Edit tour

Windows Analysis Report
PandoraFMS_One_Agent_Windows-lts.x86_64.exe

Overview

General Information

Sample name:	PandoraFMS_One_Agent_Windows-lts.x86_64.exe
Analysis ID:	1543756
MD5:	850a59f9c158b9d953ee6a75f55f7f8a
SHA1:	00112195c957667f320fa4565966827a8570c168
SHA256:	324f914c6e630516c2d2565cbd0b63e33eb6dc171f26aeaadf4f920636b16dc0
Infos:

Detection

Score:	32
Range:	0 - 100
Whitelisted:	false
Confidence:	40%

Compliance

Score:	34
Range:	0 - 100

Signatures

Multi AV Scanner detection for dropped file

Disables security and backup related services

Found API chain indicative of debugger detection

Potential context-aware VBS script found (checks for environment specific values)

Uses schtasks.exe or at.exe to add and modify task schedules

Abnormal high CPU Usage

Contains functionality for read data from the clipboard

Contains functionality to dynamically determine API calls

Contains functionality to shutdown / reboot the system

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

EXE planting / hijacking vulnerabilities found

Found dropped PE file which has not been started or loaded

PE file contains an invalid checksum

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Stores files to the Windows start menu directory

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Uses net.exe to stop services

Classification

Process Tree

System is w10x64

PandoraFMS_One_Agent_Windows-lts.x86_64.exe (PID: 7308 cmdline: "C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe" MD5: 850A59F9C158B9D953EE6A75F55F7F8A)

cmd.exe (PID: 7460 cmdline: cmd.exe /c net stop pandoraFMSagent MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7468 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

net.exe (PID: 7512 cmdline: net stop pandoraFMSagent MD5: 31890A7DE89936F922D44D677F681A7F)

net1.exe (PID: 7532 cmdline: C:\Windows\system32\net1 stop pandoraFMSagent MD5: 2EFE6ED4C294AB8A39EB59C80813FEC1)

cmd.exe (PID: 7700 cmdline: cmd.exe /c PandoraAgent.exe --install MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7708 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PandoraAgent.exe (PID: 7764 cmdline: PandoraAgent.exe --install MD5: D885123606524EA6542E5AC351FB3529)

schtasks.exe (PID: 7820 cmdline: schtasks /Create /TN pandora_agent_restart /TR "\"C:\Program Files\pandora_agent\scripts\restart_pandora_agent.bat\"" /SC DAILY /ST 00:00:00 /F /RU SYSTEM MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7836 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 7916 cmdline: schtasks /Change /TN pandora_agent_restart /TR "\"C:\Program Files\pandora_agent\scripts\restart_pandora_agent.bat\"" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7924 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

ShortElev.exe (PID: 7984 cmdline: "C:\Program Files\pandora_agent\util\ShortElev.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PandoraFMS_Agent_v7.0NG.777.1\Edit Config File.lnk" MD5: 0137DF9F792F635269E6FFF74F238C95)

conhost.exe (PID: 7992 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

ShortElev.exe (PID: 8036 cmdline: "C:\Program Files\pandora_agent\util\ShortElev.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PandoraFMS_Agent_v7.0NG.777.1\PandoraFMS_Agent_start.lnk" MD5: 0137DF9F792F635269E6FFF74F238C95)

conhost.exe (PID: 8044 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

ShortElev.exe (PID: 8088 cmdline: "C:\Program Files\pandora_agent\util\ShortElev.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PandoraFMS_Agent_v7.0NG.777.1\PandoraFMS_Agent_stop.lnk" MD5: 0137DF9F792F635269E6FFF74F238C95)

conhost.exe (PID: 8096 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 8140 cmdline: C:\Windows\SYSTEM32\cmd.exe /c ""C:\Program Files\pandora_agent\scripts\restart_pandora_agent.bat"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8148 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

net.exe (PID: 8184 cmdline: net stop PandoraFMSAgent MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

net1.exe (PID: 3612 cmdline: C:\Windows\system32\net1 stop PandoraFMSAgent MD5: 55693DF2BB3CBE2899DFDDF18B4EB8C9)

net.exe (PID: 1508 cmdline: net start PandoraFMSAgent MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

net1.exe (PID: 4600 cmdline: C:\Windows\system32\net1 start PandoraFMSAgent MD5: 55693DF2BB3CBE2899DFDDF18B4EB8C9)

PandoraAgent.exe (PID: 3620 cmdline: "C:\Program Files\pandora_agent\PandoraAgent.exe" MD5: D885123606524EA6542E5AC351FB3529)

cleanup

Sigma Signatures

Sigma detected: Net.exe Execution

Source: Process started

Author: Michael Haag, Mark Woan (improvements), James Pemberton / @4A616D6573 / oscd.community (improvements): Data: Command: net stop pandoraFMSagent, CommandLine: net stop pandoraFMSagent, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\net.exe, NewProcessName: C:\Windows\SysWOW64\net.exe, OriginalFileName: C:\Windows\SysWOW64\net.exe, ParentCommandLine: cmd.exe /c net stop pandoraFMSagent, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 7460, ParentProcessName: cmd.exe, ProcessCommandLine: net stop pandoraFMSagent, ProcessId: 7512, ProcessName: net.exe

Sigma detected: Start Windows Service Via Net.EXE

Source: Process started

Author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: net start PandoraFMSAgent, CommandLine: net start PandoraFMSAgent, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: C:\Windows\SYSTEM32\cmd.exe /c ""C:\Program Files\pandora_agent\scripts\restart_pandora_agent.bat"", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 8140, ParentProcessName: cmd.exe, ProcessCommandLine: net start PandoraFMSAgent, ProcessId: 1508, ProcessName: net.exe

Sigma detected: Stop Windows Service Via Net.EXE

Source: Process started

Author: Jakob Weinzettl, oscd.community, Nasreddine Bencherchali (Nextron Systems): Data: Command: net stop pandoraFMSagent, CommandLine: net stop pandoraFMSagent, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\net.exe, NewProcessName: C:\Windows\SysWOW64\net.exe, OriginalFileName: C:\Windows\SysWOW64\net.exe, ParentCommandLine: cmd.exe /c net stop pandoraFMSagent, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 7460, ParentProcessName: cmd.exe, ProcessCommandLine: net stop pandoraFMSagent, ProcessId: 7512, ProcessName: net.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for dropped file

Source: C:\Program Files\pandora_agent\util\pandora_hardening.exe

ReversingLabs: Detection: 13%

Cryptography

Source: PandoraAgent.exe, 00000008.00000002.1898706731.0000000000736000.00000002.00000001.01000000.0000000B.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_17e0a04a-e

Privilege Escalation

EXE planting / hijacking vulnerabilities found

Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	EXE: schtasks.exe			Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	EXE: cmd.exe			Jump to behavior

Compliance

EXE planting / hijacking vulnerabilities found

Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	EXE: schtasks.exe			Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	EXE: cmd.exe			Jump to behavior

Uses 32bit PE files

Source: PandoraFMS_One_Agent_Windows-lts.x86_64.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED

Found installer window with terms and condition text

Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe

Window detected: < &BackI &AgreeCancelPandoraFMS v7.0 PandoraFMS v7.0License AgreementPlease review the license terms before installing Pandora FMS Agent 7.0NG.777.1.Press Page Down to see the rest of the agreement.License and terms of use Pandora FMSReview: May 2024General contract conditionsThese general conditions of PandoraFMS (the "Conditions") regulate the terms in which Pandora FMS gives intuitu personae to the Client the use of the PandoraFMS Pandora ITSM or Pandora RC application and of the contracted components as well as the terms in which the support services and the other applicable conditions will be provided. The license of use is fully valid regardless of the services contracted and is an essential part of the contract signed between the parties together with the order or purchase order (if any) and the commercial proposal (all of them together the Contract).These Terms and Conditions are binding to the Client and all entities and persons acting on the Client's behalf or in collaboration with the Client whether they be employees associates collaborators partners suppliers or any other (hereinafter the Associates). Particularly it is understood that all references made to the Client reach and bind the Associates to whom the Client must inform of the content of these conditions and for whose compliance and non-compliance they shall be jointly and severally liable.By the simple installation or acceptance of the installation and by the simple use of the application the Client declares to have read understood and accepted all the Terms of these Conditions. It also declares that it has sufficient power of attorney to be bound by its representation.1. Ownership of PandoraFMS its components and the application documentationPandora FMS Pandora ITSM and Pandora RC are the exclusive property of Pandora FMS SLU ("Pandora FMS"); an entity that manages and coordinates its development as a collective work and that holds all the moral exploitation and remunerative rights over it also exclusively. Pandora FMS hereby grants the Client a license to use the application (the executable binaries the expressly agreed upon source codes the related components provided with the software the application programming interfaces and the other associated media) and grants the Client no rights of reproduction distribution public communication or transformation of the application beyond those strictly necessary for the use intended in the commercial offer.The application manuals and all related material including the material used for their development (in any format) are protected by the same intellectual property rights as the application itself and the current license of use extends to them. Pandora FMS hereby grants the Client no rights of reproduction public communication and distribution of these materials beyond those strictly necessary to learn how to use the application. Any transformation (including translation into any language) of the aid and development materials

Creates a directory in C:\Program Files

Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\temp	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\temp\pandora_agent_nsis.conf	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\collections	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\ref	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\help	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\key	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\key\id_dsa	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\key\id_dsa.pub	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\key\PUT_SSH_KEYS_HERE	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\LICENSE_EN.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\LICENSE_ES.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\config.tmp.conf	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\pandora.ico	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\PandoraAgent.exe	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\README.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\scripts	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\scripts\delete_at_job.bat	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\scripts\install_service_restart.bat	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\scripts\restart_pandora_agent.bat	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\scripts\start_pandora_agent.bat	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\scripts\edit_config_file.bat	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\scripts\stop_pandora_agent.bat	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\cmp.exe	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\curl.exe	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\curl-ca-bundle.crt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\cut.exe	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\date.exe	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\df.vbs	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\df_percent.vbs	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\expr.exe	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\gawk.exe	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\getreg.exe	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\getsnmp.bat	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\grep.exe	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\grep_log.exe	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\head.exe	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\logevent_log4x.vbs	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\ls.exe	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\md5.exe	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\agentname.vbs	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\autodiscover.exe	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\pandora_agent_exec.exe	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\AGENTX-MIB.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\DISMAN-EVENT-MIB.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\DISMAN-EXPRESSION-MIB.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\DISMAN-NSLOOKUP-MIB.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\DISMAN-PING-MIB.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\DISMAN-SCHEDULE-MIB.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\DISMAN-SCRIPT-MIB.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\DISMAN-TRACEROUTE-MIB.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\EtherLike-MIB.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\HCNUM-TC.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\HOST-RESOURCES-MIB.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\HOST-RESOURCES-TYPES.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\IANA-ADDRESS-FAMILY-NUMBERS-MIB.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\IANA-LANGUAGE-MIB.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\IANA-RTPROTO-MIB.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\IANAifType-MIB.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\ianalist	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\IF-INVERTED-STACK-MIB.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\IF-MIB.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\INET-ADDRESS-MIB.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\IP-FORWARD-MIB.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\IP-MIB.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\IPV6-ICMP-MIB.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\IPV6-MIB.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\IPV6-TC.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\IPV6-TCP-MIB.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\IPV6-UDP-MIB.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\LM-SENSORS-MIB.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\Makefile.in	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\Makefile.mib	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\makehtml.pl	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\mibfetch	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\MTA-MIB.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\NET-SNMP-AGENT-MIB.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\NET-SNMP-EXAMPLES-MIB.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\NET-SNMP-EXTEND-MIB.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\NET-SNMP-MIB.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\NET-SNMP-MONITOR-MIB.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\NET-SNMP-SYSTEM-MIB.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\NET-SNMP-TC.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\NETWORK-SERVICES-MIB.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\nodemap	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\NOTIFICATION-LOG-MIB.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\README.mibs	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\RFC-1215.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\RFC1155-SMI.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\RFC1213-MIB.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\rfclist	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\rfcmibs.diff	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\RMON-MIB.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\smistrip	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\SMUX-MIB.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\SNMP-COMMUNITY-MIB.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\SNMP-FRAMEWORK-MIB.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\SNMP-MPD-MIB.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\SNMP-NOTIFICATION-MIB.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\SNMP-PROXY-MIB.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\SNMP-TARGET-MIB.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\SNMP-USER-BASED-SM-MIB.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\SNMP-USM-AES-MIB.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\SNMP-USM-DH-OBJECTS-MIB.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\SNMP-VIEW-BASED-ACM-MIB.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\SNMPv2-CONF.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\SNMPv2-MIB.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\SNMPv2-SMI.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\SNMPv2-TC.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\SNMPv2-TM.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\TCP-MIB.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\TRANSPORT-ADDRESS-MIB.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\TUNNEL-MIB.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\UCD-DEMO-MIB.inc	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\UCD-DEMO-MIB.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\UCD-DISKIO-MIB.inc	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\UCD-DISKIO-MIB.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\UCD-DLMOD-MIB.inc	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\UCD-DLMOD-MIB.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\UCD-IPFILTER-MIB.inc	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\UCD-IPFILTER-MIB.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\UCD-IPFWACC-MIB.inc	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\UCD-IPFWACC-MIB.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\UCD-SNMP-MIB-OLD.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\UCD-SNMP-MIB.inc	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\UCD-SNMP-MIB.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\UDP-MIB.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\pandora_revent.exe	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\pandora_update.exe	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\ps.vbs	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\du_percent.vbs	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\puttygen.exe	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\snmpget.exe	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\sort.exe	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\tail.exe	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\tentacle_client.exe	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\tentacle_server.exe	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\tr.exe	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\unzip.exe	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\wc.exe	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\cpuinfo.vbs	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\moboinfo.vbs	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\diskdrives.vbs	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\cdromdrives.vbs	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\videocardinfo.vbs	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\ifaces.vbs	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\monitors.vbs	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\printers.vbs	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\software_installed.vbs	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\raminfo.vbs	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\userslogged.vbs	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\productkey.vbs	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\productID.vbs	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\architecture.vbs	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\domain.vbs	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\osversion.vbs	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\df_percent_used.vbs	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mem_percent_used.vbs	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\network.vbs	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\route_parser.exe	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\omnishell_client.exe	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\pandora_hardening.exe	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\pandora_security_win.exe	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\pandora_security_win.conf	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\ShortElev.exe	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\PandoraFMS_Agent.url	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\uninst.exe	Jump to behavior
Source: C:\Program Files\pandora_agent\PandoraAgent.exe	Directory created: C:\Program Files\pandora_agent\pandora_agent.log	Jump to behavior

Creates license or readme file

Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	File created: C:\Program Files\pandora_agent\LICENSE_EN.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	File created: C:\Program Files\pandora_agent\LICENSE_ES.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	File created: C:\Program Files\pandora_agent\README.txt	Jump to behavior

PE / OLE file has a valid certificate

Source: PandoraFMS_One_Agent_Windows-lts.x86_64.exe

Static PE information: certificate valid

Binary contains paths to debug symbols

Source:	Binary string: c:\projects\md5\Release\md5.pdb source: md5.exe.0.dr
Source:	Binary string: C:\data\buildbot-pdk-slave\pdk-grover\build\src\PerlApp\src\paperl512.pdb source: pandora_revent.exe.0.dr
Source:	Binary string: .Pdb'L source: PandoraFMS_One_Agent_Windows-lts.x86_64.exe
Source:	Binary string: .PdB] source: PandoraFMS_One_Agent_Windows-lts.x86_64.exe

Spreading

Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Code function: 0_2_00407F13 FindFirstFileA,FindClose,	0_2_00407F13
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Code function: 0_2_004083A8 DeleteFileA,DeleteFileA,lstrlenA,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,	0_2_004083A8
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Code function: 0_2_0040342B FindFirstFileA,	0_2_0040342B

Networking

Source: curl.exe.0.dr	String found in binary or memory: Usage: curl [options...] <url>
Source: curl.exe.0.dr	String found in binary or memory: E@Usage: curl [options...] <url>Options: (H) means HTTP/HTTPS only, (F) means FTP only --anyauth Pick "any" authentication method (H) -a, --append Append to target file when uploading (F/SFTP) --basic Use HTTP Basic Authentication (H) --cacert FILE CA certificate to verify peer against (SSL) --capath DIR CA directory to verify peer against (SSL) -E, --cert CERT[:PASSWD] Client certificate file and password (SSL) --cert-type TYPE Certificate file type (DER/PEM/ENG) (SSL) --ciphers LIST SSL ciphers to use (SSL) --compressed Request compressed response (using deflate or gzip) -K, --config FILE Specify which config file to read --connect-timeout SECONDS Maximum time allowed for connection -C, --continue-at OFFSET Resumed transfer offset -b, --cookie STRING/FILE String or file to read cookies from (H) -c, --cookie-jar FILE Write cookies to this file after operation (H) --create-dirs Create necessary local directory hierarchy --crlf Convert LF to CRLF in upload --crlfile FILE Get a CRL list in PEM format from the given file -d, --data DATA HTTP POST data (H) --data-ascii DATA HTTP POST ASCII data (H) --data-binary DATA HTTP POST binary data (H) --data-urlencode DATA HTTP POST data url encoded (H) --delegation STRING GSS-API delegation permission --digest Use HTTP Digest Authentication (H) --disable-eprt Inhibit using EPRT or LPRT (F) --disable-epsv Inhibit using EPSV (F) -D, --dump-header FILE Write the headers to this file --egd-file FILE EGD socket path for random data (SSL) --engine ENGINGE Crypto engine (SSL). "--engine list" for list -f, --fail Fail silently (no output at all) on HTTP errors (H) -F, --form CONTENT Specify HTTP multipart POST data (H) --form-string STRING Specify HTTP multipart POST data (H) --ftp-account DATA Account data string (F) --ftp-alternative-to-user COMMAND String to replace "USER [name]" (F) --ftp-create-dirs Create the remote dirs if not present (F) --ftp-method [MULTICWD/NOCWD/SINGLECWD] Control CWD usage (F) --ftp-pasv Use PASV/EPSV instead of PORT (F) -P, --ftp-port ADR Use PORT with given address instead of PASV (F) --ftp-skip-pasv-ip Skip the IP address for PASV (F)

Source: curl.exe.0.dr	String found in binary or memory: http://curl.haxx.se/P
Source: curl.exe.0.dr	String found in binary or memory: http://curl.haxx.se/docs/copyright.htmlD
Source: PandoraAgent.exe, 00000008.00000002.1898706731.0000000000736000.00000002.00000001.01000000.0000000B.sdmp, PandoraAgent.exe, 0000001B.00000000.1928109476.0000000000736000.00000002.00000001.01000000.0000000B.sdmp, curl.exe.0.dr, PandoraAgent.exe.0.dr	String found in binary or memory: http://curl.haxx.se/docs/http-cookies.html
Source: curl.exe.0.dr	String found in binary or memory: http://curl.haxx.se/docs/sslcerts.html
Source: curl.exe.0.dr	String found in binary or memory: http://curl.haxx.se/libcurl/c/curl_easy_setopt.html
Source: curl.exe.0.dr	String found in binary or memory: http://https://-.://%s%s%s/%sall
Source: PandoraFMS_One_Agent_Windows-lts.x86_64.exe, uninst.exe.0.dr	String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: PandoraFMS_One_Agent_Windows-lts.x86_64.exe, uninst.exe.0.dr	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: config.tmp.conf.0.dr, pandora_agent_nsis.conf.0.dr	String found in binary or memory: http://pandorafms.org
Source: md5.exe.0.dr	String found in binary or memory: http://www.fourmilab.ch/
Source: config.tmp.conf.0.dr, pandora_agent_nsis.conf.0.dr	String found in binary or memory: http://www.google.com
Source: INET-ADDRESS-MIB.txt.0.dr	String found in binary or memory: http://www.iana.org/
Source: IP-MIB.txt.0.dr	String found in binary or memory: http://www.iana.org/assignments/icmp-parameters
Source: IP-MIB.txt.0.dr	String found in binary or memory: http://www.iana.org/assignments/icmpv6-parameters
Source: AGENTX-MIB.txt.0.dr	String found in binary or memory: http://www.ietf.org/html.charters/agentx-charter.html
Source: TCP-MIB.txt.0.dr, IP-FORWARD-MIB.txt.0.dr	String found in binary or memory: http://www.ietf.org/html.charters/ipv6-charter.html
Source: unzip.exe.0.dr	String found in binary or memory: http://www.info-zip.org/UnZip.htmlDVarFileInfo$
Source: unzip.exe.0.dr	String found in binary or memory: http://www.info-zip.org/zip-bug.html;
Source: PandoraAgent.exe, 00000008.00000000.1897515760.000000000079D000.00000002.00000001.01000000.0000000B.sdmp, PandoraAgent.exe, 0000001B.00000002.4162596872.000000000079D000.00000002.00000001.01000000.0000000B.sdmp, PandoraAgent.exe.0.dr	String found in binary or memory: http://www.openssl.org/support/faq.html
Source: PandoraAgent.exe, 00000008.00000000.1897515760.000000000079D000.00000002.00000001.01000000.0000000B.sdmp, PandoraAgent.exe, 0000001B.00000002.4162596872.000000000079D000.00000002.00000001.01000000.0000000B.sdmp, PandoraAgent.exe.0.dr	String found in binary or memory: http://www.openssl.org/support/faq.htmlRAND
Source: PandoraFMS_One_Agent_Windows-lts.x86_64.exe, 00000000.00000002.4162559671.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, PandoraFMS_Agent.url.0.dr	String found in binary or memory: http://www.pandorafms.com
Source: PandoraFMS_One_Agent_Windows-lts.x86_64.exe, 00000000.00000002.4163286809.0000000003963000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.pandorafms.com.
Source: PandoraFMS_One_Agent_Windows-lts.x86_64.exe, 00000000.00000002.4162559671.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, LICENSE_EN.txt.0.dr, LICENSE_ES.txt.0.dr	String found in binary or memory: https://support.pandorafms.com/

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality for read data from the clipboard

Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe

Code function: 0_2_00406EFB GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SetDlgItemTextA,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageA,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_00406EFB

System Summary

Abnormal high CPU Usage

Source: C:\Program Files\pandora_agent\PandoraAgent.exe

Process Stats: CPU usage > 49%

Contains functionality to shutdown / reboot the system

Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe

Code function: 0_2_00404167 EntryPoint,SetErrorMode,GetVersion,lstrlenA,InitCommonControls,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,DeleteFileA,DeleteFileA,GetWindowsDirectoryA,DeleteFileA,DeleteFileA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,DeleteFileA,DeleteFileA,OleUninitialize,GetCurrentProcess,ExitWindowsEx,ExitProcess,

0_2_00404167

Detected potential crypto function

Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Code function: 0_2_00408D2E	0_2_00408D2E
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Code function: 0_2_6E5C4710	0_2_6E5C4710
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Code function: 0_2_6E5C22B5	0_2_6E5C22B5

Dropped file seen in connection with other malware

Source: Joe Sandbox View

Dropped File: C:\Program Files\pandora_agent\util\ShortElev.exe D8CB74994754E0FE701F842651AD5EA4F54B41C0450ECFD511E2B7A8C761847E

PE file contains more sections than normal

Source: PandoraAgent.exe.0.dr	Static PE information: Number of sections : 18 > 10
Source: ShortElev.exe.0.dr	Static PE information: Number of sections : 16 > 10

Uses 32bit PE files

Source: PandoraFMS_One_Agent_Windows-lts.x86_64.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED

Source: grep_log.exe.0.dr	Static PE information: Section: .rsrc ZLIB complexity 0.9979870854591837
Source: route_parser.exe.0.dr	Static PE information: Section: .rsrc ZLIB complexity 0.9976158993089234

Source: classification engine

Classification label: sus32.evad.winEXE@39/174@0/0

Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe

Code function: 0_2_00405A34 GetDlgItem,SetWindowTextA,SetDlgItemTextA,SetDlgItemTextA,SHAutoComplete,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,GetDiskFreeSpaceExA,GetDiskFreeSpaceA,MulDiv,

0_2_00405A34

Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe

Code function: 0_2_00402988 CoCreateInstance,MultiByteToWideChar,

0_2_00402988

Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe

File created: C:\Program Files\pandora_agent

Jump to behavior

Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu.lnk

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7708:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7992:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:8148:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7924:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8096:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7836:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8044:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7468:120:WilError_03

Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe

File created: C:\Users\user\AppData\Local\Temp\nsnBCF3.tmp

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\cmd.exe C:\Windows\SYSTEM32\cmd.exe /c ""C:\Program Files\pandora_agent\scripts\restart_pandora_agent.bat""

Source: PandoraFMS_One_Agent_Windows-lts.x86_64.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: PandoraAgent.exe, 00000008.00000002.1898706731.0000000000736000.00000002.00000001.01000000.0000000B.sdmp, PandoraAgent.exe, 0000001B.00000000.1928109476.0000000000736000.00000002.00000001.01000000.0000000B.sdmp, PandoraAgent.exe.0.dr

Binary or memory string: SELECT Name, PathName, State FROM Win32_Service.PathName;

Source: PandoraAgent.exe	String found in binary or memory: -startinfo
Source: PandoraAgent.exe	String found in binary or memory: -StartupInfo
Source: PandoraAgent.exe	String found in binary or memory: -address
Source: PandoraAgent.exe	String found in binary or memory: -startinfo
Source: PandoraAgent.exe	String found in binary or memory: -StartupInfo
Source: PandoraAgent.exe	String found in binary or memory: -address

Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe

File read: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe "C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe"
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c net stop pandoraFMSagent
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\net.exe net stop pandoraFMSagent
Source: C:\Windows\SysWOW64\net.exe	Process created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 stop pandoraFMSagent
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c PandoraAgent.exe --install
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Program Files\pandora_agent\PandoraAgent.exe PandoraAgent.exe --install
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /Create /TN pandora_agent_restart /TR "\"C:\Program Files\pandora_agent\scripts\restart_pandora_agent.bat\"" /SC DAILY /ST 00:00:00 /F /RU SYSTEM
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /Change /TN pandora_agent_restart /TR "\"C:\Program Files\pandora_agent\scripts\restart_pandora_agent.bat\""
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Process created: C:\Program Files\pandora_agent\util\ShortElev.exe "C:\Program Files\pandora_agent\util\ShortElev.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PandoraFMS_Agent_v7.0NG.777.1\Edit Config File.lnk"
Source: C:\Program Files\pandora_agent\util\ShortElev.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Process created: C:\Program Files\pandora_agent\util\ShortElev.exe "C:\Program Files\pandora_agent\util\ShortElev.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PandoraFMS_Agent_v7.0NG.777.1\PandoraFMS_Agent_start.lnk"
Source: C:\Program Files\pandora_agent\util\ShortElev.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Process created: C:\Program Files\pandora_agent\util\ShortElev.exe "C:\Program Files\pandora_agent\util\ShortElev.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PandoraFMS_Agent_v7.0NG.777.1\PandoraFMS_Agent_stop.lnk"
Source: C:\Program Files\pandora_agent\util\ShortElev.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\SYSTEM32\cmd.exe /c ""C:\Program Files\pandora_agent\scripts\restart_pandora_agent.bat""
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net stop PandoraFMSAgent
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 stop PandoraFMSAgent
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net start PandoraFMSAgent
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 start PandoraFMSAgent
Source: unknown	Process created: C:\Program Files\pandora_agent\PandoraAgent.exe "C:\Program Files\pandora_agent\PandoraAgent.exe"
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c net stop pandoraFMSagent	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c PandoraAgent.exe --install	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /Create /TN pandora_agent_restart /TR "\"C:\Program Files\pandora_agent\scripts\restart_pandora_agent.bat\"" /SC DAILY /ST 00:00:00 /F /RU SYSTEM	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /Change /TN pandora_agent_restart /TR "\"C:\Program Files\pandora_agent\scripts\restart_pandora_agent.bat\""	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Process created: C:\Program Files\pandora_agent\util\ShortElev.exe "C:\Program Files\pandora_agent\util\ShortElev.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PandoraFMS_Agent_v7.0NG.777.1\Edit Config File.lnk"	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Process created: C:\Program Files\pandora_agent\util\ShortElev.exe "C:\Program Files\pandora_agent\util\ShortElev.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PandoraFMS_Agent_v7.0NG.777.1\PandoraFMS_Agent_start.lnk"	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Process created: C:\Program Files\pandora_agent\util\ShortElev.exe "C:\Program Files\pandora_agent\util\ShortElev.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PandoraFMS_Agent_v7.0NG.777.1\PandoraFMS_Agent_stop.lnk"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\net.exe net stop pandoraFMSagent	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Process created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 stop pandoraFMSagent	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Program Files\pandora_agent\PandoraAgent.exe PandoraAgent.exe --install	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net stop PandoraFMSAgent	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net start PandoraFMSAgent	Jump to behavior
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 stop PandoraFMSAgent	Jump to behavior
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 start PandoraFMSAgent	Jump to behavior

Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files\pandora_agent\PandoraAgent.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Program Files\pandora_agent\util\ShortElev.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net1.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net1.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net1.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\net1.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net1.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net1.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\System32\net1.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net1.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net1.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net1.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\net1.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net1.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net1.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\System32\net1.exe	Section loaded: cryptbase.dll	Jump to behavior

Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: Start Menu.lnk.0.dr	LNK file: ..\..\..\..\..\..\Program Files\pandora_agent\README.txt
Source: Start Pandora Agent.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\Program Files\pandora_agent\scripts\start_pandora_agent.bat
Source: Stop Pandora Agent.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\Program Files\pandora_agent\scripts\stop_pandora_agent.bat
Source: Website.lnk.0.dr	LNK file: ..\..\..\..\..\..\Program Files\pandora_agent\PandoraFMS_Agent.url
Source: Uninstall.lnk.0.dr	LNK file: ..\..\..\..\..\..\Program Files\pandora_agent\uninst.exe
Source: Edit Config File.lnk.0.dr	LNK file: ..\..\..\..\..\..\Program Files\pandora_agent\scripts\edit_config_file.bat
Source: PandoraFMS_Agent_start.lnk.0.dr	LNK file: ..\..\..\..\..\..\Program Files\pandora_agent\scripts\start_pandora_agent.bat
Source: PandoraFMS_Agent_stop.lnk.0.dr	LNK file: ..\..\..\..\..\..\Program Files\pandora_agent\scripts\stop_pandora_agent.bat
Source: README.lnk.0.dr	LNK file: ..\..\..\..\..\..\Program Files\pandora_agent\README.txt

Found GUI installer (many successful clicks)

Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Automated click: OK
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Automated click: Next >
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Automated click: I Agree
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Automated click: Install
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Automated click: Next >
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Automated click: OK
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Automated click: Next >
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Automated click: OK
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Automated click: Next >
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Automated click: OK
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Automated click: Next >
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Automated click: OK
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Automated click: Next >
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Automated click: OK
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Automated click: Next >
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Automated click: OK
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Automated click: Next >
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Automated click: OK
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Automated click: Next >
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Automated click: OK
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Automated click: Next >
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Automated click: OK
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Automated click: Next >
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Automated click: OK
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Automated click: Next >
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Automated click: OK
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Automated click: Next >
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Automated click: OK
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Automated click: Next >
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Automated click: OK
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Automated click: Next >
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Automated click: OK
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Automated click: Next >
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Automated click: OK
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Automated click: Next >
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Automated click: OK
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Automated click: Next >
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Automated click: OK
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Automated click: Next >
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Automated click: OK
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Automated click: Next >
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Automated click: OK
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Automated click: Next >
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Automated click: OK
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Automated click: Next >
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Automated click: OK
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Automated click: Next >
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Automated click: OK
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Automated click: Next >
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Automated click: OK
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Automated click: Next >
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Automated click: OK
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Automated click: Next >
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Automated click: OK
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Automated click: Next >
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Automated click: OK
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Automated click: Next >
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Automated click: OK
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Automated click: Next >
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Automated click: OK
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Automated click: Next >
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Automated click: OK
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Automated click: Next >
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Automated click: OK
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Automated click: Next >
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Automated click: OK

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Found installer window with terms and condition text

Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe

Creates a directory in C:\Program Files

Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\temp	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\temp\pandora_agent_nsis.conf	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\collections	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\ref	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\help	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\key	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\key\id_dsa	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\key\id_dsa.pub	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\key\PUT_SSH_KEYS_HERE	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\LICENSE_EN.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\LICENSE_ES.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\config.tmp.conf	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\pandora.ico	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\PandoraAgent.exe	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\README.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\scripts	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\scripts\delete_at_job.bat	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\scripts\install_service_restart.bat	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\scripts\restart_pandora_agent.bat	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\scripts\start_pandora_agent.bat	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\scripts\edit_config_file.bat	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\scripts\stop_pandora_agent.bat	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\cmp.exe	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\curl.exe	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\curl-ca-bundle.crt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\cut.exe	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\date.exe	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\df.vbs	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\df_percent.vbs	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\expr.exe	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\gawk.exe	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\getreg.exe	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\getsnmp.bat	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\grep.exe	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\grep_log.exe	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\head.exe	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\logevent_log4x.vbs	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\ls.exe	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\md5.exe	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\agentname.vbs	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\autodiscover.exe	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\pandora_agent_exec.exe	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\AGENTX-MIB.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\DISMAN-EVENT-MIB.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\DISMAN-EXPRESSION-MIB.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\DISMAN-NSLOOKUP-MIB.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\DISMAN-PING-MIB.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\DISMAN-SCHEDULE-MIB.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\DISMAN-SCRIPT-MIB.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\DISMAN-TRACEROUTE-MIB.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\EtherLike-MIB.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\HCNUM-TC.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\HOST-RESOURCES-MIB.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\HOST-RESOURCES-TYPES.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\IANA-ADDRESS-FAMILY-NUMBERS-MIB.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\IANA-LANGUAGE-MIB.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\IANA-RTPROTO-MIB.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\IANAifType-MIB.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\ianalist	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\IF-INVERTED-STACK-MIB.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\IF-MIB.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\INET-ADDRESS-MIB.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\IP-FORWARD-MIB.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\IP-MIB.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\IPV6-ICMP-MIB.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\IPV6-MIB.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\IPV6-TC.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\IPV6-TCP-MIB.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\IPV6-UDP-MIB.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\LM-SENSORS-MIB.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\Makefile.in	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\Makefile.mib	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\makehtml.pl	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\mibfetch	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\MTA-MIB.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\NET-SNMP-AGENT-MIB.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\NET-SNMP-EXAMPLES-MIB.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\NET-SNMP-EXTEND-MIB.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\NET-SNMP-MIB.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\NET-SNMP-MONITOR-MIB.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\NET-SNMP-SYSTEM-MIB.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\NET-SNMP-TC.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\NETWORK-SERVICES-MIB.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\nodemap	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\NOTIFICATION-LOG-MIB.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\README.mibs	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\RFC-1215.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\RFC1155-SMI.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\RFC1213-MIB.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\rfclist	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\rfcmibs.diff	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\RMON-MIB.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\smistrip	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\SMUX-MIB.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\SNMP-COMMUNITY-MIB.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\SNMP-FRAMEWORK-MIB.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\SNMP-MPD-MIB.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\SNMP-NOTIFICATION-MIB.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\SNMP-PROXY-MIB.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\SNMP-TARGET-MIB.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\SNMP-USER-BASED-SM-MIB.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\SNMP-USM-AES-MIB.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\SNMP-USM-DH-OBJECTS-MIB.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\SNMP-VIEW-BASED-ACM-MIB.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\SNMPv2-CONF.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\SNMPv2-MIB.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\SNMPv2-SMI.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\SNMPv2-TC.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\SNMPv2-TM.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\TCP-MIB.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\TRANSPORT-ADDRESS-MIB.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\TUNNEL-MIB.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\UCD-DEMO-MIB.inc	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\UCD-DEMO-MIB.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\UCD-DISKIO-MIB.inc	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\UCD-DISKIO-MIB.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\UCD-DLMOD-MIB.inc	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\UCD-DLMOD-MIB.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\UCD-IPFILTER-MIB.inc	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\UCD-IPFILTER-MIB.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\UCD-IPFWACC-MIB.inc	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\UCD-IPFWACC-MIB.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\UCD-SNMP-MIB-OLD.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\UCD-SNMP-MIB.inc	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\UCD-SNMP-MIB.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mibs\UDP-MIB.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\pandora_revent.exe	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\pandora_update.exe	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\ps.vbs	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\du_percent.vbs	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\puttygen.exe	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\snmpget.exe	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\sort.exe	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\tail.exe	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\tentacle_client.exe	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\tentacle_server.exe	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\tr.exe	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\unzip.exe	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\wc.exe	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\cpuinfo.vbs	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\moboinfo.vbs	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\diskdrives.vbs	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\cdromdrives.vbs	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\videocardinfo.vbs	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\ifaces.vbs	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\monitors.vbs	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\printers.vbs	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\software_installed.vbs	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\raminfo.vbs	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\userslogged.vbs	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\productkey.vbs	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\productID.vbs	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\architecture.vbs	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\domain.vbs	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\osversion.vbs	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\df_percent_used.vbs	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\mem_percent_used.vbs	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\network.vbs	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\route_parser.exe	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\omnishell_client.exe	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\pandora_hardening.exe	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\pandora_security_win.exe	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\pandora_security_win.conf	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\util\ShortElev.exe	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\PandoraFMS_Agent.url	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Directory created: C:\Program Files\pandora_agent\uninst.exe	Jump to behavior
Source: C:\Program Files\pandora_agent\PandoraAgent.exe	Directory created: C:\Program Files\pandora_agent\pandora_agent.log	Jump to behavior

PE / OLE file has a valid certificate

Source: PandoraFMS_One_Agent_Windows-lts.x86_64.exe

Static PE information: certificate valid

Submission file is bigger than most known malware samples

Source: PandoraFMS_One_Agent_Windows-lts.x86_64.exe

Static file information: File size 62120984 > 1048576

Binary contains paths to debug symbols

Source:	Binary string: c:\projects\md5\Release\md5.pdb source: md5.exe.0.dr
Source:	Binary string: C:\data\buildbot-pdk-slave\pdk-grover\build\src\PerlApp\src\paperl512.pdb source: pandora_revent.exe.0.dr
Source:	Binary string: .Pdb'L source: PandoraFMS_One_Agent_Windows-lts.x86_64.exe
Source:	Binary string: .PdB] source: PandoraFMS_One_Agent_Windows-lts.x86_64.exe

Data Obfuscation

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe

Code function: 0_2_6E5C22B5 lstrcpyA,GlobalAlloc,GlobalFree,lstrcpyA,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GetModuleHandleA,LoadLibraryA,GetProcAddress,GetProcAddress,lstrcatA,GetProcAddress,lstrcpyA,GlobalFree,

0_2_6E5C22B5

PE file contains an invalid checksum

Source: expr.exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x56b2
Source: puttygen.exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x2f1b4
Source: tr.exe.0.dr	Static PE information: real checksum: 0x0 should be: 0xdb79
Source: ls.exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x1bafa
Source: cut.exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x5f11
Source: head.exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x14301
Source: uninst.exe.0.dr	Static PE information: real checksum: 0x3b4b43a should be: 0x40336
Source: gawk.exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x3c909
Source: cmp.exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x2de4
Source: md5.exe.0.dr	Static PE information: real checksum: 0x0 should be: 0xcd6f
Source: snmpget.exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x483f9
Source: sort.exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x13795
Source: grep.exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x1acfd
Source: wc.exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x122f4
Source: date.exe.0.dr	Static PE information: real checksum: 0x0 should be: 0xf68d
Source: tail.exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x18175

PE file contains sections with non-standard names

Source: PandoraAgent.exe.0.dr	Static PE information: section name: .xdata
Source: PandoraAgent.exe.0.dr	Static PE information: section name: /4
Source: PandoraAgent.exe.0.dr	Static PE information: section name: /19
Source: PandoraAgent.exe.0.dr	Static PE information: section name: /31
Source: PandoraAgent.exe.0.dr	Static PE information: section name: /45
Source: PandoraAgent.exe.0.dr	Static PE information: section name: /57
Source: PandoraAgent.exe.0.dr	Static PE information: section name: /70
Source: PandoraAgent.exe.0.dr	Static PE information: section name: /81
Source: PandoraAgent.exe.0.dr	Static PE information: section name: /92
Source: getreg.exe.0.dr	Static PE information: section name: .xdata
Source: autodiscover.exe.0.dr	Static PE information: section name: _RDATA
Source: omnishell_client.exe.0.dr	Static PE information: section name: .xdata
Source: ShortElev.exe.0.dr	Static PE information: section name: /4
Source: ShortElev.exe.0.dr	Static PE information: section name: /14
Source: ShortElev.exe.0.dr	Static PE information: section name: /29
Source: ShortElev.exe.0.dr	Static PE information: section name: /41
Source: ShortElev.exe.0.dr	Static PE information: section name: /55
Source: ShortElev.exe.0.dr	Static PE information: section name: /67
Source: ShortElev.exe.0.dr	Static PE information: section name: /80
Source: ShortElev.exe.0.dr	Static PE information: section name: /91
Source: ShortElev.exe.0.dr	Static PE information: section name: /102

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Code function: 0_2_00403141 push edx; mov dword ptr [esp], eax	0_2_00403156
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Code function: 0_2_00407F4B push ebx; mov dword ptr [esp], 00434A80h	0_2_00407F68
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Code function: 0_2_00407F4B push eax; mov dword ptr [esp], 00434A80h	0_2_00407FE0
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Code function: 0_2_00402E4B push ebx; mov dword ptr [esp], 00413040h	0_2_00402EF6
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Code function: 0_2_0040194E push ecx; mov dword ptr [esp], eax	0_2_0040195B
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Code function: 0_2_00401860 push eax; mov dword ptr [esp], ebx	0_2_0040192D
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Code function: 0_2_00403164 push edi; mov dword ptr [esp], eax	0_2_00403177
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Code function: 0_2_00404167 push ecx; mov dword ptr [esp], ebx	0_2_004041BB
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Code function: 0_2_00404167 push ebx; mov dword ptr [esp], 0000000Bh	0_2_004041D8
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Code function: 0_2_00404167 push eax; mov dword ptr [esp], 00000000h	0_2_00404263
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Code function: 0_2_00404167 push edx; mov dword ptr [esp], eax	0_2_004042A0
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Code function: 0_2_00404167 push eax; mov dword ptr [esp], ebx	0_2_00404382
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Code function: 0_2_00404167 push eax; mov dword ptr [esp], 00440400h	0_2_004044D8
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Code function: 0_2_00404167 push ecx; mov dword ptr [esp], 00431860h	0_2_0040454D
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Code function: 0_2_00404167 push eax; mov dword ptr [esp], 00431860h	0_2_004045B2
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Code function: 0_2_00404167 push ebx; mov dword ptr [esp], 00000002h	0_2_0040462A
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Code function: 0_2_00401B06 push edx; mov dword ptr [esp], eax	0_2_00401B53
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Code function: 0_2_00401B06 push edi; mov dword ptr [esp], 00412840h	0_2_00401B6A
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Code function: 0_2_00402613 push ecx; mov dword ptr [esp], ebx	0_2_00402634
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Code function: 0_2_00405A34 push esi; mov dword ptr [esp], ebx	0_2_00405A71
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Code function: 0_2_00405A34 push eax; mov dword ptr [esp], 0000000Ah	0_2_00405B27
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Code function: 0_2_00405A34 push ecx; mov dword ptr [esp], ebx	0_2_00405BF4
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Code function: 0_2_00405A34 push eax; mov dword ptr [esp], ebx	0_2_00405CA8
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Code function: 0_2_00405A34 push ecx; mov dword ptr [esp], 00000001h	0_2_00405CCD
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Code function: 0_2_00405A34 push ebx; mov dword ptr [esp], 004324C0h	0_2_00405CF4
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Code function: 0_2_0040183B push ecx; mov dword ptr [esp], eax	0_2_0040184E
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Code function: 0_2_004040CC push eax; mov dword ptr [esp], 00440400h	0_2_004040DF
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Code function: 0_2_004040CC push eax; mov dword ptr [esp], 00440400h	0_2_00404101
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Code function: 0_2_00404DDD push eax; mov dword ptr [esp], 00000405h	0_2_00405305
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Code function: 0_2_00405EED push eax; mov dword ptr [esp], ebx	0_2_00406093
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Code function: 0_2_00405EED push ebx; mov dword ptr [esp], 0043F400h	0_2_004060AE

Persistence and Installation Behavior

Drops PE files

Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	File created: C:\Program Files\pandora_agent\util\cmp.exe	Jump to dropped file
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	File created: C:\Program Files\pandora_agent\util\tentacle_client.exe	Jump to dropped file
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	File created: C:\Program Files\pandora_agent\util\route_parser.exe	Jump to dropped file
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	File created: C:\Program Files\pandora_agent\util\gawk.exe	Jump to dropped file
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	File created: C:\Program Files\pandora_agent\util\tentacle_server.exe	Jump to dropped file
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	File created: C:\Program Files\pandora_agent\uninst.exe	Jump to dropped file
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	File created: C:\Program Files\pandora_agent\util\pandora_update.exe	Jump to dropped file
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	File created: C:\Program Files\pandora_agent\util\grep_log.exe	Jump to dropped file
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	File created: C:\Program Files\pandora_agent\util\pandora_revent.exe	Jump to dropped file
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	File created: C:\Program Files\pandora_agent\util\expr.exe	Jump to dropped file
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	File created: C:\Program Files\pandora_agent\util\snmpget.exe	Jump to dropped file
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	File created: C:\Program Files\pandora_agent\util\autodiscover.exe	Jump to dropped file
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	File created: C:\Program Files\pandora_agent\util\getreg.exe	Jump to dropped file
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	File created: C:\Users\user\AppData\Local\Temp\nsiBE5B.tmp\nsDialogs.dll	Jump to dropped file
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	File created: C:\Users\user\AppData\Local\Temp\nsiBE5B.tmp\LangDLL.dll	Jump to dropped file
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	File created: C:\Program Files\pandora_agent\util\tr.exe	Jump to dropped file
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	File created: C:\Program Files\pandora_agent\util\wc.exe	Jump to dropped file
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	File created: C:\Users\user\AppData\Local\Temp\nsiBE5B.tmp\System.dll	Jump to dropped file
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	File created: C:\Program Files\pandora_agent\util\cut.exe	Jump to dropped file
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	File created: C:\Program Files\pandora_agent\util\puttygen.exe	Jump to dropped file
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	File created: C:\Program Files\pandora_agent\util\omnishell_client.exe	Jump to dropped file
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	File created: C:\Program Files\pandora_agent\util\pandora_hardening.exe	Jump to dropped file
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	File created: C:\Program Files\pandora_agent\util\sort.exe	Jump to dropped file
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	File created: C:\Program Files\pandora_agent\util\date.exe	Jump to dropped file
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	File created: C:\Program Files\pandora_agent\PandoraAgent.exe	Jump to dropped file
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	File created: C:\Program Files\pandora_agent\util\tail.exe	Jump to dropped file
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	File created: C:\Program Files\pandora_agent\util\grep.exe	Jump to dropped file
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	File created: C:\Program Files\pandora_agent\util\unzip.exe	Jump to dropped file
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	File created: C:\Program Files\pandora_agent\util\pandora_agent_exec.exe	Jump to dropped file
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	File created: C:\Program Files\pandora_agent\util\head.exe	Jump to dropped file
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	File created: C:\Program Files\pandora_agent\util\md5.exe	Jump to dropped file
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	File created: C:\Program Files\pandora_agent\util\curl.exe	Jump to dropped file
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	File created: C:\Program Files\pandora_agent\util\ShortElev.exe	Jump to dropped file
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	File created: C:\Program Files\pandora_agent\util\pandora_security_win.exe	Jump to dropped file
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	File created: C:\Program Files\pandora_agent\util\ls.exe	Jump to dropped file

Creates license or readme file

Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	File created: C:\Program Files\pandora_agent\LICENSE_EN.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	File created: C:\Program Files\pandora_agent\LICENSE_ES.txt	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	File created: C:\Program Files\pandora_agent\README.txt	Jump to behavior

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe

Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /Create /TN pandora_agent_restart /TR "\"C:\Program Files\pandora_agent\scripts\restart_pandora_agent.bat\"" /SC DAILY /ST 00:00:00 /F /RU SYSTEM

Stores files to the Windows start menu directory

Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu.lnk	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Start Pandora Agent.lnk	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Stop Pandora Agent.lnk	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PandoraFMS_Agent_v7.0NG.777.1	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PandoraFMS_Agent_v7.0NG.777.1\Website.lnk	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PandoraFMS_Agent_v7.0NG.777.1\Uninstall.lnk	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PandoraFMS_Agent_v7.0NG.777.1\Edit Config File.lnk	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PandoraFMS_Agent_v7.0NG.777.1\PandoraFMS_Agent_start.lnk	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PandoraFMS_Agent_v7.0NG.777.1\PandoraFMS_Agent_stop.lnk	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PandoraFMS_Agent_v7.0NG.777.1\README.lnk	Jump to behavior

Uses net.exe to stop services

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\net.exe net stop pandoraFMSagent

Hooking and other Techniques for Hiding and Protection

Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Potential context-aware VBS script found (checks for environment specific values)

Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Dropped file: Wscript.StdOut.WriteLine "<data><![CDATA[" & mobo.manufacturer & ";" & mobo.model & ";" & mobo.OEMStringArray(0) & "]]></data>"			Jump to dropped file
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Dropped file: Wscript.StdOut.WriteLine "<data><![CDATA[" & data.osarchitecture & "]]></data>"			Jump to dropped file

Found dropped PE file which has not been started or loaded

Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Dropped PE file which has not been started: C:\Program Files\pandora_agent\util\tentacle_client.exe	Jump to dropped file
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Dropped PE file which has not been started: C:\Program Files\pandora_agent\util\route_parser.exe	Jump to dropped file
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Dropped PE file which has not been started: C:\Program Files\pandora_agent\util\cmp.exe	Jump to dropped file
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Dropped PE file which has not been started: C:\Program Files\pandora_agent\util\gawk.exe	Jump to dropped file
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Dropped PE file which has not been started: C:\Program Files\pandora_agent\uninst.exe	Jump to dropped file
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Dropped PE file which has not been started: C:\Program Files\pandora_agent\util\tentacle_server.exe	Jump to dropped file
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Dropped PE file which has not been started: C:\Program Files\pandora_agent\util\pandora_update.exe	Jump to dropped file
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Dropped PE file which has not been started: C:\Program Files\pandora_agent\util\grep_log.exe	Jump to dropped file
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Dropped PE file which has not been started: C:\Program Files\pandora_agent\util\expr.exe	Jump to dropped file
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Dropped PE file which has not been started: C:\Program Files\pandora_agent\util\pandora_revent.exe	Jump to dropped file
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Dropped PE file which has not been started: C:\Program Files\pandora_agent\util\snmpget.exe	Jump to dropped file
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Dropped PE file which has not been started: C:\Program Files\pandora_agent\util\autodiscover.exe	Jump to dropped file
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Dropped PE file which has not been started: C:\Program Files\pandora_agent\util\getreg.exe	Jump to dropped file
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsiBE5B.tmp\nsDialogs.dll	Jump to dropped file
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsiBE5B.tmp\LangDLL.dll	Jump to dropped file
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Dropped PE file which has not been started: C:\Program Files\pandora_agent\util\tr.exe	Jump to dropped file
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Dropped PE file which has not been started: C:\Program Files\pandora_agent\util\wc.exe	Jump to dropped file
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Dropped PE file which has not been started: C:\Program Files\pandora_agent\util\cut.exe	Jump to dropped file
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsiBE5B.tmp\System.dll	Jump to dropped file
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Dropped PE file which has not been started: C:\Program Files\pandora_agent\util\puttygen.exe	Jump to dropped file
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Dropped PE file which has not been started: C:\Program Files\pandora_agent\util\pandora_hardening.exe	Jump to dropped file
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Dropped PE file which has not been started: C:\Program Files\pandora_agent\util\omnishell_client.exe	Jump to dropped file
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Dropped PE file which has not been started: C:\Program Files\pandora_agent\util\sort.exe	Jump to dropped file
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Dropped PE file which has not been started: C:\Program Files\pandora_agent\util\date.exe	Jump to dropped file
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Dropped PE file which has not been started: C:\Program Files\pandora_agent\util\tail.exe	Jump to dropped file
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Dropped PE file which has not been started: C:\Program Files\pandora_agent\util\grep.exe	Jump to dropped file
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Dropped PE file which has not been started: C:\Program Files\pandora_agent\util\unzip.exe	Jump to dropped file
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Dropped PE file which has not been started: C:\Program Files\pandora_agent\util\pandora_agent_exec.exe	Jump to dropped file
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Dropped PE file which has not been started: C:\Program Files\pandora_agent\util\head.exe	Jump to dropped file
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Dropped PE file which has not been started: C:\Program Files\pandora_agent\util\md5.exe	Jump to dropped file
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Dropped PE file which has not been started: C:\Program Files\pandora_agent\util\curl.exe	Jump to dropped file
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Dropped PE file which has not been started: C:\Program Files\pandora_agent\util\pandora_security_win.exe	Jump to dropped file
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Dropped PE file which has not been started: C:\Program Files\pandora_agent\util\ls.exe	Jump to dropped file

Sample execution stops while process was sleeping (likely an evasion)

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\net1.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	File Volume queried: C:\Program Files FullSizeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	File Volume queried: C:\Program Files FullSizeInformation			Jump to behavior

Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Code function: 0_2_00407F13 FindFirstFileA,FindClose,	0_2_00407F13
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Code function: 0_2_004083A8 DeleteFileA,DeleteFileA,lstrlenA,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,	0_2_004083A8
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Code function: 0_2_0040342B FindFirstFileA,	0_2_0040342B

Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe

API call chain: ExitProcess graph end node

graph_0-5982

Anti Debugging

Found API chain indicative of debugger detection

Source: C:\Program Files\pandora_agent\util\ShortElev.exe

Debugger detection routine: QueryPerformanceCounter, DebugActiveProcess, DecisionNodes, ExitProcess or Sleep

graph_15-1473

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe

0_2_6E5C22B5

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe

Code function: 0_2_00DB1BCC CreateControl,GetProcessHeap,GetProcessHeap,HeapAlloc,GetProcessHeap,GetProcessHeap,HeapReAlloc,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,CreateWindowExA,SetPropA,SendMessageA,SendMessageA,SendMessageA,SetWindowLongA,GetProcessHeap,HeapFree,

0_2_00DB1BCC

Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Code function: 0_2_6E5C3AB0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,abort,	0_2_6E5C3AB0
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Code function: 0_2_6E5C3AAC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,abort,	0_2_6E5C3AAC
Source: C:\Program Files\pandora_agent\util\ShortElev.exe	Code function: 15_2_00401179 Sleep,Sleep,SetUnhandledExceptionFilter,_acmdln,malloc,strlen,malloc,memcpy,__initenv,_cexit,_amsg_exit,_initterm,GetStartupInfoA,_initterm,exit,	15_2_00401179
Source: C:\Program Files\pandora_agent\util\ShortElev.exe	Code function: 15_2_004021C0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,abort,	15_2_004021C0
Source: C:\Program Files\pandora_agent\util\ShortElev.exe	Code function: 15_2_004021BC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,abort,	15_2_004021BC

HIPS / PFW / Operating System Protection Evasion

Creates a process in suspended mode (likely to inject code)

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\net.exe net stop pandoraFMSagent	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Process created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 stop pandoraFMSagent	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Program Files\pandora_agent\PandoraAgent.exe PandoraAgent.exe --install	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net stop PandoraFMSAgent	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net start PandoraFMSAgent	Jump to behavior
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 stop PandoraFMSAgent	Jump to behavior
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 start PandoraFMSAgent	Jump to behavior

Language, Device and Operating System Detection

Queries the volume information (name, serial number etc) of a device

Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe

Code function: 0_2_6E5C3A00 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

0_2_6E5C3A00

Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe

0_2_00404167

Lowering of HIPS / PFW / Operating System Security Settings

Disables security and backup related services

Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c net stop pandoraFMSagent
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c net stop pandoraFMSagent
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c net stop pandoraFMSagent
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c net stop pandoraFMSagent
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c net stop pandoraFMSagent
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c net stop pandoraFMSagent
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c net stop pandoraFMSagent
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c net stop pandoraFMSagent
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c net stop pandoraFMSagent
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c net stop pandoraFMSagent
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c net stop pandoraFMSagent
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c net stop pandoraFMSagent	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c net stop pandoraFMSagent	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c net stop pandoraFMSagent	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c net stop pandoraFMSagent	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c net stop pandoraFMSagent	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c net stop pandoraFMSagent	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c net stop pandoraFMSagent	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c net stop pandoraFMSagent	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c net stop pandoraFMSagent	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c net stop pandoraFMSagent	Jump to behavior
Source: C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c net stop pandoraFMSagent	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	11 Scripting	Valid Accounts	2 Command and Scripting Interpreter	1 Windows Service	1 Windows Service	3 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	11 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	11 Process Injection	1 Virtualization/Sandbox Evasion	LSASS Memory	21 Security Software Discovery	Remote Desktop Protocol	1 Clipboard Data	1 Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Service Execution	11 Scripting	1 Scheduled Task/Job	1 Disable or Modify Tools	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Native API	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	11 Process Injection	NTDS	2 File and Directory Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	1 DLL Side-Loading	1 DLL Side-Loading	1 Obfuscated Files or Information	LSA Secrets	15 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	1 DLL Search Order Hijacking	1 DLL Search Order Hijacking	1 Software Packing	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Search Order Hijacking	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
PandoraFMS_One_Agent_Windows-lts.x86_64.exe	3%	ReversingLabs

Dropped Files

Source	Detection	Scanner
C:\Program Files\pandora_agent\PandoraAgent.exe	0%	ReversingLabs
C:\Program Files\pandora_agent\uninst.exe	0%	ReversingLabs
C:\Program Files\pandora_agent\util\ShortElev.exe	0%	ReversingLabs
C:\Program Files\pandora_agent\util\autodiscover.exe	3%	ReversingLabs
C:\Program Files\pandora_agent\util\cmp.exe	3%	ReversingLabs
C:\Program Files\pandora_agent\util\curl.exe	0%	ReversingLabs
C:\Program Files\pandora_agent\util\cut.exe	4%	ReversingLabs
C:\Program Files\pandora_agent\util\date.exe	4%	ReversingLabs
C:\Program Files\pandora_agent\util\expr.exe	0%	ReversingLabs
C:\Program Files\pandora_agent\util\gawk.exe	4%	ReversingLabs
C:\Program Files\pandora_agent\util\getreg.exe	0%	ReversingLabs
C:\Program Files\pandora_agent\util\grep.exe	3%	ReversingLabs
C:\Program Files\pandora_agent\util\grep_log.exe	0%	ReversingLabs
C:\Program Files\pandora_agent\util\head.exe	4%	ReversingLabs
C:\Program Files\pandora_agent\util\ls.exe	4%	ReversingLabs
C:\Program Files\pandora_agent\util\md5.exe	0%	ReversingLabs
C:\Program Files\pandora_agent\util\mibs\makehtml.pl	0%	ReversingLabs
C:\Program Files\pandora_agent\util\mibs\mibfetch	0%	ReversingLabs
C:\Program Files\pandora_agent\util\mibs\smistrip	0%	ReversingLabs
C:\Program Files\pandora_agent\util\omnishell_client.exe	0%	ReversingLabs
C:\Program Files\pandora_agent\util\pandora_agent_exec.exe	3%	ReversingLabs
C:\Program Files\pandora_agent\util\pandora_hardening.exe	13%	ReversingLabs
C:\Program Files\pandora_agent\util\pandora_revent.exe	0%	ReversingLabs
C:\Program Files\pandora_agent\util\pandora_security_win.exe	11%	ReversingLabs
C:\Program Files\pandora_agent\util\pandora_update.exe	0%	ReversingLabs
C:\Program Files\pandora_agent\util\puttygen.exe	0%	ReversingLabs
C:\Program Files\pandora_agent\util\route_parser.exe	0%	ReversingLabs
C:\Program Files\pandora_agent\util\snmpget.exe	4%	ReversingLabs
C:\Program Files\pandora_agent\util\sort.exe	3%	ReversingLabs
C:\Program Files\pandora_agent\util\tail.exe	3%	ReversingLabs
C:\Program Files\pandora_agent\util\tentacle_client.exe	0%	ReversingLabs
C:\Program Files\pandora_agent\util\tentacle_server.exe	4%	ReversingLabs
C:\Program Files\pandora_agent\util\tr.exe	4%	ReversingLabs
C:\Program Files\pandora_agent\util\unzip.exe	0%	ReversingLabs
C:\Program Files\pandora_agent\util\wc.exe	4%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsiBE5B.tmp\LangDLL.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsiBE5B.tmp\System.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsiBE5B.tmp\nsDialogs.dll	0%	ReversingLabs

Source	Detection	Scanner	Label
http://nsis.sf.net/NSIS_Error	0%	URL Reputation	safe
http://nsis.sf.net/NSIS_ErrorError	0%	URL Reputation	safe
http://www.openssl.org/support/faq.html	0%	URL Reputation	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.openssl.org/support/faq.htmlRAND	PandoraAgent.exe, 00000008.00000000.1897515760.000000000079D000.00000002.00000001.01000000.0000000B.sdmp, PandoraAgent.exe, 0000001B.00000002.4162596872.000000000079D000.00000002.00000001.01000000.0000000B.sdmp, PandoraAgent.exe.0.dr	false		unknown
http://curl.haxx.se/libcurl/c/curl_easy_setopt.html	curl.exe.0.dr	false		unknown
http://nsis.sf.net/NSIS_Error	PandoraFMS_One_Agent_Windows-lts.x86_64.exe, uninst.exe.0.dr	false	URL Reputation: safe	unknown
http://www.pandorafms.com	PandoraFMS_One_Agent_Windows-lts.x86_64.exe, 00000000.00000002.4162559671.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, PandoraFMS_Agent.url.0.dr	false		unknown
http://www.pandorafms.com.	PandoraFMS_One_Agent_Windows-lts.x86_64.exe, 00000000.00000002.4163286809.0000000003963000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.ietf.org/html.charters/agentx-charter.html	AGENTX-MIB.txt.0.dr	false		unknown
http://https://-.://%s%s%s/%sall	curl.exe.0.dr	false		unknown
http://www.ietf.org/html.charters/ipv6-charter.html	TCP-MIB.txt.0.dr, IP-FORWARD-MIB.txt.0.dr	false		unknown
http://pandorafms.org	config.tmp.conf.0.dr, pandora_agent_nsis.conf.0.dr	false		unknown
http://www.google.com	config.tmp.conf.0.dr, pandora_agent_nsis.conf.0.dr	false		unknown
http://curl.haxx.se/P	curl.exe.0.dr	false		unknown
http://www.fourmilab.ch/	md5.exe.0.dr	false		unknown
http://nsis.sf.net/NSIS_ErrorError	PandoraFMS_One_Agent_Windows-lts.x86_64.exe, uninst.exe.0.dr	false	URL Reputation: safe	unknown
http://curl.haxx.se/docs/copyright.htmlD	curl.exe.0.dr	false		unknown
http://curl.haxx.se/docs/sslcerts.html	curl.exe.0.dr	false		unknown
http://www.iana.org/	INET-ADDRESS-MIB.txt.0.dr	false		unknown
http://www.info-zip.org/UnZip.htmlDVarFileInfo$	unzip.exe.0.dr	false		unknown
http://www.info-zip.org/zip-bug.html;	unzip.exe.0.dr	false		unknown
https://support.pandorafms.com/	PandoraFMS_One_Agent_Windows-lts.x86_64.exe, 00000000.00000002.4162559671.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, LICENSE_EN.txt.0.dr, LICENSE_ES.txt.0.dr	false		unknown
http://www.iana.org/assignments/icmp-parameters	IP-MIB.txt.0.dr	false		unknown
http://www.iana.org/assignments/icmpv6-parameters	IP-MIB.txt.0.dr	false		unknown
http://www.openssl.org/support/faq.html	PandoraAgent.exe, 00000008.00000000.1897515760.000000000079D000.00000002.00000001.01000000.0000000B.sdmp, PandoraAgent.exe, 0000001B.00000002.4162596872.000000000079D000.00000002.00000001.01000000.0000000B.sdmp, PandoraAgent.exe.0.dr	false	URL Reputation: safe	unknown
http://curl.haxx.se/docs/http-cookies.html	PandoraAgent.exe, 00000008.00000002.1898706731.0000000000736000.00000002.00000001.01000000.0000000B.sdmp, PandoraAgent.exe, 0000001B.00000000.1928109476.0000000000736000.00000002.00000001.01000000.0000000B.sdmp, curl.exe.0.dr, PandoraAgent.exe.0.dr	false		unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1543756
Start date and time:	2024-10-28 11:37:59 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 50s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	30
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	PandoraFMS_One_Agent_Windows-lts.x86_64.exe
Detection:	SUS
Classification:	sus32.evad.winEXE@39/174@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 85% Number of executed functions: 67 Number of non-executed functions: 42
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: PandoraFMS_One_Agent_Windows-lts.x86_64.exe

Simulations

Behavior and APIs

Time	Type	Description
10:39:15	Task Scheduler	Run new task: pandora_agent_restart path: "C:\Program Files\pandora_agent\scripts\restart_pandora_agent.bat"

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Program Files\pandora_agent\util\cmp.exe	saa.zip	Get hash	malicious	Unknown	Browse
	setup_http_scclis.fcs.com_8080.exe	Get hash	malicious	Unknown	Browse
	setup_http_scclis.fcs.com_8080.exe	Get hash	malicious	Unknown	Browse
	Pandora FMS Windows Agent v7.0NG.772_x86_64.exe	Get hash	malicious	Unknown	Browse
C:\Program Files\pandora_agent\util\ShortElev.exe	Pandora FMS Windows Agent v7.0NG.772_x86_64.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Program Files\pandora_agent\LICENSE_EN.txt

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	Non-ISO extended-ASCII text, with very long lines (1785), with CRLF line terminators
Category:	dropped
Size (bytes):	43650
Entropy (8bit):	4.469870888238485
Encrypted:	false
SSDEEP:	768:J7o0jN6DmQm019M+eM32qdFo748El964bHmt2oSXrF4qoGY9cnbZ3zoVr5Q4IaKE:do0vQmKGdYoq8923E6ZFVO
MD5:	5D08FE845FD78A8E0C2A29A2EB6882B7
SHA1:	5F78F8DDD2D7C34ECF43722E3F419C7A736EA988
SHA-256:	748DAA8531D8546A84DC62A00145400E0A0117EA7218C56C0DA5E6052FDEEDC1
SHA-512:	834ABF79B4A5D4D0D3976300F5AF632BAC23E011DB1DB9241E8F139BB9918BFE62E4F3F88DE7C3BF064466A28605739640EE233D9630F3EC32C164DD0F79F2E9
Malicious:	false
Preview:	License and terms of use Pandora FMS..Review: May 2024....General contract conditions..These general conditions of PandoraFMS. (the "Conditions") regulate the terms in which Pandora FMS gives intuitu personae to the Client the use of the PandoraFMS., Pandora ITSM or Pandora RC application and of the contracted components as well as the terms in which the support services and the other applicable conditions will be provided. The license of use is fully valid regardless of the services contracted and is an essential part of the contract signed between the parties together with the order or purchase order (if any) and the commercial proposal (all of them, together, the Contract)...These Terms and Conditions are binding to the Client and all entities and persons acting on the Client's behalf or in collaboration with the Client, whether they be employees, associates, collaborators, partners, suppliers or any other (hereinafter, the Associates). Particularly, it is understood that all refere

C:\Program Files\pandora_agent\LICENSE_ES.txt

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	ISO-8859 text, with very long lines (1875), with CRLF line terminators
Category:	dropped
Size (bytes):	47992
Entropy (8bit):	4.440165166034074
Encrypted:	false
SSDEEP:	768:MAEEwnV6zcg6jsX5NRea6NWDDQPLqUZiXXvJt0kMFoW5vdl6gL/DdBgw8OsZ:BVwnV6zcg6jq5feabvQ+UZiBt0ZFo6lE
MD5:	8AFB4BCEAC29C741EAAFE8501FD6674E
SHA1:	12DA7F60B1DC0601EAB1686BD06385C1D4B93EB4
SHA-256:	F9872441254A9A50AF3613B0BFC730797416F89FE35E2751482DA7F985A5986E
SHA-512:	7427110A8AA29E8C386F034B9FCE4D0CAC360774F38703C543B65A2BFAF50C05628EF8B56AEFD1E136D79D5D47758135D0FEE3005AF4EB800803664692C1B10F
Malicious:	false
Preview:	Licencia y condiciones de uso de Pandora FMS..Revisi.n: Mayo 2024....Condiciones generales de contrataci.n..Las presentes condiciones generales de PandoraFMS. (las condiciones, en lo sucesivo) regulan los t.rminos en que Pandora FMS cede intuitu personae al Cliente el uso de la aplicaci.n PandoraFMS., Pandora ITSM, Pandora NMS o Pandora RC y de los componentes asociados contratados as. como los t.rminos en que se prestar.n los servicios de soporte y las dem.s condiciones aplicables. La licencia de uso tiene plena validez con independencia de los servicios contratados y es parte esencial del contrato firmado entre las partes junto con la orden de pedido o de compra (en su caso) y la propuesta comercial (todos ellos, en su conjunto, el Contrato)...Las presentes condiciones obligan al Cliente y a todas las entidades y personas que act.en en su nombre, por su cuenta o en colaboraci.n con el Cliente, ya sean trabajadores, socios, colaboradores, partners, proveedores o cualesquiera otros (e

C:\Program Files\pandora_agent\PandoraAgent.exe

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	7811449
Entropy (8bit):	6.228220490058277
Encrypted:	false
SSDEEP:	98304:iTIdfJqZmkm7rnsb9xbmFWm1pS/+DyzaSnfvmZddTGhLurIhANb6byz0MFKVsXSU:itZfLb0pukyLsui
MD5:	D885123606524EA6542E5AC351FB3529
SHA1:	4A227CD193A6C9E52DD45CEE88E882392536D1B2
SHA-256:	60D2F3629D5AAF94895FC7190D82E054EB8C434A5B0E0C0C5F0DD32CFEBBD413
SHA-512:	B93F72B2E70914282AF5BF2A2FB44B343537D601AC7696087EAF722C1B5DB81B5C626F1379E5312F9FC57A8CBD74A23CB2E715EEA060F74C98482DCC8104F919
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....u.f..X._.....'.......2...B...............@...............................Z.......w...`... ..............................................pC.,0....C.P.....>............................................. .C.(....................{C..............................text... .2.......2.................`..`.data....<... 2..H....2.............@.p..rdata.. ....`3......P3.............@..@.pdata........>.......>.............@.0@.xdata....... @.......@.............@.@@.bss.... .....B.......................p..idata..,0...pC..2....B.............@.0..CRT....h.....C.......B.............@.@..tls....h.....C.......B.............@.`..rsrc...P.....C.......B.............@.0./4......`.....C.......B.............@..B/19...........C.......B.............@..B/31...........R.......Q.............@..B/45..........`S......<R.............@..B/57......i...`T..j...6S.............@.@B/70.....

C:\Program Files\pandora_agent\PandoraFMS_Agent.url

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	MS Windows 95 Internet shortcut text (URL=<http://www.pandorafms.com>), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	51
Entropy (8bit):	4.603222890736578
Encrypted:	false
SSDEEP:	3:HRAbABGQYm/0S4XUUWZF:HRYFVm/r4TqF
MD5:	122B5BED58055866A70C579A063F7DB7
SHA1:	471DB72AD3631191C4A1FAE84A549BACA2869946
SHA-256:	FF186D9000AAE2A5C32EBFF00BEBEB8561BC45A3AEC98E8E2ACEAF1B9C3772CF
SHA-512:	E27FDCFB11F4B7FD7EE2D46E87B8658AEB26FD68BB50A85ADB3DD57074219DC8DD683EC64F458A2E0E55E6404B3C2BD8B1830C74AA5F76B4D5C43799E3FB3CC7
Malicious:	false
Preview:	[InternetShortcut]..URL=http://www.pandorafms.com..

C:\Program Files\pandora_agent\README.txt

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	ASCII text, with very long lines (556), with CRLF, LF line terminators
Category:	dropped
Size (bytes):	15956
Entropy (8bit):	4.6916421717170635
Encrypted:	false
SSDEEP:	384:q7Mheefshv7+GyIUhEFr55XjPVc5UHu8OmTAQMAMrLUtXbsvb4z71zj+:speEhaI4EFr/Rc5UHxNxdoUtXbEb4z74
MD5:	D87FEC777F849B7CECDDA2A243091AB9
SHA1:	F44691748EEB72915CF9BC48903C8BBC3F3F38C5
SHA-256:	F61A2C07D84F668B577DC61B0DADE1D11FF1E6352D2831BD084FD24188143CC8
SHA-512:	7ED1F6A6ED812D0C7A18B4F14D7EE4DE917CCE73EE3A07DD4821FB45B1A2A6DCECED0F3FC83A3432C1B0A2231E76CAD5555554A7909E9F133BD19D2B7430ABE1
Malicious:	false
Preview:	Pandora FMS Agents...==================......Please checkout our latest Pandora FMS documentation at http://pandorafms.org....This README file is not intended to be a documentation, only a brief introduction to Pandora FMS windows agent.......Understanding what is a Pandora FMS Agent...-----------------------------------------......Pandora FMS agents collect all system's data. They are executed in each local system, although they can also collect remote information by installing monitoring systems for the agent in several different machines - called satellite agents.......They are developed to work under a given platform, making use of the specific tools of the language being used: VBSCript/Windows Scripting for Microsoft platforms (Win2000, WinXP y Win2003), ShellScripting for UNIX - which includes GNU/Linux, Solaris, AIX, HP-UX and BSD, as well as the Nokia's IPSO. Pandora agents can be developed in virtually any language, given its simple API system and being open source. There are

C:\Program Files\pandora_agent\config.tmp.conf

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	C source, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	13433
Entropy (8bit):	4.956484636428058
Encrypted:	false
SSDEEP:	192:eIaSjJZcaH1Ym0hVkgxcT8fCeSILsEwU7yl0tMd4Py48WJm43fpMGX4l8PMda7O1:P/co6m0hqicT8SIIEZ1PB8XDPbY5b/+
MD5:	77C7E1A77B5BA039E8614913219CFE35
SHA1:	EB7C8D479ED77D6CC6E5A8B6822D7DC8F7146B8B
SHA-256:	16FF3398E8AB258ED8D4C68D424029FD208B9B26636133FEFBCAA9BBC46AA0CB
SHA-512:	53F763BF3924C3AAC71B9DB454C61D52BAE10F59A35F4CF0010F7EC13F959D9F3A6EE09E701F864E6D986D19204CCA1795CDEF919150D693FF5CD0A25D69CC1F
Malicious:	false
Preview:	#include "C:\Archivos de programa\pandora_agent\pandora_agent_alt.conf".#broker_agent name_agent..# Agent uses your hostname automatically, if you need to change agent name.# use directive agent_name (do not use blank spaces, please)..# This parameter is CASE SENSITIVE...# agent_name My_Custom_Agent_name..# To define agent name by specific command, define 'agent_name_cmd'..# If agent_name_cmd is defined, agent_name is ignored..# (In the following example, agent name is 'hostname_IP').# If set to __rand__ the agent will generate a random name..#agent_name_cmd cscript.exe //B "%ProgramFiles%\Pandora_Agent\util\agentname.vbs".agent_name_cmd __rand__..# Agent alias. Name should be unique rather than alias. Hostname by default.# agent_alias $Alias$..#Parent agent_name.#parent_agent_name caprica..# address: Enforce to server a ip address to this agent .# You can also try to detect the first IP using "auto", for example.address auto.# or setting a fixed IP address, like for example:.#address

C:\Program Files\pandora_agent\key\id_dsa

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	PEM DSA private key
Category:	dropped
Size (bytes):	668
Entropy (8bit):	5.979179465329993
Encrypted:	false
SSDEEP:	12:Lr724byv6crXRGw5hQT4m1xQo5MajP/04SSpsYzkl9hcKBU8HKs7mkrgOSxXzKvn:Lr724bBKksorH+SpsVlTVtHf3iD2X
MD5:	A440B1209E716B8459F3DBC149CEEE84
SHA1:	F4334C049829845076E20881D51A3DC06BEA5736
SHA-256:	C70AA13AE0FF89BD5299EA1E29743A525E4ED94BEB34963D7CEAE06C35FBAEDE
SHA-512:	142667818DD080FCF53425D6FA2D6B8C616936E80428D00FA8B7F404895ECC00C935D98F1CB034C0E5B328AE919D5BCF9C4978C141F2FCCAAFB976C48FAB9A6F
Malicious:	false
Preview:	-----BEGIN DSA PRIVATE KEY-----.MIIBuQIBAAKBgHv83WLb4FhOIyqFJjaGvrdBAlhQysvIxeVJRVU40c0hmc0dgWBr.LDJ2gWJu3YlewJGjYtAOTdYH231QrIiBpiutqmKyfwGGo11g7uz3hZB0922Q+4LR.g6ARdCpvWyxYOx4SJDNCPfDqQT/S0OIo7XikU9Pls4khQGRLeKWmTW69AhUAjwNN.7ATXOSuUorVyHZ1kh9QUDU0CgYAFp5pKgPsGW1pxrMPp9jpztfnY4UShJv1kVqKH.9uPc0UksseOTcTtgvZIn7YAete88Jswg1M14VBmCV0MuBLRm5ba0EoXzPxf3/hFX.+AArDz58QklFdSXs07pg66b9L5YxhxrH37wQK4M+6OGiUsBCZDo4PnIy3sfmaPSo.U4nAlAKBgHthtTw3NVOBCfNJGl7/fmi8uVX5Z3PARqyYfuoGmy1TGpx0oDllsXwB.d4gGSGAeNYhT83ndABtttY2UqBfnI8VHgsxepdG0HqtkLDjQLhGTNA/Y2vhO35Nd.kSDsnUDn1pTUu1//Xlx7VHxf/5DPBIF2lts+Hfk7c1+d4eTDcs6FAhRZpURIcied.hWYzHMCW/HEv/C/plQ==.-----END DSA PRIVATE KEY-----.

C:\Program Files\pandora_agent\key\id_dsa.pub

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	OpenSSH DSA public key
Category:	dropped
Size (bytes):	603
Entropy (8bit):	5.9180826840201695
Encrypted:	false
SSDEEP:	12:BayIZzjeRFRevUa+p++2WbSvQZJkE/L7ZWC6r+rbHKcN7mkrggSxL:x4eRavmEOJkiLVIGbHr1M
MD5:	BAB6678DF71AF38522D1EDBB6A2378CF
SHA1:	8EC2C526483BB2DD8CD61F2E11FF43DA4800FEEC
SHA-256:	E0E8C684D8BEC7B5922D3A70DF615FAA1034B2F4A559C5AB838065D56F137454
SHA-512:	26D56CD50E831AB3239F636E71F5B704F863FC5D23EB97E4AD1428C9DA0055804017691DA6ACDB95FEDCCF119BA2C31809365E5AD9AB52A48E961D52094676EC
Malicious:	false
Preview:	ssh-dss AAAAB3NzaC1kc3MAAACAe/zdYtvgWE4jKoUmNoa+t0ECWFDKy8jF5UlFVTjRzSGZzR2BYGssMnaBYm7diV7AkaNi0A5N1gfbfVCsiIGmK62qYrJ/AYajXWDu7PeFkHT3bZD7gtGDoBF0Km9bLFg7HhIkM0I98OpBP9LQ4ijteKRT0+WziSFAZEt4paZNbr0AAAAVAI8DTewE1zkrlKK1ch2dZIfUFA1NAAAAgAWnmkqA+wZbWnGsw+n2OnO1+djhRKEm/WRWoof249zRSSyx45NxO2C9kiftgB617zwmzCDUzXhUGYJXQy4EtGbltrQShfM/F/f+EVf4ACsPPnxCSUV1JezTumDrpv0vljGHGsffvBArgz7o4aJSwEJkOjg+cjLex+Zo9KhTicCUAAAAgHthtTw3NVOBCfNJGl7/fmi8uVX5Z3PARqyYfuoGmy1TGpx0oDllsXwBd4gGSGAeNYhT83ndABtttY2UqBfnI8VHgsxepdG0HqtkLDjQLhGTNA/Y2vhO35NdkSDsnUDn1pTUu1//Xlx7VHxf/5DPBIF2lts+Hfk7c1+d4eTDcs6F dsa-key-20070820..

C:\Program Files\pandora_agent\pandora.ico

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	MS Windows icon resource - 1 icon, -62x-63, 32 bits/pixel
Category:	dropped
Size (bytes):	155234
Entropy (8bit):	2.437683176628952
Encrypted:	false
SSDEEP:	192:cE0EXDTjnHnHnwEn0E0+lJ5E2Tb+g0ck3ttTS2GdzboZCRxLyhpABNx7mRLBo0Nx:cE0EzQE0EBkPT/2czTPTEi7oAHEk
MD5:	85D847A303A902597C10499B564309E6
SHA1:	95FBA86DCCA8A12E1E62FF35DDF5C070729EF165
SHA-256:	0DDD6C3227F03A0468C7827D7FE31A57C88912E68FFFEC43663D49B3BDC7161A
SHA-512:	675748F58F9175BD9A31DC3A8C15ED7A69EAFDBB34C3CB4B2B46A8ACDC9FB247DEAFE4D262067575E16A39E2FB18A9F3A36E3591B810E7DC87814C854055E14F
Malicious:	false
Preview:	............ .L^......(............. ......I............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\pandora_agent\pandora_agent.log

Download File

Process:	C:\Program Files\pandora_agent\PandoraAgent.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	43
Entropy (8bit):	4.414409522043331
Encrypted:	false
SSDEEP:	3:tR7qdCcfUs1DASw:nmCurpw
MD5:	90BF5F549941BDFA86FC681EFAA7A5A5
SHA1:	47EA99919D2CE871B3D3A25464BDAA4811B6C705
SHA-256:	DEC8109576774FA56B25A90BDEEDAB8D13AF5AB2EF6699DE7719DC7AF979504D
SHA-512:	48793C61D3AB8FD88929254A3662A1081034D9D3BCC51B3BA292D2D194CFD2AEA33845E56C782159D65BB66DD0D96E5A280BAC7FF4BA11B164A5C9CC3C252600
Malicious:	false
Preview:	2024-10-28 06:39:12 Pandora agent stopped..

C:\Program Files\pandora_agent\scripts\delete_at_job.bat

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	112
Entropy (8bit):	4.714203949796385
Encrypted:	false
SSDEEP:	3:UCXwXU6uL8UH984uHMkgmHhtGPmkN32TNi:z56X2984uVgmHhtgmkMTQ
MD5:	D6F8FD64C1C88BA05E44E2ADE2023DDF
SHA1:	9F498E3EF71A445B931B7B850B86AE09DAC69819
SHA-256:	87ED7D01804E4567EDE299F9446005CCA5BBD198DD42CC08E913307935D4DCDE
SHA-512:	227045482575D036127C46793303CCF47987BAD16D4F363B9166CFDB49413566CABCB5247A62D18E480A7DE207CF6AB8C80A1A83B33F78FCD68BE3A61597FA2A
Malicious:	false
Preview:	AT\|grep restart_pandora_agent\|gawk "{print \"@AT \"$1\" /DELETE\"}" > DEL-AT.BAT & @DEL-AT.BAT & DEL DEL-AT.BAT.

C:\Program Files\pandora_agent\scripts\edit_config_file.bat

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	63
Entropy (8bit):	4.417933400364558
Encrypted:	false
SSDEEP:	3:RT9mbZjd1KUkBKUMQDHy:RTEpSrDHy
MD5:	243807D40129ADEDE071D14B06563C78
SHA1:	B6262527832AA4C9AD99242DC2C2B4D6DD9B11A9
SHA-256:	9BBF07AB1790772F53E71148713AB582725D28FCBA65138F3279EB557DFF5FA2
SHA-512:	7CECD56FFEC343FDBFAE4E446E2EBF47560CEDA3067CD4495AB1CCD853152CF4C06A3F4D2D25D6914883832CBA21F3CAA1AD151B5A7C0950FB88F0873F3000E0
Malicious:	false
Preview:	@start "" "C:\Program Files\pandora_agent\pandora_agent.conf"..

C:\Program Files\pandora_agent\scripts\install_service_restart.bat

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	215
Entropy (8bit):	4.775024460909131
Encrypted:	false
SSDEEP:	6:7LJpaDoHUo/YH7ul6X24uR/uPrCutl6X24E:7LJK+UnH7ul60/ujhtl6i
MD5:	F34B84C10D7720C198453819F8496ED7
SHA1:	3F7F3DCE7A3AE77B6216E3438CB17861D290488F
SHA-256:	3BBB79C33EDAE0419C6A28A412E085C3BC09B7AACA57A5DA848ABA22BAEFF1DF
SHA-512:	88B9E3A9A828DBE9D925A6AD8D99AF323CEA8549AE83AE54A82DF184FDC913607F5391C2352E40F6A3EA86D320426A01AEA712C43CBD8B793201B129BC3C164D
Malicious:	false
Preview:	@at 00:00 /every:1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30 "'%CD%\restart_pandora_agent.bat'"..schtasks /change /tn pandora_agent_restart /tr "'%CD%\restart_pandora_agent.bat'"

C:\Program Files\pandora_agent\scripts\restart_pandora_agent.bat

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	53
Entropy (8bit):	3.9867756444218045
Encrypted:	false
SSDEEP:	3:mjW0PiKqkXResp1xkXRv:m1MxJ
MD5:	0F0529A8B75A1F4C69953A54BF877DBC
SHA1:	319C861AB205B99E5A9FBC444B2A49D517D1EA5F
SHA-256:	1385B0D9463BE450C515C37117C1FDE69E3EAEDE7303F6A890A746A5C4DDA4FB
SHA-512:	BB35D6B1A26E0881F2930CDBA739FFF5C410DB1BF8439ECC7BDF305ADA228CBD282FC9ADE10F7A80D6C3653CFCDCF383FC86FA820EB2C1E052D31CA8DEAC363A
Malicious:	true
Preview:	@net stop PandoraFMSAgent.@net start PandoraFMSAgent.

C:\Program Files\pandora_agent\scripts\start_pandora_agent.bat

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.671405583442497
Encrypted:	false
SSDEEP:	3:mjWJL8UvULRn:mIYLR
MD5:	9EF4B7B9606F25304F8E79D872467B95
SHA1:	36DC45F0FE5E507001BC853634AA3E11AE10B19E
SHA-256:	8AA892FD16C9A2B74DEB858332C208321D5A4FD685AAE0752D1543A038FF895F
SHA-512:	1E1F99A6588385E482A30D103C7BA6256E6229BC15E59D57E6635E1DCF22568A492DEBE42F7B57D3EF72A61CFFF95204FFE2F0B9F62624E5920E0C636D8CFA37
Malicious:	false
Preview:	@net start pandoraFMSagent

C:\Program Files\pandora_agent\scripts\stop_pandora_agent.bat

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	25
Entropy (8bit):	3.7532696895151085
Encrypted:	false
SSDEEP:	3:mjW0viTvULRn:mZLR
MD5:	8F2979326EBA715FB8755ABD431E3CB8
SHA1:	C85ECF769C5F88C12A74D94FA2FF811602C37638
SHA-256:	5A108C7E7E92681E2FE9896D15D7CEC5F5FF80FD066D71D22389AB2BDF531C25
SHA-512:	9C2F16AB7C4F089055BD14CB1AC526AC96A89D2C44C9E75352EA04E054EE926B35AE50CE851C09D28316C2E5CB5B98E7601FD9E3FB623510807E60251DF02DB3
Malicious:	false
Preview:	@net stop pandoraFMSagent

C:\Program Files\pandora_agent\temp\pandora_agent_nsis.conf

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	C source, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	15630
Entropy (8bit):	5.040398790073593
Encrypted:	false
SSDEEP:	192:2IaSjJZcaH1Ym04VkgxcT8fCeSILsEwFnG9i7ylEd4Py48WJm43fpMGX4l8PMdaJ:X/co6m04qicT8SIIJzAPB8XDPbY5b//
MD5:	6408A659A532A04C95DAA74DBC265CC6
SHA1:	FD6ED40F3161B2E120D224DED68F27ED7174FC42
SHA-256:	2C19E9BC896D8ABF9F99EBFFFDD943B9DDFA4267F3D45C6A18D88CC5C07266BD
SHA-512:	20D9F0748E30BA99F1674EF13317EB2C5A3871D7B81778570E97FFA066B06E71E82F67F065B6D0970EF8EE772F5795C7F85ABBA489EAFADD1447353A4AE65C59
Malicious:	false
Preview:	.#include "C:\Archivos de programa\pandora_agent\pandora_agent_alt.conf".#broker_agent name_agent..# Agent uses your hostname automatically, if you need to change agent name.# use directive agent_name (do not use blank spaces, please)..# This parameter is CASE SENSITIVE...# agent_name My_Custom_Agent_name..# To define agent name by specific command, define 'agent_name_cmd'..# If agent_name_cmd is defined, agent_name is ignored..# (In the following example, agent name is 'hostname_IP').# If set to __rand__ the agent will generate a random name..#agent_name_cmd cscript.exe //B "%ProgramFiles%\Pandora_Agent\util\agentname.vbs".agent_name_cmd __rand__..# Agent alias. Name should be unique rather than alias. Hostname by default.# agent_alias $Alias$..#Parent agent_name.#parent_agent_name caprica..# address: Enforce to server a ip address to this agent .# You can also try to detect the first IP using "auto", for example.address auto.# or setting a fixed IP address, like for example:.#address

C:\Program Files\pandora_agent\uninst.exe

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	248105
Entropy (8bit):	4.714092305675643
Encrypted:	false
SSDEEP:	3072:yObkmXlKp0OJ6Ixw5L1A5mKmV+xvSeAZFVjFj3:0m11O0tMHQ+vEZF7j3
MD5:	F8D684076FEC4F11E669E1703F8B0594
SHA1:	6F4906C82885A87682F19B59870BB6B9C7F75105
SHA-256:	0A90011466A029E070A26A4D5DED7DB70D82032B5F5E67B46AFC82035B64A117
SHA-512:	49A8B5B70DBDEAE16226504AF890BD2A682949334B52994BE737D9013CBEA8638A78583870D94C182BF303B9897962CDEA83C253B279D957185F3829234C595A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..... W.........................Z..gA............@..........................P......:......... .................................\|..................P................................................................................................text...p........................... .0`.data...............................@.`..rdata...k.......l..................@.`@.bss.....Z... ........................`..idata..\|...........................@.0..ndata..............................@.`..rsrc..............................@.0.........................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\pandora_agent\util\ShortElev.exe

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	111404
Entropy (8bit):	5.451523445205609
Encrypted:	false
SSDEEP:	1536:nh7r8Jq7Mvpo+6g6N7+u1j33zeupIHWTu3yMXnKbFuOTKDsBHvZ8N:h/8Jtvn6r33zNZjKQx8N
MD5:	0137DF9F792F635269E6FFF74F238C95
SHA1:	160E1A74D9AA7527950E78F55AA2781F254E3A0D
SHA-256:	D8CB74994754E0FE701F842651AD5EA4F54B41C0450ECFD511E2B7A8C761847E
SHA-512:	4D6E03EE9BC7F90095119C025481D237E065F87339B34165521A8FA78F84056AF3C96439207A72B9B2C00E7D16C8FCFE11E9E97BEF4753F8170979A887DD7EED
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: Pandora FMS Windows Agent v7.0NG.772_x86_64.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......\.D..!................................0....@........................................... ..............................p.......................................P...............................................q...............................text...$...........................`.P`.data...,....0......................@.0..rdata..0....@....... ..............@.0@/4......5....P.......&..............@.0@.bss....P....`........................p..idata.......p.......(..............@.0..CRT....4...........................@.0..tls.... ............0..............@.0./14..................2..............@.@B/29..................6..............@..B/41..........p......................@..B/55.................................@..B/67..................$..............@.0B/80..................,..............@..B/91..................0..............@..B/102....`............@..

C:\Program Files\pandora_agent\util\agentname.vbs

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	762
Entropy (8bit):	5.126338636437445
Encrypted:	false
SSDEEP:	12:JKxsyu2/zqkNwKkO0DHOzbEF+MSdGHJB5qW0VoFyjG2laNTSby59ECbgUkTyn:JKxsyu2/zVmZOH4+5GpujGWaNTh0mn
MD5:	DE44AD7D6FBF39526F68AF40E9ECD4A7
SHA1:	8A4F4981ED33C64F33568942603405575631658C
SHA-256:	A7C65773E82FF00050C82FA2A533F2766F36580E252E667A96F6D7EF7000E0B0
SHA-512:	6620C3ADCB0A0B620D0EF30B9289E7A68E06DF6C23A74436D9078054CA8D781E3E362E66F3DFFDB37071F02C0CB04FB58137D383388B3890F30ACD072E761DBC
Malicious:	false
Preview:	' agentname.vbs..'..' Pandora FMS external command sample for 'agent_name_cmd' token...' This script returns agent name like 'hostname_IPaddress'...' (c) 2014 Junichi Satoh <junichi@rworks.jp>..' ------------------------------------------....Option Explicit....Dim objNetWork..Dim oClassSet..Dim oClass..Dim oLocator..Dim oService....Set objNetWork = WScript.CreateObject("WScript.Network")....Set oLocator = WScript.CreateObject("WbemScripting.SWbemLocator")..Set oService = oLocator.ConnectServer..Set oClassSet = oService.ExecQuery("Select * From Win32_NetworkAdapterConfiguration")....For Each oClass In oClassSet....If oClass.IPEnabled = True Then....Wscript.StdOut.WriteLine objNetWork.ComputerName & "_" & oClass.IPAddress(0)..Exit For....End If....Next..

C:\Program Files\pandora_agent\util\architecture.vbs

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1229
Entropy (8bit):	5.2014182276832495
Encrypted:	false
SSDEEP:	24:Wxv0Rk8Q824Uhz/Arwlt/PDv9UKRUh7xav0Y9C6yX:WFOkrxZwKt/PDvavAcb6W
MD5:	AEBD70C47BCEDD3C82D139EFD3417AED
SHA1:	74D38B51B0C7735435B074D6B243D9A68DD7E4C5
SHA-256:	B0EE089647DDEF0B8FF8E31242AD70F69348B0F0F64DA6C8677DD9825F633FA9
SHA-512:	B45A5501400133F7D6D3878AA3CFF0C462097E0F440914563DA2532C82079CE2F8E1182D786BB7C88E71A2A5F2392675E745CA630D20EC4384DD85EAD32C8ADB
Malicious:	false
Preview:	' Pandora FMS Agent Inventory Plugin for Microsoft Windows (All platfforms)..' (c) 2015 Borja Sanchez <fborja.sanchez@artica.es>..' This plugin extends agent inventory feature. Only enterprise version..' --------------------------------------------------------------------------..'WMI architecture....strComputer = "."..Set objWMIService = GetObject("winmgmts:" & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")..Set cols = objWMIService.ExecQuery("Select osarchitecture from Win32_OperatingSystem")....on error resume next..flag = cols.Count..If (err.number <> 0) Then.. flag = true..Else.. flag = false..End If..on error goto 0 ....'Print only when there's results..If (NOT flag) Then...Wscript.StdOut.WriteLine "<inventory>"...Wscript.StdOut.WriteLine "<inventory_module>"...Wscript.StdOut.WriteLine "<name>Architecture</name>"...Wscript.StdOut.WriteLine "<type><![CDATA[generic_data_string </type>"...Wscript.StdOut.WriteLine "<datalist>".....For Each data In cols... Ws

C:\Program Files\pandora_agent\util\autodiscover.exe

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	7549822
Entropy (8bit):	7.991056147503995
Encrypted:	true
SSDEEP:	196608:gi8oadQmR5dA6lOuErSEEJwdF6x0YPikiTf:uBdQ2lO+9Jx0h7
MD5:	B78E6406E3C0DA278DB5BCED101601EA
SHA1:	91FA0194585EC6B89D1C55B8CF7582518C852F4D
SHA-256:	748A486B9C21B2EEC81BC6B4CBFC95BBF632F31A5F9D1C60847A5CB05A01AE00
SHA-512:	26C1B2E7D6D6BC8F9BC3DE0DE64917118621533A9E2A5C230174539BC1759113DFC8120537EA8489B623212A14C414F6569F5CADA4AF5BE6A4481000D92052CE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......?.^.{.0.{.0.{.0.0.3.\|.0.0.5...0.0.4.q.0.4...x.0.4.5.S.0.4.4.j.0.4.3.r.0.0.1.~.0.{.1...0..4.o.0..2.z.0.Rich{.0.........................PE..d...N..d.........."....".....T.................@.............................0......i.s...`.....................................................<.... ........... ........... ..\...P...................................@...............P............................text............................... ..`.rdata...'.......(..................@..@.data...............................@....pdata... ......."..................@..@_RDATA..\...........................@..@.rsrc........ ......................@..@.reloc..\.... ......................@..B................................................................................................................................................................................................

C:\Program Files\pandora_agent\util\cdromdrives.vbs

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1365
Entropy (8bit):	5.284576325089948
Encrypted:	false
SSDEEP:	24:Wxv0Rk8Q8v8TGUhz/ArQ3H2WWDv9UKRULxav0A+S5TH:WFOkJTZwQ3H2WWDvaOcAH
MD5:	7C454F085648F76838D1A9002AB7C5EA
SHA1:	5591D61EA5ACBA733EC2F18FF81456B515387919
SHA-256:	E20CA1639B50492EC6B84ACDB36BD396F9B11A63D0AE6DDAC3DFB99CDDA24F83
SHA-512:	62D5175DA6B2747735BED6B88BE9D5058C341E572B2BFC0A8886D6483EB69EBEEDBDB1AF60F000E1CA0D32BE97F016D35EB1679F6A372A61B2F53AA71C0EE7A6
Malicious:	false
Preview:	' Pandora FMS Agent Inventory Plugin for Microsoft Windows (All platfforms)..' (c) 2015 Borja Sanchez <fborja.sanchez@artica.es>..' This plugin extends agent inventory feature. Only enterprise version..' --------------------------------------------------------------------------..'WMI CD_ROM_drives_info....strComputer = "."..Set objWMIService = GetObject("winmgmts:" & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")..Set colCDROMDrives = objWMIService.ExecQuery("Select caption,description,drive,deviceid from win32_CDROMDrive")....on error resume next..flag = colCDROMDrives.Count..If (err.number <> 0) Then.. flag = true..Else.. flag = false..End If..on error goto 0 ....'Print only when there's results..If (NOT flag) Then...Wscript.StdOut.WriteLine "<inventory>"...Wscript.StdOut.WriteLine "<inventory_module>"...Wscript.StdOut.WriteLine "<name>CDROM</name>"...Wscript.StdOut.WriteLine "<type><![CDATA[generic_data_string </type>"...Wscript.StdOut.WriteLine "<datalist>

C:\Program Files\pandora_agent\util\cmp.exe

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	5.501792845685448
Encrypted:	false
SSDEEP:	192:GM5+2WWQnoGXFv5gyGR/vGnXSsxzxQcvV+zg5i3qN:D5ajoG1v9sGv9+z/3qN
MD5:	DAA576E1978EADB12553E248153B75C6
SHA1:	A459ADCD4731222FFE69CF58614B60B2F1D6E960
SHA-256:	D9D3E81879F07A958218D9EC371198246E2A77A21854CDAC850E093148E2E05D
SHA-512:	5BA3F2DDF93ABFE54AB5CF1CD4C6268C219D961AE36ACE442F739B23027027784121CF4CCFD21B30BDA90591833CB88BD3BA92159CCB9C258D9B6BB8DAD4A66C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Joe Sandbox View:	Filename: saa.zip, Detection: malicious, Browse Filename: setup_http_scclis.fcs.com_8080.exe, Detection: malicious, Browse Filename: setup_http_scclis.fcs.com_8080.exe, Detection: malicious, Browse Filename: Pandora FMS Windows Agent v7.0NG.772_x86_64.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....~~:...............7. ...................0....@..........................`...............................................P..\....................................................................................................................text............ .................. ..`.data...8....0.......$..............@....bss....0....@...........................idata..\....P.......&..............@...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\pandora_agent\util\cpuinfo.vbs

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1267
Entropy (8bit):	5.283370013468892
Encrypted:	false
SSDEEP:	24:Wxv0Rk8Q8P6Uhz/ArrcOXxDv9UKRUQxav0ouJMTX:WFOkKZwrcOXxDvaXc5s
MD5:	FA325AB5682E3CAE8E9347829969F91D
SHA1:	6A8FE0D684824804F0B024BDE8ADF748FAC3DD14
SHA-256:	F3AA1F52D0D61F4DB162B906F7E97E54A998ACBE7A9543A5F30EE319FBEA3E4E
SHA-512:	3357B0D8A6102435D48DDF57C818F9EEA201BF67A96BFA7655B410D61F316EECDB2C61BF0E3B6CCF66C74C3FEDEBA490CB8C5AB448BC8BCD07798FFFFDA6857F
Malicious:	false
Preview:	' Pandora FMS Agent Inventory Plugin for Microsoft Windows (All platfforms)..' (c) 2015 Borja Sanchez <fborja.sanchez@artica.es>..' This plugin extends agent inventory feature. Only enterprise version..' --------------------------------------------------------------------------..'WMI cpuinfo....strComputer = "."..Set objWMIService = GetObject("winmgmts:" & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")..Set colCPUs = objWMIService.ExecQuery("Select name,maxclockspeed,caption from Win32_Processor")....on error resume next..flag = colCPUs.Count..If (err.number <> 0) Then.. flag = true..Else.. flag = false..End If..on error goto 0 ....'Print only when there's results..If (NOT flag) Then...Wscript.StdOut.WriteLine "<inventory>"...Wscript.StdOut.WriteLine "<inventory_module>"...Wscript.StdOut.WriteLine "<name>CPU</name>"...Wscript.StdOut.WriteLine "<type><![CDATA[generic_data_string </type>"...Wscript.StdOut.WriteLine "<datalist>".....For Each cpu In colCPUs... Ws

C:\Program Files\pandora_agent\util\curl-ca-bundle.crt

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	221363
Entropy (8bit):	6.002589296839173
Encrypted:	false
SSDEEP:	6144:vNc597qxzwd9aUaNR6dTd4tL2b02dTDkMgV:vNcf7M576f4tLe0mIMq
MD5:	3231FBCBBB54C2963DC37F7224F127FF
SHA1:	5F128B187304334D2C3100D920E74B14D0922B9B
SHA-256:	0D98A1A961AAB523C9DC547E315E1D79E887DEA575426FF03567E455FC0B66B4
SHA-512:	66816E077EE99CEB9535A472E6BBF4F0E48CA838099C8A97C7BAF3297FCADA9A43016EA1DED63A455EE56A8F18501417A0F744FC17B215BB599CAFD76B754518
Malicious:	false
Preview:	##.## Bundle of CA Root Certificates.##.## Certificate data from Mozilla as of: Wed Nov 27 04:12:10 2019 GMT.##.## This is a bundle of X.509 certificates of public Certificate Authorities.## (CA). These were automatically extracted from Mozilla's root certificates.## file (certdata.txt). This file can be found in the mozilla source tree:.## https://hg.mozilla.org/releases/mozilla-release/raw-file/default/security/nss/lib/ckfw/builtins/certdata.txt.##.## It contains the certificates in PEM format and therefore.## can be directly used with curl / libcurl / php_curl, or with.## an Apache+mod_ssl webserver for SSL client authentication..## Just configure this file as the SSLCACertificateFile..##.## Conversion done with mk-ca-bundle.pl version 1.27..## SHA256: 607309057d0ec70f8e4e97b03906bafb2fcebb24cd37b5e8293e681ae26ceae0.##...GlobalSign Root CA.==================.-----BEGIN CERTIFICATE-----.MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkGA1UEBhMCQkUx.GTAXBgNVBAoTEEdsb2Jh

C:\Program Files\pandora_agent\util\curl.exe

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	444416
Entropy (8bit):	6.713737151861499
Encrypted:	false
SSDEEP:	12288:PqpJsdWqljBi+qbJHM/LFxBmCqy6/KM4dZT88:SJZqljBi+8JH0Lrvqz/2T8
MD5:	1AE73C7377B325580C275199448F56B6
SHA1:	E346D821A2A7BC22A5CAAD3D8E01559805758BD5
SHA-256:	D2694B2365B5DAB4EA938A573908B40BB205E87613747AA6A24C55E738B2CD77
SHA-512:	B9477B64EE3DE5A2EAB28FD0BF96EB3CED951D34CDD4109DA2DF8CFF53B1E6AE38AB0EF353ABC848720111F2A20EDDAEE739395079A561B69C76E5D06D2BCBC4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...e..P..........................................@..........................0......MM........ .........................`...........................................................................................h................................text...............................`.P`.data...............................@.`..rdata..............................@.`@.bss....l.............................`..edata..`............t..............@.0@.idata...............\|..............@.0..CRT....4...........................@.0..tls.... ...........................@.0..rsrc...............................@.0..reloc...........0..................@.0B................................................................................................................................................................................................................................

C:\Program Files\pandora_agent\util\cut.exe

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	24064
Entropy (8bit):	6.038442421230171
Encrypted:	false
SSDEEP:	384:8HJRcg7mT/wX23q3wE7RFxBTGbf70OgPMN6wUw1XVck:l9q3weRrRGbYOgGz0
MD5:	E9757F1678ECE31C59997C073A6527A2
SHA1:	27A3B82BD79DBC9F537F9714C7E9E696458B8C50
SHA-256:	D6A826157AF7F290ECCF6F3A35AE7719D959114E76543233E629F2157B1BBD55
SHA-512:	5C2398E778DA47D80EB79F57FC00F6D6FD6C2440CEDC413193258B171310077773155879E1BF996B346BB301C1DFD22824DD44BD84DE1193C63C33AD376D1B2C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......7...............7.P...................`....@.............................................................................l....................................................................................................................text....O.......P.................. ..`.data...d....`.......T..............@....bss....@....p...........................idata..l............V..............@...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\pandora_agent\util\date.exe

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	39424
Entropy (8bit):	6.207643132265192
Encrypted:	false
SSDEEP:	768:uN7cNqRoZWsr1eT4vznnGkDwxqXp4dwdzOsALBBqMZb:uN7c1lr19nGKzXkwdWD
MD5:	5E978EC5F615396EAA1B14334197B68E
SHA1:	B1EB6C03404A135DB5F5E67AB972BD5E6EE9B458
SHA-256:	5B399B89AD901437FAF4BE061DABC2A3F70C6973316A536D4245604BEC394B54
SHA-512:	430729B87F7ACBFBAAA1F3059208116D3D3F46041BD70C29A0E1B6356113F33F20BFC8DA1ED17F3F3F5768BCD464D46CEB50F3BF1CFB03C0658895DA921E69B0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......9...............7..........................@..................................................................................................................................................................................................text...0........................... ..`.data...............................@....bss.....................................idata..............................@...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\pandora_agent\util\df.vbs

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	1101
Entropy (8bit):	5.308052812548578
Encrypted:	false
SSDEEP:	12:ZAygBvWdtFKcYtOd1pbt4irXNZci3vAqThYPK/yEYNOxM0IlKLhKQWu7alO6VRaq:ZGAxpbvDh/AwAFQxz3SGa/EyN7n
MD5:	30CD38DA7EF5D8E165D743033950F1BB
SHA1:	254D2646884FC83862436A2D96409D727267A6AD
SHA-256:	A3A2DF6A88DB186A1CF4AAB940DA77A0BF6AEF546B8D703F8ABEE30BEB5042F6
SHA-512:	28F5B30170C128C6B634B9A0B3B8E975F42CECD1FC01BDD76F875DB037A26AA568205466DD78671CB58208B7C55B422424A3E4571188BAED2E91B91AC9B9BCFC
Malicious:	false
Preview:	' df.vbs..' Returns free space for avaible drives...' --------------------------------------....Option Explicit..On Error Resume Next....' Variables..Dim objWMIService, objItem, colItems, argc, argv, i....' Parse command line parameters..argc = Wscript.Arguments.Count..Set argv = CreateObject("Scripting.Dictionary")..For i = 0 To argc - 1.. argv.Add Wscript.Arguments(i), i..Next....' Get drive information..Set objWMIService = GetObject ("winmgmts:\\.\root\cimv2")..Set colItems = objWMIService.ExecQuery ("Select * from Win32_LogicalDisk")....For Each objItem in colItems...If argc = 0 Or argv.Exists(objItem.Name) Then....If objItem.FreeSpace <> "" Then.....Wscript.StdOut.WriteLine "<module>".....Wscript.StdOut.WriteLine " <name><![CDATA[" & objItem.Name & " </name>".....Wscript.StdOut.WriteLine " <description><![CDATA[Drive " & objItem.Name & " free space in MB </description>".....Wscript.StdOut.WriteLine " <data><![CDATA[" & Int(objItem.FreeSpace /1048576) & " </data>"

C:\Program Files\pandora_agent\util\df_percent.vbs

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1854
Entropy (8bit):	5.378197940319138
Encrypted:	false
SSDEEP:	24:dOSA5pbvDh/AwAFQx7n7PAjlxuGaXQzJfRiUEEvZa7n:dZA5NFFA2mj2GaXGRiUEh
MD5:	274690D1001D718FB7C4A30F3254AAD5
SHA1:	4E5A81EBB21BA5DD6CA68C3F727638C0892498B5
SHA-256:	F91A0A6980B2D8CE3F5C7A91800E73F158424CB7BA2F95E817FF6C1914750F7A
SHA-512:	BC1E8CA84CDC37DBFA2A7E0710C6BE24E3E68E9DAB8A4D33002278A38438A86D01034592C71D8A421E8793959A4B620EF6E067E4FB90543459C844D0D2F88E2C
Malicious:	false
Preview:	' df_all.vbs..' Returns free space (%) for all drives..' Pandora FMS Plugin, (c) 2021 Sancho Lerena..' ------------------------------------------....Option Explicit..On Error Resume Next....' Variables..Dim objWMIService, objItem, colItems, argc, argv, i, Percent......' Parse command line parameters..argc = Wscript.Arguments.Count..Set argv = CreateObject("Scripting.Dictionary")..For i = 0 To argc - 1.. argv.Add Wscript.Arguments(i), i..Next....' Get drive information..Set objWMIService = GetObject ("winmgmts:\\.\root\cimv2")..Set colItems = objWMIService.ExecQuery ("Select * from Win32_LogicalDisk")....For Each objItem in colItems...If argc = 0 Or argv.Exists(objItem.Name) Then....' Include only harddrivers (type 3)....If (objItem.FreeSpace <> "") AND (objItem.DriveType =3) Then.....Percent = round ((objItem.FreeSpace / objItem.Size) * 100, 2).....Wscript.StdOut.WriteLine "<module>".....Wscript.StdOut.WriteLine " <name><![CDATA[DiskFree%_" & objItem.Name & " </name>".....Wscri

C:\Program Files\pandora_agent\util\df_percent_used.vbs

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1902
Entropy (8bit):	5.355435841359015
Encrypted:	false
SSDEEP:	24:dnSA5pbvDh/AwAFQx7n7PAMglEGbXJfRiUEEfmImgIR7n:dSA5NFFA2mMg6GbNRiUEUG
MD5:	A008CA020CB746D2E21B6B56CEBF96EE
SHA1:	FFB6EC8FF2CAE4CE461DAD4C70074A49AE6177A8
SHA-256:	EED11686252730687CF953C3CEDA36CF8FA1B1CDB5B49E0236AD290AA5AAC223
SHA-512:	EB915E85B83BF54266D4B109001C935256076AFCCA21579F408723AC8D8C0D3ED284CD0D4C521DBDCE6BB54ECBDB6C2A554F9D7D3D124E63697141F050987408
Malicious:	false
Preview:	' df_all.vbs..' Returns used space (%) for all drives..' Pandora FMS Plugin, (c) 2021 Sancho Lerena..' ------------------------------------------....Option Explicit..On Error Resume Next....' Variables..Dim objWMIService, objItem, colItems, argc, argv, i, Percent......' Parse command line parameters..argc = Wscript.Arguments.Count..Set argv = CreateObject("Scripting.Dictionary")..For i = 0 To argc - 1.. argv.Add Wscript.Arguments(i), i..Next....' Get drive information..Set objWMIService = GetObject ("winmgmts:\\.\root\cimv2")..Set colItems = objWMIService.ExecQuery ("Select * from Win32_LogicalDisk")....For Each objItem in colItems...If argc = 0 Or argv.Exists(objItem.Name) Then....' Include only harddrivers (type 3)....If (objItem.FreeSpace <> "") AND (objItem.DriveType =3) Then.....Percent = round (100 - (objItem.FreeSpace / objItem.Size) * 100, 2).....Wscript.StdOut.WriteLine "<module>".....Wscript.StdOut.WriteLine " <name><![CDATA[DiskUsed_" & objItem.Name & " </name>".....

C:\Program Files\pandora_agent\util\diskdrives.vbs

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1527
Entropy (8bit):	5.328980130098931
Encrypted:	false
SSDEEP:	24:Wxv0Rk8Q8CUhz/ArULDv9UKRUwxav0OgmLxTebF2na+MTX:WFOkGZwULDvancOgm1ebMTC
MD5:	15C8101385C66FC3802E6813CF3DC423
SHA1:	513BA9EB9F012882FD4D7830CA4D1FDA4E2A1872
SHA-256:	8EEE5FB45BFAAC2989F4D3E699B55AB979777E45C9F9E976DE5CC000907C5909
SHA-512:	59DB83A8AC462747485A79A157E8621DF15131809B2AF65C136E8A1151A21F66FE3422FFCA4159E226E8BF2AC43789CDEB3EBDE43ADF9978737F1BEA0E4DAB17
Malicious:	false
Preview:	' Pandora FMS Agent Inventory Plugin for Microsoft Windows (All platfforms)..' (c) 2015 Borja Sanchez <fborja.sanchez@artica.es>..' This plugin extends agent inventory feature. Only enterprise version..' --------------------------------------------------------------------------..'WMI disksinfo....strComputer = "."..Set objWMIService = GetObject("winmgmts:" & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")..Set colHDDs = objWMIService.ExecQuery("Select * from win32_diskdrive")....on error resume next..flag = colHDDs.Count..If (err.number <> 0) Then.. flag = true..Else.. flag = false..End If..on error goto 0 ....'Print only when there's results..If (NOT flag) Then...Wscript.StdOut.WriteLine "<inventory>"...Wscript.StdOut.WriteLine "<inventory_module>"...Wscript.StdOut.WriteLine "<name>HD</name>"...Wscript.StdOut.WriteLine "<type><![CDATA[generic_data_string </type>"...Wscript.StdOut.WriteLine "<datalist>".....For Each disco In colHDDs... If ((not IsNull(disco.si

C:\Program Files\pandora_agent\util\domain.vbs

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1192
Entropy (8bit):	5.267122042429685
Encrypted:	false
SSDEEP:	24:Wxv0Rk8Q8XUhz/Ar/mDv9UKRUkFxav0hXZmT2:WFOk9ZA/mDvaPcZ
MD5:	FC5E90EB8E621E54BFD7132688712092
SHA1:	6786BD62C0DA23E5F1F8656F55E328AB3B70A6CE
SHA-256:	6C26CBEC48E95EAF5BD33F33B7A5A0AD776B9D3BB90BE5F8D8287EBC4299127E
SHA-512:	D4BDEAFF47A298034811635BCFC3B8191AEDB5AEF62A1BDC33582A1F4EBAEDCD96A6EF9D00A3D7840DB2E7CEA2AAF4390B680C4684E0E5B2AE562D09D2BC67D5
Malicious:	false
Preview:	' Pandora FMS Agent Inventory Plugin for Microsoft Windows (All platfforms)..' (c) 2015 Borja Sanchez <fborja.sanchez@artica.es>..' This plugin extends agent inventory feature. Only enterprise version..' --------------------------------------------------------------------------..'WMI domain/workgroup info....strComputer = "."..Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\CIMV2")..Set colItems = objWMIService.ExecQuery("SELECT Domain FROM Win32_ComputerSystem")....on error resume next..flag = colItems.Count..If (err.number <> 0) Then.. flag = true..Else.. flag = false..End If..on error goto 0 ....'Print only when there's results..If (NOT flag) Then...Wscript.StdOut.WriteLine "<inventory>"...Wscript.StdOut.WriteLine "<inventory_module>"...Wscript.StdOut.WriteLine "<name>Domain</name>"...Wscript.StdOut.WriteLine "<type><![CDATA[generic_data_string </type>"...Wscript.StdOut.WriteLine "<datalist>".....For Each objItem In colItems... WScript.StdOut.WriteLine "<data

C:\Program Files\pandora_agent\util\du_percent.vbs

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1768
Entropy (8bit):	5.331125189073667
Encrypted:	false
SSDEEP:	24:dOSAhpbvDh/AwAFQx7n7PAelwGaYgxfUxL6YEEmY7n:dZAhNFFA2meCGaYKUxLJP
MD5:	911A706AA3841C19A99E77F19B5DA946
SHA1:	ADA752DF2F0F9070C0B15C729F17B614EC45D17C
SHA-256:	975051E41D150DFAD000B9E49DB2C13C5756789881A4512F6C649E1B532829E4
SHA-512:	73BE56F424415D16619A02BAAF0AB7EE55847455AF24032CB25813D34213186F70ECF858A00F61EB00416E263C8666F03A13A6FE50E35AB4A3873E2EFC9DF47F
Malicious:	false
Preview:	' df_all.vbs..' Returns free space (%) for all drives..' Pandora FMS Plugin, (c) 2021 Sancho Lerena..' ------------------------------------------....Option Explicit..On Error Resume Next....' Variables..Dim objWMIService, objItem, colItems, argc, argv, i, Percent, Percentused......' Parse command line parameters..argc = Wscript.Arguments.Count..Set argv = CreateObject("Scripting.Dictionary")..For i = 0 To argc - 1.. argv.Add Wscript.Arguments(i), i..Next....' Get drive information..Set objWMIService = GetObject ("winmgmts:\\.\root\cimv2")..Set colItems = objWMIService.ExecQuery ("Select * from Win32_LogicalDisk")....For Each objItem in colItems...If argc = 0 Or argv.Exists(objItem.Name) Then....' Include only harddrivers (type 3)....If (objItem.FreeSpace <> "") AND (objItem.DriveType =3) Then.... Percent = round ((objItem.FreeSpace / objItem.Size) * 100, 2).... Percentused = 100 - (Percent).......Wscript.StdOut.WriteLine "<module>".....Wscript.StdOut.WriteLine " <na

C:\Program Files\pandora_agent\util\expr.exe

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	13824
Entropy (8bit):	5.740202724506134
Encrypted:	false
SSDEEP:	192:YAX8rEZea+I9Z+k7ZlPMtVqol9z5alOXUb9Tc9DOHnvphP0LW0kReEXrQ:YEcm+Ieec7KSUbhc4Hj0SDXrQ
MD5:	8C538C7548AFB81E8F0372F54740D9CF
SHA1:	2E925ED029FEC55BBDF13B40B3F7301CEFF76556
SHA-256:	C412FD2EF78EFAE5F2612D8329B46C8ED4805FB73E5B22E2066D203520F726F5
SHA-512:	9D10FABE78AC9D6FC161F721365566C1D0D0D97121DDDFE47C3300E055AE87495436338075B1883166C979A46EE0FB552DBD041D2BF5DAC2DB07E59C14516484
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........rQ............................Rich....................PE..L...(..4.................".......... /.......@....@..........................`...............................................@..(....................................................................................@...............................text.... .......".................. ..`.rdata.......@.......&..............@..@.data...T....P.......*..............@...................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\pandora_agent\util\gawk.exe

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	195584
Entropy (8bit):	6.473748107729141
Encrypted:	false
SSDEEP:	3072:mbCutS3/YZXVzJ4xsfiKI3X3jLOzIgbttmR+pcGXofWceMG2jzB+QsPTu3jrpXfw:mUvYZlzJiG1I3X3yntfofBeMG2jzFsPR
MD5:	3436EAB6988E8A911895122ED1862836
SHA1:	93F464CB986A95FBF7E5C96CC484593BBFEB3D07
SHA-256:	C8AF969F2A9A9F05D22AD9373F019D6C3137BA2F2DB4DF25C1B6EFC98756C77E
SHA-512:	DF33D1F24AA1591174B2AA4AD08AE1752CE1D86A903FF17F1001E3F45E613A166020420F5578E313097F43AAD4F67ECD1E5B7E82EAAEDA876A11DE4245193950
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....L<...............8..... ...4................@..........................`................ ..............................P.......................................................................................................................text............................... ..`.data...$...........................@....bss.....2...............................idata.......P......................@...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\pandora_agent\util\getreg.exe

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	PE32+ executable (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	43119
Entropy (8bit):	4.491670030116383
Encrypted:	false
SSDEEP:	384:wuaVX0tAlZm5eptodZDZILvGBzW5fRHt2Bs9j6xZhMV64OLSd56jU2Q/FMEmOi9Q:BU0tAlZG3dB8eBEt2O9jXVkmX2QAO+Q
MD5:	2D86FBBAFD56007EFA078D5D5306F91A
SHA1:	CB8936AA26076E00421B3E27DD8537C13A267719
SHA-256:	0FA7D4683BA5C3A04B06952756097A8FF223656F488867AAE039038766831560
SHA-512:	947DC14B156D0D03C14967858C8C3AC9F5D0F62819D6412B55A070128DF4C5B881BCE589C96CBFF295D7211B017C6C630C7975E92680435A78C385A831C36389
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d........D........'...... ... ................@......................................R........ ..............................................................P..@........................................... ...(...................(................................text............ .................. .P`.data........0.......$..............@.P..rdata..@....@.......&..............@.P@.pdata..@....P......................@.0@.xdata.......`.......2..............@.0@.bss.... ....p........................`..idata...............6..............@.0..CRT....h............@..............@.@..tls....h............B..............@.`.........................................................................................................................................................................................................................................................

C:\Program Files\pandora_agent\util\getsnmp.bat

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	265
Entropy (8bit):	5.161110927153926
Encrypted:	false
SSDEEP:	3:mKDD0ziqpbowRUE9cViTkD0lofE9cViTka2lcU2yJGWyesovaM0iJm+NwiHIeMjn:hIzrbiVz0leVFl2Z+sBZuKVeMjMFsU9A
MD5:	6F4682D7CBD94D4ED8C3C0E231D81D72
SHA1:	0356F17FD66BF21EB803FA270CF233446FDC8A16
SHA-256:	11750145FB0E2FD110D05FE5595D288F491DE42C6165FED267C574C939CC5D4E
SHA-512:	39833BE508A78C7CCFD65FC7074266863B85CB217CB5A38B1550C4086161E00FB047D501217C9CB33316D3E1B84800BB7699FA396304BDBAA4BDFD4CFB28C1C2
Malicious:	false
Preview:	@echo off....if "%1" == "" GOTO HELP...."%ProgramFiles%\pandora_agent\util\snmpget" -M "%ProgramFiles%\pandora_agent\util\mibs" -Oveqtu -v 1 -c %1 %2 %3..goto EXIT0....:HELP..echo I need parameters...echo getsnmp.bat community ip_address OID..goto EXIT0......:EXIT0

C:\Program Files\pandora_agent\util\grep.exe

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80412
Entropy (8bit):	6.510992860563782
Encrypted:	false
SSDEEP:	1536:apE9iHQrLpyzNYTtmg29fDtxHiCGBTScYvphcTraBwHD3PzN/autnDp2HrEuuKa6:apEzLpyWtDqDDHitdScYWHD37wrxuKTb
MD5:	9E05A9C264C8A908A8E79450FCBFF047
SHA1:	363B2EE171DE15AEEA793BD7FDFFD68D0FEB8BA4
SHA-256:	C2EF6FC419630D566154F8372E94859DF8141D02805BC7BCE39C726A1FFEF7C1
SHA-512:	712892E9B08A22B795F9627F6D13412CB2A4610404DE33C6F83A37178B920E7BB9D3042C3A2191E49D661A34A05202E18224C67811D8B52FA0FC2C757EF0F6FA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....[.8...............7.(...................@....@..........................p...............................................`.......................................................................................................................text....'.......(.................. ..`.data...h....@.......,..............@....bss.........P...........................idata.......`.......0..............@...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\pandora_agent\util\grep_log.exe

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	1294848
Entropy (8bit):	7.979438113357856
Encrypted:	false
SSDEEP:	24576:FRitTlohVcmj3iZ7jNka03SS9kC9Dm/RKENW:vATY2mjW73/OkC9DkRr
MD5:	3080F13EBA13E255EF7ED6F6CB8F4D27
SHA1:	A7395C8D422DAEF44444F8EC29BF23D10E4407A7
SHA-256:	10031FCBE30267958B39B30BCC52A213C90CBA5B8AB05AD0DD45F7E723CA0F9A
SHA-512:	ADD85294584B2A0955302EA8E438413132D63237AA748F5BAED9C626603204C6D793658F1177230E6849921F784B10E8CDF78203709AA3979EEE306F671905D4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....V..................................... ....@.................................7....................................................^...........................................................................................................text...............................`.P`.data........ ......................@.`..rdata...?...0...@..................@.`@.bss.........p........................`..idata...............P..............@.0..CRT....4............^..............@.0..tls.... ............`..............@.0..rsrc....^.......`...b..............@.0.................................................................................................................................................................................................................................................................................................................

C:\Program Files\pandora_agent\util\head.exe

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	24064
Entropy (8bit):	6.180567438948626
Encrypted:	false
SSDEEP:	384:rxqdd34XBb6shS9gfIDnzxbEbtAtOPaHCGldoENvWEc8cjgOhl2mjZESY:rxQaBY/tbGWdiGldXvF0gmlv
MD5:	9851E260F5F64D1E81C2489F660DCAD7
SHA1:	7F1D221C713DAEDE799DFE4933B0BE9DC2491BEA
SHA-256:	FFA5E945163FFB23D26A5DDE041802219B03692E7AF409E621EF92D6692DFBAF
SHA-512:	66DFC4BCF9F2843277DA59A1442069C6E82123C2E844925E75A9E4141F8BDEBC92468758C48E420A2D90654F527FCD7A988444377C892BFEC00BCCD109D05B8D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......7...............7.R...................p....@..................................................................................................................................................................................................text....Q.......R.................. ..`.data...`....p.......V..............@....bss....@................................idata...............X..............@...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\pandora_agent\util\ifaces.vbs

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2015
Entropy (8bit):	5.19909461302841
Encrypted:	false
SSDEEP:	48:WFOkJiIufZw82cEnjntWn6mDvabcbTOdb:WskJibf64rDCUO5
MD5:	655BFB6E38CB81C29B18EC774C4C0616
SHA1:	AC0A41AAE4440C479C84E88B86CBC1B3C145D259
SHA-256:	FD62EBF990F5A2B7863E9D7C3C16DBF8B75052C5F2DADBBF70DD3B9E9945F665
SHA-512:	792D1E30EA76FADFCE0214282EBC8AB3942C00F064ACDA7E15905A31FC4160E59836D039834EB69207AB1E09A0E450F66016FF85823F974A7E1DFFDB109DC745
Malicious:	false
Preview:	' Pandora FMS Agent Inventory Plugin for Microsoft Windows (All platfforms)..' (c) 2015 Borja Sanchez <fborja.sanchez@artica.es>..' This plugin extends agent inventory feature. Only enterprise version..' --------------------------------------------------------------------------..'WMI real interfaces info..' exlusions: ..' VBox network interfaces..' VMWare network interfaces..'..'nic where "guid is not null and not PNPDeviceID like 'ROOT%'"....strComputer = "."..Set objWMIService = GetObject("winmgmts:" & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")..Set colAdapters = objWMIService.ExecQuery("Select * from Win32_NetworkAdapter " & _........"Where not PNPDeviceID like 'ROOT%%' " & _........"and not PNPDeviceID like 'SW%%' " & _........"and not ServiceName is null " & _........"and not ServiceName like 'vwifimp' ")....on error resume next..flag = colAdapters.Count..If (err.number <> 0) Then.. flag = true..Else.. flag = false..End If..on error goto 0 ....

C:\Program Files\pandora_agent\util\logevent_log4x.vbs

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3001
Entropy (8bit):	5.288488068699771
Encrypted:	false
SSDEEP:	48:aXiu5mAvAwLb4To+5nFmdkOXeD8HQmCx+OTyuIFQdEE3OY/gIQRQw:aS4AOso+5nFm6fD+Qdx9IF2EOR/sQw
MD5:	61D156A376784D88A48556FF9D27C37B
SHA1:	186E8E8FEFDA6CEC0B57B83CD3F68661B7E2D48A
SHA-256:	A54E68AE0025B9C8E2FFBAE7A148E8176A705AC7AF6F6E2A60523C24E3A1C57A
SHA-512:	DD5F15F2027778A8CC48B47EA73F9635146A3158C0E1FB641DBA10F1289ADEFDF965B7B1DD81D1BD6293A2773B290AC64A17A1DF1A050A7EFA6A60FFE38D28F5
Malicious:	false
Preview:	' --------------------------------------------------------------..' WMI Log Event Parser for Windows..' Used as Plugin in Pandora FMS Monitoring System..' Written by Sancho Lerena <slerena@gmail.com> 2010..' Licensed under BSD Licence..' --------------------------------------------------------------....' This plugin uses three parameters:..'..' module_name : Module name to be reported at pandora, p.e: Event_Application..' logfile : Windows event logfile: Application, System, Security.....' interval: Should be the same interval agent has, p.e: 300 (seconds)....' Code begins here....' Take args from command line..if (Wscript.Arguments.Count = 0) then...WScript.Quit...end if....On Error Resume Next..cfg_module_name = Wscript.Arguments(0)..cfg_logfile = Wscript.Arguments(1)..cfg_interval = Wscript.Arguments(2)..strComputer = "."....MyDate = dateAdd("s", -cfg_interval, Now) ' Latest X seconds....Set dtmStartDate = CreateObject("WbemScripting.SWbemDateTime")....CONVERT_TO_LOCAL_TIME = TRUE..

C:\Program Files\pandora_agent\util\ls.exe

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	57856
Entropy (8bit):	6.23708681322991
Encrypted:	false
SSDEEP:	1536:zcuFS7zhtBGuq2Vq3h2NEezQOPOv1SPaC:wuFS7zht8uq2eIPOv1SPd
MD5:	81B68D181440D59C0565986ABC141139
SHA1:	62818373DDDCCE027FF2B669AED585168AE2C79F
SHA-256:	4C81921B72CA4C8C747EC65A6541289FB97436DF807FA080F9DEBE7502E7D89A
SHA-512:	693439DA509B49B1E4F7527F1C1199E2C8D21E64BE94BE9F621860249A7E7B8CAF062406A71A359A0AA4AC5118B4E5E17E46429B7FC516A5897EC4EDD47CF8F3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....7...............7..........................@.......................... ..................................................@....................................................................................................................text...`........................... ..`.data...............................@....bss.....................................idata..@...........................@...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\pandora_agent\util\md5.exe

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	5.768233184016395
Encrypted:	false
SSDEEP:	768:R1W26AwlD/vum3barTum08xL50/fEZKA7BPnbpSLD0W0SXbc6+:T69lzLu3b6/fE4A7B/bpSLPc6
MD5:	609F46A341FEDEAEEC18ABF9FB7C9647
SHA1:	1945FE2D0A0507F3F5C6EB47F089204ECDDA00B7
SHA-256:	5B7F9A223AC5A8C768287FB9EE321364F8586EA392A3E4F75F48E3EDEB936E69
SHA-512:	10CE547C0716C627C9EAF25390C35A954C1C6B709C1A87C6EFA190876DC995E717C67CDA2FBBDD3657E138332B4E39643F004BCD22EAE853C10F7C4F3E3943C5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........VJ..7$.7$.7$.U.9.7$.U.d.7$.U.=.7$.7%.7$.U.8..7$.U...7$.Rich.7$.........................PE..L....e.>.....................@.......'............@............................................................................(...................................................................................................................text....~.......................... ..`.rdata........... ..................@..@.data...D...........................@...........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\pandora_agent\util\mem_percent_used.vbs

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1837
Entropy (8bit):	5.35944522348357
Encrypted:	false
SSDEEP:	48:1sNQsZwwRx5Y4jeozXDvhQDvaTlP/4XYHbY3Y4uBD:Wd6wRThSKD+DCTZHH8o3BD
MD5:	8AFC5B6660004DC936BA584883D98CC6
SHA1:	DD7A7A4B5789504E90BA0C9C19CEA3C38328803D
SHA-256:	DB7F12EBD2E77BEBBB1F5E6A15E8A2462F03CA8B46F2052913D9BE3C59F37995
SHA-512:	6262BF98C134F0C8A20E9C5D60C75CEEF98F598401A332939C276787309969C225A2B63D06F3475C38B84E7B438D74161D6BE87935D240113CD978AF9ED8C80D
Malicious:	false
Preview:	' mem_percent_used.vbs..' Returns used RAM (%)..' Pandora FMS Plugin, (c) 2017 Fermin Hernandez..' ------------------------------------------....Dim usedMEM, Percent..Dim totalMEM....strComputer = "."..Set objWMIService = GetObject("winmgmts:" & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")..Set colRAMs = objWMIService.ExecQuery("Select * from Win32_ComputerSystem")....totalMEM = 0..For Each total in colRAMs...totalMEM = total.totalPhysicalMemory..Next....Set colUSEDs = objWMIService.ExecQuery("Select freePhysicalMemory from Win32_OperatingSystem")..For Each used in colUSEDs...usedMEM = used.freePhysicalMemory * 1024..Next....on error resume next..flag = colRAMs.Count..If (err.number <> 0) Then.. flag = true..Else.. flag = false..End If..on error goto 0 ....on error resume next..flag = colUSEDs.Count..If (err.number <> 0) Then.. flag = true..Else.. flag = false..End If..on error goto 0 ....'Print only when there's results..If (NOT flag AND totalMEM <> 0) Then

C:\Program Files\pandora_agent\util\mibs\AGENTX-MIB.txt

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	17982
Entropy (8bit):	4.840836767052516
Encrypted:	false
SSDEEP:	192:ycx7B7tz/zNjyxNSV+q3A0vhCjKBTszerUTM+0zU+3XfYvdSmHmuI+/ZaHL:jx7VlrNjyxNSV+qNvkqZ3/nfYU8EL
MD5:	701E67A710C4C197AA3FA68E1C64BB86
SHA1:	97647B3CBE31C4F5CF68F3F356FB4612DAEE3325
SHA-256:	7C65E0EDC4A1161B37532ED226924597C369721D609AB0E1D82E00B590FDAEDC
SHA-512:	20BFA4736FE35C4BE9E3EA111676519DC06E3C624CD156A41B4D86DD2AB2645A59FD8325277910ABE01B79BBFA4FA3BA7A531D6F592E7C319A863E4D9CDEFD72
Malicious:	false
Preview:	AGENTX-MIB DEFINITIONS ::= BEGIN....IMPORTS.. MODULE-IDENTITY, OBJECT-TYPE, Unsigned32, mib-2.. FROM SNMPv2-SMI.. SnmpAdminString.. FROM SNMP-FRAMEWORK-MIB.. MODULE-COMPLIANCE, OBJECT-GROUP.. FROM SNMPv2-CONF.. TEXTUAL-CONVENTION, TimeStamp, TruthValue, TDomain.. FROM SNMPv2-TC;..agentxMIB MODULE-IDENTITY.. LAST-UPDATED "200001100000Z" -- Midnight 10 January 2000.. ORGANIZATION "AgentX Working Group".. CONTACT-INFO "WG-email: agentx@dorothy.bmc.com.. Subscribe: agentx-request@dorothy.bmc.com.. WG-email Archive: ftp://ftp.peer.com/pub/agentx/archives.. FTP repository: ftp://ftp.peer.com/pub/agentx.. http://www.ietf.org/html.charters/agentx-charter.html.... Chair: Bob Natale.. ACE*COMM Corporation.. Email: bnatale@acecomm.com.... WG editor: Mark Ellison.. Ellison Software Consulting, Inc... Email:

C:\Program Files\pandora_agent\util\mibs\DISMAN-EVENT-MIB.txt

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	70132
Entropy (8bit):	4.649292030737806
Encrypted:	false
SSDEEP:	384:YX5/TwdNQ4krN3oMmB3oJV4mkNa4Uf2oi9C6PqoDIZuJZ4IFO3o3+1vs7xjA84Fs:YX5sd6JJoMCo3479CQFVio9o9cN+Y
MD5:	7F781DE0F1384AC070D767360379CC43
SHA1:	0EC4FA8AE58CDED0BDF81AF5208463F873A2C410
SHA-256:	21AE5BB52D44DF8D65B2F490C425EFB769E3FFEF834958E67BE97AA76BB0F1A4
SHA-512:	06CF855151E8AD1344CDF90F1E8B453519291E61F315ECDE42E56A940CB08C91E1B17A442F89586A8499FD9B143387C66AF807D86692D3772A752E151EA3F719
Malicious:	false
Preview:	DISMAN-EVENT-MIB DEFINITIONS ::= BEGIN....IMPORTS.. MODULE-IDENTITY, OBJECT-TYPE,.. Integer32, Unsigned32,.. NOTIFICATION-TYPE, Counter32,.. Gauge32, mib-2, zeroDotZero FROM SNMPv2-SMI.. TEXTUAL-CONVENTION, RowStatus,.. TruthValue FROM SNMPv2-TC...... MODULE-COMPLIANCE, OBJECT-GROUP,.. NOTIFICATION-GROUP FROM SNMPv2-CONF.. sysUpTime FROM SNMPv2-MIB.. SnmpTagValue FROM SNMP-TARGET-MIB.. SnmpAdminString FROM SNMP-FRAMEWORK-MIB;....dismanEventMIB MODULE-IDENTITY.. LAST-UPDATED "200010160000Z" -- 16 October 2000.. ORGANIZATION "IETF Distributed Management Working Group".. CONTACT-INFO "Ramanathan Kavasseri.. Cisco Systems, Inc... 170 West Tasman Drive,.. San Jose CA 95134-1706... Phone: +1 408 526 4527.. Email: ramk@cisco.com".. DESCRIPTION.. "The MIB module for defining eve

C:\Program Files\pandora_agent\util\mibs\DISMAN-EXPRESSION-MIB.txt

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	43896
Entropy (8bit):	4.75769364096749
Encrypted:	false
SSDEEP:	768:ntcpP9y/fA/2BfNvsvbLyYPORymLfFmVWhsW0pNaRYrz+RLDuO:n+p4/fo2BfNvGy1kmZFhsW03aRYrz+Rl
MD5:	1E230B08587679EF126B95F1D239B7FE
SHA1:	24D63F64E29DD3CA9B1819BC890AAD6A077CBE82
SHA-256:	557D7AB8F965D1D350AC79EFABD1B75CD9451C2FA4B6EA614F58B21F33511A35
SHA-512:	08946A109D5C899C35CCC244ECFC30D40E9AEA3B865EE7ACA6E6182390ED11C0FE6F09FB1677019B6253971AB69A20CEEF4002DE6ABD24BB4321AF4353F889FC
Malicious:	false
Preview:	DISMAN-EXPRESSION-MIB DEFINITIONS ::= BEGIN....IMPORTS.. MODULE-IDENTITY, OBJECT-TYPE,.. Integer32, Gauge32, Unsigned32,.. Counter32, Counter64, IpAddress,.. TimeTicks, mib-2, zeroDotZero FROM SNMPv2-SMI.. RowStatus, TruthValue, TimeStamp FROM SNMPv2-TC.. sysUpTime FROM SNMPv2-MIB.. SnmpAdminString FROM SNMP-FRAMEWORK-MIB.. MODULE-COMPLIANCE, OBJECT-GROUP FROM SNMPv2-CONF;....dismanExpressionMIB MODULE-IDENTITY.. LAST-UPDATED "200010160000Z" -- 16 October 2000.. ORGANIZATION "IETF Distributed Management Working Group".. CONTACT-INFO "Ramanathan Kavasseri.. Cisco Systems, Inc... 170 West Tasman Drive,.. San Jose CA 95134-1706... Phone: +1 408 527 2446.. Email: ramk@cisco.com".. DESCRIPTION.. "The MIB module for defining expressions of MIB objects for.. management purposes."..-- Revision History.... REVISION "20001016

C:\Program Files\pandora_agent\util\mibs\DISMAN-NSLOOKUP-MIB.txt

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	19036
Entropy (8bit):	4.659692972250592
Encrypted:	false
SSDEEP:	192:1mj4u314zRRvTGcR9QCXEkEURUuX3mW3e7dA0CQsdkS5TRSxbY5yOJBkXVRjqvCR:m3GElkRUu9uoyOaYZnHaaWaMfiwEE
MD5:	10C139518C9FE00E4C083D77E7BCA941
SHA1:	674F90E32187E8197F08CDF2AA9687B1F7CCA64A
SHA-256:	BA30FBBEBD1E7EA8FE2A05800E0174482DAD53D6A3B141914A8940857C839C66
SHA-512:	4CD55279A600A5A01D69B3B99534C47048FE553B3FE026E752F0DD498C9C5B33E8487F5560021CE0101D0E37F7B1A3832A3924EF0B39DE5A75BE85C504DBB5CC
Malicious:	false
Preview:	DISMAN-NSLOOKUP-MIB DEFINITIONS ::= BEGIN....IMPORTS.. MODULE-IDENTITY, OBJECT-TYPE,.. Unsigned32, mib-2, Integer32.. FROM SNMPv2-SMI -- RFC2578.. RowStatus.. FROM SNMPv2-TC -- RFC2579.. MODULE-COMPLIANCE, OBJECT-GROUP.. FROM SNMPv2-CONF -- RFC2580.. SnmpAdminString.. FROM SNMP-FRAMEWORK-MIB -- RFC3411.. InetAddressType, InetAddress.. FROM INET-ADDRESS-MIB; -- RFC4001.... lookupMIB MODULE-IDENTITY.. LAST-UPDATED "200606130000Z" -- 13 June 2006.. ORGANIZATION "IETF Distributed Management Working Group".. CONTACT-INFO.. "Juergen Quittek.... NEC Europe Ltd... Network Laboratories.. Kurfuersten-Anlage 36.. 69115 Heidelberg.. Germany.... Phone: +49 6221 4342-115.. Email: quittek@netlab.nec.de".. DESCRIPTION.. "The Lookup MIB (DISMAN-NSLOOKUP-MIB) enables determination.. of either t

C:\Program Files\pandora_agent\util\mibs\DISMAN-PING-MIB.txt

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	58871
Entropy (8bit):	4.596854721982835
Encrypted:	false
SSDEEP:	384:n3kzseAcOcZfzn6KehkOoyPTLcLFMHc+yWvlP9Hewym+RoU:3kzselTnOxM5M8+xfHpIRr
MD5:	97302071743D6D8633730E1DC161C6E3
SHA1:	C30D344F955B550DCA491844282D0AB29F7EFF1B
SHA-256:	D7FCC68B363439D7E21103C55DB449C0D8499A9C08B268F2338BA93C4B2E0399
SHA-512:	21E3A971BFA510CA03FE781491388E750F6AADF73EF3289EE5889BE83CC24FD88011C9FD812E37723B4DD16ACC48EC66FCF0A78202FFE9BC403BF1964EC5925A
Malicious:	false
Preview:	DISMAN-PING-MIB DEFINITIONS ::= BEGIN....IMPORTS.. MODULE-IDENTITY, OBJECT-TYPE, Integer32,.. Unsigned32, Gauge32, mib-2,.. NOTIFICATION-TYPE, OBJECT-IDENTITY.. FROM SNMPv2-SMI -- RFC2578.. TEXTUAL-CONVENTION, RowStatus,.. StorageType, DateAndTime, TruthValue.. FROM SNMPv2-TC -- RFC2579.. MODULE-COMPLIANCE, OBJECT-GROUP,.. NOTIFICATION-GROUP.. FROM SNMPv2-CONF -- RFC2580.. InterfaceIndexOrZero -- RFC2863.. FROM IF-MIB.. SnmpAdminString.. FROM SNMP-FRAMEWORK-MIB -- RFC3411.. InetAddressType, InetAddress.. FROM INET-ADDRESS-MIB; -- RFC4001.... pingMIB MODULE-IDENTITY.. LAST-UPDATED "200606130000Z" -- 13 June 2006.. ORGANIZATION "IETF Distributed Management Working Group".. CONTACT-INFO.. "Juergen Quittek.... NEC Europe Ltd... Network Laboratories.. Kurfuersten-Anlage 36.. 69115 Hei

C:\Program Files\pandora_agent\util\mibs\DISMAN-SCHEDULE-MIB.txt

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	25312
Entropy (8bit):	4.654334645509305
Encrypted:	false
SSDEEP:	192:9C4JcdPhVzN+WukGS7jXtVLtq4JkVfgfgd5K22wgMzS/qVS3HwQL8de6VPDczJ2s:tcthhr7j9NvE9vXbwAs
MD5:	DD8851B4DD5A086187FCC5F3D7B1BCD6
SHA1:	7FA5A72A7A4C5A6BF5CDC72160E904832F72FF15
SHA-256:	CC94588DA018D3213E631460CD2C4A04ACAFA356D18EFCBAD30B0B710AC0D3BD
SHA-512:	7015A001494F429A2354C2E3B39F8F9C287C558952C3B96215F8AFC93AD8EB0C5BB43AF294622E4FE3520EC3F9496BF334B30B4DBA9B1FD350DE17F5ADBC1C49
Malicious:	false
Preview:	DISMAN-SCHEDULE-MIB DEFINITIONS ::= BEGIN....IMPORTS.. MODULE-IDENTITY, OBJECT-TYPE, NOTIFICATION-TYPE,.. Integer32, Unsigned32, Counter32, mib-2, zeroDotZero.. FROM SNMPv2-SMI.... TEXTUAL-CONVENTION,.. DateAndTime, RowStatus, StorageType, VariablePointer.. FROM SNMPv2-TC.... MODULE-COMPLIANCE, OBJECT-GROUP, NOTIFICATION-GROUP.. FROM SNMPv2-CONF.... SnmpAdminString.. FROM SNMP-FRAMEWORK-MIB;....schedMIB MODULE-IDENTITY.. LAST-UPDATED "200201070000Z".. ORGANIZATION "IETF Distributed Management Working Group".. CONTACT-INFO.. "WG EMail: disman@dorothy.bmc.com.. Subscribe: disman-request@dorothy.bmc.com.... Chair: Randy Presuhn.. BMC Software, Inc... Postal: Office 1-3141.. 2141 North First Street.. San Jose, California 95131.. USA.. EMail: rpresuhn@bmc.com.. Phone: +1 408 546-1006.... Edi

C:\Program Files\pandora_agent\util\mibs\DISMAN-SCRIPT-MIB.txt

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	66075
Entropy (8bit):	4.653211226885814
Encrypted:	false
SSDEEP:	768:I7K2y2yluW23rOUzkYhUcVW11h/F0Ql0glyUMOSrYDs9S4DslX:I7ZyHluW59xF0A0LUMIT
MD5:	351D511DCC3222E19AA0FFE570FB4DA8
SHA1:	4BFD2A399D9C10C5E7BC50637B74DE0EDA825DBF
SHA-256:	10FB329954F99DDEB032EBE2C339CE2995B2592AA14201F6EF1031504F650385
SHA-512:	93774ED607576207D32BD9B1DF172D4552821B699FEF906A18F1531529454A7ACB62944C35A6D55532D9971F7AFE24BDF976729CFE4E97F3C8BE32053610E8EE
Malicious:	false
Preview:	DISMAN-SCRIPT-MIB DEFINITIONS ::= BEGIN....IMPORTS.. MODULE-IDENTITY, OBJECT-TYPE, NOTIFICATION-TYPE,.. Integer32, Unsigned32, mib-2.. FROM SNMPv2-SMI.... RowStatus, TimeInterval, DateAndTime, StorageType, DisplayString.. FROM SNMPv2-TC.... MODULE-COMPLIANCE, OBJECT-GROUP, NOTIFICATION-GROUP.. FROM SNMPv2-CONF.... SnmpAdminString.. FROM SNMP-FRAMEWORK-MIB;....scriptMIB MODULE-IDENTITY.. LAST-UPDATED "200108210000Z".. ORGANIZATION "IETF Distributed Management Working Group".. CONTACT-INFO.. "WG EMail: disman@dorothy.bmc.com.. Subscribe: disman-request@dorothy.bmc.com.... Chair: Randy Presuhn.. BMC Software, Inc..... Postal: Office 1-3141.. 2141 North First Street.. San Jose, California 95131.. USA.. EMail: rpresuhn@bmc.com.. Phone: +1 408 546-1006.... Editor: David B. Levi..

C:\Program Files\pandora_agent\util\mibs\DISMAN-TRACEROUTE-MIB.txt

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	71366
Entropy (8bit):	4.619267461126673
Encrypted:	false
SSDEEP:	384:z3543yO9BWhACcOPXik7p93nuKU8qxx6n7Bmdn5UO+eDcJr040P875uAFW70FRZX:z54vBWaGRqvAynd+IcJrB7Bw70LZaR0
MD5:	E75DC0921B17C4CB40CB8B8178D2D447
SHA1:	20E5E669CD2397472F4D6BF3031447DEE854FB42
SHA-256:	0864EF25E761688A28F415816F3B1DAAA57276E3F753E49632D7023B68600419
SHA-512:	FA403E26494FA36F689C69E321CE4D51D157A3907A816E7021686B9AB72A2A647889FD05DD2C74C2B836C3A24FFA96B28DD1B3406E944F8B5A4D2A17FC851873
Malicious:	false
Preview:	DISMAN-TRACEROUTE-MIB DEFINITIONS ::= BEGIN....IMPORTS.. MODULE-IDENTITY, OBJECT-TYPE, Integer32,.. Gauge32, Unsigned32, mib-2,.. NOTIFICATION-TYPE,.. OBJECT-IDENTITY.. FROM SNMPv2-SMI -- RFC2578.. RowStatus, StorageType,.. TruthValue, DateAndTime.. FROM SNMPv2-TC -- RFC2579.. MODULE-COMPLIANCE, OBJECT-GROUP,.. NOTIFICATION-GROUP.. FROM SNMPv2-CONF -- RFC2580.. SnmpAdminString.. FROM SNMP-FRAMEWORK-MIB -- RFC3411.. InterfaceIndexOrZero -- RFC2863.. FROM IF-MIB.. InetAddressType, InetAddress.. FROM INET-ADDRESS-MIB -- RFC4001.. OperationResponseStatus.. FROM DISMAN-PING-MIB; -- RFC4560.... traceRouteMIB MODULE-IDENTITY.. LAST-UPDATED "200606130000Z" -- 13 June 2006.. ORGANIZATION "IETF Distributed Management Working Group".. CONTACT-INFO.. "Juergen Quittek.... NEC Europe Ltd..

C:\Program Files\pandora_agent\util\mibs\EtherLike-MIB.txt

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	86354
Entropy (8bit):	4.1127098161848155
Encrypted:	false
SSDEEP:	768:RDT2ZCTYcG9GHWeXg5c/W+pZpVWThqvYvuMZmSZd6YcR+8bp/1ADK0GQdRl6:lK9stVCA89WH4Rl6
MD5:	C9D9C3FA4B867B1AC499C2132CBC51E7
SHA1:	A1E54409338CEA447CDB0F594D2BD00B1C0CD70E
SHA-256:	CC3AE91D315E1F26A130AE981A1E6B10F33B6DE77AAF688BF049E1122F4537B7
SHA-512:	C1901F3712DEC7B11E19C016F9127E4C22952EFD76256899128CC268E537A0D7C0AB3655196658A7494001BFE72F116F64D0B330550FB112D2456A318BF5D46D
Malicious:	false
Preview:	EtherLike-MIB DEFINITIONS ::= BEGIN.... IMPORTS.. MODULE-IDENTITY, OBJECT-TYPE, OBJECT-IDENTITY,.. Integer32, Counter32, Counter64, mib-2, transmission.. FROM SNMPv2-SMI.. MODULE-COMPLIANCE, OBJECT-GROUP.. FROM SNMPv2-CONF.. TruthValue.. FROM SNMPv2-TC.. ifIndex, InterfaceIndex.. FROM IF-MIB;.... etherMIB MODULE-IDENTITY.. LAST-UPDATED "200309190000Z" -- September 19, 2003.. ORGANIZATION "IETF Ethernet Interfaces and Hub MIB.. Working Group".. CONTACT-INFO.. "WG E-mail: hubmib@ietf.org.. To subscribe: hubmib-request@ietf.org.... Chair: Dan Romascanu.. Postal: Avaya Inc... Atidum Technology Park, Bldg. 3.. Tel Aviv 61131.. Israel.. Tel: +972 3 645 8414.. E-mail: dromasca@avaya.com.... Editor: John

C:\Program Files\pandora_agent\util\mibs\HCNUM-TC.txt

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4778
Entropy (8bit):	4.572884815783835
Encrypted:	false
SSDEEP:	96:CcmB27hvFwv/kTWMLgFeCAEmHBD6sKy2DIdeZR1+SO:C5u9i/kyuBgD4eZHO
MD5:	93390923BF869A02334C6EF311262553
SHA1:	065BB2644BD23EF0CE378EC87F1485D048ED8A45
SHA-256:	8ABCFEAB6C29C8A3B01594EA4811DD2C41D52556CC3BB041B11590D1F54B7A52
SHA-512:	AC560F88B248A6F0BADD978F2A7A21C40388351E55959DC39B1FA23DDDC20AD5C74E065D39B70BE62E79F05DD0E574F2CEF0FC421C8F5DCFE7EAB34A603B2EC9
Malicious:	false
Preview:	HCNUM-TC DEFINITIONS ::= BEGIN....IMPORTS.. MODULE-IDENTITY, mib-2, Counter64.. FROM SNMPv2-SMI.. TEXTUAL-CONVENTION.. FROM SNMPv2-TC;....hcnumTC MODULE-IDENTITY.. LAST-UPDATED "200006080000Z".... ORGANIZATION "IETF OPS Area".. CONTACT-INFO.. " E-mail: mibs@ops.ietf.org.. Subscribe: majordomo@psg.com.. with msg body: subscribe mibs.... Andy Bierman.. Cisco Systems Inc... 170 West Tasman Drive.. San Jose, CA 95134 USA.. +1 408-527-3711.. abierman@cisco.com.... Keith McCloghrie.. Cisco Systems Inc... 170 West Tasman Drive.. San Jose, CA 95134 USA.. +1 408-526-5260.. kzm@cisco.com.... Randy Presuhn.. BMC Software, Inc... Office 1-3141.. 2141 North First Street..

C:\Program Files\pandora_agent\util\mibs\HOST-RESOURCES-MIB.txt

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	54084
Entropy (8bit):	4.718878728526424
Encrypted:	false
SSDEEP:	384:WwJ/w7zS0Xpnq4dV1dIBdogyfAjC3lXJ8fVvscaIWj4TMJqpPDlbRLQmsmIyC+4k:WwJ/uS8JrMC3lXyiIoqxlbRLgSjniV+
MD5:	9A157F456142BB85B39539F4E243E40A
SHA1:	C4D92EC96E7B654902A09093DCD9E860588F6D3A
SHA-256:	6F3D02FB95A6CE06A10A897A85D28C78313287829C12B78F1377C01349272706
SHA-512:	8E004199BFCAC73EB7FFA2477C51D68A2F585261A11357160DB46B0EA668257AA9F7B7469262CB4AED90C0C3986A7DEAF3F2E2A7101FC083950FAF653EF7B74B
Malicious:	false
Preview:	HOST-RESOURCES-MIB DEFINITIONS ::= BEGIN....IMPORTS..MODULE-IDENTITY, OBJECT-TYPE, mib-2,..Integer32, Counter32, Gauge32, TimeTicks FROM SNMPv2-SMI....TEXTUAL-CONVENTION, DisplayString,..TruthValue, DateAndTime, AutonomousType FROM SNMPv2-TC....MODULE-COMPLIANCE, OBJECT-GROUP FROM SNMPv2-CONF....InterfaceIndexOrZero FROM IF-MIB;....hostResourcesMibModule MODULE-IDENTITY.. LAST-UPDATED "200003060000Z" -- 6 March 2000.. ORGANIZATION "IETF Host Resources MIB Working Group".. CONTACT-INFO.. "Steve Waldbusser.. Postal: Lucent Technologies, Inc... 1213 Innsbruck Dr... Sunnyvale, CA 94089.. USA.. Phone: 650-318-1251.. Fax: 650-318-1633.. Email: waldbusser@lucent.com.... In addition, the Host Resources MIB mailing list is.. dedicated to discussion of this MIB. To join the.. mailing list, send a request message to.. hostmib-request@andrew.cmu.edu. The m

C:\Program Files\pandora_agent\util\mibs\HOST-RESOURCES-TYPES.txt

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	10972
Entropy (8bit):	4.866621899873662
Encrypted:	false
SSDEEP:	96:uYJopYASf9Z2oRoogCZSrKUscUyHj7ZrFAjYRWpM6azFf3ue/p:uYJo9+CGs1RWpSn
MD5:	A2A4ED20EEDAD194BE225C5D5296B80F
SHA1:	245C83580B601C974DF58E1655CB69DD7762196C
SHA-256:	6087F9B5A1F99B9DAC0994D6D8EC1390603C4685B28FFD0021B3171EA9B9168F
SHA-512:	FC9A6698903BB2E5212E1E0A04AE14076F117EF363FAED54AA30E0B9A2D7964E4850DE390F9F5564401983EF842A73CEF8409D0924AA2DF3032A13141F4AADAD
Malicious:	false
Preview:	HOST-RESOURCES-TYPES DEFINITIONS ::= BEGIN....IMPORTS.. MODULE-IDENTITY, OBJECT-IDENTITY FROM SNMPv2-SMI.. hrMIBAdminInfo, hrStorage, hrDevice FROM HOST-RESOURCES-MIB;....hostResourcesTypesModule MODULE-IDENTITY.. LAST-UPDATED "200003060000Z" -- 6 March, 2000.. ORGANIZATION "IETF Host Resources MIB Working Group".. CONTACT-INFO.. "Steve Waldbusser.. Postal: Lucent Technologies, Inc... 1213 Innsbruck Dr... Sunnyvale, CA 94089.. USA.. Phone: 650-318-1251.. Fax: 650-318-1633.. Email: waldbusser@ins.com.... In addition, the Host Resources MIB mailing list is dedicated.. to discussion of this MIB. To join the mailing list, send a.. request message to hostmib-request@andrew.cmu.edu. The mailing.. list address is hostmib@andrew.cmu.edu.".. DESCRIPTION.. "This MIB module registers type definitions for.. storage types, device types, and file system types..... After the initia

C:\Program Files\pandora_agent\util\mibs\IANA-ADDRESS-FAMILY-NUMBERS-MIB.txt

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4864
Entropy (8bit):	4.500452096521191
Encrypted:	false
SSDEEP:	48:4MyQfTEwJpveT8lFQKTvTCvjtnySb9ipQbjG8wRbDZMRy5QCrBmoVkEnscxSmS:pswHvEyrCvj0SpVG8Ut89CrBTkEda
MD5:	9D971306D39AC6D012ED9EE3D9848DAB
SHA1:	6C9759A4BDB7A1C0744CD5C7F72CC389691D49F9
SHA-256:	F6C768E44E640937B4C6F25F51B5840CE7285D4A596C7C516ED7E4E9D8296B31
SHA-512:	7FFA8FCB333C680A2ADE851BBDB93E381888712394BBCB1216AE176794CEF215E55B15E85DFB855EC52F6DC0BB0DAA9B560D09E7533DC6C01BD201AC8A8C08D0
Malicious:	false
Preview:	IANA-ADDRESS-FAMILY-NUMBERS-MIB DEFINITIONS ::= BEGIN.... IMPORTS.. MODULE-IDENTITY,.. mib-2 FROM SNMPv2-SMI.. TEXTUAL-CONVENTION FROM SNMPv2-TC;.... ianaAddressFamilyNumbers MODULE-IDENTITY.. LAST-UPDATED "200203140000Z" -- March 14, 2002.. ORGANIZATION "IANA".. CONTACT-INFO.. "Postal: Internet Assigned Numbers Authority.. Internet Corporation for Assigned Names.... and Numbers.. 4676 Admiralty Way, Suite 330.. Marina del Rey, CA 90292-6601.. USA.... Tel: +1 310-823-9358.. E-Mail: iana@iana.org".. DESCRIPTION.. "The MIB module defines the AddressFamilyNumbers.. textual convention.".... -- revision history.... REVISION "200203140000Z" -- March 14, 2002.. DESCRIPTION "AddressFamilyNumbers assignment 22 to .. fibreChannelWWPN

C:\Program Files\pandora_agent\util\mibs\IANA-LANGUAGE-MIB.txt

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4422
Entropy (8bit):	4.835276652966644
Encrypted:	false
SSDEEP:	96:7MuiL1rJQh4MgsGYqmSORdYScUQe2dGJ3QMQ8QWQWQkQ9hQKGCpem:7MuiL1rJQh47sGV6RdY9De2YJgRBXXZn
MD5:	F3B7F541D4F34FA04C7CEC3281362A13
SHA1:	B1FD024359D5D4858E8409E33426560CE6214642
SHA-256:	6172F243FB0A9DDB717D4141C2096482CB941780FE7F15C0E5960EF2D44B056D
SHA-512:	7A3BF42C72A13F44707F8FE11BAF163FA3552458F770E768221F8257F8A98231D9268B52FACB468CFF3AD8DC7E4B3D6FA93B2D4111EDE8F2817C93E60535B00F
Malicious:	false
Preview:	IANA-LANGUAGE-MIB DEFINITIONS ::= BEGIN....IMPORTS.. MODULE-IDENTITY, OBJECT-IDENTITY, mib-2.. FROM SNMPv2-SMI;....ianaLanguages MODULE-IDENTITY.. LAST-UPDATED "200005100000Z" -- May 10, 2000.. ORGANIZATION "IANA".. CONTACT-INFO.. "Internet Assigned Numbers Authority (IANA).... Postal: ICANN.. 4676 Admiralty Way, Suite 330.. Marina del Rey, CA 90292.... Tel: +1 310 823 9358 x20.. E-Mail: iana@iana.org".. DESCRIPTION.. "The MIB module registers object identifier values for.. well-known programming and scripting languages. Every.. language registration MUST describe the format used.. when transferring scripts written in this language..... Any additions or changes to the contents of this MIB.. module require Designated Expert Review as defined in.. the Guidelines for Writing IANA Considerations Section.. document. The Designated Expert wil

C:\Program Files\pandora_agent\util\mibs\IANA-RTPROTO-MIB.txt

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3610
Entropy (8bit):	4.353424918513813
Encrypted:	false
SSDEEP:	48:KmMC/oyojJoAXYzXdwDkNUKncICn9UaXNl+U/DbNO4mCD6xglORbM:K1A+No/Gk9ncV9UaXyYO49OO
MD5:	1BFEC851076C2557D07352624E479D34
SHA1:	A5BC44B235B0DF57D6DD5A81C418601ABEB58752
SHA-256:	DD298131CF7EEFE793C0F8C68D89CD1A57F75AFC6B2BF19C495C97CC72AAD1DA
SHA-512:	0F3D6B57799EBD385BB42CCAFE16C015DCBDA9FA3EB764AC7A96EB940AD0738A64A4D5BB6CCED5C75AEE3FDCEA050B4374AE6DA5F9AF6EA6A4501363D2F1C855
Malicious:	false
Preview:	..IANA-RTPROTO-MIB DEFINITIONS ::= BEGIN....IMPORTS.. MODULE-IDENTITY, mib-2 FROM SNMPv2-SMI.. TEXTUAL-CONVENTION FROM SNMPv2-TC;....ianaRtProtoMIB MODULE-IDENTITY.. LAST-UPDATED "200009260000Z" -- September 26, 2000.. ORGANIZATION "IANA".. CONTACT-INFO.. " Internet Assigned Numbers Authority.. Internet Corporation for Assigned Names and Numbers.. 4676 Admiralty Way, Suite 330.. Marina del Rey, CA 90292-6601.... Phone: +1 310 823 9358.. EMail: iana@iana.org".. DESCRIPTION.. "This MIB module defines the IANAipRouteProtocol and.. IANAipMRouteProtocol textual conventions for use in MIBs.. which need to identify unicast or multicast routing.. mechanisms..... Any additions or changes to the contents of this MIB module.. require either publication of an RFC, or Designated Expert.. Review as defined

C:\Program Files\pandora_agent\util\mibs\IANAifType-MIB.txt

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	24552
Entropy (8bit):	4.441553394080508
Encrypted:	false
SSDEEP:	384:0MDYNWx8WN8lbD9AtsjaDq8wfwy0lWscmItPbmrA4EQgu3iTp6GBF377cXTCeLLp:0M8NWxtN8lbD9AtsjaDq8wfwy0lWscmt
MD5:	33BC1D0806FB9DDFF648B385E708D717
SHA1:	28CEA49B98780F4FC54B7DCA3B632C6711817308
SHA-256:	AF07BBA3163A17F92636237F7AC049D897BE4DC8BD2A5FB83DE42C990E98ACC7
SHA-512:	7B5B1B823031659B2B11F98BBEF21F79043CCA1AC76425E1291C2B3211802B94FAAC2BD028EB7D320F3BD27A5EBF03E0AA20210469B213C1F953D44AD6DF4EB5
Malicious:	false
Preview:	IANAifType-MIB DEFINITIONS ::= BEGIN.... IMPORTS.. MODULE-IDENTITY, mib-2 FROM SNMPv2-SMI.. TEXTUAL-CONVENTION FROM SNMPv2-TC;.... ianaifType MODULE-IDENTITY.. LAST-UPDATED "200510100000Z" -- October 10, 2005.. ORGANIZATION "IANA".. CONTACT-INFO " Internet Assigned Numbers Authority.... Postal: ICANN.. 4676 Admiralty Way, Suite 330.. Marina del Rey, CA 90292.... Tel: +1 310 823 9358.. E-Mail: iana@iana.org".... DESCRIPTION "This MIB module defines the IANAifType Textual.. Convention, and thus the enumerated values of.. the ifType object defined in MIB-II's ifTable.".... REVISION "200510100000Z" -- October 10, 2005.. DESCRIPTION "Registration of new IANA ifType 230.".... REVISION "200509090000Z" -- September 09, 2005.. DESCRIPTION

C:\Program Files\pandora_agent\util\mibs\IF-INVERTED-STACK-MIB.txt

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5215
Entropy (8bit):	4.837631060167448
Encrypted:	false
SSDEEP:	96:pvtFXA+WOKy0U0IBtG2IMLD0mo687IHpGLC0HENjYcTzN:pUSF0U0IBtmMvFo6SIQC0WkQN
MD5:	BCCDEECC99EB61D158428304FC1FA7D4
SHA1:	B392E70263410598BD4F349DAF7D99CC57911EA6
SHA-256:	3466F1307C322BF3DE289A99738B74E0CFEA136E1CA309C2C8EAB56D39985AD5
SHA-512:	429D19D1B9B6E6AB9CC509A3845809212804DEB879E9B78CA72F98C1E4E3AD20D29D14B1CBFF7F5C873C7F0B21E5221DCAC15FC1608F230242B2926F979B54B5
Malicious:	false
Preview:	IF-INVERTED-STACK-MIB DEFINITIONS ::= BEGIN....IMPORTS.. MODULE-IDENTITY, OBJECT-TYPE, mib-2 FROM SNMPv2-SMI.. RowStatus FROM SNMPv2-TC.. MODULE-COMPLIANCE, OBJECT-GROUP FROM SNMPv2-CONF.. ifStackGroup2,.. ifStackHigherLayer, ifStackLowerLayer FROM IF-MIB;....ifInvertedStackMIB MODULE-IDENTITY.. LAST-UPDATED "200006140000Z".. ORGANIZATION "IETF Interfaces MIB Working Group".. CONTACT-INFO.. " Keith McCloghrie.. Cisco Systems, Inc... 170 West Tasman Drive.. San Jose, CA 95134-1706.. US.... 408-526-5260.. kzm@cisco.com".. DESCRIPTION.. "The MIB module which provides the Inverted Stack Table for.. interface sub-layers.".. REVISION "200006140000Z".. DESCRIPTION.. "Initial revision, published as RFC 2864".. ::= { mib-2 77 }....ifInvMIBObjects OBJECT IDENTIFIER ::= { ifInvertedStackMIB 1 }....--..-- The

C:\Program Files\pandora_agent\util\mibs\IF-MIB.txt

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	73505
Entropy (8bit):	4.500890556773766
Encrypted:	false
SSDEEP:	768:r1zcF4s4EByjzZRUVd4B80ngnL8vnzn/nPndnmnSnYn4EnA69DNDF7nW9c:abnN
MD5:	EF53E4BFB4D4E1840840DA4409582D14
SHA1:	E0509B730173F2D6DE11BB5EC11AFBE2FA378B2B
SHA-256:	EBACA56D0146FD8246A202C68B96F36A10688B77B74B70F268A927D118BD366A
SHA-512:	EFE73729325AC226517C16F6AB309C6626305E26BBAA5BC7D7B4C710DE9FF4B2BFC75896CB84BCDA634B9055385774EA626AD2023B3453CA71EEA837F032771B
Malicious:	false
Preview:	IF-MIB DEFINITIONS ::= BEGIN....IMPORTS.. MODULE-IDENTITY, OBJECT-TYPE, Counter32, Gauge32, Counter64,.. Integer32, TimeTicks, mib-2,.. NOTIFICATION-TYPE FROM SNMPv2-SMI.. TEXTUAL-CONVENTION, DisplayString,.. PhysAddress, TruthValue, RowStatus,.. TimeStamp, AutonomousType, TestAndIncr FROM SNMPv2-TC.. MODULE-COMPLIANCE, OBJECT-GROUP,.. NOTIFICATION-GROUP FROM SNMPv2-CONF.. snmpTraps FROM SNMPv2-MIB.. IANAifType FROM IANAifType-MIB;....ifMIB MODULE-IDENTITY.. LAST-UPDATED "200006140000Z".. ORGANIZATION "IETF Interfaces MIB Working Group".. CONTACT-INFO.. " Keith McCloghrie.. Cisco Systems, Inc... 170 West Tasman Drive.. San Jose, CA 95134-1706.. US.... 408-526-5260.. kzm@cisco.com".. DESCRIPTION.. "The MIB module to describe g

C:\Program Files\pandora_agent\util\mibs\INET-ADDRESS-MIB.txt

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	17184
Entropy (8bit):	4.562236377256974
Encrypted:	false
SSDEEP:	192:Ez4v5xzRM6N1jO4wszQnG3pfMETzB+87DFmLpkZ0x0NICOe6I3pNaBz6TzQRsmqU:HbdM4jYGQnmffTzB+EFS2QeIwEuDU
MD5:	D014C7A1E43EA5E4D553344F3B72C2E3
SHA1:	C8027555ED4208B30B038FC05578CCE08FDFE98E
SHA-256:	8FCE1BD9FA27EF77CE579A8D22E936718FBE43C99C61366D40BB911B205797B6
SHA-512:	FF954B8C784AEEBA09469F69F7797DD4DB23995FFB03D1C7E9A1C4C4F78D8B99CF497519EDE1B3C847C90FEEF512226B3DF19D443EC3F18D82CEAEFE753BFA7C
Malicious:	false
Preview:	INET-ADDRESS-MIB DEFINITIONS ::= BEGIN....IMPORTS.. MODULE-IDENTITY, mib-2, Unsigned32 FROM SNMPv2-SMI.. TEXTUAL-CONVENTION FROM SNMPv2-TC;....inetAddressMIB MODULE-IDENTITY.. LAST-UPDATED "200502040000Z".. ORGANIZATION.. "IETF Operations and Management Area".. CONTACT-INFO.. "Juergen Schoenwaelder (Editor).. International University Bremen.. P.O. Box 750 561.. 28725 Bremen, Germany.... Phone: +49 421 200-3587.. EMail: j.schoenwaelder@iu-bremen.de.... Send comments to <ietfmibs@ops.ietf.org>.".. DESCRIPTION.. "This MIB module defines textual conventions for.. representing Internet addresses. An Internet.. address can be an IPv4 address, an IPv6 address,.. or a DNS domain name. This module also defines.. textual conventions for Internet port numbers,.. autonomous system numbers, and the length of an.. Internet address prefix.....

C:\Program Files\pandora_agent\util\mibs\IP-FORWARD-MIB.txt

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	47723
Entropy (8bit):	4.566157084028072
Encrypted:	false
SSDEEP:	384:oGYH13xtLLiLQ4hhvmPWGOnnIpKrrnloba:oN35Cc8Ism2
MD5:	4D342DE9269A901742DD1C237235E833
SHA1:	2F5D557A5A988579448485D833263208E947777C
SHA-256:	163B5CE2719DBEB81BEF6C9B9BBB2E4BD6C5B1AA74067C3E466D145D40E8740E
SHA-512:	B6BF02AFAA96F3001376097D7E77CCD0EF216735760FBC620B001D10BE0D1DE92B875235C52445DA801CED8F27DDE7E87533B09209802ECD9D0C7767188FF88A
Malicious:	false
Preview:	IP-FORWARD-MIB DEFINITIONS ::= BEGIN....IMPORTS.. MODULE-IDENTITY, OBJECT-TYPE,.. IpAddress, Integer32, Gauge32,.. Counter32 FROM SNMPv2-SMI.. RowStatus FROM SNMPv2-TC........ MODULE-COMPLIANCE, OBJECT-GROUP FROM SNMPv2-CONF.. InterfaceIndexOrZero FROM IF-MIB.. ip FROM IP-MIB.. IANAipRouteProtocol FROM IANA-RTPROTO-MIB.. InetAddress, InetAddressType,.. InetAddressPrefixLength,.. InetAutonomousSystemNumber FROM INET-ADDRESS-MIB;....ipForward MODULE-IDENTITY.. LAST-UPDATED "200602010000Z".. ORGANIZATION.. "IETF IPv6 Working Group.. http://www.ietf.org/html.charters/ipv6-charter.html".. CONTACT-INFO.. "Editor:.. Brian Haberman.. Johns Hopkins University - Applied Physics Laboratory.. Mailstop 17-S442.. 11100 Johns Hopkins Road.. Laurel MD, 20

C:\Program Files\pandora_agent\util\mibs\IP-MIB.txt

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	191182
Entropy (8bit):	4.589067886783477
Encrypted:	false
SSDEEP:	3072:wZS+7K8+84IXs73UvM5wyC2JRMbAmo7sQH9OPVJ:uS+7bEI2JRJTOdJ
MD5:	8C6E3432608841E162ACBEA05C85F5F7
SHA1:	DB9B3A722405B6731949468BC0BBAD8AB414F0E8
SHA-256:	827985E73003D4F7C998D69DF2D89E1F159F7CEB4AE27516A8CF055B36452E27
SHA-512:	6E4BBE9D713B2EAC1A510F4C3E86697847E1C7000590E666489D8B437A3039BC75CE5BDF26A7AEA8C14322C20F30162430910901A1EB0C5EC2B2EB51EB5CE09C
Malicious:	false
Preview:	IP-MIB DEFINITIONS ::= BEGIN....IMPORTS.. MODULE-IDENTITY, OBJECT-TYPE,.. Integer32, Counter32, IpAddress,.. mib-2, Unsigned32, Counter64,.. zeroDotZero FROM SNMPv2-SMI.. PhysAddress, TruthValue,.. TimeStamp, RowPointer,.. TEXTUAL-CONVENTION, TestAndIncr,.. RowStatus, StorageType FROM SNMPv2-TC.. MODULE-COMPLIANCE, OBJECT-GROUP FROM SNMPv2-CONF.. InetAddress, InetAddressType,.. InetAddressPrefixLength,.. InetVersion, InetZoneIndex FROM INET-ADDRESS-MIB.. InterfaceIndex FROM IF-MIB;....ipMIB MODULE-IDENTITY.. LAST-UPDATED "200602020000Z".. ORGANIZATION "IETF IPv6 MIB Revision Team".. CONTACT-INFO.. "Editor:........ Shawn A. Routhier.. Interworking Labs.. 108 Whispering Pines Dr. Suite 235.. Scotts Valley, CA 95066.. USA.. EMail: <sar@iwl.com>".. DESCRIPTION.. "The MIB module for managing

C:\Program Files\pandora_agent\util\mibs\IPV6-ICMP-MIB.txt

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	16465
Entropy (8bit):	4.6904018121072
Encrypted:	false
SSDEEP:	96:WZWAwXelTn/fA2x3sT62AHrmIbS5YoKeR5RCIbJbQE88lW22qrlqcFgrveDopvRE:WbwXelTn/ge+tHCOqWl+jCbD5X+Jh2
MD5:	E0F41D34F7ECEECD8C71C667B257AE17
SHA1:	15914F5D069EEF495DED0BE22154531860DE46A5
SHA-256:	B3DF8FF785B4B7F152C1CDBA0BCC104F6D9AE55E17399CF9C64012AA0A34084B
SHA-512:	3DE9EC44FF324EC41F40590BC6195614EF62A9B84A7672F9B0E56E5249A219F27DB5AE40BAA9286A9329EF6A0CC7F41B7C930E4E2E40ADA2E47A0BE4B27F3605
Malicious:	false
Preview:	IPV6-ICMP-MIB DEFINITIONS ::= BEGIN.... IMPORTS.. MODULE-IDENTITY, OBJECT-TYPE,.. Counter32, mib-2 FROM SNMPv2-SMI.. MODULE-COMPLIANCE, OBJECT-GROUP FROM SNMPv2-CONF.. ipv6IfEntry FROM IPV6-MIB;.... ipv6IcmpMIB MODULE-IDENTITY.. LAST-UPDATED "9801082155Z".. ORGANIZATION "IETF IPv6 Working Group".. CONTACT-INFO.. " Dimitry Haskin.... Postal: Bay Networks, Inc... 660 Techology Park Drive... Billerica, MA 01821.. US.... Tel: +1-978-916-8124.. E-mail: dhaskin@baynetworks.com.... Steve Onishi.... Postal: Bay Networks, Inc... 3 Federal Street.. Billerica, MA 01821.. US.... Tel: +1-978-916-3816.. E-mail: sonishi@baynetworks.com".. DESCRIPTION.. "The MIB module for entities implementing.. the ICMPv6."..

C:\Program Files\pandora_agent\util\mibs\IPV6-MIB.txt

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	50146
Entropy (8bit):	4.633095664367848
Encrypted:	false
SSDEEP:	384:ZFfaiLiTQRor4Sb/vFjTcRz++YEHy7ffdTR//V6nAGOw:jfMrvbHFjoRy+RUhw
MD5:	904A6564FC3492959849D10F8D01A3DF
SHA1:	81C4CB713A66739C6A9BC3C5D29F05C90D4D31E4
SHA-256:	3A941806B960EC1FFA55617A875902B2CAF985AEAD137B3E7A301335344BE586
SHA-512:	289B250E6D0296DDC37EA08FE870B298F56285D72C293ED05B47E7F2E0070248D6FC156C92F82498F1AD0DD3D090EC8FB4B98DC00EB6989BCFDB8BB22F9301EF
Malicious:	false
Preview:	IPV6-MIB DEFINITIONS ::= BEGIN.... IMPORTS.. MODULE-IDENTITY, OBJECT-TYPE, NOTIFICATION-TYPE,.. mib-2, Counter32, Unsigned32, Integer32,.. Gauge32 FROM SNMPv2-SMI.. DisplayString, PhysAddress, TruthValue, TimeStamp,.. VariablePointer, RowPointer FROM SNMPv2-TC.. MODULE-COMPLIANCE, OBJECT-GROUP,.. NOTIFICATION-GROUP FROM SNMPv2-CONF.. Ipv6IfIndex, Ipv6Address, Ipv6AddressPrefix,.. Ipv6AddressIfIdentifier,.. Ipv6IfIndexOrZero FROM IPV6-TC;.... ipv6MIB MODULE-IDENTITY.. LAST-UPDATED "9802052155Z".. ORGANIZATION "IETF IPv6 Working Group".. CONTACT-INFO.. " Dimitry Haskin.... Postal: Bay Networks, Inc... 660 Techology Park Drive... Billerica, MA 01821.... US.... Tel: +1-978-916-8124.. E-mail: dhaskin@baynetworks.com.... Steve Onishi....

C:\Program Files\pandora_agent\util\mibs\IPV6-TC.txt

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2434
Entropy (8bit):	4.775220868168817
Encrypted:	false
SSDEEP:	24:/fKFNR2Xt2TX9sDmwdKkjNylVE43zLhaf5cs/MwsO1OhXe:URUMXCCTuNyTDsfKMx1Ohu
MD5:	72EA269DC6762733C0A0B9E359516446
SHA1:	EE2983BE6C50143CACAC94FE3CEF8113B298CCE5
SHA-256:	86011652171E2B1851B8560B4265C34F700A7E9B63D37CA399EBA15C9A1A7D58
SHA-512:	2B07AF054A4295A8573CA55125DF488E7B519C521402EBCC9663EEEC6413AB5E05E8644060AB6E0F9B93D341E3603E6C72A02198B4B229BAA87D1E445E030147
Malicious:	false
Preview:	IPV6-TC DEFINITIONS ::= BEGIN....IMPORTS.. Integer32 FROM SNMPv2-SMI.. TEXTUAL-CONVENTION FROM SNMPv2-TC;....-- definition of textual conventions..Ipv6Address ::= TEXTUAL-CONVENTION.. DISPLAY-HINT "2x:".. STATUS current.. DESCRIPTION.. "This data type is used to model IPv6 addresses... This is a binary string of 16 octets in network.. byte-order.".. SYNTAX OCTET STRING (SIZE (16))....Ipv6AddressPrefix ::= TEXTUAL-CONVENTION.. DISPLAY-HINT "2x:".. STATUS current.. DESCRIPTION.. "This data type is used to model IPv6 address.. prefixes. This is a binary string of up to 16.. octets in network byte-order.".. SYNTAX OCTET STRING (SIZE (0..16))....Ipv6AddressIfIdentifier ::= TEXTUAL-CONVENTION.. DISPLAY-HINT "2x:".. STATUS current.. DESCRIPTION.. "This data type is used to model IPv6 address.. interface identifiers. This is a binary string..

C:\Program Files\pandora_agent\util\mibs\IPV6-TCP-MIB.txt

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	7468
Entropy (8bit):	4.8005124354895035
Encrypted:	false
SSDEEP:	192:psmXankc9S3fFvlzmqMTgt1ATYzyHEgjL/H:ZXTq6mbsY4yHEo
MD5:	27C2064EA68B92028CB7C150E519B020
SHA1:	9B6AF4777611250BF06D48AD040C2CBDC543A0BC
SHA-256:	8B87EA192A6262B677A7334A8FDC16FA7E7D17669C45D778D9C61B34FF22F6D4
SHA-512:	5ACE153804D2912187F3549EC51E6A9B1C371DB01E6ACFDCDB1C6FF6F8B1203DD4AE0826BFEA2128C45C3B8E756AFE41DD324D40472BC864216CC7E19181B571
Malicious:	false
Preview:	IPV6-TCP-MIB DEFINITIONS ::= BEGIN....IMPORTS.. MODULE-COMPLIANCE, OBJECT-GROUP FROM SNMPv2-CONF.. MODULE-IDENTITY, OBJECT-TYPE,.. mib-2, experimental FROM SNMPv2-SMI.. Ipv6Address, Ipv6IfIndexOrZero FROM IPV6-TC;....ipv6TcpMIB MODULE-IDENTITY.. LAST-UPDATED "9801290000Z".. ORGANIZATION "IETF IPv6 MIB Working Group".. CONTACT-INFO.. " Mike Daniele.... Postal: Compaq Computer Corporation.. 110 Spitbrook Rd.. Nashua, NH 03062... US.... Phone: +1 603 884 1423.. Email: daniele@zk3.dec.com".. DESCRIPTION.. "The MIB module for entities implementing TCP over IPv6.".. ::= { experimental 86 }....-- objects specific to TCP for IPv6....tcp OBJECT IDENTIFIER ::= { mib-2 6 }....-- the TCP over IPv6 Connection table....-- This connection table contains information about this..-- entity's existing TCP connections bet

C:\Program Files\pandora_agent\util\mibs\IPV6-UDP-MIB.txt

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4541
Entropy (8bit):	4.904553465822034
Encrypted:	false
SSDEEP:	96:BU7yAG2h0Fwj5vF0bq0QISSqs77s1A8xuz/kYfLP/:BoG40FwlvF0bqgSSqCw9uNr/
MD5:	8CC9E98F089ECA1B6EB4B72556C96DA7
SHA1:	751201E62204E1F371CB919D34A8C1A61FCE6A23
SHA-256:	E19F75DA5915A7B10CE8E0CC18E9997F37E49A95C81D27C40092A73F43B0552D
SHA-512:	B3180C94C48EDC2771E7DE89D273E813740CF187078910C066792F8896B2A919D1FCDBA05E3E785971A0299CA57F3AAD16A014EDDB0F38DABB474D61C8A8E159
Malicious:	false
Preview:	IPV6-UDP-MIB DEFINITIONS ::= BEGIN....IMPORTS.. MODULE-COMPLIANCE, OBJECT-GROUP FROM SNMPv2-CONF.. MODULE-IDENTITY, OBJECT-TYPE,.. mib-2, experimental FROM SNMPv2-SMI.. Ipv6Address, Ipv6IfIndexOrZero FROM IPV6-TC;....ipv6UdpMIB MODULE-IDENTITY.. LAST-UPDATED "9801290000Z".. ORGANIZATION "IETF IPv6 MIB Working Group".. CONTACT-INFO.. " Mike Daniele.... Postal: Compaq Computer Corporation.. 110 Spitbrook Rd.. Nashua, NH 03062... US.... Phone: +1 603 884 1423.. Email: daniele@zk3.dec.com".. DESCRIPTION.. "The MIB module for entities implementing UDP over IPv6.".. ::= { experimental 87 }....-- objects specific to UDP for IPv6....udp OBJECT IDENTIFIER ::= { mib-2 7 }....-- the UDP over IPv6 Listener table....-- This table contains information about this entity's..-- UDP/IPv6 endpoints. Only endpoin

C:\Program Files\pandora_agent\util\mibs\LM-SENSORS-MIB.txt

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	6161
Entropy (8bit):	4.909357761206057
Encrypted:	false
SSDEEP:	96:F9b0S5zrQEV+tgBpuQCBHuhTxmG3nBHcC2qHFpUK63:Pb/5wEVQGbXhTxmmZthHFpUKE
MD5:	1058BB123A09433AC488D924BC9BFCDF
SHA1:	D61AD1ABAB12D8CF03A191CD07A334173B88D72C
SHA-256:	C9929C407B0D168B88C63F9439FF4D60EBEF777F524F38186ECB08031D496DF6
SHA-512:	CA432C1292B323B7D3182405ADA09EDF28B8E433853066FAF368CC2C07942004864C4D5F7396BC743C31BD719A037AEC0CC668FE647310CA3B750A8BB4B13474
Malicious:	false
Preview:	LM-SENSORS-MIB DEFINITIONS ::= BEGIN....--..-- Derived from the original VEST-INTERNETT-MIB. Open issues:..--..-- (a) where to register this MIB?..-- (b) use not-accessible for diskIOIndex?..--......IMPORTS.. MODULE-IDENTITY, OBJECT-TYPE, Integer32, Gauge32.. FROM SNMPv2-SMI.. DisplayString.. FROM SNMPv2-TC.. ucdExperimental.. FROM UCD-SNMP-MIB;....lmSensorsMIB MODULE-IDENTITY.. LAST-UPDATED "200011050000Z".. ORGANIZATION "AdamsNames Ltd".. CONTACT-INFO .. "Primary Contact: M J Oldfield.. email: m@mail.tc".. DESCRIPTION.. "This MIB module defines objects for lm_sensor derived data.".. REVISION "200011050000Z".. DESCRIPTION.. "Derived from DISKIO-MIB ex UCD.".. ::= { lmSensors 1 }....lmSensors OBJECT IDENTIFIER ::= { ucdExperimental 16 }....--....lmTempSensorsTable OBJECT-TYPE.. SYNTAX SEQUENCE OF LMTempSensorsEntry.. MAX-ACCESS not-accessible.. STATUS current.. DESCRIP

C:\Program Files\pandora_agent\util\mibs\MTA-MIB.txt

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	43601
Entropy (8bit):	4.945422988806991
Encrypted:	false
SSDEEP:	384:J1qDX39+XGEVr9IJT/upxiVD0+QY0ODDdx3Duz/m5aAPfo6bkQZ3ZgZGnRDgr4Pz:JsDXQ2CrOJruBY/DeRcvgr4Ohav+pv+r
MD5:	214774D0A14FEE3F2F0EAA060B0865CF
SHA1:	B85726EBB501D6814E5040FE761E8EC9B60C9F16
SHA-256:	B6270D6E0591D57E59BD9A8AA33F60941CCD1A8B4C6591A5D597284C50C7F656
SHA-512:	169E98C3B353BB67733505A886B7A70388D736E57EF104A6CB92A1DE884E62690336AD3086A397E6A203BEB9C7F66E6DDC87D6E5EFBD10E75ECF2FC72B3A323A
Malicious:	false
Preview:	MTA-MIB DEFINITIONS ::= BEGIN....IMPORTS.. OBJECT-TYPE, Counter32, Gauge32, MODULE-IDENTITY, mib-2.. FROM SNMPv2-SMI.. TimeInterval.. FROM SNMPv2-TC.. MODULE-COMPLIANCE, OBJECT-GROUP.. FROM SNMPv2-CONF.. SnmpAdminString.. FROM SNMP-FRAMEWORK-MIB.. applIndex, URLString.. FROM NETWORK-SERVICES-MIB;....mta MODULE-IDENTITY.. LAST-UPDATED "200003030000Z".. ORGANIZATION "IETF Mail and Directory Management Working Group".. CONTACT-INFO.. " Ned Freed.... Postal: Innosoft International, Inc... 1050 Lakes Drive.. West Covina, CA 91790.. US.... Tel: +1 626 919 3600.. Fax: +1 626 919 3614.... E-Mail: ned.freed@innosoft.com".. DESCRIPTION.. "The MIB module describing Message Transfer Agents (MTAs)".. REVISION "200003030000Z".. DESCRIPTION.. "This revision, published in RFC 2789, changes a number of.. DisplayStrings to SnmpAdminStrings. Note that this change.... is not

C:\Program Files\pandora_agent\util\mibs\Makefile.in

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	makefile script, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2209
Entropy (8bit):	5.41063668399195
Encrypted:	false
SSDEEP:	48:og7N22iplLYUKdty8SDbNxE8NpmaYaKsaOV2asIfM/r7+WyJW/DJG1tXYy:142Y9YUKdtbobNtEp//OV2F3Dt/etIy
MD5:	D07395EA3D0DAFB840CFF796D6FEC340
SHA1:	39BB8C1DB9D277EF9D1C095B7F301053600CE8EA
SHA-256:	BDB8AE6214EEA299D84F96FDD3010CC029BCEFA88E507FCF0130A52F9438F5A3
SHA-512:	D186C2F636805BC5AF44B53E414CF8A6C2248BFADF1492656F7394D64F711AB75495CE7C35FC8A158C0AEA829BE1A09C6D17922E726D8347173408D66627564E
Malicious:	false
Preview:	#..# Makefile to install mib files...#....top_builddir=......VPATH..= @srcdir@....#..# Stuff here..#..OTHERINSTALL=mibsinstall..OTHERUNINSTALL=mibsuninstall......V1MIBS.= RFC1155-SMI.txt RFC1213-MIB.txt RFC-1215.txt....V2MIBS = SNMPv2-CONF.txt SNMPv2-SMI.txt SNMPv2-TC.txt SNMPv2-TM.txt \...SNMPv2-MIB.txt....V3MIBS.= SNMP-FRAMEWORK-MIB.txt SNMP-MPD-MIB.txt SNMP-TARGET-MIB.txt \...SNMP-NOTIFICATION-MIB.txt SNMP-PROXY-MIB.txt \...SNMP-USER-BASED-SM-MIB.txt SNMP-VIEW-BASED-ACM-MIB.txt \...SNMP-COMMUNITY-MIB.txt TRANSPORT-ADDRESS-MIB.txt....AGENTMIBS = AGENTX-MIB.txt SMUX-MIB.txt....IANAMIBS = IANAifType-MIB.txt IANA-LANGUAGE-MIB.txt \...IANA-ADDRESS-FAMILY-NUMBERS-MIB.txt....RFCMIBS.= IF-MIB.txt IF-INVERTED-STACK-MIB.txt \...EtherLike-MIB.txt \...IP-MIB.txt IP-FORWARD-MIB.txt IANA-RTPROTO-MIB.txt \...TCP-MIB.txt UDP-MIB.txt \...INET-ADDRESS-MIB.txt HCNUM-TC.txt \...HOST-RESOURCES-MIB.txt HOST-RESOURCES-TYPES.txt \...RMON-MIB.txt \...IPV6-TC.txt IPV6-MIB.txt IPV6-ICMP-MIB.txt IPV6-TCP-MIB.t

C:\Program Files\pandora_agent\util\mibs\Makefile.mib

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	makefile script, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4764
Entropy (8bit):	5.526750996464224
Encrypted:	false
SSDEEP:	96:wuSV/A1V8j6DeboElJTkoi34bRHLN7sRxOL0:SlA1VkknCHLBsi0
MD5:	22470257D315E2D2C3F4C63C99D35806
SHA1:	0B2E87ADE0F3121985E5ACA41F9AF4AE05E6B540
SHA-256:	C8DDAAA22DBCADFFEC578FC1C9FE2EE440B82DBF8D59773497C42FAFB4A9DFEA
SHA-512:	891FD666292B2D29CDEB2EC87FD18167C3962AB977E814669EDAE2A0C8836248113FFDC2C566B208642E49D853EC124EE9BEB19C58FCE1F8380230B3AE844258
Malicious:	false
Preview:	# RFCHOST =.ftp://ftp.nordu.net..RFCHOST =.ftp://ftp.ietf.org..RFCDIR =.rfc....IANAHOST =.http://www.iana.org..IANADIR =.assignments....PREFIX =./usr/local..ALLDIR =.$(PREFIX)/share/snmp/rfc.orig..INSTDIR =.$(PREFIX)/share/snmp/rfc....MIBS =.SNMPv2-TC.txt SNMPv2-TM.txt SNMPv2-SMI.txt SNMPv2-MIB.txt \...SNMPv2-CONF.txt HCNUM-TC.txt INET-ADDRESS-MIB.txt \...SNMP-FRAMEWORK-MIB.txt SNMP-MPD-MIB.txt SNMP-USER-BASED-SM-MIB.txt \...SNMP-VIEW-BASED-ACM-MIB.txt SNMP-COMMUNITY-MIB.txt \...SNMP-TARGET-MIB.txt SNMP-NOTIFICATION-MIB.txt SNMP-PROXY-MIB.txt \...AGENTX-MIB.txt SMUX-MIB.txt \...DISMAN-SCRIPT-MIB.txt DISMAN-SCHEDULE-MIB.txt \...IANA-LANGUAGE-MIB.txt IANA-ADDRESS-FAMILY-NUMBERS-MIB.txt \...IF-MIB.txt IF-INVERTED-STACK-MIB.txt \...IP-MIB.txt IP-FORWARD-MIB.txt TCP-MIB.txt UDP-MIB.txt \...IANAifType-MIB.txt EtherLike-MIB.txt \...IPV6-TC.txt IPV6-MIB.txt IPV6-ICMP-MIB.txt \...IPV6-TCP-MIB.txt IPV6-UDP-MIB.txt \...HOST-RESOURCES-MIB.txt HOST-RESOURCES-TYPES.txt \...NETWORK-SERVICES-MIB.txt

C:\Program Files\pandora_agent\util\mibs\NET-SNMP-AGENT-MIB.txt

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	16282
Entropy (8bit):	4.98957441977315
Encrypted:	false
SSDEEP:	192:B5o0gA3c4igF/XyXhXDBsONYpkN6kQ8ejABF5b7gZ7EOSazGrnePk3ns:Ml6FiBN8afeGr7s
MD5:	E137D8C80CCA494FAD2CB2D427DAC533
SHA1:	9A2A6500AE1C4EC774F15D83D9581945EAC00BD2
SHA-256:	4E4101A45CB3E24A900429D10D9E8E3F4487C5985DD230C858F4FDA2D633B49D
SHA-512:	DF6BF99D66AF73424B836903B5F45DC1A5497B926B8980007AD7094D7CAE75D21A4739D9B484EFD2CD2D117A018255056630FFC2FB80CC5BEA10785C144E7A3B
Malicious:	false
Preview:	NET-SNMP-AGENT-MIB DEFINITIONS ::= BEGIN....--..-- Defines control and monitoring structures for the Net-SNMP agent...--....IMPORTS.. SnmpAdminString.. .FROM SNMP-FRAMEWORK-MIB.... netSnmpObjects, netSnmpModuleIDs, netSnmpNotifications, netSnmpGroups...FROM NET-SNMP-MIB.... OBJECT-TYPE, NOTIFICATION-TYPE, MODULE-IDENTITY, Integer32, Unsigned32.. FROM SNMPv2-SMI.... OBJECT-GROUP, NOTIFICATION-GROUP...FROM SNMPv2-CONF.... TEXTUAL-CONVENTION, DisplayString, RowStatus, TruthValue...FROM SNMPv2-TC;......netSnmpAgentMIB MODULE-IDENTITY.. LAST-UPDATED "200502070000Z".. ORGANIZATION "www.net-snmp.org".. CONTACT-INFO ... "postal: Wes Hardaker.. P.O. Box 382.. Davis CA 95617.... email: net-snmp-coders@lists.sourceforge.net".. DESCRIPTION... "Defines control and monitoring structures for the Net-SNMP agent.".. REVISION "200502070000Z".. DESCRIPTION.. ."Fixing syntax errors".. REVISION

C:\Program Files\pandora_agent\util\mibs\NET-SNMP-EXAMPLES-MIB.txt

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	9439
Entropy (8bit):	4.999329811882366
Encrypted:	false
SSDEEP:	192:JaRo0SCGDNFZiIL09IjNAaVnyCA83SPc9OSId:Jx7/NFZiIL098NdnyMiU9OX
MD5:	5E69A7F345317D31EA04A277FBEFA59B
SHA1:	AC3425E059EAACFD33B6EB3A59770E3479472C73
SHA-256:	5424F9D36D1337A06C1928A6E873C71F389D0EB983026A00C47CDE629C3A3A90
SHA-512:	B2BDFA7A238E12528FBF134099C315167B1B4CDAB852843D75B475D89203FF6149DA16BF64927B3A167FECBFBF309B54826A1346872356AF0B42EFD651DD1DD8
Malicious:	false
Preview:	NET-SNMP-EXAMPLES-MIB DEFINITIONS ::= BEGIN....--..-- Example MIB objects for agent module example implementations..--....IMPORTS.. MODULE-IDENTITY, OBJECT-TYPE, Integer32,.. NOTIFICATION-TYPE FROM SNMPv2-SMI.. SnmpAdminString FROM SNMP-FRAMEWORK-MIB.. netSnmp FROM NET-SNMP-MIB.. RowStatus, StorageType FROM SNMPv2-TC.. InetAddressType, InetAddress FROM INET-ADDRESS-MIB..;....netSnmpExamples MODULE-IDENTITY.. LAST-UPDATED "200406150000Z".. ORGANIZATION "www.net-snmp.org".. CONTACT-INFO ... "postal: Wes Hardaker.. P.O. Box 382.. Davis CA 95617.... email: net-snmp-coders@lists.sourceforge.net".. DESCRIPTION..."Example MIB objects for agent module example implementations".. REVISION "200406150000Z".. DESCRIPTION..."Corrected notification example definitions".. REVISION "200202060000Z"

C:\Program Files\pandora_agent\util\mibs\NET-SNMP-EXTEND-MIB.txt

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	9520
Entropy (8bit):	4.872104016633364
Encrypted:	false
SSDEEP:	96:tq6Eo0UUp4xF6R6Y7JFW3h7sa+dsacRQN+2pupkjeJAAD6M00Gw5Bt9FPyUTWtae:t0o0bpQY9FWWdBSpkjkAY7V6ta/CV6ZM
MD5:	B2514ABC5F09F9881DA56C6E9F05DEFF
SHA1:	7013532EF84E0C169BD6A1E668CB24ADCFCAF7CE
SHA-256:	319D812877D11166AE18EBC0D84234214BB072863EA629A529B5B8676058FF5F
SHA-512:	9D818DC6CC935BA5FBD0D2C3194F970CF3C312A76A30C6E5E957EE003F2E455F7E6C587BBEE8B784017CE936A827174BAA0B5CFA301C2C6DA086A0A5706B6A7D
Malicious:	false
Preview:	NET-SNMP-EXTEND-MIB DEFINITIONS ::= BEGIN....--..-- Defines a framework for scripted extensions..--....IMPORTS.. nsExtensions FROM NET-SNMP-AGENT-MIB.... OBJECT-TYPE, NOTIFICATION-TYPE, MODULE-IDENTITY, Integer32.. FROM SNMPv2-SMI.... OBJECT-GROUP, NOTIFICATION-GROUP...FROM SNMPv2-CONF.... DisplayString, RowStatus, StorageType FROM SNMPv2-TC;......netSnmpExtendMIB MODULE-IDENTITY.. LAST-UPDATED "200405080000Z".. ORGANIZATION "www.net-snmp.org".. CONTACT-INFO ... "postal: Wes Hardaker.. P.O. Box 382.. Davis CA 95617.... email: net-snmp-coders@lists.sourceforge.net".. DESCRIPTION... "Defines a framework for scripted extensions for the Net-SNMP agent.".. REVISION "200405080000Z".. DESCRIPTION..."First revision.".. ::= { nsExtensions 1 }....nsExtendObjects OBJECT IDENTIFIER ::= { nsExtensions 2}..nsExtendGroups OBJECT IDENTIFIER ::= { nsExtensions 3}....nsExtendNumEntries OBJECT-TYPE..

C:\Program Files\pandora_agent\util\mibs\NET-SNMP-MIB.txt

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2103
Entropy (8bit):	5.031535837454501
Encrypted:	false
SSDEEP:	24:8L6F6gtVLo0CVoVT6F25V092+UD/nmF9JtT2BWnmFx6aCpCAeR0x4tJTHOLo4bc:8L26gnLo0CV222L09+gJQB0pCrtAkf
MD5:	222876F2F94EFB4D20B999F18B0D4003
SHA1:	A794DDA8E5C1815914D94AFF64030E389A001B32
SHA-256:	4F62DD4775E1654F2337BEB145D0680CB12E11131649AFD490092C8728761E78
SHA-512:	07B46D40AA31D3824A443730D3A652337017DE3207CB5E2C1BC17A98764765B8841CAE3AE80BF1BE0C3D93EFEE6F3C9F80744E87BBBB2A6D5091CBE83E23583C
Malicious:	false
Preview:	NET-SNMP-MIB DEFINITIONS ::= BEGIN....--..-- Top-level infrastructure of the Net-SNMP project enterprise MIB tree..--....IMPORTS.. MODULE-IDENTITY, enterprises FROM SNMPv2-SMI;....netSnmp MODULE-IDENTITY.. LAST-UPDATED "200201300000Z".. ORGANIZATION "www.net-snmp.org".. CONTACT-INFO ... "postal: Wes Hardaker.. P.O. Box 382.. Davis CA 95617.... email: net-snmp-coders@lists.sourceforge.net".. DESCRIPTION..."Top-level infrastructure of the Net-SNMP project enterprise MIB tree".. REVISION "200201300000Z".. DESCRIPTION..."First draft".. ::= { enterprises 8072}......--..-- Net-SNMP enterprise-specific management objects..--....netSnmpObjects OBJECT IDENTIFIER ::= {netSnmp 1}..-- netSnmpExamples OBJECT IDENTIFIER ::= {netSnmp 2}..netSnmpEnumerations OBJECT IDENTIFIER ::= {netSnmp 3}..netSnmpModuleIDs OBJECT IDENTIFIER ::= {netSnmpEnumerations 1}..netSnmpAgentOIDs

C:\Program Files\pandora_agent\util\mibs\NET-SNMP-MONITOR-MIB.txt

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1274
Entropy (8bit):	5.011071089884632
Encrypted:	false
SSDEEP:	24:8pSzUI/f4HIml2pzo0CVTSzUf4pexMV1IV:8pSzUEf6Iml2zo0CVTSzUfEe6VGV
MD5:	99915F9603ACD040D0514346CA4AB91A
SHA1:	B3F142CD6B5ABD38B3043E400884E33C600DBEEF
SHA-256:	98346A109BBFD3AB2F5D505E62BDE271F3C84C779E9F2845CE4CD292F82CFA87
SHA-512:	BD86A880945BBB7AFA7A242508C651F852CA60069F79B7DE1495936DC1661B91027051FFE2B22B0702CF8725ECB310FF70F6F4FFC6AA0D8636F2AFCA2E0B97FB
Malicious:	false
Preview:	NET-SNMP-MONITOR-MIB DEFINITIONS ::= BEGIN....--..-- Configured elements of the system to monitor.(XXX - ugh! - need a better description!)..--....IMPORTS.. netSnmpObjects, netSnmpModuleIDs FROM NET-SNMP-MIB.... OBJECT-TYPE, NOTIFICATION-TYPE, MODULE-IDENTITY, Integer32.. FROM SNMPv2-SMI.... DisplayString FROM SNMPv2-TC;......netSnmpMonitorMIB MODULE-IDENTITY.. LAST-UPDATED "200202090000Z".. ORGANIZATION "www.net-snmp.org".. CONTACT-INFO ... "postal: Wes Hardaker.. P.O. Box 382.. Davis CA 95617.... email: net-snmp-coders@lists.sourceforge.net".. DESCRIPTION..."Configured elements of the system to monitor... (XXX - ugh! - need a better description!)".. REVISION "200202090000Z".. DESCRIPTION..."First revision.".. ::= { netSnmpModuleIDs 3}......nsProcess OBJECT IDENTIFIER ::= {netSnmpObjects 21}..nsDisk OBJECT IDENTIFIER ::= {netSnmpObjects 22}..nsFile

C:\Program Files\pandora_agent\util\mibs\NET-SNMP-SYSTEM-MIB.txt

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1289
Entropy (8bit):	4.962659873677018
Encrypted:	false
SSDEEP:	12:ILrae3bijRdjkeIOQm7NXXS4Fl2cyxAzhGWvC+F/YXCRfYLoieREgVq4f+23qffG:8zXeIIVJl2Azo0CVAXeZe4mwi
MD5:	BF0CF220E8C982AA58DE0A71DE2279E8
SHA1:	16C4C0408FDF2C94012D5B988CFB347202B9E4F6
SHA-256:	D8F0630D7B859901BF48179BEFAF80EC37B0C1940B259ECC08461AE37BF2C8E2
SHA-512:	568F0A84E27EEB629666354C84F94C11D3437242514FDC1C09500A6F0AB27B65BDC8A5FE56D89BA04DE5509B2026131C0D424253A06661A9321C8F32A279F05A
Malicious:	false
Preview:	NET-SNMP-SYSTEM-MIB DEFINITIONS ::= BEGIN....--..-- Characteristics of the current running system..--....IMPORTS.. netSnmpObjects, netSnmpModuleIDs FROM NET-SNMP-MIB.... Float FROM NET-SNMP-TC.... OBJECT-TYPE, NOTIFICATION-TYPE, MODULE-IDENTITY, Integer32, Counter32.. FROM SNMPv2-SMI.... DisplayString FROM SNMPv2-TC;......netSnmpSystemMIB MODULE-IDENTITY.. LAST-UPDATED "200202090000Z".. ORGANIZATION "www.net-snmp.org".. CONTACT-INFO ... "postal: Wes Hardaker.. P.O. Box 382.. Davis CA 95617.... email: net-snmp-coders@lists.sourceforge.net".. DESCRIPTION..."Characteristics of the current running system".. REVISION "200202090000Z".. DESCRIPTION..."First draft.".. ::= { netSnmpModuleIDs 4}......nsMemory OBJECT IDENTIFIER ::= {netSnmpObjects 31}..nsSwap OBJECT IDENTIFIER ::= {netSnmpObjects 32}..nsCPU OBJECT IDENTIFIER ::= {netSnmp

C:\Program Files\pandora_agent\util\mibs\NET-SNMP-TC.txt

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4617
Entropy (8bit):	5.15653678847066
Encrypted:	false
SSDEEP:	48:8s1ud1o0CViCH7bf/xBk5TKWdZ9CoCuukFz61HV2wSnyRPKxR8Ms+b54E:p4Ho0Ui0z/nk5+WwShR6lQVygxRYE
MD5:	DADDB933CFDEAADA581E6F3AA130F14E
SHA1:	B3B809BE6214ACD36D6A323982FF9FA311B766A8
SHA-256:	F9ED09E0E72CD8E174601866F3F0C614959EABDB7CDE35273A513CDD94D1788E
SHA-512:	EA95C1DCAE5E74147346BA9573A246574BA2BD84FA4D91DA49CCAA7B7009C3950C0E5D368144A48EA56351477C685FE7F1ECBBA4B12DC68D74DDFDF26854B92B
Malicious:	false
Preview:	NET-SNMP-TC DEFINITIONS ::= BEGIN....--..-- Textual conventions and enumerations for the Net-SNMP project..--....IMPORTS.. netSnmpModuleIDs, netSnmpAgentOIDs, netSnmpDomains FROM NET-SNMP-MIB.... MODULE-IDENTITY, Opaque FROM SNMPv2-SMI.... TEXTUAL-CONVENTION FROM SNMPv2-TC;....netSnmpTCs MODULE-IDENTITY.. LAST-UPDATED "200510140000Z".. ORGANIZATION "www.net-snmp.org".. CONTACT-INFO ... "postal: Wes Hardaker.. P.O. Box 382.. Davis CA 95617.... email: net-snmp-coders@lists.sourceforge.net".. DESCRIPTION..."Textual conventions and enumerations for the Net-SNMP project".. REVISION "200202120000Z".. DESCRIPTION..."First draft".. ::= { netSnmpModuleIDs 1}......-- =====================..--..-- Textual Conventions..--..-- =====================....--..-- Define the Float Textual Convention..-- This definition was written by David Perkins...--....Float ::= TEXTUAL-CONVENTION.. STATUS current..

C:\Program Files\pandora_agent\util\mibs\NETWORK-SERVICES-MIB.txt

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	21632
Entropy (8bit):	4.930974415881389
Encrypted:	false
SSDEEP:	384:+CfMBcvlUImN2wHB2GQoRnZAm+rxcmvq00mGPeDXeDGeDkU:+CfMkwNE+ZA800mGmOhX
MD5:	6E91D98D348132A8BE01AE5D6E272B2C
SHA1:	DAFC30756CAD2CBBB969379D9752040954CDBE3F
SHA-256:	9AF972265BEC90D5402D6489A969B08F72FBCFA2DB1B76722B4FDF08D36EED99
SHA-512:	05DADFE3726C948DB9DA2626EC828D221A1DAFE4E3FA9BA936A88AC64AB7CD74D93FEE4AFE95F70ED6ED30BC72EF7EAFE6A2BA455A84EBC38F95DEA115B3A15C
Malicious:	false
Preview:	NETWORK-SERVICES-MIB DEFINITIONS ::= BEGIN....IMPORTS.. OBJECT-TYPE, Counter32, Gauge32, MODULE-IDENTITY, mib-2.. FROM SNMPv2-SMI.. TimeStamp, TEXTUAL-CONVENTION.. FROM SNMPv2-TC.. MODULE-COMPLIANCE, OBJECT-GROUP.. FROM SNMPv2-CONF.. SnmpAdminString.. FROM SNMP-FRAMEWORK-MIB;....application MODULE-IDENTITY.. LAST-UPDATED "200003030000Z".. ORGANIZATION "IETF Mail and Directory Management Working Group".... CONTACT-INFO.. " Ned Freed.... Postal: Innosoft International, Inc... 1050 Lakes Drive.. West Covina, CA 91790.. US.... Tel: +1 626 919 3600.. Fax: +1 626 919 3614.... E-Mail: ned.freed@innosoft.com".. DESCRIPTION.. "The MIB module describing network service applications".. REVISION "200003030000Z".. DESCRIPTION.. "This revision, published in RFC 2788, changes a number of.. DisplayStrings to SnmpAdminStrings. Note that this change..

C:\Program Files\pandora_agent\util\mibs\NOTIFICATION-LOG-MIB.txt

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	25505
Entropy (8bit):	4.859242291281773
Encrypted:	false
SSDEEP:	384:nYzsBrEGCWdD7iOMqPGGTdy0vsmnpP+DlLub:nYzs5EGCeD7/MeGKQ0vVnpP+DlLub
MD5:	D01122F476E946F4D54E4632A0DF0B77
SHA1:	69D663E17C71F5D5AE8F8763F792B2228E2D9705
SHA-256:	D8E34A4C400B10BF250D5015F7480C59F9086589A154F63CF74A8850D126E978
SHA-512:	5AE04515F8FCEC4BD1979CB9F1DE11C131FB2DAA6071E19CCAA022FDD32775B0920766C1B0392F5D421C0C1736812B9025F37B7B3E6B6A27C28FEF43E6575DBB
Malicious:	false
Preview:	NOTIFICATION-LOG-MIB DEFINITIONS ::= BEGIN....IMPORTS.. MODULE-IDENTITY, OBJECT-TYPE,.. Integer32, Unsigned32,.. TimeTicks, Counter32, Counter64,.. IpAddress, Opaque, mib-2 FROM SNMPv2-SMI.. TimeStamp, DateAndTime,.. StorageType, RowStatus,.. TAddress, TDomain FROM SNMPv2-TC.. SnmpAdminString, SnmpEngineID FROM SNMP-FRAMEWORK-MIB.. MODULE-COMPLIANCE, OBJECT-GROUP FROM SNMPv2-CONF;....notificationLogMIB MODULE-IDENTITY.. LAST-UPDATED "200011270000Z" -- 27 November 2000.. ORGANIZATION "IETF Distributed Management Working Group".. CONTACT-INFO "Ramanathan Kavasseri.. Cisco Systems, Inc... 170 West Tasman Drive,.. San Jose CA 95134-1706... Phone: +1 408 527 2446.. Email: ramk@cisco.com".. DESCRIPTION.. "The MIB module for logging SNMP Notifications, that is, Traps...... and Informs."..-- Revision History.... REVISION

C:\Program Files\pandora_agent\util\mibs\README.mibs

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2209
Entropy (8bit):	4.67653917297465
Encrypted:	false
SSDEEP:	48:7vfsHAgM2aOoIGGnE7z2evdBAyFb1ss7WZXwNfPRULzXYWmu:L0g9jXwmbgkfZoXYI
MD5:	93C9ECDB3366FDEBFB87C7ECC4342CF1
SHA1:	CCD952FEFE7DA5A4B6E9344E3A69ECF7BC863435
SHA-256:	BC2C82A6CCE8A866DB9F9C29206C1D439A91F70AB594BB48DF32A3A3DC311A4A
SHA-512:	5374386CAD87F9712A72340D3959F5150FA55400A029EF8DFFFA336640E23E2A46A4A89B5E099DBD9BE3D11B8B07E8F9DAC733E035E55A793AED3594D243E9AF
Malicious:	false
Preview:	About the MIBS distributed with Net-SNMP.....This directory contains a very basic set of MIB files, ready for use...In addition, there are some scripts and table files to help you get a..fuller collection of MIB files.....smistrip - a script that can extract a MIB file from an RFC (or I-D)..mibfetch - a script that will fetch an RFC file from a mirror, and extract...the hosted MIB from it. It assumes that you have wget installed...rfclist - a list of RFC numbers and corresponding MIB name(s)..ianalist - a list of files at the IANA server that holds IANA maintained...MIBs..Makefile.mib - rules for extracting current MIB files from RFC and IANA...files...rfcmibs.diff - a set of required patches for MIB files extracted from RFCs....The file Makefile.mib holds rules that fetch and extract MIB files from..their hosting RFCs. Make will use wget to retrieve the RFC files, and,..as I am located in Denmark, use the RFC mirror at NORDUnet. You may change..that at the top of Makefile.mib.....Make

C:\Program Files\pandora_agent\util\mibs\RFC-1215.txt

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1212
Entropy (8bit):	4.6916246802471315
Encrypted:	false
SSDEEP:	24:djUD8QeQZMm1EBBwegimIgd/lgyrw5YZ5NY2mHTXDzsHJ12ETmB32TF:Kfedm1EQegi2eyE5y5+nsnhTmB3WF
MD5:	725DE387B4E39A6F7294F691E0BA5F86
SHA1:	4045801262A657A4138465529DE01EA1F0598C30
SHA-256:	F900B6FC0FCE8C9ED85081C3620997CCF8FF74D86598A8E2EE346F8CB90FF4F6
SHA-512:	F68C588754F55399AF480500F40D3CF0D522ECF1CF6769F12A5330DB31BB80D2F2102F829CA86D502C72E5DEC387954125CCB585087C0C3D47B607F831DB6AD9
Malicious:	false
Preview:	..RFC-1215 DEFINITIONS ::= BEGIN....-- This module is a empty module. It has been created solely for the ..-- purpose of allowing other modules to correctly import the TRAP-TYPE ..-- clause from RFC-1215 where it should be imported from. It's a..-- built in type in the UCD-SNMP code, and in fact RFC-1215 doesn't..-- actually define a mib at all; it only defines macros. However,..-- importing the TRAP-TYPE is conventionally done from an import..-- clause pointing to RFC-1215...--..-- Wes 7/17/98....TRAP-TYPE MACRO ::=..BEGIN.. TYPE NOTATION ::= "ENTERPRISE" value.. (enterprise OBJECT IDENTIFIER).. VarPart.. DescrPart.. ReferPart.. VALUE NOTATION ::= value (VALUE INTEGER).. VarPart ::=.. "VARIABLES" "{" VarTypes "}".. \| empty.. VarTypes ::=.. VarType \| VarTypes "," VarType.. VarType ::=.. value (vartype ObjectName).. DescrPart

C:\Program Files\pandora_agent\util\mibs\RFC1155-SMI.txt

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3186
Entropy (8bit):	4.378911320395915
Encrypted:	false
SSDEEP:	96:O2sMaqQiwRsEcHXgOHXdx4vCI77v2ALRn:9sDVjJMXLXUAAVn
MD5:	ED912CF00F9731C866B74473C8FBFEF4
SHA1:	F28BC8753FDB0699884F97916D54592982AEC49B
SHA-256:	BAC4961D44BDA723D5307D491D61AF714D08C78A686A0ED7091EF862B9670677
SHA-512:	15B9CB694A4B5FE717C9E867EEA1BCBAC77472879BBEABC8428CEFF38E9BA5FD650B1C7EC8E95E405F86A3B896A32844841210BBA1AB18B89126F3AEEDB06810
Malicious:	false
Preview:	RFC1155-SMI DEFINITIONS ::= BEGIN....EXPORTS -- EVERYTHING.. internet, directory, mgmt,.. experimental, private, enterprises,.. OBJECT-TYPE, ObjectName, ObjectSyntax, SimpleSyntax,.. ApplicationSyntax, NetworkAddress, IpAddress,.. Counter, Gauge, TimeTicks, Opaque;.... -- the path to the root.... internet OBJECT IDENTIFIER ::= { iso org(3) dod(6) 1 }.... directory OBJECT IDENTIFIER ::= { internet 1 }.... mgmt OBJECT IDENTIFIER ::= { internet 2 }.... experimental OBJECT IDENTIFIER ::= { internet 3 }.... private OBJECT IDENTIFIER ::= { internet 4 }.. enterprises OBJECT IDENTIFIER ::= { private 1 }.... -- definition of object types.... OBJECT-TYPE MACRO ::=.. BEGIN.. TYPE NOTATION ::= "SYNTAX" type (TYPE ObjectSyntax).. "ACCESS" Access.. "STATUS" Status.. VALUE NOTATION ::= value (VALUE ObjectName).... Access ::= "read-only".. \| "read-write"..

C:\Program Files\pandora_agent\util\mibs\RFC1213-MIB.txt

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	82280
Entropy (8bit):	4.591495576375216
Encrypted:	false
SSDEEP:	768:VTg3ukHviySCgdWw4qVE3OpBDrTeaZdm+7Uwhv2u1ba8IpdiJylzlsUvBI:0vBjOpBDrpdm+7UFmF
MD5:	679E11BCE447A4FF4F554790038DF315
SHA1:	CFC5D8EA851E8D73D94F8588D0A8F2259300D5D3
SHA-256:	25817FC8C4A21C5AB56DF8CEAFC79761D41C3F770464C853A6EBE16EA8990B87
SHA-512:	F9DA290AC9AC33CA19FEC81C6BC901B1DB6E9B66162B355ED8270D46D704185A17E0B697BE784256B2C3EC07B9997DF5B60A17415408462F6A0ADF954BBA08E0
Malicious:	false
Preview:	RFC1213-MIB DEFINITIONS ::= BEGIN....IMPORTS.. mgmt, NetworkAddress, IpAddress, Counter, Gauge,.. TimeTicks.. FROM RFC1155-SMI.. OBJECT-TYPE.. FROM RFC-1212;....-- This MIB module uses the extended OBJECT-TYPE macro as..-- defined in [14];....-- MIB-II (same prefix as MIB-I)....mib-2 OBJECT IDENTIFIER ::= { mgmt 1 }....-- textual conventions....DisplayString ::=.. OCTET STRING..-- This data type is used to model textual information taken..-- from the NVT ASCII character set. By convention, objects..-- with this syntax are declared as having....--..-- SIZE (0..255)....PhysAddress ::=.. OCTET STRING..-- This data type is used to model media addresses. For many..-- types of media, this will be in a binary representation...-- For example, an ethernet address would be represented as..-- a string of 6 octets.....-- groups in MIB-II....system OBJECT IDENTIFIER ::= { mib-2 1 }....interfaces OBJECT IDENTIFIER ::

C:\Program Files\pandora_agent\util\mibs\RMON-MIB.txt

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	151802
Entropy (8bit):	4.648317006676539
Encrypted:	false
SSDEEP:	768:sKckUj/wAaz0XXos9QfFqM3TO2KTXwvbb1DhtyZRfOEitWIIOv:tA609QgUKTgvbb1N0ZEbXv
MD5:	73BF37EDD18290C8D8E2FED79C97892E
SHA1:	BE8DBC0CEC2D7C186F684726A65783FD5E18B4A9
SHA-256:	0B6055CD97547623D5EAA521FD94173CCE3B0E0F93987B8DEF727EFA4FBEC580
SHA-512:	F0947D2185750987A84B4E722C9A50864F39249F7E16A04EF8E28465369AB9A9083106B25DDF7ED52420318D681AB4672869E9D6CBFB418BEDC11438FD631F7B
Malicious:	false
Preview:	RMON-MIB DEFINITIONS ::= BEGIN.... IMPORTS.. MODULE-IDENTITY, OBJECT-TYPE, OBJECT-IDENTITY,.. NOTIFICATION-TYPE, mib-2, Counter32,.. Integer32, TimeTicks FROM SNMPv2-SMI.... TEXTUAL-CONVENTION, DisplayString FROM SNMPv2-TC.... MODULE-COMPLIANCE, OBJECT-GROUP,.. NOTIFICATION-GROUP FROM SNMPv2-CONF;....-- Remote Network Monitoring MIB....rmonMibModule MODULE-IDENTITY.. LAST-UPDATED "200005110000Z" -- 11 May, 2000.. ORGANIZATION "IETF RMON MIB Working Group".. CONTACT-INFO.. "Steve Waldbusser.. Phone: +1-650-948-6500.. Fax: +1-650-745-0671.. Email: waldbusser@nextbeacon.com".. DESCRIPTION.. "Remote network monitoring devices, often called.. monitors or probes, are instruments that exist for.. the purpose of managing a network. This MIB defines.. objects for managing remote network monitoring devices.".... REVISION "200005110000Z

C:\Program Files\pandora_agent\util\mibs\SMUX-MIB.txt

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4753
Entropy (8bit):	4.53150999994129
Encrypted:	false
SSDEEP:	48:irYFkO+SRf8RIM3j+AjmfBJNBVA6IzZe6xcqM33+AjmfBJNJL:dFkOGhc5BVZSZe6xcnw5JL
MD5:	543F1B75CBCB483907ADC7D4FA56C2F2
SHA1:	E20BEA1739A979287F80CD9ADDB2F3E22039A88C
SHA-256:	371C965D38543B48008D9D3D8720EF93C6B06E66FE28CC0C0CE243BCDC31089C
SHA-512:	05C65341886828CE11A66AC849D7EF10EF3272C16D2E7B31777A79B374BC95740F40ED4A792AC9AB2A99E8A664063562814823F1345DFDF3E2120EA391E0EC89
Malicious:	false
Preview:	SMUX-MIB DEFINITIONS ::= BEGIN....IMPORTS.. enterprises.. FROM RFC1155-SMI.. OBJECT-TYPE.. FROM RFC1212;....unix OBJECT IDENTIFIER ::= { enterprises 4 }....smux OBJECT IDENTIFIER ::= { unix 4 }....smuxPeerTable OBJECT-TYPE.. SYNTAX SEQUENCE OF SmuxPeerEntry.. ACCESS not-accessible.. STATUS mandatory.. DESCRIPTION.. "The SMUX peer table.".. ::= { smux 1 }....smuxPeerEntry OBJECT-TYPE.. SYNTAX SmuxPeerEntry.. ACCESS not-accessible.. STATUS mandatory.. DESCRIPTION.. "An entry in the SMUX peer table.".. INDEX { smuxPindex }.. ::= { smuxPeerTable 1}....SmuxPeerEntry ::=.. SEQUENCE {.. smuxPindex.. INTEGER,.. smuxPidentity.. OBJECT IDENTIFIER,.. smuxPdescription.. DisplayString,.. smuxPstatus.. INTEGER.. }....smuxPindex OBJECT-TYPE.. SYNTAX INT

C:\Program Files\pandora_agent\util\mibs\SNMP-COMMUNITY-MIB.txt

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	15919
Entropy (8bit):	4.704141866989306
Encrypted:	false
SSDEEP:	192:TbpsQBnMvnW+dAWor/vlOmxXvG39eGUW60AclKzWczia5cXj71GnaC9rkTdmPyzN:1uoTvk1zlKycea5cT78naC9rk4k
MD5:	AECAAA7181E17F9B203157842BA8A936
SHA1:	FC1193D5B2A25A6600927EC31D31B4C394702B77
SHA-256:	5938BDA85EA908082117A9B211FC233B8601BDD65CAE91327FB7DCAFEF19F1DE
SHA-512:	F75E7914E0A5A09D03DE1296A65F5BC471D6286C6F8538278047803AA3C8B0588A8A76FC57A28C5EFE79F29D4630CF57B4F9C552D6245C76AF5C650155441DD7
Malicious:	false
Preview:	SNMP-COMMUNITY-MIB DEFINITIONS ::= BEGIN....IMPORTS.. IpAddress,.. MODULE-IDENTITY,.. OBJECT-TYPE,.. Integer32,.. snmpModules.. FROM SNMPv2-SMI.. RowStatus,.. StorageType.. FROM SNMPv2-TC.. SnmpAdminString,.. SnmpEngineID.. FROM SNMP-FRAMEWORK-MIB.. SnmpTagValue,.. snmpTargetAddrEntry.. FROM SNMP-TARGET-MIB.. MODULE-COMPLIANCE,.. OBJECT-GROUP.. FROM SNMPv2-CONF;....snmpCommunityMIB MODULE-IDENTITY.. LAST-UPDATED "200003060000Z" -- 6 Mar 2000, midnight.. ORGANIZATION "SNMPv3 Working Group".. CONTACT-INFO "WG-email: snmpv3@lists.tislabs.com.. Subscribe: majordomo@lists.tislabs.com.. In msg body: subscribe snmpv3.... Chair: Russ Mundy.. TIS Labs at Network Associates.. Postal: 3060 Washington Rd.. Glenwood MD 21738.. USA.

C:\Program Files\pandora_agent\util\mibs\SNMP-FRAMEWORK-MIB.txt

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	22868
Entropy (8bit):	4.180558928203465
Encrypted:	false
SSDEEP:	192:8JNpeOWV10SkI09dGbqabXGU27PST9wb9PXVbnQuiGc/2M15JssRirMogzWUSEBU:WW0SkICdGbljv66qb5XV4pPbDaNVL
MD5:	B8DAFEF8DDC384E8CB759F2BE9AC7A6E
SHA1:	449DDF2B634FB564C0F7134C7F3F8E687B105BB0
SHA-256:	789DAF7E977A98E1783C24DA18F84619277F136A5B48A2674CC384023ADF1FDA
SHA-512:	C7731F100F161EB2E21E363336CDE533FDD4A1BC946206E4000C73879475D0CD1B3FF8A7B934B8955412AF7C39EA9F530E567E0819CBFF65E2412D266A140C7F
Malicious:	false
Preview:	SNMP-FRAMEWORK-MIB DEFINITIONS ::= BEGIN....IMPORTS.. MODULE-IDENTITY, OBJECT-TYPE,.. OBJECT-IDENTITY,.. snmpModules FROM SNMPv2-SMI.. TEXTUAL-CONVENTION FROM SNMPv2-TC.. MODULE-COMPLIANCE, OBJECT-GROUP FROM SNMPv2-CONF;....snmpFrameworkMIB MODULE-IDENTITY.. LAST-UPDATED "200210140000Z".. ORGANIZATION "SNMPv3 Working Group".. CONTACT-INFO "WG-EMail: snmpv3@lists.tislabs.com.. Subscribe: snmpv3-request@lists.tislabs.com.... Co-Chair: Russ Mundy.. Network Associates Laboratories.. postal: 15204 Omega Drive, Suite 300.. Rockville, MD 20850-4601.. USA.. EMail: mundy@tislabs.com.. phone: +1 301-947-7107.... Co-Chair &.. Co-editor: David Harrington.. Enterasys Network

C:\Program Files\pandora_agent\util\mibs\SNMP-MPD-MIB.txt

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5641
Entropy (8bit):	4.485071710159333
Encrypted:	false
SSDEEP:	96:ELyAeOvV10vVUjoX9UL0aLMEPRMbQ4wA5rK5ZM85GnGc1q3Y4sf:ELpeOvV10tUjoX+0ARZMEzgrCZMEQGc7
MD5:	3DA9E97A77EFD724537902B3CB5C5E20
SHA1:	D92C1EE613622B5E29E46E0682B530A828E234B4
SHA-256:	2740E273E158221082C39F1BF6B9279762CD45D0FEC5DB42F02C0856ADC0BDA9
SHA-512:	BB83D727048F2488E4D4917FAC38C787DFC7ECFBFE2F9235313E3BCDB1DA277FD1E9AB5FE2A08EE24EBF236EBFF3F8FA52E16F55B02663C22DB9125DF2191D54
Malicious:	false
Preview:	SNMP-MPD-MIB DEFINITIONS ::= BEGIN....IMPORTS.. MODULE-COMPLIANCE, OBJECT-GROUP FROM SNMPv2-CONF.. MODULE-IDENTITY, OBJECT-TYPE,.. snmpModules, Counter32 FROM SNMPv2-SMI;....snmpMPDMIB MODULE-IDENTITY.. LAST-UPDATED "200210140000Z".. ORGANIZATION "SNMPv3 Working Group".. CONTACT-INFO "WG-EMail: snmpv3@lists.tislabs.com.. Subscribe: snmpv3-request@lists.tislabs.com.... Co-Chair: Russ Mundy.. Network Associates Laboratories.. postal: 15204 Omega Drive, Suite 300.. Rockville, MD 20850-4601.. USA.... EMail: mundy@tislabs.com.. phone: +1 301-947-7107.... Co-Chair &.. Co-editor: David Harrington.. Enterasys Networks.. postal: 35 Industrial Way.. P. O

C:\Program Files\pandora_agent\util\mibs\SNMP-NOTIFICATION-MIB.txt

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	20603
Entropy (8bit):	4.69964201936874
Encrypted:	false
SSDEEP:	384:A+Ga2BLzfqgwAD7GTeL7OiymN3Z5QQpX8p8xqqs:ABtqgw5efQQpX++a
MD5:	517238BD0341827EFB4E7E3ED9FC83EF
SHA1:	A365D904CB7E9327FD38740822466B67DD1F277F
SHA-256:	6D3DDC70A544685ADA041B875C795DF2514AD0FBE833FCE94D6E450C9DBDBA6E
SHA-512:	1A5F210278F38792857E587C9204DFA43D7BAB7D1D3C7B1223B1D13141CCA5E3F28526BB872C68EBBC0853794F66B97BA84341C33F0DD5A50DDDB2BD5EFA33E1
Malicious:	false
Preview:	SNMP-NOTIFICATION-MIB DEFINITIONS ::= BEGIN....IMPORTS.. MODULE-IDENTITY,.. OBJECT-TYPE,.. snmpModules.. FROM SNMPv2-SMI.... RowStatus,.. StorageType.. FROM SNMPv2-TC.... SnmpAdminString.. FROM SNMP-FRAMEWORK-MIB.... SnmpTagValue,.. snmpTargetParamsName.. FROM SNMP-TARGET-MIB.... MODULE-COMPLIANCE,.. OBJECT-GROUP.. FROM SNMPv2-CONF;....snmpNotificationMIB MODULE-IDENTITY.. LAST-UPDATED "200210140000Z".. ORGANIZATION "IETF SNMPv3 Working Group".. CONTACT-INFO.. "WG-email: snmpv3@lists.tislabs.com.. Subscribe: majordomo@lists.tislabs.com.. In message body: subscribe snmpv3.... Co-Chair: Russ Mundy.. Network Associates Laboratories.. Postal: 15204 Omega Drive, Suite 300.. Rockville, MD 20850-4601.. USA.. EMail: mundy@tislabs.com.. Phone: +1 301-947-7107.... Co-Cha

C:\Program Files\pandora_agent\util\mibs\SNMP-PROXY-MIB.txt

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	9400
Entropy (8bit):	4.74639358384122
Encrypted:	false
SSDEEP:	192:dnz0O+DQHax0BLzznp/qHzua2XeaPY2jxjVETorv8QF:X+Ga2BLz4H0bAUVExK
MD5:	6F09A6427041D09307F9DEFB682EABEC
SHA1:	01E643941525CF80B4AA24928FA3A6AE33D02602
SHA-256:	DCA5F7EEC540DF1A6F9F09D40DDD16F10B1411A6C6935A7B9404963F16DE52F1
SHA-512:	478A282B7DB93D7C4BDEE17613B50AB633AFE3B17F1066582915174299FA1103EDD54315682042A7EE716114BBC30DD886C74205143AB8FF2EE2AC6EF92B957E
Malicious:	false
Preview:	SNMP-PROXY-MIB DEFINITIONS ::= BEGIN....IMPORTS.. MODULE-IDENTITY,.. OBJECT-TYPE,.. snmpModules.. FROM SNMPv2-SMI.... RowStatus,.. StorageType.. FROM SNMPv2-TC.... SnmpEngineID,.. SnmpAdminString.. FROM SNMP-FRAMEWORK-MIB.... SnmpTagValue.. FROM SNMP-TARGET-MIB.... MODULE-COMPLIANCE,.. OBJECT-GROUP.. FROM SNMPv2-CONF;....snmpProxyMIB MODULE-IDENTITY.. LAST-UPDATED "200210140000Z".. ORGANIZATION "IETF SNMPv3 Working Group".. CONTACT-INFO.. "WG-email: snmpv3@lists.tislabs.com.. Subscribe: majordomo@lists.tislabs.com.. In message body: subscribe snmpv3.... Co-Chair: Russ Mundy.. Network Associates Laboratories.. Postal: 15204 Omega Drive, Suite 300.. Rockville, MD 20850-4601.. USA.. EMail: mundy@tislabs.com.. Phone: +1 301-947-7107.... Co-Chair: David Harrington

C:\Program Files\pandora_agent\util\mibs\SNMP-TARGET-MIB.txt

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	23429
Entropy (8bit):	4.651915301830482
Encrypted:	false
SSDEEP:	192:oJz0O+DQHax0BOPu4q/4QpoY4fFQpk4jaeDrUT2YbeB7sqo5OKloAHKL2Y2IN2rp:a+Ga2BOFnWf4fFWk49DrFnZEOQ5Gs
MD5:	67EC17553A539DEBD54B532E5C03227C
SHA1:	80C065AFEC94A1ABFCCFDCF066D7D3632AC59FDA
SHA-256:	205CA244735D9EB927C1231515AD8447A91F43AFC6918349F50176284AF13C48
SHA-512:	2989DADB95867AA74A028F0118C0DF0E2982FA19901FBADD3A5DF387A511DDCAE695167E678AD1A5014F194759A8680D6B46B2A087B7762A63F05E48FA57B9A6
Malicious:	false
Preview:	SNMP-TARGET-MIB DEFINITIONS ::= BEGIN....IMPORTS.. MODULE-IDENTITY,.. OBJECT-TYPE,.. snmpModules,.. Counter32,.. Integer32.. FROM SNMPv2-SMI.... TEXTUAL-CONVENTION,.. TDomain,.. TAddress,.. TimeInterval,.. RowStatus,.. StorageType,.. TestAndIncr.. FROM SNMPv2-TC.... SnmpSecurityModel,.. SnmpMessageProcessingModel,.. SnmpSecurityLevel,.. SnmpAdminString.. FROM SNMP-FRAMEWORK-MIB.... MODULE-COMPLIANCE,.. OBJECT-GROUP.. FROM SNMPv2-CONF;....snmpTargetMIB MODULE-IDENTITY.. LAST-UPDATED "200210140000Z".. ORGANIZATION "IETF SNMPv3 Working Group".. CONTACT-INFO.. "WG-email: snmpv3@lists.tislabs.com.. Subscribe: majordomo@lists.tislabs.com.. In message body: subscribe snmpv3.... Co-Chair: Russ Mundy.. Network Associates Laboratories.. Postal: 15204 Omega Drive, Suite 300.. Rockville, MD 20850-4601..

C:\Program Files\pandora_agent\util\mibs\SNMP-USER-BASED-SM-MIB.txt

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	40113
Entropy (8bit):	4.329409003803699
Encrypted:	false
SSDEEP:	768:h6p3zfMzoTkIuuI08bi0VMqLAWRkknuNK:i31zlI08biWJkK
MD5:	6CF361FA1B4C8E2406C30AD42BBA9833
SHA1:	94EED38C64E25EB864955EE4D23582CB565CD12F
SHA-256:	EE6837C845C8D60D92CD0543E30BC012F2BA82A2DA5ABCAA7B6812C2FABAEE8D
SHA-512:	73142F9C3D467BDC65A381F648626A09818A2CFCAE643F0E363777128F0F4AA7269757B160218A4F540A1CF4DF762E868163F083420A3EEC68B87E97CFFF2D5A
Malicious:	false
Preview:	SNMP-USER-BASED-SM-MIB DEFINITIONS ::= BEGIN....IMPORTS.. MODULE-IDENTITY, OBJECT-TYPE,.. OBJECT-IDENTITY,.. snmpModules, Counter32 FROM SNMPv2-SMI.. TEXTUAL-CONVENTION, TestAndIncr,.. RowStatus, RowPointer,.. StorageType, AutonomousType FROM SNMPv2-TC.. MODULE-COMPLIANCE, OBJECT-GROUP FROM SNMPv2-CONF.. SnmpAdminString, SnmpEngineID,.. snmpAuthProtocols, snmpPrivProtocols FROM SNMP-FRAMEWORK-MIB;....snmpUsmMIB MODULE-IDENTITY.. LAST-UPDATED "200210160000Z" -- 16 Oct 2002, midnight.. ORGANIZATION "SNMPv3 Working Group".. CONTACT-INFO "WG-email: snmpv3@lists.tislabs.com.. Subscribe: majordomo@lists.tislabs.com.. In msg body: subscribe snmpv3.... Chair: Russ Mundy.. Network Associates Laboratories.. postal: 15204 Omega Drive, Suite 300.. Rockville, MD 20850-4601

C:\Program Files\pandora_agent\util\mibs\SNMP-USM-AES-MIB.txt

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2267
Entropy (8bit):	4.527920368353163
Encrypted:	false
SSDEEP:	48:+DDchBx6+0M7NVWTP9PLd6QtdRAybwooUSHSM:+vchH6+DZ4T6QOybwodm
MD5:	1F032E2031F631B9252E578E2588A20F
SHA1:	00F07B16314E6D9E88EDDFAEA7CECD0F2A9351DD
SHA-256:	BED1767309D094C9F4644467BE3FA6309D59A082BDAAEB5EEEEEFF3B05527A5D
SHA-512:	9BE35DEB262338162848D499CE57A1FE3492962F9D745C72BC374CCB23D8F7F4F9ECA65A8D6A7F11885C9D194F83C515A8792EBF65A435C8F939FA5695C9B73C
Malicious:	false
Preview:	SNMP-USM-AES-MIB DEFINITIONS ::= BEGIN.. IMPORTS.. MODULE-IDENTITY, OBJECT-IDENTITY,.. snmpModules FROM SNMPv2-SMI -- [RFC2578].. snmpPrivProtocols FROM SNMP-FRAMEWORK-MIB; -- [RFC3411]....snmpUsmAesMIB MODULE-IDENTITY.. LAST-UPDATED "200406140000Z".. ORGANIZATION "IETF".. CONTACT-INFO "Uri Blumenthal.. Lucent Technologies / Bell Labs.. 67 Whippany Rd... 14D-318.. Whippany, NJ 07981, USA.. 973-386-2163.. uri@bell-labs.com.... Fabio Maino.. Andiamo Systems, Inc... 375 East Tasman Drive.. San Jose, CA 95134, USA.. 408-853-7530.. fmaino@andiamo.com.... Keith McCloghrie.. Cisco Systems, Inc... 170 West Tasman Drive.. San Jose, CA 95134-1706, USA....

C:\Program Files\pandora_agent\util\mibs\SNMP-USM-DH-OBJECTS-MIB.txt

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	21643
Entropy (8bit):	4.863466003584518
Encrypted:	false
SSDEEP:	384:w6jX0qZf5TsstsTpI7nussHPbP4PKtPW8:rjkAf5Tssc3pTgW
MD5:	C25578F4CFB480B1901C923183839F44
SHA1:	FFFF931DA4464404467B4EE861236CEF1ABCC9A1
SHA-256:	1AC7924954F8BBAA4B3E4B8163A4365D2885991F9AA4D13A34603B33C07E5747
SHA-512:	E194CD3078C934FCE3D2F4B8BEAF6B1797D191864435B437869E861DFA130AB58E02FA5B11C9F6DB782A7B005C7230F5918EC3B35D5B8E474F26FD18867B4C7E
Malicious:	false
Preview:	SNMP-USM-DH-OBJECTS-MIB DEFINITIONS ::= BEGIN....IMPORTS.. MODULE-IDENTITY, OBJECT-TYPE,.. -- OBJECT-IDENTITY,.. experimental, Integer32.. FROM SNMPv2-SMI.. TEXTUAL-CONVENTION.. FROM SNMPv2-TC.. MODULE-COMPLIANCE, OBJECT-GROUP.. FROM SNMPv2-CONF.. usmUserEntry.. FROM SNMP-USER-BASED-SM-MIB.. SnmpAdminString.. FROM SNMP-FRAMEWORK-MIB;....snmpUsmDHObjectsMIB MODULE-IDENTITY.. LAST-UPDATED "200003060000Z" -- 6 March 2000, Midnight.. ORGANIZATION "Excite@Home".. CONTACT-INFO "Author: Mike StJohns.. Postal: Excite@Home.. 450 Broadway.. Redwood City, CA 94063.. Email: stjohns@corp.home.net.. Phone: +1-650-556-5368".... DESCRIPTION.. "The management information definitions for providing forward.. secrecy for key changes for the usmUserTable, and for providing a.. method for 'kickstarting' access to the agent vi

C:\Program Files\pandora_agent\util\mibs\SNMP-VIEW-BASED-ACM-MIB.txt

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	34992
Entropy (8bit):	4.408047697337799
Encrypted:	false
SSDEEP:	384:WOPSAA/l5htnZdCGHNR1JWMcVHFOClZ/QMJVVvT5g5GdlyCPj6VV03eK:WOVAtHdCGHN7YMmQCjQMJH75gfS6H0OK
MD5:	ADC8C65A8076B81C061934F1322480F8
SHA1:	5F29A2458010126EE48E65FCE297A7B458A18836
SHA-256:	86A73263497996532E68AF4DF60C8D5EFE9A36F480E7A21140596D5287963FEF
SHA-512:	F0F0267338C5EDFB5C683CB0D5C73C4E81EAE28FD85C1A534FF51F31D57A1C8A677175252B9772FCECBC092F04FFD9C4FF90CD2083510E6D7891B133F2A47169
Malicious:	false
Preview:	SNMP-VIEW-BASED-ACM-MIB DEFINITIONS ::= BEGIN....IMPORTS.. MODULE-COMPLIANCE, OBJECT-GROUP FROM SNMPv2-CONF.. MODULE-IDENTITY, OBJECT-TYPE,.. snmpModules FROM SNMPv2-SMI.. TestAndIncr,.. RowStatus, StorageType FROM SNMPv2-TC.. SnmpAdminString,.. SnmpSecurityLevel,.. SnmpSecurityModel FROM SNMP-FRAMEWORK-MIB;....snmpVacmMIB MODULE-IDENTITY.. LAST-UPDATED "200210160000Z" -- 16 Oct 2002, midnight.. ORGANIZATION "SNMPv3 Working Group".. CONTACT-INFO "WG-email: snmpv3@lists.tislabs.com.. Subscribe: majordomo@lists.tislabs.com.. In message body: subscribe snmpv3.... Co-Chair: Russ Mundy.. Network Associates Laboratories.. postal: 15204 Omega Drive, Suite 300.. Rockville, MD 20850-4601.. USA..

C:\Program Files\pandora_agent\util\mibs\SNMPv2-CONF.txt

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8585
Entropy (8bit):	4.071308844131724
Encrypted:	false
SSDEEP:	96:BM8UABZ49F8+0UZ4NGXmre8dVVoIz9AVuzgOGrgrRAenNz9AVuojndoUewm:3nM9S+0fo2re8EuzCErRAruox7ewm
MD5:	0B06190D90E169FB58292B383E85C30D
SHA1:	51DA77AB35FC7C2BA5FE023C4D16F1A6486E4611
SHA-256:	57BBCEF54A74D2EA467FC821E30F4769081504DCE157DEC1D8A41BE771D65983
SHA-512:	B4418C16E8EE0FFDFDDCD719405FD0881B1A398E8DB75045C63A9DA832005BA3AAD6CCAE51B2EBBBDCF21BBD4BD155A9BF35C8D22B4C521865BA6FEEF7D2BFD7
Malicious:	false
Preview:	SNMPv2-CONF DEFINITIONS ::= BEGIN....IMPORTS ObjectName, NotificationName, ObjectSyntax.. FROM SNMPv2-SMI;....-- definitions for conformance groups....OBJECT-GROUP MACRO ::=..BEGIN.. TYPE NOTATION ::=.. ObjectsPart.. "STATUS" Status.. "DESCRIPTION" Text.. ReferPart.... VALUE NOTATION ::=.. value(VALUE OBJECT IDENTIFIER).... ObjectsPart ::=.. "OBJECTS" "{" Objects "}".. Objects ::=.. Object.. \| Objects "," Object.. Object ::=.... value(ObjectName).... Status ::=.. "current".. \| "deprecated".. \| "obsolete".... ReferPart ::=.. "REFERENCE" Text.. \| empty.... -- a character string as defined in [2].. Text ::= value(IA5String)..END....-- more definitions for conformance groups....NOTIFICATION-G

C:\Program Files\pandora_agent\util\mibs\SNMPv2-MIB.txt

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	30159
Entropy (8bit):	4.706685041824469
Encrypted:	false
SSDEEP:	384:MP+sJ2Y10pwkDRa8Dfufp7n8YD4BlEcU+m41c:MPwM0pRda8Dfufp78YDwEcU+m4e
MD5:	F1382CD3AE375D57C0DA4FACD4A772A6
SHA1:	C991931B91C11C369600BA6D9EFA78526C6B1011
SHA-256:	07F239D8858E31165E22CFC29E9FB0A9919A642DC22ED0117EC19731A703FF1B
SHA-512:	0C88C62A60303104FBE67755D5D17779035C0748AD5D9424401BF6B69F4965E9614409A2D9430F2B29F9AAD71DF7A8E0CD2F518B0C295C146CC6C0C55F471695
Malicious:	false
Preview:	SNMPv2-MIB DEFINITIONS ::= BEGIN....IMPORTS.. MODULE-IDENTITY, OBJECT-TYPE, NOTIFICATION-TYPE,.. TimeTicks, Counter32, snmpModules, mib-2.. FROM SNMPv2-SMI.. DisplayString, TestAndIncr, TimeStamp.... FROM SNMPv2-TC.. MODULE-COMPLIANCE, OBJECT-GROUP, NOTIFICATION-GROUP.. FROM SNMPv2-CONF;....snmpMIB MODULE-IDENTITY.. LAST-UPDATED "200210160000Z".. ORGANIZATION "IETF SNMPv3 Working Group".. CONTACT-INFO.. "WG-EMail: snmpv3@lists.tislabs.com.. Subscribe: snmpv3-request@lists.tislabs.com.... Co-Chair: Russ Mundy.. Network Associates Laboratories.. postal: 15204 Omega Drive, Suite 300.. Rockville, MD 20850-4601.. USA.. EMail: mundy@tislabs.com.. phone: +1 301 947-7107.... Co-Chair: David Harrington.. Enterasys Networks.. postal: 35 Indus

C:\Program Files\pandora_agent\util\mibs\SNMPv2-SMI.txt

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	9268
Entropy (8bit):	4.637059109025311
Encrypted:	false
SSDEEP:	192:xgaWIcP6f3y+kbSTCNC37RGh9olTChiuTmoeKPSaPo:xBWoCSU7hioL3Q
MD5:	503EB55D4ED1352C69EE32699426DFF5
SHA1:	05B917507E1C359174B1D31DABED785E31F39593
SHA-256:	97816AEE70C1CD365F7487560F7D3925969F9A28B60CDAA4EFC1376FDBE2D38A
SHA-512:	4140A11110B0840E7989DE9F311473C062E7D85D2451B41C8061A0AA159556C634DFA5552AD25280BE1A9571F99BE412F444A98F3622F71C4DD6AFDD7889D1A6
Malicious:	false
Preview:	SNMPv2-SMI DEFINITIONS ::= BEGIN....-- the path to the root....org OBJECT IDENTIFIER ::= { iso 3 } -- "iso" = 1..dod OBJECT IDENTIFIER ::= { org 6 }..internet OBJECT IDENTIFIER ::= { dod 1 }....directory OBJECT IDENTIFIER ::= { internet 1 }....mgmt OBJECT IDENTIFIER ::= { internet 2 }..mib-2 OBJECT IDENTIFIER ::= { mgmt 1 }..transmission OBJECT IDENTIFIER ::= { mib-2 10 }....experimental OBJECT IDENTIFIER ::= { internet 3 }....private OBJECT IDENTIFIER ::= { internet 4 }..enterprises OBJECT IDENTIFIER ::= { private 1 }....security OBJECT IDENTIFIER ::= { internet 5 }....snmpV2 OBJECT IDENTIFIER ::= { internet 6 }....-- transport domains..snmpDomains OBJECT IDENTIFIER ::= { snmpV2 1 }....-- transport proxies..snmpProxys OBJECT IDENTIFIER ::= { snmpV2 2 }....-- module identities..snmpModules OBJECT IDENTIFIER ::= { snmpV2 3 }....-- Extended UTCTime, to allow dates with four-digit years..-- (Note t

C:\Program Files\pandora_agent\util\mibs\SNMPv2-TC.txt

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	38806
Entropy (8bit):	4.210804090324533
Encrypted:	false
SSDEEP:	768:8pi8FDF9djsUzEFrquLZDdkk0yHFrSCLZDMGHc7u5U:8ddjwVZHlH46u
MD5:	E02F8727805D92729F93DE2BFFCE917F
SHA1:	AD905E7F1C2F9515535E7B47917F6E71BF093029
SHA-256:	42A0DB2CB7E93DDF766B669E4CF1BEBF0F22BC1F18AF4DC2DB50FD57270E532C
SHA-512:	D813ECCB19E9733318114F59B21184CB1A96DD2E1116FD9C86F096602BF8876F8C3C3D2220231A984FD0FB3CAE384E05DFAE5C72C588649EDF4CF007397FF8C1
Malicious:	false
Preview:	SNMPv2-TC DEFINITIONS ::= BEGIN....IMPORTS.. TimeTicks FROM SNMPv2-SMI;....-- definition of textual conventions....TEXTUAL-CONVENTION MACRO ::=....BEGIN.. TYPE NOTATION ::=.. DisplayPart.. "STATUS" Status.. "DESCRIPTION" Text.. ReferPart.. "SYNTAX" Syntax.... VALUE NOTATION ::=.. value(VALUE Syntax) -- adapted ASN.1.... DisplayPart ::=.. "DISPLAY-HINT" Text.. \| empty.... Status ::=.. "current".. \| "deprecated".. \| "obsolete".... ReferPart ::=.. "REFERENCE" Text.. \| empty.... -- a character string as defined in [2].. Text ::= value(IA5String).... Syntax ::= -- Must be one of the following:.. -- a base type (or its refinement), or.. -- a BITS pseudo-type.. type..

C:\Program Files\pandora_agent\util\mibs\SNMPv2-TM.txt

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5951
Entropy (8bit):	4.564036185908307
Encrypted:	false
SSDEEP:	48:KTWZBxYA5Vbjm+SzQYrF2TVmNLyd9NeepxYL3RhML1G86ZLgPMFqdMFs8Pm6q8Mo:KQHYALO+4QYrF2TULnOq2JMDJ6mR
MD5:	BDB9510C0C05FBBB78D63C061680FDC7
SHA1:	4FD12E058AD63F41B4E178F22F9DD377BE4B982C
SHA-256:	1801ED28D368ADFF9CB8EF25683F6D03CA9B30378E0AB30A515D7CCA284D3C17
SHA-512:	D03B4812FE232BF9950A9FAD4E4596EC090E73A156CC7A57FA605AB8713A1C0FEB5754788F95A18B785AB8F7072968AA8533E949E6DCE5733236D70C8EDE99CC
Malicious:	false
Preview:	SNMPv2-TM DEFINITIONS ::= BEGIN....IMPORTS.. MODULE-IDENTITY, OBJECT-IDENTITY,.. snmpModules, snmpDomains, snmpProxys.. FROM SNMPv2-SMI.. TEXTUAL-CONVENTION.. FROM SNMPv2-TC;....snmpv2tm MODULE-IDENTITY.. LAST-UPDATED "200210160000Z".. ORGANIZATION "IETF SNMPv3 Working Group".. CONTACT-INFO.. "WG-EMail: snmpv3@lists.tislabs.com.. Subscribe: snmpv3-request@lists.tislabs.com.... Co-Chair: Russ Mundy.. Network Associates Laboratories.. postal: 15204 Omega Drive, Suite 300.. Rockville, MD 20850-4601.. USA.. EMail: mundy@tislabs.com.. phone: +1 301 947-7107.... Co-Chair: David Harrington.. Enterasys Networks.. postal: 35 Industrial Way.. P. O. Box 5005.. Rochester, NH 03866-5005..

C:\Program Files\pandora_agent\util\mibs\TCP-MIB.txt

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29349
Entropy (8bit):	4.574471290564408
Encrypted:	false
SSDEEP:	384:FEoO20bbYzCHdqEgcTxT+7hmyb+zyHnFhNB8HFA0PyHZ7JYqwb:FEtbYzCHdqEgcVC7hmytnFhUlzecqs
MD5:	F148B1B4FF2B1335D2CCFFC39B667707
SHA1:	1510E7F2323D7449D5FD029137377F30D680C49D
SHA-256:	19DDD9268F0297FC3BD35E124CFF6E0D38992752ED4072959150A82D8FC18D5A
SHA-512:	43292087575163DDBBA2CF9F259102A0E55FC2090E09633E23282B662A27184F779CE1462BC590836E6214D912F193866E14233BE2A69D30FC277DD071B5A4BE
Malicious:	false
Preview:	TCP-MIB DEFINITIONS ::= BEGIN....IMPORTS.. MODULE-IDENTITY, OBJECT-TYPE, Integer32, Unsigned32,.. Gauge32, Counter32, Counter64, IpAddress, mib-2.. FROM SNMPv2-SMI.. MODULE-COMPLIANCE, OBJECT-GROUP FROM SNMPv2-CONF.. InetAddress, InetAddressType,.. InetPortNumber FROM INET-ADDRESS-MIB;....tcpMIB MODULE-IDENTITY.. LAST-UPDATED "200502180000Z" -- 18 February 2005.. ORGANIZATION.. "IETF IPv6 MIB Revision Team.. http://www.ietf.org/html.charters/ipv6-charter.html".. CONTACT-INFO.. "Rajiv Raghunarayan (editor).... Cisco Systems Inc... 170 West Tasman Drive.. San Jose, CA 95134.... Phone: +1 408 853 9612.. Email: <raraghun@cisco.com>.... Send comments to <ipv6@ietf.org>".. DESCRIPTION.. "The MIB module for managing TCP implementations..... Copyright (C) The Internet Society (2005). This v

C:\Program Files\pandora_agent\util\mibs\TRANSPORT-ADDRESS-MIB.txt

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	16831
Entropy (8bit):	4.665842161338394
Encrypted:	false
SSDEEP:	192:nyz82TBS3+1SxBiRwykySv+1vurPCrgr+Iq8c9FCOEjCNNetXM1Q+QgXIvHLLX+:l9GZYt81FHGH3O
MD5:	7AB5E0346708DF798FB715C0AB979943
SHA1:	CEE303134DE3CB04F2236000D923544244661BA6
SHA-256:	597EA5CDD5DF800509918D1A1A179A40297452DACD04544322343291546EE3F7
SHA-512:	792C1882B7A84F2496F8B72DB65732DBFE4EACE57E249A9AFEB2B8097F5EAC3B9339B928DD64ED0FC4EB08D6A9F400B67E6CEB169C4B697090BF332409DC9646
Malicious:	false
Preview:	TRANSPORT-ADDRESS-MIB DEFINITIONS ::= BEGIN....IMPORTS.. MODULE-IDENTITY, OBJECT-IDENTITY, mib-2 FROM SNMPv2-SMI.. TEXTUAL-CONVENTION FROM SNMPv2-TC;....transportAddressMIB MODULE-IDENTITY.. LAST-UPDATED "200211010000Z".. ORGANIZATION.. "IETF Operations and Management Area".. CONTACT-INFO.. "Juergen Schoenwaelder (Editor).. TU Braunschweig.. Bueltenweg 74/75.. 38106 Braunschweig, Germany.. Phone: +49 531 391-3289.. EMail: schoenw@ibr.cs.tu-bs.de.... Send comments to <mibs@ops.ietf.org>.".. DESCRIPTION.. "This MIB module provides commonly used transport.. address definitions..... Copyright (C) The Internet Society (2002). This version of.. this MIB module is part of RFC 3419; see the RFC itself for.. full legal notices.".... -- Revision log.... REVISION "200211010000Z".. DESCRIPTION.. "Initial version, published as RFC 341

C:\Program Files\pandora_agent\util\mibs\TUNNEL-MIB.txt

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	13244
Entropy (8bit):	4.568252560746691
Encrypted:	false
SSDEEP:	192:L7cQdYUJep2qy+iISfwDr7VZwCbrroLIivcoQnYYCKygu/5EN7dHjkIUwS3:fJxcvPfhvLBPWI1E
MD5:	22A19F0F869F76F8A8B2F853FF5A41CE
SHA1:	F4B317A24EDD069734E31837489E16520040E202
SHA-256:	0173F565D3EEBCFFCBAF1202023F3F846FCE437F0C2870406974AC07A0838DD3
SHA-512:	53207BB65AA727E5F609654BEDAA596C2DC45751A123059BBE197806B5B78D734E89059CD825A21AEF9BFC677EFDC5347F7F789124A2CD480C54A7FE2D25E350
Malicious:	false
Preview:	TUNNEL-MIB DEFINITIONS ::= BEGIN....IMPORTS.. MODULE-IDENTITY, OBJECT-TYPE, transmission,.. Integer32, IpAddress FROM SNMPv2-SMI.. RowStatus FROM SNMPv2-TC.. MODULE-COMPLIANCE, OBJECT-GROUP FROM SNMPv2-CONF.. ifIndex, InterfaceIndexOrZero FROM IF-MIB;....tunnelMIB MODULE-IDENTITY.. LAST-UPDATED "9908241200Z" -- August 24, 1999.. ORGANIZATION "IETF Interfaces MIB Working Group".. CONTACT-INFO.. " Dave Thaler.. Microsoft Corporation.. One Microsoft Way.. Redmond, WA 98052-6399.. EMail: dthaler@dthaler.microsoft.com".. DESCRIPTION.. "The MIB module for management of IP Tunnels, independent of.. the specific encapsulation scheme in use.".. REVISION "9908241200Z" -- August 24, 1999.. DESCRIPTION.. "Initial version, published as RFC 2667.".. ::= { transmission 131 }....tunnelMIBObjects OBJECT IDENTIFIER ::= { tunnelMIB

C:\Program Files\pandora_agent\util\mibs\UCD-DEMO-MIB.inc

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	275
Entropy (8bit):	5.012485659256184
Encrypted:	false
SSDEEP:	6:HjK5AS3Fc15U4x9UAyK15jLG5IrrFIECZJKzcQyGf+CzrIRVu9:HJSyp9bFjLGeN5CqcQyGfFr2K
MD5:	F83DFF25C6426621EDB005A1EF9A531C
SHA1:	0B49A19B1B8ADEFF5AFE44F4461C7DF38FB36E42
SHA-256:	6B664F546C88F0709C8CB725D9EE047AD31B9B0C4AB3C31772E6CFA7592E5392
SHA-512:	346985291217A98BCF0993C937F492E1452E6A283947D9F556F59CC4C030BAF5AA4E849A9FBA82D19311C2C28CE4A810CC7651AAFF86AB4F318F556A61E37B19
Malicious:	false
Preview:	-- input include file for smicng.....#condInclude "SNMPv2-SMI.inc" -- SNMPv2-SMI (SNMPv2 SMI)..#condInclude "SNMPv2-TC.inc" -- SNMPv2-TC (SNMPv2 TC macro and base TCs)..#condInclude "UCD-SNMP-MIB.inc"....#pushOpt..#addOpt "CM"..#condInclude "UCD-DEMO-MIB.txt"..#popOpt....

C:\Program Files\pandora_agent\util\mibs\UCD-DEMO-MIB.txt

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2237
Entropy (8bit):	5.254618308254092
Encrypted:	false
SSDEEP:	24:tHjAGXuv36aw1z6QDj1GVbQr7KiGK48J8gCqESDKSYK9vKVgPxwv9KIMkK8bKLR8:tJj16QDjIVba6lq57YArwv9xN2XRfh4
MD5:	ED40E14BCCAC62CE7FACC141577B66E7
SHA1:	2D6A8942C6F408033C659045DCCB867C6A4D2721
SHA-256:	C3E2207331F525E1284B5D2ABD2942573BBC181436B887D9EF651E9E795062B2
SHA-512:	58C907986F854CCA5D7A5250AED243FF0AA7B3697C3CD4B3FF7C6045090817A2C8831276140B7B8584AF27D792B14B2D0E1C8AE35DA9164C243CE10504C2188A
Malicious:	false
Preview:	UCD-DEMO-MIB DEFINITIONS ::= BEGIN....IMPORTS.. MODULE-IDENTITY, OBJECT-TYPE, Integer32.FROM SNMPv2-SMI.. ucdavis.....FROM UCD-SNMP-MIB;....ucdDemoMIB MODULE-IDENTITY.. LAST-UPDATED "9912090000Z".. ORGANIZATION "University of California, Davis".. CONTACT-INFO..."This mib is no longer being maintained by the University of... California and is now in life-support-mode and being... maintained by the net-snmp project. The best place to write... for public questions about the net-snmp-coders mailing list... at net-snmp-coders@lists.sourceforge.net..... postal: Wes Hardaker.. P.O. Box 382.. Davis CA 95617.... email: net-snmp-coders@lists.sourceforge.net.. ".. DESCRIPTION..."The UCD-SNMP Demonstration MIB.".. REVISION. "9912090000Z".. DESCRIPTION..."SMIv2 version converted from older MIB definitions.".. ::= { ucdavis 14 }....ucdDemoMIBObjects OBJECT IDENTIFIER ::= { ucdDemoMIB 1 }....ucdDemoPublic OBJ

C:\Program Files\pandora_agent\util\mibs\UCD-DISKIO-MIB.inc

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	277
Entropy (8bit):	5.012181775821575
Encrypted:	false
SSDEEP:	6:HjK5AS3Fc15U4x9UAyK15jLG5IrrFIECZJKzcQyGf+CzRIRVu9:HJSyp9bFjLGeN5CqcQyGfFR2K
MD5:	2E33C0AEB8385BB88AF235DA6117A9E5
SHA1:	400928DCD581D66DF470BD587BB3285DBB52F4DE
SHA-256:	51A6A532FEBE61DB61200BAB7435764E67DF8330B1CC702FC00D85E065962CCB
SHA-512:	B11BC0DF22B705743F9A17C94BBAFAB444987EFC0EDCD342376940D71C8A6305EB014B7FE5FD3CC351DE1BD0968D6940ADE4D8F2B6C36C692696006B7D98A48C
Malicious:	false
Preview:	-- input include file for smicng.....#condInclude "SNMPv2-SMI.inc" -- SNMPv2-SMI (SNMPv2 SMI)..#condInclude "SNMPv2-TC.inc" -- SNMPv2-TC (SNMPv2 TC macro and base TCs)..#condInclude "UCD-SNMP-MIB.inc"....#pushOpt..#addOpt "CM"..#condInclude "UCD-DISKIO-MIB.txt"..#popOpt....

C:\Program Files\pandora_agent\util\mibs\UCD-DISKIO-MIB.txt

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4564
Entropy (8bit):	4.94119794918604
Encrypted:	false
SSDEEP:	48:QTl3pR+2tz16QD4ybuuMFunIUjVBSq0Jm8hJhHYJ1:G9bDtz1624/uMFYMq0JZZ6
MD5:	58A92AB5DE120F4ADDC3765F8110F948
SHA1:	D60C50767AF9788918252E1819A856696E31A533
SHA-256:	76EDD511187B0527849EB9E20C8B0BA9F2B09AA8533DAE80F425E981CCC8494E
SHA-512:	A1DDA47788A82CDCA6894C582B5B9028F116B51F806AE3201C331A956A4270155F9439939662A998FDD54348ACD26A8F7FFBF1EAE42FB41EC41CFAD9B5C2D1E0
Malicious:	false
Preview:	UCD-DISKIO-MIB DEFINITIONS ::= BEGIN....--..-- Derived from the original VEST-INTERNETT-MIB. Open issues:..--..-- (a) where to register this MIB?..-- (b) use not-accessible for diskIOIndex?..--......IMPORTS.. MODULE-IDENTITY, OBJECT-TYPE, Integer32, Counter32, Counter64.. FROM SNMPv2-SMI.. DisplayString.. FROM SNMPv2-TC.. ucdExperimental.. FROM UCD-SNMP-MIB;....ucdDiskIOMIB MODULE-IDENTITY.. LAST-UPDATED "200001260000Z".. ORGANIZATION "University of California, Davis".. CONTACT-INFO ..."This mib is no longer being maintained by the University of... California and is now in life-support-mode and being... maintained by the net-snmp project. The best place to write... for public questions about the net-snmp-coders mailing list... at net-snmp-coders@lists.sourceforge.net..... postal: Wes Hardaker.. P.O. Box 382.. Davis CA 95617.... email: net-snmp-coders@lists.sourceforge.net.. "..

C:\Program Files\pandora_agent\util\mibs\UCD-DLMOD-MIB.inc

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	237
Entropy (8bit):	4.973951899485554
Encrypted:	false
SSDEEP:	6:6sl15U4x9UAyK15jLG5IrrFIECZJKzcQyGf+CzXnGLVIRVuA:6Ip9bFjLGeN5CqcQyGfF3Gx2f
MD5:	5C0560D275354E7E4BC83568D4DE9BFA
SHA1:	217503D90ED1064A321F948DCD01C76913EF895E
SHA-256:	CFC05E54DA3353D230F6D9D11477A82EFC7DD286294CC5FB255FACD34FF00B9F
SHA-512:	08A9D6B6524F5745B3872B0C3445C2FE49E88DEBF027C5307DA79EF3B25CFEE35E3B4CECCE55B4592519ABE93BD52C597736E102B95AFB55F6AC2D72AC00BE0D
Malicious:	false
Preview:	#condInclude "SNMPv2-SMI.inc" -- SNMPv2-SMI (SNMPv2 SMI)..#condInclude "SNMPv2-TC.inc" -- SNMPv2-TC (SNMPv2 TC macro and base TCs)..#condInclude "UCD-SNMP-MIB.inc"....#pushOpt..#addOpt "CM"..#condInclude "UCD-DLMOD-MIB.txt"..#popOpt..

C:\Program Files\pandora_agent\util\mibs\UCD-DLMOD-MIB.txt

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3129
Entropy (8bit):	5.197737450541993
Encrypted:	false
SSDEEP:	48:Z+qxx034Hz16QDeCVbUZadlb6xreC/eDKhXdRVjz1kin:Z+Sy+z162eC2w36T2DaDVPq8
MD5:	39E5C398E690F410D461C8FE752C6D46
SHA1:	F04C0682E4AEBEA4C89358FAC4E4E8C53BE778F1
SHA-256:	EDDCA15A163DDC9DA5322E808428BDCAC02B2F5F7C1D9E3F3A508E1F9D80B7BD
SHA-512:	09CB32D298C6431620B975FDCADE3A20F720C8E22FC75CE55AEF198478A82539796FBA499EFDEF83C2A59476A2667AB38DC430AE9805D4CAA90A285852F0BF3C
Malicious:	false
Preview:	UCD-DLMOD-MIB DEFINITIONS ::= BEGIN....-- Why do we have dlmodNextIndex if the dlmodTable is read-write?..-- What exactly is the dlmodName and dlmodPath?..-- Should there not be a timestamp associated with dlmodError?..-- What exactly do the dlmodStatus enumerations mean?....IMPORTS.. OBJECT-TYPE, MODULE-IDENTITY, Integer32.FROM SNMPv2-SMI.. DisplayString....FROM SNMPv2-TC.. ucdExperimental....FROM UCD-SNMP-MIB;....ucdDlmodMIB MODULE-IDENTITY.. LAST-UPDATED "9912100000Z".. ORGANIZATION "University of California, Davis".. CONTACT-INFO ..."This mib is no longer being maintained by the University of... California and is now in life-support-mode and being... maintained by the net-snmp project. The best place to write... for public questions about the net-snmp-coders mailing list... at net-snmp-coders@lists.sourceforge.net..... postal: Wes Hardaker.. P.O. Box 382.. Davis CA 95617.... email: net-snmp-coders@lists

C:\Program Files\pandora_agent\util\mibs\UCD-IPFILTER-MIB.inc

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	240
Entropy (8bit):	5.015866580808246
Encrypted:	false
SSDEEP:	6:6sl15U4x9UAyK15jLG5IrrFIECZJKzcQyGf+CzDIRVuA:6Ip9bFjLGeN5CqcQyGfFD2f
MD5:	079E3BD6992A972DAC27DFB9465E7BE6
SHA1:	8B0C37120DAE3E3045B40E9E463D021CF6BD6922
SHA-256:	7CD6A7270169959D314F6E2F02DA9344A88782041ED54F4120E3D4598CAC229D
SHA-512:	5023AB809A5ED7637B61E4D6AD790778BCD4E2F19D2223C268C57C66AA55733017A1A274D2E00380599F3E2DD0DEE402214032771BEA427A06D8B49C7C76B6BD
Malicious:	false
Preview:	#condInclude "SNMPv2-SMI.inc" -- SNMPv2-SMI (SNMPv2 SMI)..#condInclude "SNMPv2-TC.inc" -- SNMPv2-TC (SNMPv2 TC macro and base TCs)..#condInclude "UCD-SNMP-MIB.inc"....#pushOpt..#addOpt "CM"..#condInclude "UCD-IPFILTER-MIB.txt"..#popOpt..

C:\Program Files\pandora_agent\util\mibs\UCD-IPFILTER-MIB.txt

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	6655
Entropy (8bit):	5.208511952965189
Encrypted:	false
SSDEEP:	96:i1bz162KaoTJEJW5jYSXYCgkpNJvA2qjlY4x05n1hJCcYCfxoYg+pQYOu0tyXFe:+bsXdTJJ5tgOi2KuL8F5BQFe
MD5:	B50A57B79159DB1DB84681B08BDBED1B
SHA1:	B5E89BD3600C55DFEFE48D39D86FA984B46322E3
SHA-256:	29E75F4059055674212FD2BEB8C3CB2B462D92611DC92F5C1AC7D83B133ECFBF
SHA-512:	148DEBA96C3EF6C61DFA169B7C3AFA8EF3D94EC80115011C745313494D3C9F209358D38455C0090DD1EB396EF84BEF1134F6A8F72DB1F926196013BFF8163ED8
Malicious:	false
Preview:	UCD-IPFILTER-MIB DEFINITIONS ::= BEGIN....IMPORTS.. OBJECT-TYPE, MODULE-IDENTITY, Counter32, Integer32...FROM SNMPv2-SMI.. ucdExperimental...FROM UCD-SNMP-MIB;....ucdIpFilter MODULE-IDENTITY.. LAST-UPDATED "9912150000Z".. ORGANIZATION "University of California, Davis".. CONTACT-INFO ..."This mib is no longer being maintained by the University of... California and is now in life-support-mode and being... maintained by the net-snmp project. The best place to write... for public questions about the net-snmp-coders mailing list... at net-snmp-coders@lists.sourceforge.net..... postal: Wes Hardaker.. P.O. Box 382.. Davis CA 95617.... email: net-snmp-coders@lists.sourceforge.net.. ".. DESCRIPTION..."This module defines MIB components for reading information ... from the IP Filter. This would let you only read its rules ... and counters..... IP Filter by Darren Reed <darrenr@pobox.com>.. IP F

C:\Program Files\pandora_agent\util\mibs\UCD-IPFWACC-MIB.inc

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	278
Entropy (8bit):	5.037323624935918
Encrypted:	false
SSDEEP:	6:HjK5AS3Fc15U4x9UAyK15jLG5IrrFIECZJKzcQyGf+CzFfIRVu9:HJSyp9bFjLGeN5CqcQyGfFFf2K
MD5:	C16A7DF90ECF0CE222F4936E7630CB2F
SHA1:	DDBBCDF5E3037FCF8E7940D4E99A9D80FAB470FC
SHA-256:	E83612284E8B7A4E88D169AC06989DB5550F008340762B9C284E9C87829E090F
SHA-512:	13F61BC22E5B4EF3057DBE8FA0F92D7EBB6B27AD51822B2FD47A45663E41562E9D82CEF6F3199EE7DEEEAD941D946FE4FFECC372AC3C2565FC2F1D842767365A
Malicious:	false
Preview:	-- input include file for smicng.....#condInclude "SNMPv2-SMI.inc" -- SNMPv2-SMI (SNMPv2 SMI)..#condInclude "SNMPv2-TC.inc" -- SNMPv2-TC (SNMPv2 TC macro and base TCs)..#condInclude "UCD-SNMP-MIB.inc"....#pushOpt..#addOpt "CM"..#condInclude "UCD-IPFWACC-MIB.txt"..#popOpt....

C:\Program Files\pandora_agent\util\mibs\UCD-IPFWACC-MIB.txt

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8445
Entropy (8bit):	5.180019111866859
Encrypted:	false
SSDEEP:	96:sTGsLz162Kb623+wE4js5y8rF7RwC7N5DLyV2Rm7rfIQ3Cr61NZV:bKsXb623+wsy8rF1wYjRcf1yQ
MD5:	46CD01277A905E60E42B29500BBD8D1A
SHA1:	ABEF44BE673C8DA9A6EBE2C9723FF95F3952A8A4
SHA-256:	345B50E98B00DE6A6994526F33CB33FFF3F7A9357984CD0E9BBF1C9496FEA72E
SHA-512:	22BF58015E33E664B1E4BBAD87B293A6608E79D3FB396109F100FF7B458410584F65988C3B4EEE3147E9719CD2FAAA6B55AF25F888AF84FBF9245836F6CAB2BF
Malicious:	false
Preview:	UCD-IPFWACC-MIB DEFINITIONS ::= BEGIN....IMPORTS.. OBJECT-TYPE, MODULE-IDENTITY, IpAddress, Integer32, Counter32...FROM SNMPv2-SMI.. DisplayString...FROM SNMPv2-TC.. ucdExperimental...FROM UCD-SNMP-MIB;....ucdIpFwAccMIB MODULE-IDENTITY.. LAST-UPDATED "9912160000Z".. ORGANIZATION "University of California, Davis".. CONTACT-INFO ..."This mib is no longer being maintained by the University of... California and is now in life-support-mode and being... maintained by the net-snmp project. The best place to write... for public questions about the net-snmp-coders mailing list... at net-snmp-coders@lists.sourceforge.net..... postal: Wes Hardaker.. P.O. Box 382.. Davis CA 95617.... email: net-snmp-coders@lists.sourceforge.net.. ".. DESCRIPTION..."This module defines MIB components for reading information.. from the accounting rules IP Firewall. This would typically.. let you read the rules a

C:\Program Files\pandora_agent\util\mibs\UCD-SNMP-MIB-OLD.txt

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	19018
Entropy (8bit):	5.1356892397895315
Encrypted:	false
SSDEEP:	384:+xy/NFmEqdFvjYJy/AF1JhdGY9xlUjWb7boVJIq8/Ln2nmz5V:ys/9xlUj0b2UV
MD5:	15D29165FBCDFD164BCC0D70CD516BB7
SHA1:	87BAD15CCBC91758A101B3FAEBD521BA4F405683
SHA-256:	ED0C5755A844421479058D51E1C4FC504FECD181229CE5C5AB24E1DED00F0C25
SHA-512:	CA0D3038D28D4EE3410FEC2AB0675260DFD96033E3AF2A5045ECF3C376E3C90CB5BDBA5E481EB9BA8E9273CACD65EC55F1CE079E8E8ACF83162045BBDC389531
Malicious:	false
Preview:	UCD-SNMP-MIB-OLD DEFINITIONS ::= BEGIN....--..-- This mib is a badly created mib which has been replaced by a more..-- properly created UCD-SNMP-MIB. Use that mib instead. This file..-- exists for historical purposes only and for use by people that..-- need to support both agent versions...--....IMPORTS...ucdavis... FROM UCD-SNMP-MIB.. OBJECT-TYPE ....... FROM SNMPv2-SMI...DisplayString ....... FROM SNMPv2-TC...Integer32.. FROM SNMPv2-SMI;....-- private. OBJECT IDENTIFIER ::= { internet 4 }..-- enterprises OBJECT IDENTIFIER ::= { private 1 }..-- ucdavis OBJECT IDENTIFIER ::= { enterprises 2021 }..-- processes OBJECT IDENTIFIER ::= { ucdavis 1 }..-- exec OBJECT IDENTIFIER ::= { ucdavis 3 }..-- memory OBJECT IDENTIFIER ::= { ucdavis 4 }..-- lockd OBJECT IDENTIFIER ::= { ucdavis 5 }..-- disk OBJECT IDENTIFIER ::= { ucdavis 6 }..-- load OBJECT IDENTIFIER ::= { ucdavis 7 }..-- version OB

C:\Program Files\pandora_agent\util\mibs\UCD-SNMP-MIB.inc

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	240
Entropy (8bit):	4.985194134753753
Encrypted:	false
SSDEEP:	6:HjK5AS3Fc15U4x9UAyK15jLG5IrrFIEC3KRf+CzcxIRVuA:HJSyp9bFjLGeN5C3KRfFcx2f
MD5:	3D9811A1E39EF81F3AD5AC48F4EDC6BA
SHA1:	F2172CFE20B2350F6941603DEF4E0C313C05F0CC
SHA-256:	0DB7F19C20D065B544C47E57E4ACF825072141E2BA1CE29455BDAB158949327A
SHA-512:	EA39821630CD70F8FF40011B9C531BECFB4E868A6CF208EFD7D359341B60507E3056FF336F1BB8EDF0C8DAC7533EF9CA3A8524A1D2E16557B00F0C9A00906B16
Malicious:	false
Preview:	-- input include file for smicng.....#condInclude "SNMPv2-SMI.inc" -- SNMPv2-SMI (SNMPv2 SMI)..#condInclude "SNMPv2-TC.inc" -- SNMPv2-TC (SNMPv2 TC macro and base TCs)....#pushOpt..#addOpt "CM"..#condInclude "UCD-SNMP-MIB.txt"..#popOpt..

C:\Program Files\pandora_agent\util\mibs\UCD-SNMP-MIB.txt

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	36651
Entropy (8bit):	5.1686237696388195
Encrypted:	false
SSDEEP:	768:a9C+qTZQQB0XPh9DPM3H0dN16Jw8UcnK0CazC5UBc:MCpVw9DPhy6Fk7c
MD5:	5D55496EF525DFDC3779E1D8F715FD88
SHA1:	BB98847EA02A34C48CD493FB03AD8F900516D08A
SHA-256:	AF5607DE2825C321B129D46DCAFA34F44ECB82023AF27518E3F9FE2C37A6EE73
SHA-512:	7F7F867FAB4322530A79C5E5F5C5650AA2442F7D38953633D4C320C02DBC2EDDA6C6DCDB22B655A13B0D3B17C59FDE5D785A89A982BD889574D1B896453FDBD9
Malicious:	false
Preview:	UCD-SNMP-MIB DEFINITIONS ::= BEGIN....-- Design notes:..--..-- The design of this mib may seem unusual in parts, as it was..-- designed for ease of numerical management routines...-- ..-- In that light, most sub-sections of this mib have four common..-- numerical oid consistencies:..--..-- 2021.ID.1 : an integer index value. In scalers, this is always..-- of value 1. In tables it is a row index...-- 2021.ID.2 : a name of the script, process, etc. that this row represents...-- 2021.ID.100 : An error flag indicating if an error is present on..-- that row (a threshold value was crossed, etc)...-- 2021.ID.101 : An error string describing why the error flag is non-0...--..-- These conventions enable managers to easy examine portions of the..-- mib by setting the ID to the sub-section they are interested in..-- monitoring, and then scanning the .100 value to check for an..-- error(s), and get a more specific error message from .101 for the..-- named check fo

C:\Program Files\pandora_agent\util\mibs\UDP-MIB.txt

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	21431
Entropy (8bit):	4.603937133146871
Encrypted:	false
SSDEEP:	384:r3NnxX6tg3od1Weo8I8b13PJtPvtC/dR1FG:r3NnxX6tg3oqY3T+g
MD5:	20D651515B215C85D0A23DAE092522D4
SHA1:	95B7DCAF64B21D12D1129A80A252A487A2BCADA9
SHA-256:	F1EEAA7B03F38F8C95DD1F6B23B3D04F71BE4C35E358E7629F3CFB36E9C989BB
SHA-512:	C17F233AD7E44C825CCF6803ECD311B66F3F91D4847C090DA5811DED5141DAC5A3FF73D7615EC24FF3B6D41559A71AA2564D1CCF83788B15CC7090D941A9F189
Malicious:	false
Preview:	UDP-MIB DEFINITIONS ::= BEGIN....IMPORTS.. MODULE-IDENTITY, OBJECT-TYPE, Integer32, Counter32, Counter64,.. Unsigned32, IpAddress, mib-2 FROM SNMPv2-SMI.. MODULE-COMPLIANCE, OBJECT-GROUP FROM SNMPv2-CONF.. InetAddress, InetAddressType,.. InetPortNumber FROM INET-ADDRESS-MIB;....udpMIB MODULE-IDENTITY.. LAST-UPDATED "200505200000Z" -- May 20, 2005.. ORGANIZATION.. "IETF IPv6 Working Group.. http://www.ietf.org/html.charters/ipv6-charter.html".. CONTACT-INFO.. "Bill Fenner (editor).... AT&T Labs -- Research.. 75 Willow Rd... Menlo Park, CA 94025.... Phone: +1 650 330-7893.. Email: <fenner@research.att.com>.... John Flick (editor).... Hewlett-Packard Company.. 8000 Foothills Blvd. M/S 5557.. Roseville, CA 95747.... Phone: +1 916 785 4018.. Email: <john.flick@hp.com>.... Send

C:\Program Files\pandora_agent\util\mibs\ianalist

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	421
Entropy (8bit):	5.069523008231174
Encrypted:	false
SSDEEP:	6:SDnb8Cvj/loRSTgy602XbxG5+XCYdGjV7xovuIlbt+IosnyZLRy14VM8DJfoVnn:i8sj/loigy60ubxi+XCYkWFbH0VpdCn
MD5:	43C2586B2291D0DA2E2E1E0CBEF97B7B
SHA1:	E7E5156732A86D2E36C2204A5C7F7F9431F74AE5
SHA-256:	23C44B98019A0AFA8E98B195A945589859AD902537BCD769604C16017302E567
SHA-512:	EF14B0EB954B6415B20D5153A457EFC7CD89ECE76D939DF74CB57805D6B8FF69DB8E47B91E4EB779E35F7244361838BE4C76D0D4BF8463C91640B98B407CF5E7
Malicious:	false
Preview:	# updated 2005-01-06..ianaiftype-mib...IANAifType-MIB..ianalanguage-mib..IANA-LANGUAGE-MIB..ianaaddressfamilynumbers-mib.IANA-ADDRESS-FAMILY-NUMBERS-MIB..ianaiprouteprotocol-mib..IANA-RTPROTO-MIB..ianatn3270etc-mib..IANATn3270eTC-MIB..ianamalloc-mib...IANA-MALLOC-MIB..ianacharset-mib...IANA-CHARSET-MIB..ianaprinter-mib...IANA-PRINTER-MIB..ianafinisher-mib..IANA-FINISHER-MIB..ianaitualarmtc-mib..IANA-ITU-ALARM-TC-MIB..

C:\Program Files\pandora_agent\util\mibs\makehtml.pl

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	Perl script text executable
Category:	dropped
Size (bytes):	2647
Entropy (8bit):	5.229283454799936
Encrypted:	false
SSDEEP:	48:d0mYuREUVwHk2EK5HjRkkRA5OvKvDWuOGD53tbABBCO5z+D8wgYQgHJyhiAmD8:d0L5tLxjRF9vEHOGJOBBv5zDeD8
MD5:	7626B7342F997805C495B4E1454726FE
SHA1:	4B1C3B6BE1D11EEC37FFC667A3870B3CD80F62AB
SHA-256:	4EC4559837B1D7DBA4A14A68C64EFCF41D92B6FC97126F2919ECCE6EC59FC871
SHA-512:	D03F5CE5FA64C3CA1EAA916590350601DE49CECA7F1EAEC79137D310C5E57EEE40A8E43043B39D0DE13352B49E09B9F6E159C5ABD2E4B8DA11092BA5C2DFF2BC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#!/usr/bin/perl....use SNMP;....use Getopt::Std;....%opts = ( M => ".",... D => "html");....getopts("M:D:WH:", \%opts) \|\| die "usage: makehtml.pl -W [-M MIBDIR] [-D OUTDIR] files > index.html";....$SNMP::save_descriptions = 1;....$ENV{'MIBDIRS'} = $opts{'M'};..$ENV{'SNMPCONFPATH'} = 'bogus';....if (-f "rfclist") {.. open(I,"rfclist");.. while (<I>) {...if (/^(\d+)\s+([-:\w]+)\s$/) {... my $mib = $2;... my $rfc = $1;... my @mibs = split(/:/,$mib);... foreach my $i (@mibs) {....$mibs{$i} = $rfc; ... }...}.. }.. close(I);..}....if (-f "nodemap") {.. open(I,"nodemap");.. while (<I>) {...if (/^([-\w]+)\s+(\w+)\s$/) {... $nodemap{$1} = $2;...}.. }.. close(I);..}....if ($opts{'W'}) {.. print '<p class="SectionTitle">..Net-SNMP Distributed MIBs..</p>....<p>The following are the MIB files distributed with Net-SNMP. Note that because they are distributed with Net-SNMP does not mean the agent implements them all. Another good place for finding other

C:\Program Files\pandora_agent\util\mibs\mibfetch

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	POSIX shell script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	1001
Entropy (8bit):	4.858268029207609
Encrypted:	false
SSDEEP:	24:dHPGBSZOGTyoMJCr48kU1QGF6++OCFnATDaYw1wvW9+:dHPGvJ248kU1ns+2AfM9+
MD5:	26300E108349EBD2A84C05D2C0262EA0
SHA1:	2FACC16D12F73217437F1B7F0ECB2D3B0547050E
SHA-256:	2994EA0EF22595DCB2113E33A0DB2CEFFA631DEE7DA50F0D4B68563E64E7F98B
SHA-512:	EA497DFF3CA843C22580031ECF7C63C32A0C46714409C723E01D3FF75DA41EE982C44321B81616191FE2CE1FDB915F71BCAEB25443328B0AC38EAF973AD5E47F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#!/bin/sh....# Usage: mibfetch [ -d outdir ] host directory rfc [mibs]..#..# If "rfc" contains a "." it is expected to be a complete file name,..# otherwise it is assumed to be just the rfc number...# If "mibs" is specified, it is a ":" separated list of mibs to extract,..# otherwise all mibs are extracted...#..# The script fetches the file from the givn directory on the given..# host, and then runs the file through smistrip to extract the mibs.....exact=0..verbose=....while getopts xvd: c..do.. case $c in.. d).mdir="-d $OPTARG".. .;;.. x).exact=1.. .;;.. v).verbose=-v.. .;;.. \?).exit 2.. .;;.. esac..done....shift `expr $OPTIND - 1`....set -e....host=$1..dir=$2..rfc=$3....if [ $exact = 0 -a `echo $rfc \| sed 's/\.//'` = $rfc ]; then.. file=rfc$rfc.txt..else.. file=$rfc..fi....if [ -n "$4" ]; then.. mibs="-m $4"..fi....# ncftpget -FV ftp://$host/$dir/$file..wget -O - -q -nv $host/$dir/$file \| \...tr -d \\r \| \..../smistrip $verbose -x .txt $mdir $mibs -.

C:\Program Files\pandora_agent\util\mibs\nodemap

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	110
Entropy (8bit):	4.693377700878361
Encrypted:	false
SSDEEP:	3:UAAS8fqnhrWMh2v29XPoBxsWo16fn:UlZ0lh2vM/oBx82n
MD5:	6E3A9614C90E3672F0313314820ED249
SHA1:	AC2B7320648AE4E113490A4DEBBFA564DCD92F87
SHA-256:	135B5DE9CA9F58C6F77B1011D2D196C8A52A0DE6D1225117C147466B8EBCD450
SHA-512:	30226E8B3C749E43B20EFD500E4D59F1290C07FAEC15B2370A9E7C340C7F67A8BFF442779FF7BA88A80B9C8B3767D497BA7F66A728337BFE7BAB4A53D92A5087
Malicious:	false
Preview:	EtherLike-MIB..dot3..HOST-RESOURCES-MIB.host..IP-MIB...ip..IF-MIB...interfaces..UDP-MIB...udp..TCP-MIB...tcp..

C:\Program Files\pandora_agent\util\mibs\rfclist

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4119
Entropy (8bit):	4.929545839132799
Encrypted:	false
SSDEEP:	96:ly/TgrJEq20+rA3w5wLPRwMh7zS+1TwEO6sfcTCN3eACRtFet:lyrgrJL++w5wznDTP1sfcTCNgRzet
MD5:	1F473B8772D452808E6660424889D068
SHA1:	1A532B9AD14343DA2A027D8461CBC44ECEED60B4
SHA-256:	0A080BACBD45031FCCD0957EB3AE82F5CC8FCD7619341746FB193551DEFCA35C
SHA-512:	932BE6605CB8D70C21425C983AE1AB8F48DDC6A3856E63169D0960380E33C10524C36BF4555972E068B6EBA05FD89165E4EBF03AE1169E00ACBF27447D84C15E
Malicious:	false
Preview:	# updated 2005-03-14..1155.RFC1155-SMI..1213.RFC1213-MIB..1227.SMUX-MIB..1238.CLNS-MIB..1381.RFC1381-MIB..1382.RFC1382-MIB..1414.RFC1414-MIB..1461.MIOX25-MIB..1471.PPP-LCP-MIB..1472.PPP-SEC-MIB..1473.PPP-IP-NCP-MIB..1474.PPP-BRIDGE-NCP-MIB..1512.FDDI-SMT73-MIB..1513.TOKEN-RING-RMON-MIB..1525.SOURCE-ROUTING-MIB..1559.DECNET-PHIV-MIB..1567.DSA-MIB..1611.DNS-SERVER-MIB..1612.DNS-RESOLVER-MIB..1628.UPS-MIB..1657.BGP4-MIB..1658.CHARACTER-MIB..1659.RS-232-MIB..1660.PARALLEL-MIB..1666.SNA-NAU-MIB..1694.SIP-MIB..1696.Modem-MIB..1697.RDBMS-MIB..1724.RIPv2-MIB..1742.APPLETALK-MIB..1747.SNA-SDLC-MIB..1748.TOKENRING-MIB..1749.TOKENRING-STATION-SR-MIB..1792.TCPIPX-MIB..1850.OSPF-MIB:OSPF-TRAP-MIB..2006.MIP-MIB..2020.DOT12-IF-MIB..2021.RMON2-MIB..2024.DLSW-MIB..2051.APPC-MIB..2108.SNMP-REPEATER-MIB..2115.FRAME-RELAY-DTE-MIB..2127.ISDN-MIB..2128.DIAL-CONTROL-MIB..2206.RSVP-MIB..2213.INTEGRATED-SERVICES-MIB..2214.INTEGRATED-SERVICES-GUARANTEED-MIB..2232.APPN-DLUR-MIB..2238.HPR-MIB..2266.DOT12-RPTR-MIB

C:\Program Files\pandora_agent\util\mibs\rfcmibs.diff

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	unified diff output, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	21515
Entropy (8bit):	4.976366118138985
Encrypted:	false
SSDEEP:	96:BD2zt2VQ2LA1qaOWjmBXSmkZDsiuFTLMk1CQbbmod1WPnU6p6nU6pwwGmenQfuyJ:BKzM41qajszO3c3O5nQfliUmAGqR1
MD5:	7237A2000168D729A0B46FBB386617A4
SHA1:	89959AE75DB6B5BF264A420FB6EF23B67D680DDF
SHA-256:	D95F55C9CEC3A341211C5FC6743921F465021C6DA95080A22123AD53399DB427
SHA-512:	D1D25F0B80C98CBC3BAD09A9C945D0D44CF690ECDB7852B2CB4FA4269D634E367D7B17FE573799DE508DA8DF66193B74EB358EB3F8C4785D2B84E945B280931B
Malicious:	false
Preview:	Only in /usr/local/share/snmp/rfc: .index..diff -ru /usr/local/share/snmp/rfc.orig/ADSL-LINE-MIB.txt /usr/local/share/snmp/rfc/ADSL-LINE-MIB.txt..--- /usr/local/share/snmp/rfc.orig/ADSL-LINE-MIB.txt.Sat Mar 3 17:27:00 2001..+++ /usr/local/share/snmp/rfc/ADSL-LINE-MIB.txt.Tue Jan 23 00:42:41 2001..@@ -3379,7 +3379,6 @@.. static profiles are implemented.".. .. OBJECT adslAtucConfMinSnrMgn..- MIN-ACCESS read-wr.. MIN-ACCESS read-write.. DESCRIPTION.. "Read-write access is applicable when..diff -ru /usr/local/share/snmp/rfc.orig/DLSW-MIB.txt /usr/local/share/snmp/rfc/DLSW-MIB.txt..--- /usr/local/share/snmp/rfc.orig/DLSW-MIB.txt.Sat Mar 3 17:18:28 2001..+++ /usr/local/share/snmp/rfc/DLSW-MIB.txt.Tue Jan 23 00:13:40 2001..@@ -7,7 +7,7 @@.. .. Counter32, Gauge32, TimeTicks,.. OBJECT-TYPE, MODULE-IDENTITY,..- NOTIFICATION-TYPE FROM SNMPv2-SMI..+ NOTIFICATION-TYPE, mib-2

C:\Program Files\pandora_agent\util\mibs\smistrip

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	POSIX shell script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	3848
Entropy (8bit):	5.168047024403546
Encrypted:	false
SSDEEP:	96:PA3ESb+2G2QU9tKYzZ10ePm2wOgN3HiqEKj1lQ5iv:iJf9tKG/mwgN3HiBK7h
MD5:	BF4EC212880DBC98D95C1FC57620E311
SHA1:	67309EBDDCB2C79FE0209B37A3A34C5E9603D01F
SHA-256:	FA1903625F62FAF92FFF921BF391D708352DD77F36DF19A62EE8C422C2A7995E
SHA-512:	19977703012CAE958874F49D653F53A4D8513AF978BF12E81D292FD15679ED12864F0186A728EE877961ADB98BF7D8F8609F07A8D80E4C4A2E833D369C99A238
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#!/bin/sh..#..# smistrip --..#..#.Extract MIB modules from text files, like RFCs or I-Ds...#..# This is variant of smistrip from libsmi-0.2, modified to be somewhat..# more aggressive in suppressing blank lines, and support the -x option...#..# Copyright (c) 1999 Frank Strauss, Technical University of Braunschweig...# Modified by Niels Baggesen..#..# See the file "COPYING" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#..# $Id: smistrip,v 5.3 2005/02/08 20:06:34 nba Exp $..#..# NOTE, that this script relies on awk (tested with GNU awk) and getopts..# (shell builtin like in bash or standalone)...#....AWK=awk..[ `uname` != SunOS ] \|\| AWK=/usr/bin/nawk..GETOPTS=getopts..VERSION=0.3-cvs......do_version () {.. echo "smistrip $VERSION"..}........do_usage () {.. echo "Usage: smistrip [-Vhn] [-d dir] [-s suffix] [-m modules] file ...".. echo "-V show version and license information".. echo "-v verbose".. ech

C:\Program Files\pandora_agent\util\moboinfo.vbs

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1402
Entropy (8bit):	5.26932800001929
Encrypted:	false
SSDEEP:	24:Wxv0Rk8Q8LUhz/Ar88mDv9UKRUGuxav0PBr6k0TX:WFOkZZwHmDvacjc5r6kK
MD5:	C71F98F344B76D8C1BE38B795329545D
SHA1:	5847C338E8C92EABC3D235D7A4C86C36E3A38643
SHA-256:	42458D745C46368C2A41EB617C53D81ACD7A61D9887C8238594CA9478156761D
SHA-512:	6A34C575A33259E26F8F713D2F53F738E8E265114E8F2CA4812802B122D3B54A7B9C22196090BD2FF573996B94CD4D57A6BF9DA08866092CEBD1033B4CF1DA12
Malicious:	false
Preview:	' Pandora FMS Agent Inventory Plugin for Microsoft Windows (All platfforms)..' (c) 2015 Borja Sanchez <fborja.sanchez@artica.es>..' This plugin extends agent inventory feature. Only enterprise version..' --------------------------------------------------------------------------..'WMI mobo info....strComputer = "."..Set objWMIService = GetObject("winmgmts:" & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")..'Set colMobos = objWMIService.ExecQuery("Select name,product,manufacturer from Win32_baseboard")..Set colMobos2 = objWMIService.ExecQuery("Select manufacturer,model,OEMStringArray from Win32_computersystem")....on error resume next..flag = colItems.Count..If (err.number <> 0) Then.. flag = true..Else.. flag = false..End If..on error goto 0 ....'Print only when there's results..If (NOT flag) Then...Wscript.StdOut.WriteLine "<inventory>"...Wscript.StdOut.WriteLine "<inventory_module>"...Wscript.StdOut.WriteLine "<name>Motherboard</name>"...Wscript.StdOut.WriteLin

C:\Program Files\pandora_agent\util\monitors.vbs

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1348
Entropy (8bit):	5.2402056112862185
Encrypted:	false
SSDEEP:	24:Wxv0Rk8Q8W2Uhz/ArUB2+gtqsLyDv9UKRUVxav03TTV1/3lV1utTX:WFOk1DZwq+tqsWDvaYcDQ1
MD5:	2F50C78B60B3167EF34B6DCDDB758101
SHA1:	2BB9F115E22BA4E39FE1A977985909736150EE20
SHA-256:	0660172F85545EBF41DFFBEAD210401074208CA0939B1B40982212F8F7120EC2
SHA-512:	4374996065CDE6E54DCF84EE8846764DE0458411F070AF5E61FCEAE432BA959D012D09450B533380C7750E2090F029E5F76A5FCD764A5DED056F67E18BD24018
Malicious:	false
Preview:	' Pandora FMS Agent Inventory Plugin for Microsoft Windows (All platfforms)..' (c) 2015 Borja Sanchez <fborja.sanchez@artica.es>..' This plugin extends agent inventory feature. Only enterprise version..' --------------------------------------------------------------------------..'WMI monitorsinfo....strComputer = "."..Set objWMIService = GetObject("winmgmts:" & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")..Set colDisplays = objWMIService.ExecQuery("Select caption,pnpdeviceid from win32_desktopmonitor")....on error resume next..flag = colDisplays.Count..If (err.number <> 0) Then.. flag = true..Else.. flag = false..End If..on error goto 0 ....'Print only when there's results..If (NOT flag) Then...Wscript.StdOut.WriteLine "<inventory>"...Wscript.StdOut.WriteLine "<inventory_module>"...Wscript.StdOut.WriteLine "<name>Monitors</name>"...Wscript.StdOut.WriteLine "<type><![CDATA[generic_data_string </type>"...Wscript.StdOut.WriteLine "<datalist>".....For Each displ

C:\Program Files\pandora_agent\util\network.vbs

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1103
Entropy (8bit):	5.093197784678948
Encrypted:	false
SSDEEP:	24:2QmVuAx8SQz5LC+qAuDIYcc7BpLUfKY8M84:AoAxzQz5LC+q7cSDUfKNG
MD5:	C68D28346571D388FD7DC1A1C8FB882E
SHA1:	388E24191C799CF2630CE8FD6FB013E3EA264571
SHA-256:	D935B74E8E1F3D44C7268916CD70866C46516129ED5B048CC49B8521DA431574
SHA-512:	A82062C5DE34628C53D1D43E261BAE8D03EF7AD9DD0E12AFA6AC7D5DA470219FA7A2FC528CB96823A814BB9454390B308CF28CFA15857B12E75A1C936B460EF9
Malicious:	false
Preview:	' Agent Plugin to get detailed network information per network interface.' Execute as module_plugin cscript //B network.vbs..Option Explicit..Dim colAdapters, objAdapter, NicDescription, strFileName, objFS, objTS, colAdapters2, objAdapter2..Dim totalNetworkUsage..totalNetworkUsage=0..Set colAdapters2 = GetObject("winmgmts:{impersonationLevel=impersonate}").ExecQuery("SELECT * FROM Win32_PerfRawData_Tcpip_NetworkInterface WHERE Name != 'isatap.localdomain'").For Each objAdapter2 in colAdapters2 ..totalNetworkUsage = totalNetworkUsage + objAdapter2.BytesTotalPersec.Next . . Wscript.StdOut.WriteLine "<module>"..Wscript.StdOut.WriteLine " <name>Network_Usage_Bytes</name>"..Wscript.StdOut.WriteLine " <description>Total bytes/sec transfered in this system</description>"..Wscript.StdOut.WriteLine " <type>generic_data_inc</type>"..Wscript.StdOut.WriteLine " <data>" & totalNetworkUsage & "</data>"..Wscript.StdOut.WriteLine " <unit>bytes/sec</unit>"..Wscript.StdOut.Write

C:\Program Files\pandora_agent\util\omnishell_client.exe

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	PE32+ executable (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	16557020
Entropy (8bit):	7.5088332074370365
Encrypted:	false
SSDEEP:	196608:jFBTFFMYS7vuj70BSqRi8FfxCnlKk6fV1UY2Ox/ifaBlA89oIAI0fOITOv:vTFDS7mH09jJsl4Lx6farA8+W0fOn
MD5:	891092A6F1C5FD063EF82A9FD33A3A38
SHA1:	6BA3F4856D1688889316FB6E708A74DE9679CB28
SHA-256:	AD4D006CF2662A57F2E062B5ADBFE8702D2147EC4C4D3DC9A1019938FE7D5B22
SHA-512:	37D750C3F7D215C95781D4B0A5F7113BC6482BF77EE2A55975FEFF77C5677BD22F2B7E2069B794C916A89E4752EC931C04017CA39A5C0CE5E80F8C50D84A181F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....xd........../.... .....VK...............@..............................PL......K....... ...............................................K...... L.h&...0K..............................................#K.(...................h.K..............................text..............................`.P`.data....`J......bJ.................@.`..rdata..P.... K.......K.............@.`@.pdata.......0K.......K.............@.0@.xdata.......@K.......K.............@.0@.bss.........PK.......................`..idata........K...... K.............@.0..CRT....h.....L.......K.............@.@..tls..........L......0K.............@.@..rsrc...h&... L..(...2K.............@.0.................................................................................................................................................................................................................

C:\Program Files\pandora_agent\util\osversion.vbs

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1207
Entropy (8bit):	5.227567094091267
Encrypted:	false
SSDEEP:	24:Wxv0Rk8Q8CUhz/ArAFIfPDv9UKRUgxav0Y9CVJT2:WFOkwZwAWfPDvavcbVs
MD5:	37D0905BF8B7250E92254BC5FF1A2461
SHA1:	710D94B929C2E3994CBDBA914B33E4D33F4F8B02
SHA-256:	D8371011F50EAF1FF0EF0D60E70B812971858E9FC7B64D6ACA8DAD073862309D
SHA-512:	1C637B530C2A4BFA46AF2395FC4F9AE5CB73EBB4096A23EFA466F52420AC0303E7A51FAD7BD91E12AD54F02D4CE057F318AD79B349D46FF5DF65D61934634E46
Malicious:	false
Preview:	' Pandora FMS Agent Inventory Plugin for Microsoft Windows (All platfforms)..' (c) 2015 Borja Sanchez <fborja.sanchez@artica.es>..' This plugin extends agent inventory feature. Only enterprise version..' --------------------------------------------------------------------------..'WMI OS version....strComputer = "."..Set objWMIService = GetObject("winmgmts:" & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")..Set cols = objWMIService.ExecQuery("SELECT version from win32_operatingsystem")....on error resume next..flag = cols.Count..If (err.number <> 0) Then.. flag = true..Else.. flag = false..End If..on error goto 0 ....'Print only when there's results..If (NOT flag) Then...Wscript.StdOut.WriteLine "<inventory>"...Wscript.StdOut.WriteLine "<inventory_module>"...Wscript.StdOut.WriteLine "<name>OSVersion</name>"...Wscript.StdOut.WriteLine "<type><![CDATA[generic_data_string </type>"...Wscript.StdOut.WriteLine "<datalist>".....For Each data In cols... Wscript.StdOut

C:\Program Files\pandora_agent\util\pandora_agent_exec.exe

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4780642
Entropy (8bit):	7.9878095255475765
Encrypted:	false
SSDEEP:	98304:mY8BC/IgyJxB6IREAyhCTJdpHpceg2EQgY/iwYHFxBDTRdR7VJqcVk+Qw:XyCAgyc23p2lxdTYc
MD5:	C586E2E13D4AB81AA11B9438E4E0012D
SHA1:	BA0912109EB64821CBB73D0C128D75C80992BA21
SHA-256:	B5C954A39865A1DF484C752AD0B050F3B160EC35CA39DB390F8D05E0645D8C80
SHA-512:	4F873ECDC86393CAC796194A4FDA5598DFAE593588405523A49A9510F48AE483477C78A98D44FEF4614891BE83A0B1AECA26E0DB650825531AFB7BA45E0175AA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............T...T...T...U..T...U<..T...U..T}..T...T}..U..T}..U..T}..U..T...U...T...T...Ts..U..Ts..U...TRich...T................PE..L...{.cc.........."....!.N..........p........`....@..........................`......[KI...@.................................$1..<....`.......................@..p...p!............................... ..@............`...............................text....M.......N.................. ..`.rdata..l....`.......R..............@..@.data........@......................@....reloc..p....@.......:..............@..B.rsrc........`.......X..............@..@........................................................................................................................................................................................................................................................................................................

C:\Program Files\pandora_agent\util\pandora_hardening.exe

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4859595
Entropy (8bit):	7.987737028938873
Encrypted:	false
SSDEEP:	98304:FtXE8LqzT6/IgyJxB6IREAPpHpceg2EQgY/iwYHFxBDTRNVuqjtQ0pntcRCo:o+a+Agyc2Pp2lxd1TjVm
MD5:	CF9BDCE023A2CAE6E819B3430E589F14
SHA1:	8E8E542BC5D2482247BB5F17806B3AD9BAA1D174
SHA-256:	520619D823DD5396CC90DE59E745D9AB3872D25D85358C9ABB4890987B5F5426
SHA-512:	EF79067606BB928B9297CBC79732BA001B71A1E34A758A244D988BCF27CB4C7FCD59A73CD082D0F7662280DF91C2ACBB249708A5D4450A5CF3C4878A25D945B6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 13%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........c...c...c......c.....Yc......c...._..c.......c.......c.......c......c...c..c......c......c..Rich.c..........PE..L...V~.e.........."....%.d........................@.................................O.J...@..................................P..P....................................A...............................@..@............................................text....c.......d.................. ..`.rdata...............h..............@..@.data...D(...`.......D..............@....reloc........... ...P..............@..B.rsrc................p..............@..@................................................................................................................................................................................................................................................................................................................

C:\Program Files\pandora_agent\util\pandora_revent.exe

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4411482
Entropy (8bit):	7.990943019976054
Encrypted:	true
SSDEEP:	98304:pjO8qNABexKwmeS2kjD0EwtxRzQU93GC6GdYmG73:k8qNABexKw+1hkzfGOYmo3
MD5:	AFD42E3F57F210E0DF11CF42F21C9399
SHA1:	156C75B179814FB66A0EC6B05574BB7D287DC0C9
SHA-256:	1C26EEF4BE3D59C81EE6A89D3E4A44BC665610AD1ADD34A203BC29DA8D653E69
SHA-512:	30ECB3EE49642BDC32C93878FFD5B02AF95279052EEED9F42990B64D0DF6BFB7ADE1CA02DF8B942F763BE90B443857F04A815B5CC6634F7E2F9FE30052F989B1
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......d.5. .[. .[. .[.U.$.[.O.Q.+.[.O._.".[. .Z.N.[.B.H.&.[.[.W.,.[. .[.$.[.&.Q./.[..].!.[.Rich .[.........PE..L....,YL......................B.....J.............@..........................PC......qC.........................................x.......@IB..........................................................................................................text...P........................... ..`.rdata..X........ ..................@..@.data............ ..................@....rsrc...@IB......PB.................@..@........................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\pandora_agent\util\pandora_security_win.conf

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	266
Entropy (8bit):	4.397153248281428
Encrypted:	false
SSDEEP:	6:ppFdklQ+SpFdszMpDpFszKm4HpSpFsz5pFFMG4SpFF605:p1klQ+S1szMZypipSy5dMG4Sd3
MD5:	6439F7133C16D39683E7FF7B8B62A05B
SHA1:	0350EB60B58BB4FF0E0027FBA77CCD089DE7C556
SHA-256:	F298F6C812CEE5203B34D3E39066C41DDF6B59C0B034890DFDA33AF373942392
SHA-512:	F7CB1107E009E52D570414FCE9FB69C329EB51FD600CDFD389763E16E9DC1BB6BD003756B0256A15E9E44F56C28787C9837D858F9D91EFBC9748AB93CB6748FE
Malicious:	false
Preview:	auditpol_logon_category = Logon.#auditpol_logon_category = Inicio de sesi.n..auditpol_logon_success_conf = Success and Failure.#auditpol_logon_success_conf = Aciertos y errores..auditpol_logon_noaudit_conf = No Auditing.#auditpol_logon_noaudit_conf = Sin auditor.a

C:\Program Files\pandora_agent\util\pandora_security_win.exe

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	7735667
Entropy (8bit):	7.993362041248269
Encrypted:	true
SSDEEP:	196608:TR+sbcUdUnYc0o5Gd7+Tza+Agyc2sp2vfxdSeTxo7G:5bPmYRQK7+Tza+As2Y+ZNxo
MD5:	0CDB81A93D8ACC37CAC5AB989B167A0D
SHA1:	1E700C9CE281F1550B1DFB42E1256D678FEC53A4
SHA-256:	293DC77D39C303793A73BF83A2698C5886331F24B8ABED4A40566474A64E3F60
SHA-512:	26571EAF281051123A983571BD6B77F22F493A659E1440BFC5681001CA738BFB5B35BEF0F44AA780AC1AE80E60B1BE7B128482CC26C380E8A1CEC993157441EF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 11%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........dAL../.../.../..},.../..}.../..}+.../......./....../...+.../...,.../..}..../......./..+.../..-.../.Rich../.........PE..L....3.f.........."....&.f.......................@.................................8.v...@..................................P..P....................................A...............................@..@............................................text....e.......f.................. ..`.rdata...............j..............@..@.data....(...`.......F..............@....reloc........... ...R..............@..B.rsrc................r..............@..@................................................................................................................................................................................................................................................................................................................

C:\Program Files\pandora_agent\util\pandora_update.exe

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1290330
Entropy (8bit):	7.968447648495047
Encrypted:	false
SSDEEP:	24576:pzFCWDxWMLhBG29DBrHVS2bySXrxwLCa0QIprtlkBbRAgUHLhNwUUycr:pzBlWMWgDB7VTmdLCvXRMRAzhGpJr
MD5:	054DE53F006DF040515328FDC3F201A7
SHA1:	FAC30CB84C35EAADA82E73D191EE6E1F65EE6C2F
SHA-256:	815117B7FA89060961E5132BD73CF94AEF47D1F704AEF7A8E6E9DDFBCB193A5D
SHA-512:	354C8395A8828742F93F778AEED384AE5A0C554258D5E0B8BE1DF58CDB35FE679F352B1283C677B8E98AC6900F63EEA7D19D9CF99685E3D55F04EB9D21F6845E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......d.5. .[. .[. .[.U.$.[.O.Q.+.[.O._.".[. .Z.N.[.B.H.&.[.[.W.,.[. .[.$.[.&.Q./.[..].!.[.Rich .[.........PE..L....,YL............................J.............@.................................wE..........................................x....................................................................................................................text...P........................... ..`.rdata..X........ ..................@..@.data............ ..................@....rsrc...............................@..@........................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\pandora_agent\util\printers.vbs

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2390
Entropy (8bit):	5.234251766006443
Encrypted:	false
SSDEEP:	48:WFOkIpI5cI0f9w7DvaScraLB92AYfjGho7acOuyxAp81:Wsk/cjODCvSBcAjhaU
MD5:	5C5CDEA9EC4B247B200E81DFC6880AEB
SHA1:	FF22F48C0B5F9CB043F8746C99DFA96A8B01A6ED
SHA-256:	505273AE2F86FB7664D0A9049480FAB6038CDBF6E1D09991A10B2C9B9C77AF21
SHA-512:	4C73714BE7C6B1CC7534E7BCC26A68621E4FA3889AB4FCED8FD9741715A675D89F04BB53AE034554B9FE230BC03D1AAB2AB46D031B6CDA4A9B08BEA4CB59694F
Malicious:	false
Preview:	' Pandora FMS Agent Inventory Plugin for Microsoft Windows (All platfforms)..' (c) 2015 Borja Sanchez <fborja.sanchez@artica.es>..' This plugin extends agent inventory feature. Only enterprise version..' --------------------------------------------------------------------------..'WMI printers attached....function validPort(port)...if strComp(port,"SHRFAX:") = 0 then....validPort = false...elseif strComp(port,"nul:") = 0 then....validPort = false...elseif strComp(port,"PORTPROMPT:") = 0 then....validPort = false...elseif strComp(port,"XPSPort:") = 0 then....validPort = false...elseif strComp(port,"PDF:") = 0 then....validPort = false...else....validPort = true...end if..end function....Set oWMI = GetObject("winmgmts:\\" & "." & "\root\cimv2")..Set colPrinters = oWMI.ExecQuery("Select * from Win32_Printer",,48)....on error resume next..flag = colPrinters.Count..If (err.number <> 0) Then.. flag = true..Else.. flag = false..End If..on error goto 0 ....'Print only when there's results..If

C:\Program Files\pandora_agent\util\productID.vbs

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.191966966078285
Encrypted:	false
SSDEEP:	24:Tc7xv0hQV4KAEVnFKCNhM4rpuzayka+Lk4:47FP1VsCNhM4rpu+yka+Lk4
MD5:	EE8E29D3C6B6F277700456C5F4100642
SHA1:	0225D4D2F6DF3DD45610FD0642D73E5A7FACE08B
SHA-256:	48A41B238A5BA8C6362C7654827F002661259BF59072530100DB504FE89988FF
SHA-512:	57D0CB7D86F0F477DDCF66311032934155DF9185136B5CA23499954B87154A3EC4CB5BDEC61C7684349D00A90AF6584E1E13ABA487E8639703B07EA0DD6BF73D
Malicious:	false
Preview:	' windows_product_key.vbs..' Pandora FMS Agent Inventory Plugin for Microsoft Windows (All platfforms)..' (c) 2021 Sancho Lerena <slerena@artica.es>..' This plugin extends agent inventory feature. Only enterprise version..' ----------------------------------------------------------------....Set oShell = WScript.CreateObject ("WScript.Shell")..Set objExec = oShell.Exec("cmd.exe /C wmic os get ""SerialNumber"" \| find /v ""SerialNumber"" ")....Do.. line = objExec.StdOut.ReadLine().. s = s & line ..Loop While Not objExec.Stdout.atEndOfStream....Wscript.StdOut.WriteLine "<inventory>"..Wscript.StdOut.WriteLine "<inventory_module>"..Wscript.StdOut.WriteLine "<name>product_ID</name>"..Wscript.StdOut.WriteLine "<type><![CDATA[generic_data_string </type>"..Wscript.StdOut.WriteLine "<datalist>"..Wscript.StdOut.WriteLine "<data><![CDATA[" & Replace(Replace(s, chr(013), ""), chr(010), "") & " </data>"..Wscript.StdOut.WriteLine "</datalist>"..Wscript.StdOut.WriteLine "</inventory_module>".

C:\Program Files\pandora_agent\util\productkey.vbs

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	5.231367723688468
Encrypted:	false
SSDEEP:	24:Tc7xv0hQKUhz/ArYjd0OuTDv9UKRUTfxav0dYe0KS0ST2:47FZZwYjdFuTDvatEcKeEw
MD5:	B352E6BA27360CF6D009F359EB285C70
SHA1:	44119310DEC61ED0BA61985A076E1908F755D8E9
SHA-256:	A2854D50425B8DBBA4E52CB4CA5BED9A00B2B1D375CF576FF1E80944FDFE9202
SHA-512:	B17DDFE688D23328E4F9DB4A1132F22D0BA60BBA5CD3DAED37CD5242CC21E47A0E57C08F90658844D6A9B115036E1FA5728AA98515F76AF8D33586CFEF643CC3
Malicious:	false
Preview:	' windows_product_key.vbs..' Pandora FMS Agent Inventory Plugin for Microsoft Windows (All platfforms)..' (c) 2021 Sancho Lerena <slerena@artica.es>..' This plugin extends agent inventory feature. Only enterprise version..' ----------------------------------------------------------------....strComputer = "."..Set objWMIService = GetObject("winmgmts:" & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")..Set colProducts = objWMIService.ExecQuery("Select OA3xOriginalProductKey from SoftwareLicensingService")....on error resume next..flag = colProducts.Count..If (err.number <> 0) Then.. flag = true..Else.. flag = false..End If..on error goto 0 ....'Print only when there's results..If (NOT flag) Then...Wscript.StdOut.WriteLine "<inventory>"...Wscript.StdOut.WriteLine "<inventory_module>"...Wscript.StdOut.WriteLine "<name>product_key</name>"...Wscript.StdOut.WriteLine "<type><![CDATA[generic_data_string </type>"...Wscript.StdOut.WriteLine "<datalist>".....For Each prod

C:\Program Files\pandora_agent\util\ps.vbs

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	1166
Entropy (8bit):	5.276416252329456
Encrypted:	false
SSDEEP:	12:eA33HUWdtFKc0ZVwci3vAqThYPK/yEaHMMAtpEeRTtPvn1n5P2FOw7gQRPWgXQum:eIHV+U/AwAVHnAXdnncFOw9vYqYoryn
MD5:	8F7FDD867C6A1931489974DCB976E9F7
SHA1:	3B8B46F3D90C3B6C454110909D091BAF1CFD075D
SHA-256:	741084C53D981710EECFC53328652EA8F8FC3F77C5F1D06A520271206746A7B3
SHA-512:	15C5E15015D4684D231DEDBDEECB8DA85CD6EDA8563E504C098FA150415CD0299807A8B82182B1A1F6940F3184F4E34F3601E8270083B7526969B0EA756AEC66
Malicious:	false
Preview:	' ps.vbs..' Returns the status of the given processes...' -----------------------------------------....Option Explicit..'On Error Resume Next....' Variables..Dim objWMIService, objItem, colItems, argc, ps, i....' Get and hash process information..Set objWMIService = GetObject ("winmgmts:\\.\root\cimv2")..Set colItems = objWMIService.ExecQuery ("Select * from Win32_Process")..Set ps = CreateObject("Scripting.Dictionary")..For Each objItem in colItems...if Not ps.Exists(objItem.Name) Then....ps.Add objItem.Name, 1...End If..Next....' Parse command line parameters and check each process..argc = Wscript.Arguments.Count..For i = 0 To argc - 1...Wscript.StdOut.WriteLine "<module>"...Wscript.StdOut.WriteLine " <name><![CDATA[" & Wscript.Arguments(i) & " </name>"...Wscript.StdOut.WriteLine " <description><![CDATA[Process " & Wscript.Arguments(i) & " status </description>"...If argc = 0 Or ps.Exists(Wscript.Arguments(i)) Then....Wscript.StdOut.WriteLine " <data><![CDATA[" & 1 & "]]

C:\Program Files\pandora_agent\util\puttygen.exe

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	6.76762688202511
Encrypted:	false
SSDEEP:	3072:2l+SFAAVcwlzl2p/WM3TXNspgwd++XsoXWQe:2kSiYvNWTXNsphEQ
MD5:	76E59B0D2321C46056D49BF7DD97F701
SHA1:	0BAF1A8642930475986DD758F37FC39FE5F162CC
SHA-256:	20EFF99E60F94644BFBC6AA2DD4E1B76B1B3B70442FF0BEC442C4D7FB2D697FF
SHA-512:	C381DEB2539BE3F811243983F004AEFB08FB102F7B86E28C5931B8C318D3D77DEC15E779E80998CD666871B81841D2ABDE15D461E3137AC8C047FFCE918240D7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......2.b.v...v...v.......w.......c...v...p...v..........}......w...........Richv...........PE..L......A.............................Q............@.......................................................................... ..x....p...............................................................................................................text............................... ..`.rdata...y..........................@..@.data....:...0... ...0..............@....rsrc........p... ...P..............@..@........................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\pandora_agent\util\raminfo.vbs

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1332
Entropy (8bit):	5.3338476948030165
Encrypted:	false
SSDEEP:	24:Wxv0Rk8Q8wUhz/ArpNrcXDv9UKRUGxav0416MD1bQvdTX:WFOkYZwpNQXDvaZc4vD1bQ
MD5:	D5AB421119A9A389CCB4D691B7B04EF4
SHA1:	4B2BB2E4F0BF4FFB03120D85AC473156F5C4724C
SHA-256:	E8D557349D3129FF16D932AB8F6D1B21832C42760859520EF81AA9393CDD65F7
SHA-512:	4C2F917ECB202FF90D47DC45E681057CF9875788D22ABBD0E1BE686CF48237A9639120DAF7E0806438D337BFEDB44E2E5D364732DA135AFF8EDA6ADA218658FA
Malicious:	false
Preview:	' Pandora FMS Agent Inventory Plugin for Microsoft Windows (All platfforms)..' (c) 2015 Borja Sanchez <fborja.sanchez@artica.es>..' This plugin extends agent inventory feature. Only enterprise version..' --------------------------------------------------------------------------..'WMI raminfo....strComputer = "."..Set objWMIService = GetObject("winmgmts:" & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")..Set colRAMs = objWMIService.ExecQuery("Select deviceLocator,capacity,speed from Win32_PhysicalMemory")....on error resume next..flag = colRAMs.Count..If (err.number <> 0) Then.. flag = true..Else.. flag = false..End If..on error goto 0 ....'Print only when there's results..If (NOT flag) Then...Wscript.StdOut.WriteLine "<inventory>"...Wscript.StdOut.WriteLine "<inventory_module>"...Wscript.StdOut.WriteLine "<name>RAM</name>"...Wscript.StdOut.WriteLine "<type><![CDATA[generic_data_string </type>"...Wscript.StdOut.WriteLine "<datalist>".....For Each ram In colRAMs

C:\Program Files\pandora_agent\util\route_parser.exe

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	1146368
Entropy (8bit):	7.974799729683869
Encrypted:	false
SSDEEP:	24576:LRitTKejoJXD2ywPsVcKmrqoBqzkXfEpB5SCpfix0Gqohl/PP63dA:dATxoJXD2yesVkrqoBqzkvW5/fyi+JXz
MD5:	36C8D65325EA3282F2860FF2B24E6469
SHA1:	5EA92004B2816FC9DD9212DF995AD4089FB05A0D
SHA-256:	13AF3EE5D0C31D794F82D8AD53B29A8239F157C4F60F5C278B5CA977C81B0314
SHA-512:	A798F883D9C71D5CF3F0E426B570B74448EAF30CB98F447DBE321042253570E4519249E66D71BDE56701F9AC9FFF043F27CF169E9A6DC0F2153BAF56229E69F9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....V.....................z............... ....@..................................p...............................................................................................................................................................text...............................`.P`.data........ ......................@.`..rdata...?...0...@..................@.`@.bss.........p........................`..idata...............P..............@.0..CRT....4............^..............@.0..tls.... ............`..............@.0..rsrc................b..............@.0.................................................................................................................................................................................................................................................................................................................

C:\Program Files\pandora_agent\util\snmpget.exe

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	278528
Entropy (8bit):	6.390054344636633
Encrypted:	false
SSDEEP:	6144:gPusxLJf2sSzOAltOKE8LrNV21Qg3YqmYqbJlnqqaPWdvHwJnx85t1ugLJ9sQRMK:gPusxLJf2sSzOAltOKE8LrNV21Qg3Yqk
MD5:	46808595676EA16489DC759B9682AC07
SHA1:	5822D3220E636073525D844B73C31CF2676019E3
SHA-256:	3278EA0EA4CFA74732073A83D0BF87328F23F0267DB2627307B5235C77157ED1
SHA-512:	13CD7F7E6A5D3062A4B16BB4AFEC73E17D6D4D9E50BC6139ECEF06B6009DC7E48A984FD86A98DB3B92BF963FF1EE122C23705C5DB3B60370162D0F74122D6B2B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ql@....................2.......Y.......................Y.......Rich....................PE..L....E.................p...........y............@.......................... ..................................................d....................................................................................................................text...0k.......p.................. ..`.rdata..............................@..@.data...............................@...................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\pandora_agent\util\software_installed.vbs

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	Ruby script, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4504
Entropy (8bit):	5.1160166548672725
Encrypted:	false
SSDEEP:	96:WskJwtO1DXu08FDd76D4J5qVwZRIq7vXp+HvgmobGvRgVvlRUTqaL9jrUrr:mUID+3RdQOgVwocvZofL5wzUuz
MD5:	4EB48C8F77A2A0A6B4EB76C323B652B1
SHA1:	71CD568E7B0CAC09E2C75089F18214524A0FA506
SHA-256:	80AE8C679ABFEF3AF24ADE0DAB86FFCA0D6450042A5E6E651AE6CFF74F36A828
SHA-512:	EC7B3162B37A1D8712E07A859866F66048319EBE3F60C1C7D14941856784C4375E64196596A750473BA2B554E4A3E087B9671C7453EBE6A201D893344C45CF2F
Malicious:	false
Preview:	' Pandora FMS Agent Inventory Plugin for Microsoft Windows (All platfforms)..' (c) 2021 Sancho Lerena <slerena@artica.es>..' (c) 2015 Borja Sanchez <fborja.sanchez@artica.es>..' This plugin extends agent inventory feature. Only enterprise version..' --------------------------------------------------------------------------..'on error resume next....Class ObjectList.. Public List.... Sub Class_Initialize().. Set List = CreateObject("Scripting.Dictionary").. End Sub.... Sub Class_Terminate().. Set List = Nothing.. End Sub.... Function Append(Anything) .. List.Add CStr(List.Count + 1), Anything .. Set Append = Anything.. End Function.... Function Item(id) .. If List.Exists(CStr(id)) Then.. Set Item = List(CStr(id)).. Else.. Set Item = Nothing.. End If.. End Function..End Class....class AppClass .. dim InstallDate,Caption,Version,Vendor..end class....'------ Checks if an item exists on the main collection..function isItemInArray(objeto,coleccion)..

C:\Program Files\pandora_agent\util\sort.exe

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	38400
Entropy (8bit):	6.367635381582048
Encrypted:	false
SSDEEP:	384:TE71g/Wv+JU84V1zZ4Oj3UKI18nRD9u1H7bgL3R36ruiVszeEBeU4MTy6KrXlVGD:k8WGm423q8WHfgNCuiOzeYeZu03GKKy
MD5:	81E47BCA760F328966888D6A600CC557
SHA1:	0BE37750001A4C608C90E19BFA5383CB7DA11DD6
SHA-256:	F821393D4226EFFA4ED508E9D0B5C9C3D601F493817B8BBA3871E2EA5D18D0E6
SHA-512:	D33A5619BA1A56D44F8A3190AB01C3A4C95D3F14396F610AE9D0CF2BFFFB15CA128D9F5B4B60011226BF3E93AB732DC6225E50E5CFDE0DAC2D1A00130DA22E1E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......7...............7..........................@.............................................................................p....................................................................................................................text............................... ..`.data...t...........................@....bss.....................................idata..p...........................@...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\pandora_agent\util\tail.exe

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	35328
Entropy (8bit):	6.144881856058755
Encrypted:	false
SSDEEP:	384:hOBY/wIFBiVpb0EGLiS7tkuiXkECIG9E1t/+/DkGjMfHLMs39u/3XxprRzskcB/:JnBiz0EGFkn0ECL9Et/8YGjMfrY/TS
MD5:	7460B4BAB940E2234A3A278BB0D8435B
SHA1:	41FBCF756522E86941E34D6E819502CE727EBDEE
SHA-256:	CA301CDE5B700EF7160CDF1F3ACC6710DA59958B8613DBE0ABD2FD8120DFC0ED
SHA-512:	B4BA514E5862C57B59ED6305F5FF5318E344F2155BE5A6D74553A44DC6C022EC7BBBCF1204BB1B5D9E75911CEEEC97F6F0510482F8DF421424330D9ECF8A0E27
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......7...............7.\|........................@..................................................................................................................................................................................................text...4z.......\|.................. ..`.data...............................@....bss.....................................idata..............................@...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\pandora_agent\util\tentacle_client.exe

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	6848000
Entropy (8bit):	7.997064561861586
Encrypted:	true
SSDEEP:	196608:qYyE7Pebw05fRVoSXerD6AKFi+TgCIXmp0Bd4yrRziXgX7vy:q1M43oSurD69Fi+TNIS0cc7
MD5:	C48D41A6BF6A9131AE71CE8EFB2E38D4
SHA1:	31C3F2BA100A15A35E9518767A99A8327D5A9BD3
SHA-256:	384EEF00B549C8900E5597832E378167C8E04683E7D6B47B6081CAFB8B3B0F9E
SHA-512:	9D7892ABE94460EFDC307C72F5C0B3C02DF2A5F663A8B5847297E61E3476F7BD44FF6ADB25AC27D1135EECC3F7E39123717D80D33AD1688EF93D838A75DBEC58
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....V.....................zh.............. ....@...........................h.......h...................................................g..........................................................................................................text...............................`.P`.data........ ......................@.`..rdata...?...0...@..................@.`@.bss.........p........................`..idata...............P..............@.0..CRT....4............^..............@.0..tls.... ............`..............@.0..rsrc.....g.......g..b..............@.0.................................................................................................................................................................................................................................................................................................................

C:\Program Files\pandora_agent\util\tentacle_server.exe

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	6980608
Entropy (8bit):	7.995793313575621
Encrypted:	true
SSDEEP:	196608:UXZRG6hlR9bK4Ph2/1ZOMK3i06j7zUaSNaQAGVFKQ:UJPbR2aMKgDGzAK
MD5:	FF5A98ABCB286C73CAA6C7F16511CF85
SHA1:	42FF6A0B43B67CE3809BD584F7F381AA377F07C6
SHA-256:	654DA30AE33580EAEA8F0E6A254C6D88D027E59C5DD4A077DD2E85FC0B6DABAD
SHA-512:	2483A45F5117F76A80E45C97813316333ADEA8E0F2AF02F93B83431F92EAC21AB366432901D58037532CBB90C4BE3C6AE1C10969A2DF77850ED0F4EB8D2E21B0
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....V......................j.............. ....@...........................j.......j.................................................P i..........................................................................................................text...............................`.P`.data........ ......................@.`..rdata...?...0...@..................@.`@.bss.........p........................`..idata...............P..............@.0..CRT....4............^..............@.0..tls.... ............`..............@.0..rsrc...P i......"i..b..............@.0.................................................................................................................................................................................................................................................................................................................

C:\Program Files\pandora_agent\util\tr.exe

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	33280
Entropy (8bit):	6.206169693523498
Encrypted:	false
SSDEEP:	384:KzQdbEUFfs5x+i6Toba/BmLyhLdlaOlUbEVDQdyBZFtGiUZ6fBJit4j0faNY8sPz:doUFfsL2To2phLdYAWEDQIvDGiUZYX
MD5:	4D3417B47936BBDD31D7278B7397778F
SHA1:	CBAB359993C37D9F02CD444BF4F072DD574F186A
SHA-256:	6CE74B29611094549D0B939A728062F2252BAC1286BE742494492E4FFF8F0A9B
SHA-512:	2094D95A6000654CFBC0979219945F8B8D921E98D48B40577A56470D1BD1B78ABF85E7FE20E9D0DEAA500DD26A0041FDA812E08DC4E7D3643AB5514812170C1F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......7...............7.t........................@..................................................................................................................................................................................................text....r.......t.................. ..`.data...\|............x..............@....bss.....................................idata...............z..............@...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\pandora_agent\util\unzip.exe

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	164864
Entropy (8bit):	6.360014758507702
Encrypted:	false
SSDEEP:	3072:lzJ+lM+sEvWfROJLhfJpreQ00ws/R3b/rz3qh:CWROJNhpeBUDnq
MD5:	FECF803F7D84D4CFA81277298574D6E6
SHA1:	0FD9A61BF9A361F87661DE295E70A9C6795FE6A1
SHA-256:	81046F943D26501561612A629D8BE95AF254BC161011BA8A62D25C34C16D6D2A
SHA-512:	A4E2E2DFC98A874F7EC8318C40500B0E481FA4476D75D559F2895CE29FBE793A889FB2390220A25AB919DEAC477ADA0C904B30F002324529285BDA94292B48A4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......B...............8.Z...................p....@...............3........................... ......................................................................................................................................................text...$X.......Z..................`..`.data........p.......^..............@....bss.....................................idata...............`..............@....rsrc................t..............@...........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\pandora_agent\util\userslogged.vbs

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2208
Entropy (8bit):	5.326834447991209
Encrypted:	false
SSDEEP:	48:WFOkTkHYkxyW90lEu7b0Z+5HzMhdnR4rp+y4xULkM:Wsk4JvO1k+Zo1U1
MD5:	4ABDE505716333DE1F5A041ACCAEA239
SHA1:	AD5B8D09704E5236301A59F7A5951A8D86B14DC0
SHA-256:	2E5712DFB212392C3C3C5D36EF04180B24D3E8674A0974F7ABA55DA410E4E9E0
SHA-512:	E6383FCA71404CFE26F2118493A661EB2066653A416DD5B336730F2E4C3C8FEADDD64276AF97644184A4D2B19C43366A5857EF322ED79E3758FA8531B358D4BC
Malicious:	false
Preview:	' Pandora FMS Agent Inventory Plugin for Microsoft Windows (All platfforms)..' (c) 2015 Borja Sanchez <fborja.sanchez@artica.es>..' This plugin extends agent inventory feature. Only enterprise version..' --------------------------------------------------------------------------..on error resume next..' Lista todos los usuarios del equipo que han iniciado procesos....dim loggedUsers(),i..i=0..Sub insertIfNotExists(sDomain,sUser)...For Each lUser in loggedUsers....If StrComp(sDomain & "\" & sUser, lUser) = 0 Then.....Exit Sub....End If...Next...redim preserve loggedUsers(i)...i=i+1...loggedUsers (i-1)=sDomain & "\" & sUser..End Sub....Function CheckRealUser(sHost, sUser, sDomain)...Dim oWMI,realUsers...Set oWmi = GetObject("winmgmts:{impersonationLevel=impersonate,(debug)}!\\" _....& sHost & "\root\cimv2")...Set realUsers = oWmi.ExecQuery("SELECT * FROM Win32_UserAccount WHERE Domain='" & sDomain & "' OR Name='" & sUser & "'")...If (realUsers.count=0) Then....CheckRealUser = False...Else

C:\Program Files\pandora_agent\util\videocardinfo.vbs

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1462
Entropy (8bit):	5.289716391143609
Encrypted:	false
SSDEEP:	24:Wxv0Rk8Q8BUhz/ArTQDv9UKRU/xav0iUxGF+bDQnTX:WFOk7ZwTQDva2cS+bW
MD5:	AF7DDEA4DA813ACD636BD673742A1326
SHA1:	95EB5524FDBC8F16A62519B81F1370C7A006E271
SHA-256:	395865447A4A31CCDF7E9FD8889B795C22C081481BF9C3D68507CFD6CC5DF3A4
SHA-512:	ABFCE55A74E3FCC4EBCC31217548BD251BA229AE24EEE298BD02C00C097B64ABED74B13F8BBDE761D7D3460A7D748CDC63D18F36E55A2233EA055EE376ECA23A
Malicious:	false
Preview:	' Pandora FMS Agent Inventory Plugin for Microsoft Windows (All platfforms)..' (c) 2015 Borja Sanchez <fborja.sanchez@artica.es>..' This plugin extends agent inventory feature. Only enterprise version..' --------------------------------------------------------------------------..'WMI video_card_info....strComputer = "."..Set objWMIService = GetObject("winmgmts:" & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")..Set colVideoCards = objWMIService.ExecQuery("Select caption,AdapterRAM,PNPDeviceID from win32_videocontroller")....on error resume next..flag = colVideoCards.Count..If (err.number <> 0) Then.. flag = true..Else.. flag = false..End If..on error goto 0 ....'Print only when there's results..If (NOT flag) Then...Wscript.StdOut.WriteLine "<inventory>"...Wscript.StdOut.WriteLine "<inventory_module>"...Wscript.StdOut.WriteLine "<name>Video</name>"...Wscript.StdOut.WriteLine "<type><![CDATA[generic_data_string </type>"...Wscript.StdOut.WriteLine "<datalist>"...

C:\Program Files\pandora_agent\util\wc.exe

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	29696
Entropy (8bit):	6.118305105783509
Encrypted:	false
SSDEEP:	384:2Dvd48l1bkedqMn3HDXTnj30ZsE4g+D/ic3a7tmGr1TgleyQsIDzcABItJu/I3cV:gt/AspFD/ilkGr10yt/I+QfDC
MD5:	D4F05A27C3C2BFC97792B47158097ADD
SHA1:	016D8B597B72CB5146775B99690CC7E32552BE4B
SHA-256:	9822EF1FF90DE685FC78D0061B27F9F15676BCAB9D6C21383DC027FA5066FD8B
SHA-512:	1ED0E3D9047CA77AAA87EF76F3B7CA43E4B976E4CD1F86AA7F4B50359E893FAC6DC14C6FD048E896F964B3081AB29DD92C5442AE2B72C13571882E9BA1E8D82A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......7...............7.f........................@..................................................................................................................................................................................................text....d.......f.................. ..`.data...h............j..............@....bss.....................................idata...............l..............@...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PandoraFMS_Agent_v7.0NG.777.1\Edit Config File.lnk

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Icon number=0, Archive, ctime=Mon Oct 28 09:39:08 2024, mtime=Mon Oct 28 09:39:08 2024, atime=Mon Oct 28 09:39:08 2024, length=63, window=hide
Category:	modified
Size (bytes):	1932
Entropy (8bit):	3.3371166371266523
Encrypted:	false
SSDEEP:	24:8P4cudttviVFi7u+Av9jd3XsZund3/d3cAJrntpfd3c6pIIBm:8gVdqe7AFjdHsZwdvdJJfdbIa
MD5:	F5CAC22BDF1419F1A502C8EA38B4E478
SHA1:	0B4F177CCA4B6B3ACDC5603A66BCE9258502710A
SHA-256:	BB4EAE5E280AA661164FFBD4DC6C4ADFDA950845E3A641212CB4D68130810AE3
SHA-512:	E3ED2EAB4C5838F2CCC8B28836244AD24249EDE6D50EE7D8E47BED37C554124C45DD44EA496367E2E7D3F12C9F02A12E9D886F4B6EA6AC9A123C9D423BE2990F
Malicious:	false
Preview:	L..................F.".. .....h.%)....h.%)....h.%)..?............................P.O. .:i.....+00.../C:\.....................1.....\Y.T..PROGRA~1..t......O.I\Y.T....B...............J.....#...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....d.1.....\Y.T..PANDOR~1..L......\Y.T\Y.T....d+......................;.p.a.n.d.o.r.a._.a.g.e.n.t.....V.1.....\Y.T..scripts.@......\Y.T\Y.T....~:........................s.c.r.i.p.t.s.....v.2.?...\Y.T .EDIT_C~1.BAT..Z......\Y.T\Y.T.....:.....................J..e.d.i.t._.c.o.n.f.i.g._.f.i.l.e...b.a.t.......j...............-.......i............m^......C:\Program Files\pandora_agent\scripts\edit_config_file.bat..J.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.p.a.n.d.o.r.a._.a.g.e.n.t.\.s.c.r.i.p.t.s.\.e.d.i.t._.c.o.n.f.i.g._.f.i.l.e...b.a.t...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.p.a.n.d.o.r.a._.a.g.e.n.t.+.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.p.a.n.d.o.r.a._.a.g.e.n.t.\.\.p.a.n.d.o.r.a...i.c.o.........%SystemDrive%\Pro

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PandoraFMS_Agent_v7.0NG.777.1\PandoraFMS_Agent_start.lnk

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Icon number=0, Archive, ctime=Wed Aug 14 08:14:00 2024, mtime=Mon Oct 28 09:39:08 2024, atime=Wed Aug 14 08:14:00 2024, length=26, window=hide
Category:	modified
Size (bytes):	1947
Entropy (8bit):	3.3159804916554205
Encrypted:	false
SSDEEP:	24:8GLWcudttvifPs658uLEUA29RMd3XsWRiuLnd3/d3cAJrntpfd3c6ut9tIBm:8GiVdqfU6etjCRMdHs2ikdvdJJfdgLa
MD5:	B3ECE252D7C10448E1DA4F47549D00E4
SHA1:	086D82B29EF36BA1BDE60C0AD5348A7FD9B41A8F
SHA-256:	42D98E498B68DF48C1B2FCD3ED3D3671B1905620E5237AA11B8242667F672401
SHA-512:	CC193E1D30B1E9DA00259B0FA076FB6F8C2002CE2AA7A47BE90128354F83D01479577D5C41E0229AE6C6EE16CA98F1FA4780C71B9EFA2EE9E75EE7434ED98B26
Malicious:	false
Preview:	L..................F.".. .....zL.....h.%)....zL................................P.O. .:i.....+00.../C:\.....................1.....\Y.T..PROGRA~1..t......O.I\Y.T....B...............J.....#...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....d.1.....\Y.T..PANDOR~1..L......\Y.T\Y.T....d+......................;.p.a.n.d.o.r.a._.a.g.e.n.t.....V.1.....\Y.T..scripts.@......\Y.T\Y.T....~:........................s.c.r.i.p.t.s.....\|.2......Y.I .START_~1.BAT..`.......Y.I\Y.T.....:........................s.t.a.r.t._.p.a.n.d.o.r.a._.a.g.e.n.t...b.a.t.......m...............-.......l............m^......C:\Program Files\pandora_agent\scripts\start_pandora_agent.bat..M.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.p.a.n.d.o.r.a._.a.g.e.n.t.\.s.c.r.i.p.t.s.\.s.t.a.r.t._.p.a.n.d.o.r.a._.a.g.e.n.t...b.a.t...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.p.a.n.d.o.r.a._.a.g.e.n.t.+.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.p.a.n.d.o.r.a._.a.g.e.n.t.\.\.p.a.n.d.o.r.a...i.c.o.........%S

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PandoraFMS_Agent_v7.0NG.777.1\PandoraFMS_Agent_stop.lnk

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Icon number=0, Archive, ctime=Wed Aug 14 08:14:00 2024, mtime=Mon Oct 28 09:39:08 2024, atime=Wed Aug 14 08:14:00 2024, length=25, window=hide
Category:	modified
Size (bytes):	1942
Entropy (8bit):	3.317413222899848
Encrypted:	false
SSDEEP:	24:8W3cudttviCDT5HLEAyy9Zd3XsWRTLnd3/d3cAJrntpfd3c6PBm:8W3VdqCDTB3ZdHs2PdvdJJfdH
MD5:	2067AFAB54B4003110F56FC78DEADA11
SHA1:	7F9DE5EC9283C312E23C4A87F92215851367845F
SHA-256:	27C8D7CE72141CE0AFBD7DAC4F2B8DEBD9885F597AEEBB313BBC83ACCB7FF02D
SHA-512:	614E6B24AB61DC59F9834BECC2ED4794B8B95C439B8539B98FD1630E79C14C6F2BACFA34950E3833D3F10C6EF88ECD70D256CF9289A3A7975170C28518A1411F
Malicious:	false
Preview:	L..................F.".. .....zL...W3k.%)....zL................................P.O. .:i.....+00.../C:\.....................1.....\Y.T..PROGRA~1..t......O.I\Y.T....B...............J.....#...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....d.1.....\Y.T..PANDOR~1..L......\Y.T\Y.T....d+......................;.p.a.n.d.o.r.a._.a.g.e.n.t.....V.1.....\Y.T..scripts.@......\Y.T\Y.T....~:........................s.c.r.i.p.t.s.....z.2......Y.I .STOP_P~1.BAT..^.......Y.I\Y.T.....:........................s.t.o.p._.p.a.n.d.o.r.a._.a.g.e.n.t...b.a.t.......l...............-.......k............m^......C:\Program Files\pandora_agent\scripts\stop_pandora_agent.bat..L.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.p.a.n.d.o.r.a._.a.g.e.n.t.\.s.c.r.i.p.t.s.\.s.t.o.p._.p.a.n.d.o.r.a._.a.g.e.n.t...b.a.t...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.p.a.n.d.o.r.a._.a.g.e.n.t.+.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.p.a.n.d.o.r.a._.a.g.e.n.t.\.\.p.a.n.d.o.r.a...i.c.o.........%System

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PandoraFMS_Agent_v7.0NG.777.1\README.lnk

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Wed Aug 14 08:14:00 2024, mtime=Mon Oct 28 09:39:08 2024, atime=Wed Aug 14 08:14:00 2024, length=15956, window=hide
Category:	dropped
Size (bytes):	894
Entropy (8bit):	4.5537577818845625
Encrypted:	false
SSDEEP:	12:8msE120YXch92c8bdpF4IN/f7Plx+AKT5YdXWjAl9XWbdpCwPlUbdpCwPljUknBc:8mfQcudtHiT5OqAl9XSd3Sd3lUknBm
MD5:	C674E833A4A179D44F39CCB6383E2D12
SHA1:	8C756A0FFEBE823B07106CA719E935A7C2A397F4
SHA-256:	E89274BAE1075DF3C8F93EB5A5C2486119AE32512B3BD145CA5D9E7809C89961
SHA-512:	2E2C6E44C23F63E66F9CFDD5EC54A9C46DAFB31E42EF3A94472720F0AD5A61822D90AEF191D8A735129ECA47A9D81AB0D5D80EE338CD769950B8153A704C80EA
Malicious:	false
Preview:	L..................F.... .....zL....a.%)....zL...T>...........................P.O. .:i.....+00.../C:\.....................1.....\Y.T..PROGRA~1..t......O.I\Y.T....B...............J.....#...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....d.1.....\Y.T..PANDOR~1..L......\Y.T\Y.T....d+......................;.p.a.n.d.o.r.a._.a.g.e.n.t.....`.2.T>...Y.I .README.txt..F.......Y.I\Y.T....}:........................R.E.A.D.M.E...t.x.t.......X...............-.......W............m^......C:\Program Files\pandora_agent\README.txt..8.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.p.a.n.d.o.r.a._.a.g.e.n.t.\.R.E.A.D.M.E...t.x.t...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.p.a.n.d.o.r.a._.a.g.e.n.t.`.......X.......932923...........hT..CrF.f4... ...T..b...,.......hT..CrF.f4... ...T..b...,......E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PandoraFMS_Agent_v7.0NG.777.1\Uninstall.lnk

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	MS Windows shortcut, Item id list present, Has Relative path, Has Working directory, ctime=Sun Dec 31 23:25:52 1600, mtime=Sun Dec 31 23:25:52 1600, atime=Sun Dec 31 23:25:52 1600, length=0, window=hide
Category:	dropped
Size (bytes):	609
Entropy (8bit):	2.8354316500192986
Encrypted:	false
SSDEEP:	12:8wl0VkXXdpyoPlaK4KbdpCwPlZRtbdpCwPl+:8OHd/D4ud3bXd34
MD5:	9A5D51F41E4F2A40186C7D506416BE11
SHA1:	E0300E04E410536DD9220AF94D2D106BFD4E03F7
SHA-256:	82BFA995CA3EF53ABA6AC1BF614AE77C9034B69D11096CA38F11F82F9A0CC939
SHA-512:	94AFA0D7618396D78921A2714CA4252B9437A49445B503238A0A80A0869521DD4CE66AA29499F422E1C64ED21FE0D60E64B2293D6EE38A70708E32D53E0B75EC
Malicious:	false
Preview:	L..................F........................................................_....P.O. .:i.....+00.../C:\...................h.1...........Program Files.L............................................P.r.o.g.r.a.m. .F.i.l.e.s.....h.1...........pandora_agent.L............................................p.a.n.d.o.r.a._.a.g.e.n.t.....`.2...........uninst.exe..F............................................u.n.i.n.s.t...e.x.e.......8.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.p.a.n.d.o.r.a._.a.g.e.n.t.\.u.n.i.n.s.t...e.x.e...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.p.a.n.d.o.r.a._.a.g.e.n.t.....

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PandoraFMS_Agent_v7.0NG.777.1\Website.lnk

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Mon Oct 28 09:39:13 2024, mtime=Mon Oct 28 09:39:13 2024, atime=Mon Oct 28 09:39:13 2024, length=51, window=hide
Category:	dropped
Size (bytes):	946
Entropy (8bit):	4.531746550000899
Encrypted:	false
SSDEEP:	12:8mKWG40YXch92c8bdpF4IN/L+PlNiCsWcDyajAX9u/bdpCwPlTyw0bdpCwPljYL3:8m7/cudQWCmymAX9uzd3Zynd3lYLgBm
MD5:	288D2403307459137F1DA7473C6E3044
SHA1:	C57791D76791421D9B916D07BAE9BB9B602830BA
SHA-256:	A962D8F54396A6045ADC5B2A0A991EB37807BBF885DE2386F34553FDE03125C9
SHA-512:	BB58B6C1966BF46D0374D7EA156C3C225C775BF6D7FBC99C2C28F6F5B6E538211C791902F194FF39A81B400A6BD2C7F9428C4C41F276E93A6EA586F367FDBA55
Malicious:	false
Preview:	L..................F.... ...F.h.%)..F.h.%)..F.h.%)..3............................P.O. .:i.....+00.../C:\.....................1.....\Y.T..PROGRA~1..t......O.I\Y.T....B...............J.....#...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....d.1.....\Y.T..PANDOR~1..L......\Y.T\Y.T....d+.....................8..p.a.n.d.o.r.a._.a.g.e.n.t.....v.2.3...\Y.T .PANDOR~1.URL..Z......\Y.T\Y.T.....G......................;.P.a.n.d.o.r.a.F.M.S._.A.g.e.n.t...u.r.l.......b...............-.......a............m^......C:\Program Files\pandora_agent\PandoraFMS_Agent.url..B.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.p.a.n.d.o.r.a._.a.g.e.n.t.\.P.a.n.d.o.r.a.F.M.S._.A.g.e.n.t...u.r.l...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.p.a.n.d.o.r.a._.a.g.e.n.t.`.......X.......932923...........hT..CrF.f4... ..T..b...,.......hT..CrF.f4... ..T..b...,......E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

C:\Users\user\AppData\Local\Temp\nsiBE5B.tmp\LangDLL.dll

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	7168
Entropy (8bit):	4.587688007809552
Encrypted:	false
SSDEEP:	96:Gv8dTrjZ9CJ2KFLy3CvUQ5SEEyI8itL7UlPVng14G7oJoiNcp:b7vwL5U4m5LsPdILsqi2
MD5:	5BF7D04824AC42BAD8263E5CEDA265C5
SHA1:	7B714893EB1FE451F6E8AF310ECFAC8447610C40
SHA-256:	DFCFC47116FA2A8EB598D89DDC3E2BF4FAC44D62E670FE615425E7300F43F860
SHA-512:	E13FBB51254B99C834408AA5F0B794ABFCCD86E619BA075726A3BCE3723980F0B43606A684E40502B6751BCF29075850B07DFAE08FE1BD650D1F0EB293AE65C3
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..... W...........#..............................o................................?......... ......................@..I....P.......`..X....................p.......................................................P..d............................text............................... .0`.rdata..T.... ......................@.0@.bss....l....0........................`..edata..I....@......................@.0@.idata.......P......................@.0..rsrc...X....`......................@.0..reloc.......p......................@.0B........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsiBE5B.tmp\System.dll

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	24064
Entropy (8bit):	5.931807565128868
Encrypted:	false
SSDEEP:	384:TsuiXfwnOEFMUgKWSeMPe3+6a+A6PcPpntKfh00g509nj:efwnLFMUGMPenA6Yuh9Xj
MD5:	8643641707FF1E4A3E1DFDA207B2DB72
SHA1:	F6D766CAA9CAFA533A04DD00E34741D276325E13
SHA-256:	D1B94797529C414B9D058C17DBD10C989EEF59B1FA14EEA7F61790D7CFA7FD25
SHA-512:	CC8E07395419027914A6D4B3842AC7D4F14E3EC8BE319BFE5C81F70BCF757F8C35F0AAEB985C240B6ECC71FC3E71B9F697CCDA6E71F84AC4930ADF5EAC801181
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..... W...........#.....<...Z.......3.......P....\n.................................P........ .................................4...................................................................................<................................text....:.......<..................`.P`.data...4....P.......@..............@.0..rdata.......`.......B..............@.0@.bss.........p........................`..edata...............J..............@.0@.idata..4............L..............@.0..CRT....,............T..............@.0..tls.... ............V..............@.0..reloc...............X..............@.0B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsiBE5B.tmp\modern-wizard.bmp

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	PC bitmap, Windows 3.x format, 164 x 314 x 24, image size 154488, resolution 4724 x 4724 px/m, cbSize 154542, bits offset 54
Category:	dropped
Size (bytes):	154542
Entropy (8bit):	7.334316012178696
Encrypted:	false
SSDEEP:	3072:cjs/2int3rn2sCj3JEAsAdE563uXmvKa/DnF4beFHEh7U0WwmPj:cjC2idrSj3J3E63u2iuDYeFHEhI0WwG
MD5:	4F22F89EA4727F2BBD5A6F4332A73AF4
SHA1:	69899A43FAC387323A4E5C6E70875D9ECCAE11C5
SHA-256:	2442B4828CE145B60FDDB66E13C422561E8AD37C417C8FE2488AE3C48D59B246
SHA-512:	F44F2D58EF9DB0ABFDCAB21FCA5468FB199876A94C8B613F14C39FF39065E336A3D855270A6F6227266BDFCE310831471291C04CCB46401A0C8F5A952F3420EB
Malicious:	false
Preview:	BM.[......6...(.......:...........x[..t...t...........O.P+.Q4.T>.U?.U?.U?.U?.U?.U?.U?.U?.U?.U?.U?.U?.U?.U?.U?.U?.U?.U?.U?.U?.S?.U?.U?.U?.U?.U?.U?.U?.U?.U?.U?.U?.U?.U?.U?.S?.S?.S?.S?.S?.H..C..E..E..R>.Q@.Q@.Q@.S@.Q9.A..@..?..?..>..>..?..?..?..?..?..?..?..?..?..?..?..?..?..?..?..?..?..?..?..?..>..>..>..>..>..>..?..=..=..:..E..U%+U#'U")T%(U")U")S$'T%(U")U")U")U")R"(R"(T"&R"(R"(Q"%O #O #O #O+.TA.S@.TA.S@.TA.V@.TA.TA.TA.TA.TA.TA.TA.TA.TA.TA.TA.TA.TA.TA.TA.TA.UB.O7.B..A..?..?..?..A..?..A..@..eW.e^.nl...)..j\|.4y.$..O..;s~!..b\|.(~.0..ev~!..K..Fq.#P+.P+.Q4.U?.T>.U?.U?.U?.U?.U?.U?.U?.U?.U?.U?.U?.U?.U?.U?.U?.U?.U?.U?.U?.S?.U?.U?.U?.U?.U?.U?.U?.U?.U?.U?.U?.U?.U?.U?.S?.S?.S?.S?.S?.H..C..E..E..Q?.R?.Q@.Q@.S@.Q9.A..@..?..?..>..>..>..>..>..>..>..>..>..>..>..>..>..>..>..>..>..>..>..>..>..>..>..>..>..>..>..>..?..=..=..<..C..U%+U")S#)V$(U")S#)Q$'S$'S#)S#)S#)R"(R"(R"(T!(R"(R"(Q!'O #O #O.%Q.U@.S@.S@.S@.S@.S@.Q@.TA.TA.TA.TA.TA.TA.TA.TA.TA.TA.TA.TA.TA.TA.TA.UB.P8.C..B..@..@..@..B..@..A..<..cX.e].qm...&..i.

C:\Users\user\AppData\Local\Temp\nsiBE5B.tmp\nsDialogs.dll

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	5.4910696778053065
Encrypted:	false
SSDEEP:	192:rAki5P7AA9Xm2Y3KkdMG95Kt0qk+PdIgb9rdTiUdH7hs:Ekg7TNm2GdMG9ISx+P99rd+aH9
MD5:	79A0BDE19E949A8D90DF271CA6E79CD2
SHA1:	946AD18A59C57A11356DD9841BEC29903247BB98
SHA-256:	8353F495064AAF30B32B02F5D935C21F86758F5A99D8EE5E8BF8077B907FAD90
SHA-512:	2A65A48F5DD453723146BABCA8D047E112AB023A589C57FCF5441962F2846A262C2AD25A2985DBA4F2246CDC21D973CBF5E426D4B75DD49A083635400F908A3E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..... W...........#................l"........L....n.................................k........ ......................`..k....p......................................................................................xq...............................text............................... .0`.rdata..<....0......................@.0@.bss....0....@........................`..edata..k....`......................@.0@.idata.......p....... ..............@.0..rsrc................(..............@.0..reloc...............*..............@.0B........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu.lnk

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Wed Aug 14 08:14:00 2024, mtime=Mon Oct 28 09:39:08 2024, atime=Wed Aug 14 08:14:00 2024, length=15956, window=hide
Category:	dropped
Size (bytes):	894
Entropy (8bit):	4.545978566624625
Encrypted:	false
SSDEEP:	24:8mfQcudC6+HiT5OqAl9XSd3Sd3lUknBm:8mfQVd9TQZDCdCdv
MD5:	AC98BB6C7FB33AA2C54F399249ABC68B
SHA1:	8024116306065C04136E0963C238707D74290BDF
SHA-256:	01A6FB5C07236663648F27708CC61749FC2F2AA51A26F4D15627E0A96E835EBD
SHA-512:	1AC6D31B5ECF48720D389C8564614A93C381925D976730B3BE585E92C69078F2FBDE45D064B1A07D101AEA06FA6B03B81E71A2B49F4E6835D1717ED144638D9F
Malicious:	false
Preview:	L..................F.... .....zL....a.%)....zL...T>...........................P.O. .:i.....+00.../C:\.....................1.....\Y.T..PROGRA~1..t......O.I\Y.T....B...............J.....#...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....d.1.....\Y.T..PANDOR~1..L......\Y.T\Y.T....d+....................b...p.a.n.d.o.r.a._.a.g.e.n.t.....`.2.T>...Y.I .README.txt..F.......Y.I\Y.T....}:........................R.E.A.D.M.E...t.x.t.......X...............-.......W............m^......C:\Program Files\pandora_agent\README.txt..8.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.p.a.n.d.o.r.a._.a.g.e.n.t.\.R.E.A.D.M.E...t.x.t...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.p.a.n.d.o.r.a._.a.g.e.n.t.`.......X.......932923...........hT..CrF.f4... ...T..b...,.......hT..CrF.f4... ...T..b...,......E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Start Pandora Agent.lnk

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Wed Aug 14 08:14:00 2024, mtime=Mon Oct 28 09:39:08 2024, atime=Wed Aug 14 08:14:00 2024, length=26, window=hide
Category:	dropped
Size (bytes):	1099
Entropy (8bit):	4.438756941377821
Encrypted:	false
SSDEEP:	24:8mDLWcudIP1tvkfPs658uLEUA29Ud3XsWRiuLm4d3XVut9tIBm:8mDiVdDfU6etjCUdHs2isdHsLa
MD5:	5C9399B593766DE6B8BB91A9A5B1EF70
SHA1:	81677E186E3782BE84B5212041764BE481B3DF36
SHA-256:	B49D68DC19857CEC022EEDF27EAB1B580E08BE4E667C3E9ECED18F6C9F7A177B
SHA-512:	4BF5737684E5F1BB0BDA9E5453E602216A007218F54970C34CCAD73DD2A6D3506A063DE7E051C38434BA53265B301D137304DA41F274A20FE2E5CE65A5E5D890
Malicious:	false
Preview:	L..................F.... .....zL.....h.%)....zL................................P.O. .:i.....+00.../C:\.....................1.....\Y.T..PROGRA~1..t......O.I\Y.T....B...............J.....#...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....d.1.....\Y.T..PANDOR~1..L......\Y.T\Y.T....d+........................p.a.n.d.o.r.a._.a.g.e.n.t.....V.1.....\Y.T..scripts.@......\Y.T\Y.T....~:........................s.c.r.i.p.t.s.....\|.2......Y.I .START_~1.BAT..`.......Y.I\Y.T.....:........................s.t.a.r.t._.p.a.n.d.o.r.a._.a.g.e.n.t...b.a.t.......m...............-.......l............m^......C:\Program Files\pandora_agent\scripts\start_pandora_agent.bat..S.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.p.a.n.d.o.r.a._.a.g.e.n.t.\.s.c.r.i.p.t.s.\.s.t.a.r.t._.p.a.n.d.o.r.a._.a.g.e.n.t...b.a.t.&.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.p.a.n.d.o.r.a._.a.g.e.n.t.\.s.c.r.i.p.t.s.`.......X.......932923...........hT..CrF.f4... ...T..b...,.......hT..C

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Stop Pandora Agent.lnk

Download File

Process:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Wed Aug 14 08:14:00 2024, mtime=Mon Oct 28 09:39:08 2024, atime=Wed Aug 14 08:14:00 2024, length=25, window=hide
Category:	dropped
Size (bytes):	1094
Entropy (8bit):	4.451163124839149
Encrypted:	false
SSDEEP:	24:8mj3cudIP1tvYCDT5HLEAyy93d3XsWRTLm4d3XVPBm:8mj3VdXCDTB33dHs2XdHz
MD5:	B186C18402A1E58BDB50EADF87850AFD
SHA1:	FC32ED803E9479C5644466AAF1711771281802C6
SHA-256:	8C03EFEAA4EAF5B1E6F5B39A3B296482B653DB9463846926375346119C554951
SHA-512:	7B40AA0ED207372912216D195A08E99FF57E13BE096FD8F6A6479F4641AD2B959837C4808C5B59F92A6B0B6ECF9E769DAE7A0474450DC3E7BE4721DA29AE3660
Malicious:	false
Preview:	L..................F.... .....zL...W3k.%)....zL................................P.O. .:i.....+00.../C:\.....................1.....\Y.T..PROGRA~1..t......O.I\Y.T....B...............J.....#...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....d.1.....\Y.T..PANDOR~1..L......\Y.T\Y.T....d+........................p.a.n.d.o.r.a._.a.g.e.n.t.....V.1.....\Y.T..scripts.@......\Y.T\Y.T....~:.....................J..s.c.r.i.p.t.s.....z.2......Y.I .STOP_P~1.BAT..^.......Y.I\Y.T.....:........................s.t.o.p._.p.a.n.d.o.r.a._.a.g.e.n.t...b.a.t.......l...............-.......k............m^......C:\Program Files\pandora_agent\scripts\stop_pandora_agent.bat..R.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.p.a.n.d.o.r.a._.a.g.e.n.t.\.s.c.r.i.p.t.s.\.s.t.o.p._.p.a.n.d.o.r.a._.a.g.e.n.t...b.a.t.&.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.p.a.n.d.o.r.a._.a.g.e.n.t.\.s.c.r.i.p.t.s.`.......X.......932923...........hT..CrF.f4... .).T..b...,.......hT..CrF.f4

\Device\ConDrv

Download File

Process:	C:\Program Files\pandora_agent\PandoraAgent.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	210
Entropy (8bit):	4.85999138992323
Encrypted:	false
SSDEEP:	3:xoFu7MZsVLUBnngwoF8DIuRsscWdZjd1KUwA7SfgwoF2G58+8UBUKdAP4Ekry:xokg6QBgwoX2UanSIwoga8LoUKdbry
MD5:	AE02717466D6E7F8B244F460FEDC4495
SHA1:	229150B5843F39D25BBA9C3EB48A7E08AA7E1744
SHA-256:	099E6C2AB5F48E7AD0689F1D37696D80877411F52837EE39B04D5F99BF95CFD1
SHA-512:	25B48CAAF1D73A7319B3D44A1CF6000BAB079C554105A6CC2F1B68EC6453ABD84C3A29D474EFFF9941F338BAEBD1B68736A6EFC22FB25B34798719D253D7B4A8
Malicious:	false
Preview:	[SERVICE] Attempting to install the service... [SERVICE] The full path to the binary is: "C:\Program Files\pandora_agent\PandoraAgent.exe".. [SERVICE] Successfully added the service to the Services database...

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.998832699326698
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	PandoraFMS_One_Agent_Windows-lts.x86_64.exe
File size:	62'120'984 bytes
MD5:	850a59f9c158b9d953ee6a75f55f7f8a
SHA1:	00112195c957667f320fa4565966827a8570c168
SHA256:	324f914c6e630516c2d2565cbd0b63e33eb6dc171f26aeaadf4f920636b16dc0
SHA512:	42ac0753dd6f4ac8103f323408b1ee106f52d210c5db92ed3bbe221af3326e992f7842b0dc7bb6e5b09ffcc66cfe3e89de6682b514267b94dd83d9d1ae88e0ef
SSDEEP:	1572864:LaFQsS0vyofU4Ss9d2tPDHorC6wf1Il4N4LSWKno9z2:LXAU4SMItPboW6UN4U+z2
TLSH:	85D733146B295ECAFA05F271C3858ED56C89CCA9B1B14933B79D373328BDE9007BB815
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..... W.........................Z..gA............@..........................P......:......... ............................

File Icon


Icon Hash:	1761c99c96ca6117

Static PE Info

General

Entrypoint:	0x404167
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x57201597 [Wed Apr 27 01:27:51 2016 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	187b3ae62ff818788b8c779ef7bc3d1c

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=Sectigo Public Code Signing CA EV R36, O=Sectigo Limited, C=GB
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	11/04/2024 01:00:00 11/07/2027 00:59:59
Subject Chain	CN=Pandora FMS SL, O=Pandora FMS SL, S=Madrid, C=ES, OID.2.5.4.15=Private Organization, OID.1.3.6.1.4.1.311.60.2.1.3=ES, SERIALNUMBER=B84491109
Version:	3
Thumbprint MD5:	CADD05AE46AB8A1E1EE59C0F3536D556
Thumbprint SHA-1:	5CE88AB48F2B88A258E1E2201F33E08303D10EE6
Thumbprint SHA-256:	B5E623CAC465D69117849F998190946490AD859B7AE04F8990F3C369669A13B1
Serial:	0478F96DD975F8E17D1E67123536784D

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 000001ACh
mov dword ptr [esp], 00008001h
call dword ptr [00438434h]
push ecx
call dword ptr [004383FCh]
cmp ax, 0006h
je 00007F5A1D17BA2Dh
mov dword ptr [esp], 00000000h
call 00007F5A1D17F905h
test eax, eax
push edx
je 00007F5A1D17BA1Ch
mov dword ptr [esp], 00000C00h
call eax
push edi
mov ebx, 0040B300h
cmp byte ptr [ebx], 00000000h
je 00007F5A1D17BA2Bh
mov dword ptr [esp], ebx
call 00007F5A1D17F859h
push ecx
mov dword ptr [esp], ebx
call dword ptr [00438464h]
lea ebx, dword ptr [ebx+eax+01h]
push esi
jmp 00007F5A1D17B9F4h
mov dword ptr [esp], 0000000Dh
call 00007F5A1D17F8C7h
push ebx
mov dword ptr [esp], 0000000Bh
call 00007F5A1D17F8BAh
push esi
mov dword ptr [004369A0h], eax
call dword ptr [00438354h]
mov dword ptr [esp], 00000000h
call dword ptr [00438474h]
mov dword ptr [00436918h], eax
push edi
lea eax, dword ptr [ebp-00000178h]
mov dword ptr [esp+10h], 00000000h
mov dword ptr [esp+0Ch], 00000160h
mov dword ptr [esp+08h], eax
mov dword ptr [esp+04h], 00000000h
mov dword ptr [esp], 0040B2BDh
call dword ptr [00000088h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x38000	0x127c	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x5b000	0x290f0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x3b3b550	0x2ec8
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x8970	0x8a00	2ec988133e621c870cc7b5a3cd9c0a46	False	0.5525928442028986	data	6.0272270031273925	IMAGE_SCN_CNT_CODE, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0xa000	0xe8	0x200	1f81afc91794a293205881d6e53e0b0f	False	0.2109375	data	1.6306147921130418	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0xb000	0x6b04	0x6c00	7bdb471d068123a70155b53231331703	False	0.7160734953703703	data	7.230628468311125	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.bss	0x12000	0x25a00	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x38000	0x127c	0x1400	c9e9e4693c2aa9c86bd5fec6ae143093	False	0.3708984375	data	5.180334996596523	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x3a000	0x21000	0x400	0f343b0931126a20f133d67c2b018a3b	False	0.0166015625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x5b000	0x290f0	0x29200	1346926b31570de576cbb3f1665c87e0	False	0.038587575987841946	data	2.523130603513166	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x5b310	0x25e4c	Device independent bitmap graphic, 194 x 386 x 32, image size 149768	English	United States	0.03080947349431745
RT_ICON	0x81160	0xea8	data	English	United States	0.007196162046908316
RT_ICON	0x82008	0x8a8	data	English	United States	0.01128158844765343
RT_ICON	0x828b0	0x568	data	English	United States	0.014450867052023121
RT_ICON	0x82e18	0x468	data	English	United States	0.015957446808510637
RT_ICON	0x83280	0x2e8	data	English	United States	0.020161290322580645
RT_ICON	0x83568	0x128	data	English	United States	0.04391891891891892
RT_DIALOG	0x83690	0xb4	data	English	United States	0.6166666666666667
RT_DIALOG	0x83748	0x144	data	English	United States	0.5339506172839507
RT_DIALOG	0x83890	0x23e	data	English	United States	0.39198606271777003
RT_DIALOG	0x83ad0	0x104	data	English	United States	0.6076923076923076
RT_DIALOG	0x83bd8	0xee	data	English	United States	0.6092436974789915
RT_GROUP_ICON	0x83cc8	0x68	data	English	United States	0.9230769230769231
RT_MANIFEST	0x83d30	0x3c0	XML 1.0 document, ASCII text, with very long lines (960), with no line terminators	English	United States	0.5197916666666667

Imports

DLL	Import
ADVAPI32.dll	RegCloseKey, RegCreateKeyExA, RegDeleteKeyA, RegDeleteValueA, RegEnumKeyA, RegEnumValueA, RegOpenKeyExA, RegQueryValueExA, RegSetValueExA, SetFileSecurityA
COMCTL32.DLL	ImageList_AddMasked, ImageList_Create, ImageList_Destroy, InitCommonControls
GDI32.dll	CreateBrushIndirect, CreateFontIndirectA, DeleteObject, GetDeviceCaps, SelectObject, SetBkColor, SetBkMode, SetTextColor
KERNEL32.dll	CloseHandle, CompareFileTime, CopyFileA, CreateDirectoryA, CreateFileA, CreateProcessA, CreateThread, DeleteFileA, ExitProcess, ExpandEnvironmentStringsA, FindClose, FindFirstFileA, FindNextFileA, FreeLibrary, GetCommandLineA, GetCurrentProcess, GetDiskFreeSpaceA, GetExitCodeProcess, GetFileAttributesA, GetFileSize, GetFullPathNameA, GetLastError, GetModuleFileNameA, GetModuleHandleA, GetPrivateProfileStringA, GetProcAddress, GetShortPathNameA, GetSystemDirectoryA, GetTempFileNameA, GetTempPathA, GetTickCount, GetVersion, GetWindowsDirectoryA, GlobalAlloc, GlobalFree, GlobalLock, GlobalUnlock, LoadLibraryExA, MoveFileA, MulDiv, MultiByteToWideChar, ReadFile, RemoveDirectoryA, SearchPathA, SetCurrentDirectoryA, SetErrorMode, SetFileAttributesA, SetFilePointer, SetFileTime, Sleep, WaitForSingleObject, WriteFile, WritePrivateProfileStringA, lstrcatA, lstrcmpA, lstrcmpiA, lstrcpynA, lstrlenA
ole32.dll	CoCreateInstance, CoTaskMemFree, OleInitialize, OleUninitialize
SHELL32.dll	SHBrowseForFolderA, SHFileOperationA, SHGetFileInfoA, SHGetPathFromIDListA, SHGetSpecialFolderLocation, ShellExecuteA
USER32.dll	AppendMenuA, BeginPaint, CallWindowProcA, CharNextA, CharPrevA, CheckDlgButton, CloseClipboard, CreateDialogParamA, CreatePopupMenu, CreateWindowExA, DefWindowProcA, DestroyWindow, DialogBoxParamA, DispatchMessageA, DrawTextA, EmptyClipboard, EnableMenuItem, EnableWindow, EndDialog, EndPaint, ExitWindowsEx, FillRect, FindWindowExA, GetClassInfoA, GetClientRect, GetDC, GetDlgItem, GetDlgItemTextA, GetMessagePos, GetSysColor, GetSystemMenu, GetSystemMetrics, GetWindowLongA, GetWindowRect, InvalidateRect, IsWindow, IsWindowEnabled, IsWindowVisible, LoadBitmapA, LoadCursorA, LoadImageA, MessageBoxIndirectA, OpenClipboard, PeekMessageA, PostQuitMessage, RegisterClassA, ScreenToClient, SendMessageA, SendMessageTimeoutA, SetClassLongA, SetClipboardData, SetCursor, SetDlgItemTextA, SetForegroundWindow, SetTimer, SetWindowLongA, SetWindowPos, SetWindowTextA, ShowWindow, SystemParametersInfoA, TrackPopupMenu, wsprintfA

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Target ID:	0
Start time:	06:38:52
Start date:	28/10/2024
Path:	C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe"
Imagebase:	0x400000
File size:	62'120'984 bytes
MD5 hash:	850A59F9C158B9D953EE6A75F55F7F8A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	06:39:05
Start date:	28/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /c net stop pandoraFMSagent
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	06:39:05
Start date:	28/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	06:39:05
Start date:	28/10/2024
Path:	C:\Windows\SysWOW64\net.exe
Wow64 process (32bit):	true
Commandline:	net stop pandoraFMSagent
Imagebase:	0xd10000
File size:	47'104 bytes
MD5 hash:	31890A7DE89936F922D44D677F681A7F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	06:39:05
Start date:	28/10/2024
Path:	C:\Windows\SysWOW64\net1.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\net1 stop pandoraFMSagent
Imagebase:	0x5d0000
File size:	139'776 bytes
MD5 hash:	2EFE6ED4C294AB8A39EB59C80813FEC1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	06:39:12
Start date:	28/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /c PandoraAgent.exe --install
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	06:39:12
Start date:	28/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	06:39:12
Start date:	28/10/2024
Path:	C:\Program Files\pandora_agent\PandoraAgent.exe
Wow64 process (32bit):	false
Commandline:	PandoraAgent.exe --install
Imagebase:	0x400000
File size:	7'811'449 bytes
MD5 hash:	D885123606524EA6542E5AC351FB3529
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	06:39:13
Start date:	28/10/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /Create /TN pandora_agent_restart /TR "\"C:\Program Files\pandora_agent\scripts\restart_pandora_agent.bat\"" /SC DAILY /ST 00:00:00 /F /RU SYSTEM
Imagebase:	0xc20000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	06:39:13
Start date:	28/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	06:39:13
Start date:	28/10/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /Change /TN pandora_agent_restart /TR "\"C:\Program Files\pandora_agent\scripts\restart_pandora_agent.bat\""
Imagebase:	0xc20000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	06:39:13
Start date:	28/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	06:39:13
Start date:	28/10/2024
Path:	C:\Program Files\pandora_agent\util\ShortElev.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files\pandora_agent\util\ShortElev.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PandoraFMS_Agent_v7.0NG.777.1\Edit Config File.lnk"
Imagebase:	0x400000
File size:	111'404 bytes
MD5 hash:	0137DF9F792F635269E6FFF74F238C95
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	06:39:13
Start date:	28/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	06:39:14
Start date:	28/10/2024
Path:	C:\Program Files\pandora_agent\util\ShortElev.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files\pandora_agent\util\ShortElev.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PandoraFMS_Agent_v7.0NG.777.1\PandoraFMS_Agent_start.lnk"
Imagebase:	0x400000
File size:	111'404 bytes
MD5 hash:	0137DF9F792F635269E6FFF74F238C95
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	06:39:15
Start date:	28/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	06:39:15
Start date:	28/10/2024
Path:	C:\Program Files\pandora_agent\util\ShortElev.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files\pandora_agent\util\ShortElev.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PandoraFMS_Agent_v7.0NG.777.1\PandoraFMS_Agent_stop.lnk"
Imagebase:	0x400000
File size:	111'404 bytes
MD5 hash:	0137DF9F792F635269E6FFF74F238C95
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	06:39:15
Start date:	28/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	06:39:15
Start date:	28/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\SYSTEM32\cmd.exe /c ""C:\Program Files\pandora_agent\scripts\restart_pandora_agent.bat""
Imagebase:	0x7ff65f0e0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	06:39:15
Start date:	28/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	06:39:15
Start date:	28/10/2024
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net stop PandoraFMSAgent
Imagebase:	0x7ff708870000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	06:39:15
Start date:	28/10/2024
Path:	C:\Windows\System32\net1.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\net1 stop PandoraFMSAgent
Imagebase:	0x7ff7ca220000
File size:	183'808 bytes
MD5 hash:	55693DF2BB3CBE2899DFDDF18B4EB8C9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	06:39:15
Start date:	28/10/2024
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net start PandoraFMSAgent
Imagebase:	0x7ff708870000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	06:39:15
Start date:	28/10/2024
Path:	C:\Windows\System32\net1.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\net1 start PandoraFMSAgent
Imagebase:	0x7ff7ca220000
File size:	183'808 bytes
MD5 hash:	55693DF2BB3CBE2899DFDDF18B4EB8C9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	06:39:15
Start date:	28/10/2024
Path:	C:\Program Files\pandora_agent\PandoraAgent.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\pandora_agent\PandoraAgent.exe"
Imagebase:	0x400000
File size:	7'811'449 bytes
MD5 hash:	D885123606524EA6542E5AC351FB3529
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	23.3%
Dynamic/Decrypted Code Coverage:	11.2%
Signature Coverage:	14.8%
Total number of Nodes:	1935
Total number of Limit Nodes:	65

Executed Functions

Function 00406EFB Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 358
windowclipboardmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetClientRect.USER32(?,?), ref: 00406FD0
GetSystemMetrics.USER32 ref: 00406FE2
SendMessageA.USER32 ref: 0040700E
SendMessageA.USER32 ref: 0040702E
SendMessageA.USER32 ref: 0040704E
SendMessageA.USER32 ref: 0040706A
SendMessageA.USER32 ref: 0040708F
ShowWindow.USER32 ref: 004070D7
ShowWindow.USER32(00000000,00000000), ref: 004070EF
SendMessageA.USER32 ref: 00407143
SendMessageA.USER32 ref: 0040716F
SendMessageA.USER32 ref: 0040718B
GetDlgItem.USER32 ref: 004071AB
CreateThread.KERNELBASE ref: 004071DD
CloseHandle.KERNELBASE ref: 004071E9
ShowWindow.USER32 ref: 0040721E
ShowWindow.USER32(00000000,00000000), ref: 0040722D
SendMessageA.USER32 ref: 004072D8
CreatePopupMenu.USER32 ref: 004072EC
AppendMenuA.USER32(?,?), ref: 00407321
GetWindowRect.USER32 ref: 0040733A
TrackPopupMenu.USER32 ref: 0040737E
SendMessageA.USER32 ref: 004073CA
OpenClipboard.USER32 ref: 004073E3
EmptyClipboard.USER32 ref: 004073EA
GlobalAlloc.KERNEL32 ref: 004073FB

Part of subcall function 00404A86: SendMessageA.USER32 ref: 00404AAB

GlobalLock.KERNEL32(00000001), ref: 00407408
SendMessageA.USER32 ref: 00407439
GlobalUnlock.KERNEL32 ref: 00407457
SetClipboardData.USER32(00000000), ref: 00407469
CloseClipboard.USER32 ref: 00407471

Strings

Pandora FMS Agent 7.0NG.777.1 Setup, xrefs: 0040739B

Memory Dump Source

Source File: 00000000.00000002.4162233942.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4162209415.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162259880.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162282586.000000000040B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.000000000045B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.0000000000483000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PandoraFMS_One_Agent_Windows-lts.jbxd

Similarity

API ID: MessageSend$Window$ClipboardShow$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleItemLockMetricsOpenSystemThreadTrackUnlock
String ID: Pandora FMS Agent 7.0NG.777.1 Setup
API String ID: 1085758737-3452433673
Opcode ID: 25d348634834151432b54fdb596b7f303cc37177b6efe9d9cc04adb1a8260883
Instruction ID: 49c7b1b4b1f97c7edd1c7ce86704a302a6a03c20b73fff38b97e2b4f4d48fb51
Opcode Fuzzy Hash: 25d348634834151432b54fdb596b7f303cc37177b6efe9d9cc04adb1a8260883
Instruction Fuzzy Hash: D2F1C1B0808305AFD710EF68D98866EBFF4FB84314F01892EE899A7391D7799845CF56

Function 00DB1BCC Relevance: 56.3, APIs: 21, Strings: 11, Instructions: 268
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 00DB1BE6
HeapAlloc.KERNEL32 ref: 00DB1BF7
GetProcessHeap.KERNEL32(?), ref: 00DB1C93
HeapFree.KERNEL32 ref: 00DB1FCE

Part of subcall function 00DB23EF: GlobalAlloc.KERNEL32 ref: 00DB2412
Part of subcall function 00DB23EF: lstrcpynA.KERNEL32 ref: 00DB2432

Strings

0, xrefs: 00DB1F6C
BUTTON, xrefs: 00DB1CE6, 00DB1EA7
RICHEDIT_CLASS, xrefs: 00DB1DAB
COMBOBOX, xrefs: 00DB1D36
error, xrefs: 00DB1C0A, 00DB1C86
RichEdit, xrefs: 00DB1D86
LISTBOX, xrefs: 00DB1D5E
LINK, xrefs: 00DB1DF5, 00DB1E63
NSIS: nsControl pointer property, xrefs: 00DB1F1D
STATIC, xrefs: 00DB1DD0
EDIT, xrefs: 00DB1D0E

Memory Dump Source

Source File: 00000000.00000002.4163042955.0000000000DB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.4163017212.0000000000DB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.4163067709.0000000000DB3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.4163092635.0000000000DB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.4163118887.0000000000DB7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.4163144543.0000000000DB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_PandoraFMS_One_Agent_Windows-lts.jbxd

Similarity

API ID: Heap$AllocProcess$FreeGloballstrcpyn
String ID: 0$BUTTON$COMBOBOX$EDIT$LINK$LISTBOX$NSIS: nsControl pointer property$RICHEDIT_CLASS$RichEdit$STATIC$error
API String ID: 1913068523-2191183267
Opcode ID: eaa3bf1f783b890188824ca9f9c04665baf6cb1dc56847890d5241e7452447d7
Instruction ID: 21373395b53b4b40d12eb3e743df7c46e3c0cc4158277714235d60529d37af60
Opcode Fuzzy Hash: eaa3bf1f783b890188824ca9f9c04665baf6cb1dc56847890d5241e7452447d7
Instruction Fuzzy Hash: F3C1D4B4908304DFD710EFA9D984AAEBBF4EF88700F40892DE88997314D774D9459FA2

Function 00404167 Relevance: 54.6, APIs: 21, Strings: 10, Instructions: 398
comfilestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE ref: 0040417A
GetVersion.KERNEL32 ref: 00404181
lstrlenA.KERNEL32 ref: 004041BE
InitCommonControls.COMCTL32(?,UXTHEME), ref: 004041EA
OleInitialize.OLE32 ref: 004041F7
SHGetFileInfoA.SHELL32 ref: 0040422C
GetCommandLineA.KERNEL32(00000000,00000000), ref: 0040424B
GetModuleHandleA.KERNEL32(00000000,00000000), ref: 0040426A
CharNextA.USER32 ref: 004042A3

Part of subcall function 00408089: GetModuleHandleA.KERNEL32(?,?,004041D7), ref: 0040809E
Part of subcall function 00408089: GetProcAddress.KERNEL32 ref: 004080CA

GetTempPathA.KERNEL32(00000001,00000001), ref: 00404361
DeleteFileA.KERNELBASE ref: 0040437F
GetWindowsDirectoryA.KERNEL32 ref: 004043A8
OleUninitialize.OLE32(?,00000000), ref: 0040460E
ExitProcess.KERNEL32 ref: 0040479E

Part of subcall function 00407694: CharNextA.USER32 ref: 004076AE

GetCurrentProcess.KERNEL32(?,?,00000000,?,00000000), ref: 00404693
ExitWindowsEx.USER32 ref: 00404745

Part of subcall function 00407AA6: lstrcpynA.KERNEL32(?,?,?,?,?,?,00404249), ref: 00407AC1

Part of subcall function 00405EED: lstrcmpiA.KERNEL32 ref: 0040606B
Part of subcall function 00405EED: GetFileAttributesA.KERNEL32 ref: 0040607A

Strings

"C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe", xrefs: 00404251, 00404286, 004043EE, 004043FC
Error launching installer, xrefs: 00404421, 00404517
UXTHEME, xrefs: 004041A8, 004041D7
%, xrefs: 0040475B
/D=, xrefs: 0040430C
Error writing temporary file. Make sure your temp folder is valid., xrefs: 004043CF
(, xrefs: 0040469F
_?=, xrefs: 00404403
NCRC, xrefs: 004042F2
Pandora FMS Agent 7.0NG.777.1 Setup, xrefs: 0040423D

Memory Dump Source

Source File: 00000000.00000002.4162233942.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4162209415.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162259880.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162282586.000000000040B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.000000000045B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.0000000000483000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PandoraFMS_One_Agent_Windows-lts.jbxd

Similarity

API ID: File$CharExitHandleModuleNextProcessWindows$AddressAttributesCommandCommonControlsCurrentDeleteDirectoryErrorInfoInitInitializeLineModePathProcTempUninitializeVersionlstrcmpilstrcpynlstrlen
String ID: /D=$ _?=$"C:\Users\user\Desktop\PandoraFMS_One_Agent_Windows-lts.x86_64.exe"$%$($Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$NCRC$Pandora FMS Agent 7.0NG.777.1 Setup$UXTHEME
API String ID: 3796326152-3126813970
Opcode ID: 16e2d105e1e81dca3616bae2cf266dd5659bcaed10084d06e587fe896da9ccc2
Instruction ID: eb74305c9b10c5c00dffd21d6ef9cb394942a1f4084aa912111b1a794379fd43
Opcode Fuzzy Hash: 16e2d105e1e81dca3616bae2cf266dd5659bcaed10084d06e587fe896da9ccc2
Instruction Fuzzy Hash: 7AF152F0908305AFD310AF65C94872FBAE4EF85704F05987EE9C4A7291D7BD88458B6B

Function 00405A34 Relevance: 23.1, APIs: 9, Strings: 4, Instructions: 327
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32 ref: 00405A9A
SetWindowTextA.USER32 ref: 00405AD6
SHAutoComplete.SHLWAPI ref: 00405B47

Part of subcall function 004075F5: GetDlgItemTextA.USER32 ref: 00407619

Part of subcall function 00407B27: CharNextA.USER32(?,?,?,?,?,?,00000000,?,?,?,004040DE), ref: 00407B8F
Part of subcall function 00407B27: CharNextA.USER32(?,?,?,?,?,00000000,?,?,?,004040DE), ref: 00407BAE
Part of subcall function 00407B27: CharNextA.USER32(?,?,?,00000000,?,?,?,004040DE), ref: 00407BBA
Part of subcall function 00407B27: CharPrevA.USER32(?,?,00000000,?,?,?,004040DE), ref: 00407BD5

GetDiskFreeSpaceExA.KERNELBASE(?,?,?,?,00000000,00000000), ref: 00405D29
GetDiskFreeSpaceA.KERNEL32(00000000,?,?,?,?,?,?,00000000,00000000), ref: 00405D9C
MulDiv.KERNEL32 ref: 00405DC2

Strings

The agent group name is required, xrefs: 00405C2E, 00405C41
A, xrefs: 00405BD1
C:\Program Files\, xrefs: 00405CBD, 00405CE6, 00405CF4, 00405D10, 00405D56, 00405D6C, 00405D7A
Pandora FMS Agent 7.0NG.777.1 Setup, xrefs: 00405BB0, 00405C26

Memory Dump Source

Source File: 00000000.00000002.4162233942.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4162209415.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162259880.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162282586.000000000040B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.000000000045B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.0000000000483000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PandoraFMS_One_Agent_Windows-lts.jbxd

Similarity

API ID: Char$Next$DiskFreeItemSpaceText$AutoCompletePrevWindow
String ID: A$C:\Program Files\$Pandora FMS Agent 7.0NG.777.1 Setup$The agent group name is required
API String ID: 1185163393-1257382930
Opcode ID: bc669f08d38e00ed445a01ca0662e1a51689882b3815cdbc4e4efe51941f4daf
Instruction ID: 50933381639441572775808517c91c7d5cd6498f4c29c03278e00cac73b22eed
Opcode Fuzzy Hash: bc669f08d38e00ed445a01ca0662e1a51689882b3815cdbc4e4efe51941f4daf
Instruction Fuzzy Hash: 18D10AB0908705AFDB10AF69C58466FBBF4FF44314F01893EE888A7391D77899458F5A

Function 004083A8 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 192
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileA.KERNELBASE ref: 004083C9
lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00408464
FindFirstFileA.KERNEL32 ref: 00408484
FindNextFileA.KERNEL32(?,?,?,?,?,?,?,00000000,00000000), ref: 0040858C
FindClose.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 0040859F

Strings

?, xrefs: 0040849D

Memory Dump Source

Source File: 00000000.00000002.4162233942.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4162209415.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162259880.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162282586.000000000040B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.000000000045B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.0000000000483000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PandoraFMS_One_Agent_Windows-lts.jbxd

Similarity

API ID: FileFind$CloseDeleteFirstNextlstrlen
String ID: ?
API String ID: 3200608346-1684325040
Opcode ID: f38dab7ad5a18fd262bbf36a96acdf371c0faf3aad6a8aed571961b49b276aa8
Instruction ID: 0b1800b3c3c92838a6642b0624ead7eb0a374eaa8f440694a798770d669b91d1
Opcode Fuzzy Hash: f38dab7ad5a18fd262bbf36a96acdf371c0faf3aad6a8aed571961b49b276aa8
Instruction Fuzzy Hash: 447157B0808745AED710AF25CD44BAEBBF8EF45714F05997EE4C5A7282DB3D8844CB1A

Function 00407F13 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 19fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNELBASE ref: 00407F27
FindClose.KERNEL32 ref: 00407F39

Strings

@=C, xrefs: 00407F40
@=C, xrefs: 00407F1C

Memory Dump Source

Source File: 00000000.00000002.4162233942.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4162209415.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162259880.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162282586.000000000040B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.000000000045B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.0000000000483000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PandoraFMS_One_Agent_Windows-lts.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: @=C$@=C
API String ID: 2295610775-2754048464
Opcode ID: 2bfd9462e1cbc59ee4524f8163dbe6c09f6051e8e628da1b15a5deab74850d34
Instruction ID: fd1819d0dc8791f7f0960ff396f270f12c07c9b33f1db7e237ffee342856c2a2
Opcode Fuzzy Hash: 2bfd9462e1cbc59ee4524f8163dbe6c09f6051e8e628da1b15a5deab74850d34
Instruction Fuzzy Hash: 00E012B15043006FC700AF7C9C4841BBAE9AB84B25F14D53DB995CB390DB3CD8518799

Function 00402988 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 160comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32 ref: 00402A22
MultiByteToWideChar.KERNEL32(00000000), ref: 00402B6F

Strings

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PandoraFMS_Agent_v7.0NG.777.1\README.lnk, xrefs: 00402B4C, 00402B8C

Memory Dump Source

Source File: 00000000.00000002.4162233942.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4162209415.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162259880.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162282586.000000000040B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.000000000045B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.0000000000483000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PandoraFMS_One_Agent_Windows-lts.jbxd

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PandoraFMS_Agent_v7.0NG.777.1\README.lnk
API String ID: 123533781-979741191
Opcode ID: 925994f22ea13129775b72d8296ddd030c081ccbde0db1921cdb94c616346c40
Instruction ID: fc97ed377ac8ae46bcbdcee05bf509fc8879884bc4961f0e359422effc0f113a
Opcode Fuzzy Hash: 925994f22ea13129775b72d8296ddd030c081ccbde0db1921cdb94c616346c40
Instruction Fuzzy Hash: A4612CB09087119FD710EF69C9886AABBF4FF48314F008AADE58897391D7749885CF55

Function 00404DDD Relevance: 56.5, APIs: 30, Strings: 2, Instructions: 461
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32 ref: 00404E2C
GetDlgItem.USER32(?,?), ref: 00404E40
SetClassLongA.USER32 ref: 00404E78
SendMessageA.USER32 ref: 00404F05
GetDlgItem.USER32 ref: 00404FBA
ShowWindow.USER32 ref: 00404FE6
KiUserCallbackDispatcher.NTDLL(00000000,00000000), ref: 00405008
KiUserCallbackDispatcher.NTDLL(00000000,00000000), ref: 0040502C
EnableMenuItem.USER32(?,?), ref: 0040505F
SendMessageA.USER32 ref: 0040508C
SendMessageA.USER32 ref: 004050BA
SetWindowTextA.USER32 ref: 00405111
SetWindowPos.USER32 ref: 00405388

Part of subcall function 00403845: MulDiv.KERNEL32 ref: 004038C0
Part of subcall function 00403845: SendMessageA.USER32 ref: 004038E0

DestroyWindow.USER32 ref: 00405172
EndDialog.USER32 ref: 0040518F

Strings

Pandora FMS Agent 7.0NG.777.1 Setup, xrefs: 004050D5, 004050E6, 004050F3, 00405106
Pandora FMS Agent 7.0NG.777.1 Setup, xrefs: 004050CD

Memory Dump Source

Source File: 00000000.00000002.4162233942.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4162209415.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162259880.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162282586.000000000040B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.000000000045B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.0000000000483000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PandoraFMS_One_Agent_Windows-lts.jbxd

Similarity

API ID: ItemMessageSendWindow$CallbackDispatcherUser$ClassDestroyDialogEnableLongMenuShowText
String ID: Pandora FMS Agent 7.0NG.777.1 Setup$Pandora FMS Agent 7.0NG.777.1 Setup
API String ID: 1385508163-3158380625
Opcode ID: 5806da81ce91792c391f69b538ee8f59b76048d0b74514085517e7a4e7cb337c
Instruction ID: c751d76a42d38eac7d7d2fbd7e62f42486d07c1e0712d5779d85113246baba5d
Opcode Fuzzy Hash: 5806da81ce91792c391f69b538ee8f59b76048d0b74514085517e7a4e7cb337c
Instruction Fuzzy Hash: EC12FCF0808701EFD710AF68D98876BBBF4EB84315F11992EE98497390D7B89844DF5A

Function 004055A5 Relevance: 33.5, APIs: 17, Strings: 2, Instructions: 246
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CheckDlgButton.USER32 ref: 0040565C
GetDlgItem.USER32 ref: 0040567F
SendMessageA.USER32(00000000,?), ref: 004056B3
GetSysColor.USER32 ref: 004056C9
SendMessageA.USER32 ref: 004056E7
SendMessageA.USER32 ref: 00405707
SendMessageA.USER32 ref: 00405736
SendMessageA.USER32 ref: 00405755
GetDlgItem.USER32 ref: 004057AE
SendMessageA.USER32 ref: 004057D1
GetDlgItem.USER32 ref: 00405812
SendMessageA.USER32 ref: 0040586F
SetCursor.USER32 ref: 0040589D
ShellExecuteA.SHELL32 ref: 004058CD
SetCursor.USER32 ref: 004058EF
SendMessageA.USER32 ref: 0040592A
SendMessageA.USER32 ref: 0040595E

Strings

The agent group name is required, xrefs: 0040583A
#, xrefs: 00405630

Memory Dump Source

Source File: 00000000.00000002.4162233942.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4162209415.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162259880.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162282586.000000000040B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.000000000045B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.0000000000483000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PandoraFMS_One_Agent_Windows-lts.jbxd

Similarity

API ID: MessageSend$Item$Cursor$ButtonCheckColorExecuteShell
String ID: #$The agent group name is required
API String ID: 3348721118-989462616
Opcode ID: f7a3d64372b7d8bde8e7adad68eba0ab3536f607a6f6adde86479ffdd78ee6fe
Instruction ID: 05f5593a509bd663a9e4b5bdd9f7dfbe71385a192a08d6ac50d5965b98471ac6
Opcode Fuzzy Hash: f7a3d64372b7d8bde8e7adad68eba0ab3536f607a6f6adde86479ffdd78ee6fe
Instruction Fuzzy Hash: 99B1E6B0908705AFDB00EF69D58876EBBF0FB44314F00892EE99997391D7789844CF96

Function 00405EED Relevance: 26.5, APIs: 11, Strings: 4, Instructions: 253
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00408089: GetModuleHandleA.KERNEL32(?,?,004041D7), ref: 0040809E
Part of subcall function 00408089: GetProcAddress.KERNEL32 ref: 004080CA

lstrcmpiA.KERNEL32 ref: 0040606B
GetFileAttributesA.KERNEL32 ref: 0040607A

Part of subcall function 004079D3: wsprintfA.USER32 ref: 004079EE

LoadImageA.USER32(?,?,00000000,00000000), ref: 00406107
RegisterClassA.USER32 ref: 00406151
SystemParametersInfoA.USER32 ref: 00406182
CreateWindowExA.USER32 ref: 004061E7
ShowWindow.USER32 ref: 0040622E
GetClassInfoA.USER32(?,00000000), ref: 00406271
GetClassInfoA.USER32 ref: 00406291
RegisterClassA.USER32 ref: 004062A7
DialogBoxParamA.USER32 ref: 004062DD

Strings

The agent group name is required, xrefs: 00405FF6, 00406018, 0040602A, 004060AC, 004060AD
Pandora FMS Agent 7.0NG.777.1 Setup, xrefs: 00405F2E, 00405F5F, 00405F70, 00405F97
_Nb, xrefs: 00406128
g, xrefs: 004060FC

Memory Dump Source

Source File: 00000000.00000002.4162233942.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4162209415.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162259880.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162282586.000000000040B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.000000000045B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.0000000000483000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PandoraFMS_One_Agent_Windows-lts.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcmpiwsprintf
String ID: Pandora FMS Agent 7.0NG.777.1 Setup$The agent group name is required$_Nb$g
API String ID: 3995538257-263436448
Opcode ID: a1fe59d6cbcf6897000ab74353cfe111201098247bf4fbf17288a58c0d9973a7
Instruction ID: dcf3d0c3349278bc68356ae28d9a2fc86fcef50f5e41ea6b43324dcf94f26e8c
Opcode Fuzzy Hash: a1fe59d6cbcf6897000ab74353cfe111201098247bf4fbf17288a58c0d9973a7
Instruction Fuzzy Hash: 30B1F6B0808305AFD710AF69D94472FBBE4EF44308F01992EE8D9A7291D7BD94448F9A

Function 00403DB2 Relevance: 19.4, APIs: 5, Strings: 6, Instructions: 193
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00403DBB
GetModuleFileNameA.KERNEL32(?,?,?,?,00000000,?,74DF3160,?,0040438C,00000000), ref: 00403DE2

Part of subcall function 00407868: GetFileAttributesA.KERNELBASE ref: 00407875
Part of subcall function 00407868: CreateFileA.KERNELBASE(?,?,?,?,?,?,?,?,?,?,00000000,?,00403E07), ref: 004078B4

Part of subcall function 00407AA6: lstrcpynA.KERNEL32(?,?,?,?,?,?,00404249), ref: 00407AC1

Part of subcall function 004076BE: lstrlenA.KERNEL32 ref: 004076CB
Part of subcall function 004076BE: CharPrevA.USER32 ref: 004076E0

GetFileSize.KERNEL32(74DF3160,74DF3160,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00403E5F

Part of subcall function 00403A7D: ReadFile.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00403B47), ref: 00403AA9

GlobalAlloc.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,74DF3160), ref: 00404010
SetFilePointer.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00404097

Part of subcall function 004039E1: DestroyWindow.USER32 ref: 004039F9

Strings

Null, xrefs: 00403F1D
Error launching installer, xrefs: 00403E14
soft, xrefs: 00403F14
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error, xrefs: 00403FF8
@, xrefs: 004040A3
Inst, xrefs: 00403F0B

Memory Dump Source

Source File: 00000000.00000002.4162233942.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4162209415.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162259880.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162282586.000000000040B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.000000000045B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.0000000000483000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PandoraFMS_One_Agent_Windows-lts.jbxd

Similarity

API ID: File$AllocAttributesCharCountCreateDestroyGlobalModuleNamePointerPrevReadSizeTickWindowlstrcpynlstrlen
String ID: @$Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error$Null$soft
API String ID: 2393166194-693753142
Opcode ID: 059f8bdd00346d24186a84b23d6a6c8312db8ac0fb8c52d8f76367e301e78c20
Instruction ID: 485a20e40ad0c1c467606b95e4aeff4f213eeaa5736fc5abe555033e036e0a0c
Opcode Fuzzy Hash: 059f8bdd00346d24186a84b23d6a6c8312db8ac0fb8c52d8f76367e301e78c20
Instruction Fuzzy Hash: B18159B0808305AFDB10AF69D58975EBFF4FB80349F11893EE984A7290D7798944CF5A

Function 00407BF6 Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 236
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(?,?), ref: 00407CD6
GetVersion.KERNEL32 ref: 00407D15
GetSystemDirectoryA.KERNEL32 ref: 00407DB6
GetWindowsDirectoryA.KERNEL32 ref: 00407DDC
SHGetSpecialFolderLocation.SHELL32 ref: 00407E08
SHGetPathFromIDListA.SHELL32 ref: 00407E63
CoTaskMemFree.OLE32 ref: 00407E74

Part of subcall function 004079D3: wsprintfA.USER32 ref: 004079EE

Strings

The agent group name is required, xrefs: 00407C17, 00407C21, 00407C42, 00407CF0, 00407CFE
., xrefs: 00407D31

Memory Dump Source

Source File: 00000000.00000002.4162233942.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4162209415.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162259880.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162282586.000000000040B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.000000000045B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.0000000000483000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PandoraFMS_One_Agent_Windows-lts.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskVersionWindowslstrlenwsprintf
String ID: .$The agent group name is required
API String ID: 3880481140-1930598983
Opcode ID: 626b9dde99611f96630d4a920575274c5aca16d6444f8a4f6d5701c3e652136e
Instruction ID: f7814a4fa3dfb8eebec29bc577ef516e180b647921a8881e017fb00342220db3
Opcode Fuzzy Hash: 626b9dde99611f96630d4a920575274c5aca16d6444f8a4f6d5701c3e652136e
Instruction Fuzzy Hash: 55918FB1D0D2559FDB209F68C8806AEBBF4BF48304F14847EE494A7381D338A841DB9B

Function 00DB1A41 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 93
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32 ref: 00DB1A97
GetWindowRect.USER32 ref: 00DB1AA6
MapWindowPoints.USER32(00000000,00000000), ref: 00DB1AC5
CreateDialogParamA.USER32 ref: 00DB1AF2
SetWindowPos.USER32 ref: 00DB1B48
SetWindowLongA.USER32 ref: 00DB1B64
GetProcessHeap.KERNEL32 ref: 00DB1B86
HeapAlloc.KERNEL32 ref: 00DB1B9F

Part of subcall function 00DB23EF: GlobalAlloc.KERNEL32 ref: 00DB2412
Part of subcall function 00DB23EF: lstrcpynA.KERNEL32 ref: 00DB2432

Strings

error, xrefs: 00DB1B04

Memory Dump Source

Source File: 00000000.00000002.4163042955.0000000000DB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.4163017212.0000000000DB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.4163067709.0000000000DB3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.4163092635.0000000000DB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.4163118887.0000000000DB7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.4163144543.0000000000DB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_PandoraFMS_One_Agent_Windows-lts.jbxd

Similarity

API ID: Window$AllocHeap$CreateDialogGlobalItemLongParamPointsProcessRectlstrcpyn
String ID: error
API String ID: 1928716940-1574812785
Opcode ID: 9aad2bfbb3415bcb33827fe1a137bbaa4ea9c02016a1d22b5b610bb27e8faba4
Instruction ID: fff39973830e9b81d34ce5f90b50fa07e75b1a91138f6116145993a0f73b5a25
Opcode Fuzzy Hash: 9aad2bfbb3415bcb33827fe1a137bbaa4ea9c02016a1d22b5b610bb27e8faba4
Instruction Fuzzy Hash: E9419DB5808704DFD700EF68E98879ABBF4FB88354F408A1DE889D7364D77594488FA6

Function 00DB218A Relevance: 12.1, APIs: 8, Instructions: 65
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SendMessageA.USER32 ref: 00DB21B5
ShowWindow.USER32 ref: 00DB21CE
KiUserCallbackDispatcher.NTDLL ref: 00DB21FA
IsDialogMessageA.USER32 ref: 00DB2215
IsDialogMessageA.USER32 ref: 00DB2229
TranslateMessage.USER32 ref: 00DB2234
DispatchMessageA.USER32(00000000), ref: 00DB223E
SetWindowLongA.USER32 ref: 00DB225B

Memory Dump Source

Source File: 00000000.00000002.4163042955.0000000000DB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.4163017212.0000000000DB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.4163067709.0000000000DB3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.4163092635.0000000000DB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.4163118887.0000000000DB7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.4163144543.0000000000DB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_PandoraFMS_One_Agent_Windows-lts.jbxd

Similarity

API ID: Message$DialogWindow$CallbackDispatchDispatcherLongSendShowTranslateUser
String ID:
API String ID: 4159918924-0
Opcode ID: 102ade7be5c0b8850a5001b688c8f9c28a94538ac82eb0667414446cd899c4cb
Instruction ID: 8a1f60dab2d4c0c27c3389a8fe4beef03aab912d01d732bdec4e7a324f0d8c77
Opcode Fuzzy Hash: 102ade7be5c0b8850a5001b688c8f9c28a94538ac82eb0667414446cd899c4cb
Instruction Fuzzy Hash: 0C21B5B1809704EFD700AF69E988B6ABBF4FB84744F018A1DF985C7350E77498448BA6

Function 00403AF7 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 186
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00403B62
MulDiv.KERNEL32 ref: 00403C69
wsprintfA.USER32 ref: 00403C87
WriteFile.KERNELBASE(00000000,00000000), ref: 00403CD4

Part of subcall function 00403AC5: SetFilePointer.KERNELBASE ref: 00403AEA

Strings

d, xrefs: 00403C57

Memory Dump Source

Source File: 00000000.00000002.4162233942.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4162209415.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162259880.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162282586.000000000040B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.000000000045B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.0000000000483000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PandoraFMS_One_Agent_Windows-lts.jbxd

Similarity

API ID: File$CountPointerTickWritewsprintf
String ID: d
API String ID: 525128815-2564639436
Opcode ID: c66ba6d3189ae84549c3526c7db8e10c11fd0718d577fcddd028653b7f00e62e
Instruction ID: 81e4adff5a5540c60624bdb037fd79efe9836bde96949377459c037f7e0969f7
Opcode Fuzzy Hash: c66ba6d3189ae84549c3526c7db8e10c11fd0718d577fcddd028653b7f00e62e
Instruction Fuzzy Hash: F07135B1A083189FDB10DFA9D98466EBBF8FF84705F10853EE858A7390D73899458F49

Function 00403491 Relevance: 10.6, APIs: 7, Instructions: 132
filememoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileA.KERNEL32(74DF05F0), ref: 004034EF
GlobalAlloc.KERNELBASE ref: 0040351C
CloseHandle.KERNEL32 ref: 00403653

Part of subcall function 00403AC5: SetFilePointer.KERNELBASE ref: 00403AEA

Part of subcall function 00403A7D: ReadFile.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00403B47), ref: 00403AA9

GlobalAlloc.KERNEL32(00000000,00000000,00000000), ref: 00403561
GlobalFree.KERNEL32 ref: 004035D6
WriteFile.KERNELBASE ref: 00403606
GlobalFree.KERNELBASE ref: 00403612

Part of subcall function 00403AF7: GetTickCount.KERNEL32 ref: 00403B62
Part of subcall function 00403AF7: MulDiv.KERNEL32 ref: 00403C69
Part of subcall function 00403AF7: wsprintfA.USER32 ref: 00403C87

Memory Dump Source

Source File: 00000000.00000002.4162233942.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4162209415.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162259880.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162282586.000000000040B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.000000000045B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.0000000000483000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PandoraFMS_One_Agent_Windows-lts.jbxd

Similarity

API ID: FileGlobal$AllocFree$CloseCountDeleteHandlePointerReadTickWritewsprintf
String ID:
API String ID: 3668496186-0
Opcode ID: 61638a83f5c90cb0c6e547c9dfb278eb43bfb33e0155546a5027b14609c085c7
Instruction ID: 130394bcdb93704e2bf1dadb98659cc31cff70cb4eba6e4357c8c30b01566d60
Opcode Fuzzy Hash: 61638a83f5c90cb0c6e547c9dfb278eb43bfb33e0155546a5027b14609c085c7
Instruction Fuzzy Hash: EB510CB19087019FD710EF29C844B6AFBF4AF88314F01896EF498A7391E7399981CF56

Function 00401B06 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 185
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CompareFileTime.KERNEL32(?,00000000), ref: 00401BA1

Part of subcall function 00407AA6: lstrcpynA.KERNEL32(?,?,?,?,?,?,00404249), ref: 00407AC1

Part of subcall function 00407626: MessageBoxIndirectA.USER32 ref: 00407689

Part of subcall function 00406DBB: SetWindowTextA.USER32 ref: 00406E51
Part of subcall function 00406DBB: SendMessageA.USER32 ref: 00406E91
Part of subcall function 00406DBB: SendMessageA.USER32 ref: 00406EBF
Part of subcall function 00406DBB: SendMessageA.USER32 ref: 00406EDE

Strings

C:\Users\user\AppData\Local\Temp\nsiBE5B.tmp\System.dll, xrefs: 00401C59, 00401C87
Call, xrefs: 00401B2F, 00401B45, 00401B6A, 00401B7C, 00401BBE, 00401BE7, 00401C3D, 00401CB5, 00401D66, 00401D78, 00401D8E, 00401DA4

Memory Dump Source

Source File: 00000000.00000002.4162233942.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4162209415.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162259880.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162282586.000000000040B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.000000000045B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.0000000000483000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PandoraFMS_One_Agent_Windows-lts.jbxd

Similarity

API ID: Message$Send$CompareFileIndirectTextTimeWindowlstrcpyn
String ID: C:\Users\user\AppData\Local\Temp\nsiBE5B.tmp\System.dll$Call
API String ID: 645384303-2260928074
Opcode ID: b0df0291a9070bbb4d2ac7a6184e9e6745ad714c47b761d9512c75da916e61c5
Instruction ID: 2d2fd0f640650eb3c35c22094d486e88ecc348134081fa4b8d4fc57698f19ca0
Opcode Fuzzy Hash: b0df0291a9070bbb4d2ac7a6184e9e6745ad714c47b761d9512c75da916e61c5
Instruction Fuzzy Hash: 806150B0908701AED710BF65C945A6FBAF8EF44714F118A2FF4D4A3291D7BC98819B1B

Function 00406DBB Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 86windowCOMMON

Download Yara Rule

APIs

SetWindowTextA.USER32 ref: 00406E51
SendMessageA.USER32 ref: 00406E91
SendMessageA.USER32 ref: 00406EBF
SendMessageA.USER32 ref: 00406EDE

Strings

Skipped: C:\Users\user\AppData\Local\Temp\nsiBE5B.tmp\System.dll, xrefs: 00406DE2, 00406DF4, 00406E27, 00406E46, 00406E6F

Memory Dump Source

Source File: 00000000.00000002.4162233942.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4162209415.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162259880.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162282586.000000000040B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.000000000045B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.0000000000483000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PandoraFMS_One_Agent_Windows-lts.jbxd

Similarity

API ID: MessageSend$TextWindow
String ID: Skipped: C:\Users\user\AppData\Local\Temp\nsiBE5B.tmp\System.dll
API String ID: 1596935084-1377648789
Opcode ID: 7f77599a27076a50306d64517219d7e9aaea05d32a1fadf2d7d14ff907811c50
Instruction ID: 1465eee4a19d2b0a462d5854eefcbc7eed4554794f3d063c3fee55a466b1f068
Opcode Fuzzy Hash: 7f77599a27076a50306d64517219d7e9aaea05d32a1fadf2d7d14ff907811c50
Instruction Fuzzy Hash: A1313BB1D08304ABDB10AFA9C44879EBBF4EF84754F05C82EE8889B340D7789854CF96

Function 00402860 Relevance: 7.6, APIs: 5, Instructions: 92libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryExA.KERNELBASE ref: 004028A3
GetModuleHandleA.KERNELBASE ref: 004028BB
GetProcAddress.KERNEL32 ref: 004028CF
KiUserCallbackDispatcher.NTDLL ref: 00402927
FreeLibrary.KERNELBASE(00000000), ref: 00402965

Memory Dump Source

Source File: 00000000.00000002.4162233942.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4162209415.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162259880.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162282586.000000000040B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.000000000045B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.0000000000483000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PandoraFMS_One_Agent_Windows-lts.jbxd

Similarity

API ID: Library$AddressCallbackDispatcherFreeHandleLoadModuleProcUser
String ID:
API String ID: 2164570674-0
Opcode ID: 304363fbe489e1a9be6b7d21d99f627d145809fd3dec65ab09b55abc88bcafee
Instruction ID: b3b58c58da4d34fb64e348894598cc2978b341e5b4db3fa9d57455c3f14ebc65
Opcode Fuzzy Hash: 304363fbe489e1a9be6b7d21d99f627d145809fd3dec65ab09b55abc88bcafee
Instruction Fuzzy Hash: BB3181B16083009FD3106F25894876FBAE8BB84754F11893FF495A33D0D7798846DB1A

Function 6E5C3231 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32 ref: 6E5C32FE
FreeLibrary.KERNEL32 ref: 6E5C3380
GlobalFree.KERNEL32 ref: 6E5C33A9

Part of subcall function 6E5C2BA2: GlobalAlloc.KERNEL32 ref: 6E5C2BE1

Strings

, xrefs: 6E5C3387

Memory Dump Source

Source File: 00000000.00000002.4163482141.000000006E5C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6E5C0000, based on PE: true

Associated: 00000000.00000002.4163465602.000000006E5C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4163502457.000000006E5C6000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4163520313.000000006E5C8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4163537978.000000006E5C9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4163555114.000000006E5CC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e5c0000_PandoraFMS_One_Agent_Windows-lts.jbxd

Similarity

API ID: FreeGlobal$AllocLibrary
String ID:
API String ID: 2026276162-3916222277
Opcode ID: e50a3df83c9c9d396becf93056ff62442dc811a5dd6735ca0dfafcc189cc6d06
Instruction ID: d2d0d13964b77b9e941d5dc559994bc9f9487aa14ea101d7f24345dfc97b0a17
Opcode Fuzzy Hash: e50a3df83c9c9d396becf93056ff62442dc811a5dd6735ca0dfafcc189cc6d06
Instruction Fuzzy Hash: 16412D70104A09CBDB40AFE4C9AC6A97BE8FF45F08F058CADD9948B255DB749486CB93

Function 004021E3 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 93windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutA.USER32 ref: 00402294
SendMessageA.USER32 ref: 004022BE

Strings

!, xrefs: 00402231

Memory Dump Source

Source File: 00000000.00000002.4162233942.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4162209415.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162259880.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162282586.000000000040B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.000000000045B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.0000000000483000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PandoraFMS_One_Agent_Windows-lts.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 40388564f909119710120cef62e952463421c5c53386c7a56e5f6cb966679a26
Instruction ID: 06e4065d49d095f77ad9425923b4761041be1df8d1ba028cdb5a98dba015adb3
Opcode Fuzzy Hash: 40388564f909119710120cef62e952463421c5c53386c7a56e5f6cb966679a26
Instruction Fuzzy Hash: EA4132B18083159FD714AF6AC84539EFBF4AF84345F11C4AEF489A3291D7788981CF56

Function 00402613 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00406DBB: SetWindowTextA.USER32 ref: 00406E51
Part of subcall function 00406DBB: SendMessageA.USER32 ref: 00406E91
Part of subcall function 00406DBB: SendMessageA.USER32 ref: 00406EBF
Part of subcall function 00406DBB: SendMessageA.USER32 ref: 00406EDE

Part of subcall function 00407569: CreateProcessA.KERNELBASE ref: 004075C6
Part of subcall function 00407569: CloseHandle.KERNEL32 ref: 004075DB

WaitForSingleObject.KERNEL32 ref: 00402661
GetExitCodeProcess.KERNELBASE ref: 00402688

Part of subcall function 00408638: PeekMessageA.USER32 ref: 00408668
Part of subcall function 00408638: DispatchMessageA.USER32 ref: 00408674

CloseHandle.KERNELBASE ref: 004026C8

Strings

d, xrefs: 00402656

Memory Dump Source

Source File: 00000000.00000002.4162233942.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4162209415.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162259880.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162282586.000000000040B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.000000000045B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.0000000000483000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PandoraFMS_One_Agent_Windows-lts.jbxd

Similarity

API ID: Message$Send$CloseHandleProcess$CodeCreateDispatchExitObjectPeekSingleTextWaitWindow
String ID: d
API String ID: 3753073698-2564639436
Opcode ID: 5e4665b6b7fedc1ef13a96b95e587289213e731baef5cd124458f6640e3bf6c2
Instruction ID: 341f0019eac798eba97503d0cc358f98f06cceaaddc433da9f359427ade5de81
Opcode Fuzzy Hash: 5e4665b6b7fedc1ef13a96b95e587289213e731baef5cd124458f6640e3bf6c2
Instruction Fuzzy Hash: F72181B1508300DFD750AF25CD88BAEB7E5EB84315F11887EF489A3380D6795981CF2A

Function 0040792A Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 50registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,The agent group name is required,?,00407D89), ref: 00407964
RegQueryValueExA.KERNELBASE ref: 0040799F
RegCloseKey.KERNELBASE ref: 004079C5

Strings

The agent group name is required, xrefs: 0040792D

Memory Dump Source

Source File: 00000000.00000002.4162233942.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4162209415.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162259880.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162282586.000000000040B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.000000000045B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.0000000000483000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PandoraFMS_One_Agent_Windows-lts.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: The agent group name is required
API String ID: 3677997916-4148607786
Opcode ID: b60c37829d9ea3b0f8dd51353dea047c2196d4c71068be0f0c58ced7d000753a
Instruction ID: 3ff7b6bf0a91014e0cdb82914d3ac24b39519e99ef6d997070f847f5e25f1e30
Opcode Fuzzy Hash: b60c37829d9ea3b0f8dd51353dea047c2196d4c71068be0f0c58ced7d000753a
Instruction Fuzzy Hash: 9F11C6B090830ADFDB00DF68C58479EBBF4EB49704F00886AE894E7341E775D9148BA2

Function 00407FFE Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryA.KERNEL32 ref: 00408019
wsprintfA.USER32 ref: 00408060
LoadLibraryExA.KERNELBASE ref: 00408079

Strings

\, xrefs: 0040802E

Memory Dump Source

Source File: 00000000.00000002.4162233942.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4162209415.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162259880.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162282586.000000000040B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.000000000045B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.0000000000483000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PandoraFMS_One_Agent_Windows-lts.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: \
API String ID: 2200240437-2967466578
Opcode ID: edf936936982a89848ab2bfb9a1c34cba80a5486cfbedbecf1c2913205bce52b
Instruction ID: 9f368012c825991ce04982f92701aa648b8799f0085610c4de867fb21c6dde5f
Opcode Fuzzy Hash: edf936936982a89848ab2bfb9a1c34cba80a5486cfbedbecf1c2913205bce52b
Instruction Fuzzy Hash: 94014BB1508304AFD300DF68D98879EBBF5FB84348F04C83DE08996291DB7895588B1A

Function 00DB153A Relevance: 6.1, APIs: 4, Instructions: 61memoryCOMMON

Download Yara Rule

APIs

CallWindowProcA.USER32 ref: 00DB157A
DestroyWindow.USER32 ref: 00DB1595
GetProcessHeap.KERNEL32(00000000), ref: 00DB15A2
HeapFree.KERNEL32 ref: 00DB15B7

Memory Dump Source

Source File: 00000000.00000002.4163042955.0000000000DB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.4163017212.0000000000DB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.4163067709.0000000000DB3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.4163092635.0000000000DB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.4163118887.0000000000DB7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.4163144543.0000000000DB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_PandoraFMS_One_Agent_Windows-lts.jbxd

Similarity

API ID: HeapWindow$CallDestroyFreeProcProcess
String ID:
API String ID: 1278960361-0
Opcode ID: 12e251e28d5c930905fe14e91eee4f386113057baf7dbbdadfae235a8dac2fdf
Instruction ID: 0c0664c45ff698e8cc9e34c4bedd58668c716ebdbe599d68ca7b6173165a4bdc
Opcode Fuzzy Hash: 12e251e28d5c930905fe14e91eee4f386113057baf7dbbdadfae235a8dac2fdf
Instruction Fuzzy Hash: B92108B5A04704DFC720EF29E98875ABBF4FB88350F048629E986C7354D334D8449BB2

Function 004074A0 Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNELBASE ref: 004074F4
GetLastError.KERNEL32 ref: 0040750A
SetFileSecurityA.ADVAPI32 ref: 00407522
GetLastError.KERNEL32 ref: 0040752F

Memory Dump Source

Source File: 00000000.00000002.4162233942.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4162209415.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162259880.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162282586.000000000040B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.000000000045B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.0000000000483000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PandoraFMS_One_Agent_Windows-lts.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID:
API String ID: 3449924974-0
Opcode ID: 4b4b7c87a1b8ee6e94e6bba5899c313b1bf0de4921ac642b6ace4a115c59440c
Instruction ID: a9114a71b9ed1fd184deaf5cb9d0e2738b806a811cb5365c7ce03c7ffc84f281
Opcode Fuzzy Hash: 4b4b7c87a1b8ee6e94e6bba5899c313b1bf0de4921ac642b6ace4a115c59440c
Instruction Fuzzy Hash: 7C11FAB1D08308AADB009FA9D8487DEFBB4EF54714F10842EE944B7250D77A9549CBAE

Function 00401860 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00407725: CharNextA.USER32(?,00000000,74DF3160,?,00407F74,?,?,?,00000000,?,004083BF), ref: 0040773A
Part of subcall function 00407725: CharNextA.USER32(74DF3160,?,00407F74,?,?,?,00000000,?,004083BF), ref: 00407742

SetCurrentDirectoryA.KERNELBASE(00000000,00000000), ref: 00401930

Part of subcall function 00407694: CharNextA.USER32 ref: 004076AE

GetFileAttributesA.KERNELBASE ref: 004018E0

Strings

\, xrefs: 00401882

Memory Dump Source

Source File: 00000000.00000002.4162233942.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4162209415.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162259880.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162282586.000000000040B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.000000000045B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.0000000000483000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PandoraFMS_One_Agent_Windows-lts.jbxd

Similarity

API ID: CharNext$AttributesCurrentDirectoryFile
String ID: \
API String ID: 15404496-2967466578
Opcode ID: 5c22a10f2eeaa49ecbec61f85fec86801a2d9e51ea18f934f8232086c298fb79
Instruction ID: 00cd6c951602bd80d4099365e7cb31704f5a5a5660bfa9d9f1f97e5c295f873e
Opcode Fuzzy Hash: 5c22a10f2eeaa49ecbec61f85fec86801a2d9e51ea18f934f8232086c298fb79
Instruction Fuzzy Hash: EE2191B18083419AD7103F2A8C4076ABBE8AF41314F15897FE4D5A33E2E63D8581CB2A

Function 00403845 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32 ref: 004038C0
SendMessageA.USER32 ref: 004038E0

Strings

0u, xrefs: 004038AC

Memory Dump Source

Source File: 00000000.00000002.4162233942.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4162209415.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162259880.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162282586.000000000040B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.000000000045B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.0000000000483000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PandoraFMS_One_Agent_Windows-lts.jbxd

Similarity

API ID: MessageSend
String ID: 0u
API String ID: 3850602802-3203441087
Opcode ID: 4e71a1974caaa1261595a851c5052f8bebca73b141bb856c4b894835f81d7657
Instruction ID: 65c96d0eefb1b38f6cf6dd23baf14e763e2f7a708bd0f60a5118c077a9330c57
Opcode Fuzzy Hash: 4e71a1974caaa1261595a851c5052f8bebca73b141bb856c4b894835f81d7657
Instruction Fuzzy Hash: 631190B2908301DFC710AF69D88961BBFE8EB40751F15C67EF894A7390E73999048B99

Function 004078C4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 004078E2
GetTempFileNameA.KERNELBASE ref: 0040790A

Strings

nsa, xrefs: 004078DB

Memory Dump Source

Source File: 00000000.00000002.4162233942.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4162209415.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162259880.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162282586.000000000040B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.000000000045B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.0000000000483000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PandoraFMS_One_Agent_Windows-lts.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: nsa
API String ID: 1716503409-2209301699
Opcode ID: 93fc1848b608f135017e582bbd32cd97ec0baf52c4cc3b9489d4c7975639f793
Instruction ID: 5a97e475c2bf528ad144de220c914729813741e1c6e15ec140d7c1313bfaff61
Opcode Fuzzy Hash: 93fc1848b608f135017e582bbd32cd97ec0baf52c4cc3b9489d4c7975639f793
Instruction Fuzzy Hash: A6F04F72E083059BD700AF6AD88869FBFA5EB85310F00843AE95497381DA359515CB96

Function 00408089 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,004041D7), ref: 0040809E
GetProcAddress.KERNEL32 ref: 004080CA

Part of subcall function 00407FFE: GetSystemDirectoryA.KERNEL32 ref: 00408019
Part of subcall function 00407FFE: wsprintfA.USER32 ref: 00408060
Part of subcall function 00407FFE: LoadLibraryExA.KERNELBASE ref: 00408079

Strings

UXTHEME, xrefs: 0040808D

Memory Dump Source

Source File: 00000000.00000002.4162233942.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4162209415.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162259880.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162282586.000000000040B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.000000000045B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.0000000000483000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PandoraFMS_One_Agent_Windows-lts.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID: UXTHEME
API String ID: 2547128583-2858369361
Opcode ID: fa6da1299e01e6f681b8fc28d034e78e45055ec1f99b4499e8faed80d24c1c5f
Instruction ID: 491df23e4349f922115187e15a686d99dd7590c197a6103022668aa04458a457
Opcode Fuzzy Hash: fa6da1299e01e6f681b8fc28d034e78e45055ec1f99b4499e8faed80d24c1c5f
Instruction Fuzzy Hash: A8F08275A047089BD700AF29998446FBBF8EB84750B01C43DF98493320EA35A960879A

Function 004020E0 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 92memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32 ref: 00402195
GlobalAlloc.KERNELBASE ref: 004021B0

Strings

Call, xrefs: 00402131, 0040215E

Memory Dump Source

Source File: 00000000.00000002.4162233942.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4162209415.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162259880.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162282586.000000000040B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.000000000045B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.0000000000483000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PandoraFMS_One_Agent_Windows-lts.jbxd

Similarity

API ID: Global$AllocFree
String ID: Call
API String ID: 3394109436-1824292864
Opcode ID: c97105ca30053a454d05aecfa654e635cbfe171ed3c7ec043818f99b6f5f978a
Instruction ID: 871d1b58d1c2a4e5e4038b6f8a94e261c900a6c6fbadd1a87131bd4552b44949
Opcode Fuzzy Hash: c97105ca30053a454d05aecfa654e635cbfe171ed3c7ec043818f99b6f5f978a
Instruction Fuzzy Hash: F6317EB2A08710AFD710EF15D944A6BB7E8EB84B04F05883EF985A7380D7789941DB5A

Function 00402E4B Relevance: 4.6, APIs: 3, Instructions: 89registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.KERNELBASE ref: 00402ED3
RegSetValueExA.KERNELBASE ref: 00402F7F
RegCloseKey.ADVAPI32 ref: 0040307E

Memory Dump Source

Source File: 00000000.00000002.4162233942.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4162209415.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162259880.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162282586.000000000040B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.000000000045B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.0000000000483000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PandoraFMS_One_Agent_Windows-lts.jbxd

Similarity

API ID: CloseCreateValue
String ID:
API String ID: 1818849710-0
Opcode ID: 655cd4bdee7b611a47ebb591dad39cdc22d4cc0ab7a637e93ba35ba75de8a483
Instruction ID: c70f114857dc8bb25fa6c328139017004dc0d7bac582f0227bc692f201b037f5
Opcode Fuzzy Hash: 655cd4bdee7b611a47ebb591dad39cdc22d4cc0ab7a637e93ba35ba75de8a483
Instruction Fuzzy Hash: 23316FB09083019FD700EF25C94839EBBF4FB84355F10886EF498A7391D7799A858F5A

Function 0040319E Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 41fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE ref: 00403220

Strings

C:\Users\user\AppData\Local\Temp\nsiBE5B.tmp\System.dll, xrefs: 004031B3, 00403215

Memory Dump Source

Source File: 00000000.00000002.4162233942.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4162209415.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162259880.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162282586.000000000040B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.000000000045B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.0000000000483000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PandoraFMS_One_Agent_Windows-lts.jbxd

Similarity

API ID: FileWrite
String ID: C:\Users\user\AppData\Local\Temp\nsiBE5B.tmp\System.dll
API String ID: 3934441357-1928934717
Opcode ID: a5b481040afeb196096c6cf8418f77f7ebb565596ab9556ed62a218c9e3d3b9a
Instruction ID: 9251182b8276100042518cb3302fb10897ac279717b607855393a04265dfa06b
Opcode Fuzzy Hash: a5b481040afeb196096c6cf8418f77f7ebb565596ab9556ed62a218c9e3d3b9a
Instruction Fuzzy Hash: F50180B19083009FD718AF69D84439EBBF0AB84304F00C87EE08967391D7784584CB9A

Function 004015AE Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 31registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNELBASE ref: 00401600

Strings

@h, xrefs: 004015CD

Memory Dump Source

Source File: 00000000.00000002.4162233942.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4162209415.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162259880.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162282586.000000000040B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.000000000045B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.0000000000483000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PandoraFMS_One_Agent_Windows-lts.jbxd

Similarity

API ID: Open
String ID: @h
API String ID: 71445658-3436019336
Opcode ID: 724425dcc63114b173beb9410b993dbb427e6f1e43d5ca50d2dbe65d7b4fdcb8
Instruction ID: 21eb7b73b39be551c045d5804fa28c682b097b1c122b42c0b0b50213ef707915
Opcode Fuzzy Hash: 724425dcc63114b173beb9410b993dbb427e6f1e43d5ca50d2dbe65d7b4fdcb8
Instruction Fuzzy Hash: 8BF087B0A00306AFCB04EF26C984A4AFBF5BF98304F10C62DE859472A5E730E501CB95

Function 004015B0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNELBASE ref: 00401600

Strings

@h, xrefs: 004015CD

Memory Dump Source

Source File: 00000000.00000002.4162233942.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4162209415.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162259880.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162282586.000000000040B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.000000000045B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.0000000000483000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PandoraFMS_One_Agent_Windows-lts.jbxd

Similarity

API ID: Open
String ID: @h
API String ID: 71445658-3436019336
Opcode ID: 04c4111b7faca97cd434c74b43e5d3736dd37eeb9b68cf1a7a63b264a30f222a
Instruction ID: 9edcfc96fd8926ded056f6e6ddc148378f3531a355c3ae5333fd229b5fe3d93d
Opcode Fuzzy Hash: 04c4111b7faca97cd434c74b43e5d3736dd37eeb9b68cf1a7a63b264a30f222a
Instruction Fuzzy Hash: D8F037B0A05306ABCB04EF66C984A4AFBF5BF98344F51C62DE859472A5E730E501CB95

Function 00407626 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 27windowCOMMON

Download Yara Rule

APIs

MessageBoxIndirectA.USER32 ref: 00407689

Strings

Pandora FMS Agent 7.0NG.777.1 Setup, xrefs: 00407647

Memory Dump Source

Source File: 00000000.00000002.4162233942.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4162209415.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162259880.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162282586.000000000040B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.000000000045B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.0000000000483000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PandoraFMS_One_Agent_Windows-lts.jbxd

Similarity

API ID: IndirectMessage
String ID: Pandora FMS Agent 7.0NG.777.1 Setup
API String ID: 1874166685-3452433673
Opcode ID: a0b9989dac790c89276446c02662fe56e5146f067b4b785e6006d4b28e70d7c4
Instruction ID: a13ab6da1d8a293d91393787c7bc82828f517769e8edf7072ca9ada013704a8a
Opcode Fuzzy Hash: a0b9989dac790c89276446c02662fe56e5146f067b4b785e6006d4b28e70d7c4
Instruction Fuzzy Hash: 90F017B5A01309AFC740DF28EA4471577E4AB48318F11D43AE845E7360D7789854CB4A

Function 6E5C33B8 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 23memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 6E5C33EB

Strings

@, xrefs: 6E5C33D4

Memory Dump Source

Source File: 00000000.00000002.4163482141.000000006E5C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6E5C0000, based on PE: true

Associated: 00000000.00000002.4163465602.000000006E5C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4163502457.000000006E5C6000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4163520313.000000006E5C8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4163537978.000000006E5C9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4163555114.000000006E5CC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e5c0000_PandoraFMS_One_Agent_Windows-lts.jbxd

Similarity

API ID: ProtectVirtual
String ID: @
API String ID: 544645111-2766056989
Opcode ID: 7ea98f346244138fe709102fc37b25e63c8e4eb101189a9a4cd3e1441a87def3
Instruction ID: 28cd750346f424f662dbf68a36e014bdd697d14c12b221935bd466f7201e4737
Opcode Fuzzy Hash: 7ea98f346244138fe709102fc37b25e63c8e4eb101189a9a4cd3e1441a87def3
Instruction Fuzzy Hash: D0F092B0008B40DEEB00DFA5C42D30A7AE0A742F58F41854CE9944ABC5CBB9446ACFA6

Function 00404A86 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 13windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32 ref: 00404AAB

Strings

(, xrefs: 00404A97

Memory Dump Source

Source File: 00000000.00000002.4162233942.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4162209415.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162259880.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162282586.000000000040B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.000000000045B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.0000000000483000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PandoraFMS_One_Agent_Windows-lts.jbxd

Similarity

API ID: MessageSend
String ID: (
API String ID: 3850602802-3887548279
Opcode ID: 3fea1d1dcde79aed48b753e8be5351aaa4ed740cc25652d4c976dd3f3aeffc86
Instruction ID: 4431a04590381803e72544c28ab4ca6bc6a442d634567352a3e84a68d91008fe
Opcode Fuzzy Hash: 3fea1d1dcde79aed48b753e8be5351aaa4ed740cc25652d4c976dd3f3aeffc86
Instruction Fuzzy Hash: D9D017B4404304AFC300EF2CD54960EBBE4AB40308F40C82CE88497241D774D4448F96

Function 6E5C174C Relevance: 3.2, APIs: 2, Instructions: 156COMMON

Download Yara Rule

APIs

LoadImageA.USER32(00000000), ref: 6E5C180B
GetLastError.KERNEL32 ref: 6E5C1912

Memory Dump Source

Source File: 00000000.00000002.4163482141.000000006E5C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6E5C0000, based on PE: true

Associated: 00000000.00000002.4163465602.000000006E5C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4163502457.000000006E5C6000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4163520313.000000006E5C8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4163537978.000000006E5C9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4163555114.000000006E5CC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e5c0000_PandoraFMS_One_Agent_Windows-lts.jbxd

Similarity

API ID: ErrorImageLastLoad
String ID:
API String ID: 2189606529-0
Opcode ID: 2dcc59e37b22470102ce5ea22712f04bbfa7d98cd994f5b2af3464afe560379a
Instruction ID: bb1a01ed37a9c7c627bd12ad5be763d6472761d0a4ada896b852aef19c3ba236
Opcode Fuzzy Hash: 2dcc59e37b22470102ce5ea22712f04bbfa7d98cd994f5b2af3464afe560379a
Instruction Fuzzy Hash: 8651A771504A089FDB11DFE4D5BC79837F8EB41F18F2149ADE900C6644DF389896CB92

Function 00404B92 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 92COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00404C89

Strings

Pandora FMS Agent 7.0NG.777.1 Setup, xrefs: 00404C1C, 00404C59, 00404C69, 00404C92

Memory Dump Source

Source File: 00000000.00000002.4162233942.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4162209415.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162259880.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162282586.000000000040B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.000000000045B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.0000000000483000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PandoraFMS_One_Agent_Windows-lts.jbxd

Similarity

API ID: wsprintf
String ID: Pandora FMS Agent 7.0NG.777.1 Setup
API String ID: 2111968516-3452433673
Opcode ID: db73776f264ac93107dee5e323fdc406abbe58821ea3c0603e3c71232ff97682
Instruction ID: 593b97edefadd73ccda5d49503661726c9e38e261618b5471b3a859fbb28941b
Opcode Fuzzy Hash: db73776f264ac93107dee5e323fdc406abbe58821ea3c0603e3c71232ff97682
Instruction Fuzzy Hash: 9D31B5B19087049BC704EF69D480A5EBBF4EF88714F10853EFA94E7390E778D8058B9A

Function 00402F9D Relevance: 3.1, APIs: 2, Instructions: 67registryCOMMON

Download Yara Rule

APIs

Part of subcall function 004015B0: RegOpenKeyExA.KERNELBASE ref: 00401600

RegQueryValueExA.KERNELBASE ref: 00403008
RegCloseKey.ADVAPI32 ref: 0040307E

Memory Dump Source

Source File: 00000000.00000002.4162233942.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4162209415.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162259880.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162282586.000000000040B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.000000000045B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.0000000000483000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PandoraFMS_One_Agent_Windows-lts.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 85ab4fcb1b04ab50c0500d86b219c8fa6d9567016e209113fbae202f6b5d9c3a
Instruction ID: 5d0aa2dbbc53d88669278889509e7fb439c96b02ffb0fedbb1402b2b7154f18b
Opcode Fuzzy Hash: 85ab4fcb1b04ab50c0500d86b219c8fa6d9567016e209113fbae202f6b5d9c3a
Instruction Fuzzy Hash: BE217C71909300DFE724DF28C84879ABBF4AB84315F1489BEE489A3380D7799A85CF56

Function 00407F4B Relevance: 3.1, APIs: 2, Instructions: 60stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00407AA6: lstrcpynA.KERNEL32(?,?,?,?,?,?,00404249), ref: 00407AC1

Part of subcall function 00407725: CharNextA.USER32(?,00000000,74DF3160,?,00407F74,?,?,?,00000000,?,004083BF), ref: 0040773A
Part of subcall function 00407725: CharNextA.USER32(74DF3160,?,00407F74,?,?,?,00000000,?,004083BF), ref: 00407742

lstrlenA.KERNEL32(?,00000000,?,?,?,00000000,?,004083BF), ref: 00407FAE
GetFileAttributesA.KERNELBASE(00000000,?,?,00000000,?,?,?,00000000,?,004083BF), ref: 00407FE7

Memory Dump Source

Source File: 00000000.00000002.4162233942.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4162209415.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162259880.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162282586.000000000040B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.000000000045B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.0000000000483000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PandoraFMS_One_Agent_Windows-lts.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID:
API String ID: 3248276644-0
Opcode ID: 8373e1f232ddb6bf7035178ee982c0deddac14c927df7a2db69a26edf8d4db0f
Instruction ID: e0dee199aa33a759337c76bdc749115b0906b62447b55552086bcd5c64e8d670
Opcode Fuzzy Hash: 8373e1f232ddb6bf7035178ee982c0deddac14c927df7a2db69a26edf8d4db0f
Instruction Fuzzy Hash: 87118FB090C306AEC7107BB96840AAA7EECDE45364F05983FE8C1A3281D77C7841966F

Function 004049FD Relevance: 3.0, APIs: 2, Instructions: 42comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(007F3E48), ref: 00404A18

Part of subcall function 004049C7: SendMessageA.USER32 ref: 004049F0

OleUninitialize.OLE32(00000000,00000000,?,?,0040630F), ref: 00404A72

Memory Dump Source

Source File: 00000000.00000002.4162233942.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4162209415.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162259880.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162282586.000000000040B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.000000000045B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.0000000000483000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PandoraFMS_One_Agent_Windows-lts.jbxd

Similarity

API ID: InitializeMessageSendUninitialize
String ID:
API String ID: 2896919175-0
Opcode ID: d339b3f802cd687aeaa006cbcec2a62dd4f032680ecc39a974beee111cb915e5
Instruction ID: 1e3af241344d98a248872f0bd2083e35cf73cdb40cc7b52374e1de70a9c27ef2
Opcode Fuzzy Hash: d339b3f802cd687aeaa006cbcec2a62dd4f032680ecc39a974beee111cb915e5
Instruction Fuzzy Hash: 180171F1505306AFD740AFA4D844766BBE8EB44310F11947EFE9493291D73994408F5D

Function 00401803 Relevance: 3.0, APIs: 2, Instructions: 30COMMON

Download Yara Rule

APIs

ShowWindow.USER32 ref: 00401814
ShowWindow.USER32 ref: 0040256D

Memory Dump Source

Source File: 00000000.00000002.4162233942.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4162209415.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162259880.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162282586.000000000040B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.000000000045B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.0000000000483000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PandoraFMS_One_Agent_Windows-lts.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: bd2355a4c4afa0af93886b696c643db1bb6602db62a74264e95f2d03f51559e5
Instruction ID: 191cf0361faf7115a81ea473c9f044b320c3d38e43f128136233a9863dde8171
Opcode Fuzzy Hash: bd2355a4c4afa0af93886b696c643db1bb6602db62a74264e95f2d03f51559e5
Instruction Fuzzy Hash: 36F05EB6B08201EFD714DF55AC8056ABBF9FBC4301B15D47BE94593240C6308A01AB59

Function 00407569 Relevance: 3.0, APIs: 2, Instructions: 29processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNELBASE ref: 004075C6
CloseHandle.KERNEL32 ref: 004075DB

Memory Dump Source

Source File: 00000000.00000002.4162233942.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4162209415.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162259880.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162282586.000000000040B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.000000000045B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.0000000000483000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PandoraFMS_One_Agent_Windows-lts.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID:
API String ID: 3712363035-0
Opcode ID: d6989bb56516e3a2962a9bd2f4898316265ee85a6e4b2dfdbe44f00bbc7ceed3
Instruction ID: 689bfe552f6c86e98e1027bdd9d88049dc19f07609aaa16ba02e971f40684cfe
Opcode Fuzzy Hash: d6989bb56516e3a2962a9bd2f4898316265ee85a6e4b2dfdbe44f00bbc7ceed3
Instruction Fuzzy Hash: 7B01BDB09083059FE700DF65C95874BBBF4BB88308F00892CE984AB380D7B9D5498F96

Function 00402541 Relevance: 3.0, APIs: 2, Instructions: 28COMMON

Download Yara Rule

APIs

ShowWindow.USER32 ref: 0040256D
EnableWindow.USER32 ref: 00402578

Memory Dump Source

Source File: 00000000.00000002.4162233942.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4162209415.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162259880.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162282586.000000000040B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.000000000045B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.0000000000483000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PandoraFMS_One_Agent_Windows-lts.jbxd

Similarity

API ID: Window$EnableShow
String ID:
API String ID: 1136574915-0
Opcode ID: c5e1c5af09a17d7162aaa8d321b7f86fef45140455825dc6134dca4c65cc3eb6
Instruction ID: 7f628d260daaf21f823d0aec3129a8927898c46e80915c605feb16ab9189c399
Opcode Fuzzy Hash: c5e1c5af09a17d7162aaa8d321b7f86fef45140455825dc6134dca4c65cc3eb6
Instruction Fuzzy Hash: 18F030F1608200EFD754BF5AEC447AAF7F8EB84316F12843FF589A2591DA7805419A2E

Function 004037D8 Relevance: 3.0, APIs: 2, Instructions: 26windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32 ref: 004037FB
InvalidateRect.USER32 ref: 00403826

Memory Dump Source

Source File: 00000000.00000002.4162233942.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4162209415.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162259880.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162282586.000000000040B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.000000000045B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.0000000000483000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PandoraFMS_One_Agent_Windows-lts.jbxd

Similarity

API ID: InvalidateMessageRectSend
String ID:
API String ID: 909852535-0
Opcode ID: 3687898a21f3f3fe1f817b9c8a46b856033ac9a2ec5078b9b31088a7850533db
Instruction ID: 4d59ad536880b3338388803c7daac04e80b68a5d2d2d9c9899754cd343548cd5
Opcode Fuzzy Hash: 3687898a21f3f3fe1f817b9c8a46b856033ac9a2ec5078b9b31088a7850533db
Instruction Fuzzy Hash: CAF0B7759043049FE710EF69E89839EBBF1FB84315F00D86EE55893250DB358598CF46

Function 00407868 Relevance: 3.0, APIs: 2, Instructions: 25fileCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE ref: 00407875
CreateFileA.KERNELBASE(?,?,?,?,?,?,?,?,?,?,00000000,?,00403E07), ref: 004078B4

Memory Dump Source

Source File: 00000000.00000002.4162233942.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4162209415.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162259880.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162282586.000000000040B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.000000000045B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.0000000000483000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PandoraFMS_One_Agent_Windows-lts.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 095a37bff4decf175eb1bd94082fa7df9a8174ae5e2f969c188c31d5a9e38645
Instruction ID: 0fa958c00355423b5825cef4833c134f4f2af1b07d937f04d1427b8d5614869e
Opcode Fuzzy Hash: 095a37bff4decf175eb1bd94082fa7df9a8174ae5e2f969c188c31d5a9e38645
Instruction Fuzzy Hash: 2FF0B2B05083059BC700EF29D48874EBBF4AB88754F10892CF89987391D775D9848BA2

Function 00407836 Relevance: 3.0, APIs: 2, Instructions: 19COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(?,00000000,00000000), ref: 00407843
SetFileAttributesA.KERNELBASE(?,?,00000000,00000000), ref: 00407859

Memory Dump Source

Source File: 00000000.00000002.4162233942.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4162209415.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162259880.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162282586.000000000040B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.000000000045B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.0000000000483000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PandoraFMS_One_Agent_Windows-lts.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: ee5c1f5fcb19ff260445b9409ea9ad711b6eeeda713977d19237c8fb6ce17a97
Instruction ID: 2d87bc076650892dff14bf629d0825291b245e1deb4b29ce28756198e0d386ec
Opcode Fuzzy Hash: ee5c1f5fcb19ff260445b9409ea9ad711b6eeeda713977d19237c8fb6ce17a97
Instruction Fuzzy Hash: 58E08CB1804709ABC700AF78CCC881EBABCAB24760B504A2CF5A5C33D1D63498408B35

Function 0040753B Relevance: 3.0, APIs: 2, Instructions: 16COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNELBASE ref: 0040754F
GetLastError.KERNEL32 ref: 0040755F

Memory Dump Source

Source File: 00000000.00000002.4162233942.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4162209415.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162259880.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162282586.000000000040B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.000000000045B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.0000000000483000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PandoraFMS_One_Agent_Windows-lts.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 817bc1b9dcae04099eeee7c287e0f8940a7378e0748306417bf06f72b7378fa7
Instruction ID: 555b80ff280aab0952195b46ca47e1bd25d37e94dfcacda55879a87a47fbe0d4
Opcode Fuzzy Hash: 817bc1b9dcae04099eeee7c287e0f8940a7378e0748306417bf06f72b7378fa7
Instruction Fuzzy Hash: A1D05EB0A043056BC700EF78980861BBAF9AB90B44F00C43CB944C3340FA74D8058796

Function 00401968 Relevance: 1.5, APIs: 1, Instructions: 47fileCOMMON

Download Yara Rule

APIs

MoveFileA.KERNEL32 ref: 0040199A

Memory Dump Source

Source File: 00000000.00000002.4162233942.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4162209415.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162259880.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162282586.000000000040B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.000000000045B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.0000000000483000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PandoraFMS_One_Agent_Windows-lts.jbxd

Similarity

API ID: FileMove
String ID:
API String ID: 3562171763-0
Opcode ID: 18f417a656d5aee30d76cc2538e182e12095416163dcb9beba6f3a859823740d
Instruction ID: 53ae8252f41965b0c1919c1ba66bf311c03744c8a734f28553da68392c6c6446
Opcode Fuzzy Hash: 18f417a656d5aee30d76cc2538e182e12095416163dcb9beba6f3a859823740d
Instruction Fuzzy Hash: C60192B05086019BD3107F2A8D4466EB6F4EF90724F15863FB5D4B22E1D67848828A6B

Function 00402CBF Relevance: 1.5, APIs: 1, Instructions: 32COMMON

Download Yara Rule

APIs

WritePrivateProfileStringA.KERNEL32 ref: 00402D24

Memory Dump Source

Source File: 00000000.00000002.4162233942.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4162209415.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162259880.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162282586.000000000040B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.000000000045B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.0000000000483000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PandoraFMS_One_Agent_Windows-lts.jbxd

Similarity

API ID: PrivateProfileStringWrite
String ID:
API String ID: 390214022-0
Opcode ID: dd577b94fb968ef0c328d54a646d973f372bd89200f89a093cceea7d7ba19614
Instruction ID: 879747074b4e1b14df2381b92450785b3757b65ac9bf0bb35f3091ebfbfc7782
Opcode Fuzzy Hash: dd577b94fb968ef0c328d54a646d973f372bd89200f89a093cceea7d7ba19614
Instruction Fuzzy Hash: E2F012714082109ED315BF6A8D4436EBAE46F44385F11853EB588A32E2D7B84481CB5A

Function 00403A7D Relevance: 1.5, APIs: 1, Instructions: 23fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00403B47), ref: 00403AA9

Memory Dump Source

Source File: 00000000.00000002.4162233942.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4162209415.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162259880.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162282586.000000000040B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.000000000045B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.0000000000483000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PandoraFMS_One_Agent_Windows-lts.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 864bb8e8a586830efcbe2ee958ea0bf1a0d9a6489681a71610e933f9576fdf23
Instruction ID: 1c49c6a52c00be2641cec1acdc1bf2ba04586d911cd88fa55dbd5d8fb6f9238d
Opcode Fuzzy Hash: 864bb8e8a586830efcbe2ee958ea0bf1a0d9a6489681a71610e933f9576fdf23
Instruction Fuzzy Hash: D2F0AC71904309AFC740EF69D58468EBBF4BB48254F008879E89993341E734D644CF55

Function 00404AB8 Relevance: 1.5, APIs: 1, Instructions: 16windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32 ref: 00404AE8

Memory Dump Source

Source File: 00000000.00000002.4162233942.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4162209415.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162259880.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162282586.000000000040B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.000000000045B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.0000000000483000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PandoraFMS_One_Agent_Windows-lts.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 66d4689fbc8569e1fd45598b70766002729c44451447966a135d6988e736546c
Instruction ID: 5a3a7b7be979fc00f35a6542abf12f847681ed3bc5d4400e6a8564fe02df8d3a
Opcode Fuzzy Hash: 66d4689fbc8569e1fd45598b70766002729c44451447966a135d6988e736546c
Instruction Fuzzy Hash: 33E0E2B0508305AFC700AF68D94961EBFF4AB85314F90982DE989AB391D778D8448F9A

Function 004049C7 Relevance: 1.5, APIs: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32 ref: 004049F0

Memory Dump Source

Source File: 00000000.00000002.4162233942.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4162209415.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162259880.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162282586.000000000040B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.000000000045B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.0000000000483000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PandoraFMS_One_Agent_Windows-lts.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: aa5f0078c5c91a5ab00808205fc22a8e80333a2e3e19be405c841ee7ecc70c06
Instruction ID: 95ab6499f073aa7dc88c61072bb55c4a539e5532572e3332cdc6406efa5f1179
Opcode Fuzzy Hash: aa5f0078c5c91a5ab00808205fc22a8e80333a2e3e19be405c841ee7ecc70c06
Instruction Fuzzy Hash: 99D017B1108304AFD300EF28C48971BBBE4AB80344F40C92CE88997290DB78D4449F96

Function 004075F5 Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

GetDlgItemTextA.USER32 ref: 00407619

Memory Dump Source

Source File: 00000000.00000002.4162233942.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4162209415.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162259880.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162282586.000000000040B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.000000000045B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.0000000000483000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PandoraFMS_One_Agent_Windows-lts.jbxd

Similarity

API ID: ItemText
String ID:
API String ID: 3367045223-0
Opcode ID: 4179ef11889bfc32c970cb4b695ddf26e4d91e89fffc5eb3b513b075a9a18c38
Instruction ID: ce57ea90032812a2176e13de1b86ec66f6dd0ae0cf349a3b1574ffa4062be47c
Opcode Fuzzy Hash: 4179ef11889bfc32c970cb4b695ddf26e4d91e89fffc5eb3b513b075a9a18c38
Instruction Fuzzy Hash: 62D0E8B4908304AFC700FF2CC88990ABBE4AB48218F40C82DE88897350E674E8848F86

Function 0040183B Relevance: 1.5, APIs: 1, Instructions: 13COMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNEL32 ref: 00401855

Memory Dump Source

Source File: 00000000.00000002.4162233942.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4162209415.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162259880.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162282586.000000000040B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.000000000045B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.0000000000483000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PandoraFMS_One_Agent_Windows-lts.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: f603d45d16697995d78d645df9e97d793ae97943438d0db616a93f364bd97212
Instruction ID: aa4265ffbac3d2a2699931aa17bf47b3ae1aa300eb8bdb5092ff34b73920f7e7
Opcode Fuzzy Hash: f603d45d16697995d78d645df9e97d793ae97943438d0db616a93f364bd97212
Instruction Fuzzy Hash: 13D0A7B000C202DED3005F208C0053BB6F4AF84340F20863DF0C6A31E4D734C8826B2A

Function 00403AC5 Relevance: 1.5, APIs: 1, Instructions: 13COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE ref: 00403AEA

Memory Dump Source

Source File: 00000000.00000002.4162233942.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4162209415.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162259880.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162282586.000000000040B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.000000000045B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.0000000000483000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PandoraFMS_One_Agent_Windows-lts.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: f502c6a14d72cac2e0b31ba9f8e88146b763efd9c37584d1b9b30b50f253f56b
Instruction ID: b3d6143a815d2316660b0046a56e6f3f5b2c112ab8e91570835b50a68ad8d929
Opcode Fuzzy Hash: f502c6a14d72cac2e0b31ba9f8e88146b763efd9c37584d1b9b30b50f253f56b
Instruction Fuzzy Hash: 0AD06CB4508304AFD300EF68D54970EBBE4AB94348F80C82CE89897251E6B8D4688B9A

Function 00404B34 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL ref: 00404B49

Memory Dump Source

Source File: 00000000.00000002.4162233942.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4162209415.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162259880.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162282586.000000000040B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.000000000045B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.0000000000483000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PandoraFMS_One_Agent_Windows-lts.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 65a0447da7a95d6931b711cd232d36d4a58e5925726a574ed6c165ac46d8c0f6
Instruction ID: d5e7e5bea0f137f7fa37aa2ac1916e01692c2b4dcd8dd483f3dabad1cf4bdedd
Opcode Fuzzy Hash: 65a0447da7a95d6931b711cd232d36d4a58e5925726a574ed6c165ac46d8c0f6
Instruction Fuzzy Hash: C7D012B5504304AFC300EF68D94581ABBECBB54244F40442CB985D3300E674E8408BE5

Function 004027AB Relevance: 1.3, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32 ref: 00402851

Memory Dump Source

Source File: 00000000.00000002.4162233942.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4162209415.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162259880.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162282586.000000000040B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.000000000045B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.0000000000483000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PandoraFMS_One_Agent_Windows-lts.jbxd

Similarity

API ID: FreeGlobal
String ID:
API String ID: 2979337801-0
Opcode ID: f06abad74ecda3f1c635d1236d224e25433d347e540cb9344a3dfd1245929eed
Instruction ID: db611f0d9cdbc77af24bca5bd09fd45422bff531a237e336b3002678854f52af
Opcode Fuzzy Hash: f06abad74ecda3f1c635d1236d224e25433d347e540cb9344a3dfd1245929eed
Instruction Fuzzy Hash: ED215E759082049FD740AF35C94899AFBF4EF45314F4184BFE888E7241EA348A85CF56

Function 0040174C Relevance: 1.3, APIs: 1, Instructions: 21sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE ref: 00401766

Memory Dump Source

Source File: 00000000.00000002.4162233942.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4162209415.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162259880.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162282586.000000000040B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.000000000045B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.0000000000483000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PandoraFMS_One_Agent_Windows-lts.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 010e457f777b0ba3de50f07910f119e564ed8aada70e8426dbe02e110ff309ea
Instruction ID: 5d3e66056d311facd1f43b60f2da74df669075f311b99e9e3489bd3f95b44579
Opcode Fuzzy Hash: 010e457f777b0ba3de50f07910f119e564ed8aada70e8426dbe02e110ff309ea
Instruction Fuzzy Hash: F3E0C2727082008FE344AF6AAC002AAF3EAEFD0315F22843BEA45D2050D6388A01951A

Function 00403141 Relevance: 1.3, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE ref: 00403159

Memory Dump Source

Source File: 00000000.00000002.4162233942.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4162209415.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162259880.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162282586.000000000040B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.000000000045B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.0000000000483000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PandoraFMS_One_Agent_Windows-lts.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: c3f3ffad0066bc9af8d9fed563eafafd78feeb676d5469556e3341a8ffa81967
Instruction ID: f778a753f5e19012d3217eb13628dc2c5327f2f1d8f53c9d8af6707b497de67d
Opcode Fuzzy Hash: c3f3ffad0066bc9af8d9fed563eafafd78feeb676d5469556e3341a8ffa81967
Instruction Fuzzy Hash: 39C012B184D7519FC3056F306859465BF706E11205B06187EF4C1A6193DB3845149617

Non-executed Functions

Function 6E5C22B5 Relevance: 25.1, APIs: 13, Strings: 1, Instructions: 553librarystringloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6E5C1A84: GlobalAlloc.KERNEL32(?,?,?,?,?,6E5C1AE2,?,?,?,6E5C1D9D,?,?,?,6E5C14CB), ref: 6E5C1A9A

Part of subcall function 6E5C1AC3: lstrcpyA.KERNEL32(?,?,?,6E5C1D9D,?,?,?,6E5C14CB), ref: 6E5C1AEE
Part of subcall function 6E5C1AC3: GlobalFree.KERNEL32(00000000), ref: 6E5C1B02

GlobalAlloc.KERNEL32 ref: 6E5C23A0
GlobalFree.KERNEL32(00000000), ref: 6E5C24FB
GlobalFree.KERNEL32(00000000), ref: 6E5C2504
GlobalFree.KERNEL32(00000000), ref: 6E5C250D
GetModuleHandleA.KERNEL32(00000000), ref: 6E5C25C3
LoadLibraryA.KERNEL32(00000001), ref: 6E5C25D7
GetProcAddress.KERNEL32(00000001), ref: 6E5C2601
lstrcatA.KERNEL32 ref: 6E5C261E
GetProcAddress.KERNEL32(00000000,00000000), ref: 6E5C2633
lstrcpyA.KERNEL32(00000000,00000000), ref: 6E5C2744
GlobalFree.KERNEL32(00000000), ref: 6E5C2903

Strings

<`\n, xrefs: 6E5C2613

Memory Dump Source

Source File: 00000000.00000002.4163482141.000000006E5C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6E5C0000, based on PE: true

Associated: 00000000.00000002.4163465602.000000006E5C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4163502457.000000006E5C6000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4163520313.000000006E5C8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4163537978.000000006E5C9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4163555114.000000006E5CC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e5c0000_PandoraFMS_One_Agent_Windows-lts.jbxd

Similarity

API ID: Global$Free$AddressAllocProclstrcpy$HandleLibraryLoadModulelstrcat
String ID: <`\n
API String ID: 960787091-1869221154
Opcode ID: eef741c8f73e08eb6d6344694e957d45622ef18745d9d2f68eec55b253c02fc2
Instruction ID: 444cd68df2272b8b9f21c71279f2a338c6f62e08c64f56e3461046c59e487aa2
Opcode Fuzzy Hash: eef741c8f73e08eb6d6344694e957d45622ef18745d9d2f68eec55b253c02fc2
Instruction Fuzzy Hash: B2227C78804A15CFDB50CFE9C4A43ADBBF5BB45B04F05E92DD894AB244D7B48886CF92

Function 6E5C3AB0 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 6E5C3AFF
UnhandledExceptionFilter.KERNEL32 ref: 6E5C3B0F
GetCurrentProcess.KERNEL32 ref: 6E5C3B18
TerminateProcess.KERNEL32 ref: 6E5C3B29
abort.MSVCRT ref: 6E5C3B32

Memory Dump Source

Source File: 00000000.00000002.4163482141.000000006E5C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6E5C0000, based on PE: true

Associated: 00000000.00000002.4163465602.000000006E5C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4163502457.000000006E5C6000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4163520313.000000006E5C8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4163537978.000000006E5C9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4163555114.000000006E5CC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e5c0000_PandoraFMS_One_Agent_Windows-lts.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentTerminateabort
String ID:
API String ID: 520269711-0
Opcode ID: db2ea6cfbae88e9818d838afebed1a7832ee56c383ff42062c61979a5364e221
Instruction ID: 6a1809723f4558abe9ef9a64cd20787c6f35a85e59dddf5b25c8fdab4bfe742e
Opcode Fuzzy Hash: db2ea6cfbae88e9818d838afebed1a7832ee56c383ff42062c61979a5364e221
Instruction Fuzzy Hash: E91107B4804B05CFCB00EFB9C56D659BBF0BB49B04F42896DE98897341EB349954CF92

Function 6E5C3A00 Relevance: 7.6, APIs: 5, Instructions: 54timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 6E5C3A39
GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6E5C1439), ref: 6E5C3A4A
GetCurrentThreadId.KERNEL32 ref: 6E5C3A52
GetTickCount.KERNEL32 ref: 6E5C3A5A
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6E5C1439), ref: 6E5C3A69

Memory Dump Source

Source File: 00000000.00000002.4163482141.000000006E5C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6E5C0000, based on PE: true

Associated: 00000000.00000002.4163465602.000000006E5C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4163502457.000000006E5C6000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4163520313.000000006E5C8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4163537978.000000006E5C9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4163555114.000000006E5CC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e5c0000_PandoraFMS_One_Agent_Windows-lts.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: 523464c3f403b970596e7afae4a968b8852f716a9b4d3081fbfb478f5e11a281
Instruction ID: 94cce05d9da4e41bd13cea3a0bbf6888bbe8ae1f8f33c598f371b459f89195d9
Opcode Fuzzy Hash: 523464c3f403b970596e7afae4a968b8852f716a9b4d3081fbfb478f5e11a281
Instruction Fuzzy Hash: 7A115EB6904B058FCB00EFF9D89C55BBBE4FB89A64F42082DE448C7200DE3198588B92

Function 6E5C3AAC Relevance: 7.5, APIs: 5, Instructions: 47COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 6E5C3AFF
UnhandledExceptionFilter.KERNEL32 ref: 6E5C3B0F
GetCurrentProcess.KERNEL32 ref: 6E5C3B18
TerminateProcess.KERNEL32 ref: 6E5C3B29
abort.MSVCRT ref: 6E5C3B32

Memory Dump Source

Source File: 00000000.00000002.4163482141.000000006E5C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6E5C0000, based on PE: true

Associated: 00000000.00000002.4163465602.000000006E5C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4163502457.000000006E5C6000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4163520313.000000006E5C8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4163537978.000000006E5C9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4163555114.000000006E5CC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e5c0000_PandoraFMS_One_Agent_Windows-lts.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentTerminateabort
String ID:
API String ID: 520269711-0
Opcode ID: a8db63faaaf068254577a2f70e5be241c3f8f07d48a3b6772ee04ddc51fe8807
Instruction ID: 4535de574edaa20f96e90ce34de3def5107d5e71f17ff0f0a9d2c4cd59df8b3d
Opcode Fuzzy Hash: a8db63faaaf068254577a2f70e5be241c3f8f07d48a3b6772ee04ddc51fe8807
Instruction Fuzzy Hash: 811135B4800A05CFCB00EFB9C52D2997BF0BB0AB04F0285ADE94897241EB34A944CF92

Function 0040342B Relevance: 1.5, APIs: 1, Instructions: 40fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32 ref: 00403445

Memory Dump Source

Source File: 00000000.00000002.4162233942.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4162209415.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162259880.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162282586.000000000040B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.000000000045B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.0000000000483000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PandoraFMS_One_Agent_Windows-lts.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: a383e3318ce8df95e431e481b1b6ef230ff90cdfaef740520a84b3d16d448493
Instruction ID: 7bbb0544dbbebf1df20c253cd27ee875bfc9e3f20a8d285f2b93f6bdd00ca06b
Opcode Fuzzy Hash: a383e3318ce8df95e431e481b1b6ef230ff90cdfaef740520a84b3d16d448493
Instruction Fuzzy Hash: 380171B1908600EED310DF69C844AAEFBF8EF84315F10C86FE489A3280D7384A418F67

Function 00408D2E Relevance: .4, Instructions: 391COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4162233942.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4162209415.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162259880.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162282586.000000000040B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.000000000045B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.0000000000483000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PandoraFMS_One_Agent_Windows-lts.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30b1a7986aa0b74e1a34f4ed43e36a838e808f1387f411dda699a044b285acb4
Instruction ID: df6b0dc4cca14d6d4c01dc5fc37562bc820621efc621070ec281f652a941da47
Opcode Fuzzy Hash: 30b1a7986aa0b74e1a34f4ed43e36a838e808f1387f411dda699a044b285acb4
Instruction Fuzzy Hash: 9112F3B4C04219CFCB18CF95C58469EBBF0FF48304F2485AAD855AB38AD7789A46CF95

Function 6E5C4710 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4163482141.000000006E5C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6E5C0000, based on PE: true

Associated: 00000000.00000002.4163465602.000000006E5C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4163502457.000000006E5C6000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4163520313.000000006E5C8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4163537978.000000006E5C9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4163555114.000000006E5CC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e5c0000_PandoraFMS_One_Agent_Windows-lts.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43e378a65eeb9ef31b54acbc4f00068264d3b9adccad63ebbccdedfa2f358023
Instruction ID: 1235d19ad6f32c7b8dc3a2fba1398f0c5c1c30d49b08674fa8564d820740e5ca
Opcode Fuzzy Hash: 43e378a65eeb9ef31b54acbc4f00068264d3b9adccad63ebbccdedfa2f358023
Instruction Fuzzy Hash: 7F31C33170930A4BD758CDEE94B4A6BB6E397CAB50F55C53DA50AC3384ED709C87C682

Function 6E5C2C49 Relevance: 28.3, APIs: 15, Strings: 1, Instructions: 307stringCOMMON

Download Yara Rule

APIs

lstrcpyA.KERNEL32 ref: 6E5C2C9A
GlobalFree.KERNEL32 ref: 6E5C2DCC
GlobalFree.KERNEL32 ref: 6E5C2DFC

Strings

', xrefs: 6E5C2D0E

Memory Dump Source

Source File: 00000000.00000002.4163482141.000000006E5C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6E5C0000, based on PE: true

Associated: 00000000.00000002.4163465602.000000006E5C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4163502457.000000006E5C6000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4163520313.000000006E5C8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4163537978.000000006E5C9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4163555114.000000006E5CC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e5c0000_PandoraFMS_One_Agent_Windows-lts.jbxd

Similarity

API ID: FreeGlobal$lstrcpy
String ID: '
API String ID: 176019282-1997036262
Opcode ID: ad54ee81cc521a66bd61810715a2b953a2fa856b7b7522c7797097b33876b5b5
Instruction ID: afbc35224d4cacc622fcd2e502aac90eaee27c05f711bbe49ba15e31bbee25f0
Opcode Fuzzy Hash: ad54ee81cc521a66bd61810715a2b953a2fa856b7b7522c7797097b33876b5b5
Instruction Fuzzy Hash: B4D118B4904B05DFCB00DFA9C4A86AABBF4FF89B44F11896DE4989B340D7349945CF92

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 165COMMON

Download Yara Rule

APIs

BeginPaint.USER32 ref: 00401045
GetClientRect.USER32 ref: 00401063
CreateBrushIndirect.GDI32(?), ref: 004010F9
FillRect.USER32 ref: 00401114
DeleteObject.GDI32 ref: 00401120
CreateFontIndirectA.GDI32 ref: 00401140
SetBkMode.GDI32(?), ref: 0040116A
SetTextColor.GDI32 ref: 0040117C
DefWindowProcA.USER32 ref: 00401209

Strings

Pandora FMS Agent 7.0NG.777.1 Setup, xrefs: 004011B2

Memory Dump Source

Source File: 00000000.00000002.4162233942.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4162209415.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162259880.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162282586.000000000040B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.000000000045B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.0000000000483000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PandoraFMS_One_Agent_Windows-lts.jbxd

Similarity

API ID: CreateIndirectRect$BeginBrushClientColorDeleteFillFontModeObjectPaintProcTextWindow
String ID: Pandora FMS Agent 7.0NG.777.1 Setup
API String ID: 2207649800-3452433673
Opcode ID: 61b91f46278564504fcc6e8d7c54ede98f6323e260d14d83c86c78e6abc51892
Instruction ID: 6812554381b726746be0810cd68d0cbcff0de309ce517ffca120cf1bd0aec520
Opcode Fuzzy Hash: 61b91f46278564504fcc6e8d7c54ede98f6323e260d14d83c86c78e6abc51892
Instruction Fuzzy Hash: 1061F2B09047089FCB14DFA9C9885AEFBF8FB88710F11892EE499D7251E734A844DF55

Function 00DB113F Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 124stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00DB238D: lstrcpynA.KERNEL32 ref: 00DB23CA
Part of subcall function 00DB238D: GlobalFree.KERNEL32 ref: 00DB23DF

lstrcmpiA.KERNEL32(00000000,00000000), ref: 00DB11E3
GetFileAttributesA.KERNEL32 ref: 00DB11F4
lstrcpyA.KERNEL32 ref: 00DB1213
lstrcpyA.KERNEL32 ref: 00DB1241
CharNextA.USER32 ref: 00DB1262
GetCurrentDirectoryA.KERNEL32 ref: 00DB127E
GetSaveFileNameA.COMDLG32 ref: 00DB128D
GetOpenFileNameA.COMDLG32 ref: 00DB1295
CommDlgExtendedError.COMDLG32 ref: 00DB12AE
GetSaveFileNameA.COMDLG32 ref: 00DB12C9
GetOpenFileNameA.COMDLG32 ref: 00DB12D1
SetCurrentDirectoryA.KERNEL32(00000000), ref: 00DB12F5

Strings

X, xrefs: 00DB1164
All Files|*.*, xrefs: 00DB1232
save, xrefs: 00DB11D8

Memory Dump Source

Source File: 00000000.00000002.4163042955.0000000000DB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.4163017212.0000000000DB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.4163067709.0000000000DB3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.4163092635.0000000000DB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.4163118887.0000000000DB7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.4163144543.0000000000DB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_PandoraFMS_One_Agent_Windows-lts.jbxd

Similarity

API ID: File$Name$CurrentDirectoryOpenSavelstrcpy$AttributesCharCommErrorExtendedFreeGlobalNextlstrcmpilstrcpyn
String ID: All Files|*.*$X$save
API String ID: 3853173656-3147001704
Opcode ID: 38224dc21374caa7790eb13572ac3aad33d27a1d6e8ee1bf5fb34c981da3a175
Instruction ID: bea4f6ba749743dceadf7dbcda1b0845c36c17e05073cebddba14fa99952352a
Opcode Fuzzy Hash: 38224dc21374caa7790eb13572ac3aad33d27a1d6e8ee1bf5fb34c981da3a175
Instruction Fuzzy Hash: 714135B4408304EFE700AFA9E8596AABBF9BF85305F45451CE58ADB351C77488058B72

Function 6E5C3C40 Relevance: 24.6, APIs: 6, Strings: 8, Instructions: 105filememoryCOMMON

Download Yara Rule

APIs

fwrite.MSVCRT ref: 6E5C3C6B
vfprintf.MSVCRT ref: 6E5C3C87
abort.MSVCRT ref: 6E5C3C8C
VirtualQuery.KERNEL32 ref: 6E5C3D30
VirtualProtect.KERNEL32 ref: 6E5C3D72

Strings

f\n, xrefs: 6E5C3E92
f\n, xrefs: 6E5C3E35
f\n, xrefs: 6E5C3E7E
f\n, xrefs: 6E5C4007
f\n, xrefs: 6E5C3EEB
f\n, xrefs: 6E5C3EF0
@, xrefs: 6E5C3D5B
f\n, xrefs: 6E5C3F19

Memory Dump Source

Source File: 00000000.00000002.4163482141.000000006E5C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6E5C0000, based on PE: true

Associated: 00000000.00000002.4163465602.000000006E5C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4163502457.000000006E5C6000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4163520313.000000006E5C8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4163537978.000000006E5C9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4163555114.000000006E5CC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e5c0000_PandoraFMS_One_Agent_Windows-lts.jbxd

Similarity

API ID: Virtual$ProtectQueryabortfwritevfprintf
String ID: @$f\n$f\n$f\n$f\n$f\n$f\n$f\n
API String ID: 1503958624-3675119293
Opcode ID: 0ff0a107993387651b644fdb640d87b8800044d6efd1d646b6ec6f7529abac93
Instruction ID: f896503a3ed3bbbe0caa9f1cc561a92e8f9142bf07f6f24f6f5d2878360406a5
Opcode Fuzzy Hash: 0ff0a107993387651b644fdb640d87b8800044d6efd1d646b6ec6f7529abac93
Instruction Fuzzy Hash: 1A4118B1904B018FD700DFA8C9A865AFBF4BF85F58F02895DE99887240E734E845CB83

Function 00DB16C6 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 242windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32 ref: 00DB1739
GetWindowTextA.USER32 ref: 00DB18B6
DrawTextA.USER32 ref: 00DB18DD
GetWindowLongA.USER32 ref: 00DB1960
SetTextColor.GDI32 ref: 00DB1980
DrawTextA.USER32 ref: 00DB19AB
DrawFocusRect.USER32 ref: 00DB19DB
SendMessageA.USER32 ref: 00DB19FE
RemovePropA.USER32 ref: 00DB1A2B

Strings

NSIS: nsControl pointer property, xrefs: 00DB1A1D

Memory Dump Source

Source File: 00000000.00000002.4163042955.0000000000DB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.4163017212.0000000000DB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.4163067709.0000000000DB3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.4163092635.0000000000DB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.4163118887.0000000000DB7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.4163144543.0000000000DB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_PandoraFMS_One_Agent_Windows-lts.jbxd

Similarity

API ID: Text$Draw$Window$ColorFocusItemLongMessagePropRectRemoveSend
String ID: NSIS: nsControl pointer property
API String ID: 2331901045-1714965683
Opcode ID: 4d401eda96edb2dde235838fa2f3606de8a7e253aba3b70049e104c8111e119b
Instruction ID: aecbdb7afeb45bb2d9c8a72f506213d89a2c6a1258f8bd0c7fb5c80fc34130a7
Opcode Fuzzy Hash: 4d401eda96edb2dde235838fa2f3606de8a7e253aba3b70049e104c8111e119b
Instruction Fuzzy Hash: A9A16DB4905300DFCB249F28C8A8BAABBF4EB45300F44896DE98AC7255D734D885CF75

Function 00408101 Relevance: 16.7, APIs: 11, Instructions: 176filememoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00408089: GetModuleHandleA.KERNEL32(?,?,004041D7), ref: 0040809E
Part of subcall function 00408089: GetProcAddress.KERNEL32 ref: 004080CA

CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,00408612), ref: 00408173
GetShortPathNameA.KERNEL32 ref: 0040818D

Part of subcall function 004077A4: lstrlenA.KERNEL32 ref: 004077BC
Part of subcall function 004077A4: lstrcmpiA.KERNEL32 ref: 004077E4

GetShortPathNameA.KERNEL32 ref: 004081B8
wsprintfA.USER32 ref: 004081EF
GetFileSize.KERNEL32 ref: 0040824A
GlobalAlloc.KERNEL32 ref: 00408266
ReadFile.KERNEL32(?,?), ref: 00408292
SetFilePointer.KERNEL32 ref: 00408358

Part of subcall function 00407868: GetFileAttributesA.KERNELBASE ref: 00407875
Part of subcall function 00407868: CreateFileA.KERNELBASE(?,?,?,?,?,?,?,?,?,?,00000000,?,00403E07), ref: 004078B4

WriteFile.KERNEL32 ref: 0040837B
GlobalFree.KERNEL32 ref: 00408387
CloseHandle.KERNEL32(?,?), ref: 00408391

Memory Dump Source

Source File: 00000000.00000002.4162233942.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4162209415.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162259880.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162282586.000000000040B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.000000000045B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.0000000000483000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PandoraFMS_One_Agent_Windows-lts.jbxd

Similarity

API ID: File$Handle$CloseGlobalNamePathShort$AddressAllocAttributesCreateFreeModulePointerProcReadSizeWritelstrcmpilstrlenwsprintf
String ID:
API String ID: 1472977481-0
Opcode ID: d5d04cc9d5ea6ec76904520980c899f315adf1fa77415180068aea4c81665863
Instruction ID: 308bbf7f557dd640f05079230b4c5f8ffdc3149362ed8bc35b0ed9b5a77fee7d
Opcode Fuzzy Hash: d5d04cc9d5ea6ec76904520980c899f315adf1fa77415180068aea4c81665863
Instruction Fuzzy Hash: E67109B0908705AFD700AF65D98866FBBF4FF84744F01C82EE8C4A7251DB799445CB9A

Function 0040247C Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 60COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00402485
GetDeviceCaps.GDI32 ref: 00402497
MulDiv.KERNEL32 ref: 004024BD
CreateFontIndirectA.GDI32 ref: 00402529

Part of subcall function 004079D3: wsprintfA.USER32 ref: 004079EE

Strings

Z, xrefs: 0040248C
H, xrefs: 004024B2
MS Shell Dlg, xrefs: 004024EE

Memory Dump Source

Source File: 00000000.00000002.4162233942.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4162209415.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162259880.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162282586.000000000040B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.000000000045B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.0000000000483000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PandoraFMS_One_Agent_Windows-lts.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectwsprintf
String ID: H$MS Shell Dlg$Z
API String ID: 1586071882-4218872114
Opcode ID: 881112ba72558d67ed13d821e07257514b29198231bf02e61c5de64094c5b7b1
Instruction ID: 43d35e70bc8dbdfe8576c93b0f3c387e258589e5c84843adacc66f172cbbc799
Opcode Fuzzy Hash: 881112ba72558d67ed13d821e07257514b29198231bf02e61c5de64094c5b7b1
Instruction Fuzzy Hash: CF216AB28093009FD300BF68DD446AABBF8FB89304F05C97EE488E3251C7B84544CB6A

Function 00404CFF Relevance: 12.1, APIs: 8, Instructions: 77COMMON

Download Yara Rule

APIs

GetWindowLongA.USER32 ref: 00404D2C
GetSysColor.USER32 ref: 00404D45
SetTextColor.GDI32 ref: 00404D59
SetBkMode.GDI32 ref: 00404D6B
GetSysColor.USER32 ref: 00404D82
SetBkColor.GDI32 ref: 00404D9C
DeleteObject.GDI32 ref: 00404DBA
CreateBrushIndirect.GDI32 ref: 00404DC7

Memory Dump Source

Source File: 00000000.00000002.4162233942.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4162209415.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162259880.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162282586.000000000040B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.000000000045B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.0000000000483000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PandoraFMS_One_Agent_Windows-lts.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: e96614c8964ac1cd6b477263a2bf992c25e24962f13eaf36a0c103584b46f05f
Instruction ID: 04b3c23794f61a317552016f1abe4b29bcde86f2adf8ab189f55abfa7b5de22e
Opcode Fuzzy Hash: e96614c8964ac1cd6b477263a2bf992c25e24962f13eaf36a0c103584b46f05f
Instruction Fuzzy Hash: 213112B0505705ABCB009FA8D988A6ABFE8EF48710F04886EFD94DB391D735D940CB69

Function 6E5C2E88 Relevance: 10.7, APIs: 7, Instructions: 225COMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(00000000), ref: 6E5C307A

Memory Dump Source

Source File: 00000000.00000002.4163482141.000000006E5C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6E5C0000, based on PE: true

Associated: 00000000.00000002.4163465602.000000006E5C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4163502457.000000006E5C6000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4163520313.000000006E5C8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4163537978.000000006E5C9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4163555114.000000006E5CC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e5c0000_PandoraFMS_One_Agent_Windows-lts.jbxd

Similarity

API ID: FreeGlobal
String ID:
API String ID: 2979337801-0
Opcode ID: 53fdc29596b879b3902f8d8fe8991ec1a41c46c075b2655e2f9a951f3f4bba21
Instruction ID: b9b6eae5df56bd2c2719c4b755f0ab810b6e2ab0808b4241b0dfde64b3dda651
Opcode Fuzzy Hash: 53fdc29596b879b3902f8d8fe8991ec1a41c46c075b2655e2f9a951f3f4bba21
Instruction Fuzzy Hash: 09A15B75904609DFCB00DFE9C4986A9BBF4FF89B54F0588ADE498AB340D7349941CF92

Function 6E5C1040 Relevance: 10.6, APIs: 7, Instructions: 132sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32 ref: 6E5C1077
_amsg_exit.MSVCRT ref: 6E5C10A4

Memory Dump Source

Source File: 00000000.00000002.4163482141.000000006E5C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6E5C0000, based on PE: true

Associated: 00000000.00000002.4163465602.000000006E5C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4163502457.000000006E5C6000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4163520313.000000006E5C8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4163537978.000000006E5C9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4163555114.000000006E5CC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e5c0000_PandoraFMS_One_Agent_Windows-lts.jbxd

Similarity

API ID: Sleep_amsg_exit
String ID:
API String ID: 1015461914-0
Opcode ID: 0bc2beddaba1dbe452c189a6e73d211ecc316ba6bd34073bf9b013e9c2d35ee3
Instruction ID: 5ee8268678132be912cbdae54052a6dbdbc3bcaedc088163fdb98ea5bbef9f9b
Opcode Fuzzy Hash: 0bc2beddaba1dbe452c189a6e73d211ecc316ba6bd34073bf9b013e9c2d35ee3
Instruction Fuzzy Hash: 6E417370614A418FEB409FF9C6B875A76F0FB81F84F02892DD9449B684DB79C949CB83

Function 00DB1038 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

Part of subcall function 00DB238D: lstrcpynA.KERNEL32 ref: 00DB23CA
Part of subcall function 00DB238D: GlobalFree.KERNEL32 ref: 00DB23DF

SHBrowseForFolderA.SHELL32 ref: 00DB10F7
SHGetPathFromIDListA.SHELL32(?), ref: 00DB110F
CoTaskMemFree.OLE32 ref: 00DB1130

Part of subcall function 00DB23EF: GlobalAlloc.KERNEL32 ref: 00DB2412
Part of subcall function 00DB23EF: lstrcpynA.KERNEL32 ref: 00DB2432

Strings

E, xrefs: 00DB10CA
error, xrefs: 00DB1078, 00DB1120

Memory Dump Source

Source File: 00000000.00000002.4163042955.0000000000DB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.4163017212.0000000000DB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.4163067709.0000000000DB3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.4163092635.0000000000DB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.4163118887.0000000000DB7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.4163144543.0000000000DB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_PandoraFMS_One_Agent_Windows-lts.jbxd

Similarity

API ID: FreeGloballstrcpyn$AllocBrowseFolderFromListPathTask
String ID: E$error
API String ID: 3273179968-2359134700
Opcode ID: 0f0b42b845c932e7269f1056546f2c1219da27bb3617bc8ffe95e4abaae379b8
Instruction ID: a46f8796878a3f875bbcb703fd6541cc37d374ff0bc9922798ed8fed8e543e2f
Opcode Fuzzy Hash: 0f0b42b845c932e7269f1056546f2c1219da27bb3617bc8ffe95e4abaae379b8
Instruction Fuzzy Hash: EF2139B4804718DFDB10AF69DC846EABBF8EF84350F00459EE94997300D7768A948FB1

Function 00406347 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 54windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32 ref: 00406377
GetMessagePos.USER32 ref: 00406385
ScreenToClient.USER32 ref: 0040639E
SendMessageA.USER32 ref: 004063BD

Strings

f, xrefs: 004063C2

Memory Dump Source

Source File: 00000000.00000002.4162233942.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4162209415.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162259880.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162282586.000000000040B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.000000000045B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.0000000000483000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PandoraFMS_One_Agent_Windows-lts.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: e247cb14e7cbc10d249b4c088be4279f67b96e3107739047fa0c8582e93359d1
Instruction ID: 4cf5f096f0e2f78d401906831ade355419e8194ea2adda6136bc25bff010bef3
Opcode Fuzzy Hash: e247cb14e7cbc10d249b4c088be4279f67b96e3107739047fa0c8582e93359d1
Instruction Fuzzy Hash: 442106B0804318EFDB00AFA9D88829EFFF4EF84715F00C91EE99997281D77984448F96

Function 0040392C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 47timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32 ref: 0040395C
MulDiv.KERNEL32 ref: 00403992
wsprintfA.USER32 ref: 004039AA
SetWindowTextA.USER32 ref: 004039B7

Strings

d, xrefs: 0040397C

Memory Dump Source

Source File: 00000000.00000002.4162233942.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4162209415.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162259880.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162282586.000000000040B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.000000000045B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.0000000000483000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PandoraFMS_One_Agent_Windows-lts.jbxd

Similarity

API ID: TextTimerWindowwsprintf
String ID: d
API String ID: 2438957755-2564639436
Opcode ID: dd67e884ec8ec0caaa6a545a3b78761555da69fea8bcb67246b7d7cfdc1be238
Instruction ID: b56613fd29131e2b1d50a06e70e6d50693f59c0b8f9709b00288229121e5cf6f
Opcode Fuzzy Hash: dd67e884ec8ec0caaa6a545a3b78761555da69fea8bcb67246b7d7cfdc1be238
Instruction Fuzzy Hash: F11148B1808304AFD700AF28D98869EBFF4FB44745F10C92EF58997290DB789944CB8A

Function 004039E1 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

DestroyWindow.USER32 ref: 004039F9
GetTickCount.KERNEL32 ref: 00403A24
CreateDialogParamA.USER32 ref: 00403A5A
ShowWindow.USER32(?,?,?,?,?,?,?,?,?,?,00403F64), ref: 00403A73

Strings

o, xrefs: 00403A4F

Memory Dump Source

Source File: 00000000.00000002.4162233942.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4162209415.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162259880.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162282586.000000000040B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.000000000045B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.0000000000483000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PandoraFMS_One_Agent_Windows-lts.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID: o
API String ID: 2102729457-252678980
Opcode ID: c87e7bb689c90c73cca680aa2d2e093ebec6ee8f34a2ff9494079182611b8dc5
Instruction ID: 1290f7298517dfc8fb71d2f53176280423ee3bc91481700663a47affe96060cf
Opcode Fuzzy Hash: c87e7bb689c90c73cca680aa2d2e093ebec6ee8f34a2ff9494079182611b8dc5
Instruction Fuzzy Hash: D601E9B0208301AFD710AF65D88C71ABEE8BB40346F01893DE48597290DB788585CF6A

Function 6E5C2AD2 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 67COMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32 ref: 6E5C2B52

Strings

+`\n, xrefs: 6E5C2B21
error, xrefs: 6E5C2B1A

Memory Dump Source

Source File: 00000000.00000002.4163482141.000000006E5C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6E5C0000, based on PE: true

Associated: 00000000.00000002.4163465602.000000006E5C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4163502457.000000006E5C6000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4163520313.000000006E5C8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4163537978.000000006E5C9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4163555114.000000006E5CC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e5c0000_PandoraFMS_One_Agent_Windows-lts.jbxd

Similarity

API ID: FreeGlobal
String ID: +`\n$error
API String ID: 2979337801-3600206984
Opcode ID: 39f0c94a17ed2a50b575994097e7cd68fe42b62ebe20008ce07c3b6782aa35ae
Instruction ID: 2d261a05050bfb8a2bfcc564829959e2f90395ade2ddcb3b6afedb854b45d144
Opcode Fuzzy Hash: 39f0c94a17ed2a50b575994097e7cd68fe42b62ebe20008ce07c3b6782aa35ae
Instruction Fuzzy Hash: 2E210CB4508B05DFCB00AFF4D5A86A9BFF8FF05B58F11886DEA8887240D7749554CB92

Function 004023C9 Relevance: 7.6, APIs: 5, Instructions: 50windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32 ref: 004023D6
GetClientRect.USER32 ref: 004023ED
LoadImageA.USER32 ref: 0040243D
SendMessageA.USER32 ref: 0040245D
DeleteObject.GDI32 ref: 00402471

Memory Dump Source

Source File: 00000000.00000002.4162233942.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4162209415.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162259880.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162282586.000000000040B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.000000000045B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.0000000000483000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PandoraFMS_One_Agent_Windows-lts.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 6b9e9b6faa1a00af3eae5babc4ac847923e0ea189fd3ef769c8cb007565c5f91
Instruction ID: abf57335424ea27cfc3bd9a21e606f2b92d378061a2b335e2ae11d471bcb5056
Opcode Fuzzy Hash: 6b9e9b6faa1a00af3eae5babc4ac847923e0ea189fd3ef769c8cb007565c5f91
Instruction Fuzzy Hash: 2A1104B19083009FD740EF69D94839EFBF4FB88705F01886EF58897250EB788A848F46

Function 00406CC7 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 71windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 00406D06
CallWindowProcA.USER32 ref: 00406DA8

Part of subcall function 004049C7: SendMessageA.USER32 ref: 004049F0

Strings

Pandora FMS Agent 7.0NG.777.1 Setup, xrefs: 00406D44, 00406D77
, xrefs: 00406CE1

Memory Dump Source

Source File: 00000000.00000002.4162233942.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4162209415.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162259880.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162282586.000000000040B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.000000000045B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.0000000000483000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PandoraFMS_One_Agent_Windows-lts.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID: $Pandora FMS Agent 7.0NG.777.1 Setup
API String ID: 3748168415-87424590
Opcode ID: dce0b9ccfbcc526376bbf972b1384a38493b26d43d79b090b71e6b401c74d695
Instruction ID: 376c30814a19dbf3e8d1ceb79ef38d2e8bd4654c647e55e4954393d94a294f82
Opcode Fuzzy Hash: dce0b9ccfbcc526376bbf972b1384a38493b26d43d79b090b71e6b401c74d695
Instruction Fuzzy Hash: A2212CB0508305AFD710AF15D98496FBBF8EF84715F01943FF885A7281C7B859508B5A

Function 00DB1304 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,?,?,?,?,?,?,00DB143A), ref: 00DB1315
CharPrevA.USER32(?,?,?,?,?,?,?,?,00DB143A), ref: 00DB1325
MapDialogRect.USER32(00000000), ref: 00DB1396

Strings

d, xrefs: 00DB1347

Memory Dump Source

Source File: 00000000.00000002.4163042955.0000000000DB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.4163017212.0000000000DB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.4163067709.0000000000DB3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.4163092635.0000000000DB6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.4163118887.0000000000DB7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.4163144543.0000000000DB9000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_PandoraFMS_One_Agent_Windows-lts.jbxd

Similarity

API ID: CharDialogPrevRectlstrlen
String ID: d
API String ID: 3411278111-2564639436
Opcode ID: 11e2e8fad07774ae8c4db5fd71b33977c5f30d0c5e813b81b9e696ce9ed136ad
Instruction ID: f00ffd0d2c006d08c5935461dfbf29305bad0f19c484e7164cae96673c1ac4fc
Opcode Fuzzy Hash: 11e2e8fad07774ae8c4db5fd71b33977c5f30d0c5e813b81b9e696ce9ed136ad
Instruction Fuzzy Hash: 52214875A08729DFCB10DF64D8846EEBBF8AB48700F40852AE986D7300E770D944CBE1

Function 6E5C1440 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 25libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 6E5C1456
GetProcAddress.KERNEL32 ref: 6E5C1473

Strings

_Jv_RegisterClasses, xrefs: 6E5C1468
libgcj-16.dll, xrefs: 6E5C144F

Memory Dump Source

Source File: 00000000.00000002.4163482141.000000006E5C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6E5C0000, based on PE: true

Associated: 00000000.00000002.4163465602.000000006E5C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4163502457.000000006E5C6000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4163520313.000000006E5C8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4163537978.000000006E5C9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4163555114.000000006E5CC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e5c0000_PandoraFMS_One_Agent_Windows-lts.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: _Jv_RegisterClasses$libgcj-16.dll
API String ID: 1646373207-328863460
Opcode ID: fb8a6bb6d88f095a24dfa36c465cd94e140ddd7333cb5af2f2c05a077dbe6e2d
Instruction ID: e76af4fe049a6557068719adc2a05e69a8bbc5231633e53917f7bf8d37eafce4
Opcode Fuzzy Hash: fb8a6bb6d88f095a24dfa36c465cd94e140ddd7333cb5af2f2c05a077dbe6e2d
Instruction Fuzzy Hash: 26E0C970614A018BE740BFF986BE32A7BF4AB82E45F42846CC985E7244EE70D449C793

Function 6E5C1ED4 Relevance: 6.2, APIs: 3, Strings: 1, Instructions: 229COMMON

Download Yara Rule

APIs

Part of subcall function 6E5C1AC3: lstrcpyA.KERNEL32(?,?,?,6E5C1D9D,?,?,?,6E5C14CB), ref: 6E5C1AEE
Part of subcall function 6E5C1AC3: GlobalFree.KERNEL32(00000000), ref: 6E5C1B02

GlobalFree.KERNEL32 ref: 6E5C1F46
GlobalFree.KERNEL32 ref: 6E5C220B
GlobalFree.KERNEL32(00000000), ref: 6E5C2211

Strings

>, xrefs: 6E5C218C

Memory Dump Source

Source File: 00000000.00000002.4163482141.000000006E5C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6E5C0000, based on PE: true

Associated: 00000000.00000002.4163465602.000000006E5C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4163502457.000000006E5C6000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4163520313.000000006E5C8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4163537978.000000006E5C9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4163555114.000000006E5CC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e5c0000_PandoraFMS_One_Agent_Windows-lts.jbxd

Similarity

API ID: FreeGlobal$lstrcpy
String ID: >
API String ID: 176019282-325317158
Opcode ID: 87254c482326426157807a6a45a12002f7431ac612f560a64d9f314d138807a1
Instruction ID: 74043427e9f5d45ba1e77a9927b6befe71a1225257ffaea2cb0d2483085817e5
Opcode Fuzzy Hash: 87254c482326426157807a6a45a12002f7431ac612f560a64d9f314d138807a1
Instruction Fuzzy Hash: 14916F39E04B68CFDB20CAE9C86079AB7F6BB85B50F05949ED68CA7201D7345D818F53

Function 00407B27 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

APIs

CharNextA.USER32(?,?,?,?,?,?,00000000,?,?,?,004040DE), ref: 00407B8F
CharNextA.USER32(?,?,?,?,?,00000000,?,?,?,004040DE), ref: 00407BAE
CharNextA.USER32(?,?,?,00000000,?,?,?,004040DE), ref: 00407BBA
CharPrevA.USER32(?,?,00000000,?,?,?,004040DE), ref: 00407BD5

Memory Dump Source

Source File: 00000000.00000002.4162233942.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4162209415.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162259880.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162282586.000000000040B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162312977.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.000000000045B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4162428637.0000000000483000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PandoraFMS_One_Agent_Windows-lts.jbxd

Similarity

API ID: Char$Next$Prev
String ID:
API String ID: 589700163-0
Opcode ID: 7cf81dcc3d96b46d5d0325c684f48696c58df3b32a57e50987832e823e076a25
Instruction ID: a017ce9f29574a2fbdca88c11cbcba89ae79f0d64e1ae8b2359e16dfb5afbbe4
Opcode Fuzzy Hash: 7cf81dcc3d96b46d5d0325c684f48696c58df3b32a57e50987832e823e076a25
Instruction Fuzzy Hash: 28219471C0C3409EDB216F288C8066AFFF59F95724F4984BFE4C45B282D778A881876B

Function 6E5C3880 Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

_lock.MSVCRT ref: 6E5C38A5
__dllonexit.MSVCRT ref: 6E5C38E3
_unlock.MSVCRT ref: 6E5C3913
_onexit.MSVCRT ref: 6E5C3927

Memory Dump Source

Source File: 00000000.00000002.4163482141.000000006E5C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6E5C0000, based on PE: true

Associated: 00000000.00000002.4163465602.000000006E5C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4163502457.000000006E5C6000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4163520313.000000006E5C8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4163537978.000000006E5C9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4163555114.000000006E5CC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e5c0000_PandoraFMS_One_Agent_Windows-lts.jbxd

Similarity

API ID: __dllonexit_lock_onexit_unlock
String ID:
API String ID: 209411981-0
Opcode ID: 5548a53bd232445f15e51c804d3f6c3bb19bc928ea4ee957be7dcd3a3286b85c
Instruction ID: 8052c45d4bec48a81b89e232f6dc3365d481f40536303d19ffa35a018f8c3734
Opcode Fuzzy Hash: 5548a53bd232445f15e51c804d3f6c3bb19bc928ea4ee957be7dcd3a3286b85c
Instruction Fuzzy Hash: 161106B4919B048FCB40EFB4C49849EBBE4AF95A44F011C2EE9C4C7340EB38D9958B83

Function 6E5C3CA0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 81memoryCOMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32 ref: 6E5C3D30
VirtualProtect.KERNEL32 ref: 6E5C3D72

Strings

@, xrefs: 6E5C3D5B

Memory Dump Source

Source File: 00000000.00000002.4163482141.000000006E5C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6E5C0000, based on PE: true

Associated: 00000000.00000002.4163465602.000000006E5C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4163502457.000000006E5C6000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4163520313.000000006E5C8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4163537978.000000006E5C9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4163555114.000000006E5CC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e5c0000_PandoraFMS_One_Agent_Windows-lts.jbxd

Similarity

API ID: Virtual$ProtectQuery
String ID: @
API String ID: 1027372294-2766056989
Opcode ID: dbfd7b8cc633845426074aec9857913a31f4ca2e37780ab35b0169c5443941e6
Instruction ID: 5db2839361e50f659f152f4919c7d1c439fde235d51cc27fc195e7da8dfd9d85
Opcode Fuzzy Hash: dbfd7b8cc633845426074aec9857913a31f4ca2e37780ab35b0169c5443941e6
Instruction Fuzzy Hash: 7E316F72504B068FD710DFB8C9A865AFBF4BB85F54F46899CD95887240E730E841CB93

Function 6E5C15C4 Relevance: 5.1, APIs: 4, Instructions: 115memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6E5C1AC3: lstrcpyA.KERNEL32(?,?,?,6E5C1D9D,?,?,?,6E5C14CB), ref: 6E5C1AEE
Part of subcall function 6E5C1AC3: GlobalFree.KERNEL32(00000000), ref: 6E5C1B02

GlobalAlloc.KERNEL32 ref: 6E5C166C
GlobalFree.KERNEL32 ref: 6E5C16D1
GlobalFree.KERNEL32 ref: 6E5C172B
GlobalFree.KERNEL32 ref: 6E5C173C

Memory Dump Source

Source File: 00000000.00000002.4163482141.000000006E5C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6E5C0000, based on PE: true

Associated: 00000000.00000002.4163465602.000000006E5C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4163502457.000000006E5C6000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4163520313.000000006E5C8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4163537978.000000006E5C9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4163555114.000000006E5CC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e5c0000_PandoraFMS_One_Agent_Windows-lts.jbxd

Similarity

API ID: Global$Free$Alloclstrcpy
String ID:
API String ID: 852173138-0
Opcode ID: 8189f534069a341e8d4021b56f36a8e15f0c1da63cb738f11c2f49cdbabcd202
Instruction ID: f55bd1ca918b85953870e3711d1c7b100d7b06f828ea03030092589967f430b5
Opcode Fuzzy Hash: 8189f534069a341e8d4021b56f36a8e15f0c1da63cb738f11c2f49cdbabcd202
Instruction Fuzzy Hash: 35415EB4904A058FCB00DFE8C5A85AAFBF5FB8AF04F05C95ED58497241D7349486CF52

Function 6E5C4177 Relevance: 5.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 6E5C41A7
free.MSVCRT ref: 6E5C41F9
LeaveCriticalSection.KERNEL32 ref: 6E5C4205

Memory Dump Source

Source File: 00000000.00000002.4163482141.000000006E5C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6E5C0000, based on PE: true

Associated: 00000000.00000002.4163465602.000000006E5C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4163502457.000000006E5C6000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4163520313.000000006E5C8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4163537978.000000006E5C9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4163555114.000000006E5CC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e5c0000_PandoraFMS_One_Agent_Windows-lts.jbxd

Similarity

API ID: CriticalSection$EnterLeavefree
String ID:
API String ID: 4020351045-0
Opcode ID: 99395ee615209239c0a01609c9f3e439448ab6f6d5cdff7e1617f3f6409888ae
Instruction ID: 018f2c71292d4037724393d6a36352418f7f6a0f31becb9448b19d8d65bc3760
Opcode Fuzzy Hash: 99395ee615209239c0a01609c9f3e439448ab6f6d5cdff7e1617f3f6409888ae
Instruction Fuzzy Hash: 69015EB56046018FD700EFF8D8A9919B7F1BB55B00F55496DED8987605EB309852CB83

Function 6E5C4090 Relevance: 5.0, APIs: 4, Instructions: 39COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6E5C42F5,?,?,?,?,?,6E5C3B78), ref: 6E5C409E
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,6E5C42F5,?,?,?,?,?,6E5C3B78), ref: 6E5C40C5
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,6E5C42F5,?,?,?,?,?,6E5C3B78), ref: 6E5C40CC
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,6E5C42F5,?,?,?,?,?,6E5C3B78), ref: 6E5C40EC

Memory Dump Source

Source File: 00000000.00000002.4163482141.000000006E5C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6E5C0000, based on PE: true

Associated: 00000000.00000002.4163465602.000000006E5C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4163502457.000000006E5C6000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4163520313.000000006E5C8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4163537978.000000006E5C9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4163555114.000000006E5CC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e5c0000_PandoraFMS_One_Agent_Windows-lts.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeaveValue
String ID:
API String ID: 682475483-0
Opcode ID: c991cc6bda3599e5e96b592b4e590799303f7b4f24d2023f940fd92eea0ff549
Instruction ID: 08b022bf466d8c6dd9c33391619ed65589c351eb0f546eeb5fc01cbbffb2ad6d
Opcode Fuzzy Hash: c991cc6bda3599e5e96b592b4e590799303f7b4f24d2023f940fd92eea0ff549
Instruction Fuzzy Hash: 0BF044B5500B158BDB00BFF9D5AD91A7BF4EA45E54B06056CDD485B208DA30E81ACBA3

Analysis Process: PandoraAgent.exePID: 7764, Parent PID: 7700COMMON

Execution Graph

Execution Coverage:	51.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	6
Total number of Limit Nodes:	1

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Non-executed Functions

Function 00654A30 Relevance: 7.6, APIs: 5, Instructions: 56
timethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00654A75
GetCurrentProcessId.KERNEL32 ref: 00654A80
GetCurrentThreadId.KERNEL32 ref: 00654A89
GetTickCount.KERNEL32 ref: 00654A91
QueryPerformanceCounter.KERNEL32 ref: 00654A9E

Memory Dump Source

Source File: 00000008.00000002.1898434459.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1898404146.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1898656578.0000000000722000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1898684553.0000000000732000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1898706731.0000000000736000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1898706731.000000000079D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1898809562.000000000082B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1898809562.0000000000837000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1898855521.0000000000839000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1898855521.000000000083D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1898898517.000000000083E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_PandoraAgent.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: a229c177b31d8b5e617a06d5b7807bd764e8c50821ad7ccf31540a0d0d88c111
Instruction ID: 6d2f32427776540ec56a7ee9d9ae1a9b7b41f0b35b6308f6b2ee3d61313dba6b
Opcode Fuzzy Hash: a229c177b31d8b5e617a06d5b7807bd764e8c50821ad7ccf31540a0d0d88c111
Instruction Fuzzy Hash: 6B11BC6661EB0042FB204B20FC043596361BB88BF9F4856609E8C02BA8DE3CCA88C310

Analysis Process: ShortElev.exePID: 7984, Parent PID: 7308COMMON

Execution Graph

Execution Coverage:	15.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	286
Total number of Limit Nodes:	24

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00401179 Relevance: 18.2, APIs: 12, Instructions: 205
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32 ref: 00401211
SetUnhandledExceptionFilter.KERNEL32 ref: 00401292
GetStartupInfoA.KERNEL32 ref: 00401473

Memory Dump Source

Source File: 0000000F.00000002.1913431590.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.1913371067.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.1913450533.0000000000402000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.1914262879.0000000000404000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.1914375125.0000000000407000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.1914431363.000000000040A000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ShortElev.jbxd

Similarity

API ID: ExceptionFilterInfoSleepStartupUnhandled
String ID:
API String ID: 2839300629-0
Opcode ID: 99cc06deda5b5394276622cd1691a00f6eb4851a20b4a29d9602f214fe30ab98
Instruction ID: c15df658a3cc893094c1fb6861b894ff7586e5007a9f56061a4e12fa1a874bd6
Opcode Fuzzy Hash: 99cc06deda5b5394276622cd1691a00f6eb4851a20b4a29d9602f214fe30ab98
Instruction Fuzzy Hash: 6F818CB1A042008FD710EF69DA8475ABBE0FB44304F06853ED985BB3B1D779A855CF9A

Function 00401AE0 Relevance: 31.7, APIs: 11, Strings: 7, Instructions: 175
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

fwrite.MSVCRT ref: 00401B0B
vfprintf.MSVCRT ref: 00401B27
abort.MSVCRT ref: 00401B2C
VirtualQuery.KERNEL32 ref: 00401BEA
VirtualQuery.KERNEL32 ref: 00401C23
memcpy.MSVCRT ref: 00401C51

Strings

@, xrefs: 00401CFE
0E@, xrefs: 00401E9D
0E@, xrefs: 00401ED4
0E@, xrefs: 00401E3F
$E@, xrefs: 00401E1E
0E@, xrefs: 00401DE2
0E@, xrefs: 00401FBD

Memory Dump Source

Source File: 0000000F.00000002.1913431590.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.1913371067.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.1913450533.0000000000402000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.1914262879.0000000000404000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.1914375125.0000000000407000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.1914431363.000000000040A000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ShortElev.jbxd

Similarity

API ID: QueryVirtual$abortfwritememcpyvfprintf
String ID: $E@$0E@$0E@$0E@$0E@$0E@$@
API String ID: 3828011698-1165053847
Opcode ID: b69e903d09c204b8c876a37b1ffb6f923a4892cc2b1158d5b22b8654e6bc15b6
Instruction ID: 6181d22603ce2d12ae831f80ea0475ddf7c6fff155df32b4345b9f5259be3375
Opcode Fuzzy Hash: b69e903d09c204b8c876a37b1ffb6f923a4892cc2b1158d5b22b8654e6bc15b6
Instruction Fuzzy Hash: 07711EB49083059FD700EF69D68455ABBE0FF88344F01892EF989A73A1D778E944CF4A

Function 00401530 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 75
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

puts.MSVCRT ref: 00401550
puts.MSVCRT ref: 0040155C
puts.MSVCRT ref: 00401568
fopen.MSVCRT ref: 0040158A
printf.MSVCRT ref: 004015AD

Strings

", xrefs: 0040153E
d@@, xrefs: 0040157F

Memory Dump Source

Source File: 0000000F.00000002.1913431590.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.1913371067.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.1913450533.0000000000402000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.1914262879.0000000000404000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.1914375125.0000000000407000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.1914431363.000000000040A000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ShortElev.jbxd

Similarity

API ID: puts$fopenprintf
String ID: "$d@@
API String ID: 2713031070-2601049721
Opcode ID: a8d501f061a4ca7ffe6a083a5da3a2b9d59d447b3f0aa522e0ec829a37c1c441
Instruction ID: b307bc13793dc2d4bb6869ad18d3f337f783364bb2641a6e7dd08223ad808d7d
Opcode Fuzzy Hash: a8d501f061a4ca7ffe6a083a5da3a2b9d59d447b3f0aa522e0ec829a37c1c441
Instruction Fuzzy Hash: F031C4B59083019FD700EF29C54971EBBE0EF84348F00C92EE585AB391D7B9D4889B9A

Function 004012F9 Relevance: 7.6, APIs: 5, Instructions: 76
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 00401292
malloc.MSVCRT ref: 0040134A
strlen.MSVCRT ref: 0040136A
malloc.MSVCRT ref: 00401375
memcpy.MSVCRT ref: 00401391
_cexit.MSVCRT ref: 004013FF
_amsg_exit.MSVCRT ref: 0040142B
_initterm.MSVCRT ref: 0040144D

Memory Dump Source

Source File: 0000000F.00000002.1913431590.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.1913371067.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.1913450533.0000000000402000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.1914262879.0000000000404000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.1914375125.0000000000407000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.1914431363.000000000040A000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ShortElev.jbxd

Similarity

API ID: malloc$ExceptionFilterUnhandled_amsg_exit_cexit_inittermmemcpystrlen
String ID:
API String ID: 2574462208-0
Opcode ID: c9b06d42529bcedfef8fee72870fd89262aca3d1dfebd48efde91bed2a28f986
Instruction ID: d4b69ffb3596250692abb332bb1b8398c5fa04885f4e607fe9df41cc56b7db4c
Opcode Fuzzy Hash: c9b06d42529bcedfef8fee72870fd89262aca3d1dfebd48efde91bed2a28f986
Instruction Fuzzy Hash: 3F314AB5A003048FDB20DF69DA8065ABBF5FB84304F16853ED949BB3A1D379A811CF59

Function 00401EE9 Relevance: 3.0, APIs: 2, Instructions: 32
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualQuery.KERNEL32 ref: 00401F27
VirtualProtect.KERNELBASE ref: 00401F58

Memory Dump Source

Source File: 0000000F.00000002.1913431590.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.1913371067.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.1913450533.0000000000402000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.1914262879.0000000000404000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.1914375125.0000000000407000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.1914431363.000000000040A000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ShortElev.jbxd

Similarity

API ID: Virtual$ProtectQuery
String ID:
API String ID: 1027372294-0
Opcode ID: 23a96097263dae46e098c6e48332b17175af7e7fd769d52e0bd5a42bd1668501
Instruction ID: 3591d5fdb85a6e1e196882128eae80fbbbb2c932e026e69d4f7c2f88bf2d9e64
Opcode Fuzzy Hash: 23a96097263dae46e098c6e48332b17175af7e7fd769d52e0bd5a42bd1668501
Instruction Fuzzy Hash: 9E01D674908301DFDB10EF68DA8869EBBF2BF44300F158429E945A7361D734E855DF46

Non-executed Functions

Function 004021BC Relevance: 7.5, APIs: 5, Instructions: 38
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 0040220F
UnhandledExceptionFilter.KERNEL32 ref: 0040221F
GetCurrentProcess.KERNEL32 ref: 00402228
TerminateProcess.KERNEL32 ref: 00402239
abort.MSVCRT ref: 00402242

Memory Dump Source

Source File: 0000000F.00000002.1913450533.0000000000402000.00000080.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.1913371067.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.1913431590.0000000000401000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.1914262879.0000000000404000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.1914375125.0000000000407000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.1914431363.000000000040A000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ShortElev.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentTerminateabort
String ID:
API String ID: 520269711-0
Opcode ID: e2f8fd7fa2d42eb3a8e5b247162d56bc6a8181ca5aa0ed0c781dc752fce05052
Instruction ID: 165403e1dcaf70f97a7d4c49adf17f634e1223ea88bb695fc664b9e463cd37e2
Opcode Fuzzy Hash: e2f8fd7fa2d42eb3a8e5b247162d56bc6a8181ca5aa0ed0c781dc752fce05052
Instruction Fuzzy Hash: 450192B4805204DFC700EFA9EB492497BF0BB09305F018539ED8AAB365E774A5598F9A

Function 004021C0 Relevance: 7.5, APIs: 5, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 0040220F
UnhandledExceptionFilter.KERNEL32 ref: 0040221F
GetCurrentProcess.KERNEL32 ref: 00402228
TerminateProcess.KERNEL32 ref: 00402239
abort.MSVCRT ref: 00402242

Memory Dump Source

Source File: 0000000F.00000002.1913450533.0000000000402000.00000080.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.1913371067.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.1913431590.0000000000401000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.1914262879.0000000000404000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.1914375125.0000000000407000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.1914431363.000000000040A000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ShortElev.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentTerminateabort
String ID:
API String ID: 520269711-0
Opcode ID: 04dd601da9111b5c479d65fcb981df0056497f434b1dd15647caec8f0cb2ddd3
Instruction ID: b3ccbfaf9c7a333ee7244beb5fafaa86e70c704d0c6fe5de34a70052f219efa6
Opcode Fuzzy Hash: 04dd601da9111b5c479d65fcb981df0056497f434b1dd15647caec8f0cb2ddd3
Instruction Fuzzy Hash: F001A4B4805204DFC700EFA9EB492487FF0BB09305F018539ED8AAB365E774A5598F9A

Function 00401870 Relevance: 12.1, APIs: 8, Instructions: 83
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

signal.MSVCRT ref: 004018AA
signal.MSVCRT ref: 0040194F
signal.MSVCRT ref: 00401968
signal.MSVCRT ref: 0040198E
signal.MSVCRT ref: 004019DF

Memory Dump Source

Source File: 0000000F.00000002.1913431590.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.1913371067.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.1913450533.0000000000402000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.1914262879.0000000000404000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.1914375125.0000000000407000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.1914431363.000000000040A000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ShortElev.jbxd

Similarity

API ID: signal
String ID:
API String ID: 1946981877-0
Opcode ID: cc5e0f6f3a19240111b8d9756e2819022e344453821d3244ecaef8342e094c22
Instruction ID: ef6f55998a86da59a904ba65539066fa55ff3d2951436b8cc2def4a2c2d336d1
Opcode Fuzzy Hash: cc5e0f6f3a19240111b8d9756e2819022e344453821d3244ecaef8342e094c22
Instruction Fuzzy Hash: E5314DB1504301CAE710BF65C29436E76E8AB45358F15892FE1C8A73E1C7BDC984DB1B

Function 00402110 Relevance: 7.6, APIs: 5, Instructions: 54
timethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00402149
GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,004014F2), ref: 0040215A
GetCurrentThreadId.KERNEL32 ref: 00402162
GetTickCount.KERNEL32 ref: 0040216A
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,004014F2), ref: 00402179

Memory Dump Source

Source File: 0000000F.00000002.1913450533.0000000000402000.00000080.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.1913371067.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.1913431590.0000000000401000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.1914262879.0000000000404000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.1914375125.0000000000407000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.1914431363.000000000040A000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ShortElev.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: 456ab34481953780d482b3704d0cc115c67e335bd347a39907ea1c0fe4ad7b57
Instruction ID: a34ecbd558ef4af1ba273e244e8b7f41493d51da4d3b68ece57e2ea5233ef8d1
Opcode Fuzzy Hash: 456ab34481953780d482b3704d0cc115c67e335bd347a39907ea1c0fe4ad7b57
Instruction Fuzzy Hash: 1D117375D093008FC310DF79EA8855BBBE4FB8C255F05083AE684DB350DA3599598BD7

Function 00401790 Relevance: 6.0, APIs: 4, Instructions: 46
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_lock.MSVCRT ref: 004017B5
__dllonexit.MSVCRT ref: 004017F3
_unlock.MSVCRT ref: 00401823
_onexit.MSVCRT ref: 00401837

Memory Dump Source

Source File: 0000000F.00000002.1913431590.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.1913371067.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.1913450533.0000000000402000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.1914262879.0000000000404000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.1914375125.0000000000407000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.1914431363.000000000040A000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ShortElev.jbxd

Similarity

API ID: __dllonexit_lock_onexit_unlock
String ID:
API String ID: 209411981-0
Opcode ID: 4b72cae09ac0519ac9bef8fe7a193a8243c8ed8e8ea69326f3d3de4b2cebaf89
Instruction ID: d4ff4da94d25b7f665149e1a51568b9879a9b2cae011600a9f4df0321a1fa380
Opcode Fuzzy Hash: 4b72cae09ac0519ac9bef8fe7a193a8243c8ed8e8ea69326f3d3de4b2cebaf89
Instruction Fuzzy Hash: CD1180B991A3018FC700EF79D58551EBBE0AB49344F41493EF8C4A73A2E63894948B8A

Function 00402337 Relevance: 5.0, APIs: 4, Instructions: 48
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32 ref: 00402367
free.MSVCRT ref: 004023B9
LeaveCriticalSection.KERNEL32 ref: 004023C5

Memory Dump Source

Source File: 0000000F.00000002.1913450533.0000000000402000.00000080.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.1913371067.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.1913431590.0000000000401000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.1914262879.0000000000404000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.1914375125.0000000000407000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.1914431363.000000000040A000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ShortElev.jbxd

Similarity

API ID: CriticalSection$EnterLeavefree
String ID:
API String ID: 4020351045-0
Opcode ID: 8ee836b976f67aeea1b8b27855f0d8eaaae248bbd9ae32ed0cd8c7042e8c57fd
Instruction ID: b1e28576f2fa02e77e2260c3c406feebba2d56c4249656223933477f267f2ddd
Opcode Fuzzy Hash: 8ee836b976f67aeea1b8b27855f0d8eaaae248bbd9ae32ed0cd8c7042e8c57fd
Instruction Fuzzy Hash: A0016571A041118FD704AF78DA8851AB7E1BB80300F15857ADD86BB3D2E77CA851CBDE

Function 00402250 Relevance: 5.0, APIs: 4, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32 ref: 0040225E
TlsGetValue.KERNEL32 ref: 00402285
GetLastError.KERNEL32 ref: 0040228C
LeaveCriticalSection.KERNEL32 ref: 004022AC

Memory Dump Source

Source File: 0000000F.00000002.1913450533.0000000000402000.00000080.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.1913371067.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.1913431590.0000000000401000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.1914262879.0000000000404000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.1914375125.0000000000407000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.1914431363.000000000040A000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ShortElev.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeaveValue
String ID:
API String ID: 682475483-0
Opcode ID: 779c3b759be3563ad33a6946f233231bdf77dececdbb531bcb012fd1311d0d8a
Instruction ID: bad66241d4b588debb01c28b8d7b76bd65fc326059fd977c8fbe74e1655a1b79
Opcode Fuzzy Hash: 779c3b759be3563ad33a6946f233231bdf77dececdbb531bcb012fd1311d0d8a
Instruction Fuzzy Hash: B3F0A4B19042108FDB10BFB8EA8891B7BA4AA44750B06047DDD856B385D734B819CBAB

Analysis Process: PandoraAgent.exePID: 3620, Parent PID: 620COMMON

Execution Graph

Execution Coverage:	51.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	6
Total number of Limit Nodes:	1

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Non-executed Functions

Function 00654A30 Relevance: 7.6, APIs: 5, Instructions: 56
timethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00654A75
GetCurrentProcessId.KERNEL32 ref: 00654A80
GetCurrentThreadId.KERNEL32 ref: 00654A89
GetTickCount.KERNEL32 ref: 00654A91
QueryPerformanceCounter.KERNEL32 ref: 00654A9E

Memory Dump Source

Source File: 0000001B.00000002.4162179057.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001B.00000002.4162153250.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001B.00000002.4162545419.0000000000722000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001B.00000002.4162576475.0000000000732000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001B.00000002.4162596872.0000000000736000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001B.00000002.4162596872.000000000079D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001B.00000002.4162743806.000000000082B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001B.00000002.4162743806.0000000000837000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001B.00000002.4162794485.0000000000839000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001B.00000002.4162794485.000000000083D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001B.00000002.4162850266.000000000083E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_400000_PandoraAgent.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: a229c177b31d8b5e617a06d5b7807bd764e8c50821ad7ccf31540a0d0d88c111
Instruction ID: 6d2f32427776540ec56a7ee9d9ae1a9b7b41f0b35b6308f6b2ee3d61313dba6b
Opcode Fuzzy Hash: a229c177b31d8b5e617a06d5b7807bd764e8c50821ad7ccf31540a0d0d88c111
Instruction Fuzzy Hash: 6B11BC6661EB0042FB204B20FC043596361BB88BF9F4856609E8C02BA8DE3CCA88C310

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report PandoraFMS_One_Agent_Windows-lts.x86_64.exe

Overview

General Information

Detection

Compliance

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Privilege Escalation

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files\pandora_agent\LICENSE_EN.txt

C:\Program Files\pandora_agent\LICENSE_ES.txt

C:\Program Files\pandora_agent\PandoraAgent.exe

C:\Program Files\pandora_agent\PandoraFMS_Agent.url

C:\Program Files\pandora_agent\README.txt

C:\Program Files\pandora_agent\config.tmp.conf

C:\Program Files\pandora_agent\key\id_dsa

C:\Program Files\pandora_agent\key\id_dsa.pub

C:\Program Files\pandora_agent\pandora.ico

C:\Program Files\pandora_agent\pandora_agent.log

C:\Program Files\pandora_agent\scripts\delete_at_job.bat

C:\Program Files\pandora_agent\scripts\edit_config_file.bat

C:\Program Files\pandora_agent\scripts\install_service_restart.bat

C:\Program Files\pandora_agent\scripts\restart_pandora_agent.bat

C:\Program Files\pandora_agent\scripts\start_pandora_agent.bat

C:\Program Files\pandora_agent\scripts\stop_pandora_agent.bat

C:\Program Files\pandora_agent\temp\pandora_agent_nsis.conf

Windows Analysis Report
PandoraFMS_One_Agent_Windows-lts.x86_64.exe

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre