Edit tour

Windows Analysis Report
EACore.dll

Overview

General Information

Sample name:	EACore.dll
Analysis ID:	1524375
MD5:	2554e4864294dc96a5b4548dd42c7189
SHA1:	8e3b3c600ab812537a84409adfc5169518862fd3
SHA256:	b25c79ba507a256c9ca12a9bd34def6a33f9c087578c03d083d7863c708eca21
Tags:	CeranaKeeperdlluser-JAMESWT_MHT
Infos:

Detection

Score:	56
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Found decision node followed by non-executed suspicious APIs

Found large amount of non-executed APIs

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Tries to resolve domain names, but no domain seems valid (expired dropper behavior)

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

loaddll32.exe (PID: 7472 cmdline: loaddll32.exe "C:\Users\user\Desktop\EACore.dll" MD5: 51E6071F9CBA48E79F10C84515AAE618)

conhost.exe (PID: 7480 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7520 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\EACore.dll",#1 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

rundll32.exe (PID: 7548 cmdline: rundll32.exe "C:\Users\user\Desktop\EACore.dll",#1 MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7532 cmdline: rundll32.exe C:\Users\user\Desktop\EACore.dll,AgentAdd MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7596 cmdline: rundll32.exe C:\Users\user\Desktop\EACore.dll,AgentRemove MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7620 cmdline: rundll32.exe C:\Users\user\Desktop\EACore.dll,AgentTaskAdd MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7644 cmdline: rundll32.exe "C:\Users\user\Desktop\EACore.dll",AgentAdd MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7652 cmdline: rundll32.exe "C:\Users\user\Desktop\EACore.dll",AgentRemove MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7660 cmdline: rundll32.exe "C:\Users\user\Desktop\EACore.dll",AgentTaskAdd MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7668 cmdline: rundll32.exe "C:\Users\user\Desktop\EACore.dll",ViewSetContentFilters MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7684 cmdline: rundll32.exe "C:\Users\user\Desktop\EACore.dll",UserLogout MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7692 cmdline: rundll32.exe "C:\Users\user\Desktop\EACore.dll",UserLogin MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7712 cmdline: rundll32.exe "C:\Users\user\Desktop\EACore.dll",UserIsLoggedIn MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7724 cmdline: rundll32.exe "C:\Users\user\Desktop\EACore.dll",UserGetNames MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7736 cmdline: rundll32.exe "C:\Users\user\Desktop\EACore.dll",UserGetEntitlements MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7748 cmdline: rundll32.exe "C:\Users\user\Desktop\EACore.dll",UserEnumContent MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7760 cmdline: rundll32.exe "C:\Users\user\Desktop\EACore.dll",StateSetTag MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7772 cmdline: rundll32.exe "C:\Users\user\Desktop\EACore.dll",StateSetProperty MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7784 cmdline: rundll32.exe "C:\Users\user\Desktop\EACore.dll",StateGet MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7836 cmdline: rundll32.exe "C:\Users\user\Desktop\EACore.dll",ItemUse MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7844 cmdline: rundll32.exe "C:\Users\user\Desktop\EACore.dll",ItemUnpackStart MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7860 cmdline: rundll32.exe "C:\Users\user\Desktop\EACore.dll",ItemUnpackCancel MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7872 cmdline: rundll32.exe "C:\Users\user\Desktop\EACore.dll",ItemInstallStartBatch MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7904 cmdline: rundll32.exe "C:\Users\user\Desktop\EACore.dll",ItemInstallStart MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7916 cmdline: rundll32.exe "C:\Users\user\Desktop\EACore.dll",ItemGetStatus MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7924 cmdline: rundll32.exe "C:\Users\user\Desktop\EACore.dll",ItemEnumPatches MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7932 cmdline: rundll32.exe "C:\Users\user\Desktop\EACore.dll",ItemDownloadTogglePauseState MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7940 cmdline: rundll32.exe "C:\Users\user\Desktop\EACore.dll",ItemDownloadStart MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7948 cmdline: rundll32.exe "C:\Users\user\Desktop\EACore.dll",ItemDownloadCancel MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7960 cmdline: rundll32.exe "C:\Users\user\Desktop\EACore.dll",ItemDecryptStart MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7972 cmdline: rundll32.exe "C:\Users\user\Desktop\EACore.dll",ItemDecryptCancel MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 8000 cmdline: rundll32.exe "C:\Users\user\Desktop\EACore.dll",ItemClearCache MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 8012 cmdline: rundll32.exe "C:\Users\user\Desktop\EACore.dll",IsConnected MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 8024 cmdline: rundll32.exe "C:\Users\user\Desktop\EACore.dll",Disconnect MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 8040 cmdline: rundll32.exe "C:\Users\user\Desktop\EACore.dll",Connect3 MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 8052 cmdline: rundll32.exe "C:\Users\user\Desktop\EACore.dll",Connect MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 8060 cmdline: rundll32.exe "C:\Users\user\Desktop\EACore.dll",Command MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 8124 cmdline: rundll32.exe "C:\Users\user\Desktop\EACore.dll",AgentTaskStatusSet MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 8136 cmdline: rundll32.exe "C:\Users\user\Desktop\EACore.dll",AgentTaskStatusGet MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 8164 cmdline: rundll32.exe "C:\Users\user\Desktop\EACore.dll",AgentTaskRemove MD5: 889B99C52A60DD49227C5E485A016679)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: EACore.dll

Avira: detected

Multi AV Scanner detection for submitted file

Source: EACore.dll

ReversingLabs: Detection: 39%

Source: EACore.dll

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE, DLL

Source: EACore.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: C:\Users\admin\source\repos\YK0130\Release\YK0130.pdb` source: rundll32.exe, 00000021.00000002.2920624747.000000006E354000.00000002.00000001.01000000.00000003.sdmp, EACore.dll
Source:	Binary string: C:\Users\admin\source\repos\YK0130\Release\YK0130.pdb source: rundll32.exe, 00000021.00000002.2920624747.000000006E354000.00000002.00000001.01000000.00000003.sdmp, EACore.dll

Source: unknown

DNS traffic detected: query: www.toptipvideo.com replaycode: Name error (3)

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 33_2_6E349A60 recv,

33_2_6E349A60

Source: global traffic

DNS traffic detected: DNS query: www.toptipvideo.com

Source: EACore.dll

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE, DLL

Source: classification engine

Classification label: mal56.winDLL@80/0@35/0

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7480:120:WilError_03
Source: C:\Windows\SysWOW64\rundll32.exe	Mutant created: \Sessions\1\BaseNamedObjects\Mutex8565865865

Source: EACore.dll

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\EACore.dll,AgentAdd

Source: EACore.dll

ReversingLabs: Detection: 39%

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\EACore.dll"
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\EACore.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\EACore.dll,AgentAdd
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\EACore.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\EACore.dll,AgentRemove
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\EACore.dll,AgentTaskAdd
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\EACore.dll",AgentAdd
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\EACore.dll",AgentRemove
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\EACore.dll",AgentTaskAdd
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\EACore.dll",ViewSetContentFilters
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\EACore.dll",UserLogout
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\EACore.dll",UserLogin
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\EACore.dll",UserIsLoggedIn
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\EACore.dll",UserGetNames
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\EACore.dll",UserGetEntitlements
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\EACore.dll",UserEnumContent
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\EACore.dll",StateSetTag
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\EACore.dll",StateSetProperty
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\EACore.dll",StateGet
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\EACore.dll",ItemUse
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\EACore.dll",ItemUnpackStart
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\EACore.dll",ItemUnpackCancel
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\EACore.dll",ItemInstallStartBatch
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\EACore.dll",ItemInstallStart
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\EACore.dll",ItemGetStatus
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\EACore.dll",ItemEnumPatches
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\EACore.dll",ItemDownloadTogglePauseState
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\EACore.dll",ItemDownloadStart
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\EACore.dll",ItemDownloadCancel
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\EACore.dll",ItemDecryptStart
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\EACore.dll",ItemDecryptCancel
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\EACore.dll",ItemClearCache
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\EACore.dll",IsConnected
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\EACore.dll",Disconnect
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\EACore.dll",Connect3
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\EACore.dll",Connect
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\EACore.dll",Command
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\EACore.dll",AgentTaskStatusSet
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\EACore.dll",AgentTaskStatusGet
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\EACore.dll",AgentTaskRemove
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\EACore.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\EACore.dll,AgentAdd	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\EACore.dll,AgentRemove	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\EACore.dll,AgentTaskAdd	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\EACore.dll",AgentAdd	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\EACore.dll",AgentRemove	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\EACore.dll",AgentTaskAdd	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\EACore.dll",ViewSetContentFilters	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\EACore.dll",UserLogout	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\EACore.dll",UserLogin	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\EACore.dll",UserIsLoggedIn	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\EACore.dll",UserGetNames	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\EACore.dll",UserGetEntitlements	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\EACore.dll",UserEnumContent	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\EACore.dll",StateSetTag	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\EACore.dll",StateSetProperty	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\EACore.dll",StateGet	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\EACore.dll",ItemUse	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\EACore.dll",ItemUnpackStart	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\EACore.dll",ItemUnpackCancel	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\EACore.dll",ItemInstallStartBatch	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\EACore.dll",ItemInstallStart	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\EACore.dll",ItemGetStatus	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\EACore.dll",ItemEnumPatches	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\EACore.dll",ItemDownloadTogglePauseState	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\EACore.dll",ItemDownloadStart	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\EACore.dll",ItemDownloadCancel	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\EACore.dll",ItemDecryptStart	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\EACore.dll",ItemDecryptCancel	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\EACore.dll",ItemClearCache	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\EACore.dll",IsConnected	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\EACore.dll",Disconnect	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\EACore.dll",Connect3	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\EACore.dll",Connect	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\EACore.dll",Command	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\EACore.dll",AgentTaskStatusSet	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\EACore.dll",AgentTaskStatusGet	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\EACore.dll",AgentTaskRemove	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\EACore.dll",#1	Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior

Source: EACore.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: EACore.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: EACore.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: EACore.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: EACore.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: EACore.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: EACore.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source: EACore.dll

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\Users\admin\source\repos\YK0130\Release\YK0130.pdb` source: rundll32.exe, 00000021.00000002.2920624747.000000006E354000.00000002.00000001.01000000.00000003.sdmp, EACore.dll
Source:	Binary string: C:\Users\admin\source\repos\YK0130\Release\YK0130.pdb source: rundll32.exe, 00000021.00000002.2920624747.000000006E354000.00000002.00000001.01000000.00000003.sdmp, EACore.dll

Source: EACore.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: EACore.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: EACore.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: EACore.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: EACore.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: EACore.dll

Static PE information: section name: .00cfg

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 33_2_6E343910 push eax; mov dword ptr [esp], ecx	33_2_6E343915
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 33_2_6E342E00 push eax; mov dword ptr [esp], ecx	33_2_6E342E03
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 33_2_6E351E50 push eax; mov dword ptr [esp], ecx	33_2_6E351E53
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 33_2_6E344EA0 push eax; mov dword ptr [esp], ecx	33_2_6E344EA2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 33_2_6E342EF0 push eax; mov dword ptr [esp], ecx	33_2_6E342EF3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 33_2_6E34E4D0 push eax; mov dword ptr [esp], ecx	33_2_6E34E4D3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 33_2_6E342F60 push eax; mov dword ptr [esp], ecx	33_2_6E342F63
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 33_2_6E349580 push eax; mov dword ptr [esp], ecx	33_2_6E349585

Source: EACore.dll

Static PE information: section name: .text entropy: 6.9068504888777

Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\SysWOW64\rundll32.exe

Thread delayed: delay time: 1800000

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

graph_33-6222

Source: C:\Windows\SysWOW64\rundll32.exe

API coverage: 4.9 %

Source: C:\Windows\SysWOW64\rundll32.exe TID: 8016	Thread sleep count: 35 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 8016	Thread sleep time: -70000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 8016	Thread sleep time: -21600000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed

Source: C:\Windows\System32\loaddll32.exe	Thread delayed: delay time: 120000			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 1800000			Jump to behavior

Source: rundll32.exe, 00000021.00000002.2920322058.0000000002C1F000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\SysWOW64\rundll32.exe

API call chain: ExitProcess graph end node

graph_33-5453

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 33_2_6E352F3A IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

33_2_6E352F3A

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 33_2_6E352F3A IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		33_2_6E352F3A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 33_2_6E3527F0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		33_2_6E3527F0

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\EACore.dll",#1

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 33_2_6E353127 cpuid

33_2_6E353127

Source: C:\Windows\SysWOW64\rundll32.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 33_2_6E352BC6 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

33_2_6E352BC6

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 33_2_6E349F20 GetUserNameA,lstrlenA,

33_2_6E349F20

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	11 Process Injection	21 Virtualization/Sandbox Evasion	OS Credential Dumping	1 System Time Discovery	Remote Services	Data from Local System	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	11 Process Injection	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	2 Obfuscated Files or Information	Security Account Manager	21 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Rundll32	NTDS	1 Account Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Software Packing	LSA Secrets	1 System Owner/User Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	22 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
EACore.dll	39%	ReversingLabs	Win32.Trojan.Generic
EACore.dll	100%	Avira	TR/Agent.tcdnf

Name	IP	Active	Malicious	Antivirus Detection	Reputation
www.toptipvideo.com	unknown	unknown	false		unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1524375
Start date and time:	2024-10-02 18:24:26 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 10s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	42
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	EACore.dll
Detection:	MAL
Classification:	mal56.winDLL@80/0@35/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 10 Number of non-executed functions: 35
Cookbook Comments:	Found application associated with file extension: .dll

Warnings

Exclude process from analysis (whitelisted): SIHClient.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
VT rate limit hit for: EACore.dll

Simulations

Behavior and APIs

Time	Type	Description
12:25:28	API Interceptor	1x Sleep call for process: loaddll32.exe modified
12:25:34	API Interceptor	12x Sleep call for process: rundll32.exe modified

File type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.7858962988515925
TrID:	Win32 Dynamic Link Library (generic) (1002004/3) 99.60% Generic Win/DOS Executable (2004/3) 0.20% DOS Executable Generic (2002/1) 0.20% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	EACore.dll
File size:	90'624 bytes
MD5:	2554e4864294dc96a5b4548dd42c7189
SHA1:	8e3b3c600ab812537a84409adfc5169518862fd3
SHA256:	b25c79ba507a256c9ca12a9bd34def6a33f9c087578c03d083d7863c708eca21
SHA512:	d8074bb68791560027d6e391110a36b6de604d6b73829bd1b1b89476f2e0a53398d6611129f3782a92b935115589763248fb90b6ba74ec5abb6d81dec3c12c1a
SSDEEP:	1536:9gSxD3zFkkt0h0BJVSIKMDSiAJtaNQ2hyAr+u6IHnQz0SuRPeJPqHO4LyFffbGqS:9gSNxkka0BRKMDSiAJtChyAr+u6IHnQq
TLSH:	DB934C8676C3B0FBD38F40F5102AD22BA7256A309B101EF3E694DD7899A13C15971B7B
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...*..d...........!.....&...8......X+....................................................@.........................$O.......R.....

File Icon


Icon Hash:	7ae282899bbab082

Static PE Info

General

Entrypoint:	0x10012b58
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x10000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE, DLL
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x64EEB12A [Wed Aug 30 03:02:02 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	d7b40c7a58929630429c343781a071bd

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
cmp dword ptr [ebp+0Ch], 01h
jne 00007F13D4ABADF7h
call 00007F13D4ABAE0Ah
push dword ptr [ebp+10h]
push dword ptr [ebp+0Ch]
push dword ptr [ebp+08h]
call 00007F13D4ABACCEh
add esp, 0Ch
pop ebp
retn 000Ch
mov ecx, dword ptr [10017330h]
push esi
push edi
mov edi, BB40E64Eh
mov esi, FFFF0000h
cmp ecx, edi
je 00007F13D4ABADF6h
test esi, ecx
jne 00007F13D4ABAE18h
call 00007F13D4ABAE21h
mov ecx, eax
cmp ecx, edi
jne 00007F13D4ABADF9h
mov ecx, BB40E64Fh
jmp 00007F13D4ABAE00h
test esi, ecx
jne 00007F13D4ABADFCh
or eax, 00004711h
shl eax, 10h
or ecx, eax
mov dword ptr [10017330h], ecx
not ecx
pop edi
mov dword ptr [1001732Ch], ecx
pop esi
ret
push ebp
mov ebp, esp
sub esp, 14h
and dword ptr [ebp-0Ch], 00000000h
lea eax, dword ptr [ebp-0Ch]
and dword ptr [ebp-08h], 00000000h
push eax
call dword ptr [10015540h]
mov eax, dword ptr [ebp-08h]
xor eax, dword ptr [ebp-0Ch]
mov dword ptr [ebp-04h], eax
call dword ptr [10015538h]
xor dword ptr [ebp-04h], eax
call dword ptr [10015534h]
xor dword ptr [ebp-04h], eax
lea eax, dword ptr [ebp-14h]
push eax
call dword ptr [10015560h]
mov eax, dword ptr [ebp-10h]
lea ecx, dword ptr [ebp-04h]
xor eax, dword ptr [ebp-14h]
xor eax, dword ptr [ebp-04h]
xor eax, ecx
leave
ret
push 10017698h
call dword ptr [1001554Ch]
ret

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x14f24	0x386	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x152aa	0xc8	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x19000	0xe8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1a000	0x740	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x14e54	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x147d8	0xbc	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x15514	0x1a0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x12470	0x12600	9165d72b02e63e520899156da7d23d1f	False	0.5031090561224489	data	6.9068504888777	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x14000	0x262c	0x2800	b90072950bf4f3684e5e89fb65cf945d	False	0.34951171875	data	5.066255958576898	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x17000	0x6ec	0x400	0ade64011f16b75e4e262084d81defc4	False	0.2451171875	data	3.955903511120874	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.00cfg	0x18000	0x4	0x200	55b14440e19e0e31e878405a13dfbbf9	False	0.033203125	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x19000	0xe8	0x200	d8d5560c7c0e8b679ab25180f1113416	False	0.306640625	data	2.344915704357875	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x1a000	0x740	0x800	f2064fe2de19efe9376d521d83d87cbf	False	0.775390625	data	6.016678031703543	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x19060	0x87	XML 1.0 document, ASCII text	English	United States	0.8222222222222222

Imports

DLL	Import
KERNEL32.dll	CloseHandle, CreateMutexA, CreateProcessW, DeleteCriticalSection, EnterCriticalSection, ExitProcess, GetComputerNameA, GetCurrentProcess, GetCurrentProcessId, GetCurrentThreadId, GetModuleFileNameW, GetSystemTimeAsFileTime, GetVolumeInformationA, InitializeCriticalSection, InitializeSListHead, IsDebuggerPresent, IsProcessorFeaturePresent, LeaveCriticalSection, OpenMutexA, QueryPerformanceCounter, SetUnhandledExceptionFilter, Sleep, TerminateProcess, UnhandledExceptionFilter, WaitForSingleObject, lstrlenA
ADVAPI32.dll	GetUserNameA
MSVCP140.dll	??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ, ??0ios_base@std@@IAE@XZ, ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ, ??1ios_base@std@@UAE@XZ, ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z, ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ, ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ, ?_Random_device@std@@YAIXZ, ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ, ?_Xinvalid_argument@std@@YAXPBD@Z, ?_Xlength_error@std@@YAXPBD@Z, ?_Xout_of_range@std@@YAXPBD@Z, ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z, ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ, ?good@ios_base@std@@QBE_NXZ, ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z, ?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IAEXPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z, ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z, ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ, ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z, ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ, ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ, ?uncaught_exception@std@@YA_NXZ, ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z, ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
WS2_32.dll	WSAStartup, closesocket, connect, gethostbyname, htons, inet_addr, inet_ntoa, recv, send, setsockopt, shutdown, socket
VCRUNTIME140.dll	_CxxThrowException, __CxxFrameHandler3, __std_exception_copy, __std_exception_destroy, __std_terminate, __std_type_info_destroy_list, _except_handler4_common, _purecall, memchr, memcmp, memcpy, memmove, memset
api-ms-win-crt-heap-l1-1-0.dll	_callnewh, free, malloc
api-ms-win-crt-runtime-l1-1-0.dll	_beginthread, _cexit, _configure_narrow_argv, _endthread, _errno, _execute_onexit_table, _initialize_narrow_environment, _initialize_onexit_table, _initterm, _initterm_e, _invalid_parameter_noinfo_noreturn, _seh_filter_dll
api-ms-win-crt-convert-l1-1-0.dll	strtol
api-ms-win-crt-string-l1-1-0.dll	strlen, wcslen

Exports

Name	Ordinal	Address
AgentAdd	1	0x10001000
AgentRemove	2	0x10001000
AgentTaskAdd	3	0x10001000
AgentTaskRemove	4	0x10001000
AgentTaskStatusGet	5	0x10001000
AgentTaskStatusSet	6	0x10001000
Command	7	0x10001000
Connect	8	0x10001000
Connect3	9	0x10001000
Disconnect	10	0x10001000
IsConnected	11	0x10001010
ItemClearCache	12	0x10001000
ItemDecryptCancel	13	0x10001000
ItemDecryptStart	14	0x10001000
ItemDownloadCancel	15	0x10001000
ItemDownloadStart	16	0x10001000
ItemDownloadTogglePauseState	17	0x10001000
ItemEnumPatches	18	0x10001000
ItemGetStatus	19	0x10001000
ItemInstallStart	20	0x10001000
ItemInstallStartBatch	21	0x10001000
ItemUnpackCancel	22	0x10001000
ItemUnpackStart	23	0x10001000
ItemUse	24	0x10001000
StateGet	25	0x10001000
StateSetProperty	26	0x10001000
StateSetTag	27	0x10001000
UserEnumContent	28	0x10001000
UserGetEntitlements	29	0x10001000
UserGetNames	30	0x10001000
UserIsLoggedIn	31	0x10001000
UserLogin	32	0x10001000
UserLogout	33	0x10001000
ViewSetContentFilters	34	0x10001000

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 2, 2024 18:25:29.308029890 CEST	64297	53	192.168.2.4	1.1.1.1
Oct 2, 2024 18:25:29.321520090 CEST	53	64297	1.1.1.1	192.168.2.4
Oct 2, 2024 18:25:35.491889000 CEST	52067	53	192.168.2.4	1.1.1.1
Oct 2, 2024 18:25:35.502222061 CEST	53	52067	1.1.1.1	192.168.2.4
Oct 2, 2024 18:25:41.648597956 CEST	51037	53	192.168.2.4	1.1.1.1
Oct 2, 2024 18:25:41.659759998 CEST	53	51037	1.1.1.1	192.168.2.4
Oct 2, 2024 18:25:47.804610968 CEST	65327	53	192.168.2.4	1.1.1.1
Oct 2, 2024 18:25:47.822385073 CEST	53	65327	1.1.1.1	192.168.2.4
Oct 2, 2024 18:25:53.977952003 CEST	53236	53	192.168.2.4	1.1.1.1
Oct 2, 2024 18:25:53.990899086 CEST	53	53236	1.1.1.1	192.168.2.4
Oct 2, 2024 18:26:00.172275066 CEST	49524	53	192.168.2.4	1.1.1.1
Oct 2, 2024 18:26:00.202981949 CEST	53	49524	1.1.1.1	192.168.2.4
Oct 2, 2024 18:26:04.226437092 CEST	52108	53	192.168.2.4	1.1.1.1
Oct 2, 2024 18:26:04.342066050 CEST	53	52108	1.1.1.1	192.168.2.4
Oct 2, 2024 18:26:10.492182970 CEST	54794	53	192.168.2.4	1.1.1.1
Oct 2, 2024 18:26:10.502648115 CEST	53	54794	1.1.1.1	192.168.2.4
Oct 2, 2024 18:26:16.648518085 CEST	59636	53	192.168.2.4	1.1.1.1
Oct 2, 2024 18:26:17.039787054 CEST	53	59636	1.1.1.1	192.168.2.4
Oct 2, 2024 18:26:23.195262909 CEST	56951	53	192.168.2.4	1.1.1.1
Oct 2, 2024 18:26:24.211215973 CEST	56951	53	192.168.2.4	1.1.1.1
Oct 2, 2024 18:26:25.210892916 CEST	56951	53	192.168.2.4	1.1.1.1
Oct 2, 2024 18:26:27.231678009 CEST	56951	53	192.168.2.4	1.1.1.1
Oct 2, 2024 18:26:31.226234913 CEST	56951	53	192.168.2.4	1.1.1.1
Oct 2, 2024 18:26:35.243419886 CEST	55369	53	192.168.2.4	1.1.1.1
Oct 2, 2024 18:26:36.257520914 CEST	55369	53	192.168.2.4	1.1.1.1
Oct 2, 2024 18:26:36.361794949 CEST	53	55369	1.1.1.1	192.168.2.4
Oct 2, 2024 18:26:37.368302107 CEST	58159	53	192.168.2.4	1.1.1.1
Oct 2, 2024 18:26:38.382728100 CEST	58159	53	192.168.2.4	1.1.1.1
Oct 2, 2024 18:26:39.398127079 CEST	58159	53	192.168.2.4	1.1.1.1
Oct 2, 2024 18:26:41.413738012 CEST	58159	53	192.168.2.4	1.1.1.1
Oct 2, 2024 18:26:45.429389000 CEST	58159	53	192.168.2.4	1.1.1.1
Oct 2, 2024 18:26:49.430061102 CEST	52683	53	192.168.2.4	1.1.1.1
Oct 2, 2024 18:26:50.445240021 CEST	52683	53	192.168.2.4	1.1.1.1
Oct 2, 2024 18:26:51.445679903 CEST	52683	53	192.168.2.4	1.1.1.1
Oct 2, 2024 18:26:53.445229053 CEST	52683	53	192.168.2.4	1.1.1.1
Oct 2, 2024 18:26:53.670322895 CEST	53	52683	1.1.1.1	192.168.2.4
Oct 2, 2024 18:26:57.804871082 CEST	56073	53	192.168.2.4	1.1.1.1
Oct 2, 2024 18:26:58.804619074 CEST	56073	53	192.168.2.4	1.1.1.1
Oct 2, 2024 18:26:59.804692984 CEST	56073	53	192.168.2.4	1.1.1.1
Oct 2, 2024 18:27:01.804570913 CEST	56073	53	192.168.2.4	1.1.1.1
Oct 2, 2024 18:27:05.820949078 CEST	56073	53	192.168.2.4	1.1.1.1
Oct 2, 2024 18:27:09.836880922 CEST	63904	53	192.168.2.4	1.1.1.1
Oct 2, 2024 18:27:10.836477995 CEST	63904	53	192.168.2.4	1.1.1.1
Oct 2, 2024 18:27:11.852399111 CEST	63904	53	192.168.2.4	1.1.1.1
Oct 2, 2024 18:27:11.910135031 CEST	53	63904	1.1.1.1	192.168.2.4
Oct 2, 2024 18:27:18.056669950 CEST	63941	53	192.168.2.4	1.1.1.1
Oct 2, 2024 18:27:18.123241901 CEST	53	63941	1.1.1.1	192.168.2.4
Oct 2, 2024 18:27:22.259082079 CEST	56838	53	192.168.2.4	1.1.1.1
Oct 2, 2024 18:27:22.290612936 CEST	53	56838	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 2, 2024 18:25:29.308029890 CEST	192.168.2.4	1.1.1.1	0xa2f7	Standard query (0)	www.toptipvideo.com	A (IP address)	IN (0x0001)	false
Oct 2, 2024 18:25:35.491889000 CEST	192.168.2.4	1.1.1.1	0xacc5	Standard query (0)	www.toptipvideo.com	A (IP address)	IN (0x0001)	false
Oct 2, 2024 18:25:41.648597956 CEST	192.168.2.4	1.1.1.1	0x9cd1	Standard query (0)	www.toptipvideo.com	A (IP address)	IN (0x0001)	false
Oct 2, 2024 18:25:47.804610968 CEST	192.168.2.4	1.1.1.1	0x91d	Standard query (0)	www.toptipvideo.com	A (IP address)	IN (0x0001)	false
Oct 2, 2024 18:25:53.977952003 CEST	192.168.2.4	1.1.1.1	0xada6	Standard query (0)	www.toptipvideo.com	A (IP address)	IN (0x0001)	false
Oct 2, 2024 18:26:00.172275066 CEST	192.168.2.4	1.1.1.1	0xacea	Standard query (0)	www.toptipvideo.com	A (IP address)	IN (0x0001)	false
Oct 2, 2024 18:26:04.226437092 CEST	192.168.2.4	1.1.1.1	0xe08d	Standard query (0)	www.toptipvideo.com	A (IP address)	IN (0x0001)	false
Oct 2, 2024 18:26:10.492182970 CEST	192.168.2.4	1.1.1.1	0x16ed	Standard query (0)	www.toptipvideo.com	A (IP address)	IN (0x0001)	false
Oct 2, 2024 18:26:16.648518085 CEST	192.168.2.4	1.1.1.1	0x3878	Standard query (0)	www.toptipvideo.com	A (IP address)	IN (0x0001)	false
Oct 2, 2024 18:26:23.195262909 CEST	192.168.2.4	1.1.1.1	0x1779	Standard query (0)	www.toptipvideo.com	A (IP address)	IN (0x0001)	false
Oct 2, 2024 18:26:24.211215973 CEST	192.168.2.4	1.1.1.1	0x1779	Standard query (0)	www.toptipvideo.com	A (IP address)	IN (0x0001)	false
Oct 2, 2024 18:26:25.210892916 CEST	192.168.2.4	1.1.1.1	0x1779	Standard query (0)	www.toptipvideo.com	A (IP address)	IN (0x0001)	false
Oct 2, 2024 18:26:27.231678009 CEST	192.168.2.4	1.1.1.1	0x1779	Standard query (0)	www.toptipvideo.com	A (IP address)	IN (0x0001)	false
Oct 2, 2024 18:26:31.226234913 CEST	192.168.2.4	1.1.1.1	0x1779	Standard query (0)	www.toptipvideo.com	A (IP address)	IN (0x0001)	false
Oct 2, 2024 18:26:35.243419886 CEST	192.168.2.4	1.1.1.1	0x5cbf	Standard query (0)	www.toptipvideo.com	A (IP address)	IN (0x0001)	false
Oct 2, 2024 18:26:36.257520914 CEST	192.168.2.4	1.1.1.1	0x5cbf	Standard query (0)	www.toptipvideo.com	A (IP address)	IN (0x0001)	false
Oct 2, 2024 18:26:37.368302107 CEST	192.168.2.4	1.1.1.1	0xd52e	Standard query (0)	www.toptipvideo.com	A (IP address)	IN (0x0001)	false
Oct 2, 2024 18:26:38.382728100 CEST	192.168.2.4	1.1.1.1	0xd52e	Standard query (0)	www.toptipvideo.com	A (IP address)	IN (0x0001)	false
Oct 2, 2024 18:26:39.398127079 CEST	192.168.2.4	1.1.1.1	0xd52e	Standard query (0)	www.toptipvideo.com	A (IP address)	IN (0x0001)	false
Oct 2, 2024 18:26:41.413738012 CEST	192.168.2.4	1.1.1.1	0xd52e	Standard query (0)	www.toptipvideo.com	A (IP address)	IN (0x0001)	false
Oct 2, 2024 18:26:45.429389000 CEST	192.168.2.4	1.1.1.1	0xd52e	Standard query (0)	www.toptipvideo.com	A (IP address)	IN (0x0001)	false
Oct 2, 2024 18:26:49.430061102 CEST	192.168.2.4	1.1.1.1	0xd9ff	Standard query (0)	www.toptipvideo.com	A (IP address)	IN (0x0001)	false
Oct 2, 2024 18:26:50.445240021 CEST	192.168.2.4	1.1.1.1	0xd9ff	Standard query (0)	www.toptipvideo.com	A (IP address)	IN (0x0001)	false
Oct 2, 2024 18:26:51.445679903 CEST	192.168.2.4	1.1.1.1	0xd9ff	Standard query (0)	www.toptipvideo.com	A (IP address)	IN (0x0001)	false
Oct 2, 2024 18:26:53.445229053 CEST	192.168.2.4	1.1.1.1	0xd9ff	Standard query (0)	www.toptipvideo.com	A (IP address)	IN (0x0001)	false
Oct 2, 2024 18:26:57.804871082 CEST	192.168.2.4	1.1.1.1	0x9c58	Standard query (0)	www.toptipvideo.com	A (IP address)	IN (0x0001)	false
Oct 2, 2024 18:26:58.804619074 CEST	192.168.2.4	1.1.1.1	0x9c58	Standard query (0)	www.toptipvideo.com	A (IP address)	IN (0x0001)	false
Oct 2, 2024 18:26:59.804692984 CEST	192.168.2.4	1.1.1.1	0x9c58	Standard query (0)	www.toptipvideo.com	A (IP address)	IN (0x0001)	false
Oct 2, 2024 18:27:01.804570913 CEST	192.168.2.4	1.1.1.1	0x9c58	Standard query (0)	www.toptipvideo.com	A (IP address)	IN (0x0001)	false
Oct 2, 2024 18:27:05.820949078 CEST	192.168.2.4	1.1.1.1	0x9c58	Standard query (0)	www.toptipvideo.com	A (IP address)	IN (0x0001)	false
Oct 2, 2024 18:27:09.836880922 CEST	192.168.2.4	1.1.1.1	0x6bde	Standard query (0)	www.toptipvideo.com	A (IP address)	IN (0x0001)	false
Oct 2, 2024 18:27:10.836477995 CEST	192.168.2.4	1.1.1.1	0x6bde	Standard query (0)	www.toptipvideo.com	A (IP address)	IN (0x0001)	false
Oct 2, 2024 18:27:11.852399111 CEST	192.168.2.4	1.1.1.1	0x6bde	Standard query (0)	www.toptipvideo.com	A (IP address)	IN (0x0001)	false
Oct 2, 2024 18:27:18.056669950 CEST	192.168.2.4	1.1.1.1	0x4808	Standard query (0)	www.toptipvideo.com	A (IP address)	IN (0x0001)	false
Oct 2, 2024 18:27:22.259082079 CEST	192.168.2.4	1.1.1.1	0x7ddb	Standard query (0)	www.toptipvideo.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 2, 2024 18:25:29.321520090 CEST	1.1.1.1	192.168.2.4	0xa2f7	Name error (3)	www.toptipvideo.com	none	none	A (IP address)	IN (0x0001)	false
Oct 2, 2024 18:25:35.502222061 CEST	1.1.1.1	192.168.2.4	0xacc5	Name error (3)	www.toptipvideo.com	none	none	A (IP address)	IN (0x0001)	false
Oct 2, 2024 18:25:41.659759998 CEST	1.1.1.1	192.168.2.4	0x9cd1	Name error (3)	www.toptipvideo.com	none	none	A (IP address)	IN (0x0001)	false
Oct 2, 2024 18:25:47.822385073 CEST	1.1.1.1	192.168.2.4	0x91d	Name error (3)	www.toptipvideo.com	none	none	A (IP address)	IN (0x0001)	false
Oct 2, 2024 18:25:53.990899086 CEST	1.1.1.1	192.168.2.4	0xada6	Name error (3)	www.toptipvideo.com	none	none	A (IP address)	IN (0x0001)	false
Oct 2, 2024 18:26:00.202981949 CEST	1.1.1.1	192.168.2.4	0xacea	Name error (3)	www.toptipvideo.com	none	none	A (IP address)	IN (0x0001)	false
Oct 2, 2024 18:26:04.342066050 CEST	1.1.1.1	192.168.2.4	0xe08d	Name error (3)	www.toptipvideo.com	none	none	A (IP address)	IN (0x0001)	false
Oct 2, 2024 18:26:10.502648115 CEST	1.1.1.1	192.168.2.4	0x16ed	Name error (3)	www.toptipvideo.com	none	none	A (IP address)	IN (0x0001)	false
Oct 2, 2024 18:26:17.039787054 CEST	1.1.1.1	192.168.2.4	0x3878	Name error (3)	www.toptipvideo.com	none	none	A (IP address)	IN (0x0001)	false
Oct 2, 2024 18:26:36.361794949 CEST	1.1.1.1	192.168.2.4	0x5cbf	Name error (3)	www.toptipvideo.com	none	none	A (IP address)	IN (0x0001)	false
Oct 2, 2024 18:26:53.670322895 CEST	1.1.1.1	192.168.2.4	0xd9ff	Name error (3)	www.toptipvideo.com	none	none	A (IP address)	IN (0x0001)	false
Oct 2, 2024 18:27:11.910135031 CEST	1.1.1.1	192.168.2.4	0x6bde	Name error (3)	www.toptipvideo.com	none	none	A (IP address)	IN (0x0001)	false
Oct 2, 2024 18:27:18.123241901 CEST	1.1.1.1	192.168.2.4	0x4808	Name error (3)	www.toptipvideo.com	none	none	A (IP address)	IN (0x0001)	false
Oct 2, 2024 18:27:22.290612936 CEST	1.1.1.1	192.168.2.4	0x7ddb	Name error (3)	www.toptipvideo.com	none	none	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	12:25:17
Start date:	02/10/2024
Path:	C:\Windows\System32\loaddll32.exe
Wow64 process (32bit):	true
Commandline:	loaddll32.exe "C:\Users\user\Desktop\EACore.dll"
Imagebase:	0x340000
File size:	126'464 bytes
MD5 hash:	51E6071F9CBA48E79F10C84515AAE618
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	12:25:17
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	12:25:17
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\EACore.dll",#1
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	12:25:17
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\EACore.dll,AgentAdd
Imagebase:	0x690000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	12:25:17
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\EACore.dll",#1
Imagebase:	0x690000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	12:25:20
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\EACore.dll,AgentRemove
Imagebase:	0x690000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	12:25:23
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\EACore.dll,AgentTaskAdd
Imagebase:	0x690000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	12:25:26
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\EACore.dll",AgentAdd
Imagebase:	0x690000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	12:25:26
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\EACore.dll",AgentRemove
Imagebase:	0x690000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	12:25:26
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\EACore.dll",AgentTaskAdd
Imagebase:	0x690000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	12:25:26
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\EACore.dll",ViewSetContentFilters
Imagebase:	0x690000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	12:25:26
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\EACore.dll",UserLogout
Imagebase:	0x690000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	12:25:26
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\EACore.dll",UserLogin
Imagebase:	0x690000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	12:25:27
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\EACore.dll",UserIsLoggedIn
Imagebase:	0x690000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	12:25:27
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\EACore.dll",UserGetNames
Imagebase:	0x690000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	12:25:27
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\EACore.dll",UserGetEntitlements
Imagebase:	0x690000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	12:25:27
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\EACore.dll",UserEnumContent
Imagebase:	0x690000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	12:25:27
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\EACore.dll",StateSetTag
Imagebase:	0x690000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	12:25:27
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\EACore.dll",StateSetProperty
Imagebase:	0x690000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	12:25:27
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\EACore.dll",StateGet
Imagebase:	0x690000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	12:25:27
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\EACore.dll",ItemUse
Imagebase:	0x690000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	12:25:27
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\EACore.dll",ItemUnpackStart
Imagebase:	0x690000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	12:25:27
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\EACore.dll",ItemUnpackCancel
Imagebase:	0x690000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	12:25:27
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\EACore.dll",ItemInstallStartBatch
Imagebase:	0x690000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	12:25:27
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\EACore.dll",ItemInstallStart
Imagebase:	0x690000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	12:25:27
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\EACore.dll",ItemGetStatus
Imagebase:	0x690000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	12:25:27
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\EACore.dll",ItemEnumPatches
Imagebase:	0x690000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	12:25:27
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\EACore.dll",ItemDownloadTogglePauseState
Imagebase:	0x690000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	12:25:27
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\EACore.dll",ItemDownloadStart
Imagebase:	0x690000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	12:25:27
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\EACore.dll",ItemDownloadCancel
Imagebase:	0x690000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	12:25:27
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\EACore.dll",ItemDecryptStart
Imagebase:	0x690000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	12:25:27
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\EACore.dll",ItemDecryptCancel
Imagebase:	0x690000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	12:25:27
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\EACore.dll",ItemClearCache
Imagebase:	0x690000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	12:25:27
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\EACore.dll",IsConnected
Imagebase:	0x690000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	34
Start time:	12:25:27
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\EACore.dll",Disconnect
Imagebase:	0x690000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	12:25:27
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\EACore.dll",Connect3
Imagebase:	0x690000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	12:25:27
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\EACore.dll",Connect
Imagebase:	0x690000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	12:25:27
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\EACore.dll",Command
Imagebase:	0x690000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	12:25:27
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\EACore.dll",AgentTaskStatusSet
Imagebase:	0x690000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	12:25:28
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\EACore.dll",AgentTaskStatusGet
Imagebase:	0x690000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	12:25:28
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\EACore.dll",AgentTaskRemove
Imagebase:	0x690000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	2.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	2%
Total number of Nodes:	840
Total number of Limit Nodes:	5

Executed Functions

Function 6E349F20 Relevance: 3.0, APIs: 2, Instructions: 40
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserNameA.ADVAPI32(?,00000100), ref: 6E349F46
lstrlenA.KERNEL32(?), ref: 6E349F93

Memory Dump Source

Source File: 00000021.00000002.2920601298.000000006E341000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E340000, based on PE: true

Associated: 00000021.00000002.2920584008.000000006E340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920624747.000000006E354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920643920.000000006E357000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920661278.000000006E359000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_6e340000_rundll32.jbxd

Similarity

API ID: NameUserlstrlen
String ID:
API String ID: 188228716-0
Opcode ID: b2491a453bf353071e94aa4914ce6190bba136d49f6b3dd945983b87b36b04e3
Instruction ID: 48bb17087398adcdbb6ae47f2b872f042b62d55f743bb80dfb076af64136f0a5
Opcode Fuzzy Hash: b2491a453bf353071e94aa4914ce6190bba136d49f6b3dd945983b87b36b04e3
Instruction Fuzzy Hash: E4018B71618207EFCB189F6AC06562A77F9AFC9355F60486DE88A87350D7349881CBA2

Function 6E3525CA Relevance: 9.1, APIs: 6, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_callnewh.API-MS-WIN-CRT-HEAP-L1-1-0(6E341131,?,6E341131,00000024), ref: 6E3525D2
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(6E341131,?,6E341131,00000024), ref: 6E3525DF
_CxxThrowException.VCRUNTIME140(?,6E356588), ref: 6E3526D3
_CxxThrowException.VCRUNTIME140(?,6E3561FC), ref: 6E3526F0
IsProcessorFeaturePresent.KERNEL32(00000017), ref: 6E352701
___raise_securityfailure.LIBCMT ref: 6E3527E9

Memory Dump Source

Source File: 00000021.00000002.2920601298.000000006E341000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E340000, based on PE: true

Associated: 00000021.00000002.2920584008.000000006E340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920624747.000000006E354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920643920.000000006E357000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920661278.000000006E359000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_6e340000_rundll32.jbxd

Similarity

API ID: ExceptionThrow$FeaturePresentProcessor___raise_securityfailure_callnewhmalloc
String ID:
API String ID: 1670996968-0
Opcode ID: 508f945f8b0b93dc3089391c5132a970e080a69e7bfe7853452767c83b3172fa
Instruction ID: de6a6a2ddd12292d8d7fdff0830e97d4dad417b8089df4b6804cd5aa7d0c9590
Opcode Fuzzy Hash: 508f945f8b0b93dc3089391c5132a970e080a69e7bfe7853452767c83b3172fa
Instruction Fuzzy Hash: E23162B4500B08AFDF00DFA9D955AA47FBCBB0A314F20C46AE914973D1E7B09665CF94

Function 6E341290 Relevance: 7.7, APIs: 2, Strings: 3, Instructions: 176
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 6E349F20: GetUserNameA.ADVAPI32(?,00000100), ref: 6E349F46
Part of subcall function 6E349F20: lstrlenA.KERNEL32(?), ref: 6E349F93

memcpy.VCRUNTIME140(00000000,874CCA50,?), ref: 6E3414D4

Strings

TD , xrefs: 6E3414EA
SD , xrefs: 6E3412F0
TD , xrefs: 6E341306

Memory Dump Source

Source File: 00000021.00000002.2920601298.000000006E341000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E340000, based on PE: true

Associated: 00000021.00000002.2920584008.000000006E340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920624747.000000006E354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920643920.000000006E357000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920661278.000000006E359000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_6e340000_rundll32.jbxd

Similarity

API ID: NameUserlstrlenmemcpy
String ID: SD $TD $TD
API String ID: 2751256217-980538074
Opcode ID: df6603da3582b9456ed2aaff186de368279b398ae22ebf325e82776abe391867
Instruction ID: cd6235be1a3690c046d31c8a0df61eeee79f15276a36fe50d7764605c08f2ddd
Opcode Fuzzy Hash: df6603da3582b9456ed2aaff186de368279b398ae22ebf325e82776abe391867
Instruction Fuzzy Hash: 4C51593064DA01EFCA948BD984A0A6E72F99F81384F14089EF596CBB15D636C86C8797

Function 6E3410D0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 80
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenMutexA.KERNEL32(001F0001,00000000,Mutex8565865865), ref: 6E341109
CreateMutexA.KERNELBASE(00000000,00000000,Mutex8565865865), ref: 6E341124

Part of subcall function 6E3525CA: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(6E341131,?,6E341131,00000024), ref: 6E3525DF

Part of subcall function 6E3525CA: _callnewh.API-MS-WIN-CRT-HEAP-L1-1-0(6E341131,?,6E341131,00000024), ref: 6E3525D2
Part of subcall function 6E3525CA: _CxxThrowException.VCRUNTIME140(?,6E356588), ref: 6E3526D3
Part of subcall function 6E3525CA: _CxxThrowException.VCRUNTIME140(?,6E3561FC), ref: 6E3526F0
Part of subcall function 6E3525CA: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 6E352701
Part of subcall function 6E3525CA: ___raise_securityfailure.LIBCMT ref: 6E3527E9

Strings

www.toptipvideo.com, xrefs: 6E341142
Mutex8565865865, xrefs: 6E3410FD, 6E34111B

Memory Dump Source

Source File: 00000021.00000002.2920601298.000000006E341000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E340000, based on PE: true

Associated: 00000021.00000002.2920584008.000000006E340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920624747.000000006E354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920643920.000000006E357000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920661278.000000006E359000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_6e340000_rundll32.jbxd

Similarity

API ID: ExceptionMutexThrow$CreateFeatureOpenPresentProcessor___raise_securityfailure_callnewhmalloc
String ID: Mutex8565865865$www.toptipvideo.com
API String ID: 4215415863-3626984906
Opcode ID: 0bf4fcdb79c3a2f0a04e8a79c8ad95b517243d5267b91ff48795a4cc13a61d23
Instruction ID: aff1f10630c47574633743ab27a306c3bed78856c4b54c900129de69dffc7613
Opcode Fuzzy Hash: 0bf4fcdb79c3a2f0a04e8a79c8ad95b517243d5267b91ff48795a4cc13a61d23
Instruction Fuzzy Hash: 012173B1D006559BDF049FE48C15BEEBBB5BB04724F000A28E5557B3C0E7751A258BA6

Function 6E349680 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 79
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

gethostbyname.WS2_32(?), ref: 6E3496D2
inet_ntoa.WS2_32(?), ref: 6E34972E

Strings

UX.t, xrefs: 6E3496DC
UX.t, xrefs: 6E349717

Memory Dump Source

Source File: 00000021.00000002.2920601298.000000006E341000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E340000, based on PE: true

Associated: 00000021.00000002.2920584008.000000006E340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920624747.000000006E354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920643920.000000006E357000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920661278.000000006E359000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_6e340000_rundll32.jbxd

Similarity

API ID: gethostbynameinet_ntoa
String ID: UX.t$UX.t
API String ID: 2080845111-2708226215
Opcode ID: 7ddc3d3786054aaf2b22b8b233f5d1ce0fe09a8f73106fde111eaddbecd96c5a
Instruction ID: 492b37c029f9bfe84915b1d3d4139bf75ba345418d73480ea3e96f17fd9a35d8
Opcode Fuzzy Hash: 7ddc3d3786054aaf2b22b8b233f5d1ce0fe09a8f73106fde111eaddbecd96c5a
Instruction Fuzzy Hash: 7621B374308216DFC750EE9C86D0A1A7BE9EB89324F118C2AE599CB325D637D851CB92

Function 6E349DC0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 49
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVolumeInformationA.KERNELBASE ref: 6E349DFE

Strings

<Yvn, xrefs: 6E349E30
<Yvn, xrefs: 6E349E17
c:\, xrefs: 6E349DE7

Memory Dump Source

Source File: 00000021.00000002.2920601298.000000006E341000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E340000, based on PE: true

Associated: 00000021.00000002.2920584008.000000006E340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920624747.000000006E354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920643920.000000006E357000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920661278.000000006E359000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_6e340000_rundll32.jbxd

Similarity

API ID: InformationVolume
String ID: <Yvn$<Yvn$c:\
API String ID: 2039140958-2283949575
Opcode ID: 93441be108a64f1e64ca95b0f0ffd1c0e774da6ef4d20daa667f0bfb3226cdd9
Instruction ID: c20e195279b1d3386b095c3b1274331b032f173b5c9c5e0c35a71cdcb8568426
Opcode Fuzzy Hash: 93441be108a64f1e64ca95b0f0ffd1c0e774da6ef4d20daa667f0bfb3226cdd9
Instruction Fuzzy Hash: BF119E34608352CFC7508FA5D68420FB7E2BFC9658F60CE1DE488AA358DB308991CB83

Function 6E3434F0 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 76
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 6E349DC0: GetVolumeInformationA.KERNELBASE ref: 6E349DFE

InitializeCriticalSection.KERNEL32(00000001), ref: 6E34360E
InitializeCriticalSection.KERNEL32(?), ref: 6E343614

Strings

@b5n, xrefs: 6E343508
I5n, xrefs: 6E34352C

Memory Dump Source

Source File: 00000021.00000002.2920601298.000000006E341000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E340000, based on PE: true

Associated: 00000021.00000002.2920584008.000000006E340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920624747.000000006E354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920643920.000000006E357000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920661278.000000006E359000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_6e340000_rundll32.jbxd

Similarity

API ID: CriticalInitializeSection$InformationVolume
String ID: @b5n$I5n
API String ID: 1646672599-520474278
Opcode ID: 631ec896b2877a6c4be01801504b47b7a9e4ea2d438b55dac2b31bdc36798a52
Instruction ID: e53c7925b800bbdb208275bb14686e9a4775a6a58189613a05c97df698e3d5ba
Opcode Fuzzy Hash: 631ec896b2877a6c4be01801504b47b7a9e4ea2d438b55dac2b31bdc36798a52
Instruction Fuzzy Hash: 2E3122B4900609DFDB14CFA4C844BDABBB4FB08318F14862ED459AB341D77AA559CFA0

Function 6E341010 Relevance: 3.0, APIs: 2, Instructions: 3
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 6E3410D0: OpenMutexA.KERNEL32(001F0001,00000000,Mutex8565865865), ref: 6E341109
Part of subcall function 6E3410D0: CreateMutexA.KERNELBASE(00000000,00000000,Mutex8565865865), ref: 6E341124

ExitProcess.KERNEL32 ref: 6E341017

Memory Dump Source

Source File: 00000021.00000002.2920601298.000000006E341000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E340000, based on PE: true

Associated: 00000021.00000002.2920584008.000000006E340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920624747.000000006E354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920643920.000000006E357000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920661278.000000006E359000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_6e340000_rundll32.jbxd

Similarity

API ID: Mutex$CreateExitOpenProcess
String ID:
API String ID: 2853217582-0
Opcode ID: 7266fd00f577ebd5b4698b78e9a15bdbb7bcb8408160b46f561876a95778adb2
Instruction ID: 7c1874af1d2bb08b7aad4fa1f2cb71bd7d8d038ba48c38d0f767525b122c2988
Opcode Fuzzy Hash: 7266fd00f577ebd5b4698b78e9a15bdbb7bcb8408160b46f561876a95778adb2
Instruction Fuzzy Hash: 84900230144A40A6D55116E1580974826695705656F100840A14A545844A5020549715

Function 6E3497C0 Relevance: 1.5, APIs: 1, Instructions: 46
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32(00000202,?), ref: 6E3497DF

Memory Dump Source

Source File: 00000021.00000002.2920601298.000000006E341000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E340000, based on PE: true

Associated: 00000021.00000002.2920584008.000000006E340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920624747.000000006E354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920643920.000000006E357000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920661278.000000006E359000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_6e340000_rundll32.jbxd

Similarity

API ID: Startup
String ID:
API String ID: 724789610-0
Opcode ID: f7da161201eaff6f06fac460b4592314b878d1d29d8b9a68753a0a4ac7770e52
Instruction ID: 23d05a503e892c7e310897742d99bf0d77af38501809d47fcaba84ba9d964955
Opcode Fuzzy Hash: f7da161201eaff6f06fac460b4592314b878d1d29d8b9a68753a0a4ac7770e52
Instruction Fuzzy Hash: 80012830A48252DBCB741EAC82717BA77F8EFC6318F52042EC5878A784D6250891C7E3

Function 6E343910 Relevance: 1.3, APIs: 1, Instructions: 60
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000007D0,00000000,00000000,?,74DF0F00,4FFB6A0C,6E3414E8,00000001,00000000,?), ref: 6E3439C8

Memory Dump Source

Source File: 00000021.00000002.2920601298.000000006E341000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E340000, based on PE: true

Associated: 00000021.00000002.2920584008.000000006E340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920624747.000000006E354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920643920.000000006E357000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920661278.000000006E359000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_6e340000_rundll32.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: cb69cbf70640970afe9cf83d4fcf54992f1d3a9f1a3135f476fe1e253210c09a
Instruction ID: d91b4f1feeec32bcec3e10833019fc84d8d9a05e23da65e76c5ec13c3e761aaa
Opcode Fuzzy Hash: cb69cbf70640970afe9cf83d4fcf54992f1d3a9f1a3135f476fe1e253210c09a
Instruction Fuzzy Hash: 4211497278C280FF8A5055C958CCBBE76DCEBA5314F10091AE2C5C3322D16BC894C7A3

Non-executed Functions

Function 6E352F3A Relevance: 9.1, APIs: 6, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 6E352F46
memset.VCRUNTIME140(?,00000000,00000003), ref: 6E352F6C
memset.VCRUNTIME140(?,00000000,00000050), ref: 6E352FF6
IsDebuggerPresent.KERNEL32 ref: 6E353012
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 6E353032
UnhandledExceptionFilter.KERNEL32(?), ref: 6E35303C

Memory Dump Source

Source File: 00000021.00000002.2920601298.000000006E341000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E340000, based on PE: true

Associated: 00000021.00000002.2920584008.000000006E340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920624747.000000006E354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920643920.000000006E357000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920661278.000000006E359000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_6e340000_rundll32.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$DebuggerFeatureProcessor
String ID:
API String ID: 1045392073-0
Opcode ID: 58a835bcc138eadcf955e0ac4ed73739622ee882cdbeb8a49645d747fac0de9d
Instruction ID: 0d4c444c1626baa660c2caf6d7be64bcde1b9620b6de890d74b118f6fcb212bf
Opcode Fuzzy Hash: 58a835bcc138eadcf955e0ac4ed73739622ee882cdbeb8a49645d747fac0de9d
Instruction Fuzzy Hash: 2B3116B5D453189BDB11DFA4D989BCDBBB8BF08304F1044AAE44DAB350EB719A85CF04

Function 6E353127 Relevance: 1.6, APIs: 1, Instructions: 144COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 6E35313D

Memory Dump Source

Source File: 00000021.00000002.2920601298.000000006E341000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E340000, based on PE: true

Associated: 00000021.00000002.2920584008.000000006E340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920624747.000000006E354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920643920.000000006E357000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920661278.000000006E359000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_6e340000_rundll32.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 56669f7e8295aa83cc6ac918f662399eaf8c7d7c4a07519d8c2f851c8a1913f3
Instruction ID: f486c5d90f63181c35ebea07aaa4d07a1c643e39491eeb43d48cc188bbec1ca8
Opcode Fuzzy Hash: 56669f7e8295aa83cc6ac918f662399eaf8c7d7c4a07519d8c2f851c8a1913f3
Instruction Fuzzy Hash: 135181B1910A05CFDB05CFA9C496BAABBF4FB45350F20856AE815EB384D3769920CF60

Function 6E349A60 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.2920601298.000000006E341000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E340000, based on PE: true

Associated: 00000021.00000002.2920584008.000000006E340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920624747.000000006E354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920643920.000000006E357000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920661278.000000006E359000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_6e340000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa2794cd5f8265bfb38fe47ab7ea0272d9117f93e9b974dc6054a212bba267ff
Instruction ID: 46c004cb6ca0f039b2e2a6cc80affef837243ee12894088be0dd348c688c6870
Opcode Fuzzy Hash: fa2794cd5f8265bfb38fe47ab7ea0272d9117f93e9b974dc6054a212bba267ff
Instruction Fuzzy Hash: 2821D71434E137EBA7AC8CEA5BB067E71CA5BD9214B21459EF81356B90C4529C41C2F3

Function 6E345830 Relevance: 24.9, APIs: 7, Strings: 7, Instructions: 389
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6E345912
memset.VCRUNTIME140(?,00000000,?), ref: 6E345935
memset.VCRUNTIME140(?,00000000,?), ref: 6E345C2B

Strings

fv>, xrefs: 6E345979
fv>, xrefs: 6E345A34
fv>, xrefs: 6E345A81
|)#, xrefs: 6E345ACF
|)#, xrefs: 6E345B28
|)#, xrefs: 6E345ABF
ev>, xrefs: 6E345882

Memory Dump Source

Source File: 00000021.00000002.2920601298.000000006E341000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E340000, based on PE: true

Associated: 00000021.00000002.2920584008.000000006E340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920624747.000000006E354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920643920.000000006E357000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920661278.000000006E359000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_6e340000_rundll32.jbxd

Similarity

API ID: memset$memcpy
String ID: ev>$fv>$fv>$fv>$|)#$|)#$|)#
API String ID: 368790112-2700277603
Opcode ID: 41328cf95faad224a69d478e317dbb486e58ae141557802ce6b66a38b50c8990
Instruction ID: 5e70adc8b7408f6692081b2835228cf7c640f2f99639960ef2f833092e624644
Opcode Fuzzy Hash: 41328cf95faad224a69d478e317dbb486e58ae141557802ce6b66a38b50c8990
Instruction Fuzzy Hash: 63E1EF71E08201EFC710DF9DD8C4A1EB7E8AF99354F94492AE999D7361C732EC448B92

Function 6E342FD0 Relevance: 23.1, APIs: 5, Strings: 8, Instructions: 324
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

L^|?, xrefs: 6E34328A
CZpY, xrefs: 6E3433FE
``, xrefs: 6E343048
M^|?, xrefs: 6E343306
CZpY, xrefs: 6E343438
M^|?, xrefs: 6E343336
``, xrefs: 6E343038
``, xrefs: 6E343081

Memory Dump Source

Source File: 00000021.00000002.2920601298.000000006E341000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E340000, based on PE: true

Associated: 00000021.00000002.2920584008.000000006E340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920624747.000000006E354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920643920.000000006E357000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920661278.000000006E359000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_6e340000_rundll32.jbxd

Similarity

API ID:
String ID: CZpY$CZpY$L^|?$M^|?$M^|?$``$``$``
API String ID: 0-2715003150
Opcode ID: cdebbd5ed39e9b48441c14f323aef6b4e3e105f1f6a55018001b0cb659489c87
Instruction ID: 256e83703ba99efe6d9ac423459c0ea42e14bb57bff0991947f2691c353add8a
Opcode Fuzzy Hash: cdebbd5ed39e9b48441c14f323aef6b4e3e105f1f6a55018001b0cb659489c87
Instruction Fuzzy Hash: D1C15471A08301DFC7509FC9C4D895EB7E9BB89B14F114A2EE995AB310D731DC818BA3

Function 6E342480 Relevance: 23.0, APIs: 2, Strings: 11, Instructions: 298
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

CZpY, xrefs: 6E342848
C!", xrefs: 6E3425E7
``, xrefs: 6E3424E8
``, xrefs: 6E3424D8
C!", xrefs: 6E34263E
CZpY, xrefs: 6E34280F
C!", xrefs: 6E3425E0
M^|?, xrefs: 6E342726
``, xrefs: 6E342522
M^|?, xrefs: 6E342756
L^|?, xrefs: 6E3426AA

Memory Dump Source

Source File: 00000021.00000002.2920601298.000000006E341000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E340000, based on PE: true

Associated: 00000021.00000002.2920584008.000000006E340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920624747.000000006E354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920643920.000000006E357000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920661278.000000006E359000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_6e340000_rundll32.jbxd

Similarity

API ID:
String ID: CZpY$CZpY$L^|?$M^|?$M^|?$C!"$C!"$C!"$``$``$``
API String ID: 0-3622555438
Opcode ID: 4834c1605d0ecb29c39dd2884f1499d1652decf4e449a26b0a58b0fa22d6ce62
Instruction ID: bd489f21a1ea45af1046aa29ce894490ccbaf7fce930714c53d775a40372c3c8
Opcode Fuzzy Hash: 4834c1605d0ecb29c39dd2884f1499d1652decf4e449a26b0a58b0fa22d6ce62
Instruction Fuzzy Hash: 7BA16471A58305CFC710AEC982D0A1EB7F6AB85710F12486AED94FB310F676DC818B97

Function 6E349930 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 81
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

socket.WS2_32(00000002,00000001,00000006), ref: 6E34995C
htons.WS2_32 ref: 6E34999C
inet_addr.WS2_32(?), ref: 6E3499AA
connect.WS2_32(?,?,00000010), ref: 6E3499BD
shutdown.WS2_32(?,00000002), ref: 6E3499FD
closesocket.WS2_32(?), ref: 6E349A05

Strings

5FiZ, xrefs: 6E349A29
qMxH, xrefs: 6E3499E0
qMxH, xrefs: 6E349A11
5FiZ, xrefs: 6E3499E7
pMxH, xrefs: 6E349970
qMxH, xrefs: 6E349A36

Memory Dump Source

Source File: 00000021.00000002.2920601298.000000006E341000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E340000, based on PE: true

Associated: 00000021.00000002.2920584008.000000006E340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920624747.000000006E354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920643920.000000006E357000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920661278.000000006E359000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_6e340000_rundll32.jbxd

Similarity

API ID: closesocketconnecthtonsinet_addrshutdownsocket
String ID: 5FiZ$5FiZ$pMxH$qMxH$qMxH$qMxH
API String ID: 502862507-2539853916
Opcode ID: 769271176a19ecf19a64033905a0ee0fab3203adf7c97c10fc98a1e60edf6745
Instruction ID: 0cc145ccee1d233f89c0f62f85edac78263e2a67ff8660769f228b54d3ab05d4
Opcode Fuzzy Hash: 769271176a19ecf19a64033905a0ee0fab3203adf7c97c10fc98a1e60edf6745
Instruction Fuzzy Hash: 9E210771658242EFCB108F98CC95B5A77F9BF4A760F100A56F951CB3A0D7719C40CBA2

Function 6E34CCD0 Relevance: 19.6, APIs: 4, Strings: 7, Instructions: 350COMMON

Download Yara Rule

APIs

Part of subcall function 6E34D2D0: ?_Random_device@std@@YAIXZ.MSVCP140(?,?,?,6E34CD35,?,00000014), ref: 6E34D468

Part of subcall function 6E34D7A0: ??0ios_base@std@@IAE@XZ.MSVCP140 ref: 6E34D7E5
Part of subcall function 6E34D7A0: ?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IAEXPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z.MSVCP140(?,00000000), ref: 6E34D84A
Part of subcall function 6E34D7A0: ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ.MSVCP140 ref: 6E34D8A1

Part of subcall function 6E34D9E0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6E34DA13
Part of subcall function 6E34D9E0: ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z.MSVCP140(?), ref: 6E34DAE3

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z.MSVCP140(?), ref: 6E34CF29
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ.MSVCP140 ref: 6E34D1AA
??1ios_base@std@@UAE@XZ.MSVCP140 ref: 6E34D1B2

Strings

Accept: */*, xrefs: 6E34CF3D
HTTP/1.1, xrefs: 6E34CDD1
Content-Length: , xrefs: 6E34CF10
GET /, xrefs: 6E34CD59
User-Agent: , xrefs: 6E34CE68
Connection: Close, xrefs: 6E34CF4E
Host: , xrefs: 6E34CDE2

Memory Dump Source

Source File: 00000021.00000002.2920601298.000000006E341000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E340000, based on PE: true

Associated: 00000021.00000002.2920584008.000000006E340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920624747.000000006E354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920643920.000000006E357000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920661278.000000006E359000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_6e340000_rundll32.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$??0?$basic_streambuf@??0ios_base@std@@??1?$basic_streambuf@??1ios_base@std@@??6?$basic_ostream@?init@?$basic_ios@?sputc@?$basic_streambuf@D@std@@@2@_Random_device@std@@V01@V?$basic_streambuf@strlen
String ID: HTTP/1.1$Accept: */*$Connection: Close$Content-Length: $GET /$Host: $User-Agent:
API String ID: 882624657-3865628381
Opcode ID: b968d5419f618b53cbd3f0ba3227132b6cadbcbe57f7c4e5d501f887fdb602c0
Instruction ID: 057dde3bf14b8a991757780291a003daf80c9f200d37fc4c0f05fe0a177f46fd
Opcode Fuzzy Hash: b968d5419f618b53cbd3f0ba3227132b6cadbcbe57f7c4e5d501f887fdb602c0
Instruction Fuzzy Hash: 63E1AAB5600B00CFC724CFA5C891A96B7F9AF89304F408D2DE89A8B711E771F859CB91

Function 6E346FC0 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 303COMMON

Download Yara Rule

Strings

nD*, xrefs: 6E3470B0
nD*, xrefs: 6E3470E8
nD*, xrefs: 6E347098

Memory Dump Source

Source File: 00000021.00000002.2920601298.000000006E341000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E340000, based on PE: true

Associated: 00000021.00000002.2920584008.000000006E340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920624747.000000006E354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920643920.000000006E357000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920661278.000000006E359000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_6e340000_rundll32.jbxd

Similarity

API ID:
String ID: nD*$nD*$nD*
API String ID: 0-2512186221
Opcode ID: 91a02d9fa0f176f6c815676359ae830d6217dff6a12a097788b1a65b6f7efd04
Instruction ID: ea0ac04e8d6f7fb9593d6d5cfa92becb76a4b8100d44a32e6d0fa97399287939
Opcode Fuzzy Hash: 91a02d9fa0f176f6c815676359ae830d6217dff6a12a097788b1a65b6f7efd04
Instruction Fuzzy Hash: B7B1C071958306CFC760DFD9C48062AB7E5AB89310F154D69F9A4973A1E3B2CC548BE3

Function 6E34D7A0 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 133COMMON

Download Yara Rule

APIs

??0ios_base@std@@IAE@XZ.MSVCP140 ref: 6E34D7E5
?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IAEXPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z.MSVCP140(?,00000000), ref: 6E34D84A
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ.MSVCP140 ref: 6E34D8A1

Strings

i, xrefs: 6E34D995
i, xrefs: 6E34D8CB
LG5n, xrefs: 6E34D7EB
i, xrefs: 6E34D97E

Memory Dump Source

Source File: 00000021.00000002.2920601298.000000006E341000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E340000, based on PE: true

Associated: 00000021.00000002.2920584008.000000006E340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920624747.000000006E354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920643920.000000006E357000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920661278.000000006E359000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_6e340000_rundll32.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$??0?$basic_streambuf@??0ios_base@std@@?init@?$basic_ios@D@std@@@2@_V?$basic_streambuf@
String ID: LG5n$i$i$i
API String ID: 4279176481-459428206
Opcode ID: fb090c99e1ffea42e63d7aa031d85f1bdb67ee84af25bff093467f77810d7690
Instruction ID: 5c04d18090d71f8b6d1a92506f564a320e5fea518ab1963882764db199ac3b07
Opcode Fuzzy Hash: fb090c99e1ffea42e63d7aa031d85f1bdb67ee84af25bff093467f77810d7690
Instruction Fuzzy Hash: B2516A78A0060ACFCB28CF88D1A4A79BBF4FF59304FA0845EE5125B7A4D335A841CF91

Function 6E3468D0 Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 291COMMON

Download Yara Rule

Strings

nD*, xrefs: 6E3469E8
nD*, xrefs: 6E346998
nD*, xrefs: 6E3469B0

Memory Dump Source

Source File: 00000021.00000002.2920601298.000000006E341000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E340000, based on PE: true

Associated: 00000021.00000002.2920584008.000000006E340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920624747.000000006E354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920643920.000000006E357000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920661278.000000006E359000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_6e340000_rundll32.jbxd

Similarity

API ID:
String ID: nD*$nD*$nD*
API String ID: 0-2512186221
Opcode ID: ce420dc6c68f66d03e835b385675b364cf418e4b36d757b7134dc0c64ed5df62
Instruction ID: c3ac9a4da57b4c2d482aa60cb284d2f9eab3f552a45ca6897abdb4c777fae77f
Opcode Fuzzy Hash: ce420dc6c68f66d03e835b385675b364cf418e4b36d757b7134dc0c64ed5df62
Instruction Fuzzy Hash: 85A1127092C746CF8714DEA984D061BBBE8EB89314F10492EE9A59B351D372DC448BD3

Function 6E347490 Relevance: 10.7, APIs: 1, Strings: 6, Instructions: 234COMMON

Download Yara Rule

Strings

nD*, xrefs: 6E34764C
nD*, xrefs: 6E347687
nD*, xrefs: 6E3476C5
nD*, xrefs: 6E347660
nD*, xrefs: 6E3476F7
nD*, xrefs: 6E3476D0

Memory Dump Source

Source File: 00000021.00000002.2920601298.000000006E341000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E340000, based on PE: true

Associated: 00000021.00000002.2920584008.000000006E340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920624747.000000006E354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920643920.000000006E357000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920661278.000000006E359000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_6e340000_rundll32.jbxd

Similarity

API ID:
String ID: nD*$nD*$nD*$nD*$nD*$nD*
API String ID: 0-3356428140
Opcode ID: 33c1912cae1a74cd2e97f86f449ee70181906ded4a66f2e060cd9b697e54aa52
Instruction ID: 6148b4418dcb13fe6729e957dff31aafc4aee201c7c65f8cb5412cc0f66be473
Opcode Fuzzy Hash: 33c1912cae1a74cd2e97f86f449ee70181906ded4a66f2e060cd9b697e54aa52
Instruction Fuzzy Hash: 7E91C170918202CFC7508FADC49052ABBE6AB55324F614E6DE4A8DB7E0D336D9858BD3

Function 6E348E60 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 125stringCOMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(0000000A,00000000,-0000000F,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6E348E7A
strtol.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000001), ref: 6E348EE4

Strings

invalid stoi argument, xrefs: 6E349008
stoi argument out of range, xrefs: 6E348FFE

Memory Dump Source

Source File: 00000021.00000002.2920601298.000000006E341000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E340000, based on PE: true

Associated: 00000021.00000002.2920584008.000000006E340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920624747.000000006E354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920643920.000000006E357000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920661278.000000006E359000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_6e340000_rundll32.jbxd

Similarity

API ID: _errnostrtol
String ID: invalid stoi argument$stoi argument out of range
API String ID: 897893115-1606216832
Opcode ID: afe875f16f5de7a910b71e4b2788f516cf20c9f055f73dbd7d58503a78e689e4
Instruction ID: c406b60021f00c741c575101904f7ba98b794163db47b629c200e199f1bf8f59
Opcode Fuzzy Hash: afe875f16f5de7a910b71e4b2788f516cf20c9f055f73dbd7d58503a78e689e4
Instruction Fuzzy Hash: B041E832608205DFCB585AA8E0E0A7E77EBAFC5358F50485EF8964B754C7325894CBD3

Function 6E346D40 Relevance: 9.2, APIs: 1, Strings: 5, Instructions: 178COMMON

Download Yara Rule

Strings

|, xrefs: 6E346F27
|, xrefs: 6E346E9A
nD*, xrefs: 6E346E18
nD*, xrefs: 6E346DE0
nD*, xrefs: 6E346DBF

Memory Dump Source

Source File: 00000021.00000002.2920601298.000000006E341000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E340000, based on PE: true

Associated: 00000021.00000002.2920584008.000000006E340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920624747.000000006E354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920643920.000000006E357000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920661278.000000006E359000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_6e340000_rundll32.jbxd

Similarity

API ID:
String ID: nD*$nD*$nD*$|$|
API String ID: 0-1944917205
Opcode ID: 4f6ec5cff62208e532b7b81fcef5ad7f2766faebaf7a7ac0454d8e7d3005a87a
Instruction ID: c152777193ed130f135f099fd1f74036cec0239458d68fc36e1b0e20279e98de
Opcode Fuzzy Hash: 4f6ec5cff62208e532b7b81fcef5ad7f2766faebaf7a7ac0454d8e7d3005a87a
Instruction Fuzzy Hash: 39519F30669301CFC650EF99C59461EB7E5AFC9614F61886DE5D88B312D732EC81CBA3

Function 6E34D9E0 Relevance: 9.2, APIs: 6, Instructions: 153stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6E34DA13

Part of subcall function 6E352000: ?good@ios_base@std@@QBE_NXZ.MSVCP140 ref: 6E352098
Part of subcall function 6E352000: ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ.MSVCP140 ref: 6E3520B6
Part of subcall function 6E352000: ?good@ios_base@std@@QBE_NXZ.MSVCP140 ref: 6E3520C4

?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z.MSVCP140(?), ref: 6E34DAE3
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z.MSVCP140(?,?), ref: 6E34DB3A
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?), ref: 6E34DB94
?uncaught_exception@std@@YA_NXZ.MSVCP140 ref: 6E34DB9A
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ.MSVCP140 ref: 6E34DBAD

Memory Dump Source

Source File: 00000021.00000002.2920601298.000000006E341000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E340000, based on PE: true

Associated: 00000021.00000002.2920584008.000000006E340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920624747.000000006E354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920643920.000000006E357000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920661278.000000006E359000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_6e340000_rundll32.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?good@ios_base@std@@?sputc@?$basic_streambuf@$?clear@?$basic_ios@?flush@?$basic_ostream@?uncaught_exception@std@@Osfx@?$basic_ostream@V12@strlen
String ID:
API String ID: 2744321282-0
Opcode ID: 4ed1f60f09d7df6868d016fa36271db2fc0bd354d706f6b4ad6309fbafbb521d
Instruction ID: 228a6f4539ff7c4309b5129305add009f89fdd63c4c3a393023f1193e9fe8041
Opcode Fuzzy Hash: 4ed1f60f09d7df6868d016fa36271db2fc0bd354d706f6b4ad6309fbafbb521d
Instruction Fuzzy Hash: 49515875A00618CFCB11CFA8C984BAABBF5FF49324F548658E956AB390C735AD00CF90

Function 6E345E50 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 267COMMON

Download Yara Rule

Strings

nD*, xrefs: 6E345F30
nD*, xrefs: 6E345F18
nD*, xrefs: 6E345F68

Memory Dump Source

Source File: 00000021.00000002.2920601298.000000006E341000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E340000, based on PE: true

Associated: 00000021.00000002.2920584008.000000006E340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920624747.000000006E354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920643920.000000006E357000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920661278.000000006E359000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_6e340000_rundll32.jbxd

Similarity

API ID:
String ID: nD*$nD*$nD*
API String ID: 0-2512186221
Opcode ID: 0c71be428a06e41212a82886482e544e396d5e6eeba52d1ba8e8ded80740d606
Instruction ID: 8325d819620e83f0765e6665dece7d591c54d6bcfcddb537be9f4be9bd450a67
Opcode Fuzzy Hash: 0c71be428a06e41212a82886482e544e396d5e6eeba52d1ba8e8ded80740d606
Instruction Fuzzy Hash: 57913372D2C221DF8751EE9C849065EB3E9AB89310F414D6AECE5AB355D332CC858BD3

Function 6E342B90 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 80COMMON

Download Yara Rule

Strings

.[t, xrefs: 6E342BDC
.[t, xrefs: 6E342BA9
.[t, xrefs: 6E342C6E
-[t, xrefs: 6E342BB8

Memory Dump Source

Source File: 00000021.00000002.2920601298.000000006E341000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E340000, based on PE: true

Associated: 00000021.00000002.2920584008.000000006E340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920624747.000000006E354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920643920.000000006E357000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920661278.000000006E359000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_6e340000_rundll32.jbxd

Similarity

API ID:
String ID: -[t$.[t$.[t$.[t
API String ID: 0-664268514
Opcode ID: cac5b989b2beaf67a869a02b4ab7c4ad94e07818ae5692d013ecd911f8e76ae6
Instruction ID: 8d34d4b50e08fd93e54604d1578a2309254eb43e0c43040af63fa3617cf214ad
Opcode Fuzzy Hash: cac5b989b2beaf67a869a02b4ab7c4ad94e07818ae5692d013ecd911f8e76ae6
Instruction Fuzzy Hash: 4F21C8A066C900DB595C8DDA07B593E39EEDE81710B210D8FF253F7F44DA1A588147B3

Function 6E347810 Relevance: 8.0, APIs: 5, Instructions: 475stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6E34788F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6E347B13

Memory Dump Source

Source File: 00000021.00000002.2920601298.000000006E341000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E340000, based on PE: true

Associated: 00000021.00000002.2920584008.000000006E340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920624747.000000006E354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920643920.000000006E357000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920661278.000000006E359000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_6e340000_rundll32.jbxd

Similarity

API ID: strlen
String ID:
API String ID: 39653677-0
Opcode ID: 4cf5e40d70f144c52a0be49349b48164e705e5836f04d480ceb266532c9a1147
Instruction ID: cc734babb4c5d3940de31ae033a9d5e40a7fd956660e15f68c8c00771e9d8038
Opcode Fuzzy Hash: 4cf5e40d70f144c52a0be49349b48164e705e5836f04d480ceb266532c9a1147
Instruction Fuzzy Hash: 21022672E54249CFCF50CFE9C59469EF7FAAF89310F25091AE415AB390D7318C858BA1

Function 6E350AB0 Relevance: 7.8, APIs: 2, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000007), ref: 6E350EEE
memcpy.VCRUNTIME140(00000000,?,?), ref: 6E350F05

Strings

uDJl, xrefs: 6E350D8C
DG5n, xrefs: 6E350B51
uDJl, xrefs: 6E350DB1

Memory Dump Source

Source File: 00000021.00000002.2920601298.000000006E341000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E340000, based on PE: true

Associated: 00000021.00000002.2920584008.000000006E340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920624747.000000006E354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920643920.000000006E357000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920661278.000000006E359000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_6e340000_rundll32.jbxd

Similarity

API ID: memcpy
String ID: DG5n$uDJl$uDJl
API String ID: 3510742995-1489047631
Opcode ID: 12fea78d6196b6c08d71ef14511f6aed694ac48b7cc7385cfe94f63b1b5757c0
Instruction ID: 6d96afeb0b2ceaa3fa590d87d5eb34c9e2e709212b791af4a9f902f3ecaea0af
Opcode Fuzzy Hash: 12fea78d6196b6c08d71ef14511f6aed694ac48b7cc7385cfe94f63b1b5757c0
Instruction Fuzzy Hash: 13A114729083118FC7509E89C0E0A5EB7E6AB85328F62495DE8E42B354E733DC648F93

Function 6E349FB0 Relevance: 7.7, APIs: 5, Instructions: 234COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00001000,CAD60A9B), ref: 6E349FF2
GetModuleFileNameW.KERNEL32(00000000,?,00001000,?,6E34A590,?), ref: 6E34A002
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6E34A024

Memory Dump Source

Source File: 00000021.00000002.2920601298.000000006E341000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E340000, based on PE: true

Associated: 00000021.00000002.2920584008.000000006E340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920624747.000000006E354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920643920.000000006E357000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920661278.000000006E359000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_6e340000_rundll32.jbxd

Similarity

API ID: FileModuleNamememsetwcslen
String ID:
API String ID: 13871436-0
Opcode ID: 6381d3f51908c8148f393728770706760ad235f8e78600603059bcbe994e5a99
Instruction ID: 889c7c82dd52dcca5a16fb2d692bb367e247f7f762e47856b04c940671f071b1
Opcode Fuzzy Hash: 6381d3f51908c8148f393728770706760ad235f8e78600603059bcbe994e5a99
Instruction Fuzzy Hash: EC91FFB1A08214CFDB50CFD8C890BAEBBF5BB89314F154569E444AB351E3369D85CBA2

Function 6E344920 Relevance: 7.7, APIs: 3, Strings: 2, Instructions: 158COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6E3448E5), ref: 6E344A5E

Strings

y2q4, xrefs: 6E344B67
y2q4, xrefs: 6E344A31

Memory Dump Source

Source File: 00000021.00000002.2920601298.000000006E341000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E340000, based on PE: true

Associated: 00000021.00000002.2920584008.000000006E340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920624747.000000006E354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920643920.000000006E357000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920661278.000000006E359000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_6e340000_rundll32.jbxd

Similarity

API ID: memcpy
String ID: y2q4$y2q4
API String ID: 3510742995-3122413610
Opcode ID: c341e26ddc4d1416b5c1e0209e3da052be8ac18b33394d726d2024f09ec98195
Instruction ID: 9c596d4bfe1e747f4e4834d78b19276eed85c5bb9f088c66df0062981d774272
Opcode Fuzzy Hash: c341e26ddc4d1416b5c1e0209e3da052be8ac18b33394d726d2024f09ec98195
Instruction Fuzzy Hash: 7E518574608200DFCBA1DF99C484B59B7E8AF5A324F14497AF0C8DB321C736A866CB53

Function 6E352190 Relevance: 7.6, APIs: 5, Instructions: 136COMMON

Download Yara Rule

APIs

Part of subcall function 6E352000: ?good@ios_base@std@@QBE_NXZ.MSVCP140 ref: 6E352098
Part of subcall function 6E352000: ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ.MSVCP140 ref: 6E3520B6
Part of subcall function 6E352000: ?good@ios_base@std@@QBE_NXZ.MSVCP140 ref: 6E3520C4

?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z.MSVCP140(?), ref: 6E352234
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z.MSVCP140(?), ref: 6E3522CC
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000), ref: 6E352315
?uncaught_exception@std@@YA_NXZ.MSVCP140 ref: 6E35231B
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ.MSVCP140 ref: 6E35232E

Memory Dump Source

Source File: 00000021.00000002.2920601298.000000006E341000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E340000, based on PE: true

Associated: 00000021.00000002.2920584008.000000006E340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920624747.000000006E354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920643920.000000006E357000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920661278.000000006E359000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_6e340000_rundll32.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?good@ios_base@std@@?sputc@?$basic_streambuf@$?clear@?$basic_ios@?flush@?$basic_ostream@?uncaught_exception@std@@Osfx@?$basic_ostream@V12@
String ID:
API String ID: 3657783076-0
Opcode ID: 15a0e1d4228bd538769454344cfed88cb1334e25660fcae91052b91ab34ba1ce
Instruction ID: aaabc4903a08a75e17babdf66434a34627fe9b18d7e21438fdd73e57ae610383
Opcode Fuzzy Hash: 15a0e1d4228bd538769454344cfed88cb1334e25660fcae91052b91ab34ba1ce
Instruction Fuzzy Hash: 5C516678A00615DFDB05CF98CA94FADBBB1FF48324F148658E929AB381C735E910CB90

Function 6E349020 Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 109COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,?,00000000,00000001,00000000), ref: 6E3490AC

Strings

~'p, xrefs: 6E349077
~'p, xrefs: 6E349037
$dS), xrefs: 6E34910C
$dS), xrefs: 6E3490C6

Memory Dump Source

Source File: 00000021.00000002.2920601298.000000006E341000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E340000, based on PE: true

Associated: 00000021.00000002.2920584008.000000006E340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920624747.000000006E354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920643920.000000006E357000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920661278.000000006E359000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_6e340000_rundll32.jbxd

Similarity

API ID: memcmp
String ID: $dS)$$dS)$~'p$~'p
API String ID: 1475443563-1066583186
Opcode ID: 22f57edd218caf6c9cd5a2f4a1729eb1283821887e7056a7fede8a20f55ec451
Instruction ID: 896e42c7b4f5276985b9047aa924f6b426f55cfc6e7b001b6cff52c33c6a24f8
Opcode Fuzzy Hash: 22f57edd218caf6c9cd5a2f4a1729eb1283821887e7056a7fede8a20f55ec451
Instruction Fuzzy Hash: D531287160C303CFC6525DA986E032E73F657C5338F264AAAE6599B359C273CD42CB82

Function 6E352A4D Relevance: 7.6, APIs: 5, Instructions: 87COMMONLIBRARYCODE

Download Yara Rule

APIs

dllmain_raw.LIBCMT ref: 6E352A8A
dllmain_crt_dispatch.LIBCMT ref: 6E352AA1
dllmain_raw.LIBCMT ref: 6E352AE9
dllmain_crt_dispatch.LIBCMT ref: 6E352AFC
dllmain_raw.LIBCMT ref: 6E352B0F

Memory Dump Source

Source File: 00000021.00000002.2920601298.000000006E341000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E340000, based on PE: true

Associated: 00000021.00000002.2920584008.000000006E340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920624747.000000006E354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920643920.000000006E357000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920661278.000000006E359000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_6e340000_rundll32.jbxd

Similarity

API ID: dllmain_raw$dllmain_crt_dispatch
String ID:
API String ID: 3136044242-0
Opcode ID: 2ba5ddff63460c7f9291908c52ad196ca2ba6eef10ec97a7fdd4eac0f8c2c7cb
Instruction ID: 10e00550d148428f6c36190e8cc42199783a27c136d6a51a08d00559a4cf928d
Opcode Fuzzy Hash: 2ba5ddff63460c7f9291908c52ad196ca2ba6eef10ec97a7fdd4eac0f8c2c7cb
Instruction Fuzzy Hash: E021AE72D0061AAFDB628ED5CE40EAF7A7DEB91A94B014415F85467318EB328D318BE0

Function 6E34D2D0 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 281COMMON

Download Yara Rule

APIs

?_Random_device@std@@YAIXZ.MSVCP140(?,?,?,6E34CD35,?,00000014), ref: 6E34D468

Strings

>, xrefs: 6E34D323
Q#j!, xrefs: 6E34D5FE
Q#j!, xrefs: 6E34D62C

Memory Dump Source

Source File: 00000021.00000002.2920601298.000000006E341000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E340000, based on PE: true

Associated: 00000021.00000002.2920584008.000000006E340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920624747.000000006E354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920643920.000000006E357000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920661278.000000006E359000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_6e340000_rundll32.jbxd

Similarity

API ID: Random_device@std@@
String ID: >$Q#j!$Q#j!
API String ID: 1041445435-139136301
Opcode ID: c609a6feeea94a8ccb7129cd2dd40f4ff2696d4c5c8ef1b120d75479cf0c30aa
Instruction ID: 5f976a00ddafc2350fa696883e577134ea8463401584fd595a427b93eeaa3afa
Opcode Fuzzy Hash: c609a6feeea94a8ccb7129cd2dd40f4ff2696d4c5c8ef1b120d75479cf0c30aa
Instruction Fuzzy Hash: E0C18974E05218CFCB14CFA8C4A06EDBBF1BF49308FA1459AD859AB391D7759980CF92

Function 6E342200 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 83COMMON

Download Yara Rule

Strings

M^|?, xrefs: 6E342326
M^|?, xrefs: 6E3422F6
L^|?, xrefs: 6E34227A

Memory Dump Source

Source File: 00000021.00000002.2920601298.000000006E341000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E340000, based on PE: true

Associated: 00000021.00000002.2920584008.000000006E340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920624747.000000006E354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920643920.000000006E357000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920661278.000000006E359000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_6e340000_rundll32.jbxd

Similarity

API ID:
String ID: L^|?$M^|?$M^|?
API String ID: 0-714862341
Opcode ID: 0d87a672bfa3456764188c80164eeb229461796b14780d59e8aff9f93d06cbb7
Instruction ID: 4075274ea5e2797a3c47ddaae3cb77739b814aa64dfa423e1dbf7cdadaffe8b5
Opcode Fuzzy Hash: 0d87a672bfa3456764188c80164eeb229461796b14780d59e8aff9f93d06cbb7
Instruction Fuzzy Hash: EA21F771A1C601CBCA9449D2ABD460A72FA97C9344F30842BC505FF718D637EF8B4356

Function 6E342350 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 82COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6E342464

Strings

L^|?, xrefs: 6E3423C6
M^|?, xrefs: 6E34242E
M^|?, xrefs: 6E342458

Memory Dump Source

Source File: 00000021.00000002.2920601298.000000006E341000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E340000, based on PE: true

Associated: 00000021.00000002.2920584008.000000006E340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920624747.000000006E354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920643920.000000006E357000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920661278.000000006E359000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_6e340000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: L^|?$M^|?$M^|?
API String ID: 3668304517-714862341
Opcode ID: 0a61c6c952f56941a588f90761653269fc60f98ee571d416382557bd336e1bff
Instruction ID: 3c18da6417166a2fd00e57aa0eb2ee2f8cc32d72dbee516d07aace6843d35e6c
Opcode Fuzzy Hash: 0a61c6c952f56941a588f90761653269fc60f98ee571d416382557bd336e1bff
Instruction Fuzzy Hash: 06210571B14205CFC6200DD28BD050975FA9B88700B30882FE426FF30AD636E987431B

Function 6E344020 Relevance: 6.4, APIs: 5, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.2920601298.000000006E341000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E340000, based on PE: true

Associated: 00000021.00000002.2920584008.000000006E340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920624747.000000006E354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920643920.000000006E357000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920661278.000000006E359000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_6e340000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 559e1622a51ab4c536e5477d7ae6d5143fbd15894bae1e28c5f477227c7526d1
Instruction ID: 490d51517cfe55a2087e3691be8099397110ef660045235a645bc3a0913db13e
Opcode Fuzzy Hash: 559e1622a51ab4c536e5477d7ae6d5143fbd15894bae1e28c5f477227c7526d1
Instruction Fuzzy Hash: 395190B4608341DFC7518F98C594B09BBE8AF96318F154C6AF896CF352C336DC928B52

Function 6E344EA0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 104COMMON

Download Yara Rule

Strings

%>!8, xrefs: 6E344F28
$>!8, xrefs: 6E344F20
%>!8, xrefs: 6E345050

Memory Dump Source

Source File: 00000021.00000002.2920601298.000000006E341000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E340000, based on PE: true

Associated: 00000021.00000002.2920584008.000000006E340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920624747.000000006E354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920643920.000000006E357000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920661278.000000006E359000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_6e340000_rundll32.jbxd

Similarity

API ID:
String ID: $>!8$%>!8$%>!8
API String ID: 0-1600156571
Opcode ID: 76d4a886f1cdf76f16d0bdfbe9b1397499099a542f41984ac1657355f3654eef
Instruction ID: 2ff6875f14e3408da9aa09d6caff5332c50877102d293b887d7c41250cbef707
Opcode Fuzzy Hash: 76d4a886f1cdf76f16d0bdfbe9b1397499099a542f41984ac1657355f3654eef
Instruction Fuzzy Hash: 7A318D34608141CFCA489ED8C0B4B38B3E6EF85314F108A6DD9D74B7B5CA269C979752

Function 6E352818 Relevance: 6.1, APIs: 4, Instructions: 92COMMONLIBRARYCODE

Download Yara Rule

APIs

__RTC_Initialize.LIBCMT ref: 6E352865

Part of subcall function 6E352C13: InitializeSListHead.KERNEL32(6E357698,6E35286F,6E3565A8,00000010,6E352A0A,?,00000000,?,00000007,6E3565C8,00000010,6E352A1D,?,?,6E352AA6,?), ref: 6E352C18

_initterm_e.API-MS-WIN-CRT-RUNTIME-L1-1-0(6E354F0C,6E354F10,6E3565A8,00000010,6E352A0A,?,00000000,?,00000007,6E3565C8,00000010,6E352A1D,?,?,6E352AA6,?), ref: 6E35287E
_initterm.API-MS-WIN-CRT-RUNTIME-L1-1-0(6E354F04,6E354F08,6E3565A8,00000010,6E352A0A,?,00000000,?,00000007,6E3565C8,00000010,6E352A1D,?,?,6E352AA6,?), ref: 6E35289C
___scrt_is_nonwritable_in_current_image.LIBCMT ref: 6E3528CF

Memory Dump Source

Source File: 00000021.00000002.2920601298.000000006E341000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E340000, based on PE: true

Associated: 00000021.00000002.2920584008.000000006E340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920624747.000000006E354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920643920.000000006E357000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920661278.000000006E359000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_6e340000_rundll32.jbxd

Similarity

API ID: Initialize$HeadList___scrt_is_nonwritable_in_current_image_initterm_initterm_e
String ID:
API String ID: 590286634-0
Opcode ID: 2a1bd2bc76c01e9f56851280453bc5bd1a862dc24ba6771d7df335ee8f221fc9
Instruction ID: 886753254e8f910c7964af76970ffdf574a0b2b3f807dfe44a278a8214a5abb0
Opcode Fuzzy Hash: 2a1bd2bc76c01e9f56851280453bc5bd1a862dc24ba6771d7df335ee8f221fc9
Instruction Fuzzy Hash: B52124322487469EEB445BE8DA14FDC37B8AF1632DF104C6AD8D66B3C1DB324035C666

Function 6E34DC40 Relevance: 6.0, APIs: 4, Instructions: 32COMMON

Download Yara Rule

APIs

__std_terminate.VCRUNTIME140 ref: 6E34DC47
__std_terminate.VCRUNTIME140 ref: 6E34DC5F
?uncaught_exception@std@@YA_NXZ.MSVCP140 ref: 6E34DC77
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ.MSVCP140 ref: 6E34DC83

Memory Dump Source

Source File: 00000021.00000002.2920601298.000000006E341000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E340000, based on PE: true

Associated: 00000021.00000002.2920584008.000000006E340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920624747.000000006E354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920643920.000000006E357000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920661278.000000006E359000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_6e340000_rundll32.jbxd

Similarity

API ID: __std_terminate$?uncaught_exception@std@@D@std@@@std@@Osfx@?$basic_ostream@U?$char_traits@
String ID:
API String ID: 2331131724-0
Opcode ID: 300ed7eaa1de8a700751572fb4139372efe73f42c372170a76359539150c21af
Instruction ID: bd939b8f4a8ba232bc7480eb2722f1283676bbe1b4211d9fdbf65c49cb901237
Opcode Fuzzy Hash: 300ed7eaa1de8a700751572fb4139372efe73f42c372170a76359539150c21af
Instruction Fuzzy Hash: B0F0E238900108CFC704BBB8E848DA87778BF15208F55449CD84A5B3A5EF316A1CCA51

Function 6E3523C0 Relevance: 6.0, APIs: 4, Instructions: 32COMMON

Download Yara Rule

APIs

__std_terminate.VCRUNTIME140 ref: 6E3523C7
__std_terminate.VCRUNTIME140 ref: 6E3523DF
?uncaught_exception@std@@YA_NXZ.MSVCP140 ref: 6E3523F7
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ.MSVCP140 ref: 6E352403

Memory Dump Source

Source File: 00000021.00000002.2920601298.000000006E341000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E340000, based on PE: true

Associated: 00000021.00000002.2920584008.000000006E340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920624747.000000006E354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920643920.000000006E357000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920661278.000000006E359000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_6e340000_rundll32.jbxd

Similarity

API ID: __std_terminate$?uncaught_exception@std@@D@std@@@std@@Osfx@?$basic_ostream@U?$char_traits@
String ID:
API String ID: 2331131724-0
Opcode ID: 44be16380a7898320f732b20545484d3ef7ad08ad22ef3a5a7c0044325ba46fd
Instruction ID: 8b60b047b96724383e7323c971a4cb7937eca85dfb9f643714f07d6eba34f2c4
Opcode Fuzzy Hash: 44be16380a7898320f732b20545484d3ef7ad08ad22ef3a5a7c0044325ba46fd
Instruction Fuzzy Hash: 48F0B478920104DFC700BBB4FD58D687778BF11208F08049CD84A4B3A6EF216929C741

Function 6E3454C0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 95COMMON

Download Yara Rule

Strings

|)#, xrefs: 6E345588
|)#, xrefs: 6E34552B

Memory Dump Source

Source File: 00000021.00000002.2920601298.000000006E341000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E340000, based on PE: true

Associated: 00000021.00000002.2920584008.000000006E340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920624747.000000006E354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920643920.000000006E357000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920661278.000000006E359000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_6e340000_rundll32.jbxd

Similarity

API ID:
String ID: |)#$|)#
API String ID: 0-3832309455
Opcode ID: ec0bf73e0fb9576f151174d8d7fe5d3647f3307f5093f93dbe55de0bdbc8bba1
Instruction ID: 09ebaac1827586a2de8b1697e7527b9925ce0f209562b0120d421c95529f4fe5
Opcode Fuzzy Hash: ec0bf73e0fb9576f151174d8d7fe5d3647f3307f5093f93dbe55de0bdbc8bba1
Instruction Fuzzy Hash: 5331F6B2E04305EFD6704E9D85D073A73FBAB89315FA1899AC02B4B365EB73D4448792

Function 6E342CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

_CxxThrowException.VCRUNTIME140(?,6E3561FC), ref: 6E342D12
__std_exception_copy.VCRUNTIME140(-00000004,?,?,?,6E3561FC), ref: 6E342D43

Strings

0I5n, xrefs: 6E342CFB

Memory Dump Source

Source File: 00000021.00000002.2920601298.000000006E341000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E340000, based on PE: true

Associated: 00000021.00000002.2920584008.000000006E340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920624747.000000006E354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920643920.000000006E357000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920661278.000000006E359000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_6e340000_rundll32.jbxd

Similarity

API ID: ExceptionThrow__std_exception_copy
String ID: 0I5n
API String ID: 1552479455-2787057435
Opcode ID: c6497ce36aecdc130ab3549365a6767364b1c00d07a23a3fe44f1e88a67fa8b1
Instruction ID: a0ef2a20a41d5496f4249e207f11f07105409f66b782c4c2c4ce595e0e837d4e
Opcode Fuzzy Hash: c6497ce36aecdc130ab3549365a6767364b1c00d07a23a3fe44f1e88a67fa8b1
Instruction Fuzzy Hash: 27E06DF5914301ABE2045F84DC0AF4BBEA8DB12308F418C2CE1869B700D77598768792

Function 6E345E30 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 11COMMON

Download Yara Rule

APIs

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(deque<T> too long,6E345E0B), ref: 6E345E35

Strings

deque<T> too long, xrefs: 6E345E30
@b5n, xrefs: 6E345E40

Memory Dump Source

Source File: 00000021.00000002.2920601298.000000006E341000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E340000, based on PE: true

Associated: 00000021.00000002.2920584008.000000006E340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920624747.000000006E354000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920643920.000000006E357000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000021.00000002.2920661278.000000006E359000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_6e340000_rundll32.jbxd

Similarity

API ID: Xlength_error@std@@
String ID: @b5n$deque<T> too long
API String ID: 1004598685-1186726973
Opcode ID: d22f9bcaa104cc8e18c6f3084a8a7c38dce93c639ad669061e450e42689a1ed5
Instruction ID: 953b2ecf3272197fd5697adadf722ffe956b8e36b5c723f1a1f0091b6d68fa22
Opcode Fuzzy Hash: d22f9bcaa104cc8e18c6f3084a8a7c38dce93c639ad669061e450e42689a1ed5
Instruction Fuzzy Hash: 3FB0223880E080CB02080BCB880CE00222C3B03B23FB00CE382200AB0CCF2200B08323

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report EACore.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Exports

Possible Origin

Network Behavior

Network Port Distribution

UDP Packets

DNS Queries

DNS Answers

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior

Analysis Process: loaddll32.exePID: 7472, Parent PID: 2580

General

Chronological Activities

Analysis Process: conhost.exePID: 7480, Parent PID: 7472

General

Windows Analysis Report
EACore.dll