2.4	88.212.201.198
Oct 29, 2021 17:51:16.060487986 CEST	49794	443	192.168.2.4	88.212.201.198
Oct 29, 2021 17:51:16.060513020 CEST	443	49794	88.212.201.198	192.168.2.4
Oct 29, 2021 17:51:16.064027071 CEST	443	49793	88.212.201.198	192.168.2.4
Oct 29, 2021 17:51:16.064127922 CEST	49793	443	192.168.2.4	88.212.201.198
Oct 29, 2021 17:51:16.064136982 CEST	443	49793	88.212.201.198	192.168.2.4
Oct 29, 2021 17:51:16.064225912 CEST	49793	443	192.168.2.4	88.212.201.198
Oct 29, 2021 17:51:16.064769983 CEST	49793	443	192.168.2.4	88.212.201.198
Oct 29, 2021 17:51:16.064807892 CEST	443	49793	88.212.201.198	192.168.2.4
Oct 29, 2021 17:51:16.067068100 CEST	49795	443	192.168.2.4	88.212.201.198
Oct 29, 2021 17:51:16.067107916 CEST	443	49795	88.212.201.198	192.168.2.4
Oct 29, 2021 17:51:16.067214012 CEST	49795	443	192.168.2.4	88.212.201.198
Oct 29, 2021 17:51:16.067758083 CEST	80	49782	193.109.247.229	192.168.2.4
Oct 29, 2021 17:51:16.067786932 CEST	49795	443	192.168.2.4	88.212.201.198
Oct 29, 2021 17:51:16.067804098 CEST	443	49795	88.212.201.198	192.168.2.4
Oct 29, 2021 17:51:16.067806005 CEST	80	49782	193.109.247.229	192.168.2.4
Oct 29, 2021 17:51:16.067868948 CEST	49782	80	192.168.2.4	193.109.247.229
Oct 29, 2021 17:51:16.068365097 CEST	49782	80	192.168.2.4	193.109.247.229
Oct 29, 2021 17:51:16.070466995 CEST	80	49783	193.109.247.229	192.168.2.4
Oct 29, 2021 17:51:16.070512056 CEST	80	49783	193.109.247.229	192.168.2.4
Oct 29, 2021 17:51:16.070537090 CEST	49783	80	192.168.2.4	193.109.247.229
Oct 29, 2021 17:51:16.070545912 CEST	80	49783	193.109.247.229	192.168.2.4
Oct 29, 2021 17:51:16.070559978 CEST	49783	80	192.168.2.4	193.109.247.229
Oct 29, 2021 17:51:16.070593119 CEST	49783	80	192.168.2.4	193.109.247.229
Oct 29, 2021 17:51:16.070837975 CEST	49782	80	192.168.2.4	193.109.247.229
Oct 29, 2021 17:51:16.074219942 CEST	49783	80	192.168.2.4	193.109.247.229
Oct 29, 2021 17:51:16.081327915 CEST	443	49790	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:16.081345081 CEST	443	49790	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:16.081433058 CEST	49790	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:16.081454039 CEST	49790	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:16.081468105 CEST	443	49790	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:16.081490040 CEST	443	49790	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:16.081588984 CEST	49790	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:16.081603050 CEST	443	49790	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:16.081693888 CEST	49790	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:16.081868887 CEST	443	49790	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:16.081970930 CEST	49790	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:16.081984043 CEST	443	49790	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:16.082071066 CEST	49790	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:16.082156897 CEST	443	49790	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:16.082251072 CEST	49790	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:16.082263947 CEST	443	49790	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:16.082372904 CEST	49790	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:16.086606979 CEST	443	49791	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:16.086642981 CEST	443	49791	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:16.086707115 CEST	49791	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:16.086743116 CEST	49791	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:16.086757898 CEST	443	49791	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:16.086899042 CEST	443	49791	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:16.086992025 CEST	49791	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:16.087007999 CEST	443	49791	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:16.087045908 CEST	443	49791	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:16.087068081 CEST	49791	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:16.087097883 CEST	443	49791	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:16.087130070 CEST	49791	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:16.087173939 CEST	49791	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:16.087225914 CEST	443	49791	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:16.087409973 CEST	443	49791	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:16.087488890 CEST	49791	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:16.087512016 CEST	443	49791	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:16.087528944 CEST	49791	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:16.087622881 CEST	49791	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:16.124212027 CEST	443	49790	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:16.124341965 CEST	49790	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:16.124358892 CEST	443	49790	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:16.124383926 CEST	443	49790	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:16.124444962 CEST	49790	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:16.124466896 CEST	443	49790	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:16.124741077 CEST	443	49790	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:16.124819040 CEST	49790	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:16.124833107 CEST	443	49790	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:16.124927998 CEST	443	49790	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:16.125001907 CEST	49790	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:16.125016928 CEST	443	49790	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:16.125072002 CEST	49790	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:16.125283003 CEST	443	49790	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:16.125358105 CEST	49790	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:16.125370979 CEST	443	49790	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:16.125401020 CEST	443	49790	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:16.125464916 CEST	49790	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:16.125478029 CEST	443	49790	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:16.125569105 CEST	49790	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:16.128918886 CEST	443	49791	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:16.129029989 CEST	49791	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:16.129055977 CEST	443	49791	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:16.129127979 CEST	49791	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:16.129196882 CEST	443	49791	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:16.129271984 CEST	49791	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:16.129290104 CEST	443	49791	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:16.129332066 CEST	49791	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:16.129447937 CEST	443	49791	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:16.129524946 CEST	49791	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:16.129539967 CEST	443	49791	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:16.129586935 CEST	49791	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:16.129609108 CEST	443	49791	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:16.129688025 CEST	49791	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:16.129699945 CEST	443	49791	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:16.129748106 CEST	49791	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:16.130562067 CEST	443	49791	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:16.130664110 CEST	49791	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:16.130680084 CEST	443	49791	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:16.130732059 CEST	49791	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:16.130825996 CEST	443	49791	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:16.130903959 CEST	49791	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:16.130919933 CEST	443	49791	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:16.130973101 CEST	49791	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:16.136607885 CEST	80	49782	193.109.247.229	192.168.2.4
Oct 29, 2021 17:51:16.136655092 CEST	80	49782	193.109.247.229	192.168.2.4
Oct 29, 2021 17:51:16.136683941 CEST	49782	80	192.168.2.4	193.109.247.229
Oct 29, 2021 17:51:16.136724949 CEST	49782	80	192.168.2.4	193.109.247.229
Oct 29, 2021 17:51:16.141700029 CEST	80	49783	193.109.247.229	192.168.2.4
Oct 29, 2021 17:51:16.141743898 CEST	80	49783	193.109.247.229	192.168.2.4
Oct 29, 2021 17:51:16.141783953 CEST	80	49783	193.109.247.229	192.168.2.4
Oct 29, 2021 17:51:16.141824007 CEST	80	49783	193.109.247.229	192.168.2.4
Oct 29, 2021 17:51:16.141838074 CEST	49783	80	192.168.2.4	193.109.247.229
Oct 29, 2021 17:51:16.141855001 CEST	80	49783	193.109.247.229	192.168.2.4
Oct 29, 2021 17:51:16.141875982 CEST	49783	80	192.168.2.4	193.109.247.229
Oct 29, 2021 17:51:16.141882896 CEST	49783	80	192.168.2.4	193.109.247.229
Oct 29, 2021 17:51:16.141887903 CEST	49783	80	192.168.2.4	193.109.247.229
Oct 29, 2021 17:51:16.141902924 CEST	49783	80	192.168.2.4	193.109.247.229
Oct 29, 2021 17:51:16.167511940 CEST	443	49790	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:16.167632103 CEST	443	49790	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:16.167659044 CEST	49790	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:16.167681932 CEST	443	49790	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:16.167711973 CEST	49790	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:16.167732000 CEST	49790	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:16.167871952 CEST	443	49790	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:16.167949915 CEST	49790	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:16.167963982 CEST	443	49790	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:16.168265104 CEST	443	49790	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:16.168353081 CEST	49790	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:16.168368101 CEST	443	49790	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:16.168632030 CEST	443	49790	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:16.168719053 CEST	443	49790	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:16.168723106 CEST	49790	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:16.168741941 CEST	443	49790	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:16.168781996 CEST	49790	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:16.168809891 CEST	49790	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:16.168819904 CEST	443	49790	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:16.168880939 CEST	49790	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:16.168893099 CEST	443	49790	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:16.170753956 CEST	49790	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:16.172152042 CEST	443	49791	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:16.172257900 CEST	49791	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:16.172283888 CEST	443	49791	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:16.172358990 CEST	49791	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:16.172466993 CEST	443	49791	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:16.172579050 CEST	49791	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:16.172597885 CEST	443	49791	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:16.172651052 CEST	49791	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:16.172703028 CEST	443	49791	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:16.172797918 CEST	49791	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:16.172815084 CEST	443	49791	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:16.172893047 CEST	49791	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:16.173058033 CEST	443	49791	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:16.173172951 CEST	49791	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:16.173197985 CEST	443	49791	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:16.173266888 CEST	49791	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:16.173363924 CEST	443	49791	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:16.173495054 CEST	443	49791	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:16.173590899 CEST	49791	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:16.173612118 CEST	443	49791	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:16.173713923 CEST	49791	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:16.173753023 CEST	443	49791	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:16.173841000 CEST	49791	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:16.179133892 CEST	443	49794	88.212.201.198	192.168.2.4
Oct 29, 2021 17:51:16.179271936 CEST	49794	443	192.168.2.4	88.212.201.198
Oct 29, 2021 17:51:16.194659948 CEST	443	49795	88.212.201.198	192.168.2.4
Oct 29, 2021 17:51:16.194962978 CEST	49795	443	192.168.2.4	88.212.201.198
Oct 29, 2021 17:51:16.226403952 CEST	49795	443	192.168.2.4	88.212.201.198
Oct 29, 2021 17:51:16.226429939 CEST	443	49795	88.212.201.198	192.168.2.4
Oct 29, 2021 17:51:16.230212927 CEST	49795	443	192.168.2.4	88.212.201.198
Oct 29, 2021 17:51:16.230230093 CEST	443	49795	88.212.201.198	192.168.2.4
Oct 29, 2021 17:51:16.230654955 CEST	49794	443	192.168.2.4	88.212.201.198
Oct 29, 2021 17:51:16.230673075 CEST	443	49794	88.212.201.198	192.168.2.4
Oct 29, 2021 17:51:16.237123013 CEST	49794	443	192.168.2.4	88.212.201.198
Oct 29, 2021 17:51:16.237145901 CEST	443	49794	88.212.201.198	192.168.2.4
Oct 29, 2021 17:51:16.237517118 CEST	49791	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:16.237550020 CEST	443	49791	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:16.239866972 CEST	49790	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:16.239917994 CEST	443	49790	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:16.395189047 CEST	443	49794	88.212.201.198	192.168.2.4
Oct 29, 2021 17:51:16.395298958 CEST	443	49794	88.212.201.198	192.168.2.4
Oct 29, 2021 17:51:16.395343065 CEST	49794	443	192.168.2.4	88.212.201.198
Oct 29, 2021 17:51:16.395363092 CEST	49794	443	192.168.2.4	88.212.201.198
Oct 29, 2021 17:51:16.396940947 CEST	49794	443	192.168.2.4	88.212.201.198
Oct 29, 2021 17:51:16.396970987 CEST	443	49794	88.212.201.198	192.168.2.4
Oct 29, 2021 17:51:16.420218945 CEST	443	49795	88.212.201.198	192.168.2.4
Oct 29, 2021 17:51:16.420306921 CEST	49795	443	192.168.2.4	88.212.201.198
Oct 29, 2021 17:51:16.420335054 CEST	443	49795	88.212.201.198	192.168.2.4
Oct 29, 2021 17:51:16.420416117 CEST	49795	443	192.168.2.4	88.212.201.198
Oct 29, 2021 17:51:16.432787895 CEST	49795	443	192.168.2.4	88.212.201.198
Oct 29, 2021 17:51:16.432821989 CEST	443	49795	88.212.201.198	192.168.2.4
Oct 29, 2021 17:51:20.785264969 CEST	49796	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:20.785350084 CEST	443	49796	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:20.785449982 CEST	49796	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:20.848257065 CEST	49796	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:20.848278046 CEST	443	49796	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:20.934581041 CEST	443	49796	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:20.934983015 CEST	49796	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:20.937721014 CEST	49796	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:20.937735081 CEST	443	49796	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:20.943073034 CEST	49796	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:20.943109989 CEST	443	49796	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:20.946856022 CEST	49797	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:20.946923018 CEST	443	49797	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:20.947021008 CEST	49797	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:20.947932005 CEST	49797	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:20.947973967 CEST	443	49797	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:21.020080090 CEST	443	49796	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:21.020198107 CEST	49796	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:21.020234108 CEST	443	49796	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:21.020294905 CEST	443	49796	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:21.020318985 CEST	49796	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:21.020375013 CEST	49796	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:21.022488117 CEST	49796	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:21.022531986 CEST	443	49796	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:21.025563955 CEST	49798	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:21.025619030 CEST	443	49798	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:21.025718927 CEST	49798	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:21.026580095 CEST	49798	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:21.026609898 CEST	443	49798	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:21.035330057 CEST	443	49797	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:21.035466909 CEST	49797	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:21.036009073 CEST	49797	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:21.036031961 CEST	443	49797	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:21.040112019 CEST	49797	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:21.040128946 CEST	443	49797	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:21.112166882 CEST	443	49798	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:21.112409115 CEST	49798	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:21.113662004 CEST	49798	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:21.113679886 CEST	443	49798	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:21.119508982 CEST	443	49797	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:21.119707108 CEST	443	49797	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:21.121391058 CEST	49797	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:21.124162912 CEST	49797	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:21.124201059 CEST	443	49797	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:21.124628067 CEST	49798	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:21.124648094 CEST	443	49798	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:21.126950979 CEST	49799	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:21.127002001 CEST	443	49799	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:21.127120018 CEST	49799	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:21.128032923 CEST	49799	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:21.128057003 CEST	443	49799	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:21.196330070 CEST	443	49798	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:21.196469069 CEST	49798	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:21.196505070 CEST	443	49798	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:21.196530104 CEST	443	49798	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:21.196629047 CEST	49798	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:21.196643114 CEST	49798	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:21.197206974 CEST	49798	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:21.197267056 CEST	443	49798	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:21.199352980 CEST	49800	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:21.199455976 CEST	443	49800	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:21.199565887 CEST	49800	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:21.199981928 CEST	49800	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:21.200018883 CEST	443	49800	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:21.213851929 CEST	443	49799	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:21.213963985 CEST	49799	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:21.214389086 CEST	49799	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:21.214401960 CEST	443	49799	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:21.217988968 CEST	49799	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:21.218005896 CEST	443	49799	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:21.288194895 CEST	443	49800	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:21.288319111 CEST	49800	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:21.288963079 CEST	49800	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:21.288981915 CEST	443	49800	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:21.292476892 CEST	49800	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:21.292496920 CEST	443	49800	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:21.298106909 CEST	443	49799	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:21.298239946 CEST	49799	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:21.298250914 CEST	443	49799	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:21.298312902 CEST	49799	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:21.298595905 CEST	49799	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:21.298618078 CEST	443	49799	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:21.300107956 CEST	49801	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:21.300143003 CEST	443	49801	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:21.300211906 CEST	49801	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:21.300774097 CEST	49801	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:21.300793886 CEST	443	49801	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:21.372479916 CEST	443	49800	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:21.372595072 CEST	49800	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:21.372621059 CEST	443	49800	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:21.372646093 CEST	443	49800	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:21.372736931 CEST	49800	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:21.372792006 CEST	49800	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:21.373806000 CEST	49800	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:21.373830080 CEST	443	49800	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:21.392185926 CEST	443	49801	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:21.392345905 CEST	49801	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:21.393182993 CEST	49801	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:21.393194914 CEST	443	49801	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:21.397862911 CEST	49801	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:21.397878885 CEST	443	49801	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:21.475016117 CEST	443	49801	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:21.475174904 CEST	49801	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:21.475186110 CEST	443	49801	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:21.475214958 CEST	443	49801	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:21.475285053 CEST	49801	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:21.475353956 CEST	49801	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:21.481211901 CEST	49801	443	192.168.2.4	87.250.251.119
Oct 29, 2021 17:51:21.481229067 CEST	443	49801	87.250.251.119	192.168.2.4
Oct 29, 2021 17:51:31.117208004 CEST	80	49783	193.109.247.229	192.168.2.4
Oct 29, 2021 17:51:31.117257118 CEST	80	49782	193.109.247.229	192.168.2.4
Oct 29, 2021 17:51:31.117348909 CEST	49783	80	192.168.2.4	193.109.247.229
Oct 29, 2021 17:51:31.117381096 CEST	49782	80	192.168.2.4	193.109.247.229

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 29, 2021 17:51:13.816387892 CEST	55854	53	192.168.2.4	8.8.8.8
Oct 29, 2021 17:51:14.822130919 CEST	55854	53	192.168.2.4	8.8.8.8
Oct 29, 2021 17:51:14.890239954 CEST	53	55854	8.8.8.8	192.168.2.4
Oct 29, 2021 17:51:14.924814939 CEST	53	55854	8.8.8.8	192.168.2.4
Oct 29, 2021 17:51:15.343087912 CEST	63153	53	192.168.2.4	8.8.8.8
Oct 29, 2021 17:51:15.362226963 CEST	53	63153	8.8.8.8	192.168.2.4
Oct 29, 2021 17:51:15.362785101 CEST	52991	53	192.168.2.4	8.8.8.8
Oct 29, 2021 17:51:15.381855965 CEST	53	52991	8.8.8.8	192.168.2.4

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Oct 29, 2021 17:51:14.924932003 CEST	192.168.2.4	8.8.8.8	d00d	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Oct 29, 2021 17:51:13.816387892 CEST	192.168.2.4	8.8.8.8	0xc22c	Standard query (0)	www.all-bearings.narod.ru	A (IP address)	IN (0x0001)
Oct 29, 2021 17:51:14.822130919 CEST	192.168.2.4	8.8.8.8	0xc22c	Standard query (0)	www.all-bearings.narod.ru	A (IP address)	IN (0x0001)
Oct 29, 2021 17:51:15.343087912 CEST	192.168.2.4	8.8.8.8	0x6b57	Standard query (0)	counter.yadro.ru	A (IP address)	IN (0x0001)
Oct 29, 2021 17:51:15.362785101 CEST	192.168.2.4	8.8.8.8	0xe7f9	Standard query (0)	mc.yandex.ru	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class
Oct 29, 2021 17:51:14.890239954 CEST	8.8.8.8	192.168.2.4	0xc22c	No error (0)	www.all-bearings.narod.ru	193.109.247.229	A (IP address)	IN (0x0001)
Oct 29, 2021 17:51:14.924814939 CEST	8.8.8.8	192.168.2.4	0xc22c	No error (0)	www.all-bearings.narod.ru	193.109.247.229	A (IP address)	IN (0x0001)
Oct 29, 2021 17:51:15.347728014 CEST	8.8.8.8	192.168.2.4	0x2fe6	No error (0)	www-google-analytics.l.google.com	142.250.203.110	A (IP address)	IN (0x0001)
Oct 29, 2021 17:51:15.362226963 CEST	8.8.8.8	192.168.2.4	0x6b57	No error (0)	counter.yadro.ru	88.212.201.198	A (IP address)	IN (0x0001)
Oct 29, 2021 17:51:15.362226963 CEST	8.8.8.8	192.168.2.4	0x6b57	No error (0)	counter.yadro.ru	88.212.201.210	A (IP address)	IN (0x0001)
Oct 29, 2021 17:51:15.362226963 CEST	8.8.8.8	192.168.2.4	0x6b57	No error (0)	counter.yadro.ru	88.212.201.216	A (IP address)	IN (0x0001)
Oct 29, 2021 17:51:15.362226963 CEST	8.8.8.8	192.168.2.4	0x6b57	No error (0)	counter.yadro.ru	88.212.201.204	A (IP address)	IN (0x0001)
Oct 29, 2021 17:51:15.381855965 CEST	8.8.8.8	192.168.2.4	0xe7f9	No error (0)	mc.yandex.ru	87.250.251.119	A (IP address)	IN (0x0001)
Oct 29, 2021 17:51:15.381855965 CEST	8.8.8.8	192.168.2.4	0xe7f9	No error (0)	mc.yandex.ru	87.250.250.119	A (IP address)	IN (0x0001)
Oct 29, 2021 17:51:15.381855965 CEST	8.8.8.8	192.168.2.4	0xe7f9	No error (0)	mc.yandex.ru	77.88.21.119	A (IP address)	IN (0x0001)
Oct 29, 2021 17:51:15.381855965 CEST	8.8.8.8	192.168.2.4	0xe7f9	No error (0)	mc.yandex.ru	93.158.134.119	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

www.all-bearings.narod.ru

mc.yandex.ru

counter.yadro.ru

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.4	49790	87.250.251.119	443	C:\Users\user\Desktop\njw.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.4	49792	88.212.201.198	443	C:\Users\user\Desktop\njw.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.2.4	49800	87.250.251.119	443	C:\Users\user\Desktop\njw.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	192.168.2.4	49801	87.250.251.119	443	C:\Users\user\Desktop\njw.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
12	192.168.2.4	49782	193.109.247.229	80	C:\Users\user\Desktop\njw.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 17:51:14.979448080 CEST	1390	OUT	GET /secondpage.html HTTP/1.1 Accept: / Accept-Language: en-US Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: www.all-bearings.narod.ru Connection: Keep-Alive
Oct 29, 2021 17:51:15.045492887 CEST	1391	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 29 Oct 2021 15:51:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=15 ETag: W/"611e66ad-1ad5" Content-Encoding: gzip Data Raw: 61 30 31 0d 0a 1f 8b 08 00 00 00 00 00 00 03 9d 59 fb 6f db 38 12 fe 3d 7f 05 ab e0 60 bb 89 25 bf 92 a6 7e 15 6d da c5 2e 90 6e 7b bb e9 1d 8a a2 28 68 89 b6 d8 48 a2 4a 52 71 bc d9 fc ef 37 43 ea 65 5b 4e ba 67 a1 91 c4 c7 70 e6 9b 99 8f 43 75 fa ec ed 87 cb eb cf 1f df 91 50 c7 d1 fc 68 5a dc 18 0d e6 47 04 7e d3 98 69 0a bd 3a ed b2 1f 19 bf 9d 39 be 48 34 4b 74 57 6f 52 e6 90 fc 6d e6 68 76 a7 3d 9c 3e 21 7e 48 a5 62 7a 96 e9 65 f7 c2 21 5e 2e 49 73 1d b1 f9 af d7 d7 1f c9 a8 37 22 7f 30 25 32 e9 33 92 08 4d 96 22 4b 82 a9 67 87 1c 4d 95 de 44 8c e0 0a b9 60 5f 29 67 7e b4 10 c1 86 dc c7 54 ae 78 32 26 bd 09 49 69 10 f0 64 65 9e 17 d4 bf 59 49 94 33 26 c7 cb e5 72 02 42 13 3d 26 fd 41 7a e7 0d e0 0f 69 fd 87 c9 80 26 b4 05 2a 8a 48 48 18 77 7e 81 d7 e4 c1 8a a6 e4 be e8 18 0e e8 c0 07 19 b8 7a 37 60 be 90 54 73 01 ab 82 7c 26 23 9e b0 72 d2 38 14 b7 4c 92 fb bd a1 89 30 a3 74 70 4a 78 92 66 fa 94 28 16 31 1f ee 38 94 4a 06 eb 55 3a 92 a7 95 74 fd 88 51 58 c9 dc c6 64 21 74 68 5a ad 0f c8 fd 9a 07 3a 1c 93 17 c3 b3 f4 6e 42 0a 9c 68 a6 05 0c f3 9e 77 f3 1f 7a 97 49 fb fc dc 3b 3a b6 ef e4 3e 64 7c 15 82 36 67 66 7a 1d cf 4c 46 6d cf 55 1e 8f 57 1e 93 d2 03 ff 15 52 10 0a 77 c5 97 1d 22 59 ca a8 ee de 91 1e f8 17 24 3c 1c 1d 47 62 25 c0 c6 48 50 10 1b b1 a5 ae b4 aa 7b 6f 70 9e e2 ac 1e 36 e6 36 8c 86 a8 43 a1 d1 e0 45 4d 1e a0 16 70 95 46 74 03 10 44 c2 bf a9 c7 01 79 89 f3 0e 0b 21 e8 2b 50 68 3d 26 21 0f 02 96 40 4b a6 d1 88 dc 5f d6 e3 1c bc 8c 8e e9 be 84 df 2e 1a 18 5d 8d 90 a0 7a 6e 9a ac 3a 20 aa 6b e1 20 3e c8 01 70 ed 0d bd a5 b8 66 5d 1f 9c af 59 09 8d 44 0d 2b 6c ea 78 3c 62 ea 99 19 d5 37 de ca e3 a8 8f b1 7e 7e 20 8c 5e f8 3d 36 f8 49 53 a8 94 62 bd 6b 0b 7a 90 f4 ad 6f ab 70 aa ff 20 9c aa 8e 98 f2 a4 d6 71 8c ef e4 be 34 e0 ac 67 f4 3f 33 66 20 32 66 bc 59 63 3b 64 72 6f f6 cf 71 65 eb 1f 1a f1 15 00 55 a1 0a 7a 0b 69 e8 a3 cc a9 0b c4 62 d4 8c c5 0b b6 18 05 83 72 a2 2f 02 56 11 4b df 2a 36 b0 8a 95 cb db b4 28 a2 e9 fc fc 27 92 64 07 40 5c 2f a5 2b 06 8c 67 08 af 54 75 84 aa f6 0e a9 8a d7 de 54 9a 13 8e 96 34 51 4b 21 63 50 20 4d 99 f4 a9 62 4d 76 1a 70 4d 9c 35 a3 3b 7a b9 45 1a 26 fa c8 85 f5 75 7d 72 38 dc 62 e0 1a c7 22 e0 4d 06 0c 86 78 95 62 4a b6 6a 62 82 fe b0 8c fc dd f1 59 54 4d 19 96 91 0f 19 8a 6a d7 37 82 88 2b dd 35 3b 48 49 c1 c7 0a 08 d3 0f c9 3d e6 9f 79 5c 0b 19 94 84 39 7c d1 db 16 42 b6 5c 3d 30 bd c8 11 dd ed a6 1d e6 58 80 4c 06 16 43 12 12 25 22 1e 90 63 7f 89 57 d1 d5 95 34 e0 99 1a 5b f1 40 44 9a fb 34 2a 82 39 06 3e 8a 8c a3 ad 8a 6a 11 3f 1a 20 a5 2e 03 94 56 a0 7d 36 a2 41 b9 71 a9 90 06 48 75 3d a3 13 fe b3 3b 63 cd 52 23 15 37 1e 6b 52 93 0d 43 bc c8 33 1e a7 90 62 34 d1 cd e6 6c d1 0a bb c0 6b 2f 25 16 99 d6 22 b1 59 51 6c 17 a0 7a 26 15 ea 9e 0a 6e d2 79 17 d7 03 40 d5 a8 fc 96 2b be 30 d8 3d 1f 2f b9 04 ff fb 21 8f 82 13 ac 47 48 1d ce c2 bc 5e dd 9c 9f 21 b3 a5 10 ba d8 33 0d 99 d9 86 1a 9d f5 cf 2a d2 ce f1 d1 22 dd 42 32 58 e0 85 1e ce c5 81 d3 9a b3 71 30 72 5f fe 6b 67 60 38 22 f7 5b f9 d9 cf 09 aa c6 fd fd 03 7c 77 76 8e d7 8e 40 cc a8 c6 fd b8 39 89 76 a6 46 1c 66 d7 97 3e 90 fe 17 14 af 9d f9 30 19 08 6c 77 cc 7e b5 d5 b0 34 4e 3d 58 72 d5 ab b3 83 4e 9d 7a c6 30 a8 33 3d 5b e8 4e b1 90 c3 b2 d3 97 3c d5 f5 ba f3 3b bd a5 b6 d5 c1 2a f6 16 aa af 6f 2b fa 83 cc ec Data Ascii: a01Yo8=`%~m.n{(hHJRq7Ce[NgpCuPhZG~i:9H4KtWoRmhv=>!~Hbze!^.Is7"0%23M"KgMD`_)g~Tx2&IideYI3&rB=&Azi&HHw~z7`Ts\|&#r8L0tpJxf(18JU:tQXd!thZ:nBhwzI;:>d\|6gfzLFmUWRw"Y$<Gb%HP{op66CEMpFtDy!+Ph=&!@K_.]zn: k >pf]YD+lx<b7~~ ^=6ISbkzop q4g?3f 2fYc;droqeUzibr/VK6('d@\/+gTuT4QK!cP MbMvpM5;zE&u}r8b"MxbJjbYTMj7+5;HI=y\9\|B\=0XLC%"cW4[@D49>j? .V}6AqHu=;cR#7kRC3b4lk/%"YQlz&ny@+0=/!GH^!3"B2Xq0r_kg`8"[\|wv@9vFf>0lw~4N=XrNz03=[N<;*o+
Oct 29, 2021 17:51:15.045532942 CEST	1393	IN	Data Raw: ed ef bf c9 97 af 13 e8 c0 37 37 cd 54 d8 fe d2 fa 06 b5 ef 6b df 87 4c d0 ad 53 d2 fa f4 ba 3b ec f5 a0 8c 38 eb 77 fb ad af 9d a6 e1 6f 05 52 dd ef 34 66 38 03 8d 3e 30 f0 75 04 f1 7e c5 93 1b 26 61 a4 96 19 6b 18 07 5b 82 7f f3 11 36 8b 5b ce Data Ascii: 77TkLS;8woR4f8>0u~&ak[6[2K\|!G[V,-JE-kw3a.bc[;L'U^gbCnA[dV[J07B+<wx]9!-w%*b]h=XjMJT9/`[0w(\(
Oct 29, 2021 17:51:15.045563936 CEST	1393	IN	Data Raw: 11 07 89 ea 2e 2c dd 36 48 cd 87 3f 22 18 4f 08 7a cd 35 d6 ca 28 f4 f8 99 91 fb 8d 25 0d a0 db 71 ff 07 4c bf b2 28 7d 02 21 38 70 3d 86 cf eb 7f 3f 8e 8e 41 e5 f0 f6 74 0d 29 bc 85 c4 cf eb 7e c5 56 34 02 e2 c2 2c 35 45 d6 3f 09 78 26 63 e5 e1 Data Ascii: .,6H?"Oz5(%qL(}!8p=?At)~V4,5E?x&cpGN?[o<D>f++IN0
Oct 29, 2021 17:51:15.785819054 CEST	1457	OUT	GET /.s/img/err/404-header-line.gif HTTP/1.1 Accept: / Referer: http://www.all-bearings.narod.ru/secondpage.html Accept-Language: en-US Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: www.all-bearings.narod.ru Connection: Keep-Alive
Oct 29, 2021 17:51:15.851555109 CEST	1458	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 29 Oct 2021 15:51:17 GMT Content-Type: image/gif Content-Length: 1161 Last-Modified: Mon, 31 Jul 2017 10:32:10 GMT Connection: keep-alive Keep-Alive: timeout=15 ETag: "597f072a-489" Expires: Thu, 18 Nov 2021 15:51:17 GMT Cache-Control: max-age=1728000 Accept-Ranges: bytes
Oct 29, 2021 17:51:15.851598978 CEST	1459	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ac dd ef 00 00 00 21 ff 0b 58 4d 50 20 44 61 74 61 58 4d 50 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 Data Ascii: GIF89a!XMP DataXMP<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/
Oct 29, 2021 17:51:15.859746933 CEST	1461	OUT	GET /.s/img/err/404-logo.png HTTP/1.1 Accept: / Referer: http://www.all-bearings.narod.ru/secondpage.html Accept-Language: en-US Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: www.all-bearings.narod.ru Connection: Keep-Alive
Oct 29, 2021 17:51:15.925540924 CEST	1462	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 29 Oct 2021 15:51:17 GMT Content-Type: image/png Content-Length: 2152 Last-Modified: Mon, 31 Jul 2017 10:32:10 GMT Connection: keep-alive Keep-Alive: timeout=15 ETag: "597f072a-868" Expires: Thu, 18 Nov 2021 15:51:17 GMT Cache-Control: max-age=1728000 Accept-Ranges: bytes
Oct 29, 2021 17:51:15.925595999 CEST	1463	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 2b 00 00 00 1b 08 06 00 00 00 e5 27 76 6d 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 64 69 54 58 74 58 4d 4c 3a Data Ascii: PNGIHDR+'vmtEXtSoftwareAdobe ImageReadyqe<diTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/0
Oct 29, 2021 17:51:15.925632954 CEST	1464	IN	Data Raw: 43 70 5c f9 f8 de c0 58 26 fd 3d 00 79 52 fe 0a 65 0b 33 fb 8d 70 cc 08 3d bf a3 f9 3c aa 0b cc 62 47 42 e9 74 31 bf 71 08 65 23 cb 1f 0e 0c 7e 5c cb 19 7d 61 ac f2 ae 51 a4 40 7d e9 5a fe 68 5e ee 94 5f 4f d7 0c 56 ca 6f 07 49 f9 cf 7d 6e f5 10 Data Ascii: Cp\X&=yRe3p=<bGBt1qe#~\}aQ@}Zh^_OVoI}nWt{s(cz[iB\|mIY/:B>n_`cx;[$;=/YbN@YvUlu5=RQ61qxinfp5($>>!p\
Oct 29, 2021 17:51:15.932754993 CEST	1466	OUT	GET /.s/img/err/404.png HTTP/1.1 Accept: / Referer: http://www.all-bearings.narod.ru/secondpage.html Accept-Language: en-US Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: www.all-bearings.narod.ru Connection: Keep-Alive
Oct 29, 2021 17:51:15.998469114 CEST	1469	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 29 Oct 2021 15:51:17 GMT Content-Type: image/png Content-Length: 4451 Last-Modified: Mon, 31 Jul 2017 10:32:10 GMT Connection: keep-alive Keep-Alive: timeout=15 ETag: "597f072a-1163" Expires: Thu, 18 Nov 2021 15:51:17 GMT Cache-Control: max-age=1728000 Accept-Ranges: bytes
Oct 29, 2021 17:51:15.998507023 CEST	1470	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 9b 00 00 00 42 08 06 00 00 00 40 50 a4 6b 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 64 69 54 58 74 58 4d 4c 3a Data Ascii: PNGIHDRB@PktEXtSoftwareAdobe ImageReadyqe<diTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/0
Oct 29, 2021 17:51:15.998537064 CEST	1472	IN	Data Raw: 7a 39 65 5f 9f 8d 87 24 30 07 24 68 fb 21 9a e0 f8 37 fe 86 cf fe fb 7e 0a 6d 76 f3 9d 79 ad 18 06 fb 84 84 ee 59 d5 82 49 3e 89 c0 7a 9b 52 94 f1 a6 08 c2 56 27 8d d2 21 a6 e4 65 1e 4e 88 76 0d 82 61 dc 9a b1 af 48 d0 de 5c cf 8e 42 20 bc 88 bf Data Ascii: z9e_$0$h!7~mvyYI>zRV'!eNvaH\B F>#ksBF[BjpJyu1G3Y=A{Z5kd"~}9c {Y_iqx?]bRH/lZjY"8_iv]}~;m`:<7QgSJz\w$
Oct 29, 2021 17:51:15.998560905 CEST	1473	IN	Data Raw: be 9f 29 66 2b 2c 6f 56 f1 46 11 7c ec 19 e1 8e 88 a0 43 22 30 2a 75 a5 a3 f1 92 76 eb 56 cb c8 eb 95 86 3e 92 fa aa b0 1d 85 e6 cd 2a 9a ad c7 39 b7 6f b4 46 d0 aa f6 b2 20 3b 23 cd 66 e7 1c df ca da 1b 2d 34 6f 96 15 b6 0e 0b 23 dd fe 8f e2 df Data Ascii: )f+,oVF\|C"0uvV>9oF ;#f-4o#+27xo9ss T/_cyv'kV9Wh%\|.Xu}Vl,$\|M{>`Fu1C2a6*&Darkf5\Zy?A\}
Oct 29, 2021 17:51:15.998579979 CEST	1473	IN	Data Raw: a3 69 44 fb db 25 03 1a 2e 92 36 26 ee bb b1 b8 7f b4 2b 2e c4 48 f7 4e dc 1f 7a 82 5b 94 27 0b b1 b5 e7 5b 16 ee 17 3d 0a b1 1a 2b 78 d5 c3 9b 1c 35 5b fd 7d 42 ca 4c 78 c8 70 4d e3 b8 1e 92 b0 1d fd 64 db 8a 09 83 78 ec f4 72 06 5c 72 92 c2 43 Data Ascii: iD%.6&+.HNz['[=+x5[}BLxpMdxr\rCE;O^:(Ot$uP\|9lM_3SF"&]YM'18j\|KYEe;,v,2Nt&AbSdN~s=~wOv
Oct 29, 2021 17:51:16.002221107 CEST	1477	OUT	GET /.s/img/err/404-header-line.gif HTTP/1.1 Accept: / Referer: http://www.all-bearings.narod.ru/firstpage.html Accept-Language: en-US Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: www.all-bearings.narod.ru Connection: Keep-Alive
Oct 29, 2021 17:51:16.067758083 CEST	1493	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 29 Oct 2021 15:51:17 GMT Content-Type: image/gif Content-Length: 1161 Last-Modified: Mon, 31 Jul 2017 10:32:10 GMT Connection: keep-alive Keep-Alive: timeout=15 ETag: "597f072a-489" Expires: Thu, 18 Nov 2021 15:51:17 GMT Cache-Control: max-age=1728000 Accept-Ranges: bytes
Oct 29, 2021 17:51:16.067806005 CEST	1495	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ac dd ef 00 00 00 21 ff 0b 58 4d 50 20 44 61 74 61 58 4d 50 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 Data Ascii: GIF89a!XMP DataXMP<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/
Oct 29, 2021 17:51:16.070837975 CEST	1498	OUT	GET /.s/img/err/404-arrow.png HTTP/1.1 Accept: / Referer: http://www.all-bearings.narod.ru/firstpage.html Accept-Language: en-US Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: www.all-bearings.narod.ru Connection: Keep-Alive
Oct 29, 2021 17:51:16.136607885 CEST	1664	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 29 Oct 2021 15:51:17 GMT Content-Type: image/png Content-Length: 1169 Last-Modified: Mon, 31 Jul 2017 10:32:10 GMT Connection: keep-alive Keep-Alive: timeout=15 ETag: "597f072a-491" Expires: Thu, 18 Nov 2021 15:51:17 GMT Cache-Control: max-age=1728000 Accept-Ranges: bytes

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
13	192.168.2.4	49783	193.109.247.229	80	C:\Users\user\Desktop\njw.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 17:51:15.015364885 CEST	1390	OUT	GET /firstpage.html HTTP/1.1 Accept: / Accept-Language: en-US Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: www.all-bearings.narod.ru Connection: Keep-Alive
Oct 29, 2021 17:51:15.082951069 CEST	1395	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 29 Oct 2021 15:51:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=15 ETag: W/"611e66ad-1ad5" Content-Encoding: gzip Data Raw: 61 30 31 0d 0a 1f 8b 08 00 00 00 00 00 00 03 9d 59 fb 6f db 38 12 fe 3d 7f 05 ab e0 60 bb 89 25 bf 92 a6 7e 15 6d da c5 2e 90 6e 7b bb e9 1d 8a a2 28 68 89 b6 d8 48 a2 4a 52 71 bc d9 fc ef 37 43 ea 65 5b 4e ba 67 a1 91 c4 c7 70 e6 9b 99 8f 43 75 fa ec ed 87 cb eb cf 1f df 91 50 c7 d1 fc 68 5a dc 18 0d e6 47 04 7e d3 98 69 0a bd 3a ed b2 1f 19 bf 9d 39 be 48 34 4b 74 57 6f 52 e6 90 fc 6d e6 68 76 a7 3d 9c 3e 21 7e 48 a5 62 7a 96 e9 65 f7 c2 21 5e 2e 49 73 1d b1 f9 af d7 d7 1f c9 a8 37 22 7f 30 25 32 e9 33 92 08 4d 96 22 4b 82 a9 67 87 1c 4d 95 de 44 8c e0 0a b9 60 5f 29 67 7e b4 10 c1 86 dc c7 54 ae 78 32 26 bd 09 49 69 10 f0 64 65 9e 17 d4 bf 59 49 94 33 26 c7 cb e5 72 02 42 13 3d 26 fd 41 7a e7 0d e0 0f 69 fd 87 c9 80 26 b4 05 2a 8a 48 48 18 77 7e 81 d7 e4 c1 8a a6 e4 be e8 18 0e e8 c0 07 19 b8 7a 37 60 be 90 54 73 01 ab 82 7c 26 23 9e b0 72 d2 38 14 b7 4c 92 fb bd a1 89 30 a3 74 70 4a 78 92 66 fa 94 28 16 31 1f ee 38 94 4a 06 eb 55 3a 92 a7 95 74 fd 88 51 58 c9 dc c6 64 21 74 68 5a ad 0f c8 fd 9a 07 3a 1c 93 17 c3 b3 f4 6e 42 0a 9c 68 a6 05 0c f3 9e 77 f3 1f 7a 97 49 fb fc dc 3b 3a b6 ef e4 3e 64 7c 15 82 36 67 66 7a 1d cf 4c 46 6d cf 55 1e 8f 57 1e 93 d2 03 ff 15 52 10 0a 77 c5 97 1d 22 59 ca a8 ee de 91 1e f8 17 24 3c 1c 1d 47 62 25 c0 c6 48 50 10 1b b1 a5 ae b4 aa 7b 6f 70 9e e2 ac 1e 36 e6 36 8c 86 a8 43 a1 d1 e0 45 4d 1e a0 16 70 95 46 74 03 10 44 c2 bf a9 c7 01 79 89 f3 0e 0b 21 e8 2b 50 68 3d 26 21 0f 02 96 40 4b a6 d1 88 dc 5f d6 e3 1c bc 8c 8e e9 be 84 df 2e 1a 18 5d 8d 90 a0 7a 6e 9a ac 3a 20 aa 6b e1 20 3e c8 01 70 ed 0d bd a5 b8 66 5d 1f 9c af 59 09 8d 44 0d 2b 6c ea 78 3c 62 ea 99 19 d5 37 de ca e3 a8 8f b1 7e 7e 20 8c 5e f8 3d 36 f8 49 53 a8 94 62 bd 6b 0b 7a 90 f4 ad 6f ab 70 aa ff 20 9c aa 8e 98 f2 a4 d6 71 8c ef e4 be 34 e0 ac 67 f4 3f 33 66 20 32 66 bc 59 63 3b 64 72 6f f6 cf 71 65 eb 1f 1a f1 15 00 55 a1 0a 7a 0b 69 e8 a3 cc a9 0b c4 62 d4 8c c5 0b b6 18 05 83 72 a2 2f 02 56 11 4b df 2a 36 b0 8a 95 cb db b4 28 a2 e9 fc fc 27 92 64 07 40 5c 2f a5 2b 06 8c 67 08 af 54 75 84 aa f6 0e a9 8a d7 de 54 9a 13 8e 96 34 51 4b 21 63 50 20 4d 99 f4 a9 62 4d 76 1a 70 4d 9c 35 a3 3b 7a b9 45 1a 26 fa c8 85 f5 75 7d 72 38 dc 62 e0 1a c7 22 e0 4d 06 0c 86 78 95 62 4a b6 6a 62 82 fe b0 8c fc dd f1 59 54 4d 19 96 91 0f 19 8a 6a d7 37 82 88 2b dd 35 3b 48 49 c1 c7 0a 08 d3 0f c9 3d e6 9f 79 5c 0b 19 94 84 39 7c d1 db 16 42 b6 5c 3d 30 bd c8 11 dd ed a6 1d e6 58 80 4c 06 16 43 12 12 25 22 1e 90 63 7f 89 57 d1 d5 95 34 e0 99 1a 5b f1 40 44 9a fb 34 2a 82 39 06 3e 8a 8c a3 ad 8a 6a 11 3f 1a 20 a5 2e 03 94 56 a0 7d 36 a2 41 b9 71 a9 90 06 48 75 3d a3 13 fe b3 3b 63 cd 52 23 15 37 1e 6b 52 93 0d 43 bc c8 33 1e a7 90 62 34 d1 cd e6 6c d1 0a bb c0 6b 2f 25 16 99 d6 22 b1 59 51 6c 17 a0 7a 26 15 ea 9e 0a 6e d2 79 17 d7 03 40 d5 a8 fc 96 2b be 30 d8 3d 1f 2f b9 04 ff fb 21 8f 82 13 ac 47 48 1d ce c2 bc 5e dd 9c 9f 21 b3 a5 10 ba d8 33 0d 99 d9 86 1a 9d f5 cf 2a d2 ce f1 d1 22 dd 42 32 58 e0 85 1e ce c5 81 d3 9a b3 71 30 72 5f fe 6b 67 60 38 22 f7 5b f9 d9 cf 09 aa c6 fd fd 03 7c 77 76 8e d7 8e 40 cc a8 c6 fd b8 39 89 76 a6 46 1c 66 d7 97 3e 90 fe 17 14 af 9d f9 30 19 08 6c 77 cc 7e b5 d5 b0 34 4e 3d 58 72 d5 ab b3 83 4e 9d 7a c6 30 a8 33 3d 5b e8 4e b1 90 c3 b2 d3 97 3c d5 f5 ba f3 3b bd a5 b6 d5 c1 2a f6 16 aa af 6f 2b fa 83 cc ec Data Ascii: a01Yo8=`%~m.n{(hHJRq7Ce[NgpCuPhZG~i:9H4KtWoRmhv=>!~Hbze!^.Is7"0%23M"KgMD`_)g~Tx2&IideYI3&rB=&Azi&HHw~z7`Ts\|&#r8L0tpJxf(18JU:tQXd!thZ:nBhwzI;:>d\|6gfzLFmUWRw"Y$<Gb%HP{op66CEMpFtDy!+Ph=&!@K_.]zn: k >pf]YD+lx<b7~~ ^=6ISbkzop q4g?3f 2fYc;droqeUzibr/VK6('d@\/+gTuT4QK!cP MbMvpM5;zE&u}r8b"MxbJjbYTMj7+5;HI=y\9\|B\=0XLC%"cW4[@D49>j? .V}6AqHu=;cR#7kRC3b4lk/%"YQlz&ny@+0=/!GH^!3"B2Xq0r_kg`8"[\|wv@9vFf>0lw~4N=XrNz03=[N<;*o+
Oct 29, 2021 17:51:15.082993984 CEST	1396	IN	Data Raw: ed ef bf c9 97 af 13 e8 c0 37 37 cd 54 d8 fe d2 fa 06 b5 ef 6b df 87 4c d0 ad 53 d2 fa f4 ba 3b ec f5 a0 8c 38 eb 77 fb ad af 9d a6 e1 6f 05 52 dd ef 34 66 38 03 8d 3e 30 f0 75 04 f1 7e c5 93 1b 26 61 a4 96 19 6b 18 07 5b 82 7f f3 11 36 8b 5b ce Data Ascii: 77TkLS;8woR4f8>0u~&ak[6[2K\|!G[V,-JE-kw3a.bc[;L'U^gbCnA[dV[J07B+<wx]9!-w%*b]h=XjMJT9/`[0w(\(
Oct 29, 2021 17:51:15.083020926 CEST	1396	IN	Data Raw: 11 07 89 ea 2e 2c dd 36 48 cd 87 3f 22 18 4f 08 7a cd 35 d6 ca 28 f4 f8 99 91 fb 8d 25 0d a0 db 71 ff 07 4c bf b2 28 7d 02 21 38 70 3d 86 cf eb 7f 3f 8e 8e 41 e5 f0 f6 74 0d 29 bc 85 c4 cf eb 7e c5 56 34 02 e2 c2 2c 35 45 d6 3f 09 78 26 63 e5 e1 Data Ascii: .,6H?"Oz5(%qL(}!8p=?At)~V4,5E?x&cpGN?[o<D>f++IN0
Oct 29, 2021 17:51:15.785171032 CEST	1457	OUT	GET /.s/img/err/button.png HTTP/1.1 Accept: / Referer: http://www.all-bearings.narod.ru/secondpage.html Accept-Language: en-US Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: www.all-bearings.narod.ru Connection: Keep-Alive
Oct 29, 2021 17:51:15.852315903 CEST	1459	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 29 Oct 2021 15:51:17 GMT Content-Type: image/png Content-Length: 1036 Last-Modified: Mon, 31 Jul 2017 10:32:10 GMT Connection: keep-alive Keep-Alive: timeout=15 ETag: "597f072a-40c" Expires: Thu, 18 Nov 2021 15:51:17 GMT Cache-Control: max-age=1728000 Accept-Ranges: bytes
Oct 29, 2021 17:51:15.852349997 CEST	1460	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 14 08 02 00 00 00 c3 6c c0 f6 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 64 69 54 58 74 58 4d 4c 3a Data Ascii: PNGIHDRltEXtSoftwareAdobe ImageReadyqe<diTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/0
Oct 29, 2021 17:51:15.858786106 CEST	1461	OUT	GET /.s/img/err/404-arrow.png HTTP/1.1 Accept: / Referer: http://www.all-bearings.narod.ru/secondpage.html Accept-Language: en-US Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: www.all-bearings.narod.ru Connection: Keep-Alive
Oct 29, 2021 17:51:15.925990105 CEST	1464	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 29 Oct 2021 15:51:17 GMT Content-Type: image/png Content-Length: 1169 Last-Modified: Mon, 31 Jul 2017 10:32:10 GMT Connection: keep-alive Keep-Alive: timeout=15 ETag: "597f072a-491" Expires: Thu, 18 Nov 2021 15:51:17 GMT Cache-Control: max-age=1728000 Accept-Ranges: bytes
Oct 29, 2021 17:51:15.926028013 CEST	1466	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 06 00 00 00 09 08 06 00 00 00 11 9a 5d 9d 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 64 69 54 58 74 58 4d 4c 3a Data Ascii: PNGIHDR]tEXtSoftwareAdobe ImageReadyqe<diTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/0
Oct 29, 2021 17:51:15.933043003 CEST	1467	OUT	GET /.s/img/err/button.png HTTP/1.1 Accept: / Referer: http://www.all-bearings.narod.ru/firstpage.html Accept-Language: en-US Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: www.all-bearings.narod.ru Connection: Keep-Alive
Oct 29, 2021 17:51:16.000112057 CEST	1474	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 29 Oct 2021 15:51:17 GMT Content-Type: image/png Content-Length: 1036 Last-Modified: Mon, 31 Jul 2017 10:32:10 GMT Connection: keep-alive Keep-Alive: timeout=15 ETag: "597f072a-40c" Expires: Thu, 18 Nov 2021 15:51:17 GMT Cache-Control: max-age=1728000 Accept-Ranges: bytes
Oct 29, 2021 17:51:16.000145912 CEST	1476	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 14 08 02 00 00 00 c3 6c c0 f6 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 64 69 54 58 74 58 4d 4c 3a Data Ascii: PNGIHDRltEXtSoftwareAdobe ImageReadyqe<diTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/0
Oct 29, 2021 17:51:16.003344059 CEST	1478	OUT	GET /.s/img/err/404-logo.png HTTP/1.1 Accept: / Referer: http://www.all-bearings.narod.ru/firstpage.html Accept-Language: en-US Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: www.all-bearings.narod.ru Connection: Keep-Alive
Oct 29, 2021 17:51:16.070466995 CEST	1495	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 29 Oct 2021 15:51:17 GMT Content-Type: image/png Content-Length: 2152 Last-Modified: Mon, 31 Jul 2017 10:32:10 GMT Connection: keep-alive Keep-Alive: timeout=15 ETag: "597f072a-868" Expires: Thu, 18 Nov 2021 15:51:17 GMT Cache-Control: max-age=1728000 Accept-Ranges: bytes
Oct 29, 2021 17:51:16.070512056 CEST	1497	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 2b 00 00 00 1b 08 06 00 00 00 e5 27 76 6d 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 64 69 54 58 74 58 4d 4c 3a Data Ascii: PNGIHDR+'vmtEXtSoftwareAdobe ImageReadyqe<diTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/0
Oct 29, 2021 17:51:16.070545912 CEST	1498	IN	Data Raw: 43 70 5c f9 f8 de c0 58 26 fd 3d 00 79 52 fe 0a 65 0b 33 fb 8d 70 cc 08 3d bf a3 f9 3c aa 0b cc 62 47 42 e9 74 31 bf 71 08 65 23 cb 1f 0e 0c 7e 5c cb 19 7d 61 ac f2 ae 51 a4 40 7d e9 5a fe 68 5e ee 94 5f 4f d7 0c 56 ca 6f 07 49 f9 cf 7d 6e f5 10 Data Ascii: Cp\X&=yRe3p=<bGBt1qe#~\}aQ@}Zh^_OVoI}nWt{s(cz[iB\|mIY/:B>n_`cx;[$;=/YbN@YvUlu5=RQ61qxinfp5($>>!p\
Oct 29, 2021 17:51:16.074219942 CEST	1499	OUT	GET /.s/img/err/404.png HTTP/1.1 Accept: / Referer: http://www.all-bearings.narod.ru/firstpage.html Accept-Language: en-US Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: www.all-bearings.narod.ru Connection: Keep-Alive
Oct 29, 2021 17:51:16.141700029 CEST	1666	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 29 Oct 2021 15:51:17 GMT Content-Type: image/png Content-Length: 4451 Last-Modified: Mon, 31 Jul 2017 10:32:10 GMT Connection: keep-alive Keep-Alive: timeout=15 ETag: "597f072a-1163" Expires: Thu, 18 Nov 2021 15:51:17 GMT Cache-Control: max-age=1728000 Accept-Ranges: bytes
Oct 29, 2021 17:51:16.141743898 CEST	1667	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 9b 00 00 00 42 08 06 00 00 00 40 50 a4 6b 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 64 69 54 58 74 58 4d 4c 3a Data Ascii: PNGIHDRB@PktEXtSoftwareAdobe ImageReadyqe<diTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/0
Oct 29, 2021 17:51:16.141783953 CEST	1668	IN	Data Raw: 7a 39 65 5f 9f 8d 87 24 30 07 24 68 fb 21 9a e0 f8 37 fe 86 cf fe fb 7e 0a 6d 76 f3 9d 79 ad 18 06 fb 84 84 ee 59 d5 82 49 3e 89 c0 7a 9b 52 94 f1 a6 08 c2 56 27 8d d2 21 a6 e4 65 1e 4e 88 76 0d 82 61 dc 9a b1 af 48 d0 de 5c cf 8e 42 20 bc 88 bf Data Ascii: z9e_$0$h!7~mvyYI>zRV'!eNvaH\B F>#ksBF[BjpJyu1G3Y=A{Z5kd"~}9c {Y_iqx?]bRH/lZjY"8_iv]}~;m`:<7QgSJz\w$
Oct 29, 2021 17:51:16.141824007 CEST	1670	IN	Data Raw: be 9f 29 66 2b 2c 6f 56 f1 46 11 7c ec 19 e1 8e 88 a0 43 22 30 2a 75 a5 a3 f1 92 76 eb 56 cb c8 eb 95 86 3e 92 fa aa b0 1d 85 e6 cd 2a 9a ad c7 39 b7 6f b4 46 d0 aa f6 b2 20 3b 23 cd 66 e7 1c df ca da 1b 2d 34 6f 96 15 b6 0e 0b 23 dd fe 8f e2 df Data Ascii: )f+,oVF\|C"0uvV>9oF ;#f-4o#+27xo9ss T/_cyv'kV9Wh%\|.Xu}Vl,$\|M{>`Fu1C2a6*&Darkf5\Zy?A\}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
14	192.168.2.4	49787	88.212.201.198	80	C:\Users\user\Desktop\njw.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 17:51:15.440135956 CEST	1437	OUT	GET /hit;counter1?r;s1280102432;uhttp%3A//www.all-bearings.narod.ru/firstpage.html;0.34476715437082456 HTTP/1.1 Accept: / Referer: http://www.all-bearings.narod.ru/firstpage.html Accept-Language: en-US Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: counter.yadro.ru Connection: Keep-Alive
Oct 29, 2021 17:51:15.499608040 CEST	1439	IN	HTTP/1.1 302 Moved Temporarily Date: Fri, 29 Oct 2021 15:51:23 GMT Server: 0W/0.8c Content-Type: text/html Location: https://counter.yadro.ru/hit;counter1?r;s1280102432;uhttp%3A//www.all-bearings.narod.ru/firstpage.html;0.34476715437082456 Content-Length: 32 Expires: Wed, 28 Oct 2020 21:00:00 GMT Pragma: no-cache Cache-control: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 4d 6f 76 65 64 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body>Moved</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
15	192.168.2.4	49788	87.250.251.119	80	C:\Users\user\Desktop\njw.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 17:51:15.440211058 CEST	1437	OUT	GET /metrika/watch.js HTTP/1.1 Accept: / Referer: http://www.all-bearings.narod.ru/secondpage.html Accept-Language: en-US Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: mc.yandex.ru Connection: Keep-Alive
Oct 29, 2021 17:51:15.481770992 CEST	1438	IN	HTTP/1.1 302 Moved temporarily Content-Length: 0 Location: https://mc.yandex.ru/metrika/watch.js

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
16	192.168.2.4	49789	87.250.251.119	80	C:\Users\user\Desktop\njw.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 17:51:15.440260887 CEST	1438	OUT	GET /metrika/watch.js HTTP/1.1 Accept: / Referer: http://www.all-bearings.narod.ru/firstpage.html Accept-Language: en-US Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: mc.yandex.ru Connection: Keep-Alive
Oct 29, 2021 17:51:15.482186079 CEST	1439	IN	HTTP/1.1 302 Moved temporarily Content-Length: 0 Location: https://mc.yandex.ru/metrika/watch.js

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
17	192.168.2.4	49786	88.212.201.198	80	C:\Users\user\Desktop\njw.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 17:51:15.440336943 CEST	1438	OUT	GET /hit;counter1?r;s1280102432;uhttp%3A//www.all-bearings.narod.ru/secondpage.html;0.5443641556055339 HTTP/1.1 Accept: / Referer: http://www.all-bearings.narod.ru/secondpage.html Accept-Language: en-US Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: counter.yadro.ru Connection: Keep-Alive
Oct 29, 2021 17:51:15.503304958 CEST	1440	IN	HTTP/1.1 302 Moved Temporarily Date: Fri, 29 Oct 2021 15:51:23 GMT Server: 0W/0.8c Content-Type: text/html Location: https://counter.yadro.ru/hit;counter1?r;s1280102432;uhttp%3A//www.all-bearings.narod.ru/secondpage.html;0.5443641556055339 Content-Length: 32 Expires: Wed, 28 Oct 2020 21:00:00 GMT Pragma: no-cache Cache-control: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 4d 6f 76 65 64 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body>Moved</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.4	49791	87.250.251.119	443	C:\Users\user\Desktop\njw.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.4	49793	88.212.201.198	443	C:\Users\user\Desktop\njw.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.4	49795	88.212.201.198	443	C:\Users\user\Desktop\njw.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.4	49794	88.212.201.198	443	C:\Users\user\Desktop\njw.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.4	49796	87.250.251.119	443	C:\Users\user\Desktop\njw.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.4	49797	87.250.251.119	443	C:\Users\user\Desktop\njw.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.4	49798	87.250.251.119	443	C:\Users\user\Desktop\njw.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.2.4	49799	87.250.251.119	443	C:\Users\user\Desktop\njw.exe

Timestamp	kBytes transferred	Direction	Data

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.4	49790	87.250.251.119	443	C:\Users\user\Desktop\njw.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-29 15:51:15 UTC	0	OUT	GET /metrika/watch.js HTTP/1.1 Accept: / Referer: http://www.all-bearings.narod.ru/secondpage.html Accept-Language: en-US Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Connection: Keep-Alive Host: mc.yandex.ru
2021-10-29 15:51:16 UTC	1	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Cache-Control: max-age=3600 Connection: Close Content-Length: 132911 Content-Type: application/javascript Date: Fri, 29 Oct 2021 15:51:16 GMT ETag: "617677e6-2072f" Expires: Fri, 29 Oct 2021 16:51:16 GMT Last-Modified: Mon, 25 Oct 2021 12:24:54 GMT Strict-Transport-Security: max-age=31536000
2021-10-29 15:51:16 UTC	1	IN	Data Raw: ef bb bf 28 66 75 6e 63 74 69 6f 6e 28 29 7b 74 72 79 7b 28 66 75 6e 63 74 69 6f 6e 28 4a 63 29 7b 66 75 6e 63 74 69 6f 6e 20 48 69 28 61 29 7b 72 65 74 75 72 6e 20 61 2e 72 65 70 6c 61 63 65 28 49 69 2c 66 75 6e 63 74 69 6f 6e 28 62 2c 63 2c 64 2c 65 29 7b 72 65 74 75 72 6e 22 22 2b 63 2b 65 7d 29 7d 66 75 6e 63 74 69 6f 6e 20 4b 63 28 61 2c 62 29 7b 69 66 28 21 62 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 63 3d 4d 28 61 29 3b 72 65 74 75 72 6e 28 6e 65 77 20 52 65 67 45 78 70 28 62 29 29 2e 74 65 73 74 28 22 22 2b 63 2e 70 61 74 68 6e 61 6d 65 2b 63 2e 68 61 73 68 2b 63 2e 73 65 61 72 63 68 29 7d 66 75 6e 63 74 69 6f 6e 20 4a 69 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 44 61 28 61 2c 62 2c 66 75 6e 63 74 69 6f 6e 28 63 29 7b 76 61 72 20 64 3d 6e 28 63 2c Data Ascii: (function(){try{(function(Jc){function Hi(a){return a.replace(Ii,function(b,c,d,e){return""+c+e})}function Kc(a,b){if(!b)return!1;var c=M(a);return(new RegExp(b)).test(""+c.pathname+c.hash+c.search)}function Ji(a,b){return Da(a,b,function(c){var d=n(c,
2021-10-29 15:51:16 UTC	14	IN	Data Raw: 74 61 26 26 28 64 3d 30 3c 61 2e 77 68 65 65 6c 44 65 6c 74 61 3f 32 3a 30 3e 61 2e 77 68 65 65 6c 44 65 6c 74 61 3f 31 3a 30 29 3b 69 66 28 64 29 7b 76 61 72 20 65 3d 4d 63 28 62 2c 61 29 3b 61 3d 64 62 28 62 2c 63 29 3b 62 3d 74 61 28 62 29 3b 65 3d 5b 65 2e 78 2c 65 2e 79 5d 3b 63 3d 63 5b 6d 61 5d 3b 69 66 28 21 63 7c 7c 30 3e 63 29 63 3d 5b 5d 3b 65 6c 73 65 7b 76 61 72 20 66 3d 5b 5d 3b 75 61 28 66 2c 33 31 29 3b 7a 28 66 2c 62 29 3b 7a 28 66 2c 63 29 3b 7a 28 66 2c 65 5b 30 5d 29 3b 7a 28 66 2c 65 5b 31 5d 29 3b 75 61 28 66 2c 30 29 3b 75 61 28 66 2c 30 29 3b 75 61 28 66 2c 64 29 3b 63 3d 66 7d 72 65 74 75 72 6e 20 50 28 61 2c 63 29 7d 7d 7d 66 75 6e 63 74 69 6f 6e 20 6d 66 28 61 29 7b 76 61 72 20 62 3d 61 2e 6f 3b 61 3d 4c 64 28 62 29 3b 76 61 72 Data Ascii: ta&&(d=0<a.wheelDelta?2:0>a.wheelDelta?1:0);if(d){var e=Mc(b,a);a=db(b,c);b=ta(b);e=[e.x,e.y];c=c[ma];if(!c\|\|0>c)c=[];else{var f=[];ua(f,31);z(f,b);z(f,c);z(f,e[0]);z(f,e[1]);ua(f,0);ua(f,0);ua(f,d);c=f}return P(a,c)}}}function mf(a){var b=a.o;a=Ld(b);var
2021-10-29 15:51:16 UTC	22	IN	Data Raw: 2b 63 2b 22 2e 22 29 3b 47 64 28 61 2c 62 2c 22 62 74 6e 22 2c 64 29 28 63 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 4b 6a 28 61 2c 62 29 7b 76 61 72 20 63 3d 41 61 28 61 29 3b 69 66 28 22 22 21 3d 3d 63 2e 62 28 22 63 63 22 29 29 72 65 74 75 72 6e 20 30 3b 76 61 72 20 64 3d 76 28 22 63 63 22 2c 63 2e 6c 29 3b 64 28 30 29 3b 76 61 72 20 65 3d 57 28 61 29 2c 66 3d 4c 28 61 29 3b 66 3d 71 28 54 28 57 61 28 7b 44 61 3a 31 7d 29 2b 22 2e 63 22 29 2c 4d 62 28 66 75 6e 63 74 69 6f 6e 28 67 29 7b 64 28 67 2b 22 26 22 2b 65 28 58 61 29 29 7d 29 2c 76 28 22 63 63 22 2c 66 2e 6c 29 29 3b 64 61 28 61 2c 22 36 22 2c 62 29 28 7b 7d 29 2e 74 68 65 6e 28 66 29 5b 22 63 61 74 63 68 22 5d 28 71 28 4d 62 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 67 3d 65 28 58 61 29 3b 63 Data Ascii: +c+".");Gd(a,b,"btn",d)(c)}}function Kj(a,b){var c=Aa(a);if(""!==c.b("cc"))return 0;var d=v("cc",c.l);d(0);var e=W(a),f=L(a);f=q(T(Wa({Da:1})+".c"),Mb(function(g){d(g+"&"+e(Xa))}),v("cc",f.l));da(a,"6",b)({}).then(f)["catch"](q(Mb(function(){var g=e(Xa);c
2021-10-29 15:51:16 UTC	30	IN	Data Raw: 75 72 6e 20 53 28 66 75 6e 63 74 69 6f 6e 28 64 2c 65 29 7b 64 5b 65 5d 3d 63 28 22 28 22 2b 65 2b 22 29 22 29 3b 72 65 74 75 72 6e 20 64 7d 2c 7b 7d 2c 6e 6b 29 7d 66 75 6e 63 74 69 6f 6e 20 56 69 28 61 29 7b 61 3d 65 62 28 61 29 3b 69 66 28 21 61 29 72 65 74 75 72 6e 22 22 3b 61 3d 61 28 22 76 69 64 65 6f 22 29 3b 74 72 79 7b 76 61 72 20 62 3d 63 61 28 22 63 61 6e 50 6c 61 79 54 79 70 65 22 2c 61 29 2c 63 3d 76 62 28 66 75 6e 63 74 69 6f 6e 28 64 29 7b 72 65 74 75 72 6e 20 49 28 71 28 4b 2c 63 61 28 22 63 6f 6e 63 61 74 22 2c 64 2b 22 3b 20 63 6f 64 65 63 73 3d 22 29 29 2c 6f 6b 29 7d 2c 61 67 29 3b 72 65 74 75 72 6e 20 49 28 62 2c 5b 5d 2e 63 6f 6e 63 61 74 28 61 67 2c 63 29 29 7d 63 61 74 63 68 28 64 29 7b 72 65 74 75 72 6e 22 63 61 6e 50 6c 61 79 54 Data Ascii: urn S(function(d,e){d[e]=c("("+e+")");return d},{},nk)}function Vi(a){a=eb(a);if(!a)return"";a=a("video");try{var b=ca("canPlayType",a),c=vb(function(d){return I(q(K,ca("concat",d+"; codecs=")),ok)},ag);return I(b,[].concat(ag,c))}catch(d){return"canPlayT
2021-10-29 15:51:16 UTC	38	IN	Data Raw: 74 75 72 6e 20 64 26 26 21 65 3f 66 3a 67 7d 29 7d 66 75 6e 63 74 69 6f 6e 20 24 6b 28 61 2c 62 2c 63 2c 64 29 7b 62 3d 64 2e 62 28 22 63 63 22 29 3b 64 3d 47 28 5b 22 63 63 22 2c 22 22 5d 2c 64 2e 6c 29 3b 69 66 28 62 29 7b 76 61 72 20 65 3d 62 2e 73 70 6c 69 74 28 22 26 22 29 3b 62 3d 65 5b 30 5d 3b 69 66 28 28 65 3d 28 65 3d 65 5b 31 5d 29 26 26 70 61 72 73 65 49 6e 74 28 65 2c 31 30 29 29 26 26 31 34 34 30 3c 57 28 61 29 28 58 61 29 2d 65 29 72 65 74 75 72 6e 20 64 28 29 3b 63 2e 6c 28 22 63 63 22 2c 62 29 7d 65 6c 73 65 20 73 61 28 30 29 28 62 29 7c 7c 64 28 29 7d 66 75 6e 63 74 69 6f 6e 20 61 6c 28 61 2c 62 2c 63 2c 64 29 7b 72 65 74 75 72 6e 20 44 61 28 61 2c 62 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 22 30 22 3d 3d 3d 6e 28 65 2c 22 73 65 Data Ascii: turn d&&!e?f:g})}function $k(a,b,c,d){b=d.b("cc");d=G(["cc",""],d.l);if(b){var e=b.split("&");b=e[0];if((e=(e=e[1])&&parseInt(e,10))&&1440<W(a)(Xa)-e)return d();c.l("cc",b)}else sa(0)(b)\|\|d()}function al(a,b,c,d){return Da(a,b,function(e){if("0"===n(e,"se
2021-10-29 15:51:16 UTC	78	IN	Data Raw: 20 76 61 28 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 63 28 61 29 7d 29 7d 66 75 6e 63 74 69 6f 6e 20 77 6b 28 61 29 7b 72 65 74 75 72 6e 20 76 61 28 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 61 2e 74 68 65 6e 28 63 2c 62 29 7d 29 7d 66 75 6e 63 74 69 6f 6e 20 76 6b 28 61 29 7b 76 61 72 20 62 3d 5b 5d 2c 63 3d 21 31 3b 72 65 74 75 72 6e 20 76 61 28 66 75 6e 63 74 69 6f 6e 28 64 2c 65 29 7b 66 75 6e 63 74 69 6f 6e 20 66 28 67 29 7b 62 2e 70 75 73 68 28 67 29 3d 3d 3d 61 2e 6c 65 6e 67 74 68 26 26 64 28 62 29 7d 44 28 66 75 6e 63 74 69 6f 6e 28 67 29 7b 67 28 50 63 28 66 2c 66 75 6e 63 74 69 6f 6e 28 68 29 7b 69 66 28 21 63 29 74 72 79 7b 65 28 68 29 2c 63 3d 21 30 7d 63 61 74 63 68 28 6b 29 7b 66 28 6b 29 7d 7d 29 29 7d 2c 61 29 7d 29 7d 66 75 6e 63 74 69 Data Ascii: va(function(b,c){c(a)})}function wk(a){return va(function(b,c){a.then(c,b)})}function vk(a){var b=[],c=!1;return va(function(d,e){function f(g){b.push(g)===a.length&&d(b)}D(function(g){g(Pc(f,function(h){if(!c)try{e(h),c=!0}catch(k){f(k)}}))},a)})}functi
2021-10-29 15:51:16 UTC	86	IN	Data Raw: 3b 29 64 2b 3d 65 5b 66 5d 7c 7c 22 2a 22 2c 64 2b 3d 6b 68 28 61 2c 62 2c 63 29 7c 7c 22 22 2c 62 3d 62 2e 70 61 72 65 6e 74 45 6c 65 6d 65 6e 74 2c 66 3d 4c 61 28 62 29 7c 7c 22 2a 22 3b 72 65 74 75 72 6e 20 7a 62 28 64 2c 31 32 38 29 7d 66 75 6e 63 74 69 6f 6e 20 6b 68 28 61 2c 62 2c 63 29 7b 69 66 28 61 3d 64 64 28 61 2c 62 29 29 7b 61 3d 61 2e 63 68 69 6c 64 4e 6f 64 65 73 3b 66 6f 72 28 76 61 72 20 64 3d 62 26 26 62 2e 6e 6f 64 65 4e 61 6d 65 2c 65 3d 30 2c 66 3d 30 3b 66 3c 61 2e 6c 65 6e 67 74 68 3b 66 2b 3d 31 29 69 66 28 64 3d 3d 3d 28 61 5b 66 5d 26 26 61 5b 66 5d 2e 6e 6f 64 65 4e 61 6d 65 29 29 7b 69 66 28 62 3d 3d 3d 61 5b 66 5d 29 72 65 74 75 72 6e 20 65 3b 63 26 26 61 5b 66 5d 3d 3d 3d 63 7c 7c 28 65 2b 3d 31 29 7d 7d 72 65 74 75 72 6e 20 Data Ascii: ;)d+=e[f]\|\|"",d+=kh(a,b,c)\|\|"",b=b.parentElement,f=La(b)\|\|"";return zb(d,128)}function kh(a,b,c){if(a=dd(a,b)){a=a.childNodes;for(var d=b&&b.nodeName,e=0,f=0;f<a.length;f+=1)if(d===(a[f]&&a[f].nodeName)){if(b===a[f])return e;c&&a[f]===c\|\|(e+=1)}}return
2021-10-29 15:51:16 UTC	94	IN	Data Raw: 20 78 68 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 7a 63 28 66 75 6e 63 74 69 6f 6e 28 63 2c 64 2c 65 29 7b 61 28 64 2c 65 29 26 26 63 2e 70 75 73 68 28 64 29 3b 72 65 74 75 72 6e 20 63 7d 2c 5b 5d 2c 62 29 7d 66 75 6e 63 74 69 6f 6e 20 6e 63 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 42 61 28 61 29 3f 21 31 3a 43 65 2e 63 61 6c 6c 28 61 2c 62 29 7d 66 75 6e 63 74 69 6f 6e 20 49 61 28 61 29 7b 69 66 28 41 63 29 72 65 74 75 72 6e 20 41 63 28 61 29 3b 28 41 63 3d 71 61 28 41 72 72 61 79 2e 69 73 41 72 72 61 79 2c 22 69 73 41 72 72 61 79 22 29 29 7c 7c 28 41 63 3d 6d 6d 29 3b 72 65 74 75 72 6e 20 41 63 28 61 29 7d 66 75 6e 63 74 69 6f 6e 20 71 28 29 7b 76 61 72 20 61 3d 6e 61 28 61 72 67 75 6d 65 6e 74 73 29 2c 62 3d 61 2e 73 68 69 66 74 28 29 3b 72 65 74 75 72 6e Data Ascii: xh(a,b){return zc(function(c,d,e){a(d,e)&&c.push(d);return c},[],b)}function nc(a,b){return Ba(a)?!1:Ce.call(a,b)}function Ia(a){if(Ac)return Ac(a);(Ac=qa(Array.isArray,"isArray"))\|\|(Ac=mm);return Ac(a)}function q(){var a=na(arguments),b=a.shift();return
2021-10-29 15:51:16 UTC	102	IN	Data Raw: 70 3d 59 28 70 2c 4d 61 28 5b 30 2c 63 2e 63 68 61 72 43 6f 64 65 41 74 28 6c 2b 31 30 29 5d 2c 31 36 29 29 3b 63 61 73 65 20 31 30 3a 70 3d 59 28 70 2c 4d 61 28 5b 30 2c 63 2e 63 68 61 72 43 6f 64 65 41 74 28 6c 2b 39 29 5d 2c 38 29 29 3b 63 61 73 65 20 39 3a 70 3d 59 28 70 2c 5b 30 2c 63 2e 63 68 61 72 43 6f 64 65 41 74 28 6c 2b 38 29 5d 29 2c 70 3d 50 61 28 70 2c 6b 29 2c 70 3d 58 62 28 70 2c 33 33 29 2c 70 3d 50 61 28 70 2c 68 29 2c 64 3d 59 28 64 2c 70 29 3b 63 61 73 65 20 38 3a 6d 3d 59 28 6d 2c 4d 61 28 5b 30 2c 63 2e 63 68 61 72 43 6f 64 65 41 74 28 6c 2b 37 29 5d 2c 35 36 29 29 3b 63 61 73 65 20 37 3a 6d 3d 59 28 6d 2c 4d 61 28 5b 30 2c 63 2e 63 68 61 72 43 6f 64 65 41 74 28 6c 2b 36 29 5d 2c 34 38 29 29 3b 63 61 73 65 20 36 3a 6d 3d 59 28 6d 2c Data Ascii: p=Y(p,Ma([0,c.charCodeAt(l+10)],16));case 10:p=Y(p,Ma([0,c.charCodeAt(l+9)],8));case 9:p=Y(p,[0,c.charCodeAt(l+8)]),p=Pa(p,k),p=Xb(p,33),p=Pa(p,h),d=Y(d,p);case 8:m=Y(m,Ma([0,c.charCodeAt(l+7)],56));case 7:m=Y(m,Ma([0,c.charCodeAt(l+6)],48));case 6:m=Y(m,
2021-10-29 15:51:16 UTC	110	IN	Data Raw: 3d 4c 61 28 61 29 26 26 62 28 29 7d 66 75 6e 63 74 69 6f 6e 20 70 64 28 61 2c 62 2c 63 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 64 3d 45 61 28 61 2c 62 29 2c 65 3d 6e 61 28 61 72 67 75 6d 65 6e 74 73 29 3b 69 66 28 64 29 72 65 74 75 72 6e 20 63 2e 61 70 70 6c 79 28 76 6f 69 64 20 30 2c 65 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 51 6d 28 61 2c 62 2c 63 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 64 3d 45 61 28 61 2c 62 29 2c 65 3d 6e 61 28 61 72 67 75 6d 65 6e 74 73 29 3b 63 2e 61 70 70 6c 79 28 76 6f 69 64 20 30 2c 65 29 3b 72 65 74 75 72 6e 20 64 7d 7d 66 75 6e 63 74 69 6f 6e 20 52 6d 28 61 2c 62 2c 63 2c 64 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 66 6f 72 28 76 61 72 20 65 3d 5b Data Ascii: =La(a)&&b()}function pd(a,b,c){return function(){var d=Ea(a,b),e=na(arguments);if(d)return c.apply(void 0,e)}}function Qm(a,b,c){return function(){var d=Ea(a,b),e=na(arguments);c.apply(void 0,e);return d}}function Rm(a,b,c,d){return function(){for(var e=[
2021-10-29 15:51:16 UTC	118	IN	Data Raw: 73 6b 7c 2e 2a 5c 2e 79 61 6e 64 65 78 7c 74 75 72 62 6f 70 61 67 65 73 5c 2e 6f 72 67 7c 74 75 72 62 6f 5c 2e 73 69 74 65 29 24 2f 2c 0a 74 6b 3d 74 28 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 4d 28 61 29 2e 68 6f 73 74 6e 61 6d 65 3b 76 61 72 20 62 3d 21 31 3b 61 26 26 28 62 3d 2d 31 21 3d 3d 61 2e 73 65 61 72 63 68 28 68 6e 29 29 3b 72 65 74 75 72 6e 20 62 7d 29 2c 6a 6e 3d 2f 28 3f 3a 5e 7c 5c 2e 29 28 3f 3a 79 61 7c 79 61 6e 64 65 78 29 5c 2e 28 3f 3a 5c 77 2b 7c 63 6f 6d 3f 5c 2e 5c 77 2b 29 24 2f 2c 6b 6e 3d 74 28 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 4d 28 61 29 2e 68 6f 73 74 6e 61 6d 65 3b 76 61 72 20 62 3d 21 31 3b 61 26 26 28 62 3d 2d 31 21 3d 3d 61 2e 73 65 61 72 63 68 28 6a 6e 29 29 3b 72 65 74 75 72 6e 20 62 7d 29 2c 74 6d 3d 74 28 66 Data Ascii: sk\|.*\.yandex\|turbopages\.org\|turbo\.site)$/,tk=t(function(a){a=M(a).hostname;var b=!1;a&&(b=-1!==a.search(hn));return b}),jn=/(?:^\|\.)(?:ya\|yandex)\.(?:\w+\|com?\.\w+)$/,kn=t(function(a){a=M(a).hostname;var b=!1;a&&(b=-1!==a.search(jn));return b}),tm=t(f
2021-10-29 15:51:16 UTC	174	IN	Data Raw: 22 3a 22 2a 22 2c 22 2f 22 3a 22 2d 22 2c 22 3d 22 3a 22 5f 22 7d 2c 45 63 3d 74 28 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 6e 28 61 2c 22 63 6f 6e 73 6f 6c 65 22 29 3b 76 61 72 20 62 3d 6e 28 61 2c 22 6c 6f 67 22 29 3b 62 3d 6e 64 28 22 6c 6f 67 22 2c 62 29 3f 45 28 62 2c 61 29 3a 43 3b 76 61 72 20 63 3d 6e 28 61 2c 22 77 61 72 6e 22 29 3b 63 3d 6e 64 28 22 77 61 72 6e 22 2c 63 29 3f 45 28 63 2c 61 29 3a 62 3b 76 61 72 20 64 3d 6e 28 61 2c 22 65 72 72 6f 72 22 29 3b 61 3d 6e 64 28 22 65 72 72 6f 72 22 2c 64 29 3f 45 28 64 2c 61 29 3a 62 3b 72 65 74 75 72 6e 7b 6c 6f 67 3a 62 2c 65 72 72 6f 72 3a 61 2c 77 61 72 6e 3a 63 7d 7d 29 2c 78 6e 3d 41 28 22 70 2e 63 64 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 68 64 28 61 29 7c 7c 0a 41 65 28 61 29 29 Data Ascii: ":"*","/":"-","=":"_"},Ec=t(function(a){a=n(a,"console");var b=n(a,"log");b=nd("log",b)?E(b,a):C;var c=n(a,"warn");c=nd("warn",c)?E(c,a):b;var d=n(a,"error");a=nd("error",d)?E(d,a):b;return{log:b,error:a,warn:c}}),xn=A("p.cd",function(a){if(hd(a)\|\|Ae(a))
2021-10-29 15:51:16 UTC	182	IN	Data Raw: 75 72 6e 20 6e 75 6c 6c 3b 64 3d 64 2e 63 61 6c 6c 28 61 2e 64 6f 63 75 6d 65 6e 74 2c 0a 22 69 66 72 61 6d 65 22 29 3b 66 3d 28 63 3d 7b 7d 2c 63 2e 63 6f 75 6e 74 65 72 49 64 3d 62 2e 69 64 2c 63 2e 68 69 64 3d 22 22 2b 51 62 28 61 29 2c 63 29 3b 6a 6c 28 61 2c 67 29 3b 63 3d 4c 6e 28 61 2c 66 29 3b 76 61 72 20 6b 3d 4e 6e 28 61 2c 63 28 5b 5d 29 29 3b 44 28 66 75 6e 63 74 69 6f 6e 28 6c 29 7b 76 61 72 20 6d 3d 6e 75 6c 6c 3b 74 72 79 7b 6d 3d 6c 2e 63 6f 6e 74 65 6e 74 57 69 6e 64 6f 77 7d 63 61 74 63 68 28 70 29 7b 7d 6d 26 26 6b 28 6d 2c 7b 74 79 70 65 3a 22 69 6e 69 74 54 6f 43 68 69 6c 64 22 7d 2c 66 75 6e 63 74 69 6f 6e 28 70 2c 75 29 7b 67 2e 4a 28 22 69 6e 69 74 54 6f 50 61 72 65 6e 74 22 2c 5b 70 2c 75 5d 29 7d 29 7d 2c 64 29 3b 48 62 28 61 29 Data Ascii: urn null;d=d.call(a.document,"iframe");f=(c={},c.counterId=b.id,c.hid=""+Qb(a),c);jl(a,g);c=Ln(a,f);var k=Nn(a,c([]));D(function(l){var m=null;try{m=l.contentWindow}catch(p){}m&&k(m,{type:"initToChild"},function(p,u){g.J("initToParent",[p,u])})},d);Hb(a)
2021-10-29 15:51:16 UTC	190	IN	Data Raw: 3d 0a 64 7d 61 2e 70 72 6f 74 6f 74 79 70 65 2e 51 62 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 70 61 28 74 68 69 73 2e 6f 2c 71 28 45 28 74 68 69 73 2e 66 6c 75 73 68 2c 74 68 69 73 29 2c 45 28 74 68 69 73 2e 51 62 2c 74 68 69 73 29 29 2c 74 68 69 73 2e 6c 62 2c 22 62 2e 66 22 29 7d 3b 61 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 6e 64 3d 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 74 68 69 73 2e 55 63 28 62 2c 63 7c 7c 5b 5d 2c 74 68 69 73 2e 56 61 29 3b 74 68 69 73 2e 56 61 2b 3d 31 7d 3b 61 2e 70 72 6f 74 6f 74 79 70 65 2e 70 75 73 68 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 3b 61 2e 70 72 6f 74 6f 74 79 70 65 2e 66 6c 75 73 68 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 3b 72 65 74 75 72 6e 20 61 7d 28 29 2c 67 67 3d 61 61 28 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b Data Ascii: =d}a.prototype.Qb=function(){pa(this.o,q(E(this.flush,this),E(this.Qb,this)),this.lb,"b.f")};a.prototype.send=function(b,c){this.Uc(b,c\|\|[],this.Va);this.Va+=1};a.prototype.push=function(){};a.prototype.flush=function(){};return a}(),gg=aa(function(a,b){
2021-10-29 15:51:16 UTC	198	IN	Data Raw: 5b 5d 3b 63 2e 24 62 3d 37 35 30 30 3b 63 2e 6c 62 3d 33 45 34 3b 63 2e 51 62 28 29 3b 72 65 74 75 72 6e 20 63 7d 70 6d 28 62 2c 61 29 3b 62 2e 70 72 6f 74 6f 74 79 70 65 2e 70 75 73 68 3d 66 75 6e 63 74 69 6f 6e 28 63 2c 64 29 7b 76 61 72 20 65 3d 74 68 69 73 2e 4f 62 2e 4e 62 28 63 2c 64 29 3b 4a 61 28 74 68 69 73 2e 62 75 66 66 65 72 2c 65 29 3b 74 68 69 73 2e 4f 62 2e 7a 63 28 74 68 69 73 2e 62 75 66 66 65 72 29 3e 74 68 69 73 2e 24 62 26 26 74 68 69 73 2e 66 6c 75 73 68 28 29 7d 3b 62 2e 70 72 6f 74 6f 74 79 70 65 2e 66 6c 75 73 68 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 63 3d 74 68 69 73 2e 62 75 66 66 65 72 3b 63 2e 6c 65 6e 67 74 68 26 26 28 74 68 69 73 2e 73 65 6e 64 28 63 29 2c 74 68 69 73 2e 62 75 66 66 65 72 3d 5b 5d 29 7d 3b 72 65 74 Data Ascii: [];c.$b=7500;c.lb=3E4;c.Qb();return c}pm(b,a);b.prototype.push=function(c,d){var e=this.Ob.Nb(c,d);Ja(this.buffer,e);this.Ob.zc(this.buffer)>this.$b&&this.flush()};b.prototype.flush=function(){var c=this.buffer;c.length&&(this.send(c),this.buffer=[])};ret
2021-10-29 15:51:16 UTC	206	IN	Data Raw: 6e 28 65 29 7b 65 2e 43 28 64 29 7d 29 7d 7d 29 2c 49 6f 3d 41 28 22 66 69 64 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 2c 63 3d 43 3b 69 66 28 21 4f 28 61 2e 50 65 72 66 6f 72 6d 61 6e 63 65 4f 62 73 65 72 76 65 72 29 29 72 65 74 75 72 6e 20 63 3b 76 61 72 20 64 3d 4c 28 61 29 3b 69 66 28 64 2e 62 28 22 66 69 64 6f 22 29 29 72 65 74 75 72 6e 20 63 3b 64 2e 6c 28 22 66 69 64 6f 22 2c 21 30 29 3b 76 61 72 20 65 3d 6e 65 77 20 61 2e 50 65 72 66 6f 72 6d 61 6e 63 65 4f 62 73 65 72 76 65 72 28 78 28 61 2c 22 66 69 64 22 2c 66 75 6e 63 74 69 6f 6e 28 66 29 7b 66 3d 66 2e 67 65 74 45 6e 74 72 69 65 73 28 29 5b 30 5d 3b 64 2e 6c 28 22 66 69 64 22 2c 61 2e 4d 61 74 68 2e 72 6f 75 6e 64 28 31 30 30 2a 28 66 2e 70 72 6f 63 65 73 73 69 6e 67 53 74 61 Data Ascii: n(e){e.C(d)})}}),Io=A("fid",function(a){var b,c=C;if(!O(a.PerformanceObserver))return c;var d=L(a);if(d.b("fido"))return c;d.l("fido",!0);var e=new a.PerformanceObserver(x(a,"fid",function(f){f=f.getEntries()[0];d.l("fid",a.Math.round(100*(f.processingSta
2021-10-29 15:51:16 UTC	214	IN	Data Raw: 63 5b 31 5d 2c 65 3d 63 5b 32 5d 2c 66 3d 63 2e 73 6c 69 63 65 28 33 29 3b 63 3d 70 61 72 73 65 49 6e 74 28 63 5b 30 5d 2c 32 29 3b 69 66 28 31 3d 3d 3d 63 29 63 3d 22 41 54 35 54 36 6b 75 30 36 6b 45 73 58 4b 33 69 79 42 52 67 6f 36 6c 6b 38 72 43 74 58 34 4b 6a 66 30 71 70 52 65 37 34 76 74 41 70 6c 4f 6b 6b 70 53 69 38 45 39 46 44 54 42 4a 6c 49 56 36 73 7a 47 75 57 61 77 79 49 4c 72 4c 6c 7a 74 77 6c 34 4b 45 71 73 31 70 4e 46 76 4e 64 74 49 72 59 74 52 4f 42 4e 31 67 53 47 53 31 61 64 70 2b 6d 79 72 7a 6d 5a 4b 6f 71 45 72 74 43 76 32 30 57 79 57 69 52 6c 45 71 5a 51 55 7a 76 56 33 73 52 61 31 6e 53 63 6d 6c 78 70 74 77 4c 4c 59 37 6f 22 3b 65 6c 73 65 20 69 66 28 32 3d 3d 3d 63 29 63 3d 22 43 79 32 46 63 72 65 4c 4a 4c 70 59 58 57 33 42 58 46 4a 71 Data Ascii: c[1],e=c[2],f=c.slice(3);c=parseInt(c[0],2);if(1===c)c="AT5T6ku06kEsXK3iyBRgo6lk8rCtX4Kjf0qpRe74vtAplOkkpSi8E9FDTBJlIV6szGuWawyILrLlztwl4KEqs1pNFvNdtIrYtROBN1gSGS1adp+myrzmZKoqErtCv20WyWiRlEqZQUzvV3sRa1nScmlxptwLLY7o";else if(2===c)c="Cy2FcreLJLpYXW3BXFJq

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.4	49792	88.212.201.198	443	C:\Users\user\Desktop\njw.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-29 15:51:15 UTC	0	OUT	GET /hit;counter1?r;s1280102432;uhttp%3A//www.all-bearings.narod.ru/secondpage.html;0.5443641556055339 HTTP/1.1 Accept: / Referer: http://www.all-bearings.narod.ru/secondpage.html Accept-Language: en-US Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Connection: Keep-Alive Host: counter.yadro.ru
2021-10-29 15:51:16 UTC	13	IN	HTTP/1.1 302 Moved Temporarily Server: nginx/1.17.9 Date: Fri, 29 Oct 2021 15:51:24 GMT Content-Type: text/html Content-Length: 32 Connection: close Location: https://counter.yadro.ru/hit;counter1?q;r;s1280102432;uhttp%3A//www.all-bearings.narod.ru/secondpage.html;0.5443641556055339 Expires: Wed, 28 Oct 2020 21:00:00 GMT Pragma: no-cache Cache-control: no-cache P3P: policyref="/w3c/p3p.xml", CP="UNI" Set-Cookie: FTID=1XV1Xy3Wb9uB1XV1Xy001Ei9; path=/; expires=Fri, 28 Oct 2022 21:00:00 GMT; HttpOnly; Secure; SameSite=None; domain=.yadro.ru Strict-Transport-Security: max-age=86400
2021-10-29 15:51:16 UTC	13	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 4d 6f 76 65 64 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body>Moved</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.2.4	49800	87.250.251.119	443	C:\Users\user\Desktop\njw.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-29 15:51:21 UTC	272	OUT	GET /watch/14153041/1?callback=_ymjsp355627947&page-url=http%3A%2F%2Fwww.all-bearings.narod.ru%2Ffirstpage.html&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3A9ezyymqkmijljhdjn%3Afp%3A1930%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A680%3Acn%3A1%3Adp%3A0%3Als%3A732524701665%3Ahid%3A87010386%3Az%3A120%3Ai%3A202101029175120%3Aet%3A1635522680%3Ac%3A1%3Arn%3A244404675%3Au%3A1635522678322622628%3Aw%3A148x47%3As%3A1280x1024x32%3Aifr%3A1%3Aj%3A1%3Ans%3A1635522674781%3Ads%3A0%2C0%2C0%2C0%2C0%2C0%2C%2C155%2C0%2C2520%2C2521%2C0%2C2520%3Aco%3A0%3Arqnl%3A1%3Ast%3A1635522681%3At%3AHTTP%20404%20Resource%20not%20found&t=gdpr%2814%29ti%283%29&wmode=5 HTTP/1.1 Accept: / Referer: http://www.all-bearings.narod.ru/firstpage.html Accept-Language: en-US Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: mc.yandex.ru Connection: Keep-Alive Cookie: yandexuid=3723159021635522681; i=yROKAQCkQEDp/MhTCtujtSWzFSx7PgG/2QZgPGeQuaYkCYGk4Lr5g33sdF0NzFWf3pPBk9Yj1OF7cHnVzZMM+SWO+Mc=; ymex=1667058681.yrts.1635522681#1667058681.yrtsi.1635522681; yabs-sid=702787781635522681
2021-10-29 15:51:21 UTC	273	IN	HTTP/1.1 200 Ok Cache-Control: private, no-cache, no-store, must-revalidate, max-age=0 Connection: Close Content-Length: 343 Content-Type: application/javascript Date: Fri, 29 Oct 2021 15:51:21 GMT Expires: Fri, 29-Oct-2021 15:51:21 GMT Last-Modified: Fri, 29-Oct-2021 15:51:21 GMT Pragma: no-cache Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block
2021-10-29 15:51:21 UTC	274	IN	Data Raw: 2f 2a 2a 2f 74 72 79 7b 5f 79 6d 6a 73 70 33 35 35 36 32 37 39 34 37 28 7b 22 61 75 74 6f 5f 67 6f 61 6c 73 22 3a 30 2c 22 62 75 74 74 6f 6e 5f 67 6f 61 6c 73 22 3a 30 2c 22 63 5f 72 65 63 70 22 3a 22 31 2e 30 30 30 30 30 22 2c 22 66 6f 72 6d 5f 67 6f 61 6c 73 22 3a 30 2c 22 70 63 73 22 3a 22 31 22 2c 22 77 65 62 76 69 73 6f 72 22 3a 7b 22 61 72 63 68 5f 74 79 70 65 22 3a 22 6e 6f 6e 65 22 2c 22 64 61 74 65 22 3a 22 32 30 32 30 2d 30 39 2d 30 34 20 32 30 3a 33 32 3a 32 31 22 2c 22 66 6f 72 6d 73 22 3a 31 2c 22 72 65 63 70 22 3a 22 31 2e 30 30 30 30 30 22 7d 2c 22 73 62 70 22 3a 20 7b 22 61 22 3a 22 57 70 33 42 63 78 52 52 36 46 46 48 63 78 42 45 79 39 43 33 36 5a 7a 76 49 70 51 55 54 41 39 68 68 4f 68 75 44 70 42 46 30 6b 5a 37 45 2f 4e 73 6d 53 62 5a 54 Data Ascii: /**/try{_ymjsp355627947({"auto_goals":0,"button_goals":0,"c_recp":"1.00000","form_goals":0,"pcs":"1","webvisor":{"arch_type":"none","date":"2020-09-04 20:32:21","forms":1,"recp":"1.00000"},"sbp": {"a":"Wp3BcxRR6FFHcxBEy9C36ZzvIpQUTA9hhOhuDpBF0kZ7E/NsmSbZT

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	192.168.2.4	49801	87.250.251.119	443	C:\Users\user\Desktop\njw.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-29 15:51:21 UTC	274	OUT	GET /metrika/advert.gif?t=ti(4) HTTP/1.1 Accept: / Referer: http://www.all-bearings.narod.ru/firstpage.html Accept-Language: en-US Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: mc.yandex.ru Connection: Keep-Alive
2021-10-29 15:51:21 UTC	275	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Cache-Control: max-age=3600 Connection: Close Content-Length: 43 Content-Type: image/gif Date: Fri, 29 Oct 2021 15:51:21 GMT ETag: "617677e6-2b" Expires: Fri, 29 Oct 2021 16:51:21 GMT Last-Modified: Mon, 25 Oct 2021 12:24:54 GMT Strict-Transport-Security: max-age=31536000
2021-10-29 15:51:21 UTC	275	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.4	49791	87.250.251.119	443	C:\Users\user\Desktop\njw.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-29 15:51:15 UTC	0	OUT	GET /metrika/watch.js HTTP/1.1 Accept: / Referer: http://www.all-bearings.narod.ru/firstpage.html Accept-Language: en-US Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Connection: Keep-Alive Host: mc.yandex.ru
2021-10-29 15:51:16 UTC	8	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Cache-Control: max-age=3600 Connection: Close Content-Length: 132911 Content-Type: application/javascript Date: Fri, 29 Oct 2021 15:51:16 GMT ETag: "617677e6-2072f" Expires: Fri, 29 Oct 2021 16:51:16 GMT Last-Modified: Mon, 25 Oct 2021 12:24:54 GMT Strict-Transport-Security: max-age=31536000
2021-10-29 15:51:16 UTC	8	IN	Data Raw: ef bb bf 28 66 75 6e 63 74 69 6f 6e 28 29 7b 74 72 79 7b 28 66 75 6e 63 74 69 6f 6e 28 4a 63 29 7b 66 75 6e 63 74 69 6f 6e 20 48 69 28 61 29 7b 72 65 74 75 72 6e 20 61 2e 72 65 70 6c 61 63 65 28 49 69 2c 66 75 6e 63 74 69 6f 6e 28 62 2c 63 2c 64 2c 65 29 7b 72 65 74 75 72 6e 22 22 2b 63 2b 65 7d 29 7d 66 75 6e 63 74 69 6f 6e 20 4b 63 28 61 2c 62 29 7b 69 66 28 21 62 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 63 3d 4d 28 61 29 3b 72 65 74 75 72 6e 28 6e 65 77 20 52 65 67 45 78 70 28 62 29 29 2e 74 65 73 74 28 22 22 2b 63 2e 70 61 74 68 6e 61 6d 65 2b 63 2e 68 61 73 68 2b 63 2e 73 65 61 72 63 68 29 7d 66 75 6e 63 74 69 6f 6e 20 4a 69 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 44 61 28 61 2c 62 2c 66 75 6e 63 74 69 6f 6e 28 63 29 7b 76 61 72 20 64 3d 6e 28 63 2c Data Ascii: (function(){try{(function(Jc){function Hi(a){return a.replace(Ii,function(b,c,d,e){return""+c+e})}function Kc(a,b){if(!b)return!1;var c=M(a);return(new RegExp(b)).test(""+c.pathname+c.hash+c.search)}function Ji(a,b){return Da(a,b,function(c){var d=n(c,
2021-10-29 15:51:16 UTC	46	IN	Data Raw: 6b 20 61 7d 7d 63 61 74 63 68 28 48 29 7b 7d 79 3d 7b 7d 7d 49 64 28 64 2c 79 29 3b 69 66 28 21 63 2e 67 65 74 53 68 61 64 65 72 50 72 65 63 69 73 69 6f 6e 46 6f 72 6d 61 74 29 72 65 74 75 72 6e 20 42 28 22 7e 22 2c 64 29 3b 49 64 28 64 2c 66 6a 28 63 29 29 3b 72 65 74 75 72 6e 20 42 28 22 7e 22 2c 64 29 7d 66 75 6e 63 74 69 6f 6e 20 49 64 28 61 2c 62 2c 63 29 7b 76 6f 69 64 20 30 3d 3d 3d 63 26 26 28 63 3d 22 3a 22 29 3b 44 28 66 75 6e 63 74 69 6f 6e 28 64 29 7b 72 65 74 75 72 6e 20 61 2e 70 75 73 68 28 22 22 2b 0a 64 5b 30 5d 2b 63 2b 64 5b 31 5d 29 7d 2c 4e 61 28 62 29 29 7d 66 75 6e 63 74 69 6f 6e 20 67 6a 28 61 29 7b 76 61 72 20 62 3d 68 6a 28 61 29 3b 72 65 74 75 72 6e 20 62 3f 53 28 66 75 6e 63 74 69 6f 6e 28 63 2c 64 2c 65 29 7b 64 3d 22 22 2b 28 Data Ascii: k a}}catch(H){}y={}}Id(d,y);if(!c.getShaderPrecisionFormat)return B("~",d);Id(d,fj(c));return B("~",d)}function Id(a,b,c){void 0===c&&(c=":");D(function(d){return a.push(""+d[0]+c+d[1])},Na(b))}function gj(a){var b=hj(a);return b?S(function(c,d,e){d=""+(
2021-10-29 15:51:16 UTC	54	IN	Data Raw: 65 74 75 72 6e 20 63 7d 2c 7b 7d 2c 61 29 3b 72 65 74 75 72 6e 20 79 61 28 61 29 2e 6c 65 6e 67 74 68 3f 61 3a 76 6f 69 64 20 30 7d 66 75 6e 63 74 69 6f 6e 20 47 6a 28 61 2c 62 2c 63 29 7b 76 61 72 20 64 3d 21 31 2c 65 3d 22 22 3b 69 66 28 21 69 63 28 62 29 29 72 65 74 75 72 6e 20 4c 62 28 63 2c 22 45 63 6f 6d 6d 65 72 63 65 20 64 61 74 61 20 73 68 6f 75 6c 64 20 62 65 20 61 6e 20 6f 62 6a 65 63 74 22 29 2c 64 3b 76 61 72 20 66 3d 62 2e 67 6f 6f 64 73 3b 0a 73 77 69 74 63 68 28 61 29 7b 63 61 73 65 20 22 64 65 74 61 69 6c 22 3a 63 61 73 65 20 22 61 64 64 22 3a 63 61 73 65 20 22 72 65 6d 6f 76 65 22 3a 49 61 28 66 29 26 26 66 2e 6c 65 6e 67 74 68 3f 28 64 3d 52 64 28 66 75 6e 63 74 69 6f 6e 28 67 29 7b 72 65 74 75 72 6e 20 69 63 28 67 29 26 26 28 56 61 28 Data Ascii: eturn c},{},a);return ya(a).length?a:void 0}function Gj(a,b,c){var d=!1,e="";if(!ic(b))return Lb(c,"Ecommerce data should be an object"),d;var f=b.goods;switch(a){case "detail":case "add":case "remove":Ia(f)&&f.length?(d=Rd(function(g){return ic(g)&&(Va(
2021-10-29 15:51:16 UTC	62	IN	Data Raw: 52 41 59 5f 42 55 46 46 45 52 2c 64 2c 62 2e 53 54 41 54 49 43 5f 44 52 41 57 29 3b 63 2e 45 63 3d 33 3b 63 2e 4b 63 3d 33 3b 64 3d 62 2e 63 72 65 61 74 65 50 72 6f 67 72 61 6d 28 29 3b 76 61 72 20 65 3d 62 2e 63 72 65 61 74 65 53 68 61 64 65 72 28 62 2e 56 45 52 54 45 58 5f 53 48 41 44 45 52 29 3b 69 66 28 21 64 7c 7c 21 65 29 72 65 74 75 72 6e 22 22 3b 62 2e 73 68 61 64 65 72 53 6f 75 72 63 65 28 65 2c 22 61 74 74 72 69 62 75 74 65 20 76 65 63 32 20 61 74 74 72 56 65 72 74 65 78 3b 76 61 72 79 69 6e 67 20 76 65 63 32 20 76 61 72 79 69 6e 54 65 78 43 6f 6f 72 64 69 6e 61 74 65 3b 75 6e 69 66 6f 72 6d 20 76 65 63 32 20 75 6e 69 66 6f 72 6d 4f 66 66 73 65 74 3b 76 6f 69 64 20 6d 61 69 6e 28 29 7b 76 61 72 79 69 6e 54 65 78 43 6f 6f 72 64 69 6e 61 74 65 3d Data Ascii: RAY_BUFFER,d,b.STATIC_DRAW);c.Ec=3;c.Kc=3;d=b.createProgram();var e=b.createShader(b.VERTEX_SHADER);if(!d\|\|!e)return"";b.shaderSource(e,"attribute vec2 attrVertex;varying vec2 varyinTexCoordinate;uniform vec2 uniformOffset;void main(){varyinTexCoordinate=
2021-10-29 15:51:16 UTC	70	IN	Data Raw: 20 4a 28 66 75 6e 63 74 69 6f 6e 28 6c 2c 6d 29 7b 63 2e 5a 61 28 68 2c 6b 2c 66 75 6e 63 74 69 6f 6e 28 70 2c 75 29 7b 6c 28 5b 70 2c 75 5d 29 7d 29 3b 70 61 28 61 2c 76 28 6a 62 28 29 2c 6d 29 2c 35 31 30 30 2c 22 69 73 2e 6f 22 29 7d 29 7d 2c 4b 62 3a 66 75 6e 63 74 69 6f 6e 28 68 29 7b 76 61 72 20 6b 3d 7b 4d 62 3a 5b 5d 2c 68 62 3a 5b 5d 2c 64 61 74 61 3a 68 7d 3b 64 2e 70 75 73 68 28 6b 29 3b 72 65 74 75 72 6e 20 66 28 63 2e 66 61 2c 6b 2c 68 29 7d 2c 4c 62 3a 66 75 6e 63 74 69 6f 6e 28 68 29 7b 76 61 72 20 6b 3d 7b 4d 62 3a 5b 5d 2c 68 62 3a 5b 5d 2c 64 61 74 61 3a 68 7d 3b 65 2e 70 75 73 68 28 6b 29 3b 72 65 74 75 72 6e 20 66 28 63 2e 6a 61 2c 6b 2c 68 29 7d 7d 7d 66 75 6e 63 74 69 6f 6e 20 67 65 28 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f Data Ascii: J(function(l,m){c.Za(h,k,function(p,u){l([p,u])});pa(a,v(jb(),m),5100,"is.o")})},Kb:function(h){var k={Mb:[],hb:[],data:h};d.push(k);return f(c.fa,k,h)},Lb:function(h){var k={Mb:[],hb:[],data:h};e.push(k);return f(c.ja,k,h)}}}function ge(){return functio
2021-10-29 15:51:16 UTC	126	IN	Data Raw: 69 6f 6e 28 6b 29 7b 65 2e 53 63 3d 6b 2e 44 61 3b 72 65 74 75 72 6e 20 6e 65 28 61 2c 63 2c 65 29 2e 74 68 65 6e 28 76 28 6b 2e 44 61 2c 4b 29 29 7d 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 72 6c 28 61 29 7b 76 61 72 20 62 3d 22 6d 63 2e 79 61 6e 64 65 78 2e 72 75 22 2c 63 3d 6e 28 61 2c 22 64 6f 63 75 6d 65 6e 74 2e 72 65 66 65 72 72 65 72 22 29 3b 69 66 28 21 63 29 72 65 74 75 72 6e 20 62 3b 28 61 3d 59 64 28 61 2c 63 29 2e 68 6f 73 74 2e 6d 61 74 63 68 28 2f 28 3f 3a 5e 7c 5c 2e 29 28 3f 3a 79 61 7c 79 61 6e 64 65 78 29 5c 2e 28 3f 3a 5c 77 2b 7c 63 6f 6d 3f 5c 2e 5c 77 2b 29 24 2f 29 29 3f 28 61 3d 61 5b 30 5d 2e 73 70 6c 69 74 28 22 79 61 6e 64 65 78 22 29 2e 72 65 76 65 72 73 65 28 29 5b 30 5d 2e 73 75 62 73 74 72 69 6e 67 28 31 29 2c 61 3d 4e 28 61 2c Data Ascii: ion(k){e.Sc=k.Da;return ne(a,c,e).then(v(k.Da,K))})}}function rl(a){var b="mc.yandex.ru",c=n(a,"document.referrer");if(!c)return b;(a=Yd(a,c).host.match(/(?:^\|\.)(?:ya\|yandex)\.(?:\w+\|com?\.\w+)$/))?(a=a[0].split("yandex").reverse()[0].substring(1),a=N(a,
2021-10-29 15:51:16 UTC	134	IN	Data Raw: 6c 3b 67 20 69 6e 20 65 68 3f 68 3d 62 2e 67 65 74 41 74 74 72 69 62 75 74 65 26 26 62 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 65 68 5b 67 5d 29 3a 67 20 69 6e 20 55 62 26 26 28 68 3d 22 70 22 3d 3d 3d 67 3f 55 62 5b 67 5d 28 61 2c 62 2c 65 29 3a 22 63 22 3d 3d 3d 67 3f 55 62 5b 67 5d 28 61 2c 62 2c 64 29 3a 55 62 5b 67 5d 28 61 2c 62 29 29 3b 68 26 26 28 68 3d 68 2e 73 6c 69 63 65 28 30 2c 66 68 5b 67 5d 7c 7c 31 30 30 29 2c 66 5b 67 5d 3d 79 65 5b 67 5d 3f 22 22 2b 73 63 28 68 29 3a 68 29 3b 72 65 74 75 72 6e 20 66 7d 2c 7b 7d 2c 63 29 7d 66 75 6e 63 74 69 6f 6e 20 50 66 28 61 2c 62 2c 63 29 7b 69 66 28 61 2e 64 6f 63 75 6d 65 6e 74 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 26 26 0a 6b 61 28 22 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c Data Ascii: l;g in eh?h=b.getAttribute&&b.getAttribute(eh[g]):g in Ub&&(h="p"===g?Ub[g](a,b,e):"c"===g?Ub[g](a,b,d):Ub[g](a,b));h&&(h=h.slice(0,fh[g]\|\|100),f[g]=ye[g]?""+sc(h):h);return f},{},c)}function Pf(a,b,c){if(a.document.querySelectorAll&&ka("querySelectorAll
2021-10-29 15:51:16 UTC	142	IN	Data Raw: 63 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 63 3d 6e 61 28 61 72 67 75 6d 65 6e 74 73 29 2c 64 3d 63 5b 30 5d 3b 63 3d 63 2e 73 6c 69 63 65 28 31 29 3b 76 61 72 20 65 3d 4c 28 64 29 2c 66 3d 65 2e 62 28 22 6d 36 38 30 22 2c 7b 7d 29 2c 67 3d 6e 28 66 2c 61 29 3b 67 7c 7c 28 67 3d 74 28 62 29 2c 66 5b 61 5d 3d 67 2c 65 2e 6c 28 22 6d 36 38 30 22 2c 66 29 29 3b 72 65 74 75 72 6e 20 67 2e 61 70 70 6c 79 28 76 6f 69 64 20 30 2c 50 28 5b 64 5d 2c 63 29 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 7a 61 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 62 3f 61 28 62 29 3a 61 28 29 7d 66 75 6e 63 74 69 6f 6e 20 74 28 61 2c 62 29 7b 76 61 72 20 63 3d 5b 5d 2c 64 3d 5b 5d 3b 76 61 72 20 65 3d 62 3f 62 3a 4b 3b 72 65 74 75 72 6e 20 66 75 6e Data Ascii: c(a,b){return function(){var c=na(arguments),d=c[0];c=c.slice(1);var e=L(d),f=e.b("m680",{}),g=n(f,a);g\|\|(g=t(b),f[a]=g,e.l("m680",f));return g.apply(void 0,P([d],c))}}function za(a,b){return b?a(b):a()}function t(a,b){var c=[],d=[];var e=b?b:K;return fun
2021-10-29 15:51:16 UTC	150	IN	Data Raw: 2d 62 5d 3b 62 2d 3d 33 32 3b 72 65 74 75 72 6e 5b 61 5b 31 5d 3c 3c 62 7c 61 5b 30 5d 3e 3e 3e 33 32 2d 62 2c 61 5b 30 5d 3c 3c 62 7c 61 5b 31 5d 3e 3e 3e 33 32 2d 62 5d 7d 66 75 6e 63 74 69 6f 6e 20 4d 61 28 61 2c 62 29 7b 62 25 3d 36 34 3b 72 65 74 75 72 6e 20 30 3d 3d 3d 62 3f 61 3a 33 32 3e 62 3f 5b 61 5b 30 5d 3c 3c 62 7c 61 5b 31 5d 3e 3e 3e 33 32 2d 62 2c 61 5b 31 5d 3c 3c 62 5d 3a 5b 61 5b 31 5d 3c 3c 62 2d 33 32 2c 30 5d 7d 66 75 6e 63 74 69 6f 6e 20 59 28 61 2c 62 29 7b 72 65 74 75 72 6e 5b 61 5b 30 5d 5e 62 5b 30 5d 2c 61 5b 31 5d 5e 62 5b 31 5d 5d 7d 66 75 6e 63 74 69 6f 6e 20 44 68 28 61 29 7b 61 3d 59 28 61 2c 5b 30 2c 61 5b 30 5d 3e 3e 3e 31 5d 29 3b 61 3d 50 61 28 61 2c 5b 34 32 38 33 35 34 33 35 31 31 2c 33 39 38 31 38 30 36 37 39 37 5d Data Ascii: -b];b-=32;return[a[1]<<b\|a[0]>>>32-b,a[0]<<b\|a[1]>>>32-b]}function Ma(a,b){b%=64;return 0===b?a:32>b?[a[0]<<b\|a[1]>>>32-b,a[1]<<b]:[a[1]<<b-32,0]}function Y(a,b){return[a[0]^b[0],a[1]^b[1]]}function Dh(a){a=Y(a,[0,a[0]>>>1]);a=Pa(a,[4283543511,3981806797]
2021-10-29 15:51:16 UTC	158	IN	Data Raw: 72 65 74 75 72 6e 20 50 28 65 63 28 61 29 2c 4c 6d 28 61 29 7c 7c 5b 5d 29 7d 66 75 6e 63 74 69 6f 6e 20 4e 68 28 61 29 7b 72 65 74 75 72 6e 28 61 2e 73 68 69 66 74 4b 65 79 3f 32 3a 30 29 7c 28 61 2e 63 74 72 6c 4b 65 79 3f 34 3a 30 29 7c 28 61 2e 61 6c 74 4b 65 79 3f 31 3a 30 29 7c 28 61 2e 6d 65 74 61 4b 65 79 3f 38 3a 30 29 7c 28 61 2e 63 74 72 6c 4b 65 79 7c 7c 61 2e 61 6c 74 4b 65 79 3f 31 36 3a 30 29 7d 66 75 6e 63 74 69 6f 6e 20 4f 68 28 61 29 7b 76 61 72 20 62 3d 5b 5d 3b 4d 65 7c 7c 28 4d 65 3d 21 30 2c 4c 65 26 26 62 2e 70 75 73 68 2e 61 70 70 6c 79 28 62 2c 44 6d 28 61 2e 6f 2c 74 61 28 61 2e 6f 29 29 29 2c 0a 49 62 28 61 2e 6f 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 4d 65 3d 21 31 7d 2c 22 66 76 2e 63 22 29 29 3b 72 65 74 75 72 6e 20 62 7d 66 75 Data Ascii: return P(ec(a),Lm(a)\|\|[])}function Nh(a){return(a.shiftKey?2:0)\|(a.ctrlKey?4:0)\|(a.altKey?1:0)\|(a.metaKey?8:0)\|(a.ctrlKey\|\|a.altKey?16:0)}function Oh(a){var b=[];Me\|\|(Me=!0,Le&&b.push.apply(b,Dm(a.o,ta(a.o))),Ib(a.o,function(){Me=!1},"fv.c"));return b}fu
2021-10-29 15:51:16 UTC	166	IN	Data Raw: 2e 65 78 70 3d 22 65 78 70 65 72 69 6d 65 6e 74 73 22 3b 77 61 2e 4f 61 3d 22 65 63 6f 6d 6d 65 72 63 65 22 3b 46 62 2e 4f 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 29 72 65 74 75 72 6e 21 30 3d 3d 3d 61 3f 22 64 61 74 61 4c 61 79 65 72 22 3a 22 22 2b 61 7d 3b 77 61 2e 48 3d 22 70 61 72 61 6d 73 22 3b 77 61 2e 49 61 3d 22 75 73 65 72 50 61 72 61 6d 73 22 3b 77 61 2e 73 61 3d 22 61 63 63 75 72 61 74 65 54 72 61 63 6b 42 6f 75 6e 63 65 22 3b 77 61 2e 55 62 3d 22 74 72 69 67 67 65 72 45 76 65 6e 74 22 3b 46 62 2e 55 62 3d 42 6f 6f 6c 65 61 6e 3b 77 61 2e 4a 62 3d 22 73 65 6e 64 54 69 74 6c 65 22 3b 46 62 2e 4a 62 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 21 21 61 7c 7c 56 28 61 29 7d 3b 77 61 2e 67 62 3d 22 74 72 61 63 6b 48 61 73 Data Ascii: .exp="experiments";wa.Oa="ecommerce";Fb.Oa=function(a){if(a)return!0===a?"dataLayer":""+a};wa.H="params";wa.Ia="userParams";wa.sa="accurateTrackBounce";wa.Ub="triggerEvent";Fb.Ub=Boolean;wa.Jb="sendTitle";Fb.Jb=function(a){return!!a\|\|V(a)};wa.gb="trackHas
2021-10-29 15:51:16 UTC	218	IN	Data Raw: 28 63 2c 64 2c 65 29 7b 65 2b 3d 31 3b 32 3c 3d 65 26 26 21 63 26 26 28 65 3d 42 28 22 2e 22 2c 62 2e 73 6c 69 63 65 28 2d 65 29 29 2c 4e 66 28 61 2c 65 29 26 26 28 63 3d 0a 65 29 29 3b 72 65 74 75 72 6e 20 63 7d 2c 22 22 2c 62 29 7d 29 2c 78 62 3d 74 28 66 63 29 2c 43 6c 3d 74 28 66 75 6e 63 74 69 6f 6e 28 61 29 7b 5a 67 28 61 2c 22 5f 79 6d 42 52 43 22 2c 22 31 22 29 3b 76 61 72 20 62 3d 22 31 22 21 3d 3d 59 67 28 61 2c 22 5f 79 6d 42 52 43 22 29 3b 62 7c 7c 24 67 28 61 2c 22 5f 79 6d 42 52 43 22 29 3b 72 65 74 75 72 6e 20 62 7d 29 2c 41 61 3d 74 28 58 67 29 2c 74 64 3d 74 28 58 67 2c 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 72 65 74 75 72 6e 22 22 2b 62 2b 63 7d 29 2c 57 3d 74 28 44 67 29 2c 56 67 3d 79 63 28 22 72 22 2c 66 75 6e 63 74 69 6f 6e Data Ascii: (c,d,e){e+=1;2<=e&&!c&&(e=B(".",b.slice(-e)),Nf(a,e)&&(c=e));return c},"",b)}),xb=t(fc),Cl=t(function(a){Zg(a,"_ymBRC","1");var b="1"!==Yg(a,"_ymBRC");b\|\|$g(a,"_ymBRC");return b}),Aa=t(Xg),td=t(Xg,function(a,b,c){return""+b+c}),W=t(Dg),Vg=yc("r",function
2021-10-29 15:51:16 UTC	225	IN	Data Raw: 74 69 6f 6e 22 2c 22 6d 6f 7a 52 54 43 50 65 65 72 43 6f 6e 6e 65 63 74 69 6f 6e 22 2c 22 77 65 62 6b 69 74 52 54 43 50 65 65 72 43 6f 6e 6e 65 63 74 69 6f 6e 22 5d 2c 59 63 3d 74 28 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 7b 6a 61 3a 7b 7d 2c 70 65 6e 64 69 6e 67 3a 7b 7d 2c 66 61 3a 7b 7d 7d 7d 29 2c 52 65 3d 54 28 22 70 6f 73 74 4d 65 73 73 61 67 65 22 29 2c 4c 6e 3d 61 61 28 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 2c 64 29 7b 76 61 72 20 65 2c 66 3d 7b 76 61 3a 57 28 61 29 28 55 29 2c 6b 65 79 3a 61 2e 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 2c 64 69 72 3a 30 7d 3b 63 2e 6c 65 6e 67 74 68 26 26 28 66 2e 76 61 3d 70 61 72 73 65 49 6e 74 28 63 5b 30 5d 2c 31 30 29 2c 66 2e 6b 65 79 3d 70 61 72 73 65 46 6c 6f 61 74 28 63 5b 31 5d 29 2c 66 2e Data Ascii: tion","mozRTCPeerConnection","webkitRTCPeerConnection"],Yc=t(function(){return{ja:{},pending:{},fa:{}}}),Re=T("postMessage"),Ln=aa(function(a,b,c,d){var e,f={va:W(a)(U),key:a.Math.random(),dir:0};c.length&&(f.va=parseInt(c[0],10),f.key=parseFloat(c[1]),f.
2021-10-29 15:51:16 UTC	233	IN	Data Raw: 3b 63 3d 45 6b 28 61 2c 62 2c 63 29 3b 76 61 72 20 65 3d 62 61 5b 62 5d 2c 66 3d 65 3f 65 28 61 2c 64 2c 63 29 3a 43 61 28 61 2c 64 2c 63 29 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 67 3d 6e 61 28 61 72 67 75 6d 65 6e 74 73 29 2c 68 3d 67 2e 73 6c 69 63 65 28 31 29 3b 67 3d 46 28 67 5b 30 5d 2c 7b 57 3a 5b 62 5d 7d 29 3b 72 65 74 75 72 6e 20 66 2e 61 70 70 6c 79 28 76 6f 69 64 20 30 2c 50 28 5b 67 5d 2c 68 29 29 7d 7d 2c 75 69 29 2c 68 67 3d 74 28 71 28 54 28 22 69 64 22 29 2c 6d 62 28 5b 32 36 38 31 32 36 35 33 5d 29 29 2c 51 29 2c 57 6e 3d 41 28 22 64 63 2e 69 6e 69 74 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 3d 4d 28 61 29 2c 63 3d 45 63 28 61 29 2c 64 3d 78 62 28 61 29 2c 65 3d 69 67 28 61 29 2c 66 3d 65 2e Data Ascii: ;c=Ek(a,b,c);var e=ba[b],f=e?e(a,d,c):Ca(a,d,c);return function(){var g=na(arguments),h=g.slice(1);g=F(g[0],{W:[b]});return f.apply(void 0,P([g],h))}},ui),hg=t(q(T("id"),mb([26812653])),Q),Wn=A("dc.init",function(a){var b=M(a),c=Ec(a),d=xb(a),e=ig(a),f=e.
2021-10-29 15:51:16 UTC	241	IN	Data Raw: 75 6c 6c 3b 64 3d 78 28 61 2c 22 63 6c 6d 2e 70 2e 63 22 2c 66 75 6e 63 74 69 6f 6e 28 6c 29 7b 76 61 72 20 6d 3d 67 28 29 3b 69 66 28 6d 29 7b 76 61 72 20 70 3d 22 6f 62 6a 65 63 74 22 3d 3d 3d 74 79 70 65 6f 66 20 6d 3f 6d 3a 7b 7d 2c 75 3d 70 2e 66 69 6c 74 65 72 3b 0a 6d 3d 70 2e 69 73 54 72 61 63 6b 48 61 73 68 7c 7c 21 31 3b 76 61 72 20 72 3d 49 28 66 75 6e 63 74 69 6f 6e 28 79 29 7b 72 65 74 75 72 6e 28 22 22 2b 79 29 2e 74 6f 55 70 70 65 72 43 61 73 65 28 29 7d 2c 70 2e 69 67 6e 6f 72 65 54 61 67 73 7c 7c 5b 5d 29 3b 56 28 68 29 26 26 28 68 3d 70 2e 71 75 6f 74 61 7c 7c 6e 75 6c 6c 29 3b 76 61 72 20 77 3d 21 21 70 2e 71 75 6f 74 61 3b 6c 3d 7b 65 6c 65 6d 65 6e 74 3a 63 6b 28 61 2c 6c 29 2c 70 6f 73 69 74 69 6f 6e 3a 4d 63 28 61 2c 6c 29 2c 62 75 Data Ascii: ull;d=x(a,"clm.p.c",function(l){var m=g();if(m){var p="object"===typeof m?m:{},u=p.filter;m=p.isTrackHash\|\|!1;var r=I(function(y){return(""+y).toUpperCase()},p.ignoreTags\|\|[]);V(h)&&(h=p.quota\|\|null);var w=!!p.quota;l={element:ck(a,l),position:Mc(a,l),bu
2021-10-29 15:51:16 UTC	249	IN	Data Raw: 22 5f 5f 79 6d 22 2c 6d 29 26 26 6c 3b 6d 3d 21 68 67 28 62 29 3b 6c 3d 6c 62 28 61 2c 62 2c 75 3f 22 53 65 74 20 75 73 65 72 20 69 64 20 22 2b 6c 3a 28 70 3f 22 55 73 65 72 20 70 22 3a 22 50 22 29 2b 22 61 72 61 6d 73 2e 20 43 6f 75 6e 74 65 72 20 22 2b 62 2e 69 64 2c 75 3f 76 6f 69 64 20 30 3a 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 79 28 66 29 29 3b 68 28 7b 48 3a 66 2c 46 3a 68 61 28 28 63 3d 7b 7d 2c 63 2e 70 61 3d 31 2c 63 2e 61 72 3d 0a 31 2c 63 29 29 2c 44 3a 28 64 3d 7b 7d 2c 64 5b 22 70 61 67 65 2d 75 72 6c 22 5d 3d 6b 7c 7c 4d 28 61 29 2e 68 72 65 66 2c 64 29 7d 2c 62 29 2e 74 68 65 6e 28 6d 3f 6c 3a 43 29 5b 22 63 61 74 63 68 22 5d 28 78 28 61 2c 22 70 2e 73 22 29 29 2e 74 68 65 6e 28 45 28 6f 62 2c 6e 75 6c 6c 2c 61 2c 67 2c 65 29 29 7d 7d 29 Data Ascii: "__ym",m)&&l;m=!hg(b);l=lb(a,b,u?"Set user id "+l:(p?"User p":"P")+"arams. Counter "+b.id,u?void 0:JSON.stringify(f));h({H:f,F:ha((c={},c.pa=1,c.ar=1,c)),D:(d={},d["page-url"]=k\|\|M(a).href,d)},b).then(m?l:C)["catch"](x(a,"p.s")).then(E(ob,null,a,g,e))}})
2021-10-29 15:51:16 UTC	257	IN	Data Raw: 69 73 4e 61 4e 28 63 29 3f 63 3d 30 3a 28 63 3d 4d 61 74 68 2e 6d 69 6e 28 63 2c 64 29 2c 63 3d 4d 61 74 68 2e 6d 61 78 28 63 2c 30 29 29 3b 72 65 74 75 72 6e 20 63 7d 29 2c 6d 70 3d 5b 5b 5b 22 45 55 52 22 2c 22 5c 75 32 30 61 63 22 5d 2c 0a 22 39 37 38 22 5d 2c 5b 5b 22 55 53 44 22 2c 22 5c 75 30 34 32 33 5c 5c 2e 5c 75 30 34 31 35 5c 5c 2e 22 2c 22 5c 5c 24 22 5d 2c 22 38 34 30 22 5d 2c 5b 5b 22 55 41 48 22 2c 22 5c 75 30 34 31 33 5c 75 30 34 32 30 5c 75 30 34 31 64 22 2c 22 5c 75 32 30 62 34 22 5d 2c 22 39 38 30 22 5d 2c 5b 22 5c 75 30 34 32 32 5c 75 30 34 31 33 20 4b 5a 54 20 5c 75 32 30 62 38 20 5c 75 30 34 32 32 5c 75 30 34 61 32 5c 75 30 34 31 33 20 54 45 4e 47 45 20 5c 75 30 34 32 32 5c 75 30 34 31 35 5c 75 30 34 31 64 5c 75 30 34 31 33 5c 75 30 Data Ascii: isNaN(c)?c=0:(c=Math.min(c,d),c=Math.max(c,0));return c}),mp=[[["EUR","\u20ac"],"978"],[["USD","\u0423\\.\u0415\\.","\\$"],"840"],[["UAH","\u0413\u0420\u041d","\u20b4"],"980"],["\u0422\u0413 KZT \u20b8 \u0422\u04a2\u0413 TENGE \u0422\u0415\u041d\u0413\u0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.4	49793	88.212.201.198	443	C:\Users\user\Desktop\njw.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-29 15:51:15 UTC	1	OUT	GET /hit;counter1?r;s1280102432;uhttp%3A//www.all-bearings.narod.ru/firstpage.html;0.34476715437082456 HTTP/1.1 Accept: / Referer: http://www.all-bearings.narod.ru/firstpage.html Accept-Language: en-US Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Connection: Keep-Alive Host: counter.yadro.ru
2021-10-29 15:51:16 UTC	14	IN	HTTP/1.1 302 Moved Temporarily Server: nginx/1.17.9 Date: Fri, 29 Oct 2021 15:51:24 GMT Content-Type: text/html Content-Length: 32 Connection: close Location: https://counter.yadro.ru/hit;counter1?q;r;s1280102432;uhttp%3A//www.all-bearings.narod.ru/firstpage.html;0.34476715437082456 Expires: Wed, 28 Oct 2020 21:00:00 GMT Pragma: no-cache Cache-control: no-cache P3P: policyref="/w3c/p3p.xml", CP="UNI" Set-Cookie: FTID=1XV1Xy3Wb9uB1XV1Xy001EiW; path=/; expires=Fri, 28 Oct 2022 21:00:00 GMT; HttpOnly; Secure; SameSite=None; domain=.yadro.ru Strict-Transport-Security: max-age=86400
2021-10-29 15:51:16 UTC	14	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 4d 6f 76 65 64 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body>Moved</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.4	49795	88.212.201.198	443	C:\Users\user\Desktop\njw.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-29 15:51:16 UTC	263	OUT	GET /hit;counter1?q;r;s1280102432;uhttp%3A//www.all-bearings.narod.ru/firstpage.html;0.34476715437082456 HTTP/1.1 Accept: / Referer: http://www.all-bearings.narod.ru/firstpage.html Accept-Language: en-US Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Connection: Keep-Alive Host: counter.yadro.ru Cookie: FTID=1XV1Xy3Wb9uB1XV1Xy001EiW
2021-10-29 15:51:16 UTC	264	IN	HTTP/1.1 200 OK Server: nginx/1.17.9 Date: Fri, 29 Oct 2021 15:51:24 GMT Content-Type: image/gif Content-Length: 43 Connection: close Expires: Wed, 28 Oct 2020 21:00:00 GMT Pragma: no-cache Cache-control: no-cache P3P: policyref="/w3c/p3p.xml", CP="UNI" Set-Cookie: VID=27k9Bf33T4OB1XV1Xy001PnT; path=/; expires=Fri, 28 Oct 2022 21:00:00 GMT; HttpOnly; Secure; SameSite=None; domain=.yadro.ru Access-Control-Allow-Origin: * Strict-Transport-Security: max-age=86400
2021-10-29 15:51:16 UTC	265	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 ff 00 c0 c0 c0 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.4	49794	88.212.201.198	443	C:\Users\user\Desktop\njw.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-29 15:51:16 UTC	263	OUT	GET /hit;counter1?q;r;s1280102432;uhttp%3A//www.all-bearings.narod.ru/secondpage.html;0.5443641556055339 HTTP/1.1 Accept: / Referer: http://www.all-bearings.narod.ru/secondpage.html Accept-Language: en-US Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Connection: Keep-Alive Host: counter.yadro.ru Cookie: FTID=1XV1Xy3Wb9uB1XV1Xy001Ei9
2021-10-29 15:51:16 UTC	264	IN	HTTP/1.1 200 OK Server: nginx/1.17.9 Date: Fri, 29 Oct 2021 15:51:24 GMT Content-Type: image/gif Content-Length: 43 Connection: close Expires: Wed, 28 Oct 2020 21:00:00 GMT Pragma: no-cache Cache-control: no-cache P3P: policyref="/w3c/p3p.xml", CP="UNI" Set-Cookie: VID=27k78t1mnSOB1XV1Xy001Exq; path=/; expires=Fri, 28 Oct 2022 21:00:00 GMT; HttpOnly; Secure; SameSite=None; domain=.yadro.ru Access-Control-Allow-Origin: * Strict-Transport-Security: max-age=86400
2021-10-29 15:51:16 UTC	264	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 ff 00 c0 c0 c0 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.4	49796	87.250.251.119	443	C:\Users\user\Desktop\njw.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-29 15:51:20 UTC	265	OUT	GET /watch/14153041?callback=_ymjsp303195921&page-url=http%3A%2F%2Fwww.all-bearings.narod.ru%2Fsecondpage.html&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3A9ezyymqkmijljhdjn%3Afp%3A1976%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A680%3Acn%3A1%3Adp%3A0%3Als%3A1156845228070%3Ahid%3A271984739%3Az%3A120%3Ai%3A202101029175118%3Aet%3A1635522678%3Ac%3A1%3Arn%3A1015963535%3Au%3A1635522678322622628%3Aw%3A148x55%3As%3A1280x1024x32%3Aifr%3A1%3Aj%3A1%3Ans%3A1635522674734%3Ads%3A0%2C0%2C0%2C0%2C0%2C0%2C%2C128%2C0%2C1973%2C1975%2C0%2C1973%3Aco%3A0%3Arqnl%3A1%3Ast%3A1635522680%3At%3AHTTP%20404%20Resource%20not%20found&t=gdpr(14)ti(3)&wmode=5 HTTP/1.1 Accept: / Referer: http://www.all-bearings.narod.ru/secondpage.html Accept-Language: en-US Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: mc.yandex.ru Connection: Keep-Alive
2021-10-29 15:51:21 UTC	266	IN	HTTP/1.1 302 Moved temporarily Cache-Control: private, no-cache, no-store, must-revalidate, max-age=0 Connection: Close Date: Fri, 29 Oct 2021 15:51:20 GMT Expires: Fri, 29-Oct-2021 15:51:20 GMT Last-Modified: Fri, 29-Oct-2021 15:51:20 GMT Location: /watch/14153041/1?callback=_ymjsp303195921&page-url=http%3A%2F%2Fwww.all-bearings.narod.ru%2Fsecondpage.html&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3A9ezyymqkmijljhdjn%3Afp%3A1976%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A680%3Acn%3A1%3Adp%3A0%3Als%3A1156845228070%3Ahid%3A271984739%3Az%3A120%3Ai%3A202101029175118%3Aet%3A1635522678%3Ac%3A1%3Arn%3A1015963535%3Au%3A1635522678322622628%3Aw%3A148x55%3As%3A1280x1024x32%3Aifr%3A1%3Aj%3A1%3Ans%3A1635522674734%3Ads%3A0%2C0%2C0%2C0%2C0%2C0%2C%2C128%2C0%2C1973%2C1975%2C0%2C1973%3Aco%3A0%3Arqnl%3A1%3Ast%3A1635522680%3At%3AHTTP%20404%20Resource%20not%20found&t=gdpr%2814%29ti%283%29&wmode=5 Pragma: no-cache Set-Cookie: yandexuid=847304281635522680; Expires=Sat, 29-Oct-2022 15:51:20 GMT; Domain=.yandex.ru; Path=/ Set-Cookie: yabs-sid=2327043721635522680; Path=/ Set-Cookie: i=vL1T7ICVuHRXpyNPzwMzlaKjl/D94ryPalEPO4xIx2pX5AZpVtBfDP0muIercdmDCjCbNqUK2tSOHbHUPiY/6ZY1euA=; Expires=Mon, 27-Oct-2031 15:51:20 GMT; Domain=.yandex.ru; Path=/; Secure; HttpOnly Set-Cookie: ymex=1667058680.yrts.1635522680#1667058680.yrtsi.1635522680; Expires=Sat, 29-Oct-2022 15:51:20 GMT; Domain=.yandex.ru; Path=/ Strict-Transport-Security: max-age=31536000 Transfer-Encoding: chunked X-XSS-Protection: 1; mode=block
2021-10-29 15:51:21 UTC	267	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.4	49797	87.250.251.119	443	C:\Users\user\Desktop\njw.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-29 15:51:21 UTC	267	OUT	GET /watch/14153041?callback=_ymjsp355627947&page-url=http%3A%2F%2Fwww.all-bearings.narod.ru%2Ffirstpage.html&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3A9ezyymqkmijljhdjn%3Afp%3A1930%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A680%3Acn%3A1%3Adp%3A0%3Als%3A732524701665%3Ahid%3A87010386%3Az%3A120%3Ai%3A202101029175120%3Aet%3A1635522680%3Ac%3A1%3Arn%3A244404675%3Au%3A1635522678322622628%3Aw%3A148x47%3As%3A1280x1024x32%3Aifr%3A1%3Aj%3A1%3Ans%3A1635522674781%3Ads%3A0%2C0%2C0%2C0%2C0%2C0%2C%2C155%2C0%2C2520%2C2521%2C0%2C2520%3Aco%3A0%3Arqnl%3A1%3Ast%3A1635522681%3At%3AHTTP%20404%20Resource%20not%20found&t=gdpr(14)ti(3)&wmode=5 HTTP/1.1 Accept: / Referer: http://www.all-bearings.narod.ru/firstpage.html Accept-Language: en-US Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: mc.yandex.ru Connection: Keep-Alive
2021-10-29 15:51:21 UTC	268	IN	HTTP/1.1 302 Moved temporarily Cache-Control: private, no-cache, no-store, must-revalidate, max-age=0 Connection: Close Date: Fri, 29 Oct 2021 15:51:21 GMT Expires: Fri, 29-Oct-2021 15:51:21 GMT Last-Modified: Fri, 29-Oct-2021 15:51:21 GMT Location: /watch/14153041/1?callback=_ymjsp355627947&page-url=http%3A%2F%2Fwww.all-bearings.narod.ru%2Ffirstpage.html&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3A9ezyymqkmijljhdjn%3Afp%3A1930%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A680%3Acn%3A1%3Adp%3A0%3Als%3A732524701665%3Ahid%3A87010386%3Az%3A120%3Ai%3A202101029175120%3Aet%3A1635522680%3Ac%3A1%3Arn%3A244404675%3Au%3A1635522678322622628%3Aw%3A148x47%3As%3A1280x1024x32%3Aifr%3A1%3Aj%3A1%3Ans%3A1635522674781%3Ads%3A0%2C0%2C0%2C0%2C0%2C0%2C%2C155%2C0%2C2520%2C2521%2C0%2C2520%3Aco%3A0%3Arqnl%3A1%3Ast%3A1635522681%3At%3AHTTP%20404%20Resource%20not%20found&t=gdpr%2814%29ti%283%29&wmode=5 Pragma: no-cache Set-Cookie: yandexuid=3723159021635522681; Expires=Sat, 29-Oct-2022 15:51:21 GMT; Domain=.yandex.ru; Path=/ Set-Cookie: yabs-sid=702787781635522681; Path=/ Set-Cookie: i=yROKAQCkQEDp/MhTCtujtSWzFSx7PgG/2QZgPGeQuaYkCYGk4Lr5g33sdF0NzFWf3pPBk9Yj1OF7cHnVzZMM+SWO+Mc=; Expires=Mon, 27-Oct-2031 15:51:14 GMT; Domain=.yandex.ru; Path=/; Secure; HttpOnly Set-Cookie: ymex=1667058681.yrts.1635522681#1667058681.yrtsi.1635522681; Expires=Sat, 29-Oct-2022 15:51:21 GMT; Domain=.yandex.ru; Path=/ Strict-Transport-Security: max-age=31536000 Transfer-Encoding: chunked X-XSS-Protection: 1; mode=block
2021-10-29 15:51:21 UTC	270	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.4	49798	87.250.251.119	443	C:\Users\user\Desktop\njw.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-29 15:51:21 UTC	270	OUT	GET /metrika/advert.gif?t=ti(4) HTTP/1.1 Accept: / Referer: http://www.all-bearings.narod.ru/secondpage.html Accept-Language: en-US Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: mc.yandex.ru Connection: Keep-Alive
2021-10-29 15:51:21 UTC	270	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Cache-Control: max-age=3600 Connection: Close Content-Length: 43 Content-Type: image/gif Date: Fri, 29 Oct 2021 15:51:21 GMT ETag: "617677e6-2b" Expires: Fri, 29 Oct 2021 16:51:21 GMT Last-Modified: Mon, 25 Oct 2021 12:24:54 GMT Strict-Transport-Security: max-age=31536000
2021-10-29 15:51:21 UTC	270	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.2.4	49799	87.250.251.119	443	C:\Users\user\Desktop\njw.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-29 15:51:21 UTC	270	OUT	GET /watch/14153041/1?callback=_ymjsp303195921&page-url=http%3A%2F%2Fwww.all-bearings.narod.ru%2Fsecondpage.html&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3A9ezyymqkmijljhdjn%3Afp%3A1976%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A680%3Acn%3A1%3Adp%3A0%3Als%3A1156845228070%3Ahid%3A271984739%3Az%3A120%3Ai%3A202101029175118%3Aet%3A1635522678%3Ac%3A1%3Arn%3A1015963535%3Au%3A1635522678322622628%3Aw%3A148x55%3As%3A1280x1024x32%3Aifr%3A1%3Aj%3A1%3Ans%3A1635522674734%3Ads%3A0%2C0%2C0%2C0%2C0%2C0%2C%2C128%2C0%2C1973%2C1975%2C0%2C1973%3Aco%3A0%3Arqnl%3A1%3Ast%3A1635522680%3At%3AHTTP%20404%20Resource%20not%20found&t=gdpr%2814%29ti%283%29&wmode=5 HTTP/1.1 Accept: / Referer: http://www.all-bearings.narod.ru/secondpage.html Accept-Language: en-US Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: mc.yandex.ru Connection: Keep-Alive Cookie: yandexuid=847304281635522680; i=vL1T7ICVuHRXpyNPzwMzlaKjl/D94ryPalEPO4xIx2pX5AZpVtBfDP0muIercdmDCjCbNqUK2tSOHbHUPiY/6ZY1euA=; ymex=1667058680.yrts.1635522680#1667058680.yrtsi.1635522680; yabs-sid=2327043721635522680
2021-10-29 15:51:21 UTC	273	IN	HTTP/1.1 200 Ok Cache-Control: private, no-cache, no-store, must-revalidate, max-age=0 Connection: Close Content-Length: 343 Content-Type: application/javascript Date: Fri, 29 Oct 2021 15:51:21 GMT Expires: Fri, 29-Oct-2021 15:51:21 GMT Last-Modified: Fri, 29-Oct-2021 15:51:21 GMT Pragma: no-cache Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block
2021-10-29 15:51:21 UTC	273	IN	Data Raw: 2f 2a 2a 2f 74 72 79 7b 5f 79 6d 6a 73 70 33 30 33 31 39 35 39 32 31 28 7b 22 61 75 74 6f 5f 67 6f 61 6c 73 22 3a 30 2c 22 62 75 74 74 6f 6e 5f 67 6f 61 6c 73 22 3a 30 2c 22 63 5f 72 65 63 70 22 3a 22 31 2e 30 30 30 30 30 22 2c 22 66 6f 72 6d 5f 67 6f 61 6c 73 22 3a 30 2c 22 70 63 73 22 3a 22 31 22 2c 22 77 65 62 76 69 73 6f 72 22 3a 7b 22 61 72 63 68 5f 74 79 70 65 22 3a 22 6e 6f 6e 65 22 2c 22 64 61 74 65 22 3a 22 32 30 32 30 2d 30 39 2d 30 34 20 32 30 3a 33 32 3a 32 31 22 2c 22 66 6f 72 6d 73 22 3a 31 2c 22 72 65 63 70 22 3a 22 31 2e 30 30 30 30 30 22 7d 2c 22 73 62 70 22 3a 20 7b 22 61 22 3a 22 64 49 2f 53 48 47 41 4a 56 2b 51 46 38 2b 43 6a 73 68 70 4e 49 6a 41 73 64 6a 58 77 61 4e 53 70 32 70 32 45 74 59 6b 41 78 78 4b 4b 74 63 74 6a 4b 79 2b 69 75 Data Ascii: /**/try{_ymjsp303195921({"auto_goals":0,"button_goals":0,"c_recp":"1.00000","form_goals":0,"pcs":"1","webvisor":{"arch_type":"none","date":"2020-09-04 20:32:21","forms":1,"recp":"1.00000"},"sbp": {"a":"dI/SHGAJV+QF8+CjshpNIjAsdjXwaNSp2p2EtYkAxxKKtctjKy+iu

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

System Behavior

Analysis Process: njw.exe PID: 7120 Parent PID: 6120

General

Start time:	17:50:33
Start date:	29/10/2021
Path:	C:\Users\user\Desktop\njw.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\njw.exe'
Imagebase:	0x400000
File size:	1694802 bytes
MD5 hash:	3F91F84924D1DB7ACE9AD307FCAE35D1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: njw.exe PID: 7120 Parent PID: 6120 njw.exeCOMMON

Execution Graph

Execution Coverage:	11.1%
Dynamic/Decrypted Code Coverage:	13%
Signature Coverage:	8.2%
Total number of Nodes:	2000
Total number of Limit Nodes:	57

Executed Functions

Function 0042AC1C, Relevance: 33.5, APIs: 12, Strings: 7, Instructions: 226
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,CreateToolhelp32Snapshot), ref: 0042AC68
GetModuleHandleA.KERNEL32(kernel32.dll,Thread32First,00000000,kernel32.dll,CreateToolhelp32Snapshot), ref: 0042AC7F
GetModuleHandleA.KERNEL32(kernel32.dll,Thread32Next,00000000,kernel32.dll,Thread32First,00000000,kernel32.dll,CreateToolhelp32Snapshot), ref: 0042AC97
GetCurrentProcessId.KERNEL32 ref: 0042ACDB

Strings

MZP, xrefs: 0042ADB7
NtQuerySystemInformation, xrefs: 0042AD3E
Thread32Next, xrefs: 0042AC8D
ntdll.dll, xrefs: 0042AD43
CreateToolhelp32Snapshot, xrefs: 0042AC5E
kernel32.dll, xrefs: 0042AC63, 0042AC7A, 0042AC92
Thread32First, xrefs: 0042AC75

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: HandleModule$CurrentProcess
String ID: CreateToolhelp32Snapshot$MZP$NtQuerySystemInformation$Thread32First$Thread32Next$kernel32.dll$ntdll.dll
API String ID: 2298500976-1970166007
Opcode ID: f016c38b36d5398fbdd9d4d233ba64581c94305994ffee6a9e41a52ec48a2b6f
Instruction ID: 25c506a66158cd3355367edfedc91018c0085eac84d9a77a12a069d1e1ebf7d5
Opcode Fuzzy Hash: f016c38b36d5398fbdd9d4d233ba64581c94305994ffee6a9e41a52ec48a2b6f
Instruction Fuzzy Hash: E0718270F40218AFDB10EBA9D841BAEB7F8EB44704F51447AFD10E7281D678AD51CB6A

Uniqueness

Uniqueness Score: -1.00%

Function 0040648C, Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 184
registrystringlibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000105,00000000,005FA08C,?,0040627C,00400000,?,00000105,00000000,00000000,004062B8,0042E34B,00000000,0042E627), ref: 004064A8
RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,00000000,005FA08C,?,0040627C,00400000,?,00000105,00000000), ref: 004064C6
RegOpenKeyExA.ADVAPI32(80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,00000000,005FA08C), ref: 004064E4
RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000), ref: 00406502
RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,00000000,00000005,00000000,00406591,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?), ref: 0040654B
RegQueryValueExA.ADVAPI32(?,004066F8,00000000,00000000,00000000,00000005,?,?,00000000,00000000,00000000,00000005,00000000,00406591,?,80000001), ref: 00406569
RegCloseKey.ADVAPI32(?,00406598,00000000,00000000,00000005,00000000,00406591,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 0040658B
lstrcpyn.KERNEL32(?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000), ref: 004065A8
GetThreadLocale.KERNEL32(00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?), ref: 004065B5
GetLocaleInfoA.KERNEL32(00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019), ref: 004065BB
lstrlen.KERNEL32(00000000,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000), ref: 004065E6
lstrcpyn.KERNEL32(00000001,00000000,00000105,00000000,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 0040662D
LoadLibraryExA.KERNEL32(00000000,00000000,00000002,00000001,00000000,00000105,00000000,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 0040663D
lstrcpyn.KERNEL32(00000001,00000000,00000105,00000000,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 00406665
LoadLibraryExA.KERNEL32(00000000,00000000,00000002,00000001,00000000,00000105,00000000,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 00406675
lstrcpyn.KERNEL32(00000001,00000000,00000105,00000000,00000000,00000002,00000001,00000000,00000105,00000000,00000000,00000003,?,00000005,?,?), ref: 0040669B
LoadLibraryExA.KERNEL32(00000000,00000000,00000002,00000001,00000000,00000105,00000000,00000000,00000002,00000001,00000000,00000105,00000000,00000000,00000003,?), ref: 004066AB

Strings

Software\Borland\Locales, xrefs: 004064BC, 004064DA
Software\Borland\Delphi\Locales, xrefs: 004064F8

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: lstrcpyn$LibraryLoadOpen$LocaleQueryValue$CloseFileInfoModuleNameThreadlstrlen
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales
API String ID: 1759228003-2375825460
Opcode ID: 41e41b0db0f7f1ccb7cb8395cf69e8931c0eafefebc9b6fd29a6a813709a5f40
Instruction ID: 35034cb9c8b39abfd1ed4ce7b6579fd55a354f176cf6ca7fa3e2609fe7cbbef7
Opcode Fuzzy Hash: 41e41b0db0f7f1ccb7cb8395cf69e8931c0eafefebc9b6fd29a6a813709a5f40
Instruction Fuzzy Hash: A351A771A4021C7AFB21D6A49C46FEF77FC9B04744F4104B7BA05F61C2EA789E848B68

Uniqueness

Uniqueness Score: -1.00%

Function 0041CE14, Relevance: 19.6, APIs: 3, Strings: 8, Instructions: 352
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualQuery.KERNEL32(?,?,0000001C,00000000,0041D283), ref: 0041CF3C
GetVersion.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,0041D283), ref: 0041D075
GetModuleHandleA.KERNEL32(user32.dll,?,00000000,00000000,00000000,00000000,00000000,0041D283), ref: 0041D086

Strings

@HandleOnException, xrefs: 0041CFCC
@Halt0, xrefs: 0041D00E
DispatchMessageA, xrefs: 0041D08D
@HandleAnyException, xrefs: 0041D028
System, xrefs: 0041CFD3, 0041CFE9, 0041CFFF, 0041D015, 0041D02F
user32.dll, xrefs: 0041D081
@HandleAutoException, xrefs: 0041CFE2
@HandleFinally, xrefs: 0041CFF8

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: HandleModuleQueryVersionVirtual
String ID: @Halt0$@HandleAnyException$@HandleAutoException$@HandleFinally$@HandleOnException$DispatchMessageA$System$user32.dll
API String ID: 1237424064-2702513104
Opcode ID: 1379c6149f9f382d3fe842521ec3f57df3de91adc8bf4df1726b6523ff95646c
Instruction ID: ee9e27a4e0ffd690c78b592a3592fbe3e8c5dd6835b98571a8b4d3104461112d
Opcode Fuzzy Hash: 1379c6149f9f382d3fe842521ec3f57df3de91adc8bf4df1726b6523ff95646c
Instruction Fuzzy Hash: 39D1A170E442089BCB10DF69DCC5AEE77B2EB84314F24817AE5149B395C779ED86CB88

Uniqueness

Uniqueness Score: -1.00%

Function 0042EB98, Relevance: 16.7, APIs: 3, Strings: 8, Instructions: 156
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32(0072FFF8,00000000,0042ED69,?,00000000,00000000,00000000,00000000,00000000,?,0043707C,00000000,00000000,00000000), ref: 0042EBE4
LocalAlloc.KERNEL32(00000040,00000018,00000000,0042ED47,?,0072FFF8,00000000,0042ED69,?,00000000,00000000,00000000,00000000,00000000,?,0043707C), ref: 0042EC1E
LeaveCriticalSection.KERNEL32(0072FFF8,0042ED4E,0072FFF8,00000000,0042ED69,?,00000000,00000000,00000000,00000000,00000000,?,0043707C,00000000,00000000,00000000), ref: 0042ED41

Strings

HttpPassword, xrefs: 0042ECB5, 0042ED18
HttpServer, xrefs: 0042ECCE
|pC, xrefs: 0042EC57, 0042EC66, 0042EC69
SmtpAccount, xrefs: 0042EC6F
iB, xrefs: 0042ED0F, 0042ED12
HttpAccount, xrefs: 0042ECE1
SmtpPassword, xrefs: 0042EC43, 0042ECA6
SmtpServer, xrefs: 0042EC5C

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: CriticalSection$AllocEnterLeaveLocal
String ID: HttpAccount$HttpPassword$HttpServer$SmtpAccount$SmtpPassword$SmtpServer$iB$|pC
API String ID: 716609888-2538785936
Opcode ID: 359a05c34b916c2fa2df73e3abaa47fc6b3e0ead8dbd5e75bb7d7fed5bd0e2dd
Instruction ID: b1a5dffe35c2b65eac377c160e100ab3d76b18143520182c00df121b29fdb422
Opcode Fuzzy Hash: 359a05c34b916c2fa2df73e3abaa47fc6b3e0ead8dbd5e75bb7d7fed5bd0e2dd
Instruction Fuzzy Hash: B2515475B101299FDB10EB9AD841ADEB7B9EB48704F90846BF400E7341DB78ED05CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00406598, Relevance: 15.1, APIs: 10, Instructions: 98
stringlibrarythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcpyn.KERNEL32(?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000), ref: 004065A8
GetThreadLocale.KERNEL32(00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?), ref: 004065B5
GetLocaleInfoA.KERNEL32(00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019), ref: 004065BB
lstrlen.KERNEL32(00000000,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000), ref: 004065E6
lstrcpyn.KERNEL32(00000001,00000000,00000105,00000000,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 0040662D
LoadLibraryExA.KERNEL32(00000000,00000000,00000002,00000001,00000000,00000105,00000000,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 0040663D
lstrcpyn.KERNEL32(00000001,00000000,00000105,00000000,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 00406665
LoadLibraryExA.KERNEL32(00000000,00000000,00000002,00000001,00000000,00000105,00000000,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 00406675
lstrcpyn.KERNEL32(00000001,00000000,00000105,00000000,00000000,00000002,00000001,00000000,00000105,00000000,00000000,00000003,?,00000005,?,?), ref: 0040669B
LoadLibraryExA.KERNEL32(00000000,00000000,00000002,00000001,00000000,00000105,00000000,00000000,00000002,00000001,00000000,00000105,00000000,00000000,00000003,?), ref: 004066AB

Strings

Software\Borland\Locales, xrefs: 004064BC, 004064DA
Software\Borland\Delphi\Locales, xrefs: 004064F8

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: lstrcpyn$LibraryLoad$Locale$InfoThreadlstrlen
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales
API String ID: 1599918012-2375825460
Opcode ID: 8079b842eedd49424861a0e0ef99779649cd7b20b458b88265d2ac509d6a4de3
Instruction ID: 61454ffa90b4873eb83e5aa98ed909ba9c8c2f1453fa0c8e63582d35130b75c6
Opcode Fuzzy Hash: 8079b842eedd49424861a0e0ef99779649cd7b20b458b88265d2ac509d6a4de3
Instruction Fuzzy Hash: 0D316171E0021D6AFB25D6B49C86FEF7AEC8B04344F0515B7A605F62C2EA789F848B54

Uniqueness

Uniqueness Score: -1.00%

Function 0040B8E8, Relevance: 4.6, APIs: 3, Instructions: 84synchronizationnativeCOMMON

Download Yara Rule

APIs

NtdllDefWindowProc_A.NTDLL(?,?,?,?,00000000,0040BA4B), ref: 0040B922
WaitForSingleObject.KERNEL32(00000254,000000FF,?,?,?,?,00000000,0040BA4B), ref: 0040B953
ReleaseMutex.KERNEL32(00000254,0040B9C7,00000254,000000FF,?,?,?,?,00000000,0040BA4B), ref: 0040B9BA

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: MutexNtdllObjectProc_ReleaseSingleWaitWindow
String ID:
API String ID: 250368104-0
Opcode ID: 6773adef9bbb23e499ec1b3f3d4e19e4dfb5e9e8690b39ec665ce324eddf23a0
Instruction ID: 50032811fb8e66da72b736ad8a7cf76f3f7a3248e7df676ebd229ae3824abea4
Opcode Fuzzy Hash: 6773adef9bbb23e499ec1b3f3d4e19e4dfb5e9e8690b39ec665ce324eddf23a0
Instruction Fuzzy Hash: D731A7B1604208AFCB11EF69DC8195A37A8FB48324721853AF904E72A0D738ED10CBAD

Uniqueness

Uniqueness Score: -1.00%

Function 0042BA90, Relevance: 3.1, APIs: 2, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: HugeRead
String ID:
API String ID: 2080902951-0
Opcode ID: 65bbda4cf2aacf3d839f4102b2621f1d7dc26343c2337852587084a0b08523a0
Instruction ID: 3fb9157b490e494cd94c85aef85e79309f2ee38da51e1ff7ea6ec7a2e784775e
Opcode Fuzzy Hash: 65bbda4cf2aacf3d839f4102b2621f1d7dc26343c2337852587084a0b08523a0
Instruction Fuzzy Hash: C511A271F00228ABDB20CA59EC80B6FB7B8EF44320F444566E915E7785D738BD008BD9

Uniqueness

Uniqueness Score: -1.00%

Function 0068FDFC, Relevance: 1.5, APIs: 1, Instructions: 17fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00688FCF: EnterCriticalSection.KERNEL32(00695AC8), ref: 00688FF9

FindFirstFileA.KERNEL32(?,?,?,?,?), ref: 0068FE19

Memory Dump Source

Source File: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: CriticalEnterFileFindFirstSection
String ID:
API String ID: 1600835406-0
Opcode ID: 1e4e5e71357f83c645b8156b4636cc540aa6f05b7c39a9b91e975a545ac24d4f
Instruction ID: 5b51dbf89591c75594d25a11677034ce37e16300b2fdd682685cc0ef4cc3afa3
Opcode Fuzzy Hash: 1e4e5e71357f83c645b8156b4636cc540aa6f05b7c39a9b91e975a545ac24d4f
Instruction Fuzzy Hash: 3CE0E23550010DFFCF01EFA0CD0088EBBBAEF18384B008025F91896221E772DB20AB50

Uniqueness

Uniqueness Score: -1.00%

Function 0068EF5E, Relevance: 1.5, APIs: 1, Instructions: 6
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0068EF5E() {
				_Unknown_base(*)()* _t1;

				_t1 = SetUnhandledExceptionFilter(0x68ef6e); // executed
				return _t1;
			}

0x0068ef66
0x0068ef6d

APIs

SetUnhandledExceptionFilter.KERNEL32(0068EF6E,?,006885B0), ref: 0068EF66

Memory Dump Source

Source File: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: b8407ae374422cf5aea255856646c419441e3d17fc18c8f88835fdf8cd24ef17
Instruction ID: 765b59ec5eb171b47e7b3bec864eef9db4bd17b9c9fda8a4a54d384a54f2014c
Opcode Fuzzy Hash: b8407ae374422cf5aea255856646c419441e3d17fc18c8f88835fdf8cd24ef17
Instruction Fuzzy Hash: E5A0223208030CB30F003BE2BC0A8083B0EE000A203000002F30C02AA00A83E220CBB2

Uniqueness

Uniqueness Score: -1.00%

Function 00410CCC, Relevance: .4, Instructions: 444COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e56ffc53f83765ca6ab4aeb8ecbd74c6ffa0c8d44c0b2383d4b8dc6b6e154c0
Instruction ID: d7fd00ceb946d41356d866ef423b35c0d97d9735a7937f30d3077fc3f3139d5f
Opcode Fuzzy Hash: 6e56ffc53f83765ca6ab4aeb8ecbd74c6ffa0c8d44c0b2383d4b8dc6b6e154c0
Instruction Fuzzy Hash: AE121875A002099FCB14DF58C4C5A9ABBB1FF48354F158196E8489F366C7B8EDC2CB98

Uniqueness

Uniqueness Score: -1.00%

Function 006882A0, Relevance: 31.8, APIs: 16, Strings: 2, Instructions: 252
memorylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E006882A0(void* _a4) {
				void* _v8;
				struct HINSTANCE__* _v12;
				intOrPtr* _v16;
				struct HINSTANCE__* _v20;
				void* _v24;
				signed int _v28;
				intOrPtr _v32;
				intOrPtr* _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				long _v52;
				signed int* _v56;
				void* _v60;
				signed int _v64;
				long _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				long _v80;
				signed int* _v84;
				intOrPtr _v88;
				long _v92;
				void* _t128;
				void* _t137;
				void* _t155;
				void* _t161;
				intOrPtr _t166;
				void* _t168;
				signed int _t189;
				signed int _t190;
				signed int _t206;
				signed int _t207;
				void* _t267;
				void* _t269;

				_v20 = GetModuleHandleA(0);
				_t128 = LocalAlloc(0x40, 0xd440); // executed
				_v8 = _t128;
				_v16 = _v20 +  *((intOrPtr*)(_v20 + 0x3c));
				if( *_v16 != 0x4550) {
					RaiseException(0xef000002, 0, 0, 0);
				}
				_v24 = 0;
				_v48 = _v16 + 0xfffffffffffffff0;
				_v56 = _v20 +  *((intOrPtr*)(_v48 + 0xc));
				_v44 = _v20 +  *((intOrPtr*)(_v48 + 0xc)) +  *((intOrPtr*)(_v48 + 0x10));
				_v28 = _v56;
				while(_v56 < _v44) {
					_v28 = 0x3c6ef375 + _v28 * 0x19660d;
					 *_v56 =  *_v56 ^ _v28;
					_v56 =  &(_v56[1]);
				}
				_v36 = _v20 +  *((intOrPtr*)(_v48 + 0xc));
				_v40 =  *_v36;
				_v52 =  *((intOrPtr*)(_v36 + 4));
				_t137 = LocalAlloc(0x40, _v52); // executed
				_v24 = _t137;
				if(_v24 == 0 || _v52 > 0x10000) {
					RaiseException(0xef0000fe, 0, 0, 0);
				}
				_t189 = _v52;
				_t267 = _v36 + 8;
				_t190 = _t189 >> 2;
				memcpy(_v24, _t267, _t190 << 2);
				memcpy(_t267 + _t190 + _t190, _t267, _t189 & 0x00000003);
				_v32 = E00688000(_v8, _v24, _v52, _v36, _v40);
				LocalFree(_v24);
				 *0x695a20 = GetCurrentProcess();
				_v12 = GetModuleHandleA("kernel32.dll");
				if(_v12 == 0) {
					RaiseException(0xef0000fd, 0, 0, 0);
				}
				 *0x695a10 = GetProcAddress(_v12, "FlushInstructionCache");
				if( *0x695a10 == 0) {
					RaiseException(0xef0000fc, 0, 0, 0);
				}
				_v60 = 0;
				_v76 = _v16 + 0xffffffffffffffa0;
				_v84 = _a4;
				_v72 = _v20 +  *((intOrPtr*)(_v76 + 0xc)) +  *((intOrPtr*)(_v76 + 0x10));
				_v64 = _v84;
				while(_v84 < _v72) {
					_v64 = 0x3c6ef375 + _v64 * 0x19660d;
					 *_v84 =  *_v84 ^ _v64;
					_v84 =  &(_v84[1]);
				}
				_v68 =  *_a4;
				_v80 =  *((intOrPtr*)(_a4 + 4));
				_t155 = LocalAlloc(0x40, _v80); // executed
				_v60 = _t155;
				if(_v60 == 0 || _v80 > 0x10000) {
					RaiseException(0xef0000ff, 0, 0, 0);
				}
				_t206 = _v80;
				_t269 = _a4 + 8;
				_t207 = _t206 >> 2;
				memcpy(_v60, _t269, _t207 << 2);
				memcpy(_t269 + _t207 + _t207, _t269, _t206 & 0x00000003);
				E00688000(_v8, _v60, _v80, _a4, _v68);
				_t161 =  *0x695a20; // 0xffffffff
				FlushInstructionCache(_t161, _a4, _v68);
				LocalFree(_v60);
				LocalFree(_v8);
				 *0x695a24 =  *0x006885E4;
				_t166 = E0068E6F9( *0x006885E4, 0x68); // executed
				_v88 = _t166;
				if(_v88 == 0) {
					_v92 = 0;
				} else {
					_v92 = E00688240(_v88);
				}
				 *0x006885E4 = _v92;
				_t168 = E0068EF5E(); // executed
				return _t168;
			}

0x006882b0
0x006882ba
0x006882c0
0x006882cc
0x006882d8
0x006882e5
0x006882e5
0x006882eb
0x00688312
0x0068831e
0x00688330
0x00688336
0x00688344
0x0068835a
0x00688368
0x00688341
0x00688341
0x00688375
0x0068837d
0x00688386
0x0068838f
0x00688395
0x0068839c
0x006883b2
0x006883b2
0x006883b8
0x006883be
0x006883c6
0x006883c9
0x006883d0
0x006883ea
0x006883f1
0x006883fd
0x0068840d
0x00688414
0x00688421
0x00688421
0x00688436
0x00688442
0x0068844f
0x0068844f
0x00688455
0x0068847c
0x00688482
0x00688494
0x0068849a
0x006884a8
0x006884bf
0x006884cd
0x006884a5
0x006884a5
0x006884d6
0x006884df
0x006884e8
0x006884ee
0x006884f5
0x0068850b
0x0068850b
0x00688511
0x00688517
0x0068851f
0x00688522
0x00688529
0x0068853e
0x0068854b
0x00688551
0x0068855b
0x00688565
0x00688573
0x0068857b
0x00688583
0x0068858a
0x00688599
0x0068858c
0x00688594
0x00688594
0x006885a8
0x006885ab
0x006885b5

APIs

GetModuleHandleA.KERNEL32(00000000), ref: 006882AA
LocalAlloc.KERNEL32(00000040,0000D440), ref: 006882BA
RaiseException.KERNEL32(EF000002,00000000,00000000,00000000), ref: 006882E5
LocalAlloc.KERNEL32(00000040,?), ref: 0068838F
RaiseException.KERNEL32(EF0000FE,00000000,00000000,00000000), ref: 006883B2
LocalFree.KERNEL32(00000000,00000000,?,?,?), ref: 006883F1
GetCurrentProcess.KERNEL32 ref: 006883F7
GetModuleHandleA.KERNEL32(htSi), ref: 00688407
RaiseException.KERNEL32(EF0000FD,00000000,00000000,00000000), ref: 00688421
GetProcAddress.KERNEL32(00000000,FlushInstructionCache), ref: 00688430
RaiseException.KERNEL32(EF0000FC,00000000,00000000,00000000), ref: 0068844F

Part of subcall function 00688240: InitializeCriticalSection.KERNEL32(00000000,00000000), ref: 0068825F
Part of subcall function 00688240: InitializeCriticalSection.KERNEL32(-00000018), ref: 0068826C
Part of subcall function 00688240: InitializeCriticalSection.KERNEL32(-00000030), ref: 00688279
Part of subcall function 00688240: InitializeCriticalSection.KERNEL32(-00000048), ref: 00688286

LocalAlloc.KERNEL32(00000040,?), ref: 006884E8
RaiseException.KERNEL32(EF0000FF,00000000,00000000,00000000), ref: 0068850B
FlushInstructionCache.KERNEL32(FFFFFFFF,00000000,?,00000000,?,00000000,?), ref: 00688551
LocalFree.KERNEL32(00000000), ref: 0068855B
LocalFree.KERNEL32(?), ref: 00688565

Strings

FlushInstructionCache, xrefs: 00688427
htSi, xrefs: 00688402

Memory Dump Source

Source File: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: Local$ExceptionRaise$CriticalInitializeSection$AllocFree$HandleModule$AddressCacheCurrentFlushInstructionProcProcess
String ID: FlushInstructionCache$htSi
API String ID: 3723771925-4113515290
Opcode ID: c27f56af8ec5e0161befa5f7e861e330d02f9f7aa42f831fe33ad6ba02589f2d
Instruction ID: 7db19623159e5ff8f0d0927498a404f4ec41325188fa5b0572661afa0a3e3e94
Opcode Fuzzy Hash: c27f56af8ec5e0161befa5f7e861e330d02f9f7aa42f831fe33ad6ba02589f2d
Instruction Fuzzy Hash: F0B1F974E01219EFCB08DF94D985BAEBBB6FF88300F248159E906AB394D770A941CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00445B6C, Relevance: 30.0, APIs: 13, Strings: 4, Instructions: 228
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 00445B8F
GetCurrentThreadId.KERNEL32 ref: 00445BB2

Strings

4``, xrefs: 00445BB7, 00445D78
T$E, xrefs: 00445B74
8, xrefs: 00445D6D
EAbort, xrefs: 00445C2B

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: CurrentThread
String ID: 4``$8$EAbort$T$E
API String ID: 2882836952-4154414372
Opcode ID: 6992ce1acf9816ce0726acfc49b84a3e24821b4f2c12fdd4be1e55dd23eb3e72
Instruction ID: d8edd05669640197017135662d52151e9e2030eae24a8bc5650f74f2d97cbc4c
Opcode Fuzzy Hash: 6992ce1acf9816ce0726acfc49b84a3e24821b4f2c12fdd4be1e55dd23eb3e72
Instruction Fuzzy Hash: 91816D70D047499FEF11DFA5C885BAEBBB4EF08314F24856BE814E7282D738A941CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0068CF7A, Relevance: 28.6, APIs: 14, Strings: 2, Instructions: 648
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 83%

			E0068CF7A(CHAR* __ecx) {
				signed int _v8;
				char _v20;
				intOrPtr _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				void* _v80;
				char _v84;
				signed int _v88;
				intOrPtr _v92;
				signed int _v96;
				intOrPtr _v100;
				struct HINSTANCE__* _v104;
				signed int _v108;
				intOrPtr _v112;
				void* _v116;
				intOrPtr* _v120;
				long* _v124;
				intOrPtr _v128;
				signed int _v132;
				void* _v136;
				signed int _v140;
				intOrPtr _v144;
				signed int _v148;
				char* _v152;
				signed int _v156;
				long _v160;
				struct HINSTANCE__* _v164;
				signed int _v168;
				signed int _v172;
				signed int _v176;
				signed int _v180;
				signed int _v184;
				CHAR* _v212;
				struct HINSTANCE__* _v216;
				struct HINSTANCE__* _v220;
				struct HINSTANCE__* _v224;
				struct HINSTANCE__* _v228;
				struct HINSTANCE__* _t402;
				void* _t403;
				signed int _t409;
				signed int _t412;
				signed int _t415;
				signed int _t419;
				signed int _t422;
				signed int _t435;
				signed int _t447;
				struct HINSTANCE__* _t519;
				signed int _t529;
				void* _t536;
				void* _t543;
				signed int _t546;
				void* _t547;
				signed int _t556;
				signed int _t564;
				void* _t570;
				signed int _t572;
				signed int _t577;
				void* _t579;
				void* _t581;
				signed int _t585;
				signed int _t586;
				signed int _t596;
				struct HINSTANCE__* _t604;
				struct HINSTANCE__* _t606;
				void* _t611;
				void* _t615;
				void* _t622;
				signed int _t624;
				signed int _t625;
				signed int _t645;
				signed int _t652;
				void* _t679;
				void* _t689;
				void* _t692;
				void* _t693;
				void* _t714;
				intOrPtr _t732;

				_t610 = __ecx;
				_push(0xffffffff);
				_push(0x6934d8);
				_push(0x69052c);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t732;
				_push(__ecx);
				_push(__ecx);
				_v28 = _t732 - 0xcc;
				_v212 = __ecx;
				_v60 = _v60 | 0xffffffff;
				_v56 = _v56 | 0xffffffff;
				_v80 = _v80 | 0xffffffff;
				_v52 = _v52 & 0x00000000;
				_v48 = _v48 & 0x00000000;
				_v32 = _v32 & 0x00000000;
				_v44 = _v44 & 0x00000000;
				_v76 = _v76 & 0x00000000;
				_v68 = _v68 & 0x00000000;
				_v72 = _v72 & 0x00000000;
				_v64 = _v64 & 0x00000000;
				_v40 = _v40 & 0x00000000;
				_v8 = _v8 & 0x00000000;
				_t402 = GetModuleHandleA(_v212); // executed
				if(_t402 == 0) {
					_t403 = E0068E9C8(_t610, _v212);
					_pop(_t611);
					_v36 = E0068EA26(_t611, _t403);
					_t613 = _v36;
					_v96 = E0068AC70(_v36);
					__eflags = _v96;
					if(_v96 != 0) {
						_v40 = E0068EDF2(_t613, _v96, 0, 0);
						_v104 = GetModuleHandleA(_v40);
						__eflags = _v104;
						if(__eflags == 0) {
							_t409 = E00689BD7(_t613, __eflags, _v36, 0, 0,  &_v60);
							__eflags = _t409;
							if(_t409 == 0) {
								__eflags = _v60;
								if(_v60 == 0) {
									_t613 = 0xef00000f;
									E0068E6E1(_t409, 0xef00000f);
								}
							}
							L00689ED0(_t613, _v60,  &_v84);
							_t412 = E0068E6F9(_t613, 0x40);
							_pop(0xef00000f);
							_v168 = _t412;
							_v72 = _v168;
							_t415 = E0068A7E1(0xef00000f, _v60, _v72, 0x40, 0, 0,  &_v88);
							__eflags = _t415;
							if(_t415 == 0) {
								L11:
								E0068E6E1(_t415, 0xef00000f);
							} else {
								__eflags = _v88;
								if(_v88 == 0) {
									goto L11;
								}
							}
							E00689CE6(0xef00000f, _v60,  *((intOrPtr*)(_v72 + 0x3c)), 0, 0);
							_t419 = E0068E6F9(0xef00000f, 0xf8);
							_pop(_t615);
							_v172 = _t419;
							_v68 = _v172;
							_t422 = E0068A7E1(_t615, _v60, _v68, 0xf8, 0, 0,  &_v88);
							__eflags = _t422;
							if(_t422 == 0) {
								L14:
								E0068E6E1(_t422, 0xef00000f);
							} else {
								__eflags = _v88;
								if(_v88 == 0) {
									goto L14;
								}
							}
							_t424 = _v68;
							__eflags =  *_v68 - 0x4550;
							if( *_v68 != 0x4550) {
								E0068E6E1(_t424, 0xef00000c);
							}
							_t79 = ( *(_v68 + 0x14) & 0x0000ffff) + 0x18; // 0x18
							_v100 = _v68 + _t79 - _v68 +  *((intOrPtr*)(_v72 + 0x3c));
							_v92 = _v100 + ( *(_v68 + 6) & 0x0000ffff) * 0x28;
							_t435 = E0068CCEB(_v100 + ( *(_v68 + 6) & 0x0000ffff) * 0x28, _v92 + 0x28, 0x200);
							_pop(_t622);
							_v52 = _t435;
							_v176 = E0068E6F9(_t622, _v52);
							_v32 = _v176;
							_t624 = _v52;
							_t714 = _v32;
							_t625 = _t624 >> 2;
							memset(_t714 + _t625, memset(_t714, 0, _t625 << 2), (_t624 & 0x00000003) << 0);
							_v180 = E0068E6F9(0, 0x200);
							_v76 = _v180;
							memset(_v76, 0x90909090, 0x80 << 2);
							E00689CE6(0, _v60, 0, 0, 0);
							_t447 = E0068A7E1(0, _v60, _v32, _v92, 0, 0,  &_v88);
							__eflags = _t447;
							if(_t447 == 0) {
								L19:
								E0068E6E1(_t447, 0xef00000f);
							} else {
								__eflags = _v88;
								if(_v88 == 0) {
									goto L19;
								}
							}
							_v128 = _v32 +  *((intOrPtr*)(_v32 + 0x3c));
							_v116 = _v128 + ( *(_v128 + 0x14) & 0x0000ffff) + 0x18;
							_v112 = _v116 + ( *(_v128 + 6) & 0x0000ffff) * 0x28;
							_v120 = _v128 + 0x88;
							_v108 = _v128 + 0x80;
							 *(_v128 + 0x24) =  *(_v128 + 0x24) & 0x00000000;
							 *(_v128 + 0x20) =  *(_v128 + 0x20) & 0x00000000;
							 *(_v128 + 0x1c) =  *(_v128 + 0x1c) & 0x00000000;
							 *((intOrPtr*)(_v76 + 0x34)) =  *((intOrPtr*)(_v128 + 0xa0));
							 *((intOrPtr*)(_v76 + 0x38)) =  *((intOrPtr*)(_v128 + 0xa4));
							 *((intOrPtr*)(_v76 + 0x3c)) =  *((intOrPtr*)(_v128 + 0x80));
							_v124 = _v76 + 0x40;
							while(1) {
								__eflags = _v116 - _v112;
								if(_v116 >= _v112) {
									break;
								}
								 *_v124 =  *(_v116 + 0x14);
								_v124 =  &(_v124[1]);
								 *_v124 =  *(_v116 + 0x10);
								_v124 =  &(_v124[1]);
								__eflags =  *0x695a14 - 2;
								if( *0x695a14 >= 2) {
									L30:
									_t536 = _v116;
									_t674 = _v108;
									__eflags =  *((intOrPtr*)(_t536 + 0xc)) -  *_v108;
									if( *((intOrPtr*)(_t536 + 0xc)) <=  *_v108) {
										_t547 = _v116;
										_t679 = _v116;
										_t674 = _v108;
										__eflags =  *((intOrPtr*)(_t547 + 0xc)) +  *((intOrPtr*)(_t679 + 0x10)) -  *_v108;
										if( *((intOrPtr*)(_t547 + 0xc)) +  *((intOrPtr*)(_t679 + 0x10)) >  *_v108) {
											_v136 = _v136 & 0x00000000;
											_v8 = 1;
											_v136 = VirtualAlloc(0,  *(_v116 + 0x10), 0x1000, 4);
											E00689CE6(_t674, _v60,  *(_v116 + 0x14), 0, 0);
											_t556 = E0068A7E1(_t674, _v60, _v136,  *(_v116 + 0x10), 0, 0,  &_v88);
											__eflags = _t556;
											if(_t556 == 0) {
												L34:
												E0068E6E1(_t556, 0xef00000f);
											} else {
												__eflags = _v88;
												if(_v88 == 0) {
													goto L34;
												}
											}
											_v144 =  *((intOrPtr*)(_v116 + 0xc));
											_v140 = _v136 +  *_v108 - _v144;
											_v148 = _v148 & 0x00000000;
											while(1) {
												_t564 =  *(_v108 + 4);
												_t674 = 0x14;
												__eflags = _v148 - _t564 / _t674;
												if(_v148 >= _t564 / _t674) {
													break;
												}
												_v152 = _v136 +  *((intOrPtr*)(_v140 + 0xc + _v148 * 0x14)) - _v144;
												_t570 = _v116;
												__eflags = _v152 - _v136 +  *((intOrPtr*)(_t570 + 0x10));
												if(_v152 > _v136 +  *((intOrPtr*)(_t570 + 0x10))) {
													E0068E6E1(_t570, 0xef000017);
												}
												_t572 = _v148 * 0x14;
												_t674 = _v140;
												__eflags =  *(_t674 + _t572 + 0xc);
												if( *(_t674 + _t572 + 0xc) == 0) {
													L42:
												} else {
													__eflags =  *_v152;
													if( *_v152 != 0) {
														E0068CF7A(_v152);
														_t577 = _v148 + 1;
														__eflags = _t577;
														_v148 = _t577;
														continue;
													} else {
														goto L42;
													}
												}
												break;
											}
											VirtualFree(_v136,  *(_v116 + 0x10), 0x8000);
											_v136 = _v136 & 0x00000000;
											_v8 = _v8 & 0x00000000;
										}
									}
									 *(_v128 + 0x24) = E0068CCEB(_t674,  *(_v116 + 8),  *((intOrPtr*)(_v128 + 0x38))) +  *(_v128 + 0x24);
									 *(_v116 + 0x10) =  *(_v116 + 0x10) & 0x00000000;
									_t543 = _v116;
									_t278 = _t543 + 0x14;
									 *_t278 =  *(_t543 + 0x14) & 0x00000000;
									__eflags =  *_t278;
									 *((intOrPtr*)(_v116 + 0x24)) = 0xc0000080;
								} else {
									_t579 = _v116;
									__eflags =  *((intOrPtr*)(_t579 + 0xc)) -  *_v120;
									if( *((intOrPtr*)(_t579 + 0xc)) >  *_v120) {
										goto L30;
									} else {
										_t581 = _v116;
										_t689 = _v116;
										_t690 = _v120;
										__eflags =  *((intOrPtr*)(_t581 + 0xc)) +  *((intOrPtr*)(_t689 + 0x10)) -  *_v120;
										if( *((intOrPtr*)(_t581 + 0xc)) +  *((intOrPtr*)(_t689 + 0x10)) <=  *_v120) {
											goto L30;
										} else {
											_t585 = E0068CCEB(_t690,  *(_v116 + 0x10), 0x200);
											_pop(_t692);
											_v48 = _t585;
											_t586 = E0068E6F9(_t692, _v48);
											_pop(_t693);
											_v184 = _t586;
											_v44 = _v184;
											 *(_v128 + 0x20) = E0068CCEB(_t693,  *(_v116 + 8),  *((intOrPtr*)(_v128 + 0x38))) +  *(_v128 + 0x20);
											E00689CE6(_v128, _v60,  *(_v116 + 0x14), 0, 0);
											_t596 = E0068A7E1(_v128, _v60, _v44,  *(_v116 + 0x10), 0, 0,  &_v88);
											__eflags = _t596;
											if(_t596 == 0) {
												L28:
												E0068E6E1(_t596, 0xef00000f);
											} else {
												__eflags = _v88;
												if(_v88 == 0) {
													goto L28;
												}
											}
											 *(_v116 + 0x14) = _v52;
											 *((intOrPtr*)(_v116 + 0x24)) = 0xc0000040;
										}
									}
								}
								_t546 = _v116 + 0x28;
								__eflags = _t546;
								_v116 = _t546;
							}
							_v132 = _v132 & 0x00000000;
							while(1) {
								__eflags = _v132 - 0x10;
								if(_v132 >= 0x10) {
									break;
								}
								__eflags = _v132;
								if(_v132 != 0) {
									__eflags = _v132 - 2;
									if(_v132 != 2) {
										 *(_v128 + 0x7c + _v132 * 8) =  *(_v128 + 0x7c + _v132 * 8) & 0x00000000;
										 *(_v128 + 0x78 + _v132 * 8) =  *(_v128 + 0x78 + _v132 * 8) & 0x00000000;
									}
								}
								_t529 = _v132 + 1;
								__eflags = _t529;
								_v132 = _t529;
							}
							_t645 = 0xa;
							memset(_v116, 0, _t645 << 2);
							 *(_v116 + 0x14) = _v52 + _v48;
							 *((intOrPtr*)(_v116 + 0xc)) =  *((intOrPtr*)(_v128 + 0x50));
							asm("movsd");
							asm("movsw");
							 *(_v116 + 8) = 0x200;
							 *(_v116 + 0x10) = 0x200;
							 *((intOrPtr*)(_v116 + 0x24)) = 0xc0000020;
							 *(_v128 + 0x3c) = 0x200;
							 *((intOrPtr*)(_v128 + 0x50)) =  *((intOrPtr*)(_v128 + 0x50)) + 0x1000;
							 *(_v128 + 0x1c) =  *(_v128 + 0x1c) + 0x1000;
							_t652 = 5;
							memcpy(_v76, 0x690bd7, _t652 << 2);
							asm("movsw");
							asm("movsb");
							_v156 = _v76 + 1;
							 *(_v156 + 1) =  *(_v128 + 0x28);
							_v156 = _v156 + 5;
							 *(_v156 + 1) = _v36;
							_v156 = _v156 + 5;
							 *(_v156 + 1) = _v60;
							_v156 = _v156 + 5;
							_v156 = _v156 + 1;
							 *(_v156 + 1) = 0x68cddb;
							_v156 = _v156 & 0x00000000;
							asm("stosd");
							asm("stosd");
							asm("stosd");
							 *((intOrPtr*)(_v76 + 0x24)) = 8;
							 *((intOrPtr*)(_v128 + 0xa4)) = 8;
							 *((intOrPtr*)(_v128 + 0xa0)) =  *((intOrPtr*)(_v116 + 0xc)) + 0x20;
							 *(_v128 + 0x28) =  *(_v116 + 0xc);
							_t661 = _v128;
							 *(_v128 + 6) =  *(_v128 + 6) + 1;
							_v80 = CreateFileA(_v40, 0x40000000, 0, 0, 2, 0, 0);
							__eflags = _v80 - 0xffffffff;
							if(_v80 == 0xffffffff) {
								_t661 = 0xef000011;
								E0068E6E1(_t509, 0xef000011);
							}
							WriteFile(_v80, _v32, _v52,  &_v160, 0);
							__eflags = _v44;
							if(_v44 != 0) {
								WriteFile(_v80, _v44, _v48,  &_v160, 0);
							}
							WriteFile(_v80, _v76, 0x200,  &_v160, 0);
							FlushFileBuffers(_v80);
							CloseHandle(_v80);
							_v164 = LoadLibraryA(_v40);
							__eflags = _v164;
							if(_v164 == 0) {
								E0068ED30(_t661, "Z:\Projects\molestudio\molebox2\bootup\mbx_DLL.cpp", 0x174);
								E0068E6E1(DeleteFileA(_v40), 0xef000010);
							}
							_v228 = _v164;
							0x690476( &_v20, 0xffffffff);
							_t519 = _v228;
						} else {
							_v224 = _v104;
							0x690476( &_v20, 0xffffffff);
							_t519 = _v224;
						}
					} else {
						_t604 = LoadLibraryA(_v212); // executed
						_v220 = _t604;
						0x690476( &_v20, 0xffffffff);
						_t519 = _v220;
					}
				} else {
					_t606 = LoadLibraryA(_v212);
					_v216 = _t606;
					0x690476( &_v20, 0xffffffff);
					_t519 = _v216;
				}
				 *[fs:0x0] = _v20;
				return _t519;
			}

0x0068cf7a
0x0068cf7d
0x0068cf7f
0x0068cf84
0x0068cf8f
0x0068cf90
0x0068cf97
0x0068cf98
0x0068cfa2
0x0068cfa5
0x0068cfab
0x0068cfaf
0x0068cfb3
0x0068cfb7
0x0068cfbb
0x0068cfbf
0x0068cfc3
0x0068cfc7
0x0068cfcb
0x0068cfcf
0x0068cfd3
0x0068cfd7
0x0068cfdb
0x0068cfe5
0x0068cfed
0x0068d01f
0x0068d024
0x0068d02c
0x0068d02f
0x0068d037
0x0068d03a
0x0068d03e
0x0068d079
0x0068d085
0x0068d088
0x0068d08c
0x0068d0ba
0x0068d0bf
0x0068d0c1
0x0068d0c3
0x0068d0c7
0x0068d0c9
0x0068d0ce
0x0068d0ce
0x0068d0c7
0x0068d0da
0x0068d0e1
0x0068d0e6
0x0068d0e7
0x0068d0f3
0x0068d106
0x0068d10b
0x0068d10d
0x0068d115
0x0068d11a
0x0068d10f
0x0068d10f
0x0068d113
0x00000000
0x00000000
0x0068d113
0x0068d12c
0x0068d136
0x0068d13b
0x0068d13c
0x0068d148
0x0068d15e
0x0068d163
0x0068d165
0x0068d16d
0x0068d172
0x0068d167
0x0068d167
0x0068d16b
0x00000000
0x00000000
0x0068d16b
0x0068d177
0x0068d17a
0x0068d180
0x0068d187
0x0068d187
0x0068d196
0x0068d1a3
0x0068d1b5
0x0068d1c4
0x0068d1ca
0x0068d1cb
0x0068d1d7
0x0068d1e3
0x0068d1e6
0x0068d1eb
0x0068d1f0
0x0068d1fa
0x0068d207
0x0068d213
0x0068d223
0x0068d22e
0x0068d244
0x0068d249
0x0068d24b
0x0068d253
0x0068d258
0x0068d24d
0x0068d24d
0x0068d251
0x00000000
0x00000000
0x0068d251
0x0068d266
0x0068d277
0x0068d289
0x0068d294
0x0068d29f
0x0068d2a5
0x0068d2ac
0x0068d2b3
0x0068d2c3
0x0068d2d2
0x0068d2e1
0x0068d2ea
0x0068d2f8
0x0068d2fb
0x0068d2fe
0x00000000
0x00000000
0x0068d30d
0x0068d315
0x0068d321
0x0068d329
0x0068d32c
0x0068d333
0x0068d404
0x0068d404
0x0068d407
0x0068d40d
0x0068d40f
0x0068d415
0x0068d41b
0x0068d421
0x0068d424
0x0068d426
0x0068d42c
0x0068d433
0x0068d44f
0x0068d462
0x0068d47e
0x0068d483
0x0068d485
0x0068d48d
0x0068d492
0x0068d487
0x0068d487
0x0068d48b
0x00000000
0x00000000
0x0068d48b
0x0068d49d
0x0068d4b6
0x0068d4bc
0x0068d4d2
0x0068d4d5
0x0068d4dc
0x0068d4df
0x0068d4e5
0x00000000
0x00000000
0x0068d506
0x0068d50c
0x0068d518
0x0068d51e
0x0068d525
0x0068d525
0x0068d530
0x0068d533
0x0068d539
0x0068d53e
0x0068d54d
0x0068d540
0x0068d549
0x0068d54b
0x0068d555
0x0068d4cb
0x0068d4cb
0x0068d4cc
0x00000000
0x00000000
0x00000000
0x00000000
0x0068d54b
0x00000000
0x0068d53e
0x0068d570
0x0068d576
0x0068d57d
0x0068d57d
0x0068d426
0x0068d5af
0x0068d5b5
0x0068d5b9
0x0068d5bc
0x0068d5bc
0x0068d5bc
0x0068d5c3
0x0068d339
0x0068d339
0x0068d342
0x0068d344
0x00000000
0x0068d34a
0x0068d34a
0x0068d350
0x0068d356
0x0068d359
0x0068d35b
0x00000000
0x0068d361
0x0068d36c
0x0068d372
0x0068d373
0x0068d379
0x0068d37e
0x0068d37f
0x0068d38b
0x0068d3aa
0x0068d3ba
0x0068d3d3
0x0068d3d8
0x0068d3da
0x0068d3e2
0x0068d3e7
0x0068d3dc
0x0068d3dc
0x0068d3e0
0x00000000
0x00000000
0x0068d3e0
0x0068d3f2
0x0068d3f8
0x0068d3f8
0x0068d35b
0x0068d344
0x0068d2f2
0x0068d2f2
0x0068d2f5
0x0068d2f5
0x0068d5cf
0x0068d5dc
0x0068d5dc
0x0068d5e0
0x00000000
0x00000000
0x0068d5e2
0x0068d5e6
0x0068d5ea
0x0068d5ee
0x0068d5f8
0x0068d603
0x0068d603
0x0068d5ee
0x0068d5d8
0x0068d5d8
0x0068d5d9
0x0068d5d9
0x0068d60c
0x0068d612
0x0068d61d
0x0068d629
0x0068d634
0x0068d635
0x0068d63a
0x0068d644
0x0068d64e
0x0068d658
0x0068d66d
0x0068d67e
0x0068d688
0x0068d68c
0x0068d68e
0x0068d690
0x0068d695
0x0068d6a7
0x0068d6b3
0x0068d6c2
0x0068d6ce
0x0068d6dd
0x0068d6e9
0x0068d6f6
0x0068d702
0x0068d709
0x0068d718
0x0068d719
0x0068d71a
0x0068d71e
0x0068d728
0x0068d73e
0x0068d74d
0x0068d75b
0x0068d75e
0x0068d77a
0x0068d77d
0x0068d781
0x0068d783
0x0068d788
0x0068d788
0x0068d79f
0x0068d7a5
0x0068d7a9
0x0068d7bd
0x0068d7bd
0x0068d7d7
0x0068d7e0
0x0068d7e9
0x0068d7f8
0x0068d7fe
0x0068d805
0x0068d811
0x0068d826
0x0068d826
0x0068d833
0x0068d83d
0x0068d844
0x0068d08e
0x0068d093
0x0068d09d
0x0068d0a4
0x0068d0a4
0x0068d040
0x0068d046
0x0068d04e
0x0068d058
0x0068d05f
0x0068d05f
0x0068cfef
0x0068cff5
0x0068cffd
0x0068d007
0x0068d00e
0x0068d00e
0x0068d8e1
0x0068d8ec

APIs

GetModuleHandleA.KERNEL32(?), ref: 0068CFE5
LoadLibraryA.KERNEL32(?), ref: 0068CFF5
LoadLibraryA.KERNEL32(?), ref: 0068D046

Strings

Z:\Projects\molestudio\molebox2\bootup\mbx_DLL.cpp, xrefs: 0068D80C
_BOX_, xrefs: 0068D62C

Memory Dump Source

Source File: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: LibraryLoad$HandleModule
String ID: Z:\Projects\molestudio\molebox2\bootup\mbx_DLL.cpp$_BOX_
API String ID: 2593893887-309754622
Opcode ID: da4648dc99d1403d5ddc27d0ce28bc46ec17b57caf5c8fc393bc90086174c097
Instruction ID: e666f85545ea0885a52da9f9338d6b5da51e23b5c5618ae94186e17f17667789
Opcode Fuzzy Hash: da4648dc99d1403d5ddc27d0ce28bc46ec17b57caf5c8fc393bc90086174c097
Instruction Fuzzy Hash: 6D52E971E00218DFDB64DFA8D885BACBBB2FF08314F204159E519AB392DB71A991CF14

Uniqueness

Uniqueness Score: -1.00%

Function 0043CB40, Relevance: 26.7, APIs: 3, Strings: 12, Instructions: 495
filewindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MessageBeep.USER32(00000000), ref: 0043CC0C
WriteFile.KERNEL32(00000000,005FA000,00000000,?,00000000,0043D2CC,0043D2CC,005FA000,?,00607910,?,00000001,?,0044523F,?,?), ref: 0043D13C
SetEndOfFile.KERNEL32(00000000,00000000,005FA000,00000000,?,00000000,0043D2CC,0043D2CC,005FA000,?,00607910,?,00000001,?,0044523F), ref: 0043D142

Strings

current module, xrefs: 0043CF46
date/time, xrefs: 0043CEC2
count, xrefs: 0043CFDD, 0043D039
L, xrefs: 0043CC3D
executable, xrefs: 0043CF2E
version, xrefs: 0043CF76, 0043CF94
date/time, xrefs: 0043CE9D, 0043CEF3, 0043D094
*.txt, xrefs: 0043CC52
exec. date/time, xrefs: 0043CFAA
module date/time, xrefs: 0043CFC2
callstack crc, xrefs: 0043CD31, 0043D034
exception class, xrefs: 0043CD4E, 0043CF5E

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: File$BeepMessageWrite
String ID: date/time$*.txt$L$callstack crc$count$current module$date/time$exception class$exec. date/time$executable$module date/time$version
API String ID: 11317427-2501506387
Opcode ID: 1eb0f18d477a63c87e8e264402b5eb628ba25178a4cb91791152032316d575e3
Instruction ID: 18910f57363a15dfa1f1638d027c8fffd4cee4d2aaf38cd46e4d0b52b40285e7
Opcode Fuzzy Hash: 1eb0f18d477a63c87e8e264402b5eb628ba25178a4cb91791152032316d575e3
Instruction Fuzzy Hash: 3B123A70E002099FDB10EBA5D885BDEB7B5BF48318F20916AF510BB391CB78AD458B59

Uniqueness

Uniqueness Score: -1.00%

Function 0042BBB8, Relevance: 24.2, APIs: 16, Instructions: 224
memorysynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WaitForSingleObject.KERNEL32(?,000000FF,00000000,0042BE4A,?,?,?), ref: 0042BBFF
LocalSize.KERNEL32(00000000), ref: 0042BC6C
LocalSize.KERNEL32(00000000), ref: 0042BCA2
LocalFree.KERNEL32(?,00000000,00000000,0042BE25,?,?,000000FF,00000000,0042BE4A,?,?,?), ref: 0042BCB6
LocalSize.KERNEL32(00000000), ref: 0042BCBC
LocalFree.KERNEL32(?,00000000,?,00000000,00000000,0042BE25,?,?,000000FF,00000000,0042BE4A,?,?,?), ref: 0042BCCA
LocalFree.KERNEL32(00000000,00000000,?,00000000,00000000,0042BE25,?,?,000000FF,00000000,0042BE4A,?,?,?), ref: 0042BCD0
GetCurrentProcess.KERNEL32(00000000,00100040,00000000,00000000,00000000,0042BE25,?,?,000000FF,00000000,0042BE4A,?,?,?), ref: 0042BD09
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00100040,00000000,00000000,00000000,0042BE25,?,?,000000FF,00000000,0042BE4A,?,?,?), ref: 0042BD13
DuplicateHandle.KERNEL32(00000000,00000000,00000000,00000000,00100040,00000000,00000000,00000000,0042BE25,?,?,000000FF,00000000,0042BE4A), ref: 0042BD19
LocalAlloc.KERNEL32(00000040,0000001C,00000000,0042BE25,?,?,000000FF,00000000,0042BE4A,?,?,?), ref: 0042BD2C
LocalAlloc.KERNEL32(00000040,00000001,00000040,0000001C,00000000,0042BE25,?,?,000000FF,00000000,0042BE4A,?,?,?), ref: 0042BD47
LocalAlloc.KERNEL32(00000040,00000001,00000040,00000001,00000040,0000001C,00000000,0042BE25,?,?,000000FF,00000000,0042BE4A,?,?,?), ref: 0042BD5B
LocalSize.KERNEL32(?), ref: 0042BDD6
WaitForSingleObject.KERNEL32(?,00000000,00000000,0042BE25,?,?,000000FF,00000000,0042BE4A,?,?,?), ref: 0042BDE6
ReleaseMutex.KERNEL32(?,0042BE2C,?,000000FF,00000000,0042BE4A,?,?,?), ref: 0042BE1F

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: Local$Size$AllocFree$CurrentObjectProcessSingleWait$DuplicateHandleMutexRelease
String ID:
API String ID: 3731575727-0
Opcode ID: 4a226d10be0e5689b1222903dcaf70f5f0f81611f2656b9764e077457acd03bb
Instruction ID: d6b240295f11a497515275c30289a92550d1acdd33eb2583c7e21f5f3cc04d6d
Opcode Fuzzy Hash: 4a226d10be0e5689b1222903dcaf70f5f0f81611f2656b9764e077457acd03bb
Instruction Fuzzy Hash: 7B81AC70A042149FDB10EF69D881BAE77A4EB45304F91846BF914EB392CB7CEC40DB99

Uniqueness

Uniqueness Score: -1.00%

Function 0042E7FC, Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 124
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0042E734: GetCurrentProcessId.KERNEL32(?,00000000,0042E7BA,?,00000000), ref: 0042E760
Part of subcall function 0042E734: WaitForSingleObject.KERNEL32(00000000,000000FF,?,00000000,00000000,?,00000000,0042E7BA,?,00000000), ref: 0042E79A

Part of subcall function 0042B7EC: InitializeSecurityDescriptor.ADVAPI32(?,00000001,00000000,0042E75C,00000000,0042E7BA,?,00000000), ref: 0042B800
Part of subcall function 0042B7EC: SetSecurityDescriptorDacl.ADVAPI32(?,000000FF,00000000,00000000,?,00000001,00000000,0042E75C,00000000,0042E7BA,?,00000000), ref: 0042B80C

GetCurrentProcessId.KERNEL32(iB,00000000,0042E970,?,00000000,0042E992,?,00000000,00000000), ref: 0042E856
GetCurrentProcessId.KERNEL32(0042EBD3,000000FF,?,00000004,00000000,00000028,00000000,iB,00000000,0042E970,?,00000000,0042E992,?,00000000,00000000), ref: 0042E89B
OpenFileMappingA.KERNEL32(00000004,00000000,00000000), ref: 0042E8C9
GetLastError.KERNEL32(000000FF,?,00000004,00000000,00000028,00000000,iB,00000000,0042E970,?,00000000,0042E992,?,00000000,00000000), ref: 0042E8D0
InitializeCriticalSection.KERNEL32(00000008,00000000,000F001F,00000000,00000000,00000000,000000FF,?,00000004,00000000,00000028,00000000,iB,00000000,0042E970), ref: 0042E8F7
MessageBoxA.USER32 ref: 0042E937

Strings

internal error (opening settings buffer), xrefs: 0042E930
iB, xrefs: 0042E852, 0042E867, 0042E855
madExceptSettingsBuf, xrefs: 0042E86D, 0042E8B2
madExcept, xrefs: 0042E92B

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: CurrentProcess$DescriptorInitializeSecurity$CriticalDaclErrorFileLastMappingMessageObjectOpenSectionSingleWait
String ID: internal error (opening settings buffer)$iB$madExcept$madExceptSettingsBuf
API String ID: 554259201-2004705281
Opcode ID: a520201da86c91544155b15d6c37748c60bf330ee783afdcec5c649b1b573081
Instruction ID: da4038013f2275a688a9166b5df66bba4f7b57255cf10e0123217100ce2034d4
Opcode Fuzzy Hash: a520201da86c91544155b15d6c37748c60bf330ee783afdcec5c649b1b573081
Instruction Fuzzy Hash: 024185B0B443186EEB50EBA2DC42BAE77A8DB45704F904037F904FB2D2D678A845C769

Uniqueness

Uniqueness Score: -1.00%

Function 0044D104, Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 281
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

HookTThread, xrefs: 0044D33A

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID:
String ID: HookTThread
API String ID: 0-2037367185
Opcode ID: e1fdaf9d850482807fc1daf5cb6f884ab94907e5e8a63f21838e3e4fa89be6f0
Instruction ID: 257c7332132ed0e3c505c4f8848fd13293e0eaeb4dd07e62c6439ac82330cc6c
Opcode Fuzzy Hash: e1fdaf9d850482807fc1daf5cb6f884ab94907e5e8a63f21838e3e4fa89be6f0
Instruction Fuzzy Hash: 8DB16E74A003099FEB10DF98C981B9EB7F5FB49304F5085AAE904AB391D778EE00CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0040BA70, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 102
synchronizationthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 0040BAA4
GetCurrentThreadId.KERNEL32 ref: 0040BAC9
WaitForSingleObject.KERNEL32(00000000,000000FF,00000000,00000000,00000000,?,?,00000000,0040BCD6), ref: 0040BB1A
ReleaseMutex.KERNEL32(00000254,0040BBA7,00000254,000000FF,?,?,00000000,0040BCD6), ref: 0040BB9A

Strings

madToolsMsgHandlerMutex, xrefs: 0040BAF5

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: CurrentThread$MutexObjectReleaseSingleWait
String ID: madToolsMsgHandlerMutex
API String ID: 1965185967-871761905
Opcode ID: 8ed3e69b6226cc78c455cf8802a566c56ef72f02d277f8ca137b0fce9a4b788a
Instruction ID: fe342fcf527ea9f240c8836f89e6d0c6354684a447f5bd7ae9f93aad867db536
Opcode Fuzzy Hash: 8ed3e69b6226cc78c455cf8802a566c56ef72f02d277f8ca137b0fce9a4b788a
Instruction Fuzzy Hash: AF317370E046099FDB14DFA5D841A9EB7B5EB44314F20453BF501B36D1EB3CA901CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0042B538, Relevance: 9.1, APIs: 6, Instructions: 93
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,00000000,00020019,B70F0B02,00000000,0042B631,B70F0B0E,B70F0B7E,00000000,B70F0B52), ref: 0042B586
RegQueryValueExA.ADVAPI32(?,00000000,00000000,00000000,00000000,B70F0AFE,80000002,00000000,00000000,00020019,B70F0B02,00000000,0042B631,B70F0B0E,B70F0B7E,00000000), ref: 0042B5B1
LocalAlloc.KERNEL32(00000040,?,?,00000000,00000000,00000000,00000000,B70F0AFE,80000002,00000000,00000000,00020019,B70F0B02,00000000,0042B631,B70F0B0E), ref: 0042B5CA
RegQueryValueExA.ADVAPI32(?,00000000,00000000,B70F0AFA,00000000,B70F0AFE,00000040,?,?,00000000,00000000,00000000,00000000,B70F0AFE,80000002,00000000), ref: 0042B5E1
LocalFree.KERNEL32(00000000,?,00000000,00000000,B70F0AFA,00000000,B70F0AFE,00000040,?,?,00000000,00000000,00000000,00000000,B70F0AFE,80000002), ref: 0042B608
RegCloseKey.ADVAPI32(?,?,00000000,00000000,00000000,00000000,B70F0AFE,80000002,00000000,00000000,00020019,B70F0B02,00000000,0042B631,B70F0B0E,B70F0B7E), ref: 0042B611

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: LocalQueryValue$AllocCloseFreeOpen
String ID:
API String ID: 2658220197-0
Opcode ID: bf02f7612466c9e8f32361abed7e9996a425ed45ba3dead381128bebe0d80cec
Instruction ID: 6859c7db8b85a69f2b8661d8d1a4f3d77e14a9803ae17eaa1c19ae849fdc0f3c
Opcode Fuzzy Hash: bf02f7612466c9e8f32361abed7e9996a425ed45ba3dead381128bebe0d80cec
Instruction Fuzzy Hash: E831F171A04618ABDB10EBA9CC42FAFB7BCEB45704F51447AF510F7281D778AE0186A9

Uniqueness

Uniqueness Score: -1.00%

Function 0044CD40, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 105
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,0044CE69,?,00607910,?,00000000), ref: 0044CD89
GetModuleHandleA.KERNEL32(00000000,00000000,00000000,0044CE69,?,00607910,?,00000000), ref: 0044CDB4
VirtualProtect.KERNEL32(00000000,00000004,00000040,00000000,00000000,00000000,00000000,0044CE69,?,00607910,?,00000000), ref: 0044CE1C
VirtualProtect.KERNEL32(00000000,00000004,00000000,00000000,00000000,00000004,00000040,00000000,00000000,00000000,00000000,0044CE69,?,00607910,?,00000000), ref: 0044CE35

Strings

!C, xrefs: 0044CD56

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: HandleModuleProtectVirtual
String ID: !C
API String ID: 2905821283-2273022293
Opcode ID: 823d2def3dfe38cf0d3559db27a30464038f2560d5a252c8d47c5cb453a390d3
Instruction ID: ff46dd5658acbbf5915d3a5d748e236adb0f6a72f854b0dd3d621a91f42b4c47
Opcode Fuzzy Hash: 823d2def3dfe38cf0d3559db27a30464038f2560d5a252c8d47c5cb453a390d3
Instruction Fuzzy Hash: 833189B0A052059FE750EF65C8C2AAF77B9EF44304F68447BE504A7391D738AD40C7A9

Uniqueness

Uniqueness Score: -1.00%

Function 00445E06, Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 59memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00406F48: TlsGetValue.KERNEL32(00000000,00000000,00402919,0044C559,0044C57F,00000002,00000002,004046EA,?,?,?,00000002,0040476E,0040292B,00402973,?), ref: 00406F6D

VirtualAlloc.KERNEL32(00000000,MZP,00002000,00000001), ref: 00445E92
VirtualAlloc.KERNEL32(00000000,00080000,00001000,00000001,00000000,MZP,00002000,00000001), ref: 00445EA7

Strings

MadException, xrefs: 00445E46
MZP, xrefs: 00445E8B
Exception, xrefs: 00445E57

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: AllocVirtual$Value
String ID: Exception$MZP$MadException
API String ID: 2246243222-780510357
Opcode ID: b181a9dd44e3c2901ded53e41ab4c51f377af85fc3cad8b46c14d01381f35372
Instruction ID: c30187c4c35a2d6bb8d9d179fddccb91e4ab54fdf2fd8e94e9ea0ccf747e5fc3
Opcode Fuzzy Hash: b181a9dd44e3c2901ded53e41ab4c51f377af85fc3cad8b46c14d01381f35372
Instruction Fuzzy Hash: 2011C431A447005BFF10AB55AC457AE77A1EB41309F708077E5007A2D3C7785985CB1D

Uniqueness

Uniqueness Score: -1.00%

Function 0042B298, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 75COMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000104,?,00000000,0042B3AF,?,00000000,?,0042B413,00000000,0042B4EC,?,00000000,?,00445565,00000000,00445959), ref: 0042B2D2
CreateDirectoryA.KERNEL32(00000000,00000000,00000104,?,00000000,0042B3AF,?,00000000,?,0042B413,00000000,0042B4EC,?,00000000,?,00445565), ref: 0042B304
CreateDirectoryA.KERNEL32(00000000,00000000,.madExcept,00000000,00000000,00000000,00000000,00000104,?,00000000,0042B3AF,?,00000000,?,0042B413,00000000), ref: 0042B377

Strings

.madExcept, xrefs: 0042B35C

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: CreateDirectory$PathTemp
String ID: .madExcept
API String ID: 4115145201-4117059601
Opcode ID: cc4b2660333bb64770f1fbddf82e4c89239d9fe482af86b4f4ab4989cb3b0a4b
Instruction ID: 8545504f5cafbf501c3a94ccd68d6b60dd0597ad2c614c7baf41d4dca6efa616
Opcode Fuzzy Hash: cc4b2660333bb64770f1fbddf82e4c89239d9fe482af86b4f4ab4989cb3b0a4b
Instruction Fuzzy Hash: 2E21EA70B046284BDB11FB6ADC42BDA73A5EF84304F4185FAB604E7296D7BC5D408EDA

Uniqueness

Uniqueness Score: -1.00%

Function 0068CC49, Relevance: 6.0, APIs: 4, Instructions: 46
libraryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0068CC49(CHAR* __ecx, signed int __edx) {
				struct HINSTANCE__* _v8;
				intOrPtr _v12;
				CHAR* _v16;
				CHAR* _v20;
				CHAR* _v24;
				signed int _v28;
				struct HINSTANCE__* _t25;

				_v28 = __edx;
				_v24 = __ecx;
				_t36 = _v24;
				_v12 = E0068AC70(_v24);
				_v8 = _v8 & 0x00000000;
				if(_v12 == 0) {
					_t25 = GetModuleHandleA(_v24); // executed
					_v8 = _t25;
				} else {
					_v16 = E0068EDF2(_t36, _v12, 0, 0);
					_v8 = GetModuleHandleA(_v16);
					if(_v8 != 0 && (_v28 & 0x000000ff) != 0) {
						LoadLibraryA(_v16);
					}
					_v20 = _v16;
					E0068E77C(_v16, _t36, _v20);
				}
				if(_v8 != 0 && (_v28 & 0x000000ff) != 0) {
					LoadLibraryA(_v24);
				}
				return _v8;
			}

0x0068cc4f
0x0068cc52
0x0068cc55
0x0068cc5d
0x0068cc60
0x0068cc68
0x0068ccb3
0x0068ccb9
0x0068cc6a
0x0068cc79
0x0068cc85
0x0068cc8c
0x0068cc99
0x0068cc99
0x0068cca2
0x0068cca8
0x0068ccad
0x0068ccc0
0x0068cccd
0x0068cccd
0x0068ccd7

APIs

Part of subcall function 0068AC70: EnterCriticalSection.KERNEL32(00695AC8,?,?,?,?,?,?,?,?,Function_0029052C,00693478,000000FF,?,0068F9AA), ref: 0068AC9C

GetModuleHandleA.KERNEL32(?), ref: 0068CC7F
LoadLibraryA.KERNEL32(?), ref: 0068CC99
GetModuleHandleA.KERNEL32(?), ref: 0068CCB3
LoadLibraryA.KERNEL32(?), ref: 0068CCCD

Part of subcall function 0068EDF2: GetCurrentProcessId.KERNEL32(?,?,00000084,00000000,?,?,?,00000084), ref: 0068EE33
Part of subcall function 0068EDF2: GetTempPathA.KERNEL32(00000104,?,?,?,00000084,00000000), ref: 0068EE84
Part of subcall function 0068EDF2: wsprintfA.USER32 ref: 0068EEC1
Part of subcall function 0068EDF2: CharUpperBuffA.USER32(?,?,?,?,?,00000000), ref: 0068EF30

Memory Dump Source

Source File: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: HandleLibraryLoadModule$BuffCharCriticalCurrentEnterPathProcessSectionTempUpperwsprintf
String ID:
API String ID: 1923938400-0
Opcode ID: e71030d6a5497bb88893ae912dc83edeb75a129aa74f9f646caf54842b0df8f1
Instruction ID: 71fdec293fb8c4bfce11d602fc4927831e8d949268da22b6056efdc29f582a97
Opcode Fuzzy Hash: e71030d6a5497bb88893ae912dc83edeb75a129aa74f9f646caf54842b0df8f1
Instruction Fuzzy Hash: 7211E870D00219EFDF01EFA4D94A7EEBBB2AF04305F2441AAE905B22A0D7754B44EB65

Uniqueness

Uniqueness Score: -1.00%

Function 0041DF38, Relevance: 5.8, APIs: 2, Strings: 1, Instructions: 551COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C,00000000,0041E5E3), ref: 0041E03A

Strings

.@label, xrefs: 0041E316

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: QueryVirtual
String ID: .@label
API String ID: 1804819252-3308466214
Opcode ID: 2d00f4d4f3f8d2acd00cf580fe62dc4249a1565ca2ec6cbeaa7ccbda53d22733
Instruction ID: b6aa43c323a2d9ee4fd032c1343f607a5ad3f8d45021b6cfd8238ba65d8a6d78
Opcode Fuzzy Hash: 2d00f4d4f3f8d2acd00cf580fe62dc4249a1565ca2ec6cbeaa7ccbda53d22733
Instruction Fuzzy Hash: 81320938A00119AFDB10CF99C584ADEF7F2EB48314F148296ED65AB391D735EE82CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00445514, Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 388COMMON

Download Yara Rule

APIs

Part of subcall function 0042B7A8: GetSystemTime.KERNEL32(?), ref: 0042B7B0
Part of subcall function 0042B7A8: SystemTimeToFileTime.KERNEL32(?,?,?), ref: 0042B7BF

GetModuleHandleA.KERNEL32(00000000,?,00000000,004459C7,?,00607910,?,00000001,00000000,00000000,?,00445DEA,00000000,00445DFF,?,00000000), ref: 00445667
GetModuleHandleA.KERNEL32(00000000,?,00000000,004459C7,?,00607910,?,00000001,00000000,00000000,?,00445DEA,00000000,00445DFF,?,00000000), ref: 00445928

Strings

L``, xrefs: 0044579F, 00445830

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: Time$HandleModuleSystem$File
String ID: L``
API String ID: 2120564603-2928584521
Opcode ID: cbff622dcd44a12daf0b9a744282855d55bb2be5f41cd0848966678035b5d74f
Instruction ID: a840bb8cfa6292c94e8e0f3eaf7b9b38367b5677d3645b92f19b78ba6421e353
Opcode Fuzzy Hash: cbff622dcd44a12daf0b9a744282855d55bb2be5f41cd0848966678035b5d74f
Instruction Fuzzy Hash: CAF19375A005099FEF05EF64C885BAFB7B5BF49304F1444A6E801EB352CB39AC49CB65

Uniqueness

Uniqueness Score: -1.00%

Function 0044B7D0, Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 273threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0044B8C4

Strings

]D, xrefs: 0044BAAD, 0044BAB0
MEIPLWAIT, xrefs: 0044B948

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: CurrentThread
String ID: MEIPLWAIT$]D
API String ID: 2882836952-1307493707
Opcode ID: 225068fc343198fa1a3f5d7854d288bff23d04418a85acb2c0ee15c7a67f7674
Instruction ID: 007d807557b1ed4a6e7e226e4934860683cbe023119fb3f531fc7f1a89dd843a
Opcode Fuzzy Hash: 225068fc343198fa1a3f5d7854d288bff23d04418a85acb2c0ee15c7a67f7674
Instruction Fuzzy Hash: 81D12B74A01249CFDB01DFA5C484ADEBBF4FF49300F14866AE855A7352DB34AA09CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0042B3DC, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0042B298: GetTempPathA.KERNEL32(00000104,?,00000000,0042B3AF,?,00000000,?,0042B413,00000000,0042B4EC,?,00000000,?,00445565,00000000,00445959), ref: 0042B2D2
Part of subcall function 0042B298: CreateDirectoryA.KERNEL32(00000000,00000000,00000104,?,00000000,0042B3AF,?,00000000,?,0042B413,00000000,0042B4EC,?,00000000,?,00445565), ref: 0042B304
Part of subcall function 0042B298: CreateDirectoryA.KERNEL32(00000000,00000000,.madExcept,00000000,00000000,00000000,00000000,00000104,?,00000000,0042B3AF,?,00000000,?,0042B413,00000000), ref: 0042B377

DeleteFileA.KERNEL32(00000000,00000000,?,00000000,00000000,0042B4EC,?,00000000,?,00445565,00000000,00445959,?,00000000,004459C7), ref: 0042B49C
RemoveDirectoryA.KERNEL32(00000000,00000000,?,00000000,00000000,0042B4EC,?,00000000,?,00445565,00000000,00445959,?,00000000,004459C7), ref: 0042B4C1

Strings

*.*, xrefs: 0042B441

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: Directory$Create$DeleteFilePathRemoveTemp
String ID: *.*
API String ID: 3054484020-438819550
Opcode ID: 38acbbfe2dad81fa4f0d5bb28cb9c31980f1c460fce39b7f49c8c90bc52db486
Instruction ID: 3bb982c470f4826b224a914d441a47320608998997b66cf73dfb0e43ecddcc83
Opcode Fuzzy Hash: 38acbbfe2dad81fa4f0d5bb28cb9c31980f1c460fce39b7f49c8c90bc52db486
Instruction Fuzzy Hash: 3D2146709042189BDB21FBB5DD82ACD73BCEF84304F5145FBA508B3291D738AF408A99

Uniqueness

Uniqueness Score: -1.00%

Function 0042E734, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 0042B7EC: InitializeSecurityDescriptor.ADVAPI32(?,00000001,00000000,0042E75C,00000000,0042E7BA,?,00000000), ref: 0042B800
Part of subcall function 0042B7EC: SetSecurityDescriptorDacl.ADVAPI32(?,000000FF,00000000,00000000,?,00000001,00000000,0042E75C,00000000,0042E7BA,?,00000000), ref: 0042B80C

GetCurrentProcessId.KERNEL32(?,00000000,0042E7BA,?,00000000), ref: 0042E760

Part of subcall function 00407228: CreateMutexA.KERNEL32(?,00000001,00000000,?,0042E795,?,00000000,00000000,?,00000000), ref: 0040723E

WaitForSingleObject.KERNEL32(00000000,000000FF,?,00000000,00000000,?,00000000,0042E7BA,?,00000000), ref: 0042E79A

Strings

madExceptSettingsMtx, xrefs: 0042E777

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: DescriptorSecurity$CreateCurrentDaclInitializeMutexObjectProcessSingleWait
String ID: madExceptSettingsMtx
API String ID: 4044464308-1171596302
Opcode ID: 9da93b2762564384b9277dde863ff2affea87f86339b02dc9e6efabc7588dfaf
Instruction ID: 7b954b84e48ebc55d65c66ee1d67c04018e802b04cb816e60fec0271a34340d0
Opcode Fuzzy Hash: 9da93b2762564384b9277dde863ff2affea87f86339b02dc9e6efabc7588dfaf
Instruction Fuzzy Hash: 06017575A042085FDB00EBA1DC42ADEB7FDEB88324FA15576F500F36C1E678A9018779

Uniqueness

Uniqueness Score: -1.00%

Function 004459E8, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39threadwindowCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(00000000,00000244,?,00000038,?,00000000), ref: 00445A07
PostThreadMessageA.USER32(?,00000000,00000000,00000000), ref: 00445A16

Strings

8, xrefs: 004459F7

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: EventMessagePostThread
String ID: 8
API String ID: 1782233976-4194326291
Opcode ID: b80c9a64874ae66bca59b211ec96854c9e1dd56ce23d5fed54cde740addce6f3
Instruction ID: 60e4305173173cd49b4e970cbd2ef2269c8d3a1f0e719f632e354009eb1325c5
Opcode Fuzzy Hash: b80c9a64874ae66bca59b211ec96854c9e1dd56ce23d5fed54cde740addce6f3
Instruction Fuzzy Hash: 39F09671A45704BBEF20AA989C81FA6B39C9F14719F10412BB640F71C1D578AE04C7A9

Uniqueness

Uniqueness Score: -1.00%

Function 00407FD4, Relevance: 4.5, APIs: 3, Instructions: 7COMMON

Download Yara Rule

APIs

GlobalHandle.KERNEL32(05670000), ref: 00407FD5
GlobalUnWire.KERNEL32(00000000), ref: 00407FDC
GlobalFree.KERNEL32(00000000), ref: 00407FE1

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: Global$FreeHandleWire
String ID:
API String ID: 318822183-0
Opcode ID: 8b7d0559a3996ec09ec824293fdabe7fa11b13e18af1fe3f495c58ff44d9003d
Instruction ID: bf9ce320df3e29915c632ed3740557683694ac663be51e849438fec4080994a9
Opcode Fuzzy Hash: 8b7d0559a3996ec09ec824293fdabe7fa11b13e18af1fe3f495c58ff44d9003d
Instruction Fuzzy Hash: 13A00188C5821464D84072BA1C0A86E180C58952493C0486A3804F2083C83CA800007B

Uniqueness

Uniqueness Score: -1.00%

Function 00411714, Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 436COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C,00000000,00411C5C,?,00607910,?,?,?,00411C9E,?,00000000,00000000,00000000,00000000), ref: 004117AD

Part of subcall function 0040ADE4: GetModuleHandleA.KERNEL32(00000000,00000000,00000000,0040AFAA,?,00607910,?,00000057,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040AE39
Part of subcall function 0040ADE4: LoadLibraryExA.KERNEL32(00000000,00000000,00000002,00000000,0040AFAA,?,00607910,?,00000057,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040AE7C
Part of subcall function 0040ADE4: FormatMessageA.KERNEL32(00001300,?,00000057,00000400,?,00000000,00000000,00000000,0040AF88,?,00000000,0040AFAA,?,00607910,?,00000057), ref: 0040AEB8

Strings

Invalid code!, xrefs: 00411AC2

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: FormatHandleLibraryLoadMessageModuleQueryVirtual
String ID: Invalid code!
API String ID: 2076662300-2012297025
Opcode ID: e482bc16bac8d38ba19a9bc9e7add6f2b2e43ab29b4ccccc5e87141ef22cdf34
Instruction ID: 16d86ae259adae00bd4f68fe0685beef84222829119c83ed3b0625fc1cfda91e
Opcode Fuzzy Hash: e482bc16bac8d38ba19a9bc9e7add6f2b2e43ab29b4ccccc5e87141ef22cdf34
Instruction Fuzzy Hash: 3F125F74A042089FDB14DF58C484BDE7BB1AF48354F24815AE948AB362D778EDC5CB98

Uniqueness

Uniqueness Score: -1.00%

Function 0040BD30, Relevance: 3.1, APIs: 2, Instructions: 137synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 0040BA70: GetCurrentThreadId.KERNEL32 ref: 0040BAA4
Part of subcall function 0040BA70: GetCurrentThreadId.KERNEL32 ref: 0040BAC9
Part of subcall function 0040BA70: WaitForSingleObject.KERNEL32(00000000,000000FF,00000000,00000000,00000000,?,?,00000000,0040BCD6), ref: 0040BB1A
Part of subcall function 0040BA70: ReleaseMutex.KERNEL32(00000254,0040BBA7,00000254,000000FF,?,?,00000000,0040BCD6), ref: 0040BB9A

WaitForSingleObject.KERNEL32(00000254,000000FF), ref: 0040BD5D
ReleaseMutex.KERNEL32(00000254,0040BEC1,000000FF), ref: 0040BEB4

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: CurrentMutexObjectReleaseSingleThreadWait
String ID:
API String ID: 1076790184-0
Opcode ID: 89297451507f07dcf8eaf58e5594dad6d85aebe9236f5563888d47c66c82219e
Instruction ID: 579d800f2869a0263043deeba4abc94f4de9e2a2d8fa18d9af92c5b0c38e4d47
Opcode Fuzzy Hash: 89297451507f07dcf8eaf58e5594dad6d85aebe9236f5563888d47c66c82219e
Instruction Fuzzy Hash: 39517C34A0460A9FCB20DF59C880AAAB7F5FB44314F20857AE959E7391D738ED41CBD9

Uniqueness

Uniqueness Score: -1.00%

Function 00446D24, Relevance: 3.1, APIs: 2, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(00000000,00000005,00000040,?,00000000,00446E3A,?,00000000,00446E5F,?,?,?,00000000), ref: 00446DB4
VirtualProtect.KERNEL32(00000000,00000005,?,?,00000000,00000005,00000040,?,00000000,00446E3A,?,00000000,00446E5F,?,?,?), ref: 00446DD2

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 99e25ed52c6ed30910fad9794e1e076a0bddda4515bc965695daf80b8b161200
Instruction ID: f992cece7b299cab000ee85b8685c0d3137a80a7fa10af5c3e1d9bafaf83ae76
Opcode Fuzzy Hash: 99e25ed52c6ed30910fad9794e1e076a0bddda4515bc965695daf80b8b161200
Instruction Fuzzy Hash: DB31B875B04144AFD710EFA9D88196E77E9EBC9304F62447AE504E3391DB38AE018B59

Uniqueness

Uniqueness Score: -1.00%

Function 0041C45C, Relevance: 3.1, APIs: 2, Instructions: 94COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(00000000,?,0000001C,00000000,0041C57B,?,00000000,0041C5B9,?,00607910,?,00000001,?,0042D872,00000000,0042D8D8), ref: 0041C4A8
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 0041C4E6

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: FileModuleNameQueryVirtual
String ID:
API String ID: 2827130835-0
Opcode ID: d000792ce3c85d2ffbda417df055203851c8f9ad904e7fbe6177e54e40bcb824
Instruction ID: ebb318006cec01f31196544383172026961fcb11b34d1f3298ffab88241147db
Opcode Fuzzy Hash: d000792ce3c85d2ffbda417df055203851c8f9ad904e7fbe6177e54e40bcb824
Instruction Fuzzy Hash: D731F770640214ABDB21DA65CCD1BEB73EEDB4D304F4040BBF64492691DA78ADC08E58

Uniqueness

Uniqueness Score: -1.00%

Function 0044D4D0, Relevance: 3.1, APIs: 2, Instructions: 61threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(?,?,Function_0004CFA0,?,?,?), ref: 0044D523
GetCurrentThreadId.KERNEL32 ref: 0044D540

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: Thread$CreateCurrent
String ID:
API String ID: 1518938775-0
Opcode ID: cbee45395a4d4fc12741492b771b45ca5d03ae8d013116a14cab34c15e4aa9b9
Instruction ID: 1d2351ab5d38bec11989de91c60cb1f3812a521254a55c93cb931a4661809088
Opcode Fuzzy Hash: cbee45395a4d4fc12741492b771b45ca5d03ae8d013116a14cab34c15e4aa9b9
Instruction Fuzzy Hash: 3A11C8B6A04219BFDB41DF99DC91E9FB7FCEB4C304B514466B915E3240DA38EA048BA4

Uniqueness

Uniqueness Score: -1.00%

Function 00413288, Relevance: 3.1, APIs: 2, Instructions: 51COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,00000000,00000004,?,?,?,00000000), ref: 004132D6
ReadProcessMemory.KERNEL32(00000000,?,00000000,00000004,?,?,?,00000000), ref: 004132DC

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: Process$CurrentMemoryRead
String ID:
API String ID: 267060218-0
Opcode ID: 0f8f438bcd480190302ec1ef4d735d2650f217d0d13f8c2afa17ba847d6ad4fd
Instruction ID: 0ba8ceb97ae1fa9dbf94b0f3ed7a690fc105c03b9b89c93d604d5ea7d0fbfc80
Opcode Fuzzy Hash: 0f8f438bcd480190302ec1ef4d735d2650f217d0d13f8c2afa17ba847d6ad4fd
Instruction Fuzzy Hash: AE012071708104AB9710EE9E5C416EBB7DCAB94311B14007BB804D3341DB39DF85D26D

Uniqueness

Uniqueness Score: -1.00%

Function 0068C930, Relevance: 3.0, APIs: 2, Instructions: 44
memoryCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E0068C930(void* _a4) {
				intOrPtr _v8;
				void* _v12;
				long _v16;
				long _v20;
				void* _t14;
				void* _t15;
				int _t18;

				_v8 = 0;
				if( *0x69a030 == 0) {
					E0068E6E1(_t14, 0xef00000a);
				}
				_t15 = _a4;
				0x690235( *_t15);
				_v12 = _t15;
				if(_v12 != 0) {
					_t18 = VirtualProtect(_a4, 4, 4,  &_v20); // executed
					if(_t18 == 0) {
						E0068E6E1(_t18, 0xef00000b);
					}
					 *_a4 =  *_v12;
					VirtualProtect(_a4, 4, _v20,  &_v16); // executed
					_v8 = 1;
				}
				return _v8;
			}

0x0068c936
0x0068c944
0x0068c94b
0x0068c94b
0x0068c950
0x0068c95c
0x0068c961
0x0068c968
0x0068c976
0x0068c97e
0x0068c985
0x0068c985
0x0068c992
0x0068c9a2
0x0068c9a8
0x0068c9a8
0x0068c9b5

APIs

VirtualProtect.KERNEL32(00000000,00000004,00000004,?,?,?,0068C90A), ref: 0068C976
VirtualProtect.KERNEL32(00000000,00000004,?,0068C90A,?,0068C90A), ref: 0068C9A2

Part of subcall function 0068E6E1: RaiseException.KERNEL32(00000000,00000000,00000000,00000000,EF00000D,?,0068E777,024B0488,?,0068E703,024B0488,024B0488,?,00688580,00000068), ref: 0068E6F1

Memory Dump Source

Source File: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: ProtectVirtual$ExceptionRaise
String ID:
API String ID: 2285923662-0
Opcode ID: bea95e8d0a27382d17352ba792ef777e7934b1469990a840f3c9ab85a3bcb04a
Instruction ID: 7ad27c4e04248ce158150094e332f1df2be133a542c546e6c9aa77d7d9518c33
Opcode Fuzzy Hash: bea95e8d0a27382d17352ba792ef777e7934b1469990a840f3c9ab85a3bcb04a
Instruction Fuzzy Hash: 0E010074A00208EFDF04EFA4DC45BAD77BAFB84714F108688F9099B390DB715A51CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00407FA8, Relevance: 3.0, APIs: 2, Instructions: 6memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(C08B0002,05E70000,004185DE,?,-0000000E,00419AA2,00000000,00419B53,?,00000000,00000000,00419B7D,?,00000000,00000004,00000000), ref: 00407FAA
GlobalFix.KERNEL32(00000000), ref: 00407FB0

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: Global$Alloc
String ID:
API String ID: 2558781224-0
Opcode ID: 20d48b862582ff9fa3717c59226fc903c8685604ff1cfd308f2dd2775e5a4f90
Instruction ID: a39a6022b1cc374292960b0e17bc1fecf98ba161e91244267312326eb72c791a
Opcode Fuzzy Hash: 20d48b862582ff9fa3717c59226fc903c8685604ff1cfd308f2dd2775e5a4f90
Instruction Fuzzy Hash: 709002E4C0920125DC4473B20C0AD2B081C58C070C7C0886E7040B20A3883CF440403E

Uniqueness

Uniqueness Score: -1.00%

Function 00401674, Relevance: 2.5, APIs: 2, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00002000,00000001,?,?,?,0040197D), ref: 004016A3
VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,?,00002000,00000001,?,?,?,0040197D), ref: 004016CA

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 7df549ffc28c32cb2bd68b6daee27827f0b0854fe30f80007c2715c349264863
Instruction ID: 4cb07ffbe4a022823a0cd7d68d0b0d47ec14a5362f4d7301b3da54b1d36325a0
Opcode Fuzzy Hash: 7df549ffc28c32cb2bd68b6daee27827f0b0854fe30f80007c2715c349264863
Instruction Fuzzy Hash: 7FF0A7B3F0072017DB205A6A4C85B5369C59F857A4F194577FD08FF3E9D6BA8C0142AA

Uniqueness

Uniqueness Score: -1.00%

Function 004204C4, Relevance: 1.9, APIs: 1, Instructions: 377COMMON

Download Yara Rule

APIs

IsBadHugeReadPtr.KERNEL32(00000000,00000000), ref: 0042057B

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: HugeRead
String ID:
API String ID: 2080902951-0
Opcode ID: 2cb844271f2d830aa0ed6b5c5b8a96cc7aa137eabc1be76e7944084dee4482a4
Instruction ID: 3de7cae0edc3296a3b6615fa1b3824bb8634309011725cbd8b4182b10f1b6b9e
Opcode Fuzzy Hash: 2cb844271f2d830aa0ed6b5c5b8a96cc7aa137eabc1be76e7944084dee4482a4
Instruction Fuzzy Hash: 1CD1F4713042589FE719DF29E84579A3BE5EB89314FA2417BF801976E2C77C9CC1CA18

Uniqueness

Uniqueness Score: -1.00%

Function 0041EEFC, Relevance: 1.7, APIs: 1, Instructions: 189COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C,?), ref: 0041F056

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: QueryVirtual
String ID:
API String ID: 1804819252-0
Opcode ID: e8031176c9c19f0f2ef0ef00ee5f12e7da453bd5b4e057b7680f3b39d0daa6d3
Instruction ID: 735d9e6a4d719bf9bea4e9c26f47b592e4bb65f376ce5a7d85718859a76511a2
Opcode Fuzzy Hash: e8031176c9c19f0f2ef0ef00ee5f12e7da453bd5b4e057b7680f3b39d0daa6d3
Instruction Fuzzy Hash: C461C174A00149AFCB10CA99C880EEEFBB5FF48314F244266E9549B382D735EDC6CB94

Uniqueness

Uniqueness Score: -1.00%

Function 0041CB28, Relevance: 1.6, APIs: 1, Instructions: 144COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,?,00000004,00000000,0041CF63,?,?,0000001C,00000000,0041D283), ref: 0041CB79

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: FileModuleName
String ID:
API String ID: 514040917-0
Opcode ID: dc8b7ec55a5303f9a42151de484fd838b0f1c51d778216262f9857b0e16eefd2
Instruction ID: 027f15c874b36ed5794fbe4f00a51eea8d4b3a2995432e0e033781a6f69b01c7
Opcode Fuzzy Hash: dc8b7ec55a5303f9a42151de484fd838b0f1c51d778216262f9857b0e16eefd2
Instruction Fuzzy Hash: FF513B70A482469FD300DF29D8C5B66B7E2FB94318F18823AD55887352E738EC91CBC9

Uniqueness

Uniqueness Score: -1.00%

Function 0068C7A0, Relevance: 1.6, APIs: 1, Instructions: 120
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E0068C7A0(char _a4, intOrPtr* _a8) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr* _v16;
				char _v20;
				intOrPtr* _v24;
				intOrPtr _v28;
				intOrPtr* _v32;
				signed int _v36;
				void* _v40;
				CHAR* _v44;
				intOrPtr _v48;
				intOrPtr _t70;
				CHAR* _t74;
				struct HINSTANCE__* _t80;
				intOrPtr _t85;
				intOrPtr _t88;
				intOrPtr _t116;
				intOrPtr _t123;
				void* _t129;

				_v20 = _a4;
				_v16 = _a8;
				_v24 = _a8;
				while(_v24 != 0) {
					_t85 =  *_v24;
					if(_t85 != _a4) {
						_v24 =  *((intOrPtr*)(_v24 + 4));
						continue;
					}
					return _t85;
				}
				_t88 =  *0x695af8; // 0x0
				 *0x695af8 = _t88 + 1;
				_v28 = _a4;
				_t70 = _v28;
				_v32 = _v28 +  *((intOrPtr*)(_t70 + 0x3c));
				if( *_v32 != 0x4550) {
					_t70 = E0068E6E1(_t70, 0xef00000c);
				}
				if( *0x695a14 != 1 || _a4 <= 0x80000000) {
					_v12 = _v28 +  *((intOrPtr*)(_v32 + 0x80));
					_v8 =  *(_v32 + 0x84) / 0x14;
					_v36 = 0;
					while(1) {
						_t74 = _v36;
						if(_t74 >= _v8) {
							break;
						}
						_t74 = _v28 +  *((intOrPtr*)(_v12 + 0xc + _v36 * 0x14));
						_v44 = _t74;
						if( *((intOrPtr*)(_v12 + 0xc + _v36 * 0x14)) == 0) {
							L16:
							break;
						}
						_t74 = _v28;
						if(0 != 0) {
							_v40 = _v28 +  *((intOrPtr*)(_v12 + 0x10 + _v36 * 0x14));
							_t123 =  *0x695448; // 0x450518
							_v48 = _t123;
							 *0x695448 = _v44;
							_t80 = GetModuleHandleA(_v44); // executed
							E0068C7A0(_t80,  &_v20); // executed
							_t129 = _t129 + 8;
							 *0x695448 = _v48;
							while( *_v40 != 0) {
								_push(_v44);
								E0068C930(_v40); // executed
								_t129 = _t129 + 8;
								_v40 = _v40 + 4;
							}
							_v36 = _v36 + 1;
							continue;
						}
						goto L16;
					}
					_t116 =  *0x695af8; // 0x0
					 *0x695af8 = _t116 - 1;
					return _t74;
				} else {
					return _t70;
				}
			}

0x0068c7a9
0x0068c7af
0x0068c7b5
0x0068c7c3
0x0068c7cc
0x0068c7d1
0x0068c7c0
0x00000000
0x0068c7c0
0x00000000
0x0068c7d1
0x0068c7da
0x0068c7e3
0x0068c7ec
0x0068c7ef
0x0068c7f8
0x0068c804
0x0068c80b
0x0068c80b
0x0068c817
0x0068c833
0x0068c848
0x0068c84b
0x0068c85d
0x0068c85d
0x0068c863
0x00000000
0x00000000
0x0068c875
0x0068c879
0x0068c88a
0x0068c8a5
0x00000000
0x0068c8a5
0x0068c899
0x0068c8a3
0x0068c8b7
0x0068c8ba
0x0068c8c0
0x0068c8c6
0x0068c8d3
0x0068c8da
0x0068c8df
0x0068c8e5
0x0068c8f5
0x0068c900
0x0068c905
0x0068c90a
0x0068c8f2
0x0068c8f2
0x0068c85a
0x00000000
0x0068c85a
0x00000000
0x0068c8a3
0x0068c914
0x0068c91d
0x00000000
0x00000000
0x00000000
0x00000000

APIs

GetModuleHandleA.KERNEL32(?,?), ref: 0068C8D3

Memory Dump Source

Source File: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 3c3919b1abb053e2554a618bfd56dd739ed359a8a699a44c3c8fa9764ebc7d1a
Instruction ID: b7aceb4d0d8a3590b7a32dc19f6ab29a5a8eb58b24ead72d6699c9f786b12b86
Opcode Fuzzy Hash: 3c3919b1abb053e2554a618bfd56dd739ed359a8a699a44c3c8fa9764ebc7d1a
Instruction Fuzzy Hash: 6951E974E00109CFCF08DF98D5909EDBBB6FB48324F24825AD916AB751C734A981CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 004373BC, Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,00000000,0000001C,00000000,004374CF,?,?,00000000), ref: 004373E9

Part of subcall function 0042E204: FindResourceA.KERNEL32(00400000,TMADEXCEPT,0000000A), ref: 0042E20C

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: FindQueryResourceVirtual
String ID:
API String ID: 2266176927-0
Opcode ID: 9d30e83fa00c56a554f8be335964d3f53130ecc896b4dc64232b86b1d3b13883
Instruction ID: 2f521166a41a1a2d10b63b356176c5a88747e73dc1008bd5563774faf3d89338
Opcode Fuzzy Hash: 9d30e83fa00c56a554f8be335964d3f53130ecc896b4dc64232b86b1d3b13883
Instruction Fuzzy Hash: 9B31F270704205CBDB21DF28C881B9E77A5AF19308F54A17AF4809B396DB3DBD05CB89

Uniqueness

Uniqueness Score: -1.00%

Function 004371E4, Relevance: 1.6, APIs: 1, Instructions: 92COMMON

Download Yara Rule

APIs

Part of subcall function 0042E204: FindResourceA.KERNEL32(00400000,TMADEXCEPT,0000000A), ref: 0042E20C

VirtualQuery.KERNEL32(00000000,?,0000001C,00000000,004372E9,?,00607910,?,00445EC5), ref: 004372C5

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: FindQueryResourceVirtual
String ID:
API String ID: 2266176927-0
Opcode ID: b30d0302ed8942a45a92faa135f029d676c015b4466edd2ac9167504a3cd6376
Instruction ID: 88ad2e6c7e05a9b8b56d869ecdd8a15ecb5e5a1e98ee9df1feff5b9066c27662
Opcode Fuzzy Hash: b30d0302ed8942a45a92faa135f029d676c015b4466edd2ac9167504a3cd6376
Instruction Fuzzy Hash: 6131C170A041058BDB31DF69CC81AAF73B6AF89314F5060B6F840A7396DB39AD05CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0041C300, Relevance: 1.6, APIs: 1, Instructions: 83timeCOMMON

Download Yara Rule

APIs

FileTimeToDosDateTime.KERNEL32(00607910,?,?), ref: 0041C386

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: Time$DateFile
String ID:
API String ID: 1286729926-0
Opcode ID: 20b0a3ecaf4c1befb282801f26dacade9459f747f8cd95f7672d3b6f6679cd7d
Instruction ID: 67440f7bb8d01e23cafdcd63fd41e68c82f2788d7d4f1b5c727226b919b7fb2d
Opcode Fuzzy Hash: 20b0a3ecaf4c1befb282801f26dacade9459f747f8cd95f7672d3b6f6679cd7d
Instruction Fuzzy Hash: 0C316B74E54108AFC754EF58DCC199A73F9EB08314B6184BAA800E7362E738FE40CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00445418, Relevance: 1.6, APIs: 1, Instructions: 80synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,?,?,00000000,00000000,00000000,00000000,?,00445890,00000000,?,?,?,00000000,004459C7), ref: 004454AA

Part of subcall function 00445F20: EnterCriticalSection.KERNEL32(02B32564,005FA000,?,?,00431AE5,?,00607910,?,00000000), ref: 00445F3C
Part of subcall function 00445F20: LeaveCriticalSection.KERNEL32(02B32564,00445FC9,02B32564,005FA000,?,?,00431AE5,?,00607910,?,00000000), ref: 00445FBC

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeaveObjectSingleWait
String ID:
API String ID: 501323975-0
Opcode ID: f2b8a6b90142bb571b1aa03e7639d4fa23519618bad16eb5c7f517faeba84e66
Instruction ID: b2a602de64e80c091acb74a6d4dbc3d8fa37ed7f8b959d7990b495c0270c0851
Opcode Fuzzy Hash: f2b8a6b90142bb571b1aa03e7639d4fa23519618bad16eb5c7f517faeba84e66
Instruction Fuzzy Hash: 22217C307006059FDB04EF54C844B99B3BAFF8A705F6181A6E800AF3A2CB38AD45CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00420E98, Relevance: 1.6, APIs: 1, Instructions: 75COMMON

Download Yara Rule

APIs

IsBadHugeReadPtr.KERNEL32(00000000,00000000), ref: 00420EFC

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: HugeRead
String ID:
API String ID: 2080902951-0
Opcode ID: 6ac7c5aa3379528d0c2b20339689a646ccb7e9ef6a713cda4c88a4b638cd415d
Instruction ID: 7b53ca08c1e32ce230c4d5a9404beb1b5bfb13d85ac14f2eb3631a35b7766155
Opcode Fuzzy Hash: 6ac7c5aa3379528d0c2b20339689a646ccb7e9ef6a713cda4c88a4b638cd415d
Instruction Fuzzy Hash: B3217171F54218AFCB10DFAAE84169EBBF8EB09314F5288BBE414D3642D7789940CB58

Uniqueness

Uniqueness Score: -1.00%

Function 0044CFA0, Relevance: 1.5, APIs: 1, Instructions: 45threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0044D03E

Part of subcall function 0042BBB8: WaitForSingleObject.KERNEL32(?,000000FF,00000000,0042BE4A,?,?,?), ref: 0042BBFF
Part of subcall function 0042BBB8: LocalSize.KERNEL32(00000000), ref: 0042BC6C
Part of subcall function 0042BBB8: LocalSize.KERNEL32(00000000), ref: 0042BCA2
Part of subcall function 0042BBB8: LocalFree.KERNEL32(?,00000000,00000000,0042BE25,?,?,000000FF,00000000,0042BE4A,?,?,?), ref: 0042BCB6
Part of subcall function 0042BBB8: LocalSize.KERNEL32(00000000), ref: 0042BCBC
Part of subcall function 0042BBB8: LocalFree.KERNEL32(?,00000000,?,00000000,00000000,0042BE25,?,?,000000FF,00000000,0042BE4A,?,?,?), ref: 0042BCCA
Part of subcall function 0042BBB8: LocalFree.KERNEL32(00000000,00000000,?,00000000,00000000,0042BE25,?,?,000000FF,00000000,0042BE4A,?,?,?), ref: 0042BCD0

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: Local$FreeSize$CurrentObjectSingleThreadWait
String ID:
API String ID: 3213118908-0
Opcode ID: 4ca8a9a144964e702908f56e29fb3fc98fa8dc1156c6d51b8b1352ee94d7a41c
Instruction ID: cbf1bc5b34cb0243d9d79046f617093f6a1faf1b15a171d679140bf021ccc387
Opcode Fuzzy Hash: 4ca8a9a144964e702908f56e29fb3fc98fa8dc1156c6d51b8b1352ee94d7a41c
Instruction Fuzzy Hash: 85F08175608740BFF315AF229C22F277B99EB8AB14F61847AF90053AC1D97C6801C468

Uniqueness

Uniqueness Score: -1.00%

Function 0042E9FC, Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

APIs

Part of subcall function 0042E734: GetCurrentProcessId.KERNEL32(?,00000000,0042E7BA,?,00000000), ref: 0042E760
Part of subcall function 0042E734: WaitForSingleObject.KERNEL32(00000000,000000FF,?,00000000,00000000,?,00000000,0042E7BA,?,00000000), ref: 0042E79A

RtlDeleteCriticalSection.NTDLL(0072FFF8), ref: 0042EA33

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: CriticalCurrentDeleteObjectProcessSectionSingleWait
String ID:
API String ID: 1534368221-0
Opcode ID: ab5194679ef265d7647bead95d32c612b9fc3c1d0b422f7ed56b5309b46bc6fe
Instruction ID: 64cb0427822e871d5bdcdca9483ecf82317dc8f9f45c334444ed516f5ff7b64c
Opcode Fuzzy Hash: ab5194679ef265d7647bead95d32c612b9fc3c1d0b422f7ed56b5309b46bc6fe
Instruction Fuzzy Hash: AD016D70704200DFDB01DB66EE4A92977FDE715700B814466F408C7262D6BCBC05EB38

Uniqueness

Uniqueness Score: -1.00%

Function 0041C284, Relevance: 1.5, APIs: 1, Instructions: 38timeCOMMON

Download Yara Rule

APIs

FileTimeToDosDateTime.KERNEL32(?,?,?), ref: 0041C2B6

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: Time$DateFile
String ID:
API String ID: 1286729926-0
Opcode ID: 6274aa61fe1b0f23cca5899205ee7338522f4746e5f95f31bcc3587a43613e26
Instruction ID: bd86286fe9e04af97be60bd8acc03cb728eca4c33918cb04f5e62410206da85b
Opcode Fuzzy Hash: 6274aa61fe1b0f23cca5899205ee7338522f4746e5f95f31bcc3587a43613e26
Instruction Fuzzy Hash: 7B0186B5D581045BC300EF55DC81C8773EDEB48304F00857EB545D7261E639FD108BA5

Uniqueness

Uniqueness Score: -1.00%

Function 00408058, Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

CreateWindowExA.USER32(00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 00408081

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 24074e4f0c9761b04140219df1f553371079a76eaeea2aa9c31184406c9647cf
Instruction ID: f8a649bc847f52ddae0cba1230be84fca8026b6f63394b48e17840334b009293
Opcode Fuzzy Hash: 24074e4f0c9761b04140219df1f553371079a76eaeea2aa9c31184406c9647cf
Instruction Fuzzy Hash: B3E0FEB2214209BBDB00DE8ADCC1DABB7ACFB4C654F804105BB1C972428275AD618B75

Uniqueness

Uniqueness Score: -1.00%

Function 00406250, Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00400000,?,00000105,00000000,00000000,004062B8,0042E34B,00000000,0042E627,?,00000000,00000000,00730020), ref: 0040626E

Part of subcall function 0040648C: GetModuleFileNameA.KERNEL32(00000000,?,00000105,00000000,005FA08C,?,0040627C,00400000,?,00000105,00000000,00000000,004062B8,0042E34B,00000000,0042E627), ref: 004064A8
Part of subcall function 0040648C: RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,00000000,005FA08C,?,0040627C,00400000,?,00000105,00000000), ref: 004064C6
Part of subcall function 0040648C: RegOpenKeyExA.ADVAPI32(80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,00000000,005FA08C), ref: 004064E4
Part of subcall function 0040648C: RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000), ref: 00406502
Part of subcall function 0040648C: RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,00000000,00000005,00000000,00406591,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?), ref: 0040654B
Part of subcall function 0040648C: RegQueryValueExA.ADVAPI32(?,004066F8,00000000,00000000,00000000,00000005,?,?,00000000,00000000,00000000,00000005,00000000,00406591,?,80000001), ref: 00406569
Part of subcall function 0040648C: RegCloseKey.ADVAPI32(?,00406598,00000000,00000000,00000005,00000000,00406591,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 0040658B

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: Open$FileModuleNameQueryValue$Close
String ID:
API String ID: 2796650324-0
Opcode ID: da3582352b6af271b6eee0be6725914b0bccc304a040216e35335ea9567890d9
Instruction ID: b1d2447a3fddf84b00ea15e1c5a26f4deb5cc316ff885bad8aa69577cc48bd35
Opcode Fuzzy Hash: da3582352b6af271b6eee0be6725914b0bccc304a040216e35335ea9567890d9
Instruction Fuzzy Hash: D4E06D71A012108FCB50DE5888C1A8733D8AB08754F0109AAEC59DF386D375DD2087E8

Uniqueness

Uniqueness Score: -1.00%

Function 0068FA2C, Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

Part of subcall function 0068CF7A: GetModuleHandleA.KERNEL32(?), ref: 0068CFE5
Part of subcall function 0068CF7A: LoadLibraryA.KERNEL32(?), ref: 0068CFF5

FreeLibrary.KERNEL32(00000000,00000000,?), ref: 0068FA68

Memory Dump Source

Source File: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: Library$FreeHandleLoadModule
String ID:
API String ID: 2140536961-0
Opcode ID: 61978a77fb6c16f54ce5da5b876b6eb4c72e3230f02703bcf60ec6593a47eb28
Instruction ID: a7477f17d345e13b7d079c7168717b3e372e8449bde5368364c6c59aa622283a
Opcode Fuzzy Hash: 61978a77fb6c16f54ce5da5b876b6eb4c72e3230f02703bcf60ec6593a47eb28
Instruction Fuzzy Hash: DCF0F83090020DFFCF04FFA0D906BADBAB6AF05364F108168E509A6260E7719F40EB54

Uniqueness

Uniqueness Score: -1.00%

Function 0068F91E, Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

Part of subcall function 00689CE6: EnterCriticalSection.KERNEL32(00695AC8), ref: 00689D10

SetFilePointer.KERNEL32(?,?,?,?,?,?,?,?), ref: 0068F944

Memory Dump Source

Source File: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: CriticalEnterFilePointerSection
String ID:
API String ID: 3291797498-0
Opcode ID: 06bf70590fd7e71c50c3bc4a347811ceda893e74725d548f14536352b34dc9d4
Instruction ID: 341836ca7552b9fe4a095fea0f685f6bc9e73a4a742d0499445012303a00b109
Opcode Fuzzy Hash: 06bf70590fd7e71c50c3bc4a347811ceda893e74725d548f14536352b34dc9d4
Instruction Fuzzy Hash: 29F0923210020EFFCF029F91DD01ADE7BBABF18355F004525F91696160D372DA21EB60

Uniqueness

Uniqueness Score: -1.00%

Function 0068F8DF, Relevance: 1.5, APIs: 1, Instructions: 23fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0068A7E1: EnterCriticalSection.KERNEL32(00695AC8,?,?,?,?,006899FD,?,00000000,00000000,00000000,00000000,?), ref: 0068A80B

ReadFile.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 0068F90E

Memory Dump Source

Source File: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: CriticalEnterFileReadSection
String ID:
API String ID: 3182250808-0
Opcode ID: a37e7f9c280ce226c5589c22298301930d66dfd24c24638e3bbfc626ca9fdc2b
Instruction ID: 3c1dccb4eec7e5cec519ff58bd6980f28b8f10dcaee4cdaef9f6941a88ef3990
Opcode Fuzzy Hash: a37e7f9c280ce226c5589c22298301930d66dfd24c24638e3bbfc626ca9fdc2b
Instruction Fuzzy Hash: 72F0253650020EFBCF029F90DD019DE7FBABB18384B108029FA15A5221D332DA71ABA1

Uniqueness

Uniqueness Score: -1.00%

Function 0068FB9A, Relevance: 1.5, APIs: 1, Instructions: 23fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0068988D: EnterCriticalSection.KERNEL32(00695AC8), ref: 006898B7

MapViewOfFile.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 0068FBC9

Memory Dump Source

Source File: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: CriticalEnterFileSectionView
String ID:
API String ID: 4022974305-0
Opcode ID: 055772369029a75870db6f0429f2f00b118fe70ac815af5f3d788530f18b98b8
Instruction ID: df785a907e93bdf8e1fbb19291198601a74deed25f0f59e33a04bf36e7198dba
Opcode Fuzzy Hash: 055772369029a75870db6f0429f2f00b118fe70ac815af5f3d788530f18b98b8
Instruction Fuzzy Hash: B1F02B7650014EFBCF029F90DD01CDE7F7AAB18394B048415BA15A5520D332DA71ABA1

Uniqueness

Uniqueness Score: -1.00%

Function 0068F7A3, Relevance: 1.5, APIs: 1, Instructions: 23fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00689BD7: EnterCriticalSection.KERNEL32(00695AC8), ref: 00689C01
Part of subcall function 00689BD7: CreateFileA.KERNEL32(024B0AF8,80000000,00000001,00000000,00000003,00000000,00000000,?,?), ref: 00689C3D
Part of subcall function 00689BD7: SetFilePointer.KERNEL32(?,00000000,00000000,00000000), ref: 00689C5F

CreateFileA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 0068F7D2

Memory Dump Source

Source File: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: File$Create$CriticalEnterPointerSection
String ID:
API String ID: 2903890177-0
Opcode ID: 48d5ec6ed5edb3ab465c84fecde6b47b2f91117c63a5d1a8fd72fd5ecfdf144b
Instruction ID: 7a74ed9141c9a7bd110ca578d55ef78044559c47292dbe464b35004abfe1e933
Opcode Fuzzy Hash: 48d5ec6ed5edb3ab465c84fecde6b47b2f91117c63a5d1a8fd72fd5ecfdf144b
Instruction Fuzzy Hash: 9AF02B7650010EFFCF029F94DD41CDE7F7AAF18344B008115BE1595520D732DA61ABA0

Uniqueness

Uniqueness Score: -1.00%

Function 0068E6F9, Relevance: 1.5, APIs: 1, Instructions: 22
memoryCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E0068E6F9(void* __ecx, long _a4) {
				void* _v8;
				void* _v12;
				void* _t8;
				void* _t9;

				_push(__ecx);
				_push(__ecx); // executed
				_t8 = E0068E736(__ecx); // executed
				_v12 = _t8;
				if(_a4 != 0) {
					_t9 = RtlAllocateHeap(_v12, 8, _a4); // executed
					_v8 = _t9;
					if(_v8 == 0) {
						E0068E6E1(_t9, 0xef000009);
					}
					return _v8;
				}
				return 0;
			}

0x0068e6fc
0x0068e6fd
0x0068e6fe
0x0068e703
0x0068e70a
0x0068e718
0x0068e71e
0x0068e725
0x0068e72c
0x0068e72c
0x00000000
0x0068e731
0x00000000

APIs

Part of subcall function 0068E736: HeapCreate.KERNEL32(00000001,00010000,00000000,024B0488,?,0068E703,024B0488,024B0488,?,00688580,00000068), ref: 0068E74C

RtlAllocateHeap.NTDLL(00000000,00000008,00000000,024B0488,024B0488,?,00688580,00000068), ref: 0068E718

Memory Dump Source

Source File: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCreate
String ID:
API String ID: 2875408731-0
Opcode ID: a776423ea0cc2cbf8adb5233bd53461780e80f9df620bcbea159fbc200ab271b
Instruction ID: 3fc964fce8dc33838d71249ad058ef9df1b0035eca90cce59a3c9193207afde2
Opcode Fuzzy Hash: a776423ea0cc2cbf8adb5233bd53461780e80f9df620bcbea159fbc200ab271b
Instruction Fuzzy Hash: CBE04F3490020CFFDF90FFB0C90979CBAB6AB14344F608959F406A6240E7B29B81DB10

Uniqueness

Uniqueness Score: -1.00%

Function 0068E736, Relevance: 1.5, APIs: 1, Instructions: 22
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0068E736(void* __ecx) {
				void* _v8;
				void* _t9;

				if( *0x695b08 != 0) {
					_t6 =  *0x695b08; // 0x24b0000
					_v8 = _t6;
				} else {
					_t9 = HeapCreate(1, 0x10000, 0); // executed
					_v8 = _t9;
					_t6 = _v8;
					 *0x695b08 = _v8;
				}
				if(_v8 == 0) {
					E0068E6E1(_t6, 0xef00000d);
				}
				return _v8;
			}

0x0068e741
0x0068e75f
0x0068e764
0x0068e743
0x0068e74c
0x0068e752
0x0068e755
0x0068e758
0x0068e758
0x0068e76b
0x0068e772
0x0068e772
0x0068e77b

APIs

HeapCreate.KERNEL32(00000001,00010000,00000000,024B0488,?,0068E703,024B0488,024B0488,?,00688580,00000068), ref: 0068E74C

Memory Dump Source

Source File: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 306ac40aa62a56fdb7e2610bd52b501f600437afe2e5796cc1b110286d61f62d
Instruction ID: 468488760adf29614de207bc3424647363610ac62bc734dd7459c8d879afb7f1
Opcode Fuzzy Hash: 306ac40aa62a56fdb7e2610bd52b501f600437afe2e5796cc1b110286d61f62d
Instruction Fuzzy Hash: 47E01A74A01308EFDB10EFA4DE45B9877BAA704748F20519AF506A7798D3B15F80DB14

Uniqueness

Uniqueness Score: -1.00%

Function 0068F9C0, Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

Part of subcall function 00689ABF: EnterCriticalSection.KERNEL32(00695AC8), ref: 00689AE9

CreateFileMappingA.KERNEL32 ref: 0068F9E6

Memory Dump Source

Source File: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: CreateCriticalEnterFileMappingSection
String ID:
API String ID: 704181152-0
Opcode ID: 3d0003f23a686a717af13698a718e849044c1cdef156c1e3f3d598af7ed318fd
Instruction ID: e217971fd6b655911bf674b64fab1400329caef6777a19d7961ebbf844fa3ff0
Opcode Fuzzy Hash: 3d0003f23a686a717af13698a718e849044c1cdef156c1e3f3d598af7ed318fd
Instruction Fuzzy Hash: 76E07E3250010EFBCF02AF90DD018DE7FBAAB08344B008025FA1591120E332DA21AB90

Uniqueness

Uniqueness Score: -1.00%

Function 00406980, Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

InterlockedDecrement.KERNEL32(?), ref: 0040698C

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: DecrementInterlocked
String ID:
API String ID: 3448037634-0
Opcode ID: d7014855bf47c91553aeaf4b7a1610a6b26eed567596135cd20953664c376246
Instruction ID: 0046cb5b9020794375a6d73e1610bcd6c5669f18f89209f502effbe02e7c89be
Opcode Fuzzy Hash: d7014855bf47c91553aeaf4b7a1610a6b26eed567596135cd20953664c376246
Instruction Fuzzy Hash: F4D05E72600229AB8B10AA99D8C4C96FB9CEB553AC3004076FA05DF312C936EC0487E4

Uniqueness

Uniqueness Score: -1.00%

Function 0068FE50, Relevance: 1.5, APIs: 1, Instructions: 17fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00689132: EnterCriticalSection.KERNEL32(00695AC8), ref: 0068915C

FindNextFileA.KERNELBASE(?,?,?,?,?), ref: 0068FE6D

Memory Dump Source

Source File: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: CriticalEnterFileFindNextSection
String ID:
API String ID: 4029508138-0
Opcode ID: 2f490109b276da4f7f2bbd8138fd3a0249b5c667b6b0ba8a8eb73601b3dee986
Instruction ID: 6ca91b685b09d66cf6d225038ae0fdc4cfb94c478b3ad2d785b7e046d4149fa7
Opcode Fuzzy Hash: 2f490109b276da4f7f2bbd8138fd3a0249b5c667b6b0ba8a8eb73601b3dee986
Instruction Fuzzy Hash: 69E0E23550010DFBCF41EFA0CD0889EBBBAEB04388F008025B90996221E331DB10AB50

Uniqueness

Uniqueness Score: -1.00%

Function 0068F8B8, Relevance: 1.5, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

Part of subcall function 00689F93: EnterCriticalSection.KERNEL32(00695AC8), ref: 00689FBD

FindCloseChangeNotification.KERNEL32(?,?,?), ref: 0068F8CF

Memory Dump Source

Source File: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: ChangeCloseCriticalEnterFindNotificationSection
String ID:
API String ID: 1375277949-0
Opcode ID: 8a90da9ec171d2e9a0791728711775cc7cf3349ca514432b4a9accd641b4a383
Instruction ID: 353ebf47ae127dd463ab81ecc934339e52056743866a81e8fe041da7d76e5d43
Opcode Fuzzy Hash: 8a90da9ec171d2e9a0791728711775cc7cf3349ca514432b4a9accd641b4a383
Instruction Fuzzy Hash: B5D06CB1500209BBCB01EFA5D90199EBABAAB14388B104176A905E2620E7719B11ABA4

Uniqueness

Uniqueness Score: -1.00%

Function 0042B504, Relevance: 1.5, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

GetComputerNameA.KERNEL32(00000000,B70F0B66), ref: 0042B51A

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: ComputerName
String ID:
API String ID: 3545744682-0
Opcode ID: 4bcffc4582cbdaddebd56cb6d0573bdada6c99afd3b641f8f46c166cb4104413
Instruction ID: 2d60a426fa513126a24d073db8b86c2ec8e19fa2fe59e45fd542b10d7ba368eb
Opcode Fuzzy Hash: 4bcffc4582cbdaddebd56cb6d0573bdada6c99afd3b641f8f46c166cb4104413
Instruction Fuzzy Hash: 91D0A7F160420017D300E694ECC19DA72CC87C4314F00093D7EC9962C1E6BC59889B53

Uniqueness

Uniqueness Score: -1.00%

Function 0068FE29, Relevance: 1.5, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

Part of subcall function 006891E8: EnterCriticalSection.KERNEL32(00695AC8,?,?,?,000000FF,?,0068A062,?,00000000,?), ref: 00689212

FindClose.KERNEL32(?,?,?), ref: 0068FE40

Memory Dump Source

Source File: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: CloseCriticalEnterFindSection
String ID:
API String ID: 224337222-0
Opcode ID: 404e10d1dada20ec1f117b476238e0f1ff77f1814b5422b019cf8117e5800d1b
Instruction ID: 47693a42e8931838975e5ccc39640ffbff23e9693ff0a0f4b19f038f4edd3dc0
Opcode Fuzzy Hash: 404e10d1dada20ec1f117b476238e0f1ff77f1814b5422b019cf8117e5800d1b
Instruction Fuzzy Hash: 44D05E7050020DFBCB01EF60DD058DE7BBDAB10344B00406AF805E2220D331DF009B50

Uniqueness

Uniqueness Score: -1.00%

Function 00407228, Relevance: 1.5, APIs: 1, Instructions: 14synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32(?,00000001,00000000,?,0042E795,?,00000000,00000000,?,00000000), ref: 0040723E

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: 21e0619b74412fae9514185c35c6bd95fbb7b52f213a822672066e7264c0ded7
Instruction ID: 7db005d0661c92c352898ea82dffb6356d4ca7eae0ae56092ac729956557049e
Opcode Fuzzy Hash: 21e0619b74412fae9514185c35c6bd95fbb7b52f213a822672066e7264c0ded7
Instruction Fuzzy Hash: FCC01273560248ABCB00EEA9DC06D9B33DCAB28609B008829BA28CB100C139E9908B64

Uniqueness

Uniqueness Score: -1.00%

Function 0068E77C, Relevance: 1.5, APIs: 1, Instructions: 14
memoryCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E0068E77C(void* __eax, void* __ecx, void* _a4) {
				void* _v8;
				char _t7;

				_push(__ecx);
				if(_a4 != 0) {
					_v8 = E0068E736(__ecx);
					_t7 = RtlFreeHeap(_v8, 0, _a4); // executed
					return _t7;
				}
				return __eax;
			}

0x0068e77f
0x0068e784
0x0068e78d
0x0068e798
0x00000000
0x0068e798
0x00000000

APIs

RtlFreeHeap.NTDLL(?,00000000,00000000,?,?,0068ED1F,?,0068ED0F,?,?,?,?,?,?), ref: 0068E798

Memory Dump Source

Source File: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 28e55378a39e6cd5172f320d7a7bd89442bb89bbf15ad1a148e665c1581e27ac
Instruction ID: 75138f1a13822dae73e5c36c86800d7920c497f3f8f62c4897dff821313a5537
Opcode Fuzzy Hash: 28e55378a39e6cd5172f320d7a7bd89442bb89bbf15ad1a148e665c1581e27ac
Instruction Fuzzy Hash: 7DD0C93450021CFFEF20BFA0DD06BADBEBAEB00744F604255F50559150D6769B91EB55

Uniqueness

Uniqueness Score: -1.00%

Function 0042E7E8, Relevance: 1.5, APIs: 1, Instructions: 8synchronizationCOMMON

Download Yara Rule

APIs

ReleaseMutex.KERNEL32(00000000,00000000,0042E96F,0042E977,00000000,0042E992,?,00000000,00000000), ref: 0042E7EC

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: MutexRelease
String ID:
API String ID: 1638419-0
Opcode ID: 13a5adc392918f24a359c63fb25c668a5cff269fc648731c971dc0b5bf337393
Instruction ID: 5d610b9cdd7177eda4d6c45f0915df94142cb1c25ef5d827e032f3fa3f04ca8c
Opcode Fuzzy Hash: 13a5adc392918f24a359c63fb25c668a5cff269fc648731c971dc0b5bf337393
Instruction Fuzzy Hash: EFA002E5B4930837D60072B71CC2D6B558C5948259390387B750ABA7C3AD7DBA50103E

Uniqueness

Uniqueness Score: -1.00%

Function 00401750, Relevance: 1.3, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(FFFFFFFF,00000000,00008000), ref: 004017B4

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 7ee5c974cb4bef6106f953fb03a21c4beb40b16e32bcb23ef0dfdf6637047f38
Instruction ID: 210e13b86e5d394c0b0b95031727a0a1153672bfc5cb54779316c6ddd1ab46b4
Opcode Fuzzy Hash: 7ee5c974cb4bef6106f953fb03a21c4beb40b16e32bcb23ef0dfdf6637047f38
Instruction Fuzzy Hash: 9F21F274608701AFC714DF19C880A1BBBE1EF84760F14C96AF4989B3A4D338EC40CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 00401808, Relevance: 1.3, APIs: 1, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(02AC0000,?,00001000,00000004), ref: 00401875

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 8b1d6562b131238e010f828cf975e6794dcf59884616fd9a3526576983f92fc9
Instruction ID: 920e29322a0024707e70f0e54f444a0b541683d0f2aacef1ad4de7407b3d3b47
Opcode Fuzzy Hash: 8b1d6562b131238e010f828cf975e6794dcf59884616fd9a3526576983f92fc9
Instruction Fuzzy Hash: 82118272A047019FC314AF29CC80A1BB7E5EFC4760F15C53DE598673A4E734AD408B85

Uniqueness

Uniqueness Score: -1.00%

Function 0040189C, Relevance: 1.3, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(02AC0000,00100000,00004000,?,?,?,00001150,00005153,00401B03), ref: 004018F6

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 7719c0eb744839d2bc25ce2335368f42900b32b1b28af7d6545a3241162aee8c
Instruction ID: dd3e0c28f9c8dcdd11c57875e0ddbc556def2d70e86140b9399b2091ac16548c
Opcode Fuzzy Hash: 7719c0eb744839d2bc25ce2335368f42900b32b1b28af7d6545a3241162aee8c
Instruction Fuzzy Hash: 6901F7B7A442044FC311AF69DCC0A2B77E9EB84324F16453EEA85A73A1D23A6C01C7A4

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0043F454, Relevance: 114.8, APIs: 63, Strings: 2, Instructions: 1021nativeCOMMON

Download Yara Rule

APIs

LoadCursorA.USER32(00000000,00007F89), ref: 0043F5FD
SetCursor.USER32(00000000,00000000,00007F89,00000000,00440020), ref: 0043F603
BeginPaint.USER32(?,?,00000000,00440020), ref: 0043F633
GetClientRect.USER32(?,?), ref: 0043F640
GetSysColor.USER32(0000000F), ref: 0043F654
GetSysColor.USER32(00000015), ref: 0043F65C
SelectObject.GDI32(?,?), ref: 0043F683
GetTextExtentPoint32A.GDI32(?,00000000,00000000,?), ref: 0043F6B6
SetTextColor.GDI32(?,00900080), ref: 0043F6FC
GetSysColor.USER32(0000000F), ref: 0043F719
SetBkColor.GDI32(?,00000000), ref: 0043F726
TextOutA.GDI32(?,?,?,00000000,00000000), ref: 0043F750
SelectObject.GDI32(?,00000000), ref: 0043F75D
EndPaint.USER32(?,?,?,00000000,?,?,?,00000000,00000000,?,00000000,0000000F,?,00000000,00000015,?), ref: 0043F76D
NtdllDefWindowProc_A.NTDLL(?,?,?,?,00000000,00440020), ref: 0043F877
NtdllDefWindowProc_A.NTDLL(?,?,?,?,00000000,00440020), ref: 00440003

Strings

http://madExcept.com, xrefs: 0043F829
,, xrefs: 0043FEB8

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: Color$Text$CursorNtdllObjectPaintProc_SelectWindow$BeginClientExtentLoadPoint32Rect
String ID: ,$http://madExcept.com
API String ID: 1294446545-4113818653
Opcode ID: f85f0e6e5bc3cd165576ec8fa53478c6593d80d2833802085e3c1d224ab3aef7
Instruction ID: a87b7536818bc1a1f09d5d39b413d82975b112bd25cc63d2f5f512a0aef8cb30
Opcode Fuzzy Hash: f85f0e6e5bc3cd165576ec8fa53478c6593d80d2833802085e3c1d224ab3aef7
Instruction Fuzzy Hash: 42826471A04204AFDB10EF69D985F9E77E8AF09314F104166F908EF392C778ED858B99

Uniqueness

Uniqueness Score: -1.00%

Function 00427A5C, Relevance: 83.1, APIs: 44, Strings: 3, Instructions: 826nativeCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00427B09
ScreenToClient.USER32(?,?), ref: 00427B19
IsWindowEnabled.USER32(?), ref: 00427B38
LoadCursorA.USER32(00000000,00007F89), ref: 00427B48
SetCursor.USER32(00000000), ref: 00427B56
GetSysColor.USER32(0000000F), ref: 00427C44
GetSysColor.USER32(0000000F), ref: 00427CA7
GetSysColor.USER32(0000000F), ref: 00427D08
GetSysColor.USER32(0000000F), ref: 00427D10
GetSysColor.USER32(00000015), ref: 00427D48
NtdllDefWindowProc_A.NTDLL(?,?,?,?,00000000,00428404,?,?,?,?,00000013,00000000,00000000), ref: 00428381

Strings

L:B, xrefs: 004283E3
Arial, xrefs: 00427D3B, 00427E38, 00427E7C
?B, xrefs: 00427F2D, 00428313

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: Color$Cursor$Window$ClientEnabledLoadNtdllProc_Screen
String ID: Arial$L:B$?B
API String ID: 536557531-136738505
Opcode ID: 4a940d65220726c27b1fbaf52ffd4aa6e42917025f05bce18b202c5f925d494e
Instruction ID: ed5ec112c277b9ccae6a3beaa5f67e2a706bf2312eae5a444cff5a0ea541201c
Opcode Fuzzy Hash: 4a940d65220726c27b1fbaf52ffd4aa6e42917025f05bce18b202c5f925d494e
Instruction Fuzzy Hash: FE627F71B04218AFDB10DF69D885F9E77B5EF48314F50816AF904EB291CB38EE818B95

Uniqueness

Uniqueness Score: -1.00%

Function 00429058, Relevance: 53.2, APIs: 25, Strings: 5, Instructions: 693windowkeyboardtimeCOMMON

Download Yara Rule

APIs

IsWindowEnabled.USER32(00000000), ref: 0042909A
EnableWindow.USER32(00000000,00000000), ref: 004290B8
CreateCompatibleDC.GDI32(00000000), ref: 004290C6
SelectObject.GDI32(?,?), ref: 00429282
DeleteDC.GDI32(?), ref: 0042928B

Part of subcall function 00428F60: SendMessageA.USER32(?,00000030,?,00000000), ref: 00428FFF

GetWindowRect.USER32(?,00000000), ref: 00429570
GetClientRect.USER32(?,00000000), ref: 0042958B
GetSystemMetrics.USER32(00000001), ref: 004295AA
GetSystemMetrics.USER32(00000000), ref: 004295C0
SetWindowPos.USER32(?,00000000,0000013B,00000000,?,00000001,0000013B,?,00000004,?,00000000,?,00000000), ref: 004295DC

Part of subcall function 0042860C: IsWindowEnabled.USER32(00000000), ref: 0042867D

ShowWindow.USER32(?,00000001,00000000,?,00000000,0000013B,00000000,?,00000001,0000013B,?,00000004,?,00000000,?,00000000), ref: 0042960C
IsIconic.USER32(?), ref: 00429617
ShowWindow.USER32(?,00000009,?,?,00000001,00000000,?,00000000,0000013B,00000000,?,00000001,0000013B,?,00000004,?), ref: 00429628
BringWindowToTop.USER32(?), ref: 00429633
SetForegroundWindow.USER32(?), ref: 0042963E
SetTimer.USER32(?,00000309,?,00000000), ref: 0042965E
GetKeyState.USER32(00000010), ref: 004296DA
IsDialogMessage.USER32(?,?), ref: 004297C9
TranslateMessage.USER32(?), ref: 004297D6
DispatchMessageA.USER32(?), ref: 004297DF
IsWindow.USER32(?), ref: 004297EA
GetMessageA.USER32(?,00000000,00000000,00000000), ref: 004297FD
VirtualFree.KERNEL32(?,00000000,00008000,?,?,?,00000001,00000000,?,00000000,0000013B,00000000,?,00000001,0000013B,?), ref: 00429817
EnableWindow.USER32(00000000,000000FF), ref: 00429833
SetActiveWindow.USER32(00000000,00000000,000000FF,?,00000000,00008000,?,?,?,00000001,00000000,?,00000000,0000013B,00000000,?), ref: 0042983C

Strings

(, xrefs: 00429201
L:B, xrefs: 00429854
Arial, xrefs: 00429112
Tahoma, xrefs: 004291F6
?B, xrefs: 0042976E

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: Window$Message$EnableEnabledMetricsRectShowSystem$ActiveBringClientCompatibleCreateDeleteDialogDispatchForegroundFreeIconicObjectSelectSendStateTimerTranslateVirtual
String ID: ($Arial$L:B$Tahoma$?B
API String ID: 2795582209-1470574360
Opcode ID: d95a6417b918fb2839ea428ff22b2f49d6abb3c80d6d704c24dd845c5d66fa7e
Instruction ID: 3ea0fa7b4e3fc62ed6e0cd7e681cfc7640ceb21129acb049869ea0ffd0291387
Opcode Fuzzy Hash: d95a6417b918fb2839ea428ff22b2f49d6abb3c80d6d704c24dd845c5d66fa7e
Instruction Fuzzy Hash: 4D525C31B001298FDB10EB69D881F9E73B5FF49304F9081AAE508AB356DB78AD85CF55

Uniqueness

Uniqueness Score: -1.00%

Function 0042CB18, Relevance: 13.6, APIs: 9, Instructions: 59clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(00000000), ref: 0042CB39
EmptyClipboard.USER32 ref: 0042CB42
CloseClipboard.USER32 ref: 0042CB47
OpenClipboard.USER32(00000000), ref: 0042CB4E
GlobalAlloc.KERNEL32(00002002,00000001,00000000,00000000,0042CBBC), ref: 0042CB66
GlobalFix.KERNEL32(00000000), ref: 0042CB6E
GlobalUnWire.KERNEL32(00000000), ref: 0042CB94
SetClipboardData.USER32(00000001,00000000), ref: 0042CB9C
CloseClipboard.USER32 ref: 0042CBA1

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: Clipboard$Global$CloseOpen$AllocDataEmptyWire
String ID:
API String ID: 1447158080-0
Opcode ID: 2a720689f135e0fac6c03eef10a6589b3c5a8bfc5718ffefd4103a63884cb338
Instruction ID: be8751a62866e7428d42035bfe15854d99f690cdde3815c6a1f0b6a475fdf373
Opcode Fuzzy Hash: 2a720689f135e0fac6c03eef10a6589b3c5a8bfc5718ffefd4103a63884cb338
Instruction Fuzzy Hash: D4016570B082147EE651B7B69D43E2E769CDF80748F51047BB900B22C2DA7CAE00567E

Uniqueness

Uniqueness Score: -1.00%

Function 0042354C, Relevance: 13.6, APIs: 9, Instructions: 57windowthreadCOMMON

Download Yara Rule

APIs

GetWindowThreadProcessId.USER32(?,?), ref: 0042355F
GetCurrentProcessId.KERNEL32(?,?), ref: 00423564
IsWindowVisible.USER32(?), ref: 0042356F
IsIconic.USER32(?), ref: 00423579
GetWindowRect.USER32(?,?), ref: 00423587
OffsetRect.USER32(?,?,?), ref: 0042359B
CreateRectRgnIndirect.GDI32(?), ref: 004235A4
CombineRgn.GDI32(?,?,00000000,00000002), ref: 004235B7
DeleteObject.GDI32(00000000), ref: 004235BD

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: RectWindow$Process$CombineCreateCurrentDeleteIconicIndirectObjectOffsetThreadVisible
String ID:
API String ID: 17709045-0
Opcode ID: f5689fe6b1f61399365e0a5c460bbf039d1a7d9dd1433dd98fa83d4e3bf5c136
Instruction ID: b609e4cb5a784eeb67131a36571aec1631db591cdcd4d93f87af38dbe4eb0279
Opcode Fuzzy Hash: f5689fe6b1f61399365e0a5c460bbf039d1a7d9dd1433dd98fa83d4e3bf5c136
Instruction Fuzzy Hash: CE014471A08209BADB10EAB59C81DBF73EC9F04759B50092BB955F3182D63CFE40867A

Uniqueness

Uniqueness Score: -1.00%

Function 00412120, Relevance: 13.3, Strings: 10, Instructions: 760COMMON

Download Yara Rule

Strings

else, xrefs: 0041262D
; ---------------------------------------------------------, xrefs: 0041230D, 00412460, 004126FD, 0041299F
[...], xrefs: 00412A43
; function entry point, xrefs: 004122A7
do, xrefs: 004125FA
; case jump table, xrefs: 004123B6
loc_, xrefs: 0041263A
on , xrefs: 004125D9
dd loc_, xrefs: 00412387
loc_, xrefs: 00412264, 0041285E

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID:
String ID: ; case jump table$ ; function entry point$ dd loc_$ else$ on $ do$ loc_$; ---------------------------------------------------------$[...]$loc_
API String ID: 0-1122499465
Opcode ID: bbddb7656bf446da9e163e05fb17d9a7a5f23b4869a689ff0583062485495d2a
Instruction ID: 0afbd610ae460a683cbdb591ef5047859490a24c491cbb99adc4c41d9f7bca02
Opcode Fuzzy Hash: bbddb7656bf446da9e163e05fb17d9a7a5f23b4869a689ff0583062485495d2a
Instruction Fuzzy Hash: 3E624934A001089FDB14DF59C985BDEBBF2AF49314F2480A6E904EB391C778AED1CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00439C00, Relevance: 9.2, APIs: 6, Instructions: 211networkCOMMON

Download Yara Rule

APIs

socket.WS2_32(00000002,00000002,00000011), ref: 00439C6D
bind.WS2_32(00000000,B70F08FA,00000010), ref: 00439CA1
htons.WS2_32(00000035), ref: 00439DDF
sendto.WS2_32(00000000,B70F092E,?,00000000,B70F08FA,00000010), ref: 00439E11
select.WS2_32(00000000,B70F07F6,00000000,00000000,B70F090A), ref: 00439EEE
closesocket.WS2_32(00000000), ref: 00439F17

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: bindclosesockethtonsselectsendtosocket
String ID:
API String ID: 1985737304-0
Opcode ID: 949e411e75a6d3c252a033b8ee6a0547588df79a61cb6d15ed11d1b4a806edf0
Instruction ID: 583677dc133fbb023c93ebbce1a1a615947614f1377ced662c667ab6545df636
Opcode Fuzzy Hash: 949e411e75a6d3c252a033b8ee6a0547588df79a61cb6d15ed11d1b4a806edf0
Instruction Fuzzy Hash: C2915170A4022D8BDB20EB15CC85BD9B3B4EF58304F1051EAE918A7292D7789F85CF59

Uniqueness

Uniqueness Score: -1.00%

Function 004234B8, Relevance: 9.1, APIs: 6, Instructions: 61windowthreadCOMMON

Download Yara Rule

APIs

GetWindowThreadProcessId.USER32(?,?), ref: 004234CB
GetCurrentProcessId.KERNEL32(?,?), ref: 004234D0
IsWindowVisible.USER32(?), ref: 004234DB
IsIconic.USER32(?), ref: 004234E5
GetWindowRect.USER32(?,?), ref: 004234F3
OffsetRect.USER32(?,?,?), ref: 00423507

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: Window$ProcessRect$CurrentIconicOffsetThreadVisible
String ID:
API String ID: 3306312098-0
Opcode ID: 93d8bf5d2174936a93e6f87c61dce944ac7f217e9473e4b85a406fd627265c74
Instruction ID: 563b47dbcccafdc312c53da9f17fb08761e1bd8707b9d84564be4b96ebb547c0
Opcode Fuzzy Hash: 93d8bf5d2174936a93e6f87c61dce944ac7f217e9473e4b85a406fd627265c74
Instruction Fuzzy Hash: B8112E70B04129AB8F00DE65D5C18AFB3B9AF443157604166FC04EB245E738EE418BFA

Uniqueness

Uniqueness Score: -1.00%

Function 0068A2D1, Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 293
filetimeCOMMON

Download Yara Rule

C-Code - Quality: 42%

			E0068A2D1(void* __ecx, signed int* _a4, signed int _a8) {
				signed int _v8;
				char _v20;
				unsigned int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				char _v48;
				intOrPtr _v52;
				void* _v56;
				void* _v60;
				signed int _v64;
				struct _FILETIME _v76;
				signed int _v80;
				signed int _v84;
				signed int _v88;
				long _v92;
				long _v96;
				unsigned int _v100;
				signed int _v104;
				struct _FILETIME* _v108;
				signed int _v112;
				signed int _v120;
				signed int _v124;
				signed int _v128;
				signed int _v132;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t181;
				intOrPtr _t186;
				intOrPtr _t187;
				intOrPtr _t188;
				signed int _t200;
				struct _FILETIME* _t212;
				void* _t213;
				struct _FILETIME* _t214;
				struct _FILETIME* _t227;
				long _t243;
				int _t248;
				intOrPtr _t251;
				struct _FILETIME* _t261;
				struct _FILETIME* _t263;
				signed int _t266;
				struct _FILETIME* _t271;
				void* _t278;
				intOrPtr _t281;
				signed int _t282;
				intOrPtr _t285;
				signed int _t287;
				int _t290;
				void* _t316;
				void* _t323;
				void* _t324;
				intOrPtr _t326;

				_push(0xffffffff);
				_push(0x693458);
				_push(0x69052c);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t326;
				_push(__ecx);
				_push(__ecx);
				_push(_t278);
				_push(_t323);
				_push(_t316);
				_t281 =  *0x695af0; // 0x24b0b08
				_t2 = _t281 + 4; // 0x24b0e9c
				_v40 =  *_a4 -  *_t2 >> 4;
				_v44 = _v44 & 0x00000000;
				_v64 = _v64 & 0x00000000;
				while(_v64 < 3) {
					_t13 = 0x69540c + _v64 * 0x18; // 0x695ae400
					if( *_t13 !=  *_a4) {
						L6:
						_t271 = _v64 + 1;
						__eflags = _t271;
						_v64 = _t271;
						continue;
					} else {
						_t15 = 0x695408 + _v64 * 0x18; // 0x0
						if( *_t15 != _a8) {
							goto L6;
						} else {
							_t18 = 0x695410 + _v64 * 0x18; // 0x0
							_t213 =  *( *_t18);
						}
					}
					L38:
					 *[fs:0x0] = _v20;
					return _t213;
				}
				GetSystemTimeAsFileTime( &_v76);
				_v80 = _v80 & 0x00000000;
				while(1) {
					__eflags = _v80 - 3;
					if(_v80 >= 3) {
						break;
					}
					_v120 = _v80 * 0x18;
					__eflags = _v76.dwHighDateTime -  *((intOrPtr*)(_v120 + 0x695404));
					if(__eflags >= 0) {
						if(__eflags > 0) {
							L13:
							_t263 = _v80 * 0x18;
							__eflags = _t263;
							_t34 = _t263 + 0x695400; // 0x0
							_v76.dwLowDateTime =  *_t34;
							_t36 = _t263 + 0x695404; // 0x0
							_v76.dwHighDateTime =  *_t36;
							_v44 = _v80;
						} else {
							_t266 = _v120;
							__eflags = _v76.dwLowDateTime -  *((intOrPtr*)(_t266 + 0x695400));
							if(_v76.dwLowDateTime >  *((intOrPtr*)(_t266 + 0x695400))) {
								goto L13;
							}
						}
					}
					_t261 = _v80 + 1;
					__eflags = _t261;
					_v80 = _t261;
				}
				 *(0x695408 + _v44 * 0x18) =  *(0x695408 + _v44 * 0x18) & 0x00000000;
				 *(0x69540c + _v44 * 0x18) =  *(0x69540c + _v44 * 0x18) & 0x00000000;
				_t181 = _v44 * 0x18;
				 *(_t181 + 0x695400) =  *(_t181 + 0x695400) & 0x00000000;
				 *(_t181 + 0x695404) =  *(_t181 + 0x695404) & 0x00000000;
				_t52 = 0x695410 + _v44 * 0x18; // 0x695ae4
				_v60 =  *((intOrPtr*)( *_t52));
				_t186 =  *0x695af0; // 0x24b0b08
				_t54 = _t186 + 8; // 0x24b0f7c
				_t187 =  *_t54;
				_t282 = _v40;
				__eflags =  *(_t187 + _t282 * 8);
				if( *(_t187 + _t282 * 8) != 0) {
					L23:
					_t188 =  *0x695af0; // 0x24b0b08
					_t107 = _t188 + 8; // 0x24b0f7c
					_t283 = _v40;
					_v52 =  *((intOrPtr*)( *_t107 + _v40 * 8));
					_v36 = _v36 & 0x00000000;
					_v32 = _v32 & 0x00000000;
					__eflags = _a8;
					if(_a8 != 0) {
						_v100 =  *((intOrPtr*)( *_a4 + 8)) + 0xffff >> 0x10;
						__eflags = _a8 - _v100;
						if(_a8 >= _v100) {
							_push( *0x693500);
							_push(0x84);
							_push( *0x693504);
							E0068E82B(_t283);
						}
						_v104 = _v104 & 0x00000000;
						while(1) {
							__eflags = _v104 - _a8;
							if(_v104 >= _a8) {
								goto L30;
							}
							_v36 = _v36 + ( *(_v52 + _v104 * 4) & 0x7fffffff);
							_t227 = _v104 + 1;
							__eflags = _t227;
							_v104 = _t227;
						}
					}
					L30:
					_v56 = L0068A094(_t278, _t316, _t323, _a4,  *((intOrPtr*)( *_a4 + 4)) + _v36,  *(_v52 + _a8 * 4) & 0x7fffffff,  &_v32);
					__eflags = _v56;
					if(_v56 != 0) {
						_v48 = 0x10000;
						_t200 = _a8;
						_t285 = _v52;
						__eflags =  *(_t285 + _t200 * 4) & 0x80000000;
						if(( *(_t285 + _t200 * 4) & 0x80000000) != 0) {
							_t324 = _v56;
							_t287 = _v32 >> 2;
							_t290 = memcpy(_v60, _t324, _t287 << 2) & 0x00000003;
							__eflags = _t290;
							memcpy(_t324 + _t287 + _t287, _t324, _t290);
							goto L37;
						} else {
							_t214 =  &_v48;
							0x692aee(_v60, _t214, _v56, _v32);
							_v108 = _t214;
							__eflags = _v108;
							if(_v108 == 0) {
								L37:
								 *(0x695408 + _v44 * 0x18) = _a8;
								 *(0x69540c + _v44 * 0x18) =  *_a4;
								_t212 = 0x695400 + _v44 * 0x18;
								__eflags = _t212;
								GetSystemTimeAsFileTime(_t212);
								_t213 = _v60;
							} else {
								E0068EC88(_t285, ":BOX:ReadCompressedSection: decompresion failed with code %d", _v108);
								_t213 = 0;
							}
						}
					} else {
						_t213 = 0;
					}
				} else {
					_v88 =  *((intOrPtr*)( *_a4 + 8)) + 0xffff >> 0x10;
					_v84 = _v84 & 0x00000000;
					_v8 = _v8 & 0x00000000;
					_v112 = E0068E6F9(_t282, _v88 << 2);
					_v84 = _v112;
					_v92 = _v92 & 0x00000000;
					_v96 =  *((intOrPtr*)( *_a4 + 4)) - (_v88 << 2);
					_t243 = SetFilePointer(_a4[2], _v96, 0, 0);
					__eflags = _t243 - _v96;
					if(_t243 == _v96) {
						_t248 = ReadFile(_a4[2], _v84, _v88 << 2,  &_v92, 0);
						__eflags = _t248;
						if(_t248 != 0) {
							__eflags = _v92 - _v88 << 2;
							if(_v92 == _v88 << 2) {
								_t251 =  *0x695af0; // 0x24b0b08
								_t98 = _t251 + 8; // 0x24b0f7c
								 *((intOrPtr*)( *_t98 + _v40 * 8)) = _v84;
								_v84 = _v84 & 0x00000000;
								_v8 = _v8 | 0xffffffff;
								E0068A508(_v40);
								goto L23;
							} else {
								_v132 = _v132 & 0x00000000;
								0x690476( &_v20, 0xffffffff);
								_t213 = _v132;
							}
						} else {
							_v128 = _v128 & 0x00000000;
							0x690476( &_v20, 0xffffffff);
							_t213 = _v128;
						}
					} else {
						_v124 = _v124 & 0x00000000;
						0x690476( &_v20, 0xffffffff);
						_t213 = _v124;
					}
				}
				goto L38;
			}

0x0068a2d4
0x0068a2d6
0x0068a2db
0x0068a2e6
0x0068a2e7
0x0068a2ee
0x0068a2ef
0x0068a2f3
0x0068a2f4
0x0068a2f5
0x0068a2f9
0x0068a301
0x0068a307
0x0068a30a
0x0068a30e
0x0068a31b
0x0068a32a
0x0068a332
0x0068a358
0x0068a317
0x0068a317
0x0068a318
0x00000000
0x0068a334
0x0068a33a
0x0068a343
0x00000000
0x0068a345
0x0068a34b
0x0068a351
0x0068a351
0x0068a343
0x0068a664
0x0068a667
0x0068a672
0x0068a672
0x0068a35e
0x0068a364
0x0068a371
0x0068a371
0x0068a375
0x00000000
0x00000000
0x0068a37d
0x0068a386
0x0068a38c
0x0068a38e
0x0068a39e
0x0068a3a1
0x0068a3a1
0x0068a3a4
0x0068a3aa
0x0068a3ad
0x0068a3b3
0x0068a3b9
0x0068a390
0x0068a390
0x0068a396
0x0068a39c
0x00000000
0x00000000
0x0068a39c
0x0068a38e
0x0068a36d
0x0068a36d
0x0068a36e
0x0068a36e
0x0068a3c4
0x0068a3d1
0x0068a3db
0x0068a3de
0x0068a3e5
0x0068a3f2
0x0068a3fa
0x0068a3fd
0x0068a402
0x0068a402
0x0068a405
0x0068a408
0x0068a40c
0x0068a518
0x0068a518
0x0068a51d
0x0068a520
0x0068a526
0x0068a529
0x0068a52d
0x0068a531
0x0068a535
0x0068a547
0x0068a54d
0x0068a550
0x0068a552
0x0068a558
0x0068a55d
0x0068a563
0x0068a563
0x0068a568
0x0068a575
0x0068a578
0x0068a57b
0x00000000
0x00000000
0x0068a590
0x0068a571
0x0068a571
0x0068a572
0x0068a572
0x0068a575
0x0068a595
0x0068a5bc
0x0068a5bf
0x0068a5c3
0x0068a5cc
0x0068a5d3
0x0068a5d6
0x0068a5e1
0x0068a5e3
0x0068a61b
0x0068a623
0x0068a62a
0x0068a62a
0x0068a62d
0x00000000
0x0068a5e5
0x0068a5eb
0x0068a5f2
0x0068a5fa
0x0068a5fd
0x0068a601
0x0068a62f
0x0068a638
0x0068a649
0x0068a655
0x0068a655
0x0068a65b
0x0068a661
0x0068a603
0x0068a60b
0x0068a612
0x0068a612
0x0068a601
0x0068a5c5
0x0068a5c5
0x0068a5c5
0x0068a412
0x0068a422
0x0068a425
0x0068a429
0x0068a43a
0x0068a440
0x0068a443
0x0068a457
0x0068a467
0x0068a46d
0x0068a470
0x0068a4a1
0x0068a4a7
0x0068a4a9
0x0068a4ca
0x0068a4cd
0x0068a4e8
0x0068a4ed
0x0068a4f6
0x0068a4f9
0x0068a4fd
0x0068a501
0x00000000
0x0068a4cf
0x0068a4d1
0x0068a4d9
0x0068a4e0
0x0068a4e0
0x0068a4ab
0x0068a4ad
0x0068a4b5
0x0068a4bc
0x0068a4bc
0x0068a472
0x0068a474
0x0068a47c
0x0068a483
0x0068a483
0x0068a470
0x00000000

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 0068A35E
SetFilePointer.KERNEL32(?,?,00000000,00000000), ref: 0068A467
ReadFile.KERNEL32(?,00000000,?,00000000,00000000), ref: 0068A4A1

Strings

:BOX:ReadCompressedSection: decompresion failed with code %d, xrefs: 0068A606

Memory Dump Source

Source File: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: File$Time$PointerReadSystem
String ID: :BOX:ReadCompressedSection: decompresion failed with code %d
API String ID: 988849968-1091814870
Opcode ID: e67d7ca423477c9b3f92182f58ba8e87614acac0ca7e9c8822f92ccfd6b280fc
Instruction ID: afde831c0cef287e00f9f0dce28d97f96fe95f7ff0716822c0202dce635f79bc
Opcode Fuzzy Hash: e67d7ca423477c9b3f92182f58ba8e87614acac0ca7e9c8822f92ccfd6b280fc
Instruction Fuzzy Hash: 88D12C71A00208DFDB14DF98D985AACB7F6FF18311F64821AE816EB7A1D734A985CF11

Uniqueness

Uniqueness Score: -1.00%

Function 0068ED30, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 53
windowCOMMON

Download Yara Rule

C-Code - Quality: 50%

			E0068ED30(void* __ecx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				intOrPtr _v20;
				signed int _v32;
				char _v36;
				signed int _v40;
				void* __ebp;
				signed int _t20;
				void* _t27;
				signed int _t31;
				void* _t32;
				void* _t34;
				intOrPtr _t38;

				_push(0xffffffff);
				_push(0x693558);
				_push(0x69052c);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t38;
				_push(__ecx);
				_push(__ecx);
				_v32 = _v32 & 0x00000000;
				_v36 = _v36 & 0x00000000;
				_v8 = _v8 & 0x00000000;
				_t20 = E0068E6F9(__ecx, 0x1000);
				_t31 = _t34;
				_v40 = _t20;
				_v32 = _v40;
				FormatMessageA(0x1300, 0, GetLastError(), 0x400,  &_v36, 0, 0);
				_push(_a8);
				_push(_a4);
				_push(_v36);
				wsprintfA(_v32, "windows error %s  at %s(%d)");
				E0068EAC6(_t31, _v32);
				_pop(_t32);
				_v8 = _v8 | 0xffffffff;
				_t27 = E0068EDC4(_t32);
				 *[fs:0x0] = _v20;
				return _t27;
			}

0x0068ed33
0x0068ed35
0x0068ed3a
0x0068ed45
0x0068ed46
0x0068ed4d
0x0068ed4e
0x0068ed55
0x0068ed59
0x0068ed5d
0x0068ed66
0x0068ed6b
0x0068ed6c
0x0068ed72
0x0068ed90
0x0068ed96
0x0068ed99
0x0068ed9c
0x0068eda7
0x0068edb3
0x0068edb8
0x0068edb9
0x0068edbd
0x0068ede6
0x0068edf1

APIs

GetLastError.KERNEL32(00000400,00000000,00000000,00000000), ref: 0068ED82
FormatMessageA.KERNEL32(00001300,00000000,00000000), ref: 0068ED90
wsprintfA.USER32 ref: 0068EDA7

Part of subcall function 0068EAC6: EnterCriticalSection.KERNEL32(024B0440), ref: 0068EAF7
Part of subcall function 0068EAC6: GetModuleHandleA.KERNEL32(00000000), ref: 0068EB33
Part of subcall function 0068EAC6: MessageBoxA.USER32 ref: 0068EC40
Part of subcall function 0068EAC6: GetCurrentProcess.KERNEL32(00000000,?,?,00000000), ref: 0068EC48
Part of subcall function 0068EAC6: TerminateProcess.KERNEL32(00000000,?,?,00000000), ref: 0068EC4F

Part of subcall function 0068EDC4: LocalFree.KERNEL32(00000000,0068EDC2), ref: 0068EDCD

Strings

windows error %s at %s(%d), xrefs: 0068ED9F

Memory Dump Source

Source File: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: MessageProcess$CriticalCurrentEnterErrorFormatFreeHandleLastLocalModuleSectionTerminatewsprintf
String ID: windows error %s at %s(%d)
API String ID: 1873294848-562281301
Opcode ID: 3ce10c325d7201445262765afa2c14ea25fb1da23ccf1d3949ef13268116b5a6
Instruction ID: 94ea3fc161b59d92e7cd4ae2c5e1241a64dab3a4fbd72e82f6a9431f30fa2eac
Opcode Fuzzy Hash: 3ce10c325d7201445262765afa2c14ea25fb1da23ccf1d3949ef13268116b5a6
Instruction Fuzzy Hash: 18117072A44214FFDF01AF94DC06FEDBBBAFB08B62F104219F221A56D1C7B55A048B65

Uniqueness

Uniqueness Score: -1.00%

Function 0068D8ED, Relevance: 6.1, APIs: 4, Instructions: 61
fileCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E0068D8ED(void* __ecx, void* __eflags, intOrPtr _a4) {
				CHAR* _v8;
				void* _v12;
				CHAR* _v16;
				struct _WIN32_FIND_DATAA _v340;
				CHAR* _v344;
				CHAR* _t17;
				CHAR* _t18;
				int _t21;
				void* _t49;
				void* _t50;
				void* _t51;

				_t17 = E0068EDF2(__ecx, 0xffffffff, 0, _a4);
				_t51 = _t50 + 0xc;
				_v8 = _t17;
				_t18 = E0068E6F9(__ecx, 0x105);
				_pop(0);
				_v344 = _t18;
				_v16 = _v344;
				_t21 = FindFirstFileA(_v8,  &_v340);
				_v12 = _t21;
				if(_v12 != 0) {
					do {
						GetTempPathA(0x104, _v16);
						asm("repne scasb");
						_t49 =  &(_v340.cFileName) -  !0xffffffff;
						asm("repne scasb");
						memcpy(_v16 - 1, _t49,  !0xffffffff >> 2 << 2);
						memcpy(_t49 + 0x175b75a, _t49, 1);
						_t51 = _t51 + 0x18;
						DeleteFileA(_v16);
						_t21 = FindNextFileA(_v12,  &_v340);
					} while (_t21 != 0);
				}
				return _t21;
			}

0x0068d900
0x0068d905
0x0068d908
0x0068d910
0x0068d915
0x0068d916
0x0068d922
0x0068d92f
0x0068d935
0x0068d93c
0x0068d93e
0x0068d946
0x0068d95a
0x0068d960
0x0068d96b
0x0068d973
0x0068d97a
0x0068d97a
0x0068d97f
0x0068d98f
0x0068d995
0x0068d93e
0x0068d99d

APIs

Part of subcall function 0068EDF2: GetCurrentProcessId.KERNEL32(?,?,00000084,00000000,?,?,?,00000084), ref: 0068EE33
Part of subcall function 0068EDF2: GetTempPathA.KERNEL32(00000104,?,?,?,00000084,00000000), ref: 0068EE84
Part of subcall function 0068EDF2: wsprintfA.USER32 ref: 0068EEC1
Part of subcall function 0068EDF2: CharUpperBuffA.USER32(?,?,?,?,?,00000000), ref: 0068EF30

FindFirstFileA.KERNEL32(?,?,?,?,00000084), ref: 0068D92F
GetTempPathA.KERNEL32(00000104,00000000,?,?,00000084), ref: 0068D946
DeleteFileA.KERNEL32(00000000,?,?,00000084), ref: 0068D97F
FindNextFileA.KERNEL32(00000000,?,?,?,00000084), ref: 0068D98F

Memory Dump Source

Source File: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: File$FindPathTemp$BuffCharCurrentDeleteFirstNextProcessUpperwsprintf
String ID:
API String ID: 3474902253-0
Opcode ID: d12be983f79cdb192096b87e65848e09cb08ef1c25836017d9f94703ee233388
Instruction ID: 7636debc61b5fdca0d03105b20446740356eb0f7c7c08e5953e8ecb4ef76177d
Opcode Fuzzy Hash: d12be983f79cdb192096b87e65848e09cb08ef1c25836017d9f94703ee233388
Instruction Fuzzy Hash: 05118271A00118EFDF149FB8DC49ADEBBBAEB84315F1042A9F525A62E0DB704E848B54

Uniqueness

Uniqueness Score: -1.00%

Function 00690DFF, Relevance: 5.8, Strings: 4, Instructions: 768COMMON

Download Yara Rule

Strings

invalid bit length repeat, xrefs: 006915F8
too many length or distance symbols, xrefs: 0069155F
invalid stored block lengths, xrefs: 006914A5
invalid block type, xrefs: 00690EB8

Memory Dump Source

Source File: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID:
String ID: invalid bit length repeat$invalid block type$invalid stored block lengths$too many length or distance symbols
API String ID: 0-26694007
Opcode ID: 1650f3dfa99bcd25bed48180fa0fd58161dee78b2e53bd540bc566e5bc44926c
Instruction ID: fd87748a3076ceb0584b8bf02790cff3cf05ece0762af86fc8f8c9f1823e6ad0
Opcode Fuzzy Hash: 1650f3dfa99bcd25bed48180fa0fd58161dee78b2e53bd540bc566e5bc44926c
Instruction Fuzzy Hash: 406215B1A00206DFCF54CF58C980AADBBF6FF49310F2585AAE85A9B755D730DA81CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00414938, Relevance: 5.4, APIs: 4, Instructions: 405memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00004000,00001000,00000040,00000000,00414D96,B70F0AF2,?,?,00000000), ref: 00414A7E

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 99a594d28f348d31d1c2591101f464551af04c0f05e6109c2015bbfed6a449a2
Instruction ID: 8ce194ba518936a4b333fd011f462e0e5ff98d913f679c6ccc15bf9a6c6b4d61
Opcode Fuzzy Hash: 99a594d28f348d31d1c2591101f464551af04c0f05e6109c2015bbfed6a449a2
Instruction Fuzzy Hash: 830297B4E0020A8FDB44DF99D486AAEBBF1FF88314F158166E604AB355D734E885CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00408BAC, Relevance: 4.6, APIs: 3, Instructions: 76nativeCOMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(?,000000EB), ref: 00408BEF
GetWindowLongA.USER32(?,000000EB), ref: 00408C4B
NtdllDefWindowProc_A.NTDLL(?,?,?,?), ref: 00408C68

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: Window$Long$NtdllProc_
String ID:
API String ID: 3674618424-0
Opcode ID: d94f093f6bbe880ab3f5af4fe66c9566d624e6b01ed229cb257ddcc8ef6add43
Instruction ID: edaaff813c6da162dbd22a2388240dccd6d38522ba436c2451ccc983b7c183e0
Opcode Fuzzy Hash: d94f093f6bbe880ab3f5af4fe66c9566d624e6b01ed229cb257ddcc8ef6add43
Instruction Fuzzy Hash: B821C57260D249AEFB20DE68DA44B6B37B8DB05350F10487AF581E72C1DE39E852C739

Uniqueness

Uniqueness Score: -1.00%

Function 0068F6E2, Relevance: 4.6, APIs: 3, Instructions: 58COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(024B0458), ref: 0068F713
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0068F738
SetUnhandledExceptionFilter.KERNEL32(Function_0028EF6E), ref: 0068F748

Memory Dump Source

Source File: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$CriticalEnterSection
String ID:
API String ID: 2707260832-0
Opcode ID: c8cb39db758c780b7afe26a4f0328cfe34260d658491bb3760c95b1b090d08ea
Instruction ID: 16602493a8c0b792393aeeaf27a46c263d804042018c12da5cf1d252690eb612
Opcode Fuzzy Hash: c8cb39db758c780b7afe26a4f0328cfe34260d658491bb3760c95b1b090d08ea
Instruction Fuzzy Hash: D31133B2904214AFDF10EF98EC45B9EBBBAFB04760F10462AF111E66D0D7359900CB64

Uniqueness

Uniqueness Score: -1.00%

Function 0042E204, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 5COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(00400000,TMADEXCEPT,0000000A), ref: 0042E20C

Strings

TMADEXCEPT, xrefs: 0042E206

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: FindResource
String ID: TMADEXCEPT
API String ID: 1635176832-1465931417
Opcode ID: 8f4e9b681f455ee32d42f8674e9e35b3b176330d2b4250c9702126cd4e3cec6c
Instruction ID: c725b7d58626e53fe214e60cda4a1b434475b4e0886b49ac211c9a0d1a7f6f8c
Opcode Fuzzy Hash: 8f4e9b681f455ee32d42f8674e9e35b3b176330d2b4250c9702126cd4e3cec6c
Instruction Fuzzy Hash: A2900244FC431060D85031A21C47F09100C2751B09FD045DA31067A1C344AD5500047B

Uniqueness

Uniqueness Score: -1.00%

Function 0040AB10, Relevance: 3.0, APIs: 2, Instructions: 19threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(0000000E,?,00000002,?,0040AD3E,-00000004,00000064,00000000,00000400,00000000,00000000,0040ADA1,?,?,00000000,00000000), ref: 0040AB23
GetLocaleInfoA.KERNEL32(00000000,0000000E,?,00000002,?,0040AD3E,-00000004,00000064,00000000,00000400,00000000,00000000,0040ADA1,?,?,00000000), ref: 0040AB29

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: Locale$InfoThread
String ID:
API String ID: 4232894706-0
Opcode ID: 1581144e534d70f8741df6b7492c8bc470a485f2353277b0e8b8dc98a3a0e48c
Instruction ID: 92e52b635c2661cc65d96c96b3cbcad8bfe540f6b8f141e79983f72d97bbcf83
Opcode Fuzzy Hash: 1581144e534d70f8741df6b7492c8bc470a485f2353277b0e8b8dc98a3a0e48c
Instruction Fuzzy Hash: 5EE08C8860D3C1ACE20163746A06B363EAC0B61200F08086AA784EE2D7D27ED009E33B

Uniqueness

Uniqueness Score: -1.00%

Function 0042B7EC, Relevance: 3.0, APIs: 2, Instructions: 16COMMON

Download Yara Rule

APIs

InitializeSecurityDescriptor.ADVAPI32(?,00000001,00000000,0042E75C,00000000,0042E7BA,?,00000000), ref: 0042B800
SetSecurityDescriptorDacl.ADVAPI32(?,000000FF,00000000,00000000,?,00000001,00000000,0042E75C,00000000,0042E7BA,?,00000000), ref: 0042B80C

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: DescriptorSecurity$DaclInitialize
String ID:
API String ID: 625223987-0
Opcode ID: 392f2544300e24aa619eba52425cbbbc4ee90af40d326533f65ddcadeb52df08
Instruction ID: 1e65df1025e7ff0c97246af645b30fa6adfadddd347ce977fd0d86ba3c67559b
Opcode Fuzzy Hash: 392f2544300e24aa619eba52425cbbbc4ee90af40d326533f65ddcadeb52df08
Instruction Fuzzy Hash: E6D0C7B06443006AE7149F264CC5F11B5995B84710F25C26571146F2E2C5B554404514

Uniqueness

Uniqueness Score: -1.00%

Function 0069251E, Relevance: 1.6, Strings: 1, Instructions: 334COMMON

Download Yara Rule

Strings

$i, xrefs: 00692820

Memory Dump Source

Source File: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID:
String ID: $i
API String ID: 0-565685446
Opcode ID: 6310859695cc467afef26f9f49b3249037e8dba6b9f8126350a8d7da67942f8a
Instruction ID: 9a094c36a2cc5c230144d6614a0562df01995e6f1b336d0058b2eb2cc78c8b66
Opcode Fuzzy Hash: 6310859695cc467afef26f9f49b3249037e8dba6b9f8126350a8d7da67942f8a
Instruction Fuzzy Hash: 11D1F871E0021A9FCF18CFA9C8A05EDBBB6FF88314F25856AD859A7750D730A945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00435178, Relevance: 1.3, Strings: 1, Instructions: 26COMMON

Download Yara Rule

Strings

SmtpPassword, xrefs: 0043519B

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: FreeLocal
String ID: SmtpPassword
API String ID: 2826327444-233277553
Opcode ID: 21f18b2ea31c5c42d0c93fd81d80443debf251cbece0659f505c40d36a055042
Instruction ID: 97eff7d747fcc2a4b0bab5ae3738ff74258ae54767f3f11d40432b28e1b2cf2e
Opcode Fuzzy Hash: 21f18b2ea31c5c42d0c93fd81d80443debf251cbece0659f505c40d36a055042
Instruction Fuzzy Hash: 96E09270604B08AFDB09EB66CC5291DB7E8EB8D700BB2447AF80093681E7786E009528

Uniqueness

Uniqueness Score: -1.00%

Function 00416554, Relevance: .4, Instructions: 409COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 167120f7ed2d6992adefbe59981dc2065f01ef566f69623b4a20c52cc85b5175
Instruction ID: 7ab1b88b942e2e5cfad5c6d41d3f71dc0e9de7698ddaaf108bcaeb95f252e365
Opcode Fuzzy Hash: 167120f7ed2d6992adefbe59981dc2065f01ef566f69623b4a20c52cc85b5175
Instruction Fuzzy Hash: 2F020475E00209DFCB10DFA8C580AEEBBF5BB58310F25829AD454A7355D738EA81CB69

Uniqueness

Uniqueness Score: -1.00%

Function 0040D97C, Relevance: .4, Instructions: 385COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc29a93fa4cdfe99f934c5bb863e08a313b77466a7da11ebd17416a3c6c4674e
Instruction ID: 822653e6f62be8270055beeb766ee20ccf1534a9ecbc6b85354842dc1a65ed13
Opcode Fuzzy Hash: dc29a93fa4cdfe99f934c5bb863e08a313b77466a7da11ebd17416a3c6c4674e
Instruction Fuzzy Hash: 54F15B74A006459FDB08CF68C484E663BB2FF5A364F1581A2E845DF7A1C338ED85CB89

Uniqueness

Uniqueness Score: -1.00%

Function 004177E8, Relevance: .3, Instructions: 267COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9888bbba5f0e0de4e3f2d9ecbf770293a18013b583cd864a32af9e516857be85
Instruction ID: 5fc80d907217051bb88195e99ffc06241d774eb93a452ad80229ab199acb8a6f
Opcode Fuzzy Hash: 9888bbba5f0e0de4e3f2d9ecbf770293a18013b583cd864a32af9e516857be85
Instruction Fuzzy Hash: 8DD1FD75D442A5AFCB52CFFDD8D069EFBB0BF0E208F8A41D5D6902B242C2316651CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00415330, Relevance: .3, Instructions: 252COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abea0cec4107322f6e29c629e5f907af4dac5294d258ae93bd98213ee8de7ef9
Instruction ID: 12e859728a76b2c6e065d520079ea38d53412a1d17148bf21f1969980f5b0b1b
Opcode Fuzzy Hash: abea0cec4107322f6e29c629e5f907af4dac5294d258ae93bd98213ee8de7ef9
Instruction Fuzzy Hash: B4B18034A0464ACFCB09CF68D4949EDBBF1FF5A310B2841AED9969B352C734A981CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00418068, Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56b74fb982cafef0eca99581db3cb45b3aae44829218796c5d964cc82a860a7a
Instruction ID: a43e9ab9e1f60092882c94adf48ea3574312058ca74c03a9c54b8ada1a97dc23
Opcode Fuzzy Hash: 56b74fb982cafef0eca99581db3cb45b3aae44829218796c5d964cc82a860a7a
Instruction Fuzzy Hash: 1931226B6196D206C306863E4891361AF935BEA10475DC2EAD4D8CF30BE83BC94BD391

Uniqueness

Uniqueness Score: -1.00%

Function 004247D8, Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78794b09017843c3fddcb147730b0356f9c549d013e0f7875dd4d4cb7f6604a2
Instruction ID: 42a81a517653a3599bf1dcb86354042b88e9b61beb18ee084ea8b39880a0739a
Opcode Fuzzy Hash: 78794b09017843c3fddcb147730b0356f9c549d013e0f7875dd4d4cb7f6604a2
Instruction Fuzzy Hash: 5621D42572D6E41AD306667968903BFBFD2DFD7310FA9897FE0D982743C0288406A35B

Uniqueness

Uniqueness Score: -1.00%

Function 0043DDC8, Relevance: 33.6, APIs: 17, Strings: 2, Instructions: 315windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0042C174: GetVersion.KERNEL32(?,00000001,00445D18,00000010,00000000,00445EC5,?,T$E,005FA000,00000000), ref: 0042C178
Part of subcall function 0042C174: Sleep.KERNEL32(0000000A,?,00000001,00445D18,00000010,00000000,00445EC5,?,T$E,005FA000,00000000), ref: 0042C1D6

MessageBeep.USER32(00000000), ref: 0043DE14
SetMapMode.GDI32(?,00000001), ref: 0043DE66

Strings

Courier New, xrefs: 0043DF1E
B, xrefs: 0043DE3E

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: BeepMessageModeSleepVersion
String ID: B$Courier New
API String ID: 1322057345-994959992
Opcode ID: e5d2a6c4da25905a38c1fa769ca4b30f337a646c21e8be349fb52767ab525cca
Instruction ID: 98e2f33d15795d7243c5de33b3c325a129f29fa12189380b5d33c364f1e0699c
Opcode Fuzzy Hash: e5d2a6c4da25905a38c1fa769ca4b30f337a646c21e8be349fb52767ab525cca
Instruction Fuzzy Hash: 97B1EF75F042089FDB10EBE9CC86B9EB7B9AB48304F50457AB604F72C1D778A9058B69

Uniqueness

Uniqueness Score: -1.00%

Function 0043E984, Relevance: 28.8, APIs: 19, Instructions: 320windowCOMMON

Download Yara Rule

APIs

IsWindowEnabled.USER32(?), ref: 0043E9D6
GetClientRect.USER32(?,?), ref: 0043EA12
DrawFrameControl.USER32(?,?,00000004,00000210), ref: 0043EA46
DrawFrameControl.USER32(?,?,00000004,00000010), ref: 0043EA5C
GetSysColor.USER32(00000015), ref: 0043EA63
CreateSolidBrush.GDI32(?), ref: 0043EA73
FillRect.USER32(?,?,00000000), ref: 0043EA86
DeleteObject.GDI32(00000000), ref: 0043EA8C
GetSysColor.USER32(0000000F), ref: 0043EA93
InflateRect.USER32(?,000000FD,000000FD), ref: 0043EBA8
DrawFocusRect.USER32(?,?), ref: 0043EBB8
GetWindowTextA.USER32(?,?,0000001E), ref: 0043EBF5
IsWindowEnabled.USER32(?), ref: 0043EC36
SetTextColor.GDI32(?,00FFFFFF), ref: 0043EC4B
TextOutA.GDI32(?,?,00000005,?,00000000), ref: 0043EC64
GetSysColor.USER32(00000015), ref: 0043EC6B
SetTextColor.GDI32(?,00000000), ref: 0043EC78
SetTextColor.GDI32(?,?), ref: 0043EC8A
TextOutA.GDI32(?,?,-00000004,?,00000000), ref: 0043ECA3

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: ColorText$Rect$DrawWindow$ControlEnabledFrame$BrushClientCreateDeleteFillFocusInflateObjectSolid
String ID:
API String ID: 1775932466-0
Opcode ID: 6154e2c5ab1506d7d424ecc0a5e8c93ef5f7bf6b1839e053ed8480b06f8fc840
Instruction ID: 94e7de3dc99eb8f4b12f39fc997464827c4995fea9c8e56a366c45d8b3c22fc4
Opcode Fuzzy Hash: 6154e2c5ab1506d7d424ecc0a5e8c93ef5f7bf6b1839e053ed8480b06f8fc840
Instruction Fuzzy Hash: 5DC13B76A00208EFDB00DFA9C985EDEB7F9AF48304F154166F914EB291D638EE41CB55

Uniqueness

Uniqueness Score: -1.00%

Function 004427A4, Relevance: 26.7, APIs: 3, Strings: 12, Instructions: 472windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,0000130B,00000000,00000000), ref: 004427E9
SendMessageA.USER32(?,00001003,00000001,00000000), ref: 00442A91
SendMessageA.USER32(00000000,00000030,?,00000000), ref: 00442CB6

Part of subcall function 00442408: SendMessageA.USER32(?,00000030,?,00000000), ref: 004424D6
Part of subcall function 00442408: SendMessageA.USER32(?,00001003,00000001,?), ref: 004424F3

Strings

disassembling, xrefs: 00442C04
,C, xrefs: 00442AB2
MZP, xrefs: 00442C86
modules, xrefs: 00442B6A
stack dump, xrefs: 00442BBA
>> , xrefs: 004428CA
>> will be, xrefs: 00442ADB
cpu registers, xrefs: 00442B92
pC, xrefs: 00442AC5
processes, xrefs: 00442BDF
Edit, xrefs: 00442C93
>> internal, xrefs: 00442B05

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: MessageSend
String ID: ,C$>> $>> internal$>> will be$Edit$MZP$cpu registers$disassembling$modules$processes$pC$stack dump
API String ID: 3850602802-3811169761
Opcode ID: 9ae8e5fcb9daf7abe0b852f7c8a73c803076505817dc60ea0d3eae4c81696248
Instruction ID: f7b9eb70678656749e8d53d96f02107b78b94ab58cfd427e0bdd8fbe2907a797
Opcode Fuzzy Hash: 9ae8e5fcb9daf7abe0b852f7c8a73c803076505817dc60ea0d3eae4c81696248
Instruction Fuzzy Hash: ED121975A0020ADFDB00EB94C581EEEB7B9FF48304F604166F915AB391DB78AE06CB54

Uniqueness

Uniqueness Score: -1.00%

Function 0043E624, Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 237COMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(?,000000EB), ref: 0043E669
FindResourceA.KERNEL32(?,00000000,00000002), ref: 0043E69D
SizeofResource.KERNEL32(?,00000000,?,00000000,00000002,?,000000EB,00000000,0043E8E5), ref: 0043E6AE
LoadResource.KERNEL32(?,00000000,?,00000000,?,00000000,00000002,?,000000EB,00000000,0043E8E5), ref: 0043E6C8
LockResource.KERNEL32(00000000), ref: 0043E6F3
FreeResource.KERNEL32(00000000,00000000), ref: 0043E727
CreateCompatibleDC.GDI32(00000000), ref: 0043E826
CreateDIBSection.GDI32(00000000,?,00000000,?,00000000,00000000), ref: 0043E849
GdiFlush.GDI32(00000000,?,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 0043E85A
GdiFlush.GDI32(00000000,?,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 0043E873
SelectObject.GDI32(00000000,00000000), ref: 0043E87A
SelectObject.GDI32(00000000,?), ref: 0043E8A4
DeleteObject.GDI32(00000000), ref: 0043E8AA
DeleteDC.GDI32(00000000), ref: 0043E8B4

Strings

mei, xrefs: 0043E683

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: Resource$Object$CreateDeleteFlushSelect$CompatibleFindFreeLoadLockLongSectionSizeofWindow
String ID: mei
API String ID: 2275757986-2477442943
Opcode ID: 968a82e2796a9fd6aff9a999706c169787fc458f86d367647daebf81a791ac6d
Instruction ID: d753d782d7a4ed4e856bbd41e1f2de5cfc8918e0438134dce9487d93f8f76548
Opcode Fuzzy Hash: 968a82e2796a9fd6aff9a999706c169787fc458f86d367647daebf81a791ac6d
Instruction Fuzzy Hash: 72816571E002095BDB14EF69CC81BAE77B9EF89304F15913AE500F73D6DA78E9018B94

Uniqueness

Uniqueness Score: -1.00%

Function 00423394, Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 102threadwindowCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll,GetCursorInfo), ref: 004233BC
GetCursorPos.USER32(?), ref: 004233DB
WindowFromPoint.USER32(?,?,00000000,user32.dll,GetCursorInfo), ref: 004233EA
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 004233F6
GetCurrentThreadId.KERNEL32 ref: 00423408
AttachThreadInput.USER32(00000000,00000000,000000FF,?,?,00000000,user32.dll,GetCursorInfo), ref: 0042340E
GetCursor.USER32(?,?,00000000,user32.dll,GetCursorInfo), ref: 00423413
GetCurrentThreadId.KERNEL32 ref: 00423422
AttachThreadInput.USER32(00000000,00000000,00000000,?,?,00000000,user32.dll,GetCursorInfo), ref: 00423428
GetIconInfo.USER32(?,?), ref: 0042343F
DeleteObject.GDI32(?), ref: 00423450
DeleteObject.GDI32(?), ref: 0042345D
DrawIconEx.USER32(?,?,?,?,00000000,00000000,00000000,00000000,00000003), ref: 00423491

Strings

user32.dll, xrefs: 004233B7
GetCursorInfo, xrefs: 004233B2

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: Thread$AttachCurrentCursorDeleteIconInputObjectWindow$DrawFromHandleInfoModulePointProcess
String ID: GetCursorInfo$user32.dll
API String ID: 2809598821-4002949112
Opcode ID: dd4ac13b24d6eb81e6b845c09c47d92d2827bd99732520e98d9e44e94b4b934e
Instruction ID: 3a954f184e4d703981de476d3edde36987b02e2d82715ead4c857b0a80b75d47
Opcode Fuzzy Hash: dd4ac13b24d6eb81e6b845c09c47d92d2827bd99732520e98d9e44e94b4b934e
Instruction Fuzzy Hash: BB313C71F0431A6ADB11EEFA9C85B9F77BC9F04345F50416ABA00B7281DA7CEA008769

Uniqueness

Uniqueness Score: -1.00%

Function 0043BC94, Relevance: 24.9, APIs: 1, Strings: 13, Instructions: 403COMMON

Download Yara Rule

APIs

closesocket.WS2_32(?), ref: 0043C13F

Strings

User-Agent: madExcept/3.0, xrefs: 0043BF99
Content-Disposition: form-data; name=", xrefs: 0043BD32
Connection: close, xrefs: 0043BF85
Authorization: Basic , xrefs: 0043C033
From: , xrefs: 0043BFF4
Content-Length: , xrefs: 0043BFB2
HTTP/1.1, xrefs: 0043BF50
www.madshi.net_multipart_boundary, xrefs: 0043BD28, 0043BFA8
--www.madshi.net_multipart_boundary--, xrefs: 0043C101
POST , xrefs: 0043BF48
Content-Type: multipart/form-data; boundary=, xrefs: 0043BFA3
Host: , xrefs: 0043BF5A
Pragma: no-cache, xrefs: 0043BF8F

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: closesocket
String ID: --www.madshi.net_multipart_boundary--$ HTTP/1.1$Authorization: Basic $Connection: close$Content-Disposition: form-data; name="$Content-Length: $Content-Type: multipart/form-data; boundary=$From: $Host: $POST $Pragma: no-cache$User-Agent: madExcept/3.0$www.madshi.net_multipart_boundary
API String ID: 2781271927-3628904027
Opcode ID: 520199f2089230f9e6d2361bbdaced5b79e242663719313899282ef317dd10e2
Instruction ID: e685ab905e74a4c399274ef190aea09b3a71a631372c1315a452a7766d3a3ba8
Opcode Fuzzy Hash: 520199f2089230f9e6d2361bbdaced5b79e242663719313899282ef317dd10e2
Instruction Fuzzy Hash: 02F1D775A402089FCB00DF99C885A9EB7B5EF4C314F219166F904AB3A2CB74ED45CB94

Uniqueness

Uniqueness Score: -1.00%

Function 004172F0, Relevance: 21.4, APIs: 14, Instructions: 390filetimememoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?,00000000,00000000,00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00417415
LocalAlloc.KERNEL32(00000040,?,00000040,?,00000000,00000000,00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0041743A
GetFileTime.KERNEL32(00000000,00000000,00000000,B70F0B86,?,00000000,?,?,B70F0B82,00000000,00000040,?,00000040,?,00000000,00000000), ref: 004174E2
FileTimeToLocalFileTime.KERNEL32(B70F0B86,B70F0B86,00000000,00000000,00000000,B70F0B86,?,00000000,?,?,B70F0B82,00000000,00000040,?,00000040,?), ref: 004174EF
FileTimeToDosDateTime.KERNEL32(B70F0B86,B70F0B58,B70F0B56), ref: 00417500
WriteFile.KERNEL32(?,B70F0B4C,0000001E,B70F0B82,00000000,?,00000000,00000000,00000001,00000000,B70F0B86,B70F0B58,B70F0B56,B70F0B86,B70F0B86,00000000), ref: 00417586
WriteFile.KERNEL32(?,00000000,00000000,B70F0B82,00000000,?,B70F0B4C,0000001E,B70F0B82,00000000,?,00000000,00000000,00000001,00000000,B70F0B86), ref: 004175AF
WriteFile.KERNEL32(?,?,?,B70F0B82,00000000,?,00000000,00000000,B70F0B82,00000000,?,B70F0B4C,0000001E,B70F0B82,00000000,?), ref: 004175D6
LocalFree.KERNEL32(?,00000000,?,?,B70F0B82,00000000,00000040,?,00000040,?,00000000,00000000,00000000,80000000,00000001,00000000), ref: 004175F7
LocalFree.KERNEL32(?,00000040,?,00000040,?,00000000,00000000,00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00417600
WriteFile.KERNEL32(?,00000004,0000002E,B70F0B82,00000000,?,00000000,00000000,00000001), ref: 004176B5
WriteFile.KERNEL32(?,00000000,00000000,B70F0B82,00000000,?,00000004,0000002E,B70F0B82,00000000,?,00000000,00000000,00000001), ref: 004176DE
WriteFile.KERNEL32(?,B70F0B36,00000016,B70F0B82,00000000,?,00000000,00000000,00000001), ref: 00417717
DeleteFileA.KERNEL32(00000000,?), ref: 00417747

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: File$Write$LocalTime$AllocFree$DateDelete
String ID:
API String ID: 912391403-0
Opcode ID: 770052da791951678017411fc381b3910285bc3c257de85469ff280a0904b08d
Instruction ID: e1ad207f9c91cf2294538ed2b38fb518f8dcd0d8413a5682430c904c84897306
Opcode Fuzzy Hash: 770052da791951678017411fc381b3910285bc3c257de85469ff280a0904b08d
Instruction Fuzzy Hash: 19E12A70E04208ABDB10EBA9C885FDEB7F9AF48304F10446AF514FB291D779A945CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00408954, Relevance: 21.2, APIs: 14, Instructions: 196COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(?,00000000,00000002), ref: 004089A1
SizeofResource.KERNEL32(?,00000000,?,00000000,00000002,00000000,00408B97), ref: 004089B2
LoadResource.KERNEL32(?,00000000,?,00000000,?,00000000,00000002,00000000,00408B97), ref: 004089CC
LockResource.KERNEL32(00000000), ref: 004089F7
FreeResource.KERNEL32(00000000,00000000), ref: 00408A2B
GetSysColor.USER32(0000000F), ref: 00408A32
CreateCompatibleDC.GDI32(00000000), ref: 00408AE4
CreateDIBSection.GDI32(00000000,?,00000000,?,00000000,00000000), ref: 00408B07
GdiFlush.GDI32(00000000,00000000), ref: 00408B18
GdiFlush.GDI32(00000000,00000000), ref: 00408B31
SelectObject.GDI32(00000000,00000000), ref: 00408B38
SelectObject.GDI32(00000000,?), ref: 00408B5E
DeleteObject.GDI32(00000000), ref: 00408B64
DeleteDC.GDI32(00000000), ref: 00408B6E

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: Resource$Object$CreateDeleteFlushSelect$ColorCompatibleFindFreeLoadLockSectionSizeof
String ID:
API String ID: 3833887070-0
Opcode ID: 6d458f9748dfa3ff53c409fdc410263c719e22e04ef82bb67f5a592aab4e7371
Instruction ID: 94925152a82b1ca40a31ae821374ae76607cd8069cefb700c532e80d703e74a9
Opcode Fuzzy Hash: 6d458f9748dfa3ff53c409fdc410263c719e22e04ef82bb67f5a592aab4e7371
Instruction Fuzzy Hash: BC51E272E006155BDB11EB69CC42BBFB6B9EF85314F15413AE900BB3C1DA38AD0187E9

Uniqueness

Uniqueness Score: -1.00%

Function 0042C4E4, Relevance: 21.2, APIs: 1, Strings: 11, Instructions: 165timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,0042C70F,?,00000000,00000001,00000000,00000000,%exceptMsg%,?,004368E8), ref: 0042C5B6

Strings

Unknown, xrefs: 0042C573
%bugReport%, xrefs: 0042C595
%modname%, xrefs: 0042C560
%appname%, xrefs: 0042C53A
hC, xrefs: 0042C61B
%date%, xrefs: 0042C6B3
%exceptMsg%, xrefs: 0042C4E7
%time%, xrefs: 0042C6C4
%datetime%, xrefs: 0042C6D5
%exceptMsg%, xrefs: 0042C584
%LF%, xrefs: 0042C5A8

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: LocalTime
String ID: %LF%$%appname%$%bugReport%$%date%$%datetime%$%exceptMsg%$%exceptMsg%$%modname%$%time%$Unknown$hC
API String ID: 481472006-3650041594
Opcode ID: 5a78b00ff3505b4748fa4d10ee0d7a73b1dde4bb43795c20253abfaeba0d561b
Instruction ID: d6963eb2e8e9c77f07b0f853f71806fe7170025e4cda01f7872aee1baf3fb612
Opcode Fuzzy Hash: 5a78b00ff3505b4748fa4d10ee0d7a73b1dde4bb43795c20253abfaeba0d561b
Instruction Fuzzy Hash: 3D510375B40129ABDB00EB95D892BDEB7B5EFC8704F90803AF500B7281D77D9D058BA9

Uniqueness

Uniqueness Score: -1.00%

Function 00424A84, Relevance: 21.1, APIs: 14, Instructions: 122COMMON

Download Yara Rule

APIs

CreatePen.GDI32(?,00000001,?), ref: 00424A9E
SelectObject.GDI32(?,?), ref: 00424AAB
SetBkColor.GDI32(?,?), ref: 00424AB8
MoveToEx.GDI32(?,?,?,00000000), ref: 00424ADC
LineTo.GDI32(?,?,?), ref: 00424AF1
MoveToEx.GDI32(?,?,?,00000000), ref: 00424B01
LineTo.GDI32(?,?,?), ref: 00424B14
MoveToEx.GDI32(?,?,?,00000000), ref: 00424B26
LineTo.GDI32(?,?,?), ref: 00424B3A
MoveToEx.GDI32(?,?,?,00000000), ref: 00424B4C
LineTo.GDI32(?,?,?), ref: 00424B61
SetBkColor.GDI32(?,?), ref: 00424B75
SelectObject.GDI32(?,?), ref: 00424B7F
DeleteObject.GDI32(?), ref: 00424B88

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: LineMove$Object$ColorSelect$CreateDelete
String ID:
API String ID: 1677892028-0
Opcode ID: 9188ecbb3ec32e414258cb6dd7562417e26cd9dfeb95da7e702f848956125cc0
Instruction ID: 7d6027a4f17df77adf650f5abbc2aca914cae052f895d7a72586b5b95c30cfcc
Opcode Fuzzy Hash: 9188ecbb3ec32e414258cb6dd7562417e26cd9dfeb95da7e702f848956125cc0
Instruction Fuzzy Hash: 95310FB2B04219BFD710EEAECC85EAF7BACDB44354F004426B915E7242D638ED10C7A5

Uniqueness

Uniqueness Score: -1.00%

Function 004062D4, Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 136stringCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,00000008,00000000,005FA08C,?,00406534,00000000,00406591,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?), ref: 004062F1
lstrcpyn.KERNEL32(?,?,?,?,00406534,00000000,00406591,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 00406332
lstrcpyn.KERNEL32(?,?,?,kernel32.dll,00000008,00000000,005FA08C,?,00406534,00000000,00406591,?,80000001,Software\Borland\Locales,00000000,000F0019), ref: 00406396
lstrcpyn.KERNEL32(?,?,00000001,?,?,?,kernel32.dll,00000008,00000000,005FA08C,?,00406534,00000000,00406591,?,80000001), ref: 004063CB
lstrlen.KERNEL32(?,00000000,?,?,?,?,00000001,?,?,?,kernel32.dll,00000008,00000000,005FA08C,?,00406534), ref: 004063F7
lstrcpyn.KERNEL32(0000005D,?,00000104,?,00000000,?,?,?,?,00000001,?,?,?,kernel32.dll,00000008,00000000), ref: 0040642B
lstrlen.KERNEL32(?,0000005D,?,00000104,?,00000000,?,?,?,?,00000001,?,?,?,kernel32.dll,00000008), ref: 00406437
lstrcpyn.KERNEL32(?,0000005C,?,?,0000005D,?,00000104,?,00000000,?,?,?,?,00000001,?,?), ref: 00406459

Strings

kernel32.dll, xrefs: 004062EC
\, xrefs: 00406409
GetLongPathNameA, xrefs: 004062FC

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: lstrcpyn$lstrlen$HandleModule
String ID: GetLongPathNameA$\$kernel32.dll
API String ID: 3464091497-1565342463
Opcode ID: c5aa2957b067cb8e48b75fab92ed1dd4f637dde9c7766486749e38ce8785b10c
Instruction ID: dcb38ff0108a73db7a385731ee4ab17cf7e26b9cd380e4edd61c124c6fd04cf7
Opcode Fuzzy Hash: c5aa2957b067cb8e48b75fab92ed1dd4f637dde9c7766486749e38ce8785b10c
Instruction Fuzzy Hash: 29419572900119AFDB10EAA9CC85EDFB7EDDF44314F1500BBA949F3292D6389F548B98

Uniqueness

Uniqueness Score: -1.00%

Function 00428C20, Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 88windowregistryCOMMON

Download Yara Rule

APIs

LoadCursorA.USER32(00000000,00007F00), ref: 00428C61
RegisterClassA.USER32(000000C0), ref: 00428C6D
CreateWindowExA.USER32(00000001,?,00000000,00C80000,00000000,00000000,000000C8,000000C8,?,00000000,MZP,00000000), ref: 00428CAB

Part of subcall function 0040B834: VirtualAlloc.KERNEL32(00000000,00000011,00001000,00000040), ref: 0040B84A

SetWindowLongA.USER32(?,000000FC,00000010), ref: 00428CE2
GetSystemMenu.USER32(?,00000000,00000001,?,00000000,00C80000,00000000,00000000,000000C8,000000C8,?,00000000,MZP,00000000,00000000,00007F00), ref: 00428CF3
RemoveMenu.USER32(00000000,0000F020,00000000,?,00000000,00000001,?,00000000,00C80000,00000000,00000000,000000C8,000000C8,?,00000000,MZP), ref: 00428D02
RemoveMenu.USER32(00000000,0000F030,00000000,00000000,0000F020,00000000,?,00000000,00000001,?,00000000,00C80000,00000000,00000000,000000C8,000000C8), ref: 00428D0F
RemoveMenu.USER32(00000000,0000F120,00000000,00000000,0000F030,00000000,00000000,0000F020,00000000,?,00000000,00000001,?,00000000,00C80000,00000000), ref: 00428D1C
RemoveMenu.USER32(00000000,0000F000,00000000,00000000,0000F120,00000000,00000000,0000F030,00000000,00000000,0000F020,00000000,?,00000000,00000001,?), ref: 00428D29

Strings

MZP, xrefs: 00428C79
madNVAssistantWnd, xrefs: 00428C52

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: Menu$Remove$Window$AllocClassCreateCursorLoadLongRegisterSystemVirtual
String ID: MZP$madNVAssistantWnd
API String ID: 1475295263-1210305120
Opcode ID: e027c326a916efd6a1735755b5b3f0b373b1305ac6e418cf9bdd0a5ace3b2d63
Instruction ID: 455dac2dcebdfeaee4299419857f9b9f05eccf0c9824cea493ab2285a5ca29e2
Opcode Fuzzy Hash: e027c326a916efd6a1735755b5b3f0b373b1305ac6e418cf9bdd0a5ace3b2d63
Instruction Fuzzy Hash: 0D312E74B85204AFE710DB68CC86F9EB7E8EB08714F108165B904AF3D2C678ED408B99

Uniqueness

Uniqueness Score: -1.00%

Function 0040808C, Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 61registryclipboardwindowCOMMON

Download Yara Rule

APIs

FindWindowA.USER32(MouseZ,Magellan MSWHEEL), ref: 004080A4
RegisterClipboardFormatA.USER32(MSWHEEL_ROLLMSG), ref: 004080B0
RegisterClipboardFormatA.USER32(MSH_WHEELSUPPORT_MSG), ref: 004080BF
RegisterClipboardFormatA.USER32(MSH_SCROLL_LINES_MSG), ref: 004080CB
SendMessageA.USER32(00000000,00000000,00000000,00000000), ref: 004080E3
SendMessageA.USER32(00000000,?,00000000,00000000), ref: 00408107

Strings

MSH_SCROLL_LINES_MSG, xrefs: 004080C6
MouseZ, xrefs: 0040809F
MSH_WHEELSUPPORT_MSG, xrefs: 004080BA
MSWHEEL_ROLLMSG, xrefs: 004080AB
Magellan MSWHEEL, xrefs: 0040809A

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: ClipboardFormatRegister$MessageSend$FindWindow
String ID: MSH_SCROLL_LINES_MSG$MSH_WHEELSUPPORT_MSG$MSWHEEL_ROLLMSG$Magellan MSWHEEL$MouseZ
API String ID: 1416857345-3736581797
Opcode ID: d647705f8095a8b39024e3ec9347c9d84d0d9289cdaf1dfed943fbf054974fda
Instruction ID: 122986cd74cba8abc05e66c13d8c7e0325f67aa4a70c2a4d691c83d7a8a0f9ce
Opcode Fuzzy Hash: d647705f8095a8b39024e3ec9347c9d84d0d9289cdaf1dfed943fbf054974fda
Instruction Fuzzy Hash: 48114F71644301AFE7109F55C942B6AB7A8EF45310F20407AF884BF3C1DAB85C418BE9

Uniqueness

Uniqueness Score: -1.00%

Function 004222B4, Relevance: 17.7, APIs: 14, Instructions: 244memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00046308), ref: 004222CD
LocalAlloc.KERNEL32(00000040,00023184,00000040,00046308), ref: 004222DC
LocalAlloc.KERNEL32(00000040,00023184,00000040,00023184,00000040,00046308), ref: 004222EB
LocalAlloc.KERNEL32(00000040,00023184,00000040,00023184,00000040,00023184,00000040,00046308), ref: 004222FA
LocalAlloc.KERNEL32(00000040,00023184,00000040,00023184,00000040,00023184,00000040,00023184,00000040,00046308), ref: 00422309
LocalAlloc.KERNEL32(00000040,00001C00,00000040,00023184,00000040,00023184,00000040,00023184,00000040,00023184,00000040,00046308), ref: 00422318
LocalAlloc.KERNEL32(00000040,00000800,00000040,00001C00,00000040,00023184,00000040,00023184,00000040,00023184,00000040,00023184,00000040,00046308), ref: 00422327
LocalFree.KERNEL32(00000000,00000040,00000800,00000040,00001C00,00000040,00023184,00000040,00023184,00000040,00023184,00000040,00023184,00000040,00046308), ref: 0042249F
LocalFree.KERNEL32(?,00000000,00000040,00000800,00000040,00001C00,00000040,00023184,00000040,00023184,00000040,00023184,00000040,00023184,00000040,00046308), ref: 004224A8
LocalFree.KERNEL32(?,?,00000000,00000040,00000800,00000040,00001C00,00000040,00023184,00000040,00023184,00000040,00023184,00000040,00023184,00000040), ref: 00422537
LocalFree.KERNEL32(?,?,?,00000000,00000040,00000800,00000040,00001C00,00000040,00023184,00000040,00023184,00000040,00023184,00000040,00023184), ref: 00422540
LocalFree.KERNEL32(00000020,?,?,?,00000000,00000040,00000800,00000040,00001C00,00000040,00023184,00000040,00023184,00000040,00023184,00000040), ref: 00422549
LocalFree.KERNEL32(?,00000020,?,?,?,00000000,00000040,00000800,00000040,00001C00,00000040,00023184,00000040,00023184,00000040,00023184), ref: 00422552
LocalFree.KERNEL32(00000020,?,00000020,?,?,?,00000000,00000040,00000800,00000040,00001C00,00000040,00023184,00000040,00023184,00000040), ref: 0042255B

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: Local$AllocFree
String ID:
API String ID: 2012307162-0
Opcode ID: d7ae0e2e0411c0e937f072bc19953d3a5651fdf6e59079f0dcd5ce8470d6580d
Instruction ID: 3cf1ed9b833b69ccfd61709242b8401f1e039e7cfdc3fd41cd6853ee2e1c6009
Opcode Fuzzy Hash: d7ae0e2e0411c0e937f072bc19953d3a5651fdf6e59079f0dcd5ce8470d6580d
Instruction Fuzzy Hash: 56910670E00219ABCB00DFADD9859AEFBF4FF48304F50816AE514BB251D735AE118BA8

Uniqueness

Uniqueness Score: -1.00%

Function 00442E40, Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 242windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,00001304,00000000,00000000), ref: 00443025
SendMessageA.USER32(00000000,00001305,-00000001,?), ref: 0044304E
SendMessageA.USER32(00000000,00001308,-00000001,00000000), ref: 00443090
SendMessageA.USER32(00000000,00001307,00000000,?), ref: 0044312B
InvalidateRect.USER32(00000000,00000000,00000000,00000000,00001304,00000000,00000000,?,?,?,?,?,0043F894), ref: 00443149

Strings

general|call stack, xrefs: 00442E95
disasm, xrefs: 00442FC2
disassembling, xrefs: 00442FB3
cpu regs, xrefs: 00442FA4
cpu registers, xrefs: 00442F95

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: MessageSend$InvalidateRect
String ID: cpu registers$cpu regs$disasm$disassembling$general|call stack
API String ID: 2778011698-2178787781
Opcode ID: 24fe02df3d9b16887f68652ae04fb7878e924bbb00105965c31571ea4f71ef52
Instruction ID: 0e7b8a44243642da80558d0f20f84496f86fa15d692546af1af5dafdfc279547
Opcode Fuzzy Hash: 24fe02df3d9b16887f68652ae04fb7878e924bbb00105965c31571ea4f71ef52
Instruction Fuzzy Hash: BFA16834A001189FEB10EF95C985BDEB3B9FF48305F5081AAE904AB3A1D778AE45CB55

Uniqueness

Uniqueness Score: -1.00%

Function 004392E0, Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 190registryprocessCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000000,mailto\shell\open\command,00000000,00020019,B70F0B92,00000000,00439594,B70F0BAA,00000000,D2E4FD19,0043DBBD), ref: 0043934B
RegQueryValueExA.ADVAPI32(?,004395C0,00000000,00000000,B70F0A89,B70F0B8E,80000000,mailto\shell\open\command,00000000,00020019,B70F0B92,00000000,00439594,B70F0BAA,00000000,D2E4FD19), ref: 00439370
ExpandEnvironmentStringsA.KERNEL32(00000000,B70F0A89,00000104), ref: 004393B0
GetVersion.KERNEL32(00000000,?,&body=,?,?subject=,?,mailto:,B70F0A2A,B70F0A2E,00000000,B70F0A89,00000104), ref: 00439494
CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,B70F0A42,B70F0A32), ref: 00439531
RegCloseKey.ADVAPI32(?,?,004395C0,00000000,00000000,B70F0A89,B70F0B8E,80000000,mailto\shell\open\command,00000000,00020019,B70F0B92,00000000,00439594,B70F0BAA,00000000), ref: 00439564

Strings

?subject=, xrefs: 0043942A
&body=, xrefs: 00439432
mailto\shell\open\command, xrefs: 00439341
mailto:, xrefs: 00439422

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: CloseCreateEnvironmentExpandOpenProcessQueryStringsValueVersion
String ID: &body=$?subject=$mailto:$mailto\shell\open\command
API String ID: 4127044786-1872207929
Opcode ID: 48ca5c69302cf1639d33744998944aa7bb0d4ec2de54112ad93b7a06fc660ace
Instruction ID: 27ceea5edf645f902347def6fa979c21ef682324d3c053d622c0fe7978af8f29
Opcode Fuzzy Hash: 48ca5c69302cf1639d33744998944aa7bb0d4ec2de54112ad93b7a06fc660ace
Instruction Fuzzy Hash: DD715171A0411AABDB10EBA5CC81BEEB7B8AF48304F50547AE514B32C1D77CAE45CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00426360, Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 184windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(0000000F), ref: 004263AA

Part of subcall function 00424A08: InflateRect.USER32(?), ref: 00424A26
Part of subcall function 00424A08: CreateSolidBrush.GDI32(?), ref: 00424A2F
Part of subcall function 00424A08: FillRect.USER32(?,?,00000000), ref: 00424A3C
Part of subcall function 00424A08: DeleteObject.GDI32(00000000), ref: 00424A42

GetSysColor.USER32(0000000F), ref: 004263DA
GetSysColor.USER32(0000000F), ref: 00426414
GetSysColor.USER32(00000005), ref: 0042641F
GetSysColor.USER32(00000010), ref: 00426441
GetSysColor.USER32(00000008), ref: 0042644C
GetSysColor.USER32(00000005), ref: 004264CF
DrawFocusRect.USER32(?,?), ref: 0042652E

Strings

Marlett, xrefs: 00426478
Tahoma, xrefs: 004264C2, 00426503

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: Color$Rect$BrushCreateDeleteDrawFillFocusInflateObjectSolid
String ID: Marlett$Tahoma
API String ID: 2656558131-2348366563
Opcode ID: f7203285d071fdff8021d85fcbdbd50c8b9f75f6b8f44a7c475a93b57f401f04
Instruction ID: 52c62cdd3bd4c5e694be8fb631e2ae7449bce98f3f57c8fc9fff8b1421403275
Opcode Fuzzy Hash: f7203285d071fdff8021d85fcbdbd50c8b9f75f6b8f44a7c475a93b57f401f04
Instruction Fuzzy Hash: DE519271F002186BDB10EFA9DC82B9EB7B5EF84714F91413AF904BB2C5D678AD408B58

Uniqueness

Uniqueness Score: -1.00%

Function 0043E1AC, Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 100processthreadCOMMON

Download Yara Rule

APIs

GetCommandLineA.KERNEL32(00000000,00000000,00000000,00000004,00000000,00000000,00000044,004458CE,00000000,0043E2CC,?,?,00000000), ref: 0043E1F2
CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000004,00000000,00000000,00000044,004458CE,00000000,0043E2CC,?,?,00000000), ref: 0043E1FA
GetCurrentProcessId.KERNEL32(00000000,000F001F,00000000,00000000,00000000,000000FF,?,00000004,00000000,00000058,00000000,?,00000000,00000000,00000000,00000000), ref: 0043E268
GetCurrentProcess.KERNEL32(00000000,004458CE,00000004,00000000,00000000,00000002,00000000,000F001F,00000000,00000000,00000000,000000FF,?,00000004,00000000,00000058), ref: 0043E27E
DuplicateHandle.KERNEL32(00000000,00000000,004458CE,00000004,00000000,00000000,00000002,00000000,000F001F,00000000,00000000,00000000,000000FF,?,00000004,00000000), ref: 0043E284
ResumeThread.KERNEL32(00000000,00000000,000F001F,00000000,00000000,00000000,000000FF,?,00000004,00000000,00000058,00000000,?,00000000,00000000,00000000), ref: 0043E29F
GetCurrentProcess.KERNEL32(00000002,00000000,00000000,00000000,00000000,00000000,00000004,00000000,00000000,00000044,004458CE,00000000,0043E2CC,?,?,00000000), ref: 0043E2A6
TerminateProcess.KERNEL32(00000000,00000002,00000000,00000000,00000000,00000000,00000000,00000004,00000000,00000000,00000044,004458CE,00000000,0043E2CC,?,?), ref: 0043E2AC

Part of subcall function 0042B7EC: InitializeSecurityDescriptor.ADVAPI32(?,00000001,00000000,0042E75C,00000000,0042E7BA,?,00000000), ref: 0042B800
Part of subcall function 0042B7EC: SetSecurityDescriptorDacl.ADVAPI32(?,000000FF,00000000,00000000,?,00000001,00000000,0042E75C,00000000,0042E7BA,?,00000000), ref: 0042B80C

Strings

madExceptRestart, xrefs: 0043E22B
D, xrefs: 0043E1D7

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: Process$Current$DescriptorSecurity$CommandCreateDaclDuplicateHandleInitializeLineResumeTerminateThread
String ID: D$madExceptRestart
API String ID: 4250391635-3299302940
Opcode ID: dd2b9a343317c6ce5515a51d7ee2ab50e744acea1cdfa454eb45eb13253a9e6c
Instruction ID: d1f4441e05331e2b886ad13d0a2464ba3adc02247fd1f95a981ff333373a3de7
Opcode Fuzzy Hash: dd2b9a343317c6ce5515a51d7ee2ab50e744acea1cdfa454eb45eb13253a9e6c
Instruction Fuzzy Hash: A7311471A447086AE720EBA1CC42F9E77ACDB49714F60417ABB14FB1C2D678B9048B6D

Uniqueness

Uniqueness Score: -1.00%

Function 00402A58, Relevance: 16.6, APIs: 9, Strings: 2, Instructions: 109COMMON

Download Yara Rule

APIs

CharNextA.USER32(00000000,?,?,00000000,?,00402B68,00000000,00402B95,?,?,?,00000000), ref: 00402A8F
CharNextA.USER32(00000000,00000000,?,?,00000000,?,00402B68,00000000,00402B95,?,?,?,00000000), ref: 00402A99
CharNextA.USER32(00000000,00000000,?,?,00000000,?,00402B68,00000000,00402B95,?,?,?,00000000), ref: 00402AB6
CharNextA.USER32(00000000,?,?,00000000,?,00402B68,00000000,00402B95,?,?,?,00000000), ref: 00402AC0
CharNextA.USER32(00000000,00000000,?,?,00000000,?,00402B68,00000000,00402B95,?,?,?,00000000), ref: 00402AE9
CharNextA.USER32(00000000,00000000,00000000,?,?,00000000,?,00402B68,00000000,00402B95,?,?,?,00000000), ref: 00402AF3
CharNextA.USER32(00000000,00000000,00000000,?,?,00000000,?,00402B68,00000000,00402B95,?,?,?,00000000), ref: 00402B17
CharNextA.USER32(00000000,00000000,?,?,00000000,?,00402B68,00000000,00402B95,?,?,?,00000000), ref: 00402B21

Strings

", xrefs: 00402A74
", xrefs: 00402A79

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: CharNext
String ID: "$"
API String ID: 3213498283-3758156766
Opcode ID: d53e473390e2c70fab2889ee1aed9f49b0a321bc2d396b3fab64bcc96d64de4e
Instruction ID: 44d4dddac633dac86f44d1ef3526d0309bc9755cca435ad3cf7304e3d50030c3
Opcode Fuzzy Hash: d53e473390e2c70fab2889ee1aed9f49b0a321bc2d396b3fab64bcc96d64de4e
Instruction Fuzzy Hash: 7E21E2007043C119EF326D790AC8BAB6B854B5F34472801BB9981BA3DBD8FC6847D72E

Uniqueness

Uniqueness Score: -1.00%

Function 0042CEF0, Relevance: 16.2, APIs: 2, Strings: 7, Instructions: 404COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(cc3260mt.dll,00000000,0042D48A,?,?,?,?,00000022,00000000,00000000), ref: 0042CF44
GetModuleHandleA.KERNEL32(cc3260.dll,cc3260mt.dll,00000000,0042D48A,?,?,?,?,00000022,00000000,00000000), ref: 0042CF54

Strings

____ExceptionHandler, xrefs: 0042CF5B
___terminatePTR, xrefs: 0042CF9B
_memcpy, xrefs: 0042CF8B
cc3260mt.dll, xrefs: 0042CF3F
cc3260.dll, xrefs: 0042CF4F
@_ThrowExceptionLDTC$qpvt1t1t1uiuiuipuct1, xrefs: 0042CF6B
_malloc, xrefs: 0042CF7B

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: HandleModule
String ID: @_ThrowExceptionLDTC$qpvt1t1t1uiuiuipuct1$____ExceptionHandler$___terminatePTR$_malloc$_memcpy$cc3260.dll$cc3260mt.dll
API String ID: 4139908857-2750139601
Opcode ID: 841025939fae66e0b0d48fde87c2e11010368cb51b733c5eadeced756a3c1075
Instruction ID: 26d451a7bb7af4f2933683db3434a42c18bccfe7b1bfb051cbd287cccf829027
Opcode Fuzzy Hash: 841025939fae66e0b0d48fde87c2e11010368cb51b733c5eadeced756a3c1075
Instruction Fuzzy Hash: 70F1C130B002248FDB20EF68E8807AAB7B1EF54314F50826BD855977A5D778AD89CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00442408, Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 278windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004423BC: GetClientRect.USER32(?,?), ref: 004423CD
Part of subcall function 004423BC: SendMessageA.USER32(?,00001328,00000000,?), ref: 004423E4
Part of subcall function 004423BC: InflateRect.USER32(?,000000FD,000000FD), ref: 004423F4

SendMessageA.USER32(?,00000030,?,00000000), ref: 004424D6
SendMessageA.USER32(?,00001003,00000001,?), ref: 004424F3
SendMessageA.USER32(?,0000101B,00000000,?), ref: 0044256F
SendMessageA.USER32(00000000,00001007,00000000,00000001), ref: 004426E9
SendMessageA.USER32(00000000,00001006,00000000,00000001), ref: 004426FF
SendMessageA.USER32(?,0000101E,00000000,000000FF), ref: 00442749
ShowWindow.USER32(?,00000005,?,00001003,00000001,?,?,00000030,?,00000000,00000000,00442784,?,?,?), ref: 0044275C

Strings

MZP, xrefs: 00442477
SysListView32, xrefs: 004424A6

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: MessageSend$Rect$ClientInflateShowWindow
String ID: MZP$SysListView32
API String ID: 2077553228-3950937042
Opcode ID: fcc25b95a70597c7fb29d39daf28c5664fbd121204b8a1aef6a2ca0ddf80cbfd
Instruction ID: 28f00b9ae2aedda39305265f137e3abf13dec9f85fe492d1969b80c28badf233
Opcode Fuzzy Hash: fcc25b95a70597c7fb29d39daf28c5664fbd121204b8a1aef6a2ca0ddf80cbfd
Instruction Fuzzy Hash: EFB15074A002099FDB10DF99C985BAEB7F4FF48304F50816AF954AB392D778AE41CB94

Uniqueness

Uniqueness Score: -1.00%

Function 0042E308, Relevance: 16.0, APIs: 5, Strings: 4, Instructions: 269memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042E204: FindResourceA.KERNEL32(00400000,TMADEXCEPT,0000000A), ref: 0042E20C

LoadResource.KERNEL32(00000000,00000000,00000000,0042E627,?,00000000,00000000,00730020), ref: 0042E360
LockResource.KERNEL32(00000000,00000000,00000000,00000000,0042E627,?,00000000,00000000,00730020), ref: 0042E370
LocalAlloc.KERNEL32(00000040,00000000,7FFFFFFF,00000000,00000000,00000019,00000000,00000000,00000000,00000000,0042E627,?,00000000,00000000,00730020), ref: 0042E3AA
FreeResource.KERNEL32(00000000,7FFFFFFF,00000000,00000000,00000019,00000000,00000000,00000000,00000000,0042E627,?,00000000,00000000,00730020), ref: 0042E5FF

Strings

Internal error: Invalid settings resource (, xrefs: 0042E5AD
|pC, xrefs: 0042E428, 0042E44F, 0042E478, 0042E4A0, 0042E4D0, 0042E4FC, 0042E560, 0042E42B, 0042E452, 0042E47B, 0042E4A3, 0042E4D3, 0042E4FF, 0042E563
TPF0TMadExceptmadExcept, xrefs: 0042E382
madExcept, xrefs: 0042E5A8

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: Resource$AllocFindFreeLoadLocalLock
String ID: Internal error: Invalid settings resource ($TPF0TMadExceptmadExcept$madExcept$|pC
API String ID: 2848537939-1491361403
Opcode ID: aa1c3a75421822748f73ce3bfc93c2705fc3e4b009d258c3fe3bbd384f2df8a6
Instruction ID: 77f4b769f67da45874b03e08e449cb3e726fbed95d2845e422f13c3fbf46f533
Opcode Fuzzy Hash: aa1c3a75421822748f73ce3bfc93c2705fc3e4b009d258c3fe3bbd384f2df8a6
Instruction Fuzzy Hash: 76918271B50215AFEB10DBA6DC82FBE77B8AF49304F544066B501FB2C1D678AD01CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00432CC0, Relevance: 16.0, APIs: 4, Strings: 5, Instructions: 263fileCOMMON

Download Yara Rule

APIs

DeleteFileA.KERNEL32(00000000), ref: 00432F91

Strings

ScrShotImg, xrefs: 00432D36, 00432DD1
@, xrefs: 00432F07
<, xrefs: 00432F00
AttachCheck, xrefs: 00432D65, 00432F99
edit, xrefs: 00432F15

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: DeleteFile
String ID: <$@$AttachCheck$ScrShotImg$edit
API String ID: 4033686569-1111002740
Opcode ID: b0476906d1ee77da421ce0822d0c50d8218d05a1ec8e5cc95e8213ad71bec2be
Instruction ID: 3d31f579249b1d3e708bbb104ee6197774963e0646ac57b6629214dae2919fde
Opcode Fuzzy Hash: b0476906d1ee77da421ce0822d0c50d8218d05a1ec8e5cc95e8213ad71bec2be
Instruction Fuzzy Hash: A0B15E30A00208DFDB04EFA5C585A9EB7F5FF08305F6490BAE805AB395CB79AE45CB55

Uniqueness

Uniqueness Score: -1.00%

Function 00425644, Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 240COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 004256FB
GetSysColor.USER32(00000005), ref: 0042578A
GetSysColor.USER32(0000000F), ref: 004257C0
GetSysColor.USER32(00000008), ref: 00425836
GetSysColor.USER32(0000000F), ref: 00425855
GetSysColor.USER32(00000010), ref: 004257AC

Part of subcall function 00424A08: InflateRect.USER32(?), ref: 00424A26
Part of subcall function 00424A08: CreateSolidBrush.GDI32(?), ref: 00424A2F
Part of subcall function 00424A08: FillRect.USER32(?,?,00000000), ref: 00424A3C
Part of subcall function 00424A08: DeleteObject.GDI32(00000000), ref: 00424A42

GetSysColor.USER32(0000000F), ref: 00425869
GetSysColor.USER32(0000000F), ref: 004258A6

Strings

Arial, xrefs: 0042577D, 00425829, 00425899

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: Color$Rect$BrushCreateDeleteFillInflateObjectSolid
String ID: Arial
API String ID: 9615130-493054409
Opcode ID: 39ea4490c628a0207420be9da0a06f70ad5efa59e71fe529c2c49424d413ddd2
Instruction ID: 78f968c5ff6983dcee90eac364f8b16ec2e9891ee176f877b1a0e0d936aaa9c4
Opcode Fuzzy Hash: 39ea4490c628a0207420be9da0a06f70ad5efa59e71fe529c2c49424d413ddd2
Instruction Fuzzy Hash: BD914071B406199FCB00EF99D882BEEB7B5FF88314F50811AF514F7281C778A9458B69

Uniqueness

Uniqueness Score: -1.00%

Function 00439610, Relevance: 16.0, APIs: 2, Strings: 7, Instructions: 202COMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(00000000,004398AA,B70F0B3E,B70F0B7E,00000000,00000000,00000006,00000000,00000000,B70F0B6A,0043A073,00000101,B70F09C2,7FFFFFFF,00000000,0043A285), ref: 0043965A
FreeLibrary.KERNEL32(00000000,00000000,GetNetworkParams,IpHlpApi.dll,00000000,004398AA,B70F0B3E,B70F0B7E,00000000,00000000,00000006,00000000,00000000,B70F0B6A,0043A073,00000101), ref: 00439874

Strings

Tcpip\Parameters, xrefs: 00439669
DhcpNameServer, xrefs: 00439696
NameServer, xrefs: 004396BD
VxD\MSTCP, xrefs: 00439678
System\CurrentControlSet\Services\, xrefs: 00439688
GetNetworkParams, xrefs: 0043977A
IpHlpApi.dll, xrefs: 00439766

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: FreeLibraryVersion
String ID: DhcpNameServer$GetNetworkParams$IpHlpApi.dll$NameServer$System\CurrentControlSet\Services\$Tcpip\Parameters$VxD\MSTCP
API String ID: 1869374125-2864456209
Opcode ID: be9257167b66c50308e601114d25e930711af48e5457a80d3709c381b832ba0d
Instruction ID: 5eb0eefde4f4232f44c4392ec1ac82873e2befdb72dca7ed4e43aaeb6d98849d
Opcode Fuzzy Hash: be9257167b66c50308e601114d25e930711af48e5457a80d3709c381b832ba0d
Instruction Fuzzy Hash: 1371D830A10108ABDB04FB95D481B9EB3B9EF89304F1091BBE511B7391D7B8AE45CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0068EDF2, Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 125
COMMON

Download Yara Rule

C-Code - Quality: 43%

			E0068EDF2(void* __ecx, intOrPtr _a4, signed char _a8, intOrPtr _a12) {
				signed int _v8;
				char _v20;
				intOrPtr _v32;
				CHAR* _v36;
				CHAR* _v40;
				intOrPtr _v44;
				CHAR* _v48;
				CHAR* _t54;
				intOrPtr _t65;
				signed int _t73;
				signed int _t77;
				intOrPtr _t98;

				_t71 = __ecx;
				_push(0xffffffff);
				_push(0x693568);
				_push(0x69052c);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t98;
				_push(__ecx);
				_push(__ecx);
				if(( *0x695b04 & 1) == 0) {
					 *0x695b04 =  *0x695b04 & 0x000000ff | 0x00000001;
					 *0x695b00 = GetCurrentProcessId();
				}
				if(_a12 != 0) {
					_v44 = _a12;
				} else {
					_t65 =  *0x695b00; // 0x0
					_v44 = _t65;
				}
				_v32 = _v44;
				_v8 = _v8 & 0x00000000;
				_v40 = E0068E6F9(_t71, 0x124);
				_v36 = _v40;
				_t73 = 0x49;
				memset(_v36, 0, _t73 << 2);
				GetTempPathA(0x104, _v36);
				if((_a8 & 0x000000ff) == 0) {
					if(_a4 == 0xffffffff) {
						_push(_v32);
						asm("repne scasb");
						_t77 = 0xbadbac;
						wsprintfA( &(_v36[0xbadbac]), "MBX@%X@*.###");
					} else {
						_push(_a4);
						_push(_v32);
						asm("repne scasb");
						_t77 = 0xbadbac;
						wsprintfA( &(_v36[0xbadbac]), "MBX@%X@%X.###");
					}
				} else {
					 *0x699b10 =  *0x699b10 + 1;
					_push( *0x699b10);
					_push(_a4);
					_push(_v32);
					asm("repne scasb");
					_t77 = 0xbadbac;
					wsprintfA( &(_v36[0xbadbac]), "MBX@%X@%X@%X.###");
				}
				asm("repne scasb");
				CharUpperBuffA(_v36,  !(_t77 | 0xffffffff) - 1);
				_v48 = _v36;
				0x690476( &_v20, 0xffffffff);
				_t54 = _v48;
				 *[fs:0x0] = _v20;
				return _t54;
			}

0x0068edf2
0x0068edf5
0x0068edf7
0x0068edfc
0x0068ee07
0x0068ee08
0x0068ee0f
0x0068ee10
0x0068ee23
0x0068ee2e
0x0068ee39
0x0068ee39
0x0068ee42
0x0068ee51
0x0068ee44
0x0068ee44
0x0068ee49
0x0068ee49
0x0068ee57
0x0068ee5a
0x0068ee69
0x0068ee6f
0x0068ee74
0x0068ee7a
0x0068ee84
0x0068ee90
0x0068eed0
0x0068eefb
0x0068ef0b
0x0068ef0f
0x0068ef16
0x0068eed2
0x0068eed2
0x0068eed5
0x0068eee5
0x0068eee9
0x0068eef0
0x0068eef6
0x0068ee92
0x0068ee98
0x0068ee9d
0x0068eea3
0x0068eea6
0x0068eeb6
0x0068eeba
0x0068eec1
0x0068eec7
0x0068ef27
0x0068ef30
0x0068ef3b
0x0068ef42
0x0068ef49
0x0068ef52
0x0068ef5d

APIs

GetCurrentProcessId.KERNEL32(?,?,00000084,00000000,?,?,?,00000084), ref: 0068EE33
GetTempPathA.KERNEL32(00000104,?,?,?,00000084,00000000), ref: 0068EE84
wsprintfA.USER32 ref: 0068EEC1
wsprintfA.USER32 ref: 0068EEF0
wsprintfA.USER32 ref: 0068EF16
CharUpperBuffA.USER32(?,?,?,?,?,00000000), ref: 0068EF30

Strings

MBX@%X@%X.###, xrefs: 0068EED8
MBX@%X@%X@%X.###, xrefs: 0068EEA9
MBX@%X@*.###, xrefs: 0068EEFE

Memory Dump Source

Source File: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: wsprintf$BuffCharCurrentPathProcessTempUpper
String ID: MBX@%X@%X.###$MBX@%X@%X@%X.###$MBX@%X@*.###
API String ID: 700814352-833101087
Opcode ID: a302ad6aa9d92adba021db1af3edb04f0bf8643353551456749732299eda20a2
Instruction ID: 2a7af3097a4a5dc357acd0152c9f9cfc22730a3d1460ae7ba7de54ac6b318ce7
Opcode Fuzzy Hash: a302ad6aa9d92adba021db1af3edb04f0bf8643353551456749732299eda20a2
Instruction Fuzzy Hash: 9241A2719042189FDF15DFA8DC0AAED7BFAFB08320F14561AF522E66E1D7799900CB24

Uniqueness

Uniqueness Score: -1.00%

Function 0068D99E, Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 113
processthreadinjectionCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E0068D99E(void* __ecx) {
				signed int _v8;
				intOrPtr _v20;
				intOrPtr _v28;
				long _v32;
				struct _STARTUPINFOA _v108;
				void* _v112;
				void* _v116;
				long _v120;
				void _v124;
				signed int _v128;
				struct _PROCESS_INFORMATION _v144;
				signed int _v148;
				long _t60;
				signed int _t68;
				signed int _t71;
				intOrPtr _t88;

				_push(0xffffffff);
				_push(0x6934f0);
				_push(0x69052c);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t88;
				_push(__ecx);
				_push(__ecx);
				_v28 = _t88 - 0x7c;
				_v128 = _v128 & 0x00000000;
				_v124 = _v124 & 0x00000000;
				asm("stosd");
				_v108.cb = _v108.cb & 0x00000000;
				_t68 = 0x10;
				memset( &(_v108.lpReserved), 0, _t68 << 2);
				_v116 = GetCurrentProcess();
				_v112 = 0x6885e0;
				_v32 = _v32 & 0x00000000;
				_v8 = _v8 & 0x00000000;
				_v148 = E0068E6F9(0, 0x105);
				_v128 = _v148;
				_t71 = 0x41;
				memset(_v128, 0, _t71 << 2);
				asm("stosb");
				if(GetModuleFileNameA(GetModuleHandleA(0), _v128, 0x104) == 0) {
					E0068E6E1(_t50, 0xef000015);
				}
				_v108.cb = 0x44;
				if(CreateProcessA(_v128, 0, 0, 0, 1, 0xc, 0, 0,  &_v108,  &_v144) == 0) {
					E0068E6E1(_t53, 0xef000015);
				}
				if(DuplicateHandle(_v116, _v116, _v144.hProcess,  &_v124, 0, 1, 2) == 0) {
					E0068E6E1(_t55, 0xef000015);
				}
				_v120 = GetCurrentProcessId();
				if(WriteProcessMemory(_v144, _v112,  &_v124, 8,  &_v32) == 0) {
					E0068E6E1(_t59, 0xef000015);
				}
				_t60 = ResumeThread(_v144.hThread);
				if(_t60 == 0) {
					_t60 = E0068E6E1(_t60, 0xef000015);
				}
				_v8 = _v8 | 0xffffffff;
				 *[fs:0x0] = _v20;
				return _t60;
			}

0x0068d9a1
0x0068d9a3
0x0068d9a8
0x0068d9b3
0x0068d9b4
0x0068d9bb
0x0068d9bc
0x0068d9c3
0x0068d9c6
0x0068d9ca
0x0068d9d3
0x0068d9d4
0x0068d9da
0x0068d9e0
0x0068d9e8
0x0068d9eb
0x0068d9f2
0x0068d9f6
0x0068da05
0x0068da11
0x0068da16
0x0068da1c
0x0068da1e
0x0068da38
0x0068da3f
0x0068da3f
0x0068da44
0x0068da6f
0x0068da76
0x0068da76
0x0068da99
0x0068daa0
0x0068daa0
0x0068daab
0x0068dac9
0x0068dad0
0x0068dad0
0x0068dadb
0x0068dae3
0x0068daea
0x0068daea
0x0068daef
0x0068db2e
0x0068db39

APIs

GetCurrentProcess.KERNEL32 ref: 0068D9E2
GetModuleHandleA.KERNEL32(00000000,00000000,00000104), ref: 0068DA29
GetModuleFileNameA.KERNEL32(00000000), ref: 0068DA30
CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000001,0000000C,00000000,00000000,00000044,?), ref: 0068DA67
DuplicateHandle.KERNEL32(?,?,00000002,00000000,00000000,00000001,00000002), ref: 0068DA91
GetCurrentProcessId.KERNEL32 ref: 0068DAA5
WriteProcessMemory.KERNEL32(00000000,006885E0,00000000,00000008,00000000), ref: 0068DAC1
ResumeThread.KERNEL32(?), ref: 0068DADB

Part of subcall function 0068E6E1: RaiseException.KERNEL32(00000000,00000000,00000000,00000000,EF00000D,?,0068E777,024B0488,?,0068E703,024B0488,024B0488,?,00688580,00000068), ref: 0068E6F1

Strings

D, xrefs: 0068DA44

Memory Dump Source

Source File: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: Process$CurrentHandleModule$CreateDuplicateExceptionFileMemoryNameRaiseResumeThreadWrite
String ID: D
API String ID: 2444673992-2746444292
Opcode ID: 959dc8205ff685fc78e8c4f0734e4ee4b3a6ca833d5bf2607011e12d488419f1
Instruction ID: fce482092044319b73853983528837d6d512a950bf062064687eaf36d9891de8
Opcode Fuzzy Hash: 959dc8205ff685fc78e8c4f0734e4ee4b3a6ca833d5bf2607011e12d488419f1
Instruction Fuzzy Hash: AC415E71A50608AFEF20AFA0DC46BDEBBBABB44711F20412DF215EB2D1DBB159509F14

Uniqueness

Uniqueness Score: -1.00%

Function 0068F242, Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 79COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,0000001C,0000001C,?,?,?,-- backtrace --,-- backtrace --,?,Function_0029052C,00693578,000000FF,?,0068F522,?), ref: 0068F298
wsprintfA.USER32 ref: 0068F2AC

Strings

0x%08x:[%s]:(%03x:%08x), xrefs: 0068F30C
unknown, xrefs: 0068F2F9
hXi, xrefs: 0068F306
!broken!, xrefs: 0068F273
-- backtrace --, xrefs: 0068F25F, 0068F260
0x%08x:[unknown]:unknown, xrefs: 0068F2A2

Memory Dump Source

Source File: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: QueryVirtualwsprintf
String ID: !broken!$-- backtrace --$0x%08x:[%s]:(%03x:%08x)$0x%08x:[unknown]:unknown$hXi$unknown
API String ID: 682088319-309125684
Opcode ID: 13e760fe95d4e5862061edabd6aafcfe3ee068ff5e3b1ad9e479041794b6a54a
Instruction ID: 8ee4da66bfad700030b3499b86ceb51b0415ea56e2f146178e3891a17ec61271
Opcode Fuzzy Hash: 13e760fe95d4e5862061edabd6aafcfe3ee068ff5e3b1ad9e479041794b6a54a
Instruction Fuzzy Hash: DA215171A00618EBDF11DFD8DD05BEEBBBEFB08724F100229F511A2690D7799A018BA4

Uniqueness

Uniqueness Score: -1.00%

Function 0068EAC6, Relevance: 15.1, APIs: 10, Instructions: 140
filewindowCOMMON

Download Yara Rule

C-Code - Quality: 66%

			E0068EAC6(signed int __ecx, void* _a4) {
				signed int _v8;
				char _v20;
				signed int _v32;
				long _v36;
				void* _v40;
				char _v41;
				signed int _v48;
				char* _t52;
				struct HINSTANCE__* _t61;
				void* _t73;
				signed int _t80;
				long _t83;
				signed int _t92;
				intOrPtr _t106;

				_t80 = __ecx;
				_push(0xffffffff);
				_push(0x693538);
				_push(0x69052c);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t106;
				_push(__ecx);
				_push(__ecx);
				EnterCriticalSection( *0x006885E4 + 0x48);
				_v32 = _v32 & 0x00000000;
				_v8 = _v8 & 0x00000000;
				_t7 =  *0x006885E4 + 0x60; // 0x0
				_v40 =  *_t7;
				if(_v40 != 0) {
					L8:
					asm("repne scasb");
					_t83 =  !(_t80 | 0xffffffff) - 1;
					WriteFile(_v40, _a4, _t83,  &_v36, 0);
					asm("repne scasb");
					if(_v36 !=  !(_t83 | 0xffffffff) - 1) {
						goto L11;
					}
				} else {
					_v48 = E0068E6F9(_t80, 0x400);
					_v32 = _v48;
					_t61 = GetModuleHandleA(0);
					_t92 =  *0x006885E4;
					 *(_t92 + 0x64) = _t61;
					if( *( *0x006885E4 + 0x64) != 0) {
						_t19 =  *0x006885E4 + 0x64; // 0x0
						if(GetModuleFileNameA( *_t19, _v32, 0x400) != 0) {
							asm("repne scasb");
							wsprintfA(_v32 +  !(_t92 | 0xffffffff) - 1, "-up.txt");
							_t73 = CreateFileA(_v32, 0x40000000, 1, 0, 2, 0x80, 0);
							_t80 =  *0x006885E4;
							 *(_t80 + 0x60) = _t73;
							_t26 =  *0x006885E4 + 0x60; // 0x0
							_v40 =  *_t26;
							if(_v40 != 0) {
								SetFilePointer(_v40, 0, 0, 2);
								goto L8;
							} else {
								goto L11;
							}
						} else {
							goto L11;
						}
					} else {
						L11:
						_v41 = _v41 & 0x00000000;
						MessageBoxA(0, "can\'t open logfile",  &_v41, 0);
						TerminateProcess(GetCurrentProcess(), 0);
					}
				}
				_t52 =  &_v20;
				0x690476(_t52, 0xffffffff);
				 *[fs:0x0] = _v20;
				return _t52;
			}

0x0068eac6
0x0068eac9
0x0068eacb
0x0068ead0
0x0068eadb
0x0068eadc
0x0068eae3
0x0068eae4
0x0068eaf7
0x0068eafd
0x0068eb01
0x0068eb0d
0x0068eb10
0x0068eb17
0x0068ebe8
0x0068ebf6
0x0068ebfa
0x0068ec02
0x0068ec10
0x0068ec18
0x00000000
0x0068ec1a
0x0068eb1d
0x0068eb28
0x0068eb2e
0x0068eb33
0x0068eb3e
0x0068eb41
0x0068eb50
0x0068eb67
0x0068eb72
0x0068eb8a
0x0068eb95
0x0068ebb2
0x0068ebbd
0x0068ebc0
0x0068ebcb
0x0068ebce
0x0068ebd5
0x0068ebe2
0x00000000
0x0068ebd7
0x00000000
0x0068ebd7
0x0068eb74
0x00000000
0x0068eb74
0x0068eb52
0x0068ec2b
0x0068ec2b
0x0068ec40
0x0068ec4f
0x0068ec4f
0x0068eb50
0x0068ec1e
0x0068ec22
0x0068ec7c
0x0068ec87

APIs

EnterCriticalSection.KERNEL32(024B0440), ref: 0068EAF7
GetModuleHandleA.KERNEL32(00000000), ref: 0068EB33
GetModuleFileNameA.KERNEL32(00000000,00000000,00000400), ref: 0068EB6A
WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 0068EC02
MessageBoxA.USER32 ref: 0068EC40
GetCurrentProcess.KERNEL32(00000000,?,?,00000000), ref: 0068EC48
TerminateProcess.KERNEL32(00000000,?,?,00000000), ref: 0068EC4F

Memory Dump Source

Source File: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: FileModuleProcess$CriticalCurrentEnterHandleMessageNameSectionTerminateWrite
String ID:
API String ID: 3821509113-0
Opcode ID: 35ab076a414b0ca8afa6e0b5ed15d616604f640d31d91608fb8d64fad9d8de03
Instruction ID: 6e4e3910896c533ee7f5ae38fa5a186792d19cdb740b1f855b300dc151cf4926
Opcode Fuzzy Hash: 35ab076a414b0ca8afa6e0b5ed15d616604f640d31d91608fb8d64fad9d8de03
Instruction Fuzzy Hash: B0517E75A40204EFDB04AFA8DD0AFA97BBAFB08711F10421AF511EB6D1DB75DD018B54

Uniqueness

Uniqueness Score: -1.00%

Function 00424BEC, Relevance: 15.1, APIs: 10, Instructions: 125COMMON

Download Yara Rule

APIs

Part of subcall function 004248D4: CreateFontA.GDI32(?,00000000,00000000,00000000,00000190,00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,00000000), ref: 0042492D
Part of subcall function 004248D4: CreateFontA.GDI32(?,00000000,00000000,00000000,00000190,00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,MS Sans Serif), ref: 00424957

SelectObject.GDI32(?,?), ref: 00424C34
GetTextExtentPoint32A.GDI32(?,00000000,00000000,?), ref: 00424C57
SetBkMode.GDI32(?,00000001), ref: 00424C80
SetTextColor.GDI32(?,?), ref: 00424C8A
SetTextColor.GDI32(?,00FFFFFF), ref: 00424C9B
TextOutA.GDI32(?,?,?,00000000,00000000), ref: 00424CCD
SetTextColor.GDI32(?,?), ref: 00424CE3
TextOutA.GDI32(?,?,?,00000000,00000000), ref: 00424D03
SelectObject.GDI32(?,?), ref: 00424D0D
DeleteObject.GDI32(?), ref: 00424D16

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: Text$ColorObject$CreateFontSelect$DeleteExtentModePoint32
String ID:
API String ID: 4223740531-0
Opcode ID: 57ea5cf95d56f421e59569050752a764180e8077e836aa25c085b4f3e7a5e12c
Instruction ID: d62e06a2f62680bdbf551d72b5029f4fa8b3ef4ee66065205f2d96a2b1f22a59
Opcode Fuzzy Hash: 57ea5cf95d56f421e59569050752a764180e8077e836aa25c085b4f3e7a5e12c
Instruction Fuzzy Hash: C74133B1A04118AFDB41EF59CC81EAE77FCEB89718F51416AF914F3291C638AD018B69

Uniqueness

Uniqueness Score: -1.00%

Function 004321FC, Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 66threadsynchronizationCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00432204
GetCurrentThreadId.KERNEL32 ref: 00432219
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 0043223D
EnterCriticalSection.KERNEL32(00000000), ref: 0043225A
GetCurrentThreadId.KERNEL32 ref: 00432280
LeaveCriticalSection.KERNEL32(00000000,004322BA,00000000), ref: 004322AD
SetLastError.KERNEL32(?), ref: 004322D1

Strings

4``, xrefs: 0043221E

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: CriticalCurrentErrorLastSectionThread$EnterLeaveObjectSingleWait
String ID: 4``
API String ID: 4100131725-4100759201
Opcode ID: bbde8bfd91bc5b059367b225c8defa7ff93afc13703e35a69b96e90e7845ddb0
Instruction ID: a80b1359d35d11d84351d2b69f0832197d536343e16bfc65eee9deaa76c0731e
Opcode Fuzzy Hash: bbde8bfd91bc5b059367b225c8defa7ff93afc13703e35a69b96e90e7845ddb0
Instruction Fuzzy Hash: 1C11263090C7009BDB12EBA8ED85B6F73A9E708314F2056B7E400936D0C7BDB845D7AA

Uniqueness

Uniqueness Score: -1.00%

Function 004235D4, Relevance: 13.7, APIs: 9, Instructions: 175COMMON

Download Yara Rule

APIs

EnumWindows.USER32(Function_000234B8,?), ref: 00423635
EnumWindows.USER32(Function_0002354C,?), ref: 00423693
GetStockObject.GDI32(00000000), ref: 004236E2
FillRect.USER32(?,?,00000000), ref: 004236F0
SelectClipRgn.GDI32(?,00000000), ref: 004236FD
SelectClipRgn.GDI32(?,00000000), ref: 00423734
DeleteObject.GDI32(00000000), ref: 0042373D
SelectClipRgn.GDI32(?,00000000), ref: 004237A4
DeleteObject.GDI32(00000000), ref: 004237AD

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: ClipObjectSelect$DeleteEnumWindows$FillRectStock
String ID:
API String ID: 3926179444-0
Opcode ID: bf4ce19466c1e88cc8d92898153075d3bc9b6e9a4853832a3de92d453d1d6f47
Instruction ID: 346e78b6c383af875de1215c97b1d755aabddb0323853fd6255954ec7496e8e9
Opcode Fuzzy Hash: bf4ce19466c1e88cc8d92898153075d3bc9b6e9a4853832a3de92d453d1d6f47
Instruction Fuzzy Hash: 07610AB1E00219AFCF10DFE9D885BDEBBF8AF48314F50412AE514EB280D738AA45CB55

Uniqueness

Uniqueness Score: -1.00%

Function 0040ADE4, Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 148librarywindowCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,00000000,0040AFAA,?,00607910,?,00000057,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040AE39
LoadLibraryExA.KERNEL32(00000000,00000000,00000002,00000000,0040AFAA,?,00607910,?,00000057,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040AE7C
FormatMessageA.KERNEL32(00001300,?,00000057,00000400,?,00000000,00000000,00000000,0040AF88,?,00000000,0040AFAA,?,00607910,?,00000057), ref: 0040AEB8
LocalFree.KERNEL32(?,0040AF6B,00001300,?,00000057,00000400,?,00000000,00000000,00000000,0040AF88,?,00000000,0040AFAA,?,00607910), ref: 0040AF28

Strings

;!199{199, xrefs: 0040AE26
;0!8&2{199, xrefs: 0040AE69

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: FormatFreeHandleLibraryLoadLocalMessageModule
String ID: ;!199{199$;0!8&2{199
API String ID: 677395756-3712181515
Opcode ID: 7b16afd55c94d974c0e72bd0b139121ed7236d6ac437d6010a78933e8daf9a03
Instruction ID: c93002b9dd67e8ae5e96ea3b85a5e020cf9ed40f065f4085d2d636d5e72b00c6
Opcode Fuzzy Hash: 7b16afd55c94d974c0e72bd0b139121ed7236d6ac437d6010a78933e8daf9a03
Instruction Fuzzy Hash: B441A8B0A44305AFE711EBA5C841BAF77A9EB84704F50447BB500B32C1C67C9D55C6AE

Uniqueness

Uniqueness Score: -1.00%

Function 0045A180, Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 139COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 0045A219
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 0045A235
SafeArrayCreate.OLEAUT32(0000000C,?,?), ref: 0045A26E
SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 0045A2EB
SafeArrayPtrOfIndex.OLEAUT32(00000000,?,?), ref: 0045A304
VariantCopy.OLEAUT32(?), ref: 0045A339

Strings

, xrefs: 0045A19A

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: ArraySafe$BoundIndex$CopyCreateVariant
String ID:
API String ID: 351091851-3916222277
Opcode ID: c06c10035eb90c48e9bd03bb3843b997470d1d8fb0e16bdaec6d26336b31533e
Instruction ID: faecfb2c56e722671987fec7a475076183dd56244fbf1eb25ccc04ca58b14947
Opcode Fuzzy Hash: c06c10035eb90c48e9bd03bb3843b997470d1d8fb0e16bdaec6d26336b31533e
Instruction Fuzzy Hash: AA51FF7590061D9BCB21DB59CC81BDAB3BCAF48305F4042DAF949E7302D6389F898F65

Uniqueness

Uniqueness Score: -1.00%

Function 00432098, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 97threadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 004320C5

Part of subcall function 00431E8C: WaitForSingleObject.KERNEL32(?,00000032,00000000,00431F73), ref: 00431EC6
Part of subcall function 00431E8C: LocalSize.KERNEL32(?), ref: 00431EF7
Part of subcall function 00431E8C: ReleaseMutex.KERNEL32(?,00431F2A,?,00000032,00000000,00431F73), ref: 00431F1D

EnterCriticalSection.KERNEL32(00000000), ref: 0043211A
LeaveCriticalSection.KERNEL32(00000000,00432187), ref: 0043217A
SetEvent.KERNEL32(00000000), ref: 004321A4
SetEvent.KERNEL32(00000000), ref: 004321B8
PostMessageA.USER32(000A007E,00000400,00000001,00000000), ref: 004321CD

Part of subcall function 0042AC1C: GetModuleHandleA.KERNEL32(kernel32.dll,CreateToolhelp32Snapshot), ref: 0042AC68
Part of subcall function 0042AC1C: GetModuleHandleA.KERNEL32(kernel32.dll,Thread32First,00000000,kernel32.dll,CreateToolhelp32Snapshot), ref: 0042AC7F
Part of subcall function 0042AC1C: GetModuleHandleA.KERNEL32(kernel32.dll,Thread32Next,00000000,kernel32.dll,Thread32First,00000000,kernel32.dll,CreateToolhelp32Snapshot), ref: 0042AC97
Part of subcall function 0042AC1C: GetCurrentProcessId.KERNEL32 ref: 0042ACDB

Strings

4``, xrefs: 004320E2

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: HandleModule$CriticalCurrentEventSection$EnterLeaveLocalMessageMutexObjectPostProcessReleaseSingleSizeThreadWait
String ID: 4``
API String ID: 1701043000-4100759201
Opcode ID: 4ce6991005392160eb4812244dfe4dd5837dfdd47396716e7d116e1e183ab263
Instruction ID: 40c84eb75ffa7047a11134776f12060c6f74a966e69caacf2c6a1f6bcc65f972
Opcode Fuzzy Hash: 4ce6991005392160eb4812244dfe4dd5837dfdd47396716e7d116e1e183ab263
Instruction Fuzzy Hash: 66315A75A04215AFDF10DF94DA85EAE73B6FB48304F24446AE900E7391C778B945CB68

Uniqueness

Uniqueness Score: -1.00%

Function 00401C20, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(006065C8,00000000,#), ref: 00401C4D
LocalFree.KERNEL32(00961AA8,00000000,#), ref: 00401C5F
VirtualFree.KERNEL32(02AC0000,00000000,00008000,00961AA8,00000000,#), ref: 00401C7E
LocalFree.KERNEL32(00962AA8,02AC0000,00000000,00008000,00961AA8,00000000,#), ref: 00401CBD
LeaveCriticalSection.KERNEL32(006065C8,00401CFD,00961AA8,00000000,#), ref: 00401CE6
RtlDeleteCriticalSection.NTDLL(006065C8), ref: 00401CF0

Strings

#, xrefs: 00401C34

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: CriticalFreeSection$Local$DeleteEnterLeaveVirtual
String ID: #
API String ID: 3782394904-3629985089
Opcode ID: 123019b0fd89c8990a7f93f08345d88cce51a72815b9c0820118061b4a7a3c36
Instruction ID: 2afbbf882d9a78507c9e684b6033ecaddad39da9d73355e8fc87c883b82c9fec
Opcode Fuzzy Hash: 123019b0fd89c8990a7f93f08345d88cce51a72815b9c0820118061b4a7a3c36
Instruction Fuzzy Hash: AF11C4706C86405EE71AAF69DC81B273BD6F786754F80543AF402A72F5E6BDCC208729

Uniqueness

Uniqueness Score: -1.00%

Function 0040B538, Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 61COMMON

Download Yara Rule

APIs

GetVersion.KERNEL32 ref: 0040B54D
GetModuleHandleA.KERNEL32(kernel32.dll), ref: 0040B56B
GetModuleHandleA.KERNEL32(kernel32.dll,QT_Thunk), ref: 0040B5DC

Strings

user.exe, xrefs: 0040B5AE
QT_Thunk, xrefs: 0040B5D2
GetFreeSystemResources, xrefs: 0040B5C3
kernel32.dll, xrefs: 0040B566, 0040B5D7

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: HandleModule$Version
String ID: GetFreeSystemResources$QT_Thunk$kernel32.dll$user.exe
API String ID: 1014407405-3315640428
Opcode ID: b82bc198f79e1da13e2bbdadcf1860082333f4a32a785e8250ba499fa53de4e1
Instruction ID: cd1849b891a71296cd782f789ce174efd7122e2881f6a40f829025b46f663ba2
Opcode Fuzzy Hash: b82bc198f79e1da13e2bbdadcf1860082333f4a32a785e8250ba499fa53de4e1
Instruction Fuzzy Hash: DF11E474A04305AAD710AFA59C893AE77B4DF14304F00447BA808F23E2DB7E9984CB9F

Uniqueness

Uniqueness Score: -1.00%

Function 004237BC, Relevance: 12.1, APIs: 8, Instructions: 90memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000018,00000000,00000000,00000000,00000000,00000000,00002010,00000000,004238A7), ref: 00423810
GetObjectA.GDI32(00000000,00000018,00000000), ref: 0042381F
CreateCompatibleDC.GDI32(00000000), ref: 0042383B
SelectObject.GDI32(00000000,00000000), ref: 0042384E

Part of subcall function 004235D4: EnumWindows.USER32(Function_000234B8,?), ref: 00423635
Part of subcall function 004235D4: EnumWindows.USER32(Function_0002354C,?), ref: 00423693
Part of subcall function 004235D4: GetStockObject.GDI32(00000000), ref: 004236E2
Part of subcall function 004235D4: FillRect.USER32(?,?,00000000), ref: 004236F0

SelectObject.GDI32(00000000,?), ref: 00423877
DeleteDC.GDI32(00000000), ref: 00423880
LocalFree.KERNEL32(00000000,00000040,00000018,00000000,00000000,00000000,00000000,00000000,00002010,00000000,004238A7), ref: 00423886
DeleteObject.GDI32(00000000), ref: 0042388C

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: Object$DeleteEnumLocalSelectWindows$AllocCompatibleCreateFillFreeRectStock
String ID:
API String ID: 1630359847-0
Opcode ID: 5eaf7bac55da678812bd4c97b7a6818ad8f8be7322eb349e37943c038778dd78
Instruction ID: 26bad349f4b648af1bcd85d347c26dfbc116a5f53e974dd6276eb84962a87d72
Opcode Fuzzy Hash: 5eaf7bac55da678812bd4c97b7a6818ad8f8be7322eb349e37943c038778dd78
Instruction Fuzzy Hash: 6F217171B44618BBD710FBAA8C42F5EB6F89F48704F50447AB604F72D2DA78AA009769

Uniqueness

Uniqueness Score: -1.00%

Function 0043B758, Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 128COMMON

Download Yara Rule

APIs

select.WS2_32(00000000,B70EF65A,00000000,00000000,B70F0B62), ref: 0043B7C1
ShellExecuteA.SHELL32(00000000,00000000,00000000,00000000,00000000,00000001), ref: 0043B8BC

Strings

100, xrefs: 0043B80E
302, xrefs: 0043B849
Location: , xrefs: 0043B862
200, xrefs: 0043B8E1

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: ExecuteShellselect
String ID: 100$200$302$Location:
API String ID: 186192706-2597041285
Opcode ID: aec0b46c5e2a123ac075ff8d0cdc1ca7ad2718073454c1676293b490fd0a2677
Instruction ID: ca23a4677f096ad1a3128accc48d80e08038cc190f585900452aaff1ee19fb01
Opcode Fuzzy Hash: aec0b46c5e2a123ac075ff8d0cdc1ca7ad2718073454c1676293b490fd0a2677
Instruction Fuzzy Hash: 18418171A00618ABEB10EA55CC42BDE73A8EF88304F1091B6F605EB2D1D7789F419B98

Uniqueness

Uniqueness Score: -1.00%

Function 0040C6E4, Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(?,TMADEXCEPT,0000000A), ref: 0040C6FF
LoadResource.KERNEL32(?,00000000,00607910,?,00000000,?,00419994,?,00000000,00419B7D,?,00000000,00000004,00000000,00000000), ref: 0040C70C
SizeofResource.KERNEL32(?,00000000,?,00000000,00607910,?,00000000,?,00419994,?,00000000,00419B7D,?,00000000,00000004,00000000), ref: 0040C719
LockResource.KERNEL32(00000000,00000000,?,00000000,?,00000000,00607910,?,00000000,?,00419994,?,00000000,00419B7D,?,00000000), ref: 0040C720
FreeResource.KERNEL32(00000000,00000000,?,00000000,?,00000000,00607910,?,00000000,?,00419994,?,00000000,00419B7D,?,00000000), ref: 0040C738

Strings

TMADEXCEPT, xrefs: 0040C6FD

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: Resource$FindFreeLoadLockSizeof
String ID: TMADEXCEPT
API String ID: 4159136517-1465931417
Opcode ID: 836bb639640dc5d5459f856adf0616523f1266062b224778328f575b62ae4d4c
Instruction ID: 79fc9dbec54230cf29d6cfcc12004599d428d6a35832fe3730877f8d0e731325
Opcode Fuzzy Hash: 836bb639640dc5d5459f856adf0616523f1266062b224778328f575b62ae4d4c
Instruction Fuzzy Hash: A3F05462A095553ED322726A5CC1CBF5A9C8E966A8305417FF504F7282CB7C9D0152BA

Uniqueness

Uniqueness Score: -1.00%

Function 0040C6E8, Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(?,TMADEXCEPT,0000000A), ref: 0040C6FF
LoadResource.KERNEL32(?,00000000,00607910,?,00000000,?,00419994,?,00000000,00419B7D,?,00000000,00000004,00000000,00000000), ref: 0040C70C
SizeofResource.KERNEL32(?,00000000,?,00000000,00607910,?,00000000,?,00419994,?,00000000,00419B7D,?,00000000,00000004,00000000), ref: 0040C719
LockResource.KERNEL32(00000000,00000000,?,00000000,?,00000000,00607910,?,00000000,?,00419994,?,00000000,00419B7D,?,00000000), ref: 0040C720
FreeResource.KERNEL32(00000000,00000000,?,00000000,?,00000000,00607910,?,00000000,?,00419994,?,00000000,00419B7D,?,00000000), ref: 0040C738

Strings

TMADEXCEPT, xrefs: 0040C6FD

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: Resource$FindFreeLoadLockSizeof
String ID: TMADEXCEPT
API String ID: 4159136517-1465931417
Opcode ID: 2e5e1ec3cdb0c02730e8ca8040a725a9e6ed48187e38d7a931c64d678382c5dc
Instruction ID: ec2dfac468df73574147900598a82356e5db07548a296d9e2fc91c95b5b63c88
Opcode Fuzzy Hash: 2e5e1ec3cdb0c02730e8ca8040a725a9e6ed48187e38d7a931c64d678382c5dc
Instruction Fuzzy Hash: C3F01262A055193AD221726B5CC1CBF659C8E966A9305413FF904B7282DF7CED0152FE

Uniqueness

Uniqueness Score: -1.00%

Function 00689CE6, Relevance: 10.2, APIs: 8, Instructions: 158
COMMON

Download Yara Rule

C-Code - Quality: 50%

			E00689CE6(void* __ecx, intOrPtr _a4, signed int _a8, intOrPtr _a12, signed int* _a16) {
				signed int _v8;
				char _v20;
				char _v32;
				intOrPtr* _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int* _t68;
				signed int _t70;
				intOrPtr _t128;

				_push(0xffffffff);
				_push(0x693428);
				_push(0x69052c);
				_t68 =  *[fs:0x0];
				_push(_t68);
				 *[fs:0x0] = _t128;
				EnterCriticalSection(0x695ac8);
				_v8 = _v8 & 0x00000000;
				if( *0x695ac0 != 0) {
					if(_a16 == 0) {
						_t68 =  &_v32;
						_a16 = _t68;
					}
					0x690235(_a4);
					_v36 = _t68;
					if(_v36 == 0) {
						_v52 = _v52 & 0x00000000;
						0x690476( &_v20, 0xffffffff);
						_t70 = _v52;
						goto L29;
					} else {
						_v40 =  *(_v36 + 4);
						if(_a12 != 0) {
							if(_a12 != 2) {
								if(_a12 != 1) {
									 *_a16 =  *_a16 | 0xffffffff;
									SetLastError(0x57);
								} else {
									if(_a8 + _v40 <=  *( *_v36 + 8)) {
										if(_v40 + _a8 >= 0) {
											 *(_v36 + 4) = _a8 + _v40;
											 *_a16 =  *(_v36 + 4);
										} else {
											 *_a16 =  *_a16 | 0xffffffff;
											SetLastError(0x83);
										}
									} else {
										 *_a16 =  *_a16 | 0xffffffff;
										SetLastError(0x57);
									}
								}
							} else {
								if(_a8 <= 0) {
									if(_a8 >=  ~( *( *_v36 + 8))) {
										 *(_v36 + 4) = _a8 +  *( *_v36 + 8);
										 *_a16 =  *(_v36 + 4);
									} else {
										 *_a16 =  *_a16 | 0xffffffff;
										SetLastError(0x83);
									}
								} else {
									 *_a16 =  *_a16 | 0xffffffff;
									SetLastError(0x57);
								}
							}
							L27:
							_v48 = 1;
							0x690476( &_v20, 0xffffffff);
							_t70 = _v48;
							goto L29;
						}
						if(_a8 <=  *( *_v36 + 8)) {
							if(_a8 >= 0) {
								 *(_v36 + 4) = _a8;
								 *_a16 = _a8;
							} else {
								 *_a16 =  *_a16 | 0xffffffff;
								SetLastError(0x83);
							}
						} else {
							 *_a16 =  *_a16 | 0xffffffff;
							SetLastError(0x57);
						}
						goto L27;
					}
				} else {
					_v44 = _v44 & 0x00000000;
					0x690476( &_v20, 0xffffffff);
					_t70 = _v44;
					L29:
					 *[fs:0x0] = _v20;
					return _t70;
				}
			}

0x00689ce9
0x00689ceb
0x00689cf0
0x00689cf5
0x00689cfb
0x00689cfc
0x00689d10
0x00689d16
0x00689d21
0x00689d40
0x00689d42
0x00689d45
0x00689d45
0x00689d51
0x00689d56
0x00689d5d
0x00689e9f
0x00689ea7
0x00689eae
0x00000000
0x00689d63
0x00689d69
0x00689d70
0x00689dc2
0x00689e1e
0x00689e79
0x00689e7e
0x00689e20
0x00689e2e
0x00689e48
0x00689e66
0x00689e72
0x00689e4a
0x00689e4d
0x00689e55
0x00689e55
0x00689e30
0x00689e33
0x00689e38
0x00689e38
0x00689e74
0x00689dc4
0x00689dc8
0x00689de7
0x00689e0a
0x00689e16
0x00689de9
0x00689dec
0x00689df4
0x00689df4
0x00689dca
0x00689dcd
0x00689dd2
0x00689dd2
0x00689e18
0x00689e84
0x00689e86
0x00689e91
0x00689e98
0x00000000
0x00689e98
0x00689d7d
0x00689d93
0x00689dae
0x00689db7
0x00689d95
0x00689d98
0x00689da0
0x00689da0
0x00689d7f
0x00689d82
0x00689d87
0x00689d87
0x00000000
0x00689db9
0x00689d23
0x00689d25
0x00689d2d
0x00689d34
0x00689ebf
0x00689ec2
0x00689ecd
0x00689ecd

APIs

EnterCriticalSection.KERNEL32(00695AC8), ref: 00689D10
SetLastError.KERNEL32(00000057,?), ref: 00689D87

Memory Dump Source

Source File: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: CriticalEnterErrorLastSection
String ID:
API String ID: 3668107397-0
Opcode ID: 8bc0be570ea940915c03c8f796ade4bbd5435633829d12fa72faca045612778c
Instruction ID: 60a6c9d42475bdb0c6049a0c987d767ff23f11c2cd22daac944137cb87d0e715
Opcode Fuzzy Hash: 8bc0be570ea940915c03c8f796ade4bbd5435633829d12fa72faca045612778c
Instruction Fuzzy Hash: 0F61E630504619DFDB04DF98D949AA97BF6FF09721F148209E866AB3A0C7349D01CF25

Uniqueness

Uniqueness Score: -1.00%

Function 0068988D, Relevance: 9.2, APIs: 6, Instructions: 170
COMMON

Download Yara Rule

C-Code - Quality: 36%

			E0068988D(void* __ecx, void* _a4, intOrPtr _a8, intOrPtr _a16, long _a20, signed int* _a24) {
				signed int _v8;
				char _v20;
				void* _v32;
				long _v36;
				signed int _v40;
				signed int* _v44;
				signed int _v48;
				signed int _v52;
				char _v56;
				signed int _v60;
				long _v64;
				signed int _v68;
				intOrPtr _v72;
				signed int _v76;
				signed int _v80;
				signed int* _t85;
				signed int _t87;
				long _t98;
				signed int _t126;
				intOrPtr _t139;

				_push(0xffffffff);
				_push(0x6933f8);
				_push(0x69052c);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t139;
				_push(__ecx);
				_push(__ecx);
				EnterCriticalSection(0x695ac8);
				_v32 = _v32 & 0x00000000;
				_v8 = _v8 & 0x00000000;
				_t85 = _a24;
				 *_t85 =  *_t85 & 0x00000000;
				_v40 = _v40 & 0x00000000;
				_v36 = 2;
				if( *0x695ac0 == 0) {
					_v80 = _v80 & 0x00000000;
					0x690476( &_v20, 0xffffffff);
					_t87 = _v80;
					L31:
					 *[fs:0x0] = _v20;
					return _t87;
				}
				0x690235(_a4);
				_v44 = _t85;
				if(_v44 != 0) {
					_v48 =  *_v44;
					if(_a16 <=  *((intOrPtr*)(_v48 + 8))) {
						if(_a20 == 0) {
							_a20 =  *((intOrPtr*)(_v48 + 8)) - _a16;
						}
						if(_a20 + _a16 <=  *((intOrPtr*)(_v48 + 8))) {
							_v72 = _a8;
							if(_v72 > 0) {
								if(_v72 <= 2 || _v72 == 0xf001f) {
									_v36 = 4;
								}
							}
							_v32 = VirtualAlloc(0, _a20, 0x1000, 4);
							if(_v32 != 0) {
								_t98 = SetFilePointer(_a4,  *((intOrPtr*)(_v48 + 4)) + _a16, 0, 0);
								_t126 = _v48;
								_t128 =  *((intOrPtr*)(_t126 + 4)) + _a16;
								if(_t98 ==  *((intOrPtr*)(_t126 + 4)) + _a16) {
									_v52 = _v52 & 0x00000000;
									while(_v52 < _a20) {
										_v60 = _v60 & 0x00000000;
										if(E0068A7E1(_t128, _a4, _v32 + _v52, _a20 - _v52,  &_v60, 0,  &_v56) == 0 || _v56 == 0 || _v60 == 0) {
											goto L29;
										} else {
											_v52 = _v52 + _v60;
											continue;
										}
									}
									if(_v36 == 4 || VirtualProtect(_v32, _a20, _v36,  &_v64) != 0) {
										0x690303(_v32, _v48);
										 *_a24 = _v32;
										_v32 = _v32 & 0x00000000;
										_v40 = 1;
									}
									goto L29;
								}
							} else {
							}
							goto L29;
						} else {
							SetLastError(0x57);
							L29:
							_v76 = 1;
							0x690476( &_v20, 0xffffffff);
							_t87 = _v76;
							goto L31;
						}
					}
					SetLastError(0x57);
					goto L29;
				} else {
					_v68 = _v68 & 0x00000000;
					0x690476( &_v20, 0xffffffff);
					_t87 = _v68;
					goto L31;
				}
			}

0x00689890
0x00689892
0x00689897
0x006898a2
0x006898a3
0x006898aa
0x006898ab
0x006898b7
0x006898bd
0x006898c1
0x006898c5
0x006898c8
0x006898cb
0x006898cf
0x006898dd
0x00689a78
0x00689a80
0x00689a87
0x00689aae
0x00689ab1
0x00689abc
0x00689abc
0x006898ec
0x006898f1
0x006898f8
0x00689918
0x00689924
0x00689937
0x00689942
0x00689942
0x00689951
0x00689963
0x0068996a
0x00689970
0x0068997d
0x0068997d
0x00689970
0x00689996
0x0068999d
0x006899b5
0x006899bb
0x006899c1
0x006899c6
0x006899cd
0x006899d1
0x006899d9
0x006899ff
0x00000000
0x00689a0f
0x00689a15
0x00000000
0x00689a15
0x006899ff
0x00689a1e
0x00689a45
0x00689a50
0x00689a52
0x00689a56
0x00689a56
0x00000000
0x00689a1e
0x00000000
0x0068999f
0x00000000
0x00689953
0x00689955
0x00689a5d
0x00689a5f
0x00689a6a
0x00689a71
0x00000000
0x00689a71
0x00689951
0x00689928
0x00000000
0x006898fa
0x006898fc
0x00689904
0x0068990b
0x00000000
0x0068990b

APIs

EnterCriticalSection.KERNEL32(00695AC8), ref: 006898B7
SetLastError.KERNEL32(00000057,?), ref: 00689928

Memory Dump Source

Source File: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: CriticalEnterErrorLastSection
String ID:
API String ID: 3668107397-0
Opcode ID: 215253b7b12f5bf23806c58d2694d0e921fff2a7c6e01427980283943c1c1481
Instruction ID: e4e05300ec0116b7f3e289dbaf2614c39f6b005d0230cfc137f9282f48502592
Opcode Fuzzy Hash: 215253b7b12f5bf23806c58d2694d0e921fff2a7c6e01427980283943c1c1481
Instruction Fuzzy Hash: 89713571904208EFDF14EF98D885BFEBBBAFB08315F184219F512A6690C734A941CF64

Uniqueness

Uniqueness Score: -1.00%

Function 0043F2B8, Relevance: 9.1, APIs: 6, Instructions: 102COMMON

Download Yara Rule

APIs

MoveToEx.GDI32(?,?,?,00000000), ref: 0043F2D7
CreatePen.GDI32(00000000,00000001,?), ref: 0043F371
SelectObject.GDI32(?,?), ref: 0043F37F
LineTo.GDI32(?,?,?), ref: 0043F390
SelectObject.GDI32(?,?), ref: 0043F39A
DeleteObject.GDI32(?), ref: 0043F3A3

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: Object$Select$CreateDeleteLineMove
String ID:
API String ID: 3907703346-0
Opcode ID: bc3277a3a6e910faeaf95c971918460721eb197459c97cc412814937661b756e
Instruction ID: fd3c1981277ced9873596e638696e9c87acc2a29bd9f2813ed39731ebf14d088
Opcode Fuzzy Hash: bc3277a3a6e910faeaf95c971918460721eb197459c97cc412814937661b756e
Instruction Fuzzy Hash: 4D313E72E01519AFDB00DEADCD81BEEB7F9EF48300F148139F914E7645D678AA018BA4

Uniqueness

Uniqueness Score: -1.00%

Function 0043E904, Relevance: 9.1, APIs: 6, Instructions: 57COMMON

Download Yara Rule

APIs

CreatePen.GDI32(00000000,00000001), ref: 0043E915
SelectObject.GDI32(?,00000000), ref: 0043E927
MoveToEx.GDI32(?,?,?,00000000), ref: 0043E941
LineTo.GDI32(?,?,?), ref: 0043E960
SelectObject.GDI32(?,00000000), ref: 0043E970
DeleteObject.GDI32(00000000), ref: 0043E976

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: Object$Select$CreateDeleteLineMove
String ID:
API String ID: 3907703346-0
Opcode ID: e7f3efecfe07362aaad780e8f9df4d99058c8504e8d939d8551dd1f1a864e146
Instruction ID: fb3e0664bc353f7d230b7bdb37102da7edc4c3633353dfbd60649d5daa3712da
Opcode Fuzzy Hash: e7f3efecfe07362aaad780e8f9df4d99058c8504e8d939d8551dd1f1a864e146
Instruction Fuzzy Hash: E411B776605104AFE700EB6EC889EAAF7ECEF48654B048466BD04DB352D674ED408665

Uniqueness

Uniqueness Score: -1.00%

Function 00438E70, Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 236COMMON

Download Yara Rule

APIs

Part of subcall function 0042C174: GetVersion.KERNEL32(?,00000001,00445D18,00000010,00000000,00445EC5,?,T$E,005FA000,00000000), ref: 0042C178
Part of subcall function 0042C174: Sleep.KERNEL32(0000000A,?,00000001,00445D18,00000010,00000000,00445EC5,?,T$E,005FA000,00000000), ref: 0042C1D6

GetWindowLongA.USER32(?,000000EC), ref: 00439098
SetWindowPos.USER32(?,000000FE,00000000,00000000,00000000,00000000,00000003), ref: 004390BB
SetWindowPos.USER32(?,000000FF,00000000,00000000,00000000,00000000,00000003), ref: 0043910A

Strings

MAPISendMail, xrefs: 00438EDC
mapi32.dll, xrefs: 00438EE1

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: Window$LongSleepVersion
String ID: MAPISendMail$mapi32.dll
API String ID: 3125456618-3507761728
Opcode ID: 612646a3e70cfa799d17e86a081f11344a0fc2c67ad4611aee223f9c44af3402
Instruction ID: bc414e178ffca88585dd616e77570e667d23069d8621485faaceb839cfd020aa
Opcode Fuzzy Hash: 612646a3e70cfa799d17e86a081f11344a0fc2c67ad4611aee223f9c44af3402
Instruction Fuzzy Hash: 47913270D042099FDB10EFA9C882B9EB7B4AB48314F11517AF505BB3D1D778AD41CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00426270, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 76windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00424994: GetTextExtentPoint32A.GDI32(?,00000000,00000000,?), ref: 004249CF

GetSystemMetrics.USER32(00000047), ref: 004262B5
GetSystemMetrics.USER32(00000048), ref: 004262C2
GetSystemMetrics.USER32(00000047), ref: 004262CE
SendMessageA.USER32(?,000000F1,00000001,00000000), ref: 00426316

Strings

Button, xrefs: 004262D6

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: MetricsSystem$ExtentMessagePoint32SendText
String ID: Button
API String ID: 381378357-1034594571
Opcode ID: 9610cefe7a93072c7f39dcc76411e37b7b33c662b48549c0712d49d9d909542e
Instruction ID: 140efc3b170549be64b82a71b3e88e3ee7b879dcb084241c1a3ff13094ca3202
Opcode Fuzzy Hash: 9610cefe7a93072c7f39dcc76411e37b7b33c662b48549c0712d49d9d909542e
Instruction Fuzzy Hash: 52217771B04204AFDB14DF69D8C2B5A77E8EB89704F91407ABA04EB3C2D678DD40CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0044DE64, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 56threadCOMMON

Download Yara Rule

APIs

FindWindowA.USER32(TAppBuilder,00000000), ref: 0044DE9E
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 0044DEB0
EnumWindows.USER32(0044DD8C,?), ref: 0044DEE5

Strings

madToolsMsgHandlerWindow, xrefs: 0044DEC7
TAppBuilder, xrefs: 0044DE99

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: Window$EnumFindProcessThreadWindows
String ID: TAppBuilder$madToolsMsgHandlerWindow
API String ID: 1333186420-3019852503
Opcode ID: 9da986fc8edb66deb545d16ab0d035e449b0e2ccb688b5b0ecfc29d788371d95
Instruction ID: d0c4163d6ed96c2b33b89127c74da93fb1e7872c5d33eae7b17881679fe408b3
Opcode Fuzzy Hash: 9da986fc8edb66deb545d16ab0d035e449b0e2ccb688b5b0ecfc29d788371d95
Instruction Fuzzy Hash: 21117774E14608AFE710FBD1CC42A9EB3BCEB85304FA14477A910B32D1DB78AE058B59

Uniqueness

Uniqueness Score: -1.00%

Function 004037BC, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 49registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 004037DE
RegQueryValueExA.ADVAPI32(?,FPUMaskValue,00000000,00000000,?,00000004,00000000,0040382D,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 00403811
RegCloseKey.ADVAPI32(?,00403834,00000000,?,00000004,00000000,0040382D,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 00403827

Strings

SOFTWARE\Borland\Delphi\RTL, xrefs: 004037D4
FPUMaskValue, xrefs: 00403808

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: CloseOpenQueryValue
String ID: FPUMaskValue$SOFTWARE\Borland\Delphi\RTL
API String ID: 3677997916-4173385793
Opcode ID: 846bedb45d8f661a136d33421162aa7e50a724fc78f488bc3fb1c59c8c3c0414
Instruction ID: 1d668e07ac8a77720ccd8c4c968de9b832e89e20fa2e02c051f605d2b6028c7c
Opcode Fuzzy Hash: 846bedb45d8f661a136d33421162aa7e50a724fc78f488bc3fb1c59c8c3c0414
Instruction Fuzzy Hash: 9A017576940348BADB11EF91DC42FB9B7ECEB04B01F5080B6F904E76D0E6789A14D769

Uniqueness

Uniqueness Score: -1.00%

Function 00431A6C, Relevance: 7.8, APIs: 5, Instructions: 299windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutA.USER32(000A007E,00000400,00000001,00000000,00000000,000005DC,005FA000), ref: 00431C5C
SendMessageTimeoutA.USER32(000A007E,00000400,00000000,00000000,00000000,7FFFFFFE,00000309), ref: 00431C8B
GetWindowLongA.USER32(00000000,000000EC), ref: 00431D5C
SetWindowPos.USER32(00000000,000000FE,00000000,00000000,00000000,00000000,00000003,?,00607910,?,00000000), ref: 00431D81
SetWindowPos.USER32(00000000,000000FF,00000000,00000000,00000000,00000000,00000003,?,?,00607910,?,00000000), ref: 00431DA9

Part of subcall function 00445F20: EnterCriticalSection.KERNEL32(02B32564,005FA000,?,?,00431AE5,?,00607910,?,00000000), ref: 00445F3C
Part of subcall function 00445F20: LeaveCriticalSection.KERNEL32(02B32564,00445FC9,02B32564,005FA000,?,?,00431AE5,?,00607910,?,00000000), ref: 00445FBC

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: Window$CriticalMessageSectionSendTimeout$EnterLeaveLong
String ID:
API String ID: 1340963564-0
Opcode ID: d2c148c070ac9192014aafc63beff1f18ef92b4699fb4e99e3f1b474d1f6c5a9
Instruction ID: 9c9546ac3f015aa90516baba5e80a363fd8e856eab11c1c1d8e9aee7818f423b
Opcode Fuzzy Hash: d2c148c070ac9192014aafc63beff1f18ef92b4699fb4e99e3f1b474d1f6c5a9
Instruction Fuzzy Hash: 98C1D630904248AFDF10DF54C845BEEB7F5AF09314F14A5ABE8106B3A1C779AE46CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00432380, Relevance: 7.6, APIs: 5, Instructions: 87synchronizationwindowsleepCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 00432396
WaitForSingleObject.KERNEL32(00000000,000000FF,?,00000000,00000000,00000000,00000001,0000EA60,00000000,00000000,00000000,00000000,00000000,00432496,?,?), ref: 004323CA
PostMessageA.USER32(00000000,00000000,00000000,00000000), ref: 004323DF
Sleep.KERNEL32(0000EA60,00000000,00000000,00000000,00000000,00000000,00432496,?,?,000000FF), ref: 004323E5
PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 00432416

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: MessageObjectSingleWait$PeekPostSleep
String ID:
API String ID: 246172536-0
Opcode ID: 28f874f36f85dc648501992ffb576a62e84d1b74d72e09a3fd7f3c99b9e1a4a6
Instruction ID: dec896a5644195750a9caf4b8a5c8f83e805d9f815fa85e5e6a7d6ba481035eb
Opcode Fuzzy Hash: 28f874f36f85dc648501992ffb576a62e84d1b74d72e09a3fd7f3c99b9e1a4a6
Instruction Fuzzy Hash: 5621F930780300AFEB308B399D45F7232E6976D710F10942AFA05D72D1D6FC7849EA29

Uniqueness

Uniqueness Score: -1.00%

Function 0043A5D8, Relevance: 7.6, APIs: 5, Instructions: 79networkCOMMON

Download Yara Rule

APIs

socket.WS2_32(00000002,00000001,00000000), ref: 0043A619
inet_addr.WS2_32(00000000), ref: 0043A62E
gethostbyname.WS2_32(00000000), ref: 0043A643
htons.WS2_32(?), ref: 0043A66E
connect.WS2_32(B70F0B4E,B70F0B4E,00000010), ref: 0043A683

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: connectgethostbynamehtonsinet_addrsocket
String ID:
API String ID: 2758610518-0
Opcode ID: dae92c6cf85b471c6c9a36b15e454b55c24dd6688ec01e62c0eec8775bf61254
Instruction ID: 809d0a6be3f584be98ab2d2e58dd21187b4c30ad83b2da7377ee8bb7c1c1d6da
Opcode Fuzzy Hash: dae92c6cf85b471c6c9a36b15e454b55c24dd6688ec01e62c0eec8775bf61254
Instruction Fuzzy Hash: D621F770A00204AFC700EFA5C846A9EB7F8EF48314F56056AF890EB3E1D7789D51CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0040C0F4, Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(-0000004C,?,0000001C,00607910,-0000004C,?,0042C2AC,00000000,0042C430,?,00000000,0042C455,?,00607910,?,00000000), ref: 0040C10C
GetVersion.KERNEL32(-0000004C,?,0000001C,00607910,-0000004C,?,0042C2AC,00000000,0042C430,?,00000000,0042C455,?,00607910,?,00000000), ref: 0040C137
GetModuleFileNameA.KERNEL32(?,?,00000104,-0000004C,?,0000001C,00607910,-0000004C,?,0042C2AC,00000000,0042C430,?,00000000,0042C455), ref: 0040C152
GetModuleFileNameW.KERNEL32(?,?,00000104,-0000004C,?,0000001C,00607910,-0000004C,?,0042C2AC,00000000,0042C430,?,00000000,0042C455), ref: 0040C170
GetVersion.KERNEL32(?,?,00000104,-0000004C,?,0000001C,00607910,-0000004C,?,0042C2AC,00000000,0042C430,?,00000000,0042C455), ref: 0040C184

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: FileModuleNameVersion$QueryVirtual
String ID:
API String ID: 3263203797-0
Opcode ID: f455460b28e76d056fe319c829ca2664afccd85581205a014853d5563891295a
Instruction ID: 22667a5fcd4718f05c8b3b96abf03368a7852287611fde2aee556b70e3251d44
Opcode Fuzzy Hash: f455460b28e76d056fe319c829ca2664afccd85581205a014853d5563891295a
Instruction Fuzzy Hash: A0116275648306DBD710DB65C8C179B73D8AF88354F04093EBAC4EB3D1E27CD9449A56

Uniqueness

Uniqueness Score: -1.00%

Function 006888C0, Relevance: 7.6, APIs: 5, Instructions: 67
sleepsynchronizationCOMMON

Download Yara Rule

C-Code - Quality: 54%

			E006888C0(void* __edi, void* __esi, intOrPtr _a4) {
				int _v8;
				int _v16;
				void** _v20;
				char _v24;
				void* _t16;
				intOrPtr _t17;
				intOrPtr _t32;
				DWORD* _t33;
				void* _t39;
				void* _t40;
				void* _t41;

				_t41 = _t40 - 0x104;
				 *0x695a1c = _a4;
				_v20 = 0x6885e0;
				if( *_v20 != 0) {
					_v24 = 0x103;
					while(1) {
						_t33 =  &_v24;
						if(GetExitCodeProcess( *_v20, _t33) == 0 || _v24 != 0x103) {
							break;
						}
						WaitForSingleObject( *_v20, 0xffffffff);
					}
					Sleep(0x64);
					_t32 =  *0x695a24; // 0x0
					E0068D8ED(_t32, __eflags, _t32);
					_t41 = _t41 + 4;
					TerminateProcess(GetCurrentProcess(), 0);
				}
				_v16 = 0;
				_v8 = 0;
				ds =  *((intOrPtr*)(L00688662(0x2d0000)));
				_push(_t33);
				__eflags =  *[ss:eax] & _t33;
				asm("popad");
				_pop(_t16);
				asm("int 0xa4");
				asm("bound ecx, [ecx+ebx*2-0x1b]");
				_t17 = _t16 + 0x1f;
				 *0x50313e4b = _t17;
				asm("insd");
				asm("int1");
				asm("std");
				asm("lock jecxz 0xffffff8d");
				asm("sbb [cs:ecx], edi");
				_pop(_t39);
				__eflags =  *0x35697c20 - _t39;
				asm("fisub dword [ebp-0x2056b01c]");
				asm("adc al, 0x66");
				return _t17;
			}

0x006888c3
0x006888ce
0x006888d3
0x006888e0
0x006888e2
0x006888e9
0x006888e9
0x006888fb
0x00000000
0x00000000
0x0068890e
0x0068890e
0x00688918
0x0068891e
0x00688925
0x0068892a
0x00688936
0x00688936
0x0068893c
0x00688943
0x00688956
0x00688958
0x00688959
0x0068895c
0x0068895d
0x0068895e
0x00688960
0x00688966
0x00688968
0x0068896d
0x0068896e
0x0068896f
0x00688970
0x00688973
0x00688976
0x0068897e
0x00688984
0x0068898a
0x0068898c

APIs

GetExitCodeProcess.KERNEL32 ref: 006888F3
WaitForSingleObject.KERNEL32(?,000000FF,002D0000), ref: 0068890E
Sleep.KERNEL32(00000064,002D0000), ref: 00688918
GetCurrentProcess.KERNEL32(00000000), ref: 0068892F
TerminateProcess.KERNEL32(00000000), ref: 00688936

Memory Dump Source

Source File: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: Process$CodeCurrentExitObjectSingleSleepTerminateWait
String ID:
API String ID: 2193199854-0
Opcode ID: 1e0326f6e530d88493b1d38d759fa8794137f1a95d23da9cc5432bc7edb69d24
Instruction ID: 64935fc30731b2e995114be468fa0491e1ea4bd70328842594547ad78fe23d2d
Opcode Fuzzy Hash: 1e0326f6e530d88493b1d38d759fa8794137f1a95d23da9cc5432bc7edb69d24
Instruction Fuzzy Hash: 5721CFB4900205DFCB10DFA4CC48BAEB77ABF09714F104259E512A73A0DB749A46CB61

Uniqueness

Uniqueness Score: -1.00%

Function 004325B8, Relevance: 7.5, APIs: 5, Instructions: 40threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 004325C4
InterlockedIncrement.KERNEL32(005FD438), ref: 004325E1
CreateEventA.KERNEL32(00000000,000000FF,00000000,00000000,00000001,00445D3A,00000000,000000FF,00000000,00000000,00000010,00000000,00445EC5,?,T$E,005FA000), ref: 004325F2
InterlockedDecrement.KERNEL32(005FD438), ref: 00432603
SetEvent.KERNEL32(00000000,00000001,00445D3A,00000000,000000FF,00000000,00000000,00000010,00000000,00445EC5,?,T$E,005FA000,00000000), ref: 0043261B

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: EventInterlocked$CreateCurrentDecrementIncrementThread
String ID:
API String ID: 1795649823-0
Opcode ID: ae4b4dec4712e350aa0650b70b344b901bc27ae2bbc9e14b72ce37f93b4b6bf4
Instruction ID: ce942dd0e334b2d9eaacfc643de30fd5d71ee4f41a3f8cdf8da9684b60f541e1
Opcode Fuzzy Hash: ae4b4dec4712e350aa0650b70b344b901bc27ae2bbc9e14b72ce37f93b4b6bf4
Instruction Fuzzy Hash: E50131706852009ADB10EB7D9D4A77B36F56B28304F50152AAE04D62E1E6FC7409FF39

Uniqueness

Uniqueness Score: -1.00%

Function 00688CA4, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 92
COMMON

Download Yara Rule

C-Code - Quality: 29%

			E00688CA4(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, signed char* _a16, char** _a20) {
				intOrPtr _v8;
				int _v12;
				unsigned int _v16;
				int _v20;
				intOrPtr _t40;
				signed char _t68;
				signed int _t75;
				void* _t90;

				if(( *0x695aac & 1) == 0) {
					_t68 =  *0x695aac & 0x000000ff | 0x00000001;
					 *0x695aac = _t68;
					0x68f66e("PathMatchSpecA", "shlwapi.dll");
					 *0x695aa8 = _t68;
				}
				if(_a8 == 0) {
					L4:
					_t40 = _a12 + _a8;
					0x690610(_t40, 0x5c);
					_v8 = _t40;
					if(_v8 == 0) {
						 *_a16 =  *_a16 & 0x00000000;
						_v20 = PathMatchSpecA(_a12 + _a8, _a4 + _a8);
						 *_a20 = _a12 + _a8;
						return _v20;
					}
					 *_a16 = 1;
					_v16 = _v8 - _a12 + _a8;
					if(_v16 + 1 <= 0x80) {
						_t90 = _a12 + _a8;
						_t75 = _v16 >> 2;
						memcpy(_t90 + _t75 + _t75, _t90, memcpy(0x695a28, _t90, _t75 << 2) & 0x00000003);
						0x695a28[_v16] = 0x695a28[_v16] & 0x00000000;
						 *_a20 = 0x695a28;
						_v12 = PathMatchSpecA(0x695a28, _a4 + _a8);
						return _v12;
					}
					return 0;
				} else {
					asm("repe cmpsb");
					if(0 != 0) {
						return 0;
					}
					goto L4;
				}
			}

0x00688cb8
0x00688cc1
0x00688cc3
0x00688cd2
0x00688cd9
0x00688cd9
0x00688ce2
0x00688cf7
0x00688cfc
0x00688d00
0x00688d07
0x00688d0e
0x00688d7f
0x00688d96
0x00688da2
0x00000000
0x00688da4
0x00688d13
0x00688d21
0x00688d2d
0x00688d39
0x00688d43
0x00688d4d
0x00688d52
0x00688d5c
0x00688d74
0x00000000
0x00688d77
0x00000000
0x00688ce4
0x00688cef
0x00688cf1
0x00000000
0x00688da9
0x00000000
0x00688cf1

APIs

PathMatchSpecA.SHLWAPI(00695A28,00000000,024B0AF8,024B09F4,00000000), ref: 00688D6E

Strings

PathMatchSpecA, xrefs: 00688CCD
shlwapi.dll, xrefs: 00688CC8

Memory Dump Source

Source File: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: MatchPathSpec
String ID: PathMatchSpecA$shlwapi.dll
API String ID: 3588000350-1850424724
Opcode ID: d4d681f8841aadaed2aff48510eb239c8951212f443be9da5c78281a6dbf2643
Instruction ID: fa21303ae6c48e0c41d3ae625a9de3bf7e06d3ceab1516d15e0d738c156cbc0f
Opcode Fuzzy Hash: d4d681f8841aadaed2aff48510eb239c8951212f443be9da5c78281a6dbf2643
Instruction Fuzzy Hash: 27314672A00609AFDF05DF68D881A9E3BFAEF08324F148545FC16DB781D670EA51CB58

Uniqueness

Uniqueness Score: -1.00%

Function 0068E82B, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 62%

			E0068E82B(void* __ecx, intOrPtr _a4, intOrPtr _a8, CHAR* _a12, char _a16) {
				signed int _v8;
				intOrPtr _v20;
				char* _v32;
				CHAR* _v36;
				int _v40;
				void* _t33;
				intOrPtr _t44;

				_push(0xffffffff);
				_push(0x693518);
				_push(0x69052c);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t44;
				EnterCriticalSection( *0x006885E4 + 0x48);
				_v8 = _v8 & 0x00000000;
				_v36 = 0x695b10;
				_push(_a8);
				_push(_a4);
				_v40 = wsprintfA(_v36, "Error at %s:%dReason: ");
				_v32 =  &_a16;
				wvsprintfA( &(_v36[_v40]), _a12, _v32);
				_v32 = _v32 & 0x00000000;
				E0068E7D5(_v36);
				E0068E7A0(_v36);
				_v8 = _v8 | 0xffffffff;
				_t33 = E0068E8BF();
				 *[fs:0x0] = _v20;
				return _t33;
			}

0x0068e82e
0x0068e830
0x0068e835
0x0068e840
0x0068e841
0x0068e85c
0x0068e862
0x0068e866
0x0068e86d
0x0068e870
0x0068e884
0x0068e88a
0x0068e89a
0x0068e8a0
0x0068e8a7
0x0068e8af
0x0068e8b4
0x0068e8b8
0x0068e8d5
0x0068e8e0

APIs

EnterCriticalSection.KERNEL32(024B0440), ref: 0068E85C
wsprintfA.USER32 ref: 0068E87B
wvsprintfA.USER32(?,?,?), ref: 0068E89A

Part of subcall function 0068E7A0: ChangeDisplaySettingsA.USER32(00000000,00000000), ref: 0068E7AB
Part of subcall function 0068E7A0: MessageBoxA.USER32 ref: 0068E7BE
Part of subcall function 0068E7A0: GetCurrentProcess.KERNEL32(00000000,?,0068E94B,?,?,?,?,?,?,?,00000000,0069052C,00693528,000000FF,?,00688B8D), ref: 0068E7C6
Part of subcall function 0068E7A0: TerminateProcess.KERNEL32(00000000,?,0068E94B,?,?,?,?,?,?,?,00000000,0069052C,00693528,000000FF,?,00688B8D), ref: 0068E7CD

Part of subcall function 0068E8BF: LeaveCriticalSection.KERNEL32(024B0440,0068E8BD), ref: 0068E8CB

Strings

Error at %s:%dReason: , xrefs: 0068E873

Memory Dump Source

Source File: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: CriticalProcessSection$ChangeCurrentDisplayEnterLeaveMessageSettingsTerminatewsprintfwvsprintf
String ID: Error at %s:%dReason:
API String ID: 1133955834-961022370
Opcode ID: 108c023aa95facecf5ef007a72260641e58a67f23541bbbba2a092ae1221f4bb
Instruction ID: a1272caa66c16dd22622031d40702c34b874728716aae04d2e0ddd64f508a35b
Opcode Fuzzy Hash: 108c023aa95facecf5ef007a72260641e58a67f23541bbbba2a092ae1221f4bb
Instruction Fuzzy Hash: B9111CB6900218EFCF01AF94CD06BDEBBBAFB04711F004619F411A76A1D73A9A10CF64

Uniqueness

Uniqueness Score: -1.00%

Function 00412E64, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(00000000,00412EE8,?,00000000,00000000,00000000,?,00412F4B,?,00000000,00412F70,?,?), ref: 00412E90
GetModuleHandleW.KERNEL32(?,00000000,00412EE8,?,00000000,00000000,00000000,?,00412F4B,?,00000000,00412F70,?,?), ref: 00412EAD
GetModuleHandleA.KERNEL32(?,00000000,00412EE8,?,00000000,00000000,00000000,?,00412F4B,?,00000000,00412F70,?,?), ref: 00412EBD

Strings

>0';09fg{199, xrefs: 00412E86

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: HandleModule$Version
String ID: >0';09fg{199
API String ID: 1014407405-719157153
Opcode ID: 275d76fa8e0bdc42ef469e2a6467497d3318c3539c4231b2abc36f330a4088c5
Instruction ID: 54d1675df772ca940160094fd9df4543ef9a835a4984107498cff26b08164f4c
Opcode Fuzzy Hash: 275d76fa8e0bdc42ef469e2a6467497d3318c3539c4231b2abc36f330a4088c5
Instruction Fuzzy Hash: 6401A230A44304AFE710DBA1CE42B9E77EDE708308F60146AFA00E6690D77869A0D62E

Uniqueness

Uniqueness Score: -1.00%

Function 0040BEDC, Relevance: 6.1, APIs: 4, Instructions: 149synchronizationthreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0040BF04
WaitForSingleObject.KERNEL32(00000254,000000FF), ref: 0040BF14
IsWindow.USER32(?), ref: 0040C00C
ReleaseMutex.KERNEL32(00000254,0040C09A,00000254,000000FF), ref: 0040C08D

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: CurrentMutexObjectReleaseSingleThreadWaitWindow
String ID:
API String ID: 3208048871-0
Opcode ID: ae59ee08c1104686800ee556cc089dcbe803130fc6de61ddeef42e814996db68
Instruction ID: 349ed9152cc61fac1390ed2cf01f05ad9c8a19a611f7ae9e7dabc89df224534f
Opcode Fuzzy Hash: ae59ee08c1104686800ee556cc089dcbe803130fc6de61ddeef42e814996db68
Instruction Fuzzy Hash: F7516E31A00109CFCB10DF59D9C1A6BB7A5FB45358B24827AE808EB3A1E735AD51CBD8

Uniqueness

Uniqueness Score: -1.00%

Function 00459DD8, Relevance: 6.1, APIs: 4, Instructions: 115COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 00459E87
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 00459EA3
SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 00459F1A
VariantClear.OLEAUT32(?), ref: 00459F43

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: ArraySafe$Bound$ClearIndexVariant
String ID:
API String ID: 920484758-0
Opcode ID: 872affc479cb4ba8f9e851afa09399f46918b7aba8d055d8bc924790bd140f9c
Instruction ID: 6be4f358f5cfd21a05e0316b60066d43cd18b87475852423466a2bdf2511df4d
Opcode Fuzzy Hash: 872affc479cb4ba8f9e851afa09399f46918b7aba8d055d8bc924790bd140f9c
Instruction Fuzzy Hash: 9A411F75A0121DDBCB61DB59CC91BDAB3BCAB48705F0041DAE948E7352DA38AF888F54

Uniqueness

Uniqueness Score: -1.00%

Function 00689ABF, Relevance: 6.1, APIs: 4, Instructions: 90COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00695AC8), ref: 00689AE9
GetCurrentProcess.KERNEL32(?,00000000,00000000,00000002,?), ref: 00689B3F
GetCurrentProcess.KERNEL32(?,00000000), ref: 00689B49
DuplicateHandle.KERNEL32(00000000), ref: 00689B50

Memory Dump Source

Source File: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: CurrentProcess$CriticalDuplicateEnterHandleSection
String ID:
API String ID: 3636454022-0
Opcode ID: be27807574e3fb6f7ad841ce1fddda290b561b1e9e66978b2b322621894a9a69
Instruction ID: bb666b53e748feb997cfddb8f58cc1b6f519ecf5cf7b6f944b2d8cc56762da6c
Opcode Fuzzy Hash: be27807574e3fb6f7ad841ce1fddda290b561b1e9e66978b2b322621894a9a69
Instruction Fuzzy Hash: 2A311671904218EFDF15EF98EC45FAE77BAFB08721F148219F525AA6D0C7759900CB28

Uniqueness

Uniqueness Score: -1.00%

Function 00421118, Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

CreateCompatibleDC.GDI32(00000000), ref: 00421166
CreateDIBSection.GDI32(00000000,?,00000000,?,00000000,00000000), ref: 00421186
SelectObject.GDI32(?,?), ref: 004211B3
DeleteDC.GDI32(?), ref: 004211C2

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: Create$CompatibleDeleteObjectSectionSelect
String ID:
API String ID: 4257765504-0
Opcode ID: b17648be7af0e6145d85bdf13f3e75213a0648f60e758f74541efb09527dcae8
Instruction ID: 1e16b369fa67c417119442061e1b4e59c749474209967899c82ef8b761f9d776
Opcode Fuzzy Hash: b17648be7af0e6145d85bdf13f3e75213a0648f60e758f74541efb09527dcae8
Instruction Fuzzy Hash: E1213870A04205AFE710DF59D881B9ABBF4FF89314F60852AF944EB390D774AD90CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0042E25C, Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 70memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?,00000008,00000000,-0000001A,00000000,?,0042E449,00000000,00000000,00000000,00000000,00000001,00000000,|pC,00000000), ref: 0042E27E
LocalFree.KERNEL32(00000000,00000040,?,00000008,00000000,-0000001A,00000000,?,0042E449,00000000,00000000,00000000,00000000,00000001,00000000,|pC), ref: 0042E295
LocalAlloc.KERNEL32(00000040,00000001,00000008,00000000,-0000001A,00000000,?,0042E449,00000000,00000000,00000000,00000000,00000001,00000000,|pC,00000000), ref: 0042E2A6

Strings

'B, xrefs: 0042E2D9

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: Local$Alloc$Free
String ID: 'B
API String ID: 209276640-1013193731
Opcode ID: d676fbc91f9ab19ef8dd3de7068da17e71fe077dbb17b5e6231613199da1c028
Instruction ID: 19ee342adb76c7c48b5d11c1e2e5e861cfa44e34713da2f18f0219dd324557d5
Opcode Fuzzy Hash: d676fbc91f9ab19ef8dd3de7068da17e71fe077dbb17b5e6231613199da1c028
Instruction Fuzzy Hash: 23214A356042259FCB00DF5CD9C1D5A7BE5EF99310B1180A9EA40AB366CB34FD01CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0043BBC0, Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 51memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?,?,00000000,00000000,?,B70F0B92,0043BF04,?,?,-00000001,00000000,00000000,00000000,B70F0BAA,0043C43B), ref: 0043BC08
LocalFree.KERNEL32(00000000,?,00000000,00000000,?,B70F0B92,0043BF04,?,?,-00000001,00000000,00000000,00000000,B70F0BAA,0043C43B,B70F0BAA), ref: 0043BC29

Strings

InternetQueryOptionA, xrefs: 0043BBD0
wininet.dll, xrefs: 0043BBD5

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: Local$AllocFree
String ID: InternetQueryOptionA$wininet.dll
API String ID: 2012307162-3276249405
Opcode ID: 3be8ad25b74754897b8396812fca5120a472dac4a785b0120672350144ca993e
Instruction ID: 0b1dfe1f02c53ed3b24e606b159117424296f1c035b87623e9ae62471a08c91a
Opcode Fuzzy Hash: 3be8ad25b74754897b8396812fca5120a472dac4a785b0120672350144ca993e
Instruction Fuzzy Hash: FC016261B442097AE620B6A59C43F6F62ACDB48755F10103BB704FA1C1DFB8AE0092A9

Uniqueness

Uniqueness Score: -1.00%

Function 00424A08, Relevance: 6.0, APIs: 4, Instructions: 37COMMON

Download Yara Rule

APIs

InflateRect.USER32(?), ref: 00424A26
CreateSolidBrush.GDI32(?), ref: 00424A2F
FillRect.USER32(?,?,00000000), ref: 00424A3C
DeleteObject.GDI32(00000000), ref: 00424A42

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: Rect$BrushCreateDeleteFillInflateObjectSolid
String ID:
API String ID: 2337690274-0
Opcode ID: fd7f8c9fc395e0268748c1d1e190c2a0623abfc1c46801e6836385f398eb06b0
Instruction ID: adc012cdce8ce5855f2d405109d280a060c724324c04b767c54b41ba5d789d59
Opcode Fuzzy Hash: fd7f8c9fc395e0268748c1d1e190c2a0623abfc1c46801e6836385f398eb06b0
Instruction Fuzzy Hash: E6E0E5B3A04519268701EAEA9C81CFFB39CDE422607040A3BBD10F7241E9B5BD0042B9

Uniqueness

Uniqueness Score: -1.00%

Function 0068E7A0, Relevance: 6.0, APIs: 4, Instructions: 18
windowCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E0068E7A0(CHAR* __ecx) {
				CHAR* _v8;

				_push(__ecx);
				_v8 = __ecx;
				ChangeDisplaySettingsA(0, 0);
				MessageBoxA(0, _v8,  *0x6934fc, 0x10);
				return TerminateProcess(GetCurrentProcess(), 0);
			}

0x0068e7a3
0x0068e7a4
0x0068e7ab
0x0068e7be
0x0068e7d4

APIs

ChangeDisplaySettingsA.USER32(00000000,00000000), ref: 0068E7AB
MessageBoxA.USER32 ref: 0068E7BE
GetCurrentProcess.KERNEL32(00000000,?,0068E94B,?,?,?,?,?,?,?,00000000,0069052C,00693528,000000FF,?,00688B8D), ref: 0068E7C6
TerminateProcess.KERNEL32(00000000,?,0068E94B,?,?,?,?,?,?,?,00000000,0069052C,00693528,000000FF,?,00688B8D), ref: 0068E7CD

Memory Dump Source

Source File: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: Process$ChangeCurrentDisplayMessageSettingsTerminate
String ID:
API String ID: 428500978-0
Opcode ID: 47ef1aee9bb43730a3d04e5537af9fbdf77bc14f2df3b225521764875a240f47
Instruction ID: 0e2ff15b99a2abcf03c4a83072e9aaecf231c13e8884f75b5e29c6fe4496751f
Opcode Fuzzy Hash: 47ef1aee9bb43730a3d04e5537af9fbdf77bc14f2df3b225521764875a240f47
Instruction Fuzzy Hash: F0E01735A84318FBEB005FD0AD0FF897A7EAB08B02F005002F305956E0CAB19A00AB25

Uniqueness

Uniqueness Score: -1.00%

Function 0043C35C, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 179networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32(00000101,B70F0A0A), ref: 0043C3FD
WSACleanup.WS2_32 ref: 0043C50D

Strings

Prepare attachments..., xrefs: 0043C420

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: CleanupStartup
String ID: Prepare attachments...
API String ID: 915672949-951313767
Opcode ID: 0e2c6ebd811b29d5f48aef008382e8303504c4f3cfdcd8b5330aab5eeaf4ef2b
Instruction ID: 2bd39d02f14d9d463404da3409ade706292153b640d55638cf1153c73d5d0675
Opcode Fuzzy Hash: 0e2c6ebd811b29d5f48aef008382e8303504c4f3cfdcd8b5330aab5eeaf4ef2b
Instruction Fuzzy Hash: 6C613B71600118AFDB00EF69D881A9EB3F4EF89304F5191AAF915AB3A1CB38ED51CF55

Uniqueness

Uniqueness Score: -1.00%

Function 0043A90C, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 171COMMON

Download Yara Rule

APIs

select.WS2_32(00000000,B70F0646,00000000,00000000,B70F0B4A), ref: 0043A97F

Strings

AUTH , xrefs: 0043AA9A
LOGIN , xrefs: 0043AAE1

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: select
String ID: LOGIN $AUTH
API String ID: 1274211008-1546186761
Opcode ID: a32147f267e8543d6b9217ccab232fed38b9d4415535d6fea0ce02357a3bfc84
Instruction ID: 06a8cb4fbbc617a0ec0ab69d1e7e85324d3b0c20fa45b4d5a5ec2628b3244ea2
Opcode Fuzzy Hash: a32147f267e8543d6b9217ccab232fed38b9d4415535d6fea0ce02357a3bfc84
Instruction Fuzzy Hash: 2E61D671E401499FDB10EB98C841BEEB7F5AF89314F1542AAE540B73C1D738AE41CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 004432F4, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133windowCOMMON

Download Yara Rule

APIs

SetWindowLongA.USER32(00000000,000000EB), ref: 00443405
SetFocus.USER32(00000000,?,?,?,?,?,?,?), ref: 0044343D

Strings

Button, xrefs: 004433DE

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: FocusLongWindow
String ID: Button
API String ID: 1009637312-1034594571
Opcode ID: 9ad93541b943a1b70ae94cc41dc0d90e9f16f1fc664b8a26f08325297139d02c
Instruction ID: 64e0de0a37c5cb3d52a954156661b9220356a1a2ebeaa848b3f04e39c9dd414c
Opcode Fuzzy Hash: 9ad93541b943a1b70ae94cc41dc0d90e9f16f1fc664b8a26f08325297139d02c
Instruction Fuzzy Hash: 87515E70A046449FEB01CF58C48AB8EBBE4AF15759F5581A6F800DB3A1C778EE90CB95

Uniqueness

Uniqueness Score: -1.00%

Function 0042B860, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(?,?,00000104), ref: 0042B8E0
VirtualQuery.KERNEL32(00000000,?,0000001C), ref: 0042B964

Strings

!C, xrefs: 0042B86B

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: FileModuleNameQueryVirtual
String ID: !C
API String ID: 2827130835-2273022293
Opcode ID: fdd6b981d6011093a4f461e2da5ceaa0b3068512a2ff2ae0db43e9e4ce2c7fbe
Instruction ID: 75b32fe06ecb1dacb13bc3d14130df2f4d1d3ece9f310cdfe7b1a3eb8df6ad23
Opcode Fuzzy Hash: fdd6b981d6011093a4f461e2da5ceaa0b3068512a2ff2ae0db43e9e4ce2c7fbe
Instruction Fuzzy Hash: FE318DB1A001199FDB10DF65D881AEEB3F9EB89304F558076EA04A7351E738AE41CB95

Uniqueness

Uniqueness Score: -1.00%

Function 004251AC, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

OffsetRect.USER32(?), ref: 004251E2
EnableWindow.USER32(?,00000000), ref: 0042524F

Strings

MZP, xrefs: 00425219

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: EnableOffsetRectWindow
String ID: MZP
API String ID: 764227307-2889622443
Opcode ID: 53cab7d8d2e9a20e3cd087ee3f9230bac5fbed9fb1170ac651fa96390b789079
Instruction ID: bd40e926921a7d22917b672452e7d84544ff11ed307ea76fcc1ba7da56dacfb2
Opcode Fuzzy Hash: 53cab7d8d2e9a20e3cd087ee3f9230bac5fbed9fb1170ac651fa96390b789079
Instruction Fuzzy Hash: DE216D71204244AFDB14DF69D882F577BECEF89714F51846AF908DB292C678ED10CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 004248D4, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

CreateFontA.GDI32(?,00000000,00000000,00000000,00000190,00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,00000000), ref: 0042492D
CreateFontA.GDI32(?,00000000,00000000,00000000,00000190,00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,MS Sans Serif), ref: 00424957

Strings

MS Sans Serif, xrefs: 00424938

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: CreateFont
String ID: MS Sans Serif
API String ID: 1830492434-168460110
Opcode ID: f89f0895e41812514041ddcca525e1f7c5f35d48006dafca22d1f8f7d45cf52c
Instruction ID: b283902c23064c77dacff4d557f271f56f8165b239726fa61cbeb7dfca121dc0
Opcode Fuzzy Hash: f89f0895e41812514041ddcca525e1f7c5f35d48006dafca22d1f8f7d45cf52c
Instruction Fuzzy Hash: 72114CB07C47187AF631A625AC53F6B669CC786F58FB20466BB00BF2C1D6E97D00526C

Uniqueness

Uniqueness Score: -1.00%

Function 0043A874, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(B70F0B2A,00000000,0043A8EA,B70F0B42,00000000), ref: 0043A894
SystemTimeToFileTime.KERNEL32(B70F0B2A,B70F0B3A,B70F0B2A,00000000,0043A8EA,B70F0B42,00000000), ref: 0043A8A1

Strings

@madExcept>, xrefs: 0043A8C0

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: Time$System$File
String ID: @madExcept>
API String ID: 2838179519-2072251058
Opcode ID: 54e788ebe961d1a14942800d32ec4af3b20eeb0b29f5530c95810601b65f6d0d
Instruction ID: c574a8e7f197a642d6d52c84c3cf6af38a8b6244ca983341b788b5946a4d1509
Opcode Fuzzy Hash: 54e788ebe961d1a14942800d32ec4af3b20eeb0b29f5530c95810601b65f6d0d
Instruction Fuzzy Hash: AD01A771A04209AFDB05EBA5CC52DDEF7BDEB88304F514436F500E3291DA3C95168665

Uniqueness

Uniqueness Score: -1.00%

Function 0068E978, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31
COMMON

Download Yara Rule

C-Code - Quality: 65%

			E0068E978(void* __ecx) {
				CHAR* _v8;
				char _v12;
				signed int _t18;

				_push(__ecx);
				_push(__ecx);
				_v12 = E0068E6F9(__ecx, 0x105);
				_t2 =  &_v12; // 0x68ea32
				_v8 =  *_t2;
				_t18 = 0x41;
				memset(_v8, 0, _t18 << 2);
				asm("stosb");
				if(GetModuleFileNameA(GetModuleHandleA(0), _v8, 0x104) == 0) {
					E0068E6E1(_t13, 0xef000012);
				}
				return _v8;
			}

0x0068e97b
0x0068e97c
0x0068e989
0x0068e98c
0x0068e98f
0x0068e994
0x0068e99a
0x0068e99c
0x0068e9b6
0x0068e9bd
0x0068e9bd
0x0068e9c7

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104,?,?,?,?,0068EA32,?,?,?,0068D02B,00000000), ref: 0068E9A7
GetModuleFileNameA.KERNEL32(00000000,?,?,?,?,0068EA32,?,?,?,0068D02B,00000000), ref: 0068E9AE

Part of subcall function 0068E6E1: RaiseException.KERNEL32(00000000,00000000,00000000,00000000,EF00000D,?,0068E777,024B0488,?,0068E703,024B0488,024B0488,?,00688580,00000068), ref: 0068E6F1

Strings

2h, xrefs: 0068E98C

Memory Dump Source

Source File: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: Module$ExceptionFileHandleNameRaise
String ID: 2h
API String ID: 1728487212-1340067111
Opcode ID: 3ceee1dd2f621950e323722cb6026c21b5abbe8241eba17536c2fab1ff990bc8
Instruction ID: 39cc27cd696208977c5bbf476feb69712a3c2600a7ec5273ce1ead1d372b6155
Opcode Fuzzy Hash: 3ceee1dd2f621950e323722cb6026c21b5abbe8241eba17536c2fab1ff990bc8
Instruction Fuzzy Hash: 6EF03771B00204BFDF44EFE9DC46A9D77BADB44710F100159F605D6281E6F15E909714

Uniqueness

Uniqueness Score: -1.00%

Function 00438C80, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,00000000,InternetGetConnectedState,wininet.dll,?,-00000001,00000000,0043DAA3), ref: 00438CB6

Strings

wininet.dll, xrefs: 00438C83
InternetGetConnectedState, xrefs: 00438C8F

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID: InternetGetConnectedState$wininet.dll
API String ID: 3664257935-596207600
Opcode ID: e59751470d5d26d60e7e173a1f44e6a9e7c316e99b22d6b4d1203cf659e29a1f
Instruction ID: 4ca9f8c7ee16214017bfaab395b57ec9ed8696ad72bb100aea6334ebd5df06b4
Opcode Fuzzy Hash: e59751470d5d26d60e7e173a1f44e6a9e7c316e99b22d6b4d1203cf659e29a1f
Instruction Fuzzy Hash: 45E08611B0AB123AA21162F60D81FBF818C8B49354F10743FB900E6281EEACEC0573BE

Uniqueness

Uniqueness Score: -1.00%

Function 00401B5C, Relevance: 5.0, APIs: 4, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(006065C8,00000000,00401C12,?,?,004023F6,02647FFC,00001150,00000000,?,?,00401DE5,00401DFA,00401F4B), ref: 00401B72
EnterCriticalSection.KERNEL32(006065C8,006065C8,00000000,00401C12,?,?,004023F6,02647FFC,00001150,00000000,?,?,00401DE5,00401DFA,00401F4B), ref: 00401B85
LocalAlloc.KERNEL32(00000000,00000FF8,006065C8,00000000,00401C12,?,?,004023F6,02647FFC,00001150,00000000,?,?,00401DE5,00401DFA,00401F4B), ref: 00401BAF
LeaveCriticalSection.KERNEL32(006065C8,00401C19,00000000,00401C12,?,?,004023F6,02647FFC,00001150,00000000,?,?,00401DE5,00401DFA,00401F4B), ref: 00401C0C

Memory Dump Source

Source File: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: CriticalSection$AllocEnterInitializeLeaveLocal
String ID:
API String ID: 730355536-0
Opcode ID: 005e12c1676a6c06027b5989c53f5e188c4d05d89083241b3521b0cdc3bc4812
Instruction ID: f8c97ea0b5d985f243c5f93e84b6751703d72cd10dd25517e3de6ea68c011d8c
Opcode Fuzzy Hash: 005e12c1676a6c06027b5989c53f5e188c4d05d89083241b3521b0cdc3bc4812
Instruction Fuzzy Hash: 2601D6701C46405EE31AAF29DC067173ED6E78A708F40443EF001AB2F1DABD8860C75A

Uniqueness

Uniqueness Score: -1.00%

Function 00688240, Relevance: 5.0, APIs: 4, Instructions: 27
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E00688240(struct _CRITICAL_SECTION* __ecx) {
				struct _CRITICAL_SECTION* _v8;

				_push(__ecx);
				_v8 = __ecx;
				 *((intOrPtr*)(_v8 + 0x60)) = 0;
				 *((intOrPtr*)(_v8 + 0x64)) = 0;
				InitializeCriticalSection(_v8);
				InitializeCriticalSection(_v8 + 0x18);
				InitializeCriticalSection(_v8 + 0x30);
				InitializeCriticalSection(_v8 + 0x48);
				return _v8;
			}

0x00688243
0x00688244
0x0068824a
0x00688254
0x0068825f
0x0068826c
0x00688279
0x00688286
0x00688292

APIs

InitializeCriticalSection.KERNEL32(00000000,00000000), ref: 0068825F
InitializeCriticalSection.KERNEL32(-00000018), ref: 0068826C
InitializeCriticalSection.KERNEL32(-00000030), ref: 00688279
InitializeCriticalSection.KERNEL32(-00000048), ref: 00688286

Memory Dump Source

Source File: 00000000.00000002.932242058.0000000000688000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.931974315.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.931984957.0000000000401000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.932199946.0000000000637000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.932256445.0000000000693000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_njw.jbxd

Yara matches

Similarity

API ID: CriticalInitializeSection
String ID:
API String ID: 32694325-0
Opcode ID: 274f5669fe50b6e2d1d9705d061411af5feb26e9d31ec1585b91964e9da08499
Instruction ID: 1dc7b8de878bb0b43b31c6e804c54fbe5212c4b89aa1f7313e32c244b3e0c902
Opcode Fuzzy Hash: 274f5669fe50b6e2d1d9705d061411af5feb26e9d31ec1585b91964e9da08499
Instruction Fuzzy Hash: 10F074B890031CEBCB04DF98DA58B5EB7B9BB48305F204189E805A3751C735AF11EF94

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	API monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report njw.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

Jbx Signature Overview

AV Detection:

Compliance:

Spreading:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

ICMP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

Function 0042AC1C, Relevance: 33.5, APIs: 12, Strings: 7, Instructions: 226
COMMON

Function 0040648C, Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 184
registrystringlibraryCOMMON

Function 0041CE14, Relevance: 19.6, APIs: 3, Strings: 8, Instructions: 352
COMMON

Function 0042EB98, Relevance: 16.7, APIs: 3, Strings: 8, Instructions: 156
memoryCOMMON

Function 00406598, Relevance: 15.1, APIs: 10, Instructions: 98
stringlibrarythreadCOMMON

Function 0068EF5E, Relevance: 1.5, APIs: 1, Instructions: 6
COMMON

Function 006882A0, Relevance: 31.8, APIs: 16, Strings: 2, Instructions: 252
memorylibraryloaderCOMMON

Function 00445B6C, Relevance: 30.0, APIs: 13, Strings: 4, Instructions: 228
threadCOMMON

Function 0068CF7A, Relevance: 28.6, APIs: 14, Strings: 2, Instructions: 648
libraryCOMMON

Function 0043CB40, Relevance: 26.7, APIs: 3, Strings: 12, Instructions: 495
filewindowCOMMON

Function 0042BBB8, Relevance: 24.2, APIs: 16, Instructions: 224
memorysynchronizationCOMMON

Function 0042E7FC, Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 124
windowCOMMON

Function 0044D104, Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 281
COMMON

Function 0040BA70, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 102
synchronizationthreadCOMMON

Function 0042B538, Relevance: 9.1, APIs: 6, Instructions: 93
registrymemoryCOMMON

Function 0044CD40, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 105
memoryCOMMON

Function 0068CC49, Relevance: 6.0, APIs: 4, Instructions: 46
libraryCOMMON

Function 0068C930, Relevance: 3.0, APIs: 2, Instructions: 44
memoryCOMMON

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre