Edit tour

Windows Analysis Report
YKTNuK117e.exe

Overview

General Information

Sample name:	YKTNuK117e.exe renamed because original name is a hash value
Original sample name:	200a92ad17110cb3dacc7387b12186c6.exe
Analysis ID:	1429083
MD5:	200a92ad17110cb3dacc7387b12186c6
SHA1:	6bee61858fbf3152f748b3dcdffe0509a8d30a57
SHA256:	4685803ad19d283ca259f4af5fff5f0c397c0fe0c3032b663d0b99d510c4fcb6
Tags:	exenjratRAT
Infos:

Detection

Njrat

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected Njrat

.NET source code contains potential unpacker

.NET source code references suspicious native API functions

C2 URLs / IPs found in malware configuration

Contains functionality to log keystrokes (.Net Source)

Creates autostart registry keys with suspicious names

Disables zone checking for all users

Drops PE files to the startup folder

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies the windows firewall

Protects its processes via BreakOnTermination flag

Sigma detected: New RUN Key Pointing to Suspicious Folder

Uses netsh to modify the Windows network and firewall settings

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to call native functions

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Startup Folder File Write

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Stores files to the Windows start menu directory

Uses 32bit PE files

Yara signature match

Classification

Process Tree

System is w10x64

YKTNuK117e.exe (PID: 7344 cmdline: "C:\Users\user\Desktop\YKTNuK117e.exe" MD5: 200A92AD17110CB3DACC7387B12186C6)

WindowsServices.exe (PID: 7440 cmdline: "C:\Users\user\AppData\Local\Temp\WindowsServices.exe" MD5: 200A92AD17110CB3DACC7387B12186C6)

netsh.exe (PID: 7484 cmdline: netsh firewall add allowedprogram "C:\Users\user\AppData\Local\Temp\WindowsServices.exe" "WindowsServices.exe" ENABLE MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

conhost.exe (PID: 7492 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WindowsServices.exe (PID: 7884 cmdline: "C:\Users\user\AppData\Local\Temp\WindowsServices.exe" .. MD5: 200A92AD17110CB3DACC7387B12186C6)

WindowsServices.exe (PID: 8004 cmdline: "C:\Users\user\AppData\Local\Temp\WindowsServices.exe" .. MD5: 200A92AD17110CB3DACC7387B12186C6)

WindowsServices.exe (PID: 8064 cmdline: "C:\Users\user\AppData\Local\Temp\WindowsServices.exe" .. MD5: 200A92AD17110CB3DACC7387B12186C6)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
NjRAT	RedPacket Security describes NJRat as "a remote access trojan (RAT) has capabilities to log keystrokes, access the victim's camera, steal credentials stored in browsers, open a reverse shell, upload/download files, view the victim's desktop, perform process, file, and registry manipulations, and capabilities to let the attacker update, uninstall, restart, close, disconnect the RAT and rename its campaign ID. Through the Command & Control (CnC) server software, the attacker has capabilities to create and configure the malware to spread through USB drives."It is supposedly popular with actors in the Middle East. Similar to other RATs, many leaked builders may be backdoored.	AQUATIC PANDA Earth Lusca Operation C-Major The Gorgon Group	http://blog.trendmicro.com/trendlabs-security-intelligence/new-rats-emerge-from-leaked-njw0rm-source-code/ http://blogs.360.cn/post/analysis-of-apt-c-37.html http://threatgeek.typepad.com/files/fta-1009---njrat-uncovered-1.pdf https://about.fb.com/news/2021/04/taking-action-against-hackers-in-palestine/ https://asec.ahnlab.com/1369	https://malpedia.caad.fkie.fraunhofer.de/details/win.njrat

Malware Configuration

Threatname: Njrat

{"Host": "83.196.78.85", "Port": "8080", "Version": "0.7d", "Campaign ID": "ok", "Registry": "Software\\Microsoft\\Windows\\CurrentVersion\\Run", "Startup": "19447a578b6a3b2cdbc5a3dc3e7f5251"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
YKTNuK117e.exe	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
YKTNuK117e.exe	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x5767:$a1: get_Registry 0x6b20:$a2: SEE_MASK_NOZONECHECKS 0x6930:$a3: Download ERROR 0x6c58:$a4: cmd.exe /c ping 0 -n 2 & del " 0x6bf8:$a5: netsh firewall delete allowedprogram "
YKTNuK117e.exe	CN_disclosed_20180208_c	Detects malware from disclosed CN malware set	Florian Roth	0x6c58:$x1: cmd.exe /c ping 0 -n 2 & del " 0x682a:$s1: winmgmts:\\.\root\SecurityCenter2 0x6952:$s3: Executed As 0x5fb3:$s5: Stub.exe 0x6930:$s6: Download ERROR 0x67ec:$s8: Select * From AntiVirusProduct
YKTNuK117e.exe	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x6b50:$a1: netsh firewall add allowedprogram 0x6b20:$a2: SEE_MASK_NOZONECHECKS 0x6ce0:$b1: [TAP] 0x6c58:$c3: cmd.exe /c ping
YKTNuK117e.exe	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x6b20:$reg: SEE_MASK_NOZONECHECKS 0x690c:$msg: Execute ERROR 0x696c:$msg: Execute ERROR 0x6c58:$ping: cmd.exe /c ping 0 -n 2 & del
YKTNuK117e.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x6bf8:$s1: netsh firewall delete allowedprogram 0x6b50:$s2: netsh firewall add allowedprogram 0x6c58:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x690c:$s4: Execute ERROR 0x696c:$s4: Execute ERROR 0x6930:$s5: Download ERROR 0x6c96:$s6: [kl]
Click to see the 1 entries

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\WindowsServices.exe	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x5767:$a1: get_Registry 0x6b20:$a2: SEE_MASK_NOZONECHECKS 0x6930:$a3: Download ERROR 0x6c58:$a4: cmd.exe /c ping 0 -n 2 & del " 0x6bf8:$a5: netsh firewall delete allowedprogram "
C:\Users\user\AppData\Local\Temp\WindowsServices.exe	CN_disclosed_20180208_c	Detects malware from disclosed CN malware set	Florian Roth	0x6c58:$x1: cmd.exe /c ping 0 -n 2 & del " 0x682a:$s1: winmgmts:\\.\root\SecurityCenter2 0x6952:$s3: Executed As 0x5fb3:$s5: Stub.exe 0x6930:$s6: Download ERROR 0x67ec:$s8: Select * From AntiVirusProduct
C:\Users\user\AppData\Local\Temp\WindowsServices.exe	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x6b50:$a1: netsh firewall add allowedprogram 0x6b20:$a2: SEE_MASK_NOZONECHECKS 0x6ce0:$b1: [TAP] 0x6c58:$c3: cmd.exe /c ping
C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x6b20:$reg: SEE_MASK_NOZONECHECKS 0x690c:$msg: Execute ERROR 0x696c:$msg: Execute ERROR 0x6c58:$ping: cmd.exe /c ping 0 -n 2 & del
C:\Users\user\AppData\Local\Temp\WindowsServices.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x6bf8:$s1: netsh firewall delete allowedprogram 0x6b50:$s2: netsh firewall add allowedprogram 0x6c58:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x690c:$s4: Execute ERROR 0x696c:$s4: Execute ERROR 0x6930:$s5: Download ERROR 0x6c96:$s6: [kl]
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\19447a578b6a3b2cdbc5a3dc3e7f5251.exe	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\19447a578b6a3b2cdbc5a3dc3e7f5251.exe	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x5767:$a1: get_Registry 0x6b20:$a2: SEE_MASK_NOZONECHECKS 0x6930:$a3: Download ERROR 0x6c58:$a4: cmd.exe /c ping 0 -n 2 & del " 0x6bf8:$a5: netsh firewall delete allowedprogram "
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\19447a578b6a3b2cdbc5a3dc3e7f5251.exe	CN_disclosed_20180208_c	Detects malware from disclosed CN malware set	Florian Roth	0x6c58:$x1: cmd.exe /c ping 0 -n 2 & del " 0x682a:$s1: winmgmts:\\.\root\SecurityCenter2 0x6952:$s3: Executed As 0x5fb3:$s5: Stub.exe 0x6930:$s6: Download ERROR 0x67ec:$s8: Select * From AntiVirusProduct
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\19447a578b6a3b2cdbc5a3dc3e7f5251.exe	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x6b50:$a1: netsh firewall add allowedprogram 0x6b20:$a2: SEE_MASK_NOZONECHECKS 0x6ce0:$b1: [TAP] 0x6c58:$c3: cmd.exe /c ping
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\19447a578b6a3b2cdbc5a3dc3e7f5251.exe	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x6b20:$reg: SEE_MASK_NOZONECHECKS 0x690c:$msg: Execute ERROR 0x696c:$msg: Execute ERROR 0x6c58:$ping: cmd.exe /c ping 0 -n 2 & del
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\19447a578b6a3b2cdbc5a3dc3e7f5251.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x6bf8:$s1: netsh firewall delete allowedprogram 0x6b50:$s2: netsh firewall add allowedprogram 0x6c58:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x690c:$s4: Execute ERROR 0x696c:$s4: Execute ERROR 0x6930:$s5: Download ERROR 0x6c96:$s6: [kl]
Click to see the 7 entries

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000000.1683506708.00000000005F2000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
00000000.00000000.1683506708.00000000005F2000.00000002.00000001.01000000.00000003.sdmp	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x5567:$a1: get_Registry 0x6920:$a2: SEE_MASK_NOZONECHECKS 0x6730:$a3: Download ERROR 0x6a58:$a4: cmd.exe /c ping 0 -n 2 & del " 0x69f8:$a5: netsh firewall delete allowedprogram "
00000000.00000000.1683506708.00000000005F2000.00000002.00000001.01000000.00000003.sdmp	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x6950:$a1: netsh firewall add allowedprogram 0x6920:$a2: SEE_MASK_NOZONECHECKS 0x6ae0:$b1: [TAP] 0x6a58:$c3: cmd.exe /c ping
00000000.00000000.1683506708.00000000005F2000.00000002.00000001.01000000.00000003.sdmp	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x6920:$reg: SEE_MASK_NOZONECHECKS 0x670c:$msg: Execute ERROR 0x676c:$msg: Execute ERROR 0x6a58:$ping: cmd.exe /c ping 0 -n 2 & del
00000000.00000002.1748887345.0000000002C61000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
00000000.00000002.1748887345.0000000002C61000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x28c4f:$a1: get_Registry 0x22170:$a2: SEE_MASK_NOZONECHECKS 0x2a008:$a2: SEE_MASK_NOZONECHECKS 0x29e18:$a3: Download ERROR 0x2a140:$a4: cmd.exe /c ping 0 -n 2 & del " 0x2a0e0:$a5: netsh firewall delete allowedprogram "
00000000.00000002.1748887345.0000000002C61000.00000004.00000800.00020000.00000000.sdmp	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x221c0:$a1: netsh firewall add allowedprogram 0x2a038:$a1: netsh firewall add allowedprogram 0x22170:$a2: SEE_MASK_NOZONECHECKS 0x2a008:$a2: SEE_MASK_NOZONECHECKS 0x2a1c8:$b1: [TAP] 0x2a140:$c3: cmd.exe /c ping
00000000.00000002.1748887345.0000000002C61000.00000004.00000800.00020000.00000000.sdmp	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x22170:$reg: SEE_MASK_NOZONECHECKS 0x2a008:$reg: SEE_MASK_NOZONECHECKS 0x29df4:$msg: Execute ERROR 0x29e54:$msg: Execute ERROR 0x2a140:$ping: cmd.exe /c ping 0 -n 2 & del
00000001.00000002.4155853569.0000000002BC1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
Process Memory Space: YKTNuK117e.exe PID: 7344	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
Process Memory Space: WindowsServices.exe PID: 7440	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
Click to see the 6 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.YKTNuK117e.exe.2c844e8.0.unpack	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
0.2.YKTNuK117e.exe.2c844e8.0.unpack	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x3967:$a1: get_Registry 0x4d20:$a2: SEE_MASK_NOZONECHECKS 0x4b30:$a3: Download ERROR 0x4e58:$a4: cmd.exe /c ping 0 -n 2 & del " 0x4df8:$a5: netsh firewall delete allowedprogram "
0.2.YKTNuK117e.exe.2c844e8.0.unpack	CN_disclosed_20180208_c	Detects malware from disclosed CN malware set	Florian Roth	0x4e58:$x1: cmd.exe /c ping 0 -n 2 & del " 0x4a2a:$s1: winmgmts:\\.\root\SecurityCenter2 0x4b52:$s3: Executed As 0x41b3:$s5: Stub.exe 0x4b30:$s6: Download ERROR 0x49ec:$s8: Select * From AntiVirusProduct
0.2.YKTNuK117e.exe.2c844e8.0.unpack	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x4d50:$a1: netsh firewall add allowedprogram 0x4d20:$a2: SEE_MASK_NOZONECHECKS 0x4ee0:$b1: [TAP] 0x4e58:$c3: cmd.exe /c ping
0.2.YKTNuK117e.exe.2c844e8.0.unpack	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x4d20:$reg: SEE_MASK_NOZONECHECKS 0x4b0c:$msg: Execute ERROR 0x4b6c:$msg: Execute ERROR 0x4e58:$ping: cmd.exe /c ping 0 -n 2 & del
0.2.YKTNuK117e.exe.2c844e8.0.unpack	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x4df8:$s1: netsh firewall delete allowedprogram 0x4d50:$s2: netsh firewall add allowedprogram 0x4e58:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x4b0c:$s4: Execute ERROR 0x4b6c:$s4: Execute ERROR 0x4b30:$s5: Download ERROR 0x4e96:$s6: [kl]
0.0.YKTNuK117e.exe.5f0000.0.unpack	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
0.0.YKTNuK117e.exe.5f0000.0.unpack	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x5767:$a1: get_Registry 0x6b20:$a2: SEE_MASK_NOZONECHECKS 0x6930:$a3: Download ERROR 0x6c58:$a4: cmd.exe /c ping 0 -n 2 & del " 0x6bf8:$a5: netsh firewall delete allowedprogram "
0.0.YKTNuK117e.exe.5f0000.0.unpack	CN_disclosed_20180208_c	Detects malware from disclosed CN malware set	Florian Roth	0x6c58:$x1: cmd.exe /c ping 0 -n 2 & del " 0x682a:$s1: winmgmts:\\.\root\SecurityCenter2 0x6952:$s3: Executed As 0x5fb3:$s5: Stub.exe 0x6930:$s6: Download ERROR 0x67ec:$s8: Select * From AntiVirusProduct
0.0.YKTNuK117e.exe.5f0000.0.unpack	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x6b50:$a1: netsh firewall add allowedprogram 0x6b20:$a2: SEE_MASK_NOZONECHECKS 0x6ce0:$b1: [TAP] 0x6c58:$c3: cmd.exe /c ping
0.0.YKTNuK117e.exe.5f0000.0.unpack	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x6b20:$reg: SEE_MASK_NOZONECHECKS 0x690c:$msg: Execute ERROR 0x696c:$msg: Execute ERROR 0x6c58:$ping: cmd.exe /c ping 0 -n 2 & del
0.0.YKTNuK117e.exe.5f0000.0.unpack	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x6bf8:$s1: netsh firewall delete allowedprogram 0x6b50:$s2: netsh firewall add allowedprogram 0x6c58:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x690c:$s4: Execute ERROR 0x696c:$s4: Execute ERROR 0x6930:$s5: Download ERROR 0x6c96:$s6: [kl]
0.2.YKTNuK117e.exe.2c844e8.0.raw.unpack	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
0.2.YKTNuK117e.exe.2c844e8.0.raw.unpack	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x5767:$a1: get_Registry 0x6b20:$a2: SEE_MASK_NOZONECHECKS 0x6930:$a3: Download ERROR 0x6c58:$a4: cmd.exe /c ping 0 -n 2 & del " 0x6bf8:$a5: netsh firewall delete allowedprogram "
0.2.YKTNuK117e.exe.2c844e8.0.raw.unpack	CN_disclosed_20180208_c	Detects malware from disclosed CN malware set	Florian Roth	0x6c58:$x1: cmd.exe /c ping 0 -n 2 & del " 0x682a:$s1: winmgmts:\\.\root\SecurityCenter2 0x6952:$s3: Executed As 0x5fb3:$s5: Stub.exe 0x6930:$s6: Download ERROR 0x67ec:$s8: Select * From AntiVirusProduct
0.2.YKTNuK117e.exe.2c844e8.0.raw.unpack	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x6b50:$a1: netsh firewall add allowedprogram 0x6b20:$a2: SEE_MASK_NOZONECHECKS 0x6ce0:$b1: [TAP] 0x6c58:$c3: cmd.exe /c ping
0.2.YKTNuK117e.exe.2c844e8.0.raw.unpack	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x6b20:$reg: SEE_MASK_NOZONECHECKS 0x690c:$msg: Execute ERROR 0x696c:$msg: Execute ERROR 0x6c58:$ping: cmd.exe /c ping 0 -n 2 & del
0.2.YKTNuK117e.exe.2c844e8.0.raw.unpack	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x6bf8:$s1: netsh firewall delete allowedprogram 0x6b50:$s2: netsh firewall add allowedprogram 0x6c58:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x690c:$s4: Execute ERROR 0x696c:$s4: Execute ERROR 0x6930:$s5: Download ERROR 0x6c96:$s6: [kl]
Click to see the 13 entries

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: "C:\Users\user\AppData\Local\Temp\WindowsServices.exe" .., EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\WindowsServices.exe, ProcessId: 7440, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\19447a578b6a3b2cdbc5a3dc3e7f5251

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 83.196.78.85, DestinationIsIpv6: false, DestinationPort: 8080, EventID: 3, Image: C:\Users\user\AppData\Local\Temp\WindowsServices.exe, Initiated: true, ProcessId: 7440, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49730

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\Users\user\AppData\Local\Temp\WindowsServices.exe" .., EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\WindowsServices.exe, ProcessId: 7440, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\19447a578b6a3b2cdbc5a3dc3e7f5251

Sigma detected: Startup Folder File Write

Source: File created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Users\user\AppData\Local\Temp\WindowsServices.exe, ProcessId: 7440, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\19447a578b6a3b2cdbc5a3dc3e7f5251.exe

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\Users\user\AppData\Local\Temp\WindowsServices.exe" .., EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\WindowsServices.exe, ProcessId: 7440, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\19447a578b6a3b2cdbc5a3dc3e7f5251

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: YKTNuK117e.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Avira: detection malicious, Label: TR/Dropper.Gen7
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\19447a578b6a3b2cdbc5a3dc3e7f5251.exe	Avira: detection malicious, Label: TR/Dropper.Gen7

Found malware configuration

Source: 00000000.00000000.1683506708.00000000005F2000.00000002.00000001.01000000.00000003.sdmp

Malware Configuration Extractor: Njrat {"Host": "83.196.78.85", "Port": "8080", "Version": "0.7d", "Campaign ID": "ok", "Registry": "Software\\Microsoft\\Windows\\CurrentVersion\\Run", "Startup": "19447a578b6a3b2cdbc5a3dc3e7f5251"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	ReversingLabs: Detection: 86%
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Virustotal: Detection: 82%	Perma Link
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\19447a578b6a3b2cdbc5a3dc3e7f5251.exe	ReversingLabs: Detection: 86%
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\19447a578b6a3b2cdbc5a3dc3e7f5251.exe	Virustotal: Detection: 82%	Perma Link

Multi AV Scanner detection for submitted file

Source: YKTNuK117e.exe	ReversingLabs: Detection: 86%
Source: YKTNuK117e.exe	Virustotal: Detection: 82%			Perma Link

Yara detected Njrat

Source: Yara match	File source: YKTNuK117e.exe, type: SAMPLE
Source: Yara match	File source: 0.2.YKTNuK117e.exe.2c844e8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.YKTNuK117e.exe.5f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.YKTNuK117e.exe.2c844e8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1683506708.00000000005F2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1748887345.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4155853569.0000000002BC1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: YKTNuK117e.exe PID: 7344, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: WindowsServices.exe PID: 7440, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\19447a578b6a3b2cdbc5a3dc3e7f5251.exe, type: DROPPED

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\19447a578b6a3b2cdbc5a3dc3e7f5251.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: YKTNuK117e.exe

Joe Sandbox ML: detected

Source: YKTNuK117e.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\YKTNuK117e.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

Jump to behavior

Source: YKTNuK117e.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 83.196.78.85

Source: global traffic

TCP traffic: 192.168.2.4:49730 -> 83.196.78.85:8080

Source: Joe Sandbox View

ASN Name: FranceTelecom-OrangeFR FranceTelecom-OrangeFR

Source: unknown	TCP traffic detected without corresponding DNS query: 83.196.78.85
Source: unknown	TCP traffic detected without corresponding DNS query: 83.196.78.85
Source: unknown	TCP traffic detected without corresponding DNS query: 83.196.78.85
Source: unknown	TCP traffic detected without corresponding DNS query: 83.196.78.85
Source: unknown	TCP traffic detected without corresponding DNS query: 83.196.78.85
Source: unknown	TCP traffic detected without corresponding DNS query: 83.196.78.85
Source: unknown	TCP traffic detected without corresponding DNS query: 83.196.78.85
Source: unknown	TCP traffic detected without corresponding DNS query: 83.196.78.85
Source: unknown	TCP traffic detected without corresponding DNS query: 83.196.78.85
Source: unknown	TCP traffic detected without corresponding DNS query: 83.196.78.85
Source: unknown	TCP traffic detected without corresponding DNS query: 83.196.78.85
Source: unknown	TCP traffic detected without corresponding DNS query: 83.196.78.85
Source: unknown	TCP traffic detected without corresponding DNS query: 83.196.78.85
Source: unknown	TCP traffic detected without corresponding DNS query: 83.196.78.85
Source: unknown	TCP traffic detected without corresponding DNS query: 83.196.78.85
Source: unknown	TCP traffic detected without corresponding DNS query: 83.196.78.85
Source: unknown	TCP traffic detected without corresponding DNS query: 83.196.78.85
Source: unknown	TCP traffic detected without corresponding DNS query: 83.196.78.85
Source: unknown	TCP traffic detected without corresponding DNS query: 83.196.78.85
Source: unknown	TCP traffic detected without corresponding DNS query: 83.196.78.85
Source: unknown	TCP traffic detected without corresponding DNS query: 83.196.78.85
Source: unknown	TCP traffic detected without corresponding DNS query: 83.196.78.85
Source: unknown	TCP traffic detected without corresponding DNS query: 83.196.78.85
Source: unknown	TCP traffic detected without corresponding DNS query: 83.196.78.85
Source: unknown	TCP traffic detected without corresponding DNS query: 83.196.78.85
Source: unknown	TCP traffic detected without corresponding DNS query: 83.196.78.85
Source: unknown	TCP traffic detected without corresponding DNS query: 83.196.78.85
Source: unknown	TCP traffic detected without corresponding DNS query: 83.196.78.85
Source: unknown	TCP traffic detected without corresponding DNS query: 83.196.78.85
Source: unknown	TCP traffic detected without corresponding DNS query: 83.196.78.85
Source: unknown	TCP traffic detected without corresponding DNS query: 83.196.78.85
Source: unknown	TCP traffic detected without corresponding DNS query: 83.196.78.85
Source: unknown	TCP traffic detected without corresponding DNS query: 83.196.78.85
Source: unknown	TCP traffic detected without corresponding DNS query: 83.196.78.85
Source: unknown	TCP traffic detected without corresponding DNS query: 83.196.78.85
Source: unknown	TCP traffic detected without corresponding DNS query: 83.196.78.85
Source: unknown	TCP traffic detected without corresponding DNS query: 83.196.78.85
Source: unknown	TCP traffic detected without corresponding DNS query: 83.196.78.85
Source: unknown	TCP traffic detected without corresponding DNS query: 83.196.78.85
Source: unknown	TCP traffic detected without corresponding DNS query: 83.196.78.85
Source: unknown	TCP traffic detected without corresponding DNS query: 83.196.78.85
Source: unknown	TCP traffic detected without corresponding DNS query: 83.196.78.85
Source: unknown	TCP traffic detected without corresponding DNS query: 83.196.78.85
Source: unknown	TCP traffic detected without corresponding DNS query: 83.196.78.85
Source: unknown	TCP traffic detected without corresponding DNS query: 83.196.78.85
Source: unknown	TCP traffic detected without corresponding DNS query: 83.196.78.85
Source: unknown	TCP traffic detected without corresponding DNS query: 83.196.78.85
Source: unknown	TCP traffic detected without corresponding DNS query: 83.196.78.85
Source: unknown	TCP traffic detected without corresponding DNS query: 83.196.78.85
Source: unknown	TCP traffic detected without corresponding DNS query: 83.196.78.85

Source: WindowsServices.exe, 00000001.00000002.4154679430.0000000000CEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://go.microsoft.
Source: WindowsServices.exe, 00000001.00000002.4154679430.0000000000CEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://go.microsoft.LinkId=42127

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: YKTNuK117e.exe, kl.cs	.Net Code: VKCodeToUnicode
Source: WindowsServices.exe.0.dr, kl.cs	.Net Code: VKCodeToUnicode
Source: 0.2.YKTNuK117e.exe.2c844e8.0.raw.unpack, kl.cs	.Net Code: VKCodeToUnicode
Source: 19447a578b6a3b2cdbc5a3dc3e7f5251.exe.1.dr, kl.cs	.Net Code: VKCodeToUnicode

E-Banking Fraud

Yara detected Njrat

Source: Yara match	File source: YKTNuK117e.exe, type: SAMPLE
Source: Yara match	File source: 0.2.YKTNuK117e.exe.2c844e8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.YKTNuK117e.exe.5f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.YKTNuK117e.exe.2c844e8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1683506708.00000000005F2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1748887345.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4155853569.0000000002BC1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: YKTNuK117e.exe PID: 7344, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: WindowsServices.exe PID: 7440, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\19447a578b6a3b2cdbc5a3dc3e7f5251.exe, type: DROPPED

Operating System Destruction

Protects its processes via BreakOnTermination flag

Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe

Process information set: 01 00 00 00

Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: YKTNuK117e.exe, type: SAMPLE	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: YKTNuK117e.exe, type: SAMPLE	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: YKTNuK117e.exe, type: SAMPLE	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: YKTNuK117e.exe, type: SAMPLE	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: YKTNuK117e.exe, type: SAMPLE	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 0.2.YKTNuK117e.exe.2c844e8.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 0.2.YKTNuK117e.exe.2c844e8.0.unpack, type: UNPACKEDPE	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: 0.2.YKTNuK117e.exe.2c844e8.0.unpack, type: UNPACKEDPE	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 0.2.YKTNuK117e.exe.2c844e8.0.unpack, type: UNPACKEDPE	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.YKTNuK117e.exe.2c844e8.0.unpack, type: UNPACKEDPE	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 0.0.YKTNuK117e.exe.5f0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 0.0.YKTNuK117e.exe.5f0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: 0.0.YKTNuK117e.exe.5f0000.0.unpack, type: UNPACKEDPE	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 0.0.YKTNuK117e.exe.5f0000.0.unpack, type: UNPACKEDPE	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 0.0.YKTNuK117e.exe.5f0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 0.2.YKTNuK117e.exe.2c844e8.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 0.2.YKTNuK117e.exe.2c844e8.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: 0.2.YKTNuK117e.exe.2c844e8.0.raw.unpack, type: UNPACKEDPE	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 0.2.YKTNuK117e.exe.2c844e8.0.raw.unpack, type: UNPACKEDPE	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.YKTNuK117e.exe.2c844e8.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 00000000.00000000.1683506708.00000000005F2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 00000000.00000000.1683506708.00000000005F2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 00000000.00000000.1683506708.00000000005F2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.1748887345.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 00000000.00000002.1748887345.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 00000000.00000002.1748887345.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe, type: DROPPED	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe, type: DROPPED	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe, type: DROPPED	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\19447a578b6a3b2cdbc5a3dc3e7f5251.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\19447a578b6a3b2cdbc5a3dc3e7f5251.exe, type: DROPPED	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\19447a578b6a3b2cdbc5a3dc3e7f5251.exe, type: DROPPED	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\19447a578b6a3b2cdbc5a3dc3e7f5251.exe, type: DROPPED	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\19447a578b6a3b2cdbc5a3dc3e7f5251.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen

Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Code function: 1_2_009FBBC6 NtSetInformationProcess,	1_2_009FBBC6
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Code function: 1_2_009FBBA4 NtSetInformationProcess,	1_2_009FBBA4
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Code function: 1_2_01051B46 NtQuerySystemInformation,	1_2_01051B46
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Code function: 1_2_01051B0B NtQuerySystemInformation,	1_2_01051B0B

Source: C:\Users\user\Desktop\YKTNuK117e.exe	Code function: 0_2_00EF268E	0_2_00EF268E
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Code function: 1_2_009F268E	1_2_009F268E
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Code function: 7_2_0077247C	7_2_0077247C
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Code function: 8_2_016226C3	8_2_016226C3
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Code function: 8_2_0162247C	8_2_0162247C
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Code function: 9_2_010A26C3	9_2_010A26C3
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Code function: 9_2_010A247C	9_2_010A247C

Source: YKTNuK117e.exe, 00000000.00000002.1748488867.0000000000C8E000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: OriginalFilenamemscorwks.dllT vs YKTNuK117e.exe

Source: YKTNuK117e.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: YKTNuK117e.exe, type: SAMPLE	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: YKTNuK117e.exe, type: SAMPLE	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: YKTNuK117e.exe, type: SAMPLE	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: YKTNuK117e.exe, type: SAMPLE	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: YKTNuK117e.exe, type: SAMPLE	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 0.2.YKTNuK117e.exe.2c844e8.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 0.2.YKTNuK117e.exe.2c844e8.0.unpack, type: UNPACKEDPE	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.YKTNuK117e.exe.2c844e8.0.unpack, type: UNPACKEDPE	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 0.2.YKTNuK117e.exe.2c844e8.0.unpack, type: UNPACKEDPE	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 0.2.YKTNuK117e.exe.2c844e8.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 0.0.YKTNuK117e.exe.5f0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 0.0.YKTNuK117e.exe.5f0000.0.unpack, type: UNPACKEDPE	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.0.YKTNuK117e.exe.5f0000.0.unpack, type: UNPACKEDPE	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 0.0.YKTNuK117e.exe.5f0000.0.unpack, type: UNPACKEDPE	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 0.0.YKTNuK117e.exe.5f0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 0.2.YKTNuK117e.exe.2c844e8.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 0.2.YKTNuK117e.exe.2c844e8.0.raw.unpack, type: UNPACKEDPE	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.YKTNuK117e.exe.2c844e8.0.raw.unpack, type: UNPACKEDPE	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 0.2.YKTNuK117e.exe.2c844e8.0.raw.unpack, type: UNPACKEDPE	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 0.2.YKTNuK117e.exe.2c844e8.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 00000000.00000000.1683506708.00000000005F2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 00000000.00000000.1683506708.00000000005F2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 00000000.00000000.1683506708.00000000005F2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 00000000.00000002.1748887345.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 00000000.00000002.1748887345.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 00000000.00000002.1748887345.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe, type: DROPPED	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe, type: DROPPED	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe, type: DROPPED	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\19447a578b6a3b2cdbc5a3dc3e7f5251.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\19447a578b6a3b2cdbc5a3dc3e7f5251.exe, type: DROPPED	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\19447a578b6a3b2cdbc5a3dc3e7f5251.exe, type: DROPPED	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\19447a578b6a3b2cdbc5a3dc3e7f5251.exe, type: DROPPED	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\19447a578b6a3b2cdbc5a3dc3e7f5251.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi

Source: classification engine

Classification label: mal100.phis.troj.adwa.spyw.evad.winEXE@9/5@0/1

Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Code function: 1_2_009FB876 AdjustTokenPrivileges,		1_2_009FB876
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Code function: 1_2_009FB83F AdjustTokenPrivileges,		1_2_009FB83F

Source: C:\Users\user\Desktop\YKTNuK117e.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\YKTNuK117e.exe.log

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7492:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Mutant created: \Sessions\1\BaseNamedObjects\19447a578b6a3b2cdbc5a3dc3e7f5251
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\.net clr networking

Source: C:\Users\user\Desktop\YKTNuK117e.exe

File created: C:\Users\user\AppData\Local\Temp\WindowsServices.exe

Jump to behavior

Source: YKTNuK117e.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: YKTNuK117e.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\YKTNuK117e.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\YKTNuK117e.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: YKTNuK117e.exe	ReversingLabs: Detection: 86%
Source: YKTNuK117e.exe	Virustotal: Detection: 82%

Source: C:\Users\user\Desktop\YKTNuK117e.exe

File read: C:\Users\user\Desktop\YKTNuK117e.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\YKTNuK117e.exe "C:\Users\user\Desktop\YKTNuK117e.exe"
Source: C:\Users\user\Desktop\YKTNuK117e.exe	Process created: C:\Users\user\AppData\Local\Temp\WindowsServices.exe "C:\Users\user\AppData\Local\Temp\WindowsServices.exe"
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Users\user\AppData\Local\Temp\WindowsServices.exe" "WindowsServices.exe" ENABLE
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\WindowsServices.exe "C:\Users\user\AppData\Local\Temp\WindowsServices.exe" ..
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\WindowsServices.exe "C:\Users\user\AppData\Local\Temp\WindowsServices.exe" ..
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\WindowsServices.exe "C:\Users\user\AppData\Local\Temp\WindowsServices.exe" ..
Source: C:\Users\user\Desktop\YKTNuK117e.exe	Process created: C:\Users\user\AppData\Local\Temp\WindowsServices.exe "C:\Users\user\AppData\Local\Temp\WindowsServices.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Users\user\AppData\Local\Temp\WindowsServices.exe" "WindowsServices.exe" ENABLE	Jump to behavior

Source: C:\Users\user\Desktop\YKTNuK117e.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\YKTNuK117e.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\YKTNuK117e.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\YKTNuK117e.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\YKTNuK117e.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\YKTNuK117e.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\YKTNuK117e.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\YKTNuK117e.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\YKTNuK117e.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\YKTNuK117e.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\YKTNuK117e.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\YKTNuK117e.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\YKTNuK117e.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\YKTNuK117e.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\YKTNuK117e.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\YKTNuK117e.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\YKTNuK117e.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\YKTNuK117e.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\YKTNuK117e.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\YKTNuK117e.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\YKTNuK117e.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\YKTNuK117e.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\YKTNuK117e.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\YKTNuK117e.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ifmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasmontr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mfc42u.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: authfwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcmonitor.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3cfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3api.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: onex.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappprxy.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: hnetmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netshell.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netsetupapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netiohlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: httpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: polstore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshwfp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2pnetsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2p.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rpcnsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: whhelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlancfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlanapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wshelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: peerdistsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wcmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mobilenetworking.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprmsg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Section loaded: uxtheme.dll	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe

File opened: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll

Jump to behavior

Source: YKTNuK117e.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: C:\Users\user\Desktop\YKTNuK117e.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

Jump to behavior

Source: YKTNuK117e.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains potential unpacker

Source: YKTNuK117e.exe, OK.cs	.Net Code: Plugin System.Reflection.Assembly.Load(byte[])
Source: WindowsServices.exe.0.dr, OK.cs	.Net Code: Plugin System.Reflection.Assembly.Load(byte[])
Source: 0.2.YKTNuK117e.exe.2c844e8.0.raw.unpack, OK.cs	.Net Code: Plugin System.Reflection.Assembly.Load(byte[])
Source: 19447a578b6a3b2cdbc5a3dc3e7f5251.exe.1.dr, OK.cs	.Net Code: Plugin System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\Desktop\YKTNuK117e.exe	File created: C:\Users\user\AppData\Local\Temp\WindowsServices.exe			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\19447a578b6a3b2cdbc5a3dc3e7f5251.exe			Jump to dropped file

Boot Survival

Creates autostart registry keys with suspicious names

Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe

Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 19447a578b6a3b2cdbc5a3dc3e7f5251

Jump to behavior

Drops PE files to the startup folder

Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\19447a578b6a3b2cdbc5a3dc3e7f5251.exe

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\19447a578b6a3b2cdbc5a3dc3e7f5251.exe

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\19447a578b6a3b2cdbc5a3dc3e7f5251.exe

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 19447a578b6a3b2cdbc5a3dc3e7f5251	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 19447a578b6a3b2cdbc5a3dc3e7f5251	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run 19447a578b6a3b2cdbc5a3dc3e7f5251	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run 19447a578b6a3b2cdbc5a3dc3e7f5251	Jump to behavior

Source: C:\Users\user\Desktop\YKTNuK117e.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YKTNuK117e.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YKTNuK117e.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YKTNuK117e.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YKTNuK117e.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YKTNuK117e.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YKTNuK117e.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YKTNuK117e.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YKTNuK117e.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YKTNuK117e.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YKTNuK117e.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YKTNuK117e.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YKTNuK117e.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YKTNuK117e.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YKTNuK117e.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YKTNuK117e.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YKTNuK117e.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YKTNuK117e.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YKTNuK117e.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YKTNuK117e.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YKTNuK117e.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\YKTNuK117e.exe	Memory allocated: F60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\YKTNuK117e.exe	Memory allocated: 2C60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\YKTNuK117e.exe	Memory allocated: FD0000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Memory allocated: AE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Memory allocated: 2BC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Memory allocated: D70000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Memory allocated: AC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Memory allocated: 2860000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Memory allocated: 4860000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Memory allocated: 1690000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Memory allocated: 34A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Memory allocated: 1810000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Memory allocated: 1100000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Memory allocated: 31F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Memory allocated: 51F0000 memory commit \| memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\YKTNuK117e.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Window / User API: threadDelayed 1454	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Window / User API: threadDelayed 3535	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Window / User API: threadDelayed 4263	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Window / User API: foregroundWindowGot 1763	Jump to behavior

Source: C:\Users\user\Desktop\YKTNuK117e.exe TID: 7364	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe TID: 7444	Thread sleep time: -1454000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe TID: 7444	Thread sleep time: -4263000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe TID: 7912	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe TID: 8024	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe TID: 8092	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\YKTNuK117e.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: netsh.exe, 00000002.00000003.1819823605.00000000012F2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllN
Source: 19447a578b6a3b2cdbc5a3dc3e7f5251.exe.1.dr	Binary or memory string: VBoxServiceTrueTEMP'WindowsServices.exe
Source: WindowsServices.exe, 00000001.00000002.4154679430.0000000000CEA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll.ContextBindingElementImporter, system.workflowservices, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=MSIL

Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\YKTNuK117e.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

.NET source code references suspicious native API functions

Source: YKTNuK117e.exe, kl.cs	Reference to suspicious API methods: MapVirtualKey(a, 0u)
Source: YKTNuK117e.exe, kl.cs	Reference to suspicious API methods: GetAsyncKeyState(num2)
Source: YKTNuK117e.exe, OK.cs	Reference to suspicious API methods: capGetDriverDescriptionA(wDriver, ref lpszName, 100, ref lpszVer, 100)

Source: C:\Users\user\Desktop\YKTNuK117e.exe

Process created: C:\Users\user\AppData\Local\Temp\WindowsServices.exe "C:\Users\user\AppData\Local\Temp\WindowsServices.exe"

Jump to behavior

Source: WindowsServices.exe, 00000001.00000002.4155853569.0000000002BC1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: WindowsServices.exe, 00000001.00000002.4155853569.0000000002BC1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager@9

Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Queries volume information: C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Queries volume information: C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disables zone checking for all users

Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe

Registry value created: HKEY_CURRENT_USER\Environment SEE_MASK_NOZONECHECKS

Jump to behavior

Modifies the windows firewall

Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe

Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Users\user\AppData\Local\Temp\WindowsServices.exe" "WindowsServices.exe" ENABLE

Uses netsh to modify the Windows network and firewall settings

Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe

Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Users\user\AppData\Local\Temp\WindowsServices.exe" "WindowsServices.exe" ENABLE

Source: WindowsServices.exe, 00000001.00000002.4159340432.00000000059A2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %\Windows Defender\MsMpeng.exe
Source: WindowsServices.exe, 00000001.00000002.4154679430.0000000000D23000.00000004.00000020.00020000.00000000.sdmp, WindowsServices.exe, 00000001.00000002.4154679430.0000000000D0B000.00000004.00000020.00020000.00000000.sdmp, WindowsServices.exe, 00000001.00000002.4154679430.0000000000CAF000.00000004.00000020.00020000.00000000.sdmp, WindowsServices.exe, 00000001.00000002.4154679430.0000000000CEA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: WindowsServices.exe, 00000001.00000002.4155278201.0000000000D67000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: amFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct

Stealing of Sensitive Information

Yara detected Njrat

Source: Yara match	File source: YKTNuK117e.exe, type: SAMPLE
Source: Yara match	File source: 0.2.YKTNuK117e.exe.2c844e8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.YKTNuK117e.exe.5f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.YKTNuK117e.exe.2c844e8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1683506708.00000000005F2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1748887345.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4155853569.0000000002BC1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: YKTNuK117e.exe PID: 7344, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: WindowsServices.exe PID: 7440, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\19447a578b6a3b2cdbc5a3dc3e7f5251.exe, type: DROPPED

Remote Access Functionality

Yara detected Njrat

Source: Yara match	File source: YKTNuK117e.exe, type: SAMPLE
Source: Yara match	File source: 0.2.YKTNuK117e.exe.2c844e8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.YKTNuK117e.exe.5f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.YKTNuK117e.exe.2c844e8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1683506708.00000000005F2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1748887345.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4155853569.0000000002BC1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: YKTNuK117e.exe PID: 7344, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: WindowsServices.exe PID: 7440, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\19447a578b6a3b2cdbc5a3dc3e7f5251.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	221 Registry Run Keys / Startup Folder	1 Access Token Manipulation	1 Masquerading	1 Input Capture	121 Security Software Discovery	Remote Services	1 Input Capture	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	12 Process Injection	31 Disable or Modify Tools	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	1 Archive Collected Data	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	221 Registry Run Keys / Startup Folder	31 Virtualization/Sandbox Evasion	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	1 Access Token Manipulation	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	12 Process Injection	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Software Packing	Cached Domain Credentials	12 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
YKTNuK117e.exe	87%	ReversingLabs	ByteCode-MSIL.Backdoor.Bladabhindi
YKTNuK117e.exe	83%	Virustotal		Browse
YKTNuK117e.exe	100%	Avira	TR/Dropper.Gen7
YKTNuK117e.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\WindowsServices.exe	100%	Avira	TR/Dropper.Gen7
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\19447a578b6a3b2cdbc5a3dc3e7f5251.exe	100%	Avira	TR/Dropper.Gen7
C:\Users\user\AppData\Local\Temp\WindowsServices.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\19447a578b6a3b2cdbc5a3dc3e7f5251.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\WindowsServices.exe	87%	ReversingLabs	ByteCode-MSIL.Backdoor.Bladabhindi
C:\Users\user\AppData\Local\Temp\WindowsServices.exe	83%	Virustotal		Browse
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\19447a578b6a3b2cdbc5a3dc3e7f5251.exe	87%	ReversingLabs	ByteCode-MSIL.Backdoor.Bladabhindi
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\19447a578b6a3b2cdbc5a3dc3e7f5251.exe	83%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
http://go.microsoft.	0%	URL Reputation	safe

Name	Malicious	Antivirus Detection	Reputation
83.196.78.85	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://go.microsoft.	WindowsServices.exe, 00000001.00000002.4154679430.0000000000CEA000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://go.microsoft.LinkId=42127	WindowsServices.exe, 00000001.00000002.4154679430.0000000000CEA000.00000004.00000020.00020000.00000000.sdmp	false		low

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
83.196.78.85	unknown	France		3215	FranceTelecom-OrangeFR	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1429083
Start date and time:	2024-04-20 18:26:04 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 15s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	11
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	YKTNuK117e.exe renamed because original name is a hash value
Original Sample Name:	200a92ad17110cb3dacc7387b12186c6.exe
Detection:	MAL
Classification:	mal100.phis.troj.adwa.spyw.evad.winEXE@9/5@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 167 Number of non-executed functions: 1
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
17:27:13	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 19447a578b6a3b2cdbc5a3dc3e7f5251 "C:\Users\user\AppData\Local\Temp\WindowsServices.exe" ..
17:27:21	Autostart	Run: HKLM\Software\Microsoft\Windows\CurrentVersion\Run 19447a578b6a3b2cdbc5a3dc3e7f5251 "C:\Users\user\AppData\Local\Temp\WindowsServices.exe" ..
17:27:31	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 19447a578b6a3b2cdbc5a3dc3e7f5251 "C:\Users\user\AppData\Local\Temp\WindowsServices.exe" ..
17:27:39	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\19447a578b6a3b2cdbc5a3dc3e7f5251.exe
18:27:13	API Interceptor	478658x Sleep call for process: WindowsServices.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
FranceTelecom-OrangeFR	JdnjRc1VGX.elf	Get hash	malicious	Mirai	Browse	86.199.95.91
	H6ccnU1094.elf	Get hash	malicious	Mirai, Okiru	Browse	83.115.239.3
	9IseFevRH6.elf	Get hash	malicious	Mirai	Browse	109.211.102.134
	BzmhHwFpCV.elf	Get hash	malicious	Mirai	Browse	90.13.203.111
	ZOHH8muwjh.elf	Get hash	malicious	Mirai	Browse	92.138.88.144
	E3kpuuuOfy.elf	Get hash	malicious	Mirai	Browse	83.196.75.183
	enEQvjUlGl.elf	Get hash	malicious	Mirai	Browse	109.212.215.173
	4XAsw9FSr5.elf	Get hash	malicious	Unknown	Browse	83.114.112.82
	Oo2yeTdq5J.elf	Get hash	malicious	Mirai	Browse	81.55.171.61
	Yui1pUgieI.elf	Get hash	malicious	Mirai	Browse	109.219.139.16

Process:	C:\Users\user\AppData\Local\Temp\WindowsServices.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	525
Entropy (8bit):	5.259753436570609
Encrypted:	false
SSDEEP:	12:Q3LaJU2C9XAn10Ug+9pfu9t0U29xtUz1B0U2uk71K6xhk7v:MLF2CpI3zffup29Iz52Ve
MD5:	260E01CC001F9C4643CA7A62F395D747
SHA1:	492AD0ACE3A9C8736909866EEA168962D418BE5A
SHA-256:	4BC52CCF866F489772A6919A0CC2C55B1432729D6BDF29E17E5853ABDFAB6030
SHA-512:	01AF7D75257E3DBD460E328F5C057D0367B83D3D9397E89CA3AE54AB9B2842D62352D8CCB4BE98ACE0C5667846759D32C199DE39ECCD0CF9CD6A83267D27E7C4
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System\bec14584c93014efbc76285c35d1e891\System.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\7d443c6c007fe8696f9aa6ff1da53ef7\Microsoft.VisualBasic.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\2cdaeaf53e3d49038cf7cb0ce9d805d3\System.Drawing.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\d0e5535854cce87ea7f2d69d0594b7a8\System.Windows.Forms.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\YKTNuK117e.exe.log

Download File

Process:	C:\Users\user\Desktop\YKTNuK117e.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	525
Entropy (8bit):	5.259753436570609
Encrypted:	false
SSDEEP:	12:Q3LaJU2C9XAn10Ug+9pfu9t0U29xtUz1B0U2uk71K6xhk7v:MLF2CpI3zffup29Iz52Ve
MD5:	260E01CC001F9C4643CA7A62F395D747
SHA1:	492AD0ACE3A9C8736909866EEA168962D418BE5A
SHA-256:	4BC52CCF866F489772A6919A0CC2C55B1432729D6BDF29E17E5853ABDFAB6030
SHA-512:	01AF7D75257E3DBD460E328F5C057D0367B83D3D9397E89CA3AE54AB9B2842D62352D8CCB4BE98ACE0C5667846759D32C199DE39ECCD0CF9CD6A83267D27E7C4
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System\bec14584c93014efbc76285c35d1e891\System.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\7d443c6c007fe8696f9aa6ff1da53ef7\Microsoft.VisualBasic.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\2cdaeaf53e3d49038cf7cb0ce9d805d3\System.Drawing.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\d0e5535854cce87ea7f2d69d0594b7a8\System.Windows.Forms.ni.dll",0..

C:\Users\user\AppData\Local\Temp\WindowsServices.exe

Download File

Process:	C:\Users\user\Desktop\YKTNuK117e.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	32256
Entropy (8bit):	5.615701037320533
Encrypted:	false
SSDEEP:	768:oJhOBb13hdwzxLy3gcEOvVMRvqfQmIDUu0tiBdj:gUZ6WZ6AQVkuj
MD5:	200A92AD17110CB3DACC7387B12186C6
SHA1:	6BEE61858FBF3152F748B3DCDFFE0509A8D30A57
SHA-256:	4685803AD19D283CA259F4AF5FFF5F0C397C0FE0C3032B663D0B99D510C4FCB6
SHA-512:	1EDF29F9EBCE81CE230829637A8AD672F8D389984BB020B43992AACBF47674B8F1E5E8AF8D7EEE1AE42B03C7334E0CCEF175A868704FBB265EB4810CDE50B0E7
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe, Author: unknown Rule: CN_disclosed_20180208_c, Description: Detects malware from disclosed CN malware set, Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe, Author: Florian Roth Rule: njrat1, Description: Identify njRat, Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe, Author: Brian Wallace @botnet_hunter Rule: Njrat, Description: detect njRAT in memory, Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe, Author: JPCERT/CC Incident Response Group Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 87% Antivirus: Virustotal, Detection: 83%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f.................v............... ........@.. ....................................@....................................O.......@............................................................................ ............... ..H............text...$u... ...v.................. ..`.rsrc...@............x..............@..@.reloc...............\|..............@..B........................H.......@\...8......E.....................................................(....&..(......s.........s.........s.........s..........0...........~....o.....+...0...........~....o.....+...0...........~....o.....+...0...........~....o.....+...0.............(....(.....+.....0............(.....+...0................(.....+...0............(.....+...0......................,.(...+.+....+..&........&..(.........0..&........~..............,.(...+.....~.....+..&..(......s..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\19447a578b6a3b2cdbc5a3dc3e7f5251.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\WindowsServices.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	32256
Entropy (8bit):	5.615701037320533
Encrypted:	false
SSDEEP:	768:oJhOBb13hdwzxLy3gcEOvVMRvqfQmIDUu0tiBdj:gUZ6WZ6AQVkuj
MD5:	200A92AD17110CB3DACC7387B12186C6
SHA1:	6BEE61858FBF3152F748B3DCDFFE0509A8D30A57
SHA-256:	4685803AD19D283CA259F4AF5FFF5F0C397C0FE0C3032B663D0B99D510C4FCB6
SHA-512:	1EDF29F9EBCE81CE230829637A8AD672F8D389984BB020B43992AACBF47674B8F1E5E8AF8D7EEE1AE42B03C7334E0CCEF175A868704FBB265EB4810CDE50B0E7
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\19447a578b6a3b2cdbc5a3dc3e7f5251.exe, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\19447a578b6a3b2cdbc5a3dc3e7f5251.exe, Author: unknown Rule: CN_disclosed_20180208_c, Description: Detects malware from disclosed CN malware set, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\19447a578b6a3b2cdbc5a3dc3e7f5251.exe, Author: Florian Roth Rule: njrat1, Description: Identify njRat, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\19447a578b6a3b2cdbc5a3dc3e7f5251.exe, Author: Brian Wallace @botnet_hunter Rule: Njrat, Description: detect njRAT in memory, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\19447a578b6a3b2cdbc5a3dc3e7f5251.exe, Author: JPCERT/CC Incident Response Group Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\19447a578b6a3b2cdbc5a3dc3e7f5251.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 87% Antivirus: Virustotal, Detection: 83%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f.................v............... ........@.. ....................................@....................................O.......@............................................................................ ............... ..H............text...$u... ...v.................. ..`.rsrc...@............x..............@..@.reloc...............\|..............@..B........................H.......@\...8......E.....................................................(....&..(......s.........s.........s.........s..........0...........~....o.....+...0...........~....o.....+...0...........~....o.....+...0...........~....o.....+...0.............(....(.....+.....0............(.....+...0................(.....+...0............(.....+...0......................,.(...+.+....+..&........&..(.........0..&........~..............,.(...+.....~.....+..&..(......s..

\Device\ConDrv

Download File

Process:	C:\Windows\SysWOW64\netsh.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	313
Entropy (8bit):	4.971939296804078
Encrypted:	false
SSDEEP:	6:/ojfKsUTGN8Ypox42k9L+DbGMKeQE+vigqAZs2E+AYeDPO+Yswyha:wjPIGNrkHk9iaeIM6ADDPOHyha
MD5:	689E2126A85BF55121488295EE068FA1
SHA1:	09BAAA253A49D80C18326DFBCA106551EBF22DD6
SHA-256:	D968A966EF474068E41256321F77807A042F1965744633D37A203A705662EC25
SHA-512:	C3736A8FC7E6573FA1B26FE6A901C05EE85C55A4A276F8F569D9EADC9A58BEC507D1BB90DBF9EA62AE79A6783178C69304187D6B90441D82E46F5F56172B5C5C
Malicious:	false
Reputation:	high, very likely benign file
Preview:	..IMPORTANT: Command executed successfully...However, "netsh firewall" is deprecated;..use "netsh advfirewall firewall" instead...For more information on using "netsh advfirewall firewall" commands..instead of "netsh firewall", see KB article 947709..at https://go.microsoft.com/fwlink/?linkid=121488 .....Ok.....

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.615701037320533
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	YKTNuK117e.exe
File size:	32'256 bytes
MD5:	200a92ad17110cb3dacc7387b12186c6
SHA1:	6bee61858fbf3152f748b3dcdffe0509a8d30a57
SHA256:	4685803ad19d283ca259f4af5fff5f0c397c0fe0c3032b663d0b99d510c4fcb6
SHA512:	1edf29f9ebce81ce230829637a8ad672f8d389984bb020b43992aacbf47674b8f1e5e8af8d7eee1ae42b03c7334e0ccef175a868704fbb265eb4810cde50b0e7
SSDEEP:	768:oJhOBb13hdwzxLy3gcEOvVMRvqfQmIDUu0tiBdj:gUZ6WZ6AQVkuj
TLSH:	28E21AADFBEA4466D2BC0AB50571950013B4D103E523F77E4ECA24A62B6F7D84B84DF2
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f.................v............... ........@.. ....................................@................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x40951e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x661FCAD4 [Wed Apr 17 13:12:52 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x94cc	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xa000	0x240	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xc000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x7524	0x7600	e4466dbba6148f59dc86ca5a79e47c2b	False	0.4817597987288136	data	5.652543611491193	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xa000	0x240	0x400	5b346ed223699f15252c1fdad182859f	False	0.3134765625	data	4.968771659524424	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xc000	0xc	0x200	ab51cd88731eb5328808e4b8d5b1cbc3	False	0.044921875	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0xa058	0x1e7	XML 1.0 document, ASCII text, with CRLF line terminators			0.5338809034907598

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 20, 2024 18:27:14.762742996 CEST	49730	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:27:14.975326061 CEST	8080	49730	83.196.78.85	192.168.2.4
Apr 20, 2024 18:27:14.975467920 CEST	49730	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:27:15.135021925 CEST	49730	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:27:15.386348009 CEST	8080	49730	83.196.78.85	192.168.2.4
Apr 20, 2024 18:27:15.386431932 CEST	49730	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:27:15.637702942 CEST	8080	49730	83.196.78.85	192.168.2.4
Apr 20, 2024 18:27:20.536849022 CEST	49730	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:27:20.787210941 CEST	8080	49730	83.196.78.85	192.168.2.4
Apr 20, 2024 18:27:21.173100948 CEST	8080	49730	83.196.78.85	192.168.2.4
Apr 20, 2024 18:27:21.179256916 CEST	49730	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:27:21.429635048 CEST	8080	49730	83.196.78.85	192.168.2.4
Apr 20, 2024 18:27:24.180352926 CEST	8080	49730	83.196.78.85	192.168.2.4
Apr 20, 2024 18:27:24.180752039 CEST	49730	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:27:26.192548037 CEST	49730	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:27:26.193010092 CEST	49737	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:27:26.403249025 CEST	8080	49730	83.196.78.85	192.168.2.4
Apr 20, 2024 18:27:26.407190084 CEST	8080	49737	83.196.78.85	192.168.2.4
Apr 20, 2024 18:27:26.407306910 CEST	49737	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:27:26.437163115 CEST	49737	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:27:26.798470974 CEST	8080	49737	83.196.78.85	192.168.2.4
Apr 20, 2024 18:27:26.798716068 CEST	49737	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:27:27.052334070 CEST	8080	49737	83.196.78.85	192.168.2.4
Apr 20, 2024 18:27:28.676065922 CEST	49737	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:27:28.929934978 CEST	8080	49737	83.196.78.85	192.168.2.4
Apr 20, 2024 18:27:32.623456001 CEST	8080	49737	83.196.78.85	192.168.2.4
Apr 20, 2024 18:27:32.623775005 CEST	49737	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:27:32.877815962 CEST	8080	49737	83.196.78.85	192.168.2.4
Apr 20, 2024 18:27:35.611426115 CEST	8080	49737	83.196.78.85	192.168.2.4
Apr 20, 2024 18:27:35.611676931 CEST	49737	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:27:37.613476992 CEST	49737	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:27:37.613940001 CEST	49738	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:27:37.824250937 CEST	8080	49738	83.196.78.85	192.168.2.4
Apr 20, 2024 18:27:37.824337959 CEST	49738	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:27:37.827121019 CEST	8080	49737	83.196.78.85	192.168.2.4
Apr 20, 2024 18:27:37.850763083 CEST	49738	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:27:38.102024078 CEST	8080	49738	83.196.78.85	192.168.2.4
Apr 20, 2024 18:27:38.102072954 CEST	49738	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:27:38.352822065 CEST	8080	49738	83.196.78.85	192.168.2.4
Apr 20, 2024 18:27:44.066121101 CEST	8080	49738	83.196.78.85	192.168.2.4
Apr 20, 2024 18:27:44.066685915 CEST	49738	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:27:44.317246914 CEST	8080	49738	83.196.78.85	192.168.2.4
Apr 20, 2024 18:27:47.035198927 CEST	8080	49738	83.196.78.85	192.168.2.4
Apr 20, 2024 18:27:47.035270929 CEST	49738	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:27:50.043853045 CEST	49738	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:27:50.044279099 CEST	49739	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:27:50.254595041 CEST	8080	49738	83.196.78.85	192.168.2.4
Apr 20, 2024 18:27:50.257602930 CEST	8080	49739	83.196.78.85	192.168.2.4
Apr 20, 2024 18:27:50.257822037 CEST	49739	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:27:50.282874107 CEST	49739	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:27:50.536739111 CEST	8080	49739	83.196.78.85	192.168.2.4
Apr 20, 2024 18:27:50.536952972 CEST	49739	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:27:50.790968895 CEST	8080	49739	83.196.78.85	192.168.2.4
Apr 20, 2024 18:27:53.363742113 CEST	49739	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:27:53.655603886 CEST	8080	49739	83.196.78.85	192.168.2.4
Apr 20, 2024 18:27:56.479963064 CEST	8080	49739	83.196.78.85	192.168.2.4
Apr 20, 2024 18:27:56.480756998 CEST	49739	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:27:56.733510971 CEST	8080	49739	83.196.78.85	192.168.2.4
Apr 20, 2024 18:27:59.482266903 CEST	8080	49739	83.196.78.85	192.168.2.4
Apr 20, 2024 18:27:59.482683897 CEST	49739	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:01.488532066 CEST	49739	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:01.489135981 CEST	49741	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:01.702172995 CEST	8080	49739	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:01.702805996 CEST	8080	49741	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:01.703015089 CEST	49741	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:01.733814955 CEST	49741	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:01.987962008 CEST	8080	49741	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:01.988403082 CEST	49741	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:02.241424084 CEST	8080	49741	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:02.801307917 CEST	49741	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:03.055373907 CEST	8080	49741	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:07.916549921 CEST	8080	49741	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:07.917020082 CEST	49741	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:08.173902988 CEST	8080	49741	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:10.907243013 CEST	8080	49741	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:10.907500982 CEST	49741	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:12.910600901 CEST	49741	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:12.911139011 CEST	49742	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:13.124241114 CEST	8080	49741	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:13.124700069 CEST	8080	49742	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:13.124825954 CEST	49742	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:13.174958944 CEST	49742	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:13.430058956 CEST	8080	49742	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:13.430519104 CEST	49742	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:13.684233904 CEST	8080	49742	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:14.036593914 CEST	49742	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:14.346946001 CEST	8080	49742	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:17.395215988 CEST	49742	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:17.857808113 CEST	8080	49742	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:17.858007908 CEST	49742	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:18.260781050 CEST	8080	49742	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:18.613950014 CEST	49742	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:18.867760897 CEST	8080	49742	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:18.868052006 CEST	49742	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:19.124289989 CEST	8080	49742	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:19.124511003 CEST	49742	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:19.340534925 CEST	8080	49742	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:19.340642929 CEST	49742	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:19.593848944 CEST	8080	49742	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:19.594069958 CEST	49742	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:19.845607042 CEST	8080	49742	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:19.845822096 CEST	49742	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:20.102869034 CEST	8080	49742	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:20.103046894 CEST	49742	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:20.355900049 CEST	8080	49742	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:20.358863115 CEST	49742	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:20.613931894 CEST	8080	49742	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:20.614734888 CEST	49742	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:20.924767971 CEST	8080	49742	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:20.924983025 CEST	49742	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:21.178477049 CEST	8080	49742	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:21.178579092 CEST	49742	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:21.433377028 CEST	8080	49742	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:21.433610916 CEST	49742	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:21.685461044 CEST	8080	49742	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:21.685746908 CEST	49742	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:21.939886093 CEST	8080	49742	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:21.941834927 CEST	49742	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:22.194809914 CEST	8080	49742	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:22.195131063 CEST	49742	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:22.340600967 CEST	8080	49742	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:24.768749952 CEST	49743	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:24.979758024 CEST	8080	49743	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:24.979970932 CEST	49743	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:25.015259981 CEST	49743	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:25.268346071 CEST	8080	49743	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:25.268450022 CEST	49743	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:25.518309116 CEST	8080	49743	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:25.518778086 CEST	49743	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:25.852893114 CEST	8080	49743	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:25.854904890 CEST	49743	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:26.103734970 CEST	8080	49743	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:26.103840113 CEST	49743	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:26.356041908 CEST	8080	49743	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:26.358825922 CEST	49743	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:26.608298063 CEST	8080	49743	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:26.609090090 CEST	49743	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:26.861437082 CEST	8080	49743	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:26.862829924 CEST	49743	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:27.113116980 CEST	8080	49743	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:27.113390923 CEST	49743	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:27.363137007 CEST	8080	49743	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:27.363390923 CEST	49743	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:27.614063978 CEST	8080	49743	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:27.614734888 CEST	49743	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:27.864998102 CEST	8080	49743	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:27.865226984 CEST	49743	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:28.115732908 CEST	8080	49743	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:28.116030931 CEST	49743	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:28.366276979 CEST	8080	49743	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:28.366566896 CEST	49743	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:28.617166996 CEST	8080	49743	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:28.617410898 CEST	49743	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:28.867820024 CEST	8080	49743	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:28.870762110 CEST	49743	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:29.123938084 CEST	8080	49743	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:29.125116110 CEST	49743	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:29.375447035 CEST	8080	49743	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:29.375579119 CEST	49743	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:29.624687910 CEST	8080	49743	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:29.625597954 CEST	49743	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:29.875305891 CEST	8080	49743	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:29.875412941 CEST	49743	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:30.125087023 CEST	8080	49743	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:30.125303984 CEST	49743	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:30.374982119 CEST	8080	49743	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:30.375231028 CEST	49743	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:30.630198956 CEST	8080	49743	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:30.630316019 CEST	49743	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:30.881762981 CEST	8080	49743	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:30.881876945 CEST	49743	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:31.132325888 CEST	8080	49743	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:31.132580042 CEST	49743	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:31.195453882 CEST	8080	49743	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:31.195578098 CEST	49743	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:31.383174896 CEST	8080	49743	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:31.383425951 CEST	49743	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:31.444988012 CEST	8080	49743	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:31.445116997 CEST	49743	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:31.634845972 CEST	8080	49743	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:31.635160923 CEST	49743	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:31.695976019 CEST	8080	49743	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:31.696185112 CEST	49743	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:31.885293007 CEST	8080	49743	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:31.885713100 CEST	49743	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:31.947335005 CEST	8080	49743	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:31.948613882 CEST	49743	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:32.136291981 CEST	8080	49743	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:32.138848066 CEST	49743	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:32.199235916 CEST	8080	49743	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:32.202708006 CEST	49743	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:32.389844894 CEST	8080	49743	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:32.390044928 CEST	49743	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:32.453923941 CEST	8080	49743	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:32.454135895 CEST	49743	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:32.640750885 CEST	8080	49743	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:32.642791986 CEST	49743	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:32.705530882 CEST	8080	49743	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:32.706938028 CEST	49743	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:32.942142963 CEST	8080	49743	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:32.942348957 CEST	49743	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:32.957726002 CEST	8080	49743	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:32.957912922 CEST	49743	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:33.168505907 CEST	8080	49743	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:33.168627024 CEST	49743	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:33.420232058 CEST	8080	49743	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:33.420352936 CEST	49743	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:33.675683975 CEST	8080	49743	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:33.675911903 CEST	49743	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:33.927357912 CEST	8080	49743	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:33.930951118 CEST	49743	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:34.181269884 CEST	8080	49743	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:34.181503057 CEST	49743	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:34.198494911 CEST	8080	49743	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:36.209698915 CEST	49744	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:36.424582005 CEST	8080	49744	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:36.426445961 CEST	49744	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:36.454689980 CEST	49744	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:36.727544069 CEST	8080	49744	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:36.730912924 CEST	49744	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:36.980267048 CEST	8080	49744	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:36.980501890 CEST	49744	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:37.231946945 CEST	8080	49744	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:37.232192039 CEST	49744	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:37.484338045 CEST	8080	49744	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:37.484534979 CEST	49744	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:37.735843897 CEST	8080	49744	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:37.736094952 CEST	49744	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:37.985512018 CEST	8080	49744	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:37.986852884 CEST	49744	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:38.237720013 CEST	8080	49744	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:38.237967968 CEST	49744	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:38.488497972 CEST	8080	49744	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:38.490957022 CEST	49744	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:38.741491079 CEST	8080	49744	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:38.742789030 CEST	49744	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:38.993489981 CEST	8080	49744	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:38.993721962 CEST	49744	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:39.244281054 CEST	8080	49744	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:39.244524956 CEST	49744	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:39.495286942 CEST	8080	49744	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:39.495394945 CEST	49744	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:39.746483088 CEST	8080	49744	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:39.746871948 CEST	49744	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:39.997617960 CEST	8080	49744	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:39.997885942 CEST	49744	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:40.249139071 CEST	8080	49744	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:40.249399900 CEST	49744	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:40.500338078 CEST	8080	49744	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:40.500585079 CEST	49744	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:40.750839949 CEST	8080	49744	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:40.751056910 CEST	49744	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:41.000921965 CEST	8080	49744	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:41.002820015 CEST	49744	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:41.253350019 CEST	8080	49744	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:42.602220058 CEST	49744	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:42.626219034 CEST	8080	49744	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:42.626344919 CEST	49744	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:42.836745024 CEST	8080	49744	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:42.836985111 CEST	49744	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:43.087548971 CEST	8080	49744	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:43.087816954 CEST	49744	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:43.338677883 CEST	8080	49744	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:43.338793039 CEST	49744	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:43.589165926 CEST	8080	49744	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:43.589279890 CEST	49744	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:43.840298891 CEST	8080	49744	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:43.840527058 CEST	49744	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:44.091327906 CEST	8080	49744	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:44.094985008 CEST	49744	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:44.345884085 CEST	8080	49744	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:44.345994949 CEST	49744	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:44.596203089 CEST	8080	49744	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:44.596493959 CEST	49744	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:44.847661018 CEST	8080	49744	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:44.847918987 CEST	49744	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:45.098792076 CEST	8080	49744	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:45.099005938 CEST	49744	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:45.349328041 CEST	8080	49744	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:45.349534988 CEST	49744	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:45.600730896 CEST	8080	49744	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:45.600979090 CEST	49744	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:45.629462004 CEST	8080	49744	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:47.645312071 CEST	49745	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:47.856211901 CEST	8080	49745	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:47.856498003 CEST	49745	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:47.888948917 CEST	49745	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:48.139348984 CEST	8080	49745	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:48.142745972 CEST	49745	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:48.393492937 CEST	8080	49745	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:48.393719912 CEST	49745	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:48.644531012 CEST	8080	49745	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:48.646893978 CEST	49745	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:48.897965908 CEST	8080	49745	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:48.898204088 CEST	49745	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:49.148376942 CEST	8080	49745	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:49.148643970 CEST	49745	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:49.399490118 CEST	8080	49745	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:49.399729013 CEST	49745	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:49.650619030 CEST	8080	49745	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:49.650854111 CEST	49745	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:49.901803970 CEST	8080	49745	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:49.902533054 CEST	49745	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:50.153462887 CEST	8080	49745	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:50.154877901 CEST	49745	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:50.405922890 CEST	8080	49745	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:50.406179905 CEST	49745	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:50.655127048 CEST	8080	49745	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:50.655347109 CEST	49745	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:50.906739950 CEST	8080	49745	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:50.906913042 CEST	49745	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:51.155704975 CEST	8080	49745	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:51.155982018 CEST	49745	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:51.406316042 CEST	8080	49745	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:51.406434059 CEST	49745	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:51.657835960 CEST	8080	49745	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:51.658078909 CEST	49745	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:51.908651114 CEST	8080	49745	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:51.908813000 CEST	49745	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:52.161727905 CEST	8080	49745	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:52.161844015 CEST	49745	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:52.412744045 CEST	8080	49745	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:52.412961960 CEST	49745	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:52.665791988 CEST	8080	49745	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:52.665973902 CEST	49745	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:52.916208029 CEST	8080	49745	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:52.916512012 CEST	49745	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:53.167665958 CEST	8080	49745	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:53.167875051 CEST	49745	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:53.418683052 CEST	8080	49745	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:53.419104099 CEST	49745	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:53.668920994 CEST	8080	49745	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:53.669032097 CEST	49745	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:53.919317961 CEST	8080	49745	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:53.919718981 CEST	49745	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:54.065773964 CEST	8080	49745	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:54.066082001 CEST	49745	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:54.169758081 CEST	8080	49745	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:54.169904947 CEST	49745	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:54.317334890 CEST	8080	49745	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:54.317450047 CEST	49745	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:54.420255899 CEST	8080	49745	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:54.420347929 CEST	49745	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:54.568339109 CEST	8080	49745	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:54.568512917 CEST	49745	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:54.670053005 CEST	8080	49745	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:54.670279026 CEST	49745	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:54.819674015 CEST	8080	49745	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:54.820069075 CEST	49745	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:54.920732975 CEST	8080	49745	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:54.921139002 CEST	49745	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:55.074542999 CEST	8080	49745	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:55.074662924 CEST	49745	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:55.174459934 CEST	8080	49745	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:55.174668074 CEST	49745	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:55.328248978 CEST	8080	49745	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:55.328708887 CEST	49745	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:55.425874949 CEST	8080	49745	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:55.426004887 CEST	49745	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:55.578943014 CEST	8080	49745	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:55.579193115 CEST	49745	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:55.677300930 CEST	8080	49745	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:55.677493095 CEST	49745	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:55.829076052 CEST	8080	49745	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:55.829301119 CEST	49745	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:55.927531958 CEST	8080	49745	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:55.927758932 CEST	49745	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:56.080157042 CEST	8080	49745	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:56.080560923 CEST	49745	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:56.178586006 CEST	8080	49745	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:56.178823948 CEST	49745	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:56.330866098 CEST	8080	49745	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:56.331326962 CEST	49745	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:56.429956913 CEST	8080	49745	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:56.430212975 CEST	49745	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:56.580936909 CEST	8080	49745	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:56.581068993 CEST	49745	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:56.680777073 CEST	8080	49745	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:56.681058884 CEST	49745	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:56.931977034 CEST	8080	49745	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:56.932043076 CEST	8080	49745	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:56.932204962 CEST	49745	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:57.064229012 CEST	8080	49745	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:59.067648888 CEST	49746	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:59.281510115 CEST	8080	49746	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:59.281932116 CEST	49746	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:59.324949980 CEST	49746	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:59.578911066 CEST	8080	49746	83.196.78.85	192.168.2.4
Apr 20, 2024 18:28:59.579339981 CEST	49746	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:28:59.833925009 CEST	8080	49746	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:00.515696049 CEST	49746	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:00.769829035 CEST	8080	49746	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:00.770019054 CEST	49746	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:01.026364088 CEST	8080	49746	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:01.026510954 CEST	49746	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:01.280505896 CEST	8080	49746	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:01.280936956 CEST	49746	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:01.534305096 CEST	8080	49746	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:01.534548998 CEST	49746	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:01.788680077 CEST	8080	49746	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:01.788909912 CEST	49746	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:02.042805910 CEST	8080	49746	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:02.046319962 CEST	49746	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:02.300767899 CEST	8080	49746	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:02.301887035 CEST	49746	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:02.555660009 CEST	8080	49746	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:02.555897951 CEST	49746	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:02.810261011 CEST	8080	49746	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:02.810482979 CEST	49746	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:03.068542004 CEST	8080	49746	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:03.068747044 CEST	49746	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:03.325901031 CEST	8080	49746	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:03.326148987 CEST	49746	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:03.578145981 CEST	8080	49746	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:03.578526020 CEST	49746	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:03.834111929 CEST	8080	49746	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:03.834959030 CEST	49746	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:04.088604927 CEST	8080	49746	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:04.088845015 CEST	49746	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:04.341370106 CEST	8080	49746	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:04.341691971 CEST	49746	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:04.598086119 CEST	8080	49746	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:04.598330021 CEST	49746	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:04.852237940 CEST	8080	49746	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:04.852451086 CEST	49746	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:05.106854916 CEST	8080	49746	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:05.107142925 CEST	49746	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:05.363872051 CEST	8080	49746	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:05.364162922 CEST	49746	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:05.482939959 CEST	8080	49746	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:05.483175039 CEST	49746	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:05.619808912 CEST	8080	49746	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:05.620002985 CEST	49746	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:05.737004995 CEST	8080	49746	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:05.737240076 CEST	49746	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:05.875999928 CEST	8080	49746	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:05.876209974 CEST	49746	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:05.990712881 CEST	8080	49746	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:05.991120100 CEST	49746	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:06.130435944 CEST	8080	49746	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:06.130671978 CEST	49746	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:06.245322943 CEST	8080	49746	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:06.245512962 CEST	49746	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:06.387389898 CEST	8080	49746	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:06.387571096 CEST	49746	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:06.500089884 CEST	8080	49746	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:06.500406027 CEST	49746	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:06.641532898 CEST	8080	49746	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:06.641751051 CEST	49746	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:06.755264997 CEST	8080	49746	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:06.755454063 CEST	49746	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:06.895710945 CEST	8080	49746	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:06.895967960 CEST	49746	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:07.010788918 CEST	8080	49746	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:07.014914989 CEST	49746	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:07.149101019 CEST	8080	49746	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:07.150831938 CEST	49746	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:07.268500090 CEST	8080	49746	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:07.270469904 CEST	49746	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:07.403867960 CEST	8080	49746	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:07.403981924 CEST	49746	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:07.525975943 CEST	8080	49746	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:07.526171923 CEST	49746	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:07.658415079 CEST	8080	49746	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:07.659002066 CEST	49746	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:07.780694008 CEST	8080	49746	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:07.782115936 CEST	49746	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:07.912291050 CEST	8080	49746	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:07.912523031 CEST	49746	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:08.035757065 CEST	8080	49746	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:08.035861015 CEST	49746	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:08.166997910 CEST	8080	49746	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:08.167211056 CEST	49746	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:08.289680958 CEST	8080	49746	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:08.290184975 CEST	49746	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:08.425025940 CEST	8080	49746	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:08.425376892 CEST	49746	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:08.484561920 CEST	8080	49746	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:10.489058971 CEST	49747	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:10.700982094 CEST	8080	49747	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:10.701088905 CEST	49747	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:10.770389080 CEST	49747	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:11.038216114 CEST	8080	49747	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:11.038522959 CEST	49747	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:11.296781063 CEST	8080	49747	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:11.296907902 CEST	49747	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:11.565428972 CEST	8080	49747	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:11.565524101 CEST	49747	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:11.861699104 CEST	8080	49747	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:11.861812115 CEST	49747	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:12.130585909 CEST	8080	49747	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:12.130836964 CEST	49747	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:12.399149895 CEST	8080	49747	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:12.400049925 CEST	49747	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:12.707828045 CEST	8080	49747	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:12.710906982 CEST	49747	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:12.961992979 CEST	8080	49747	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:12.962101936 CEST	49747	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:13.228404999 CEST	8080	49747	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:13.228490114 CEST	49747	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:13.479821920 CEST	8080	49747	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:13.479934931 CEST	49747	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:13.730484962 CEST	8080	49747	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:13.730763912 CEST	49747	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:13.983028889 CEST	8080	49747	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:13.983124018 CEST	49747	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:14.234433889 CEST	8080	49747	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:14.234576941 CEST	49747	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:14.486669064 CEST	8080	49747	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:14.486779928 CEST	49747	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:14.738606930 CEST	8080	49747	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:14.739098072 CEST	49747	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:14.990406036 CEST	8080	49747	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:14.990515947 CEST	49747	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:15.243302107 CEST	8080	49747	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:15.243406057 CEST	49747	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:15.495098114 CEST	8080	49747	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:15.495189905 CEST	49747	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:15.747292995 CEST	8080	49747	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:15.747514963 CEST	49747	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:15.998069048 CEST	8080	49747	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:15.998699903 CEST	49747	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:16.249284029 CEST	8080	49747	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:16.251065016 CEST	49747	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:16.501815081 CEST	8080	49747	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:16.502705097 CEST	49747	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:16.753282070 CEST	8080	49747	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:16.754714012 CEST	49747	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:16.948353052 CEST	8080	49747	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:17.079268932 CEST	8080	49747	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:17.082297087 CEST	49747	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:17.782058954 CEST	49747	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:18.036341906 CEST	8080	49747	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:18.036462069 CEST	49747	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:18.286381960 CEST	8080	49747	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:18.286477089 CEST	49747	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:18.537285089 CEST	8080	49747	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:18.537431955 CEST	49747	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:18.788451910 CEST	8080	49747	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:18.788803101 CEST	49747	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:19.039871931 CEST	8080	49747	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:19.039975882 CEST	49747	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:19.304826975 CEST	8080	49747	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:19.305056095 CEST	49747	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:19.557643890 CEST	8080	49747	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:19.557763100 CEST	49747	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:19.809222937 CEST	8080	49747	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:19.809331894 CEST	49747	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:19.950963020 CEST	8080	49747	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:21.958245039 CEST	49748	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:22.175766945 CEST	8080	49748	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:22.175884962 CEST	49748	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:22.222096920 CEST	49748	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:22.475720882 CEST	8080	49748	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:22.475893021 CEST	49748	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:22.729001999 CEST	8080	49748	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:22.729089022 CEST	49748	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:22.983025074 CEST	8080	49748	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:22.983122110 CEST	49748	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:23.235435009 CEST	8080	49748	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:23.235515118 CEST	49748	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:23.488507986 CEST	8080	49748	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:23.488571882 CEST	49748	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:23.741906881 CEST	8080	49748	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:23.742006063 CEST	49748	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:23.994786024 CEST	8080	49748	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:23.995734930 CEST	49748	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:24.248346090 CEST	8080	49748	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:24.249594927 CEST	49748	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:24.502852917 CEST	8080	49748	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:24.503245115 CEST	49748	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:24.756793022 CEST	8080	49748	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:24.758725882 CEST	49748	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:25.011198997 CEST	8080	49748	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:25.011338949 CEST	49748	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:25.264182091 CEST	8080	49748	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:25.264302969 CEST	49748	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:25.516738892 CEST	8080	49748	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:25.516827106 CEST	49748	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:25.769959927 CEST	8080	49748	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:25.770165920 CEST	49748	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:26.025823116 CEST	8080	49748	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:26.025916100 CEST	49748	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:26.279710054 CEST	8080	49748	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:26.279808998 CEST	49748	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:26.533153057 CEST	8080	49748	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:26.533238888 CEST	49748	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:26.786487103 CEST	8080	49748	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:26.786597967 CEST	49748	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:27.040190935 CEST	8080	49748	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:27.040282965 CEST	49748	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:27.296675920 CEST	8080	49748	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:27.296806097 CEST	49748	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:27.556165934 CEST	8080	49748	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:27.556274891 CEST	49748	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:27.807836056 CEST	8080	49748	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:27.807945967 CEST	49748	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:28.063560963 CEST	8080	49748	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:28.063653946 CEST	49748	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:28.316699028 CEST	8080	49748	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:28.316781998 CEST	49748	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:28.397564888 CEST	8080	49748	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:28.397658110 CEST	49748	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:28.576776028 CEST	8080	49748	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:28.576854944 CEST	49748	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:28.676820993 CEST	8080	49748	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:28.676892996 CEST	49748	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:28.853365898 CEST	8080	49748	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:28.853450060 CEST	49748	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:28.967230082 CEST	8080	49748	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:28.967312098 CEST	49748	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:29.121804953 CEST	8080	49748	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:29.121915102 CEST	49748	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:29.239345074 CEST	8080	49748	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:29.239447117 CEST	49748	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:29.378441095 CEST	8080	49748	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:29.378581047 CEST	49748	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:29.493187904 CEST	8080	49748	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:29.493263960 CEST	49748	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:29.648027897 CEST	8080	49748	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:29.648143053 CEST	49748	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:29.759572983 CEST	8080	49748	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:29.759653091 CEST	49748	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:29.920185089 CEST	8080	49748	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:29.920264959 CEST	49748	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:30.027098894 CEST	8080	49748	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:30.027188063 CEST	49748	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:30.196264982 CEST	8080	49748	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:30.196403027 CEST	49748	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:30.306041002 CEST	8080	49748	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:30.306152105 CEST	49748	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:30.493824005 CEST	8080	49748	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:30.493927956 CEST	49748	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:30.584002018 CEST	8080	49748	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:30.584069014 CEST	49748	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:30.763715982 CEST	8080	49748	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:30.763828039 CEST	49748	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:30.862306118 CEST	8080	49748	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:30.862416029 CEST	49748	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:31.034034014 CEST	8080	49748	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:31.034115076 CEST	49748	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:31.128578901 CEST	8080	49748	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:31.298119068 CEST	8080	49748	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:31.298207045 CEST	49748	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:31.406269073 CEST	8080	49748	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:33.411262035 CEST	49749	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:33.651592970 CEST	8080	49749	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:33.651712894 CEST	49749	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:34.033036947 CEST	49749	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:34.287892103 CEST	8080	49749	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:34.287987947 CEST	49749	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:34.568201065 CEST	8080	49749	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:35.694504976 CEST	49749	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:35.949773073 CEST	8080	49749	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:35.950123072 CEST	49749	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:36.204363108 CEST	8080	49749	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:36.204459906 CEST	49749	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:36.459527969 CEST	8080	49749	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:36.459702969 CEST	49749	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:36.714123964 CEST	8080	49749	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:36.714210033 CEST	49749	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:36.967969894 CEST	8080	49749	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:36.969029903 CEST	49749	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:37.225471020 CEST	8080	49749	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:37.226866961 CEST	49749	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:37.482877970 CEST	8080	49749	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:37.486749887 CEST	49749	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:37.741786957 CEST	8080	49749	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:37.741903067 CEST	49749	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:37.995323896 CEST	8080	49749	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:37.995511055 CEST	49749	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:38.248323917 CEST	8080	49749	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:38.248444080 CEST	49749	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:38.501923084 CEST	8080	49749	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:38.502048969 CEST	49749	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:38.756486893 CEST	8080	49749	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:38.756572008 CEST	49749	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:39.010099888 CEST	8080	49749	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:39.010202885 CEST	49749	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:39.262720108 CEST	8080	49749	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:39.262841940 CEST	49749	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:39.517355919 CEST	8080	49749	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:39.517486095 CEST	49749	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:39.772023916 CEST	8080	49749	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:39.772166014 CEST	49749	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:39.960715055 CEST	8080	49749	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:39.960845947 CEST	49749	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:39.985668898 CEST	8080	49749	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:39.985786915 CEST	49749	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:40.202398062 CEST	8080	49749	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:40.202491999 CEST	49749	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:40.455529928 CEST	8080	49749	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:40.455667019 CEST	49749	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:40.708365917 CEST	8080	49749	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:40.708501101 CEST	49749	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:40.962415934 CEST	8080	49749	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:40.962513924 CEST	49749	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:41.215715885 CEST	8080	49749	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:41.215810061 CEST	49749	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:41.471698999 CEST	8080	49749	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:41.471817970 CEST	49749	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:41.726489067 CEST	8080	49749	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:41.726705074 CEST	49749	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:41.981988907 CEST	8080	49749	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:41.982141972 CEST	49749	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:42.236218929 CEST	8080	49749	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:42.236299992 CEST	49749	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:42.489480972 CEST	8080	49749	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:42.489660978 CEST	49749	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:42.743650913 CEST	8080	49749	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:42.743814945 CEST	49749	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:42.958152056 CEST	8080	49749	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:44.973658085 CEST	49750	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:45.187103987 CEST	8080	49750	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:45.187259912 CEST	49750	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:45.222012997 CEST	49750	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:45.476272106 CEST	8080	49750	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:45.476444006 CEST	49750	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:45.729269028 CEST	8080	49750	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:45.729355097 CEST	49750	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:45.986387968 CEST	8080	49750	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:45.986512899 CEST	49750	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:46.239918947 CEST	8080	49750	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:46.240012884 CEST	49750	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:46.526572943 CEST	8080	49750	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:46.526742935 CEST	49750	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:46.779958010 CEST	8080	49750	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:46.780097008 CEST	49750	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:47.033329010 CEST	8080	49750	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:47.037075043 CEST	49750	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:47.291446924 CEST	8080	49750	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:47.292764902 CEST	49750	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:47.560240030 CEST	8080	49750	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:47.561794996 CEST	49750	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:47.814881086 CEST	8080	49750	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:47.815015078 CEST	49750	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:48.068468094 CEST	8080	49750	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:48.068634033 CEST	49750	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:48.326380014 CEST	8080	49750	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:48.326555967 CEST	49750	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:48.579967976 CEST	8080	49750	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:48.580132961 CEST	49750	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:48.833271980 CEST	8080	49750	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:48.833606958 CEST	49750	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:49.089384079 CEST	8080	49750	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:49.089652061 CEST	49750	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:49.342386961 CEST	8080	49750	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:49.342524052 CEST	49750	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:49.596945047 CEST	8080	49750	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:49.597119093 CEST	49750	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:49.850722075 CEST	8080	49750	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:49.850837946 CEST	49750	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:50.106425047 CEST	8080	49750	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:50.106535912 CEST	49750	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:50.359930992 CEST	8080	49750	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:50.360038042 CEST	49750	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:50.613784075 CEST	8080	49750	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:50.614008904 CEST	49750	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:50.868999958 CEST	8080	49750	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:50.869177103 CEST	49750	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:51.127304077 CEST	8080	49750	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:51.127401114 CEST	49750	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:51.380577087 CEST	8080	49750	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:51.405466080 CEST	8080	49750	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:51.517865896 CEST	49750	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:51.771266937 CEST	8080	49750	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:51.773085117 CEST	49750	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:52.026360989 CEST	8080	49750	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:52.026480913 CEST	49750	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:52.279936075 CEST	8080	49750	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:53.342408895 CEST	49750	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:53.596348047 CEST	8080	49750	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:53.596431017 CEST	49750	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:53.850162983 CEST	8080	49750	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:53.850486040 CEST	49750	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:54.106959105 CEST	8080	49750	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:54.107379913 CEST	49750	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:54.360424042 CEST	8080	49750	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:54.360745907 CEST	49750	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:54.405898094 CEST	8080	49750	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:56.410974979 CEST	49751	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:56.626036882 CEST	8080	49751	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:56.626141071 CEST	49751	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:56.685847998 CEST	49751	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:56.941663027 CEST	8080	49751	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:56.941838980 CEST	49751	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:57.196980000 CEST	8080	49751	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:57.197101116 CEST	49751	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:57.452828884 CEST	8080	49751	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:57.453295946 CEST	49751	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:57.708043098 CEST	8080	49751	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:57.708142996 CEST	49751	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:57.961249113 CEST	8080	49751	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:57.961363077 CEST	49751	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:58.215643883 CEST	8080	49751	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:58.217530012 CEST	49751	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:58.471437931 CEST	8080	49751	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:58.471534967 CEST	49751	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:58.725713015 CEST	8080	49751	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:58.728892088 CEST	49751	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:58.982316971 CEST	8080	49751	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:58.982547045 CEST	49751	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:59.236192942 CEST	8080	49751	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:59.236329079 CEST	49751	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:59.490300894 CEST	8080	49751	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:59.490511894 CEST	49751	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:59.744690895 CEST	8080	49751	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:59.744791031 CEST	49751	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:29:59.998418093 CEST	8080	49751	83.196.78.85	192.168.2.4
Apr 20, 2024 18:29:59.998591900 CEST	49751	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:00.252173901 CEST	8080	49751	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:00.252389908 CEST	49751	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:00.506330013 CEST	8080	49751	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:00.506521940 CEST	49751	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:00.762404919 CEST	8080	49751	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:00.762684107 CEST	49751	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:01.016900063 CEST	8080	49751	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:01.017018080 CEST	49751	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:01.270941019 CEST	8080	49751	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:01.271061897 CEST	49751	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:01.526706934 CEST	8080	49751	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:01.526794910 CEST	49751	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:01.779829025 CEST	8080	49751	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:01.779936075 CEST	49751	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:02.034383059 CEST	8080	49751	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:02.034603119 CEST	49751	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:02.347966909 CEST	49751	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:02.359834909 CEST	8080	49751	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:02.359935045 CEST	49751	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:02.560889959 CEST	8080	49751	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:02.561008930 CEST	49751	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:02.577116013 CEST	8080	49751	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:02.577296972 CEST	49751	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:02.790445089 CEST	8080	49751	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:02.790540934 CEST	49751	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:02.836890936 CEST	8080	49751	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:02.836985111 CEST	49751	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:03.004188061 CEST	8080	49751	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:03.004292011 CEST	49751	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:03.089865923 CEST	8080	49751	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:03.090724945 CEST	49751	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:03.259788990 CEST	8080	49751	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:03.262764931 CEST	49751	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:03.344430923 CEST	8080	49751	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:03.344506025 CEST	49751	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:03.516299963 CEST	8080	49751	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:03.518793106 CEST	49751	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:03.597695112 CEST	8080	49751	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:03.598092079 CEST	49751	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:03.776057959 CEST	8080	49751	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:03.778723001 CEST	49751	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:03.850409031 CEST	8080	49751	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:03.850790024 CEST	49751	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:04.032536983 CEST	8080	49751	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:04.032633066 CEST	49751	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:04.104310989 CEST	8080	49751	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:04.104387999 CEST	49751	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:04.286294937 CEST	8080	49751	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:04.286410093 CEST	49751	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:04.359524012 CEST	8080	49751	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:04.359642982 CEST	49751	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:04.539074898 CEST	8080	49751	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:04.539259911 CEST	49751	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:04.613475084 CEST	8080	49751	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:04.613555908 CEST	49751	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:04.794920921 CEST	8080	49751	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:04.795120955 CEST	49751	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:04.868967056 CEST	8080	49751	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:04.869076014 CEST	49751	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:05.048500061 CEST	8080	49751	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:05.048605919 CEST	49751	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:05.125808954 CEST	8080	49751	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:05.126070023 CEST	49751	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:05.302329063 CEST	8080	49751	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:05.302431107 CEST	49751	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:05.379961967 CEST	8080	49751	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:05.380135059 CEST	49751	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:05.555790901 CEST	8080	49751	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:05.555886030 CEST	49751	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:05.634085894 CEST	8080	49751	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:05.634295940 CEST	49751	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:05.809659004 CEST	8080	49751	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:05.809870958 CEST	49751	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:05.840842962 CEST	8080	49751	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:07.848462105 CEST	49752	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:08.062365055 CEST	8080	49752	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:08.062632084 CEST	49752	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:08.096919060 CEST	49752	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:08.350718021 CEST	8080	49752	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:08.350954056 CEST	49752	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:08.604736090 CEST	8080	49752	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:08.604939938 CEST	49752	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:08.857812881 CEST	8080	49752	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:08.858026981 CEST	49752	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:09.111346960 CEST	8080	49752	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:09.111450911 CEST	49752	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:09.364851952 CEST	8080	49752	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:09.364970922 CEST	49752	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:09.619678974 CEST	8080	49752	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:09.619904995 CEST	49752	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:09.876502037 CEST	8080	49752	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:09.876751900 CEST	49752	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:10.128892899 CEST	8080	49752	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:10.129126072 CEST	49752	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:10.381724119 CEST	8080	49752	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:11.678761005 CEST	49752	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:11.933466911 CEST	8080	49752	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:11.933624029 CEST	49752	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:12.187031031 CEST	8080	49752	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:12.187279940 CEST	49752	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:12.441126108 CEST	8080	49752	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:12.441365957 CEST	49752	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:12.695388079 CEST	8080	49752	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:12.695691109 CEST	49752	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:12.949223042 CEST	8080	49752	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:12.949477911 CEST	49752	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:13.212203979 CEST	8080	49752	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:13.212451935 CEST	49752	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:13.466044903 CEST	8080	49752	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:13.466377020 CEST	49752	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:13.719676971 CEST	8080	49752	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:13.719923019 CEST	49752	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:13.976794004 CEST	8080	49752	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:13.977047920 CEST	49752	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:14.231590986 CEST	8080	49752	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:14.231798887 CEST	49752	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:14.279285908 CEST	8080	49752	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:14.279376030 CEST	49752	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:14.485615015 CEST	8080	49752	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:14.485879898 CEST	49752	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:14.532248020 CEST	8080	49752	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:14.532582045 CEST	49752	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:14.739645958 CEST	8080	49752	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:14.739881992 CEST	49752	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:14.786058903 CEST	8080	49752	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:14.786147118 CEST	49752	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:14.996148109 CEST	8080	49752	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:14.996510983 CEST	49752	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:15.040709019 CEST	8080	49752	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:15.040908098 CEST	49752	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:15.249617100 CEST	8080	49752	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:15.249872923 CEST	49752	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:15.294246912 CEST	8080	49752	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:15.294488907 CEST	49752	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:15.502860069 CEST	8080	49752	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:15.503177881 CEST	49752	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:15.547805071 CEST	8080	49752	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:15.548063040 CEST	49752	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:15.757121086 CEST	8080	49752	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:15.757467985 CEST	49752	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:15.800967932 CEST	8080	49752	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:15.801088095 CEST	49752	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:16.011482954 CEST	8080	49752	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:16.011591911 CEST	49752	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:16.053698063 CEST	8080	49752	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:16.053884983 CEST	49752	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:16.265738964 CEST	8080	49752	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:16.265841007 CEST	49752	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:16.307049990 CEST	8080	49752	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:16.307241917 CEST	49752	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:16.520279884 CEST	8080	49752	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:16.520488977 CEST	49752	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:16.560786963 CEST	8080	49752	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:16.560990095 CEST	49752	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:16.776398897 CEST	8080	49752	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:16.776674032 CEST	49752	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:16.813823938 CEST	8080	49752	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:16.814062119 CEST	49752	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:17.027364016 CEST	8080	49752	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:17.030976057 CEST	49752	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:17.278758049 CEST	8080	49752	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:19.287317991 CEST	49753	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:19.498102903 CEST	8080	49753	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:19.498233080 CEST	49753	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:19.528228998 CEST	49753	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:19.779602051 CEST	8080	49753	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:19.779687881 CEST	49753	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:20.030158043 CEST	8080	49753	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:20.030742884 CEST	49753	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:20.281451941 CEST	8080	49753	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:20.281560898 CEST	49753	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:20.531984091 CEST	8080	49753	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:20.534862995 CEST	49753	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:20.784804106 CEST	8080	49753	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:20.785528898 CEST	49753	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:21.038167000 CEST	8080	49753	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:21.038280010 CEST	49753	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:21.288131952 CEST	8080	49753	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:21.290831089 CEST	49753	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:21.541843891 CEST	8080	49753	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:21.541950941 CEST	49753	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:21.791310072 CEST	8080	49753	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:21.794768095 CEST	49753	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:22.046446085 CEST	8080	49753	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:22.046569109 CEST	49753	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:22.296863079 CEST	8080	49753	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:22.296986103 CEST	49753	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:22.547554970 CEST	8080	49753	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:22.547794104 CEST	49753	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:22.797436953 CEST	8080	49753	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:22.797544003 CEST	49753	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:23.049253941 CEST	8080	49753	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:23.049385071 CEST	49753	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:23.299992085 CEST	8080	49753	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:23.300086975 CEST	49753	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:23.550648928 CEST	8080	49753	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:23.550765991 CEST	49753	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:23.803900957 CEST	8080	49753	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:23.804040909 CEST	49753	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:24.054636955 CEST	8080	49753	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:24.054754972 CEST	49753	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:24.304357052 CEST	8080	49753	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:24.304466963 CEST	49753	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:24.555609941 CEST	8080	49753	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:24.557043076 CEST	49753	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:24.807786942 CEST	8080	49753	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:24.809122086 CEST	49753	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:25.059788942 CEST	8080	49753	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:25.059921026 CEST	49753	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:25.310642958 CEST	8080	49753	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:25.310766935 CEST	49753	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:25.560828924 CEST	8080	49753	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:25.560961962 CEST	49753	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:25.713634014 CEST	8080	49753	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:25.713768959 CEST	49753	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:25.771209002 CEST	8080	49753	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:25.771325111 CEST	49753	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:25.964257956 CEST	8080	49753	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:25.964365959 CEST	49753	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:26.020644903 CEST	8080	49753	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:26.020744085 CEST	49753	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:26.214832067 CEST	8080	49753	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:26.215054989 CEST	49753	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:26.270951986 CEST	8080	49753	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:26.271224022 CEST	49753	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:26.465277910 CEST	8080	49753	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:26.465400934 CEST	49753	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:26.522430897 CEST	8080	49753	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:26.522505045 CEST	49753	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:26.716303110 CEST	8080	49753	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:26.716461897 CEST	49753	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:26.776230097 CEST	8080	49753	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:26.776313066 CEST	49753	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:26.966830969 CEST	8080	49753	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:26.966918945 CEST	49753	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:27.028058052 CEST	8080	49753	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:27.028276920 CEST	49753	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:27.217495918 CEST	8080	49753	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:27.217592955 CEST	49753	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:27.279467106 CEST	8080	49753	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:27.279709101 CEST	49753	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:27.467169046 CEST	8080	49753	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:27.467263937 CEST	49753	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:27.529577017 CEST	8080	49753	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:27.529694080 CEST	49753	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:27.716300964 CEST	8080	49753	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:27.716408968 CEST	49753	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:27.779751062 CEST	8080	49753	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:27.779827118 CEST	49753	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:27.967258930 CEST	8080	49753	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:27.967364073 CEST	49753	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:28.030632973 CEST	8080	49753	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:28.030766964 CEST	49753	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:28.217864037 CEST	8080	49753	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:28.217991114 CEST	49753	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:28.281227112 CEST	8080	49753	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:28.281318903 CEST	49753	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:28.468274117 CEST	8080	49753	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:28.468379974 CEST	49753	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:28.531558990 CEST	8080	49753	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:28.531665087 CEST	49753	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:28.719011068 CEST	8080	49753	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:30.599185944 CEST	49754	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:30.809353113 CEST	8080	49754	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:30.809585094 CEST	49754	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:30.847270012 CEST	49754	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:31.098433018 CEST	8080	49754	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:31.100862980 CEST	49754	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:31.350497007 CEST	8080	49754	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:31.350634098 CEST	49754	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:31.601561069 CEST	8080	49754	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:31.601885080 CEST	49754	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:31.851989985 CEST	8080	49754	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:31.852123022 CEST	49754	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:32.101751089 CEST	8080	49754	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:32.102037907 CEST	49754	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:32.352981091 CEST	8080	49754	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:32.353245974 CEST	49754	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:32.604604959 CEST	8080	49754	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:32.604737043 CEST	49754	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:32.855041981 CEST	8080	49754	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:32.855282068 CEST	49754	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:33.106894970 CEST	8080	49754	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:33.107145071 CEST	49754	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:33.358058929 CEST	8080	49754	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:33.358300924 CEST	49754	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:33.608364105 CEST	8080	49754	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:33.608606100 CEST	49754	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:33.859553099 CEST	8080	49754	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:33.859808922 CEST	49754	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:34.110167027 CEST	8080	49754	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:34.110368967 CEST	49754	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:34.361174107 CEST	8080	49754	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:34.361454964 CEST	49754	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:34.612355947 CEST	8080	49754	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:34.612631083 CEST	49754	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:34.863259077 CEST	8080	49754	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:34.863482952 CEST	49754	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:35.113260031 CEST	8080	49754	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:35.113511086 CEST	49754	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:35.364846945 CEST	8080	49754	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:35.365209103 CEST	49754	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:35.615520954 CEST	8080	49754	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:35.615730047 CEST	49754	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:35.866271973 CEST	8080	49754	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:35.866611958 CEST	49754	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:36.117095947 CEST	8080	49754	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:36.117232084 CEST	49754	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:36.367809057 CEST	8080	49754	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:36.367958069 CEST	49754	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:36.618526936 CEST	8080	49754	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:36.618933916 CEST	49754	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:36.869420052 CEST	8080	49754	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:36.869692087 CEST	49754	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:37.028341055 CEST	8080	49754	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:37.028459072 CEST	49754	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:37.121119022 CEST	8080	49754	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:37.121360064 CEST	49754	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:37.278455973 CEST	8080	49754	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:37.278677940 CEST	49754	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:37.371694088 CEST	8080	49754	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:37.371840954 CEST	49754	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:37.529290915 CEST	8080	49754	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:37.529505014 CEST	49754	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:37.623554945 CEST	8080	49754	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:37.623683929 CEST	49754	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:37.779941082 CEST	8080	49754	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:37.780234098 CEST	49754	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:37.877285004 CEST	8080	49754	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:37.877625942 CEST	49754	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:38.030643940 CEST	8080	49754	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:38.030877113 CEST	49754	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:38.128213882 CEST	8080	49754	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:38.128492117 CEST	49754	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:38.281759977 CEST	8080	49754	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:38.282012939 CEST	49754	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:38.378484011 CEST	8080	49754	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:38.378844976 CEST	49754	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:38.532381058 CEST	8080	49754	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:38.532526016 CEST	49754	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:38.629281044 CEST	8080	49754	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:38.629395962 CEST	49754	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:38.783938885 CEST	8080	49754	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:38.784060955 CEST	49754	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:38.881403923 CEST	8080	49754	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:38.881730080 CEST	49754	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:39.033549070 CEST	8080	49754	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:39.034058094 CEST	49754	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:39.132297993 CEST	8080	49754	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:39.132419109 CEST	49754	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:39.284632921 CEST	8080	49754	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:39.284779072 CEST	49754	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:39.383344889 CEST	8080	49754	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:39.383539915 CEST	49754	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:39.535712957 CEST	8080	49754	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:39.535962105 CEST	49754	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:39.634320021 CEST	8080	49754	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:39.634665012 CEST	49754	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:39.786504984 CEST	8080	49754	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:39.786863089 CEST	49754	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:39.884732962 CEST	8080	49754	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:39.884855986 CEST	49754	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:40.029220104 CEST	8080	49754	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:41.786214113 CEST	49755	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:42.000288010 CEST	8080	49755	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:42.000619888 CEST	49755	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:42.037902117 CEST	49755	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:42.290697098 CEST	8080	49755	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:42.294748068 CEST	49755	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:42.549988985 CEST	8080	49755	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:42.550087929 CEST	49755	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:42.803844929 CEST	8080	49755	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:42.804069042 CEST	49755	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:43.057821035 CEST	8080	49755	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:43.058047056 CEST	49755	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:43.311966896 CEST	8080	49755	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:43.312412977 CEST	49755	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:43.566313982 CEST	8080	49755	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:43.566627026 CEST	49755	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:43.818707943 CEST	8080	49755	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:43.818957090 CEST	49755	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:44.072923899 CEST	8080	49755	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:44.937053919 CEST	49755	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:45.188281059 CEST	8080	49755	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:45.188504934 CEST	49755	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:45.441915989 CEST	8080	49755	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:45.442050934 CEST	49755	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:45.694643974 CEST	8080	49755	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:45.695036888 CEST	49755	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:45.947494984 CEST	8080	49755	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:45.947740078 CEST	49755	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:46.201493025 CEST	8080	49755	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:46.201728106 CEST	49755	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:46.455208063 CEST	8080	49755	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:46.455457926 CEST	49755	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:46.785567999 CEST	49755	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:46.814384937 CEST	8080	49755	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:46.814610004 CEST	49755	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:47.000247955 CEST	8080	49755	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:47.000462055 CEST	49755	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:47.027395010 CEST	8080	49755	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:47.027628899 CEST	49755	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:47.241621017 CEST	8080	49755	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:47.244976044 CEST	49755	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:47.586730957 CEST	49755	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:47.598298073 CEST	8080	49755	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:47.598304033 CEST	49755	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:47.800241947 CEST	8080	49755	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:47.801120996 CEST	49755	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:47.810297012 CEST	8080	49755	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:48.055027008 CEST	8080	49755	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:48.055289030 CEST	49755	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:48.211075068 CEST	8080	49755	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:48.211385965 CEST	49755	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:48.268640995 CEST	8080	49755	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:48.268965960 CEST	49755	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:48.466681957 CEST	8080	49755	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:48.466976881 CEST	49755	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:48.521186113 CEST	8080	49755	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:48.521493912 CEST	49755	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:48.720990896 CEST	8080	49755	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:48.721196890 CEST	49755	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:48.777473927 CEST	8080	49755	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:48.777661085 CEST	49755	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:48.977540970 CEST	8080	49755	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:48.977726936 CEST	49755	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:49.031204939 CEST	8080	49755	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:49.031589031 CEST	49755	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:49.232342005 CEST	8080	49755	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:49.232608080 CEST	49755	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:49.285041094 CEST	8080	49755	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:49.285274982 CEST	49755	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:49.486736059 CEST	8080	49755	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:49.487147093 CEST	49755	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:49.539797068 CEST	8080	49755	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:49.540199041 CEST	49755	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:49.741345882 CEST	8080	49755	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:49.741601944 CEST	49755	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:49.794298887 CEST	8080	49755	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:49.794563055 CEST	49755	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:49.994889021 CEST	8080	49755	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:49.995112896 CEST	49755	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:50.047739983 CEST	8080	49755	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:50.047940969 CEST	49755	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:50.248301983 CEST	8080	49755	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:50.248553038 CEST	49755	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:50.300914049 CEST	8080	49755	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:50.301345110 CEST	49755	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:50.501952887 CEST	8080	49755	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:50.502264023 CEST	49755	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:50.554713011 CEST	8080	49755	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:50.554948092 CEST	49755	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:50.755775928 CEST	8080	49755	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:50.756108046 CEST	49755	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:50.808590889 CEST	8080	49755	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:50.808810949 CEST	49755	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:51.010019064 CEST	8080	49755	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:51.010148048 CEST	49755	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:51.062331915 CEST	8080	49755	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:51.062566042 CEST	49755	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:51.211925030 CEST	8080	49755	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:52.849400997 CEST	49756	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:53.062670946 CEST	8080	49756	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:53.062778950 CEST	49756	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:53.091866016 CEST	49756	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:53.345848083 CEST	8080	49756	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:53.345961094 CEST	49756	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:53.602283955 CEST	8080	49756	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:53.602359056 CEST	49756	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:53.854283094 CEST	8080	49756	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:53.854384899 CEST	49756	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:54.108975887 CEST	8080	49756	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:54.112828970 CEST	49756	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:54.366722107 CEST	8080	49756	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:54.369041920 CEST	49756	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:54.627147913 CEST	8080	49756	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:54.628992081 CEST	49756	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:54.882602930 CEST	8080	49756	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:54.882770061 CEST	49756	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:55.137460947 CEST	8080	49756	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:55.137686014 CEST	49756	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:55.391386032 CEST	8080	49756	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:55.391501904 CEST	49756	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:55.645554066 CEST	8080	49756	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:55.645739079 CEST	49756	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:55.898684978 CEST	8080	49756	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:55.898802996 CEST	49756	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:56.151695967 CEST	8080	49756	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:56.151798964 CEST	49756	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:56.405622005 CEST	8080	49756	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:56.405859947 CEST	49756	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:56.659460068 CEST	8080	49756	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:56.659558058 CEST	49756	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:56.915400028 CEST	8080	49756	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:56.915503979 CEST	49756	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:57.168575048 CEST	8080	49756	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:57.168662071 CEST	49756	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:57.422091961 CEST	8080	49756	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:57.422306061 CEST	49756	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:57.677650928 CEST	8080	49756	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:57.677900076 CEST	49756	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:57.931168079 CEST	8080	49756	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:57.931255102 CEST	49756	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:58.184243917 CEST	8080	49756	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:58.184756994 CEST	49756	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:58.438690901 CEST	8080	49756	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:58.441836119 CEST	49756	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:58.694799900 CEST	8080	49756	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:58.698824883 CEST	49756	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:58.952334881 CEST	8080	49756	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:58.954833031 CEST	49756	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:59.208905935 CEST	8080	49756	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:59.208996058 CEST	49756	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:59.271203995 CEST	8080	49756	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:59.271275043 CEST	49756	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:59.462460995 CEST	8080	49756	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:59.462575912 CEST	49756	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:59.527043104 CEST	8080	49756	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:59.527144909 CEST	49756	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:59.715581894 CEST	8080	49756	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:59.715774059 CEST	49756	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:59.780473948 CEST	8080	49756	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:59.780544043 CEST	49756	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:30:59.969280005 CEST	8080	49756	83.196.78.85	192.168.2.4
Apr 20, 2024 18:30:59.969477892 CEST	49756	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:31:00.034790039 CEST	8080	49756	83.196.78.85	192.168.2.4
Apr 20, 2024 18:31:00.034970045 CEST	49756	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:31:00.222944975 CEST	8080	49756	83.196.78.85	192.168.2.4
Apr 20, 2024 18:31:00.223050117 CEST	49756	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:31:00.288158894 CEST	8080	49756	83.196.78.85	192.168.2.4
Apr 20, 2024 18:31:00.288247108 CEST	49756	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:31:00.478300095 CEST	8080	49756	83.196.78.85	192.168.2.4
Apr 20, 2024 18:31:00.478374958 CEST	49756	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:31:00.542504072 CEST	8080	49756	83.196.78.85	192.168.2.4
Apr 20, 2024 18:31:00.542577982 CEST	49756	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:31:00.732927084 CEST	8080	49756	83.196.78.85	192.168.2.4
Apr 20, 2024 18:31:00.732997894 CEST	49756	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:31:00.796293974 CEST	8080	49756	83.196.78.85	192.168.2.4
Apr 20, 2024 18:31:00.986432076 CEST	8080	49756	83.196.78.85	192.168.2.4
Apr 20, 2024 18:31:02.278933048 CEST	8080	49756	83.196.78.85	192.168.2.4
Apr 20, 2024 18:31:03.989350080 CEST	49757	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:31:04.203020096 CEST	8080	49757	83.196.78.85	192.168.2.4
Apr 20, 2024 18:31:04.206897020 CEST	49757	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:31:04.237622976 CEST	49757	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:31:04.491055012 CEST	8080	49757	83.196.78.85	192.168.2.4
Apr 20, 2024 18:31:04.491149902 CEST	49757	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:31:04.743674040 CEST	8080	49757	83.196.78.85	192.168.2.4
Apr 20, 2024 18:31:04.743752003 CEST	49757	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:31:04.997384071 CEST	8080	49757	83.196.78.85	192.168.2.4
Apr 20, 2024 18:31:04.997533083 CEST	49757	8080	192.168.2.4	83.196.78.85
Apr 20, 2024 18:31:05.251071930 CEST	8080	49757	83.196.78.85	192.168.2.4

Target ID:	0
Start time:	18:26:56
Start date:	20/04/2024
Path:	C:\Users\user\Desktop\YKTNuK117e.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\YKTNuK117e.exe"
Imagebase:	0x5f0000
File size:	32'256 bytes
MD5 hash:	200A92AD17110CB3DACC7387B12186C6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: 00000000.00000000.1683506708.00000000005F2000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: 00000000.00000000.1683506708.00000000005F2000.00000002.00000001.01000000.00000003.sdmp, Author: unknown Rule: njrat1, Description: Identify njRat, Source: 00000000.00000000.1683506708.00000000005F2000.00000002.00000001.01000000.00000003.sdmp, Author: Brian Wallace @botnet_hunter Rule: Njrat, Description: detect njRAT in memory, Source: 00000000.00000000.1683506708.00000000005F2000.00000002.00000001.01000000.00000003.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: 00000000.00000002.1748887345.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: 00000000.00000002.1748887345.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: njrat1, Description: Identify njRat, Source: 00000000.00000002.1748887345.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, Author: Brian Wallace @botnet_hunter Rule: Njrat, Description: detect njRAT in memory, Source: 00000000.00000002.1748887345.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	18:27:03
Start date:	20/04/2024
Path:	C:\Users\user\AppData\Local\Temp\WindowsServices.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\WindowsServices.exe"
Imagebase:	0x470000
File size:	32'256 bytes
MD5 hash:	200A92AD17110CB3DACC7387B12186C6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: 00000001.00000002.4155853569.0000000002BC1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe, Author: unknown Rule: CN_disclosed_20180208_c, Description: Detects malware from disclosed CN malware set, Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe, Author: Florian Roth Rule: njrat1, Description: Identify njRat, Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe, Author: Brian Wallace @botnet_hunter Rule: Njrat, Description: detect njRAT in memory, Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe, Author: JPCERT/CC Incident Response Group Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Local\Temp\WindowsServices.exe, Author: ditekSHen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 87%, ReversingLabs Detection: 83%, Virustotal, Browse
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	18:27:09
Start date:	20/04/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh firewall add allowedprogram "C:\Users\user\AppData\Local\Temp\WindowsServices.exe" "WindowsServices.exe" ENABLE
Imagebase:	0x1560000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	18:27:09
Start date:	20/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	18:27:21
Start date:	20/04/2024
Path:	C:\Users\user\AppData\Local\Temp\WindowsServices.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\WindowsServices.exe" ..
Imagebase:	0x270000
File size:	32'256 bytes
MD5 hash:	200A92AD17110CB3DACC7387B12186C6
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	18:27:31
Start date:	20/04/2024
Path:	C:\Users\user\AppData\Local\Temp\WindowsServices.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\WindowsServices.exe" ..
Imagebase:	0xe50000
File size:	32'256 bytes
MD5 hash:	200A92AD17110CB3DACC7387B12186C6
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	18:27:39
Start date:	20/04/2024
Path:	C:\Users\user\AppData\Local\Temp\WindowsServices.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\WindowsServices.exe" ..
Imagebase:	0xac0000
File size:	32'256 bytes
MD5 hash:	200A92AD17110CB3DACC7387B12186C6
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	17.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	47
Total number of Limit Nodes:	2

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00EFA94F Relevance: 1.6, APIs: 1, Instructions: 98
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 00EFAA05

Memory Dump Source

Source File: 00000000.00000002.1748675180.0000000000EFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EFA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_efa000_YKTNuK117e.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 1bf6398484cab0381e80b6e938130291da353c54cdc984335c3a4d6a96159a67
Instruction ID: 0c7afb73855011ffae75e1edc185bf18da96f595c5235c40e3669b85ee24f457
Opcode Fuzzy Hash: 1bf6398484cab0381e80b6e938130291da353c54cdc984335c3a4d6a96159a67
Instruction Fuzzy Hash: 4C31D2B15053806FE722CB25DD44B62BFF8EF06314F0888AAE9848B652D275E909CB71

Uniqueness

Uniqueness Score: -1.00%

Function 00EFA612 Relevance: 1.6, APIs: 1, Instructions: 89
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexW.KERNELBASE(?,?), ref: 00EFA6B9

Memory Dump Source

Source File: 00000000.00000002.1748675180.0000000000EFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EFA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_efa000_YKTNuK117e.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: 4c069306af840ea1880aa83a2bfdf2a5b0f4f421205e8023d556554a83f64540
Instruction ID: ab98a299f8a650482a53dca89895446fe96789637c0db8869cd7416ddd543d4d
Opcode Fuzzy Hash: 4c069306af840ea1880aa83a2bfdf2a5b0f4f421205e8023d556554a83f64540
Instruction Fuzzy Hash: 5C31B7B15093845FE711CB25DC45B56BFF8EF06314F0884AAE984CF692D375E909C762

Uniqueness

Uniqueness Score: -1.00%

Function 00EFA361 Relevance: 1.6, APIs: 1, Instructions: 85
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,26E409AD,00000000,00000000,00000000,00000000), ref: 00EFA40C

Memory Dump Source

Source File: 00000000.00000002.1748675180.0000000000EFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EFA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_efa000_YKTNuK117e.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 60c495bf4ff542b13985431e2d4091b4a61997c34bfa73398d0b385ff033cfc1
Instruction ID: f2c90d96b9f19df980e25f0958a79f55e6c576b4b353233524065cbf8298f889
Opcode Fuzzy Hash: 60c495bf4ff542b13985431e2d4091b4a61997c34bfa73398d0b385ff033cfc1
Instruction Fuzzy Hash: 8431B4B15053845FD721CF15CC84FA6BBF8EF05714F0884AAE945DB652D364E909CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00EFA462 Relevance: 1.6, APIs: 1, Instructions: 77
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegSetValueExW.KERNELBASE(?,00000E24,26E409AD,00000000,00000000,00000000,00000000), ref: 00EFA4F8

Memory Dump Source

Source File: 00000000.00000002.1748675180.0000000000EFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EFA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_efa000_YKTNuK117e.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 9e7f8455095d5845d157619e6fb1927abdb1976ca5af7df5045f5fcd54dae09d
Instruction ID: c636e9b0fdff210a530f57655bdfe32f1695a9a0c835d1a79f2fd9c0dae6dc07
Opcode Fuzzy Hash: 9e7f8455095d5845d157619e6fb1927abdb1976ca5af7df5045f5fcd54dae09d
Instruction Fuzzy Hash: 1921C4B25043846FD7228F51DC44FA7BFF8DF46714F08849AE985DB652C264E809C772

Uniqueness

Uniqueness Score: -1.00%

Function 00EFA986 Relevance: 1.6, APIs: 1, Instructions: 76
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 00EFAA05

Memory Dump Source

Source File: 00000000.00000002.1748675180.0000000000EFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EFA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_efa000_YKTNuK117e.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 1ffccda2bb54d08eb577ba7a4e850431b772f29277071c8a2234583690dbcaa7
Instruction ID: c0e0510da8dae60cb9b8735b92950a511f57923699bac5514c5db83db2477c43
Opcode Fuzzy Hash: 1ffccda2bb54d08eb577ba7a4e850431b772f29277071c8a2234583690dbcaa7
Instruction Fuzzy Hash: 6321B571500244AFE721DF65DD45BA6FBE8EF04314F08887DEA499B651D375E408CB72

Uniqueness

Uniqueness Score: -1.00%

Function 00EFAA5C Relevance: 1.6, APIs: 1, Instructions: 75
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNELBASE(?,00000E24,26E409AD,00000000,00000000,00000000,00000000), ref: 00EFAAF1

Memory Dump Source

Source File: 00000000.00000002.1748675180.0000000000EFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EFA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_efa000_YKTNuK117e.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 8d18c756bb16710e86741a6f5c992b7978f50cd1f515f9e1f3110d899f97f2d5
Instruction ID: 20a65538e7aca8db619e85cc4fed4aa9e68a7175534aac50a39159f59b0774b5
Opcode Fuzzy Hash: 8d18c756bb16710e86741a6f5c992b7978f50cd1f515f9e1f3110d899f97f2d5
Instruction Fuzzy Hash: F92129B55087806FE7228B25DC44BA3BFBCEF46724F0884DAE9858B653D264A909C771

Uniqueness

Uniqueness Score: -1.00%

Function 00EFA646 Relevance: 1.6, APIs: 1, Instructions: 72
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexW.KERNELBASE(?,?), ref: 00EFA6B9

Memory Dump Source

Source File: 00000000.00000002.1748675180.0000000000EFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EFA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_efa000_YKTNuK117e.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: 7d3f183236d9e81b21727aaf8ace6d8b005cb78f7056a3b8fac9a05230d41274
Instruction ID: 246aac822600af788ef5e5a587dc746d3ae1eb0e3993b4e9f7964a45f0c74340
Opcode Fuzzy Hash: 7d3f183236d9e81b21727aaf8ace6d8b005cb78f7056a3b8fac9a05230d41274
Instruction Fuzzy Hash: F721A1B16002449FE720DF25DD45BA6FBE8EF04314F08C87AEA49DF641D775E905CA62

Uniqueness

Uniqueness Score: -1.00%

Function 00EFAC0E Relevance: 1.6, APIs: 1, Instructions: 70
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,00000E24,26E409AD,00000000,00000000,00000000,00000000), ref: 00EFAC8D

Memory Dump Source

Source File: 00000000.00000002.1748675180.0000000000EFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EFA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_efa000_YKTNuK117e.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 26b3bcea7d31e94c1a864c64b3f80a35625b488fabd07c403b75954ce0694ce5
Instruction ID: 8e4905465b8d50f5a5688d1f171023ee3d58aa6744a613acf2500b9dbd76901f
Opcode Fuzzy Hash: 26b3bcea7d31e94c1a864c64b3f80a35625b488fabd07c403b75954ce0694ce5
Instruction Fuzzy Hash: 8921F671405380AFD722CF55DD44FA7FFB8EF45314F0888AAE9459B652C235A909CB72

Uniqueness

Uniqueness Score: -1.00%

Function 00EFA392 Relevance: 1.6, APIs: 1, Instructions: 69
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,26E409AD,00000000,00000000,00000000,00000000), ref: 00EFA40C

Memory Dump Source

Source File: 00000000.00000002.1748675180.0000000000EFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EFA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_efa000_YKTNuK117e.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 4a1bf0ffc0a58d1a9aca7e9639e222c61bc31bee8b81e275145c51a4f54d4d7d
Instruction ID: 06ed4f55e1a6225b81c187819ffadbeed7dcdcd43bca476d6094d7098fabab06
Opcode Fuzzy Hash: 4a1bf0ffc0a58d1a9aca7e9639e222c61bc31bee8b81e275145c51a4f54d4d7d
Instruction Fuzzy Hash: 58216DB56002089FE721CE15CD84FA6B7E8EF04714F08C46AEA599BA51D764E909CA72

Uniqueness

Uniqueness Score: -1.00%

Function 00EFA710 Relevance: 1.6, APIs: 1, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 00EFA780

Memory Dump Source

Source File: 00000000.00000002.1748675180.0000000000EFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EFA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_efa000_YKTNuK117e.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 53a80b7102ef66b670c79939d0b28f61ac9b3d61400f1b559a68ccbc920e590c
Instruction ID: 29d96ca5b0930d6ebf2698a6072d97305b45bb37d827d2e3134829a3760ca294
Opcode Fuzzy Hash: 53a80b7102ef66b670c79939d0b28f61ac9b3d61400f1b559a68ccbc920e590c
Instruction Fuzzy Hash: 5B2105B55093809FD7128F25DD85B52BFB4EF02324F0984EBDD858F693D235A905CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00EFA486 Relevance: 1.6, APIs: 1, Instructions: 65
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegSetValueExW.KERNELBASE(?,00000E24,26E409AD,00000000,00000000,00000000,00000000), ref: 00EFA4F8

Memory Dump Source

Source File: 00000000.00000002.1748675180.0000000000EFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EFA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_efa000_YKTNuK117e.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 47ef4bc5716392e92c92017e37fd851c3847b676baa875db2b192c407f8cf812
Instruction ID: e62074d0e60608576ef03a1e46f1f348041115726efb143ce79b81528c2b66dc
Opcode Fuzzy Hash: 47ef4bc5716392e92c92017e37fd851c3847b676baa875db2b192c407f8cf812
Instruction Fuzzy Hash: 8C11B1B6500304AFE7318E15DD45FA7BBECEF04714F08846AEE499AA41D774E809CA72

Uniqueness

Uniqueness Score: -1.00%

Function 00EFA2D2 Relevance: 1.6, APIs: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(?), ref: 00EFA330

Memory Dump Source

Source File: 00000000.00000002.1748675180.0000000000EFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EFA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_efa000_YKTNuK117e.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: e61d5d4e479aa1c00ff8ddec0b6bd12dd62832de88287c7a04af8a7c215b104a
Instruction ID: 84f5fef48bffac17c453343d09eff9d5c84cf9efe7c0245e71f60bd33ba2a741
Opcode Fuzzy Hash: e61d5d4e479aa1c00ff8ddec0b6bd12dd62832de88287c7a04af8a7c215b104a
Instruction Fuzzy Hash: 39217F7140E3C45FD7138B25DC54A62BFB49F07224F0D80DBDD848F2A3C269A808DB62

Uniqueness

Uniqueness Score: -1.00%

Function 00EFAC2E Relevance: 1.6, APIs: 1, Instructions: 60
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,00000E24,26E409AD,00000000,00000000,00000000,00000000), ref: 00EFAC8D

Memory Dump Source

Source File: 00000000.00000002.1748675180.0000000000EFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EFA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_efa000_YKTNuK117e.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: b21c43c921531341e974ecbd4cda5dc7f88acdad641f518434b2755d9fa2d2b0
Instruction ID: eec0580f55beb0d8ad314936c463ec32845d4ce12f0d88a645c937783c829aad
Opcode Fuzzy Hash: b21c43c921531341e974ecbd4cda5dc7f88acdad641f518434b2755d9fa2d2b0
Instruction Fuzzy Hash: 7811E271500204AFEB218F55DD44FA6FBA8EF04714F08886AEA499AA41C375A5098BB2

Uniqueness

Uniqueness Score: -1.00%

Function 00EFAE30 Relevance: 1.6, APIs: 1, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShellExecuteExW.SHELL32(?), ref: 00EFAE8C

Memory Dump Source

Source File: 00000000.00000002.1748675180.0000000000EFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EFA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_efa000_YKTNuK117e.jbxd

Similarity

API ID: ExecuteShell
String ID:
API String ID: 587946157-0
Opcode ID: 3ed4d720e8f8c1e77ebe6a38e609d7f343271f1c66b559dd59d6a3a02d9724eb
Instruction ID: e3287530cbfff9dde9477e894e088f4104239b546292e524fd64b3f0a6c26241
Opcode Fuzzy Hash: 3ed4d720e8f8c1e77ebe6a38e609d7f343271f1c66b559dd59d6a3a02d9724eb
Instruction Fuzzy Hash: D61190715093849FD712CF25DC84B62BFB89F46224F0884EAED89CF652D274E948CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00EFAA9E Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNELBASE(?,00000E24,26E409AD,00000000,00000000,00000000,00000000), ref: 00EFAAF1

Memory Dump Source

Source File: 00000000.00000002.1748675180.0000000000EFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EFA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_efa000_YKTNuK117e.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: ffa31bedf2622e8deee4933cd7b7b2bb8e11dae840ce2162756777d06cdcd2fa
Instruction ID: 53e7f5f28712d1c2356a889dc6ebd9020f4c498eaa056700e9200fa0dbb42a59
Opcode Fuzzy Hash: ffa31bedf2622e8deee4933cd7b7b2bb8e11dae840ce2162756777d06cdcd2fa
Instruction Fuzzy Hash: 7A010471500204AEE7208B15DD84BB6B7A8DF44724F08C4B6EE089FA41D678A808CAA2

Uniqueness

Uniqueness Score: -1.00%

Function 00EFAE52 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 00EFAE8C

Memory Dump Source

Source File: 00000000.00000002.1748675180.0000000000EFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EFA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_efa000_YKTNuK117e.jbxd

Similarity

API ID: ExecuteShell
String ID:
API String ID: 587946157-0
Opcode ID: dbd9f1c2ead51ba23b4d8f8c605be12e29d975d898e29dc304d659f12c3f99d9
Instruction ID: eaf1e7d6c4090516b2dcde9d767ff469192dee6b115466bfc81eaeca9c60f2c0
Opcode Fuzzy Hash: dbd9f1c2ead51ba23b4d8f8c605be12e29d975d898e29dc304d659f12c3f99d9
Instruction Fuzzy Hash: 600180716002448FEB20CF29D9847A6BBE8DF44724F0CC4BADE49DFA45D679E944CA62

Uniqueness

Uniqueness Score: -1.00%

Function 00EFA74E Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 00EFA780

Memory Dump Source

Source File: 00000000.00000002.1748675180.0000000000EFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EFA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_efa000_YKTNuK117e.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 26466606b972c698f43229d92ff184066f2f5cea761542e19c665fa6ed7216bf
Instruction ID: 70719a97bb512e939a92a419b5dddd83bc0d747d973b6ea12b38094967256667
Opcode Fuzzy Hash: 26466606b972c698f43229d92ff184066f2f5cea761542e19c665fa6ed7216bf
Instruction Fuzzy Hash: 1A01B1B59002448FEB209F15D984BA6FBA4DF04324F08C4BBDD499FA86D679E404CAA2

Uniqueness

Uniqueness Score: -1.00%

Function 00EFA2FE Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(?), ref: 00EFA330

Memory Dump Source

Source File: 00000000.00000002.1748675180.0000000000EFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EFA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_efa000_YKTNuK117e.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: f54f6d2ddda7eb4322392ca87cfe95301d1d6ca37127c04c067f8bb5fffb20d4
Instruction ID: 870389390da0091c056450d7b167e5b3b885b1dfcb2a8414ad7193977bc5f8fa
Opcode Fuzzy Hash: f54f6d2ddda7eb4322392ca87cfe95301d1d6ca37127c04c067f8bb5fffb20d4
Instruction Fuzzy Hash: 40F08C759052448FDB209F09D9847A5FBE0EF04724F0CC4AADE495FB52D2B9A808CAA2

Uniqueness

Uniqueness Score: -1.00%

Function 04DB0278 Relevance: .5, Instructions: 523COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1749044875.0000000004DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4db0000_YKTNuK117e.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9019144269996555b6beb138ca6d6c5ea736e35b34a0c6de117b4c538b93a225
Instruction ID: ffc30a706e03867bd28850a0ebec6632a330a9d60db331f0894295ae1724bb78
Opcode Fuzzy Hash: 9019144269996555b6beb138ca6d6c5ea736e35b34a0c6de117b4c538b93a225
Instruction Fuzzy Hash: 44324830A01218CFDB24EF75D854BADB7B2BF48304F1084A9D44AAB3A5DB35AD85CF91

Uniqueness

Uniqueness Score: -1.00%

Function 04DB0BD0 Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1749044875.0000000004DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4db0000_YKTNuK117e.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06124f87966def5ab79ef6971af3f212ff7a1936cfc3bbbb9b2140f633408fc0
Instruction ID: d1fca52572cc24c6620a9edd277f3edcd881280d781c999b0628c4d09dcf62f1
Opcode Fuzzy Hash: 06124f87966def5ab79ef6971af3f212ff7a1936cfc3bbbb9b2140f633408fc0
Instruction Fuzzy Hash: 56D11534A01218CFDB24EF75D891BADB7B2BF88304F1045A9D80AA7395DB35AD85CF91

Uniqueness

Uniqueness Score: -1.00%

Function 04DB0268 Relevance: .2, Instructions: 192COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1749044875.0000000004DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4db0000_YKTNuK117e.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 374663f7eeb7d17b05770f724d0468cce310eb8fb8af2d21f278d45c421a94bc
Instruction ID: 10a57b8810d25de3e637de65acb5087dd3d10c95c1bef531aa516cbdb9623d61
Opcode Fuzzy Hash: 374663f7eeb7d17b05770f724d0468cce310eb8fb8af2d21f278d45c421a94bc
Instruction Fuzzy Hash: 8F815930A01218CFDB24EF75C844BADB7B2BF49305F1084A9D44AAB391DB399E85CF91

Uniqueness

Uniqueness Score: -1.00%

Function 04DB0392 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1749044875.0000000004DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4db0000_YKTNuK117e.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f82adc6424d73020bf065bf16674185d20b5ca0f9282db042da4b99e878336f8
Instruction ID: 6ddca9c9ca605ada3f9a9aa7cf5f83592b8febc73d2f22d9013be7aee52191b3
Opcode Fuzzy Hash: f82adc6424d73020bf065bf16674185d20b5ca0f9282db042da4b99e878336f8
Instruction Fuzzy Hash: 5B612830A01218CFDB24EF75C944BADB7B2BF44308F1084A9D14AAB295DB799E85DF91

Uniqueness

Uniqueness Score: -1.00%

Function 04DB0429 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1749044875.0000000004DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4db0000_YKTNuK117e.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5cb9ea97fab0ee63268181f7f751f352dc28125ed62778013276023c73d2fd9
Instruction ID: 677d05837567d797d7a9d5995425e93715b6a7dcb7bae3fbb3798ad55d8add10
Opcode Fuzzy Hash: d5cb9ea97fab0ee63268181f7f751f352dc28125ed62778013276023c73d2fd9
Instruction Fuzzy Hash: 40512830A01218CFDB64EF75C940BADB7B2AF45304F5084A9D14AAB391DB399E89DF91

Uniqueness

Uniqueness Score: -1.00%

Function 04DB0080 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1749044875.0000000004DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4db0000_YKTNuK117e.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09ff2e8143a30f4c4f56c9f545b6197e3a510f07ac215f30931c596d2edc43a9
Instruction ID: bc5a546d12b6b6a49643384e20a4e145f5c6f81109e0c9eca81a2214ccc7ccca
Opcode Fuzzy Hash: 09ff2e8143a30f4c4f56c9f545b6197e3a510f07ac215f30931c596d2edc43a9
Instruction Fuzzy Hash: 94413430106646CFC724FF3AE981A8977F6AF9024D704883DD104CB66EDB385D49DB82

Uniqueness

Uniqueness Score: -1.00%

Function 04DB0007 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1749044875.0000000004DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4db0000_YKTNuK117e.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 653418b70eecb55ac48dbd17abc6d26308c7f886c6600a410aff7381e149f260
Instruction ID: 35ccc42d0f39b34028810e4431ca9bf70bfb5d2f2dfd6007ee5228f54406bcb1
Opcode Fuzzy Hash: 653418b70eecb55ac48dbd17abc6d26308c7f886c6600a410aff7381e149f260
Instruction Fuzzy Hash: 7901369659F7C01FD30312701CB56953F74AA53106B5E41CBC8C0CB0E3A50D5A1FA332

Uniqueness

Uniqueness Score: -1.00%

Function 010705E1 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1748837354.0000000001070000.00000040.00000020.00020000.00000000.sdmp, Offset: 01070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1070000_YKTNuK117e.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9dc6432238e7a188080eac0936d97c1feb6cd90b69a09fb7dd29cbc27b711bd4
Instruction ID: d5d5bf73fbc0dad7edac06e49a4b53ebf42823fd45be2f5d6820c07f7420d88e
Opcode Fuzzy Hash: 9dc6432238e7a188080eac0936d97c1feb6cd90b69a09fb7dd29cbc27b711bd4
Instruction Fuzzy Hash: AE0186B65097805FD7118B05EC40862FFE8EF86620709C4AFE9498BA12D225A909CBB2

Uniqueness

Uniqueness Score: -1.00%

Function 01070606 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1748837354.0000000001070000.00000040.00000020.00020000.00000000.sdmp, Offset: 01070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1070000_YKTNuK117e.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4834e27daf2d0c46753a53b66b9a81d1d8a5daceeac7cc6329d391420ed5f5d
Instruction ID: 65242882a6fc202959b9c9254d7bd404a884f8dd3ea5f847b9a76f3e63bee343
Opcode Fuzzy Hash: f4834e27daf2d0c46753a53b66b9a81d1d8a5daceeac7cc6329d391420ed5f5d
Instruction Fuzzy Hash: FBE092B6A006404BD650DF0AFD81452F7D8EB88630708C47FDC0D8BB11D276B509CEA6

Uniqueness

Uniqueness Score: -1.00%

Function 00EF23F4 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1748663884.0000000000EF2000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EF2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef2000_YKTNuK117e.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8782e5d579a877e392218bed73115e739092edfc357638f6131194ff4412592d
Instruction ID: a774835cdf9dc99bec3dbae96f81ab2d4ad67043c932ed0b5feb12624e6d6365
Opcode Fuzzy Hash: 8782e5d579a877e392218bed73115e739092edfc357638f6131194ff4412592d
Instruction Fuzzy Hash: 74D02E79200AC04FD3238A0CC2A4BA537D4AB40708F0A04FEA800CB763C7A8D980E200

Uniqueness

Uniqueness Score: -1.00%

Function 00EF23BC Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1748663884.0000000000EF2000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EF2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef2000_YKTNuK117e.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05b41370e8d6a38b5e44d753c423e6c0080fdba72e824027b6a825d8302edc28
Instruction ID: 68af568591e1c001fb2b678a75d3ea8a48343f92dd264341abece850ee03cea7
Opcode Fuzzy Hash: 05b41370e8d6a38b5e44d753c423e6c0080fdba72e824027b6a825d8302edc28
Instruction Fuzzy Hash: 17D05E742016864BC725DE0CC6D4F6977D4AB40718F0644ECAD109B762C7B8D8C4DA00

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00EF268E Relevance: .4, Instructions: 430COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1748663884.0000000000EF2000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EF2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef2000_YKTNuK117e.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0317c3f0e4ea66a61d0c7a994c95ba1455f35460a6b3cde5cc91617376edcd65
Instruction ID: 3fb8fdfcd1999ab7395fd88dd789e3f926f5ec0112244f779619b9529413e330
Opcode Fuzzy Hash: 0317c3f0e4ea66a61d0c7a994c95ba1455f35460a6b3cde5cc91617376edcd65
Instruction Fuzzy Hash: 8402656140E7C15FD71B9B3089A6455BFB4AE9321470E9ACFC9C08F1B7D3698A09C762

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: WindowsServices.exePID: 7440, Parent PID: 7344COMMON

Execution Graph

Execution Coverage:	18.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	6.2%
Total number of Nodes:	112
Total number of Limit Nodes:	6

Executed Functions

Function 009FB83F Relevance: 1.6, APIs: 1, Instructions: 75COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.KERNELBASE(?,?,?,?,?,?), ref: 009FB8BF

Memory Dump Source

Source File: 00000001.00000002.4153788955.00000000009FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 009FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9fa000_WindowsServices.jbxd

Similarity

API ID: AdjustPrivilegesToken
String ID:
API String ID: 2874748243-0
Opcode ID: 713cdd6b2ec59d15435dd6d6865abaf6a579b31d7e5e3d2d4543b1aa8c4c91b5
Instruction ID: 762762833fc2fb24c751f0058b02b4cfdc691de011580be316ce7106f7d7ac67
Opcode Fuzzy Hash: 713cdd6b2ec59d15435dd6d6865abaf6a579b31d7e5e3d2d4543b1aa8c4c91b5
Instruction Fuzzy Hash: AC21D1755093849FEB228F25DC44B62BFF8EF16310F0884DAE9858B563D371A918DB62

Uniqueness

Uniqueness Score: -1.00%

Function 01051B0B Relevance: 1.6, APIs: 1, Instructions: 64nativeCOMMON

Download Yara Rule

APIs

NtQuerySystemInformation.NTDLL ref: 01051B81

Memory Dump Source

Source File: 00000001.00000002.4155681187.0000000001050000.00000040.00000800.00020000.00000000.sdmp, Offset: 01050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1050000_WindowsServices.jbxd

Similarity

API ID: InformationQuerySystem
String ID:
API String ID: 3562636166-0
Opcode ID: b6533f1ec4f611ac1e7d84a8bda7eea6782fc90d333e1b14a2a0d1b41b5a5532
Instruction ID: 4d220b4d80820efab3fb10b9868781d355c322db4a82d0cb56d7289a07f21b69
Opcode Fuzzy Hash: b6533f1ec4f611ac1e7d84a8bda7eea6782fc90d333e1b14a2a0d1b41b5a5532
Instruction Fuzzy Hash: 0921DE754093C0AFDB238B21DC41A52FFB0EF16314F0984CBE9844B5A3E275A909CB62

Uniqueness

Uniqueness Score: -1.00%

Function 009FB876 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.KERNELBASE(?,?,?,?,?,?), ref: 009FB8BF

Memory Dump Source

Source File: 00000001.00000002.4153788955.00000000009FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 009FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9fa000_WindowsServices.jbxd

Similarity

API ID: AdjustPrivilegesToken
String ID:
API String ID: 2874748243-0
Opcode ID: ea122147762b5cc755f3ef8386a80b59aff99247e452c16ecb388786d82307f7
Instruction ID: 77a4d23cc920a2f2fd849c09a664cb4a43a1a9316c1e4a98f50c12bf8cd800f3
Opcode Fuzzy Hash: ea122147762b5cc755f3ef8386a80b59aff99247e452c16ecb388786d82307f7
Instruction Fuzzy Hash: 091186755003449FEB20CF55D944B66FBE8EF44320F08C86ADE458BA51D775E414DF61

Uniqueness

Uniqueness Score: -1.00%

Function 009FBBA4 Relevance: 1.6, APIs: 1, Instructions: 50nativeCOMMON

Download Yara Rule

APIs

NtSetInformationProcess.NTDLL ref: 009FBC01

Memory Dump Source

Source File: 00000001.00000002.4153788955.00000000009FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 009FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9fa000_WindowsServices.jbxd

Similarity

API ID: InformationProcess
String ID:
API String ID: 1801817001-0
Opcode ID: 3021e29e0c49b709ae81db787f3590d2acb210fe83ec09a24eb1e9eb8e91e390
Instruction ID: 1f6b423f3b8850dccfd7c0f6ed45481947c551dd81d39ac3c592bdf32ce6e9e8
Opcode Fuzzy Hash: 3021e29e0c49b709ae81db787f3590d2acb210fe83ec09a24eb1e9eb8e91e390
Instruction Fuzzy Hash: D111C271409384AFDB228F15DC44E62FFB4EF16320F09C49EEE854B663D275A918CB62

Uniqueness

Uniqueness Score: -1.00%

Function 009FBBC6 Relevance: 1.5, APIs: 1, Instructions: 38nativeCOMMON

Download Yara Rule

APIs

NtSetInformationProcess.NTDLL ref: 009FBC01

Memory Dump Source

Source File: 00000001.00000002.4153788955.00000000009FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 009FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9fa000_WindowsServices.jbxd

Similarity

API ID: InformationProcess
String ID:
API String ID: 1801817001-0
Opcode ID: 7cb9ac9e86171da4861c93aa3dd8c1bd47937c435fa3edcd0f3c93615a22b567
Instruction ID: 6876e3f1641bec1f675f1cc0152ec45f34245f8472347d6369a9d426a7c19987
Opcode Fuzzy Hash: 7cb9ac9e86171da4861c93aa3dd8c1bd47937c435fa3edcd0f3c93615a22b567
Instruction Fuzzy Hash: 4201A2755002089FDB208F19D984B66FBE4EF14720F08C8AADE850BA52D779E458DF72

Uniqueness

Uniqueness Score: -1.00%

Function 01051B46 Relevance: 1.5, APIs: 1, Instructions: 38nativeCOMMON

Download Yara Rule

APIs

NtQuerySystemInformation.NTDLL ref: 01051B81

Memory Dump Source

Source File: 00000001.00000002.4155681187.0000000001050000.00000040.00000800.00020000.00000000.sdmp, Offset: 01050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1050000_WindowsServices.jbxd

Similarity

API ID: InformationQuerySystem
String ID:
API String ID: 3562636166-0
Opcode ID: 12926ebc99e6c37c154a870410277502e9ab81a8f00ee9bbc45ecc528078cc66
Instruction ID: bd0d9871ca9b3527de9774c1eb7d2f84a5e97e3a4fc7744898c8abbda87a18b5
Opcode Fuzzy Hash: 12926ebc99e6c37c154a870410277502e9ab81a8f00ee9bbc45ecc528078cc66
Instruction Fuzzy Hash: 5B01A2358002049FEB618F19D984B66FBF0EF44720F08C4AADD850BA52E375E418CF62

Uniqueness

Uniqueness Score: -1.00%

Function 01052D75 Relevance: 1.6, APIs: 1, Instructions: 102
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCreateKeyExW.KERNELBASE(?,00000E24), ref: 01052E41

Memory Dump Source

Source File: 00000001.00000002.4155681187.0000000001050000.00000040.00000800.00020000.00000000.sdmp, Offset: 01050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1050000_WindowsServices.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: f4d681ea1585d0b379993652329824c66da8bfccd62c530ea40aa956cd01b93a
Instruction ID: f260290e3dd703ba04190bbbf277fb24e2d6dcb9de13be9f5ab49e3bad79792a
Opcode Fuzzy Hash: f4d681ea1585d0b379993652329824c66da8bfccd62c530ea40aa956cd01b93a
Instruction Fuzzy Hash: DC31AF72504344AFE7228F65CC44FA7BBFCEF15310F08899AE985CB662D324E909CB61

Uniqueness

Uniqueness Score: -1.00%

Function 01051D2C Relevance: 1.6, APIs: 1, Instructions: 99
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVolumeInformationA.KERNELBASE(?,00000E24,?,?), ref: 01051E06

Memory Dump Source

Source File: 00000001.00000002.4155681187.0000000001050000.00000040.00000800.00020000.00000000.sdmp, Offset: 01050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1050000_WindowsServices.jbxd

Similarity

API ID: InformationVolume
String ID:
API String ID: 2039140958-0
Opcode ID: 69ceff3a56d410a29c2f6a57ce74f62b11388f83e331a2dd18f6851f52fc4b5c
Instruction ID: 84aefd1286dbad5278f7cc5bed3163bf37008d691314e75f7eb20df1134b326e
Opcode Fuzzy Hash: 69ceff3a56d410a29c2f6a57ce74f62b11388f83e331a2dd18f6851f52fc4b5c
Instruction Fuzzy Hash: 17316B7150E3C05FD3138B358C65A61BFB8AF47210B0E85DBD884CF5A3D629A949C7B2

Uniqueness

Uniqueness Score: -1.00%

Function 010509D7 Relevance: 1.6, APIs: 1, Instructions: 98
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,?,?), ref: 01050A9E

Memory Dump Source

Source File: 00000001.00000002.4155681187.0000000001050000.00000040.00000800.00020000.00000000.sdmp, Offset: 01050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1050000_WindowsServices.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: c9e793bf354b57836f91ce19802c24222722fcec45a665811cd8d3cb6026cdfa
Instruction ID: 3b0f9c1d5dadaf582ac2875c1b2040928af5df379608a8fa0391775ad2a9ed01
Opcode Fuzzy Hash: c9e793bf354b57836f91ce19802c24222722fcec45a665811cd8d3cb6026cdfa
Instruction Fuzzy Hash: 66318D6510E3C06FD3138B258C61A62BFB4EF47610F0E45DBE8C48B6A3D2296909C7B2

Uniqueness

Uniqueness Score: -1.00%

Function 009FA612 Relevance: 1.6, APIs: 1, Instructions: 89
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexW.KERNELBASE(?,?), ref: 009FA6B9

Memory Dump Source

Source File: 00000001.00000002.4153788955.00000000009FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 009FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9fa000_WindowsServices.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: 3aecdd8747aa5ab56a0863f243a03e97c04c4c598a864828c90100201c3915a6
Instruction ID: 8e574fec3cd18a11c194a1af61108037951df2bd3ad931e26543da062a201b5b
Opcode Fuzzy Hash: 3aecdd8747aa5ab56a0863f243a03e97c04c4c598a864828c90100201c3915a6
Instruction Fuzzy Hash: 5131B3B15093845FE722CB25DC45B96BFF8EF06310F08889AE984CB292D375A909C762

Uniqueness

Uniqueness Score: -1.00%

Function 01050EF0 Relevance: 1.6, APIs: 1, Instructions: 89
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(?,00000E24), ref: 01050F87

Memory Dump Source

Source File: 00000001.00000002.4155681187.0000000001050000.00000040.00000800.00020000.00000000.sdmp, Offset: 01050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1050000_WindowsServices.jbxd

Similarity

API ID: DescriptorSecurity$ConvertString
String ID:
API String ID: 3907675253-0
Opcode ID: 571d1212b98daa7a0f26f4f606512de357ee84fe75374a2410e53ade8f4a7582
Instruction ID: 04d37eaeb739952d969779395d9aec9d6cd7bc0b0a6949d9226eeca9a1e2b2e5
Opcode Fuzzy Hash: 571d1212b98daa7a0f26f4f606512de357ee84fe75374a2410e53ade8f4a7582
Instruction Fuzzy Hash: D1318472504344AFE721CB65DC45FA7BBE8EF05310F0884AAF984DBA52D274E909CB61

Uniqueness

Uniqueness Score: -1.00%

Function 010514FC Relevance: 1.6, APIs: 1, Instructions: 89
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessTimes.KERNELBASE(?,00000E24,60660510,00000000,00000000,00000000,00000000), ref: 01051599

Memory Dump Source

Source File: 00000001.00000002.4155681187.0000000001050000.00000040.00000800.00020000.00000000.sdmp, Offset: 01050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1050000_WindowsServices.jbxd

Similarity

API ID: ProcessTimes
String ID:
API String ID: 1995159646-0
Opcode ID: 95aff226ad10451728c09e89bd9f9c9427df50c7af98dd42844f56d689ae71c1
Instruction ID: 10ac94b4b572a076b7857227d267b0fa11deef9dd314eafb135e45eaf7705997
Opcode Fuzzy Hash: 95aff226ad10451728c09e89bd9f9c9427df50c7af98dd42844f56d689ae71c1
Instruction Fuzzy Hash: 8431F9725053805FE7228F55DC45B97BFB8EF06314F0884EAE985CB553D2359905C771

Uniqueness

Uniqueness Score: -1.00%

Function 009FA8A4 Relevance: 1.6, APIs: 1, Instructions: 87
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(?,00000E24), ref: 009FA945

Memory Dump Source

Source File: 00000001.00000002.4153788955.00000000009FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 009FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9fa000_WindowsServices.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: e8adfb217e7880da97b2a4d089a9c769df8ff05179e45d37d4e48deeab39cf2e
Instruction ID: 81cf0eb35eb6580be509858ee1b497283fe363a6fe102f77a862440fc7ef5f62
Opcode Fuzzy Hash: e8adfb217e7880da97b2a4d089a9c769df8ff05179e45d37d4e48deeab39cf2e
Instruction Fuzzy Hash: AC21B4B2404344AFE7218B55CC44FA7BFFCEF15720F0488AAE9858B652D264E909CB71

Uniqueness

Uniqueness Score: -1.00%

Function 009FA98D Relevance: 1.6, APIs: 1, Instructions: 86
windowtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SendMessageTimeoutA.USER32(?,00000E24), ref: 009FAA49

Memory Dump Source

Source File: 00000001.00000002.4153788955.00000000009FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 009FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9fa000_WindowsServices.jbxd

Similarity

API ID: MessageSendTimeout
String ID:
API String ID: 1599653421-0
Opcode ID: a23ae6f39104ae4fce572ac836824c13e6f27385fea57af4ceeea306bee92c1f
Instruction ID: 48850664cde894ca6427ac36f1c95c85677ae0f2633d95cd03d8585827be5202
Opcode Fuzzy Hash: a23ae6f39104ae4fce572ac836824c13e6f27385fea57af4ceeea306bee92c1f
Instruction Fuzzy Hash: C531E8710053846FEB228F60CC45FA2FFB8EF06324F08889EE9858B553D275A90DCB61

Uniqueness

Uniqueness Score: -1.00%

Function 009FAEC5 Relevance: 1.6, APIs: 1, Instructions: 86
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 009FAF69

Memory Dump Source

Source File: 00000001.00000002.4153788955.00000000009FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 009FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9fa000_WindowsServices.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: fb92bdaa2073cea5ae00eb83be6e855d742bfdf1ede629152041d0b27c52ea21
Instruction ID: fc7f45d04d7342890713d7a7a93441e0d3229f0a43b7c910e3cc7853875ee52b
Opcode Fuzzy Hash: fb92bdaa2073cea5ae00eb83be6e855d742bfdf1ede629152041d0b27c52ea21
Instruction Fuzzy Hash: 00317EB1504344AFE721CF65DD85F62FBF8EF05310F0888AAE9898B652D375E908CB61

Uniqueness

Uniqueness Score: -1.00%

Function 01052DA6 Relevance: 1.6, APIs: 1, Instructions: 86
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCreateKeyExW.KERNELBASE(?,00000E24), ref: 01052E41

Memory Dump Source

Source File: 00000001.00000002.4155681187.0000000001050000.00000040.00000800.00020000.00000000.sdmp, Offset: 01050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1050000_WindowsServices.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 6b6e20bc154dfdb0987e7585fc08d7fc2ca2da94fe82afa49e9e53a4be76aa0e
Instruction ID: 3165dea474060ca9c44e0ca8e85879c474fb3765f4b1baacce6d25e6e527adfe
Opcode Fuzzy Hash: 6b6e20bc154dfdb0987e7585fc08d7fc2ca2da94fe82afa49e9e53a4be76aa0e
Instruction Fuzzy Hash: 4F218D72500204AEE771CE59CD44FABBBECEF18714F04886AE985C6A52D734E9098A61

Uniqueness

Uniqueness Score: -1.00%

Function 009FBAAC Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

GetExitCodeProcess.KERNELBASE(?,00000E24,60660510,00000000,00000000,00000000,00000000), ref: 009FBB40

Memory Dump Source

Source File: 00000001.00000002.4153788955.00000000009FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 009FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9fa000_WindowsServices.jbxd

Similarity

API ID: CodeExitProcess
String ID:
API String ID: 3861947596-0
Opcode ID: 1c36b2e6555a8eed35e5fdf488df000080db237ef8c649017a473e00f7d5575e
Instruction ID: e46ab6cc0db5384df31308274ed212ffaef5adf10b92c2aeace21eee733bfd06
Opcode Fuzzy Hash: 1c36b2e6555a8eed35e5fdf488df000080db237ef8c649017a473e00f7d5575e
Instruction Fuzzy Hash: 712105B15093805FE7128F25DC45BA6BFB8EF06324F0884EBE944CF193D274A909CB61

Uniqueness

Uniqueness Score: -1.00%

Function 009FA361 Relevance: 1.6, APIs: 1, Instructions: 85
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,60660510,00000000,00000000,00000000,00000000), ref: 009FA40C

Memory Dump Source

Source File: 00000001.00000002.4153788955.00000000009FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 009FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9fa000_WindowsServices.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 7a361d543da0006bbeea206be1766cb2ea54a5ee3727d7f2194b7d9a3061e9c7
Instruction ID: f5b00255010376057710f4aac0bc4af881c3a3bd0e0aa96381a654138feab2d9
Opcode Fuzzy Hash: 7a361d543da0006bbeea206be1766cb2ea54a5ee3727d7f2194b7d9a3061e9c7
Instruction Fuzzy Hash: 963161B5505744AFE722CF15CC84FA6BBFCEF06710F08849AE945CB692D364E909CB62

Uniqueness

Uniqueness Score: -1.00%

Function 010530E8 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

GetProcessWorkingSetSize.KERNEL32(?,00000E24,60660510,00000000,00000000,00000000,00000000), ref: 0105317F

Memory Dump Source

Source File: 00000001.00000002.4155681187.0000000001050000.00000040.00000800.00020000.00000000.sdmp, Offset: 01050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1050000_WindowsServices.jbxd

Similarity

API ID: ProcessSizeWorking
String ID:
API String ID: 3584180929-0
Opcode ID: 58609dfbbd57e475d6432fe6c563d842db9bd3572d663c587dfcd732bf91d568
Instruction ID: 92cbad489a2565b4c717ced6a70dae3583f7c19d7e972706be8021c70d2ac0bb
Opcode Fuzzy Hash: 58609dfbbd57e475d6432fe6c563d842db9bd3572d663c587dfcd732bf91d568
Instruction Fuzzy Hash: 6721C3715093845FE713CB24CC55B96BFB8AF46314F08C4EAE9848F193D225A909CB65

Uniqueness

Uniqueness Score: -1.00%

Function 01053392 Relevance: 1.6, APIs: 1, Instructions: 83registryCOMMON

Download Yara Rule

APIs

RegEnumValueW.KERNELBASE(?,00000E24,?,?), ref: 0105343E

Memory Dump Source

Source File: 00000001.00000002.4155681187.0000000001050000.00000040.00000800.00020000.00000000.sdmp, Offset: 01050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1050000_WindowsServices.jbxd

Similarity

API ID: EnumValue
String ID:
API String ID: 2814608202-0
Opcode ID: 54b33957a918421f33668cd909e1189166d6667d04ff034b480bc5055ac18628
Instruction ID: b8a76bec8562072c538bb82bd1308cd77fcb44af5676b4252ab6d0ab31960b58
Opcode Fuzzy Hash: 54b33957a918421f33668cd909e1189166d6667d04ff034b480bc5055ac18628
Instruction Fuzzy Hash: 4A31736150D3C06FD3138B258C65A62BFB4DF87610F1984DBD8848B6A3D225A91AD7B2

Uniqueness

Uniqueness Score: -1.00%

Function 009FA120 Relevance: 1.6, APIs: 1, Instructions: 82COMMON

Download Yara Rule

APIs

EnumWindows.USER32(?,00000E24,?,?), ref: 009FA1BD

Memory Dump Source

Source File: 00000001.00000002.4153788955.00000000009FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 009FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9fa000_WindowsServices.jbxd

Similarity

API ID: EnumWindows
String ID:
API String ID: 1129996299-0
Opcode ID: 349e3cb05091053b50c40eef52560003db5db738f0cb63bed7569bc2a28c438b
Instruction ID: 9abb53e02b3ad65f498572cf1e5e7e373961bd72a26aa8ab4a78102bf01d2868
Opcode Fuzzy Hash: 349e3cb05091053b50c40eef52560003db5db738f0cb63bed7569bc2a28c438b
Instruction Fuzzy Hash: 8921E27140D3C06FD3128B258C61B66BFB4EF47610F1985DBD8C4CF693D229A91ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 01053019 Relevance: 1.6, APIs: 1, Instructions: 80COMMON

Download Yara Rule

APIs

select.WS2_32(?,?,?,?,?), ref: 010530A8

Memory Dump Source

Source File: 00000001.00000002.4155681187.0000000001050000.00000040.00000800.00020000.00000000.sdmp, Offset: 01050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1050000_WindowsServices.jbxd

Similarity

API ID: select
String ID:
API String ID: 1274211008-0
Opcode ID: 1448f429c83f76dd6e3ae1f03bb811ed84531116dbb6dae340f4c440f6c8efce
Instruction ID: fe8cc2fb82679e991f534b156eae2986d4d121e4ef9dd90970e64e12ae756097
Opcode Fuzzy Hash: 1448f429c83f76dd6e3ae1f03bb811ed84531116dbb6dae340f4c440f6c8efce
Instruction Fuzzy Hash: 0B215C715093849FDB62CF25C854A52BFF8EF06310F0988DAE984CF163D275A949DB62

Uniqueness

Uniqueness Score: -1.00%

Function 009FA462 Relevance: 1.6, APIs: 1, Instructions: 77registryCOMMON

Download Yara Rule

APIs

RegSetValueExW.KERNELBASE(?,00000E24,60660510,00000000,00000000,00000000,00000000), ref: 009FA4F8

Memory Dump Source

Source File: 00000001.00000002.4153788955.00000000009FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 009FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9fa000_WindowsServices.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 632453e58fae9cda30e9387116f989607b8dac7875b58228708722a7f740cb2b
Instruction ID: 0a15269d2cd7a1dafb7bd7a606ffdc9f676caee61303976263b41efc62e8720b
Opcode Fuzzy Hash: 632453e58fae9cda30e9387116f989607b8dac7875b58228708722a7f740cb2b
Instruction Fuzzy Hash: AA21B0B25043846FD7228F11CC44FA7BFBCEF06710F08849AE989CB652D264E909CB72

Uniqueness

Uniqueness Score: -1.00%

Function 010510A6 Relevance: 1.6, APIs: 1, Instructions: 77fileCOMMON

Download Yara Rule

APIs

MapViewOfFile.KERNELBASE ref: 0105113A

Memory Dump Source

Source File: 00000001.00000002.4155681187.0000000001050000.00000040.00000800.00020000.00000000.sdmp, Offset: 01050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1050000_WindowsServices.jbxd

Similarity

API ID: FileView
String ID:
API String ID: 3314676101-0
Opcode ID: 3bf2ce86bb9035e4ebb5cd077894eed2221007e0bac841c1116ea1177be8cec7
Instruction ID: 5b45e5a2177bb31b2256c2d8c0453b6f3b7531a3b03ffe0b9f15ee63961c43af
Opcode Fuzzy Hash: 3bf2ce86bb9035e4ebb5cd077894eed2221007e0bac841c1116ea1177be8cec7
Instruction Fuzzy Hash: 12210271405380AFE722CF15CD44F96FFF8EF09224F0488AEE9848B692D375A909CB61

Uniqueness

Uniqueness Score: -1.00%

Function 01050ACA Relevance: 1.6, APIs: 1, Instructions: 77networkCOMMON

Download Yara Rule

APIs

WSASocketW.WS2_32(?,?,?,?,?), ref: 01050B56

Memory Dump Source

Source File: 00000001.00000002.4155681187.0000000001050000.00000040.00000800.00020000.00000000.sdmp, Offset: 01050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1050000_WindowsServices.jbxd

Similarity

API ID: Socket
String ID:
API String ID: 38366605-0
Opcode ID: a232034cd64fff4955fe9e3c525671902d735dec4ad3280286e2bd01bcc60ce5
Instruction ID: 46079100199ce680aa020d969831129e172cddf12f130c9389e583176e91954c
Opcode Fuzzy Hash: a232034cd64fff4955fe9e3c525671902d735dec4ad3280286e2bd01bcc60ce5
Instruction Fuzzy Hash: 4421CE71505380AFE722CF55DC45F96FFF8EF05220F0888AAE9858B652C275A408CB61

Uniqueness

Uniqueness Score: -1.00%

Function 009FAEEA Relevance: 1.6, APIs: 1, Instructions: 76fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 009FAF69

Memory Dump Source

Source File: 00000001.00000002.4153788955.00000000009FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 009FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9fa000_WindowsServices.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: f8186e58c19aad8fd34782c58087273eefd2c13984a5dce46f3d1e7c77ff5c13
Instruction ID: da76917fe5771f0976c95c928c4ca02fd6d8160873973d6aa443f6e563df2eef
Opcode Fuzzy Hash: f8186e58c19aad8fd34782c58087273eefd2c13984a5dce46f3d1e7c77ff5c13
Instruction Fuzzy Hash: E021B2B1600304AFE720CF65DD85B66FBE8EF08324F048869EA498B751D375E808CB72

Uniqueness

Uniqueness Score: -1.00%

Function 01050F16 Relevance: 1.6, APIs: 1, Instructions: 76COMMON

Download Yara Rule

APIs

ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(?,00000E24), ref: 01050F87

Memory Dump Source

Source File: 00000001.00000002.4155681187.0000000001050000.00000040.00000800.00020000.00000000.sdmp, Offset: 01050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1050000_WindowsServices.jbxd

Similarity

API ID: DescriptorSecurity$ConvertString
String ID:
API String ID: 3907675253-0
Opcode ID: d3ed430221d1de980f95de337b370a81b8e3107cfeb0be7af1e97f532657c751
Instruction ID: f3aac34b6241d74c03f7fcd5ff581996fde9ea524f401067441fdcdb3bf0a1a5
Opcode Fuzzy Hash: d3ed430221d1de980f95de337b370a81b8e3107cfeb0be7af1e97f532657c751
Instruction Fuzzy Hash: 1A21C272600204AFEB60DE69DD45BABBBECEF04714F04886AFD44DBA45D674E5088BB1

Uniqueness

Uniqueness Score: -1.00%

Function 01050DFE Relevance: 1.6, APIs: 1, Instructions: 76registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,60660510,00000000,00000000,00000000,00000000), ref: 01050E9C

Memory Dump Source

Source File: 00000001.00000002.4155681187.0000000001050000.00000040.00000800.00020000.00000000.sdmp, Offset: 01050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1050000_WindowsServices.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 3a8d983bdd3adf6828e021557999dd8dc97fc5b3e00477206777e483de8ca19d
Instruction ID: ab6418dd01499441c8361b5bc8d14f7a8138b3143f7a52281b4bdf74609b1d97
Opcode Fuzzy Hash: 3a8d983bdd3adf6828e021557999dd8dc97fc5b3e00477206777e483de8ca19d
Instruction Fuzzy Hash: AE21AE72505780AFE722CB15CC44F57BFF8EF45710F08889AE9859B692D365E908CB61

Uniqueness

Uniqueness Score: -1.00%

Function 009FAFC0 Relevance: 1.6, APIs: 1, Instructions: 75COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE(?,00000E24,60660510,00000000,00000000,00000000,00000000), ref: 009FB055

Memory Dump Source

Source File: 00000001.00000002.4153788955.00000000009FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 009FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9fa000_WindowsServices.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 5dfebf91c1ed0025865f226b9d05f65060dd53c474b57ad48cbf5de92e586f1a
Instruction ID: b98feedd01e5ddf70061c7e8dac49629a6bd84bc97ccf017aded70cab309b8c2
Opcode Fuzzy Hash: 5dfebf91c1ed0025865f226b9d05f65060dd53c474b57ad48cbf5de92e586f1a
Instruction Fuzzy Hash: 992149B54087806FE3228B25DC40BA3BFBCEF06724F0884DAE9918B653D374A909C771

Uniqueness

Uniqueness Score: -1.00%

Function 009FA8C6 Relevance: 1.6, APIs: 1, Instructions: 74registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(?,00000E24), ref: 009FA945

Memory Dump Source

Source File: 00000001.00000002.4153788955.00000000009FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 009FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9fa000_WindowsServices.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: daea28d8a12b7aed13f0a6d8f84b61e60a6d55bc0628fbf26ef83624ada79e90
Instruction ID: d85f3195edc1d0cc9788be18a9e97864f2ef2b1b0655b8d6a1f6d113b702557a
Opcode Fuzzy Hash: daea28d8a12b7aed13f0a6d8f84b61e60a6d55bc0628fbf26ef83624ada79e90
Instruction Fuzzy Hash: 5221C2B2500304AEE7309E55CD44FABFBECEF14714F04886AEA458AA51D778E9488B72

Uniqueness

Uniqueness Score: -1.00%

Function 010531E7 Relevance: 1.6, APIs: 1, Instructions: 73COMMON

Download Yara Rule

APIs

SetProcessWorkingSetSize.KERNEL32(?,00000E24,60660510,00000000,00000000,00000000,00000000), ref: 01053263

Memory Dump Source

Source File: 00000001.00000002.4155681187.0000000001050000.00000040.00000800.00020000.00000000.sdmp, Offset: 01050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1050000_WindowsServices.jbxd

Similarity

API ID: ProcessSizeWorking
String ID:
API String ID: 3584180929-0
Opcode ID: 05fb9f1b102f234023ec2014b7c406dced25f59fe2198dbefaba7b393926c594
Instruction ID: daa436e19cdc77c40417aad11cb5be298c15da9b21f4bb903e00ca48ffb64f36
Opcode Fuzzy Hash: 05fb9f1b102f234023ec2014b7c406dced25f59fe2198dbefaba7b393926c594
Instruction Fuzzy Hash: 7E21C5715053806FD722CB55CC44F97BFA8EF45210F08C8AAE944DB552D274A908CB75

Uniqueness

Uniqueness Score: -1.00%

Function 009FB623 Relevance: 1.6, APIs: 1, Instructions: 72COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(?,?,?), ref: 009FB6A2

Memory Dump Source

Source File: 00000001.00000002.4153788955.00000000009FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 009FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9fa000_WindowsServices.jbxd

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: f83eb7b17c5c0bcb5537623893583c36aeb5e8ce18c2572abac009cb898571f6
Instruction ID: 78bbdb0cc5b6910e8e28bc8fefde3c7e52de9d772f0278c4519114e96265caa8
Opcode Fuzzy Hash: f83eb7b17c5c0bcb5537623893583c36aeb5e8ce18c2572abac009cb898571f6
Instruction Fuzzy Hash: 772160B25053845FD711CF25DC45B52BFE8EF16314F0984AAE985CB262E274D909CB61

Uniqueness

Uniqueness Score: -1.00%

Function 009FA646 Relevance: 1.6, APIs: 1, Instructions: 72synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexW.KERNELBASE(?,?), ref: 009FA6B9

Memory Dump Source

Source File: 00000001.00000002.4153788955.00000000009FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 009FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9fa000_WindowsServices.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: fbda56231af1ab379d6161b0939d54ac417139f8f1d9c05daae74764d23a2229
Instruction ID: 306cc89b4cdacb75bdd1f64b3ff7c834c60b28dc5338fe65ec757b2b1daf06c8
Opcode Fuzzy Hash: fbda56231af1ab379d6161b0939d54ac417139f8f1d9c05daae74764d23a2229
Instruction Fuzzy Hash: 992180B56012049FE720DF25DD45BA6FBE8EF04324F08C86AEA49CB641D775E909CB72

Uniqueness

Uniqueness Score: -1.00%

Function 0105133D Relevance: 1.6, APIs: 1, Instructions: 72COMMON

Download Yara Rule

APIs

shutdown.WS2_32(?,00000E24,60660510,00000000,00000000,00000000,00000000), ref: 010513C0

Memory Dump Source

Source File: 00000001.00000002.4155681187.0000000001050000.00000040.00000800.00020000.00000000.sdmp, Offset: 01050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1050000_WindowsServices.jbxd

Similarity

API ID: shutdown
String ID:
API String ID: 2510479042-0
Opcode ID: a8efa6197da798da46f37f3cc0d81795796fffa666e77a0474e9c92ef40e8598
Instruction ID: aeaa4d4224a6ac1e7de6f189be7828de934450c163a196d52c214835950a6cfd
Opcode Fuzzy Hash: a8efa6197da798da46f37f3cc0d81795796fffa666e77a0474e9c92ef40e8598
Instruction Fuzzy Hash: 5E21C5714093806FD7228B15CC44B56BFB8EF46210F0884DBE9849F653C378A909CB61

Uniqueness

Uniqueness Score: -1.00%

Function 01050862 Relevance: 1.6, APIs: 1, Instructions: 70fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,00000E24,60660510,00000000,00000000,00000000,00000000), ref: 010508E1

Memory Dump Source

Source File: 00000001.00000002.4155681187.0000000001050000.00000040.00000800.00020000.00000000.sdmp, Offset: 01050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1050000_WindowsServices.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: bcfdf354c5a21a763a6ea86006db38df021d8e5fb45f178b8af116f6bcae9dab
Instruction ID: d991308ef549c8b771f5149ce180190cc37ae74a8e4e67578bcab23c27b4f882
Opcode Fuzzy Hash: bcfdf354c5a21a763a6ea86006db38df021d8e5fb45f178b8af116f6bcae9dab
Instruction Fuzzy Hash: 4B21D471405340AFE722CF55CC44F97BFF8EF45314F08889AE9848B552C234A908CB71

Uniqueness

Uniqueness Score: -1.00%

Function 009FA392 Relevance: 1.6, APIs: 1, Instructions: 69registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,60660510,00000000,00000000,00000000,00000000), ref: 009FA40C

Memory Dump Source

Source File: 00000001.00000002.4153788955.00000000009FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 009FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9fa000_WindowsServices.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 5a8f578bac19e9b051fdc800ffeb942d23487e3224e4de1c10f783fb25b53225
Instruction ID: 2c9638e2131f561313a460403843ab1b425ce506845e36ef3461c8b67547801f
Opcode Fuzzy Hash: 5a8f578bac19e9b051fdc800ffeb942d23487e3224e4de1c10f783fb25b53225
Instruction Fuzzy Hash: 92214DB56006089FE721CE15CD84FA6B7ECEF04714F14C86AEA498BA51D7B4E909CB72

Uniqueness

Uniqueness Score: -1.00%

Function 01052F53 Relevance: 1.6, APIs: 1, Instructions: 69COMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32(?,00000E24,60660510,00000000,00000000,00000000,00000000), ref: 01052FCF

Memory Dump Source

Source File: 00000001.00000002.4155681187.0000000001050000.00000040.00000800.00020000.00000000.sdmp, Offset: 01050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1050000_WindowsServices.jbxd

Similarity

API ID: ioctlsocket
String ID:
API String ID: 3577187118-0
Opcode ID: e7fcd9d70fc73c811c56e12352a3cd61e9416c0e570051f40a2554f95d6f22a0
Instruction ID: 20b3c9d73c9152f9b3cf30d1bc35930cca6593897cc973d696cb36582f2fec73
Opcode Fuzzy Hash: e7fcd9d70fc73c811c56e12352a3cd61e9416c0e570051f40a2554f95d6f22a0
Instruction Fuzzy Hash: B721A1714093846FD722CF55CD44F97BFB8EF45314F0888AAE9849B652D274A908CB61

Uniqueness

Uniqueness Score: -1.00%

Function 009FB90C Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 009FB978

Memory Dump Source

Source File: 00000001.00000002.4153788955.00000000009FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 009FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9fa000_WindowsServices.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: faa694baab7c8c8432968706ffe0dd40eb826012c41444ae310059f8ec27e187
Instruction ID: b1ffed60091096b8bd5ed44bf9777315420b5b28c88595926166b1ead09f6aa8
Opcode Fuzzy Hash: faa694baab7c8c8432968706ffe0dd40eb826012c41444ae310059f8ec27e187
Instruction Fuzzy Hash: 5F21F0725093C05FDB028F25DC54792BFB4AF07324F0984DAE9858F663D274A908CB62

Uniqueness

Uniqueness Score: -1.00%

Function 010516D7 Relevance: 1.6, APIs: 1, Instructions: 68networkCOMMON

Download Yara Rule

APIs

WSAConnect.WS2_32(?,?,?,?,?,?,?), ref: 01051756

Memory Dump Source

Source File: 00000001.00000002.4155681187.0000000001050000.00000040.00000800.00020000.00000000.sdmp, Offset: 01050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1050000_WindowsServices.jbxd

Similarity

API ID: Connect
String ID:
API String ID: 3144859779-0
Opcode ID: 9c35c15b2bf5019d9b1b0706eceea0306d71e3ce5fab7cf13d9c2fef96234808
Instruction ID: c34d87391b9a0bf37152be70ea7a8cc9dcb496c32b9da4311c685e7c174ded13
Opcode Fuzzy Hash: 9c35c15b2bf5019d9b1b0706eceea0306d71e3ce5fab7cf13d9c2fef96234808
Instruction Fuzzy Hash: 5B21AF75409384AFDB228F65CC44B92BFF4EF06310F0988DAE9858B563D375A819DB61

Uniqueness

Uniqueness Score: -1.00%

Function 010510C6 Relevance: 1.6, APIs: 1, Instructions: 67fileCOMMON

Download Yara Rule

APIs

MapViewOfFile.KERNELBASE ref: 0105113A

Memory Dump Source

Source File: 00000001.00000002.4155681187.0000000001050000.00000040.00000800.00020000.00000000.sdmp, Offset: 01050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1050000_WindowsServices.jbxd

Similarity

API ID: FileView
String ID:
API String ID: 3314676101-0
Opcode ID: 154c4a59557421160134e60e8a9f78dcab61b0ad11a549efa13de653536468d0
Instruction ID: 86ba32c44a49fc573ff65128745c6720fe2748f14c62706d0e10ad7fca4ad053
Opcode Fuzzy Hash: 154c4a59557421160134e60e8a9f78dcab61b0ad11a549efa13de653536468d0
Instruction Fuzzy Hash: 8D21F371500204AFEB31CF19DD45F9AFBE8EF08324F0488A9E9858BB51D375E409CB65

Uniqueness

Uniqueness Score: -1.00%

Function 01050AEA Relevance: 1.6, APIs: 1, Instructions: 67networkCOMMON

Download Yara Rule

APIs

WSASocketW.WS2_32(?,?,?,?,?), ref: 01050B56

Memory Dump Source

Source File: 00000001.00000002.4155681187.0000000001050000.00000040.00000800.00020000.00000000.sdmp, Offset: 01050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1050000_WindowsServices.jbxd

Similarity

API ID: Socket
String ID:
API String ID: 38366605-0
Opcode ID: 053cd3c933414abb3c704b6895f96ea6d548d6dcbb6ba7daca10a53c8b4ea0d8
Instruction ID: 6d73c5574c603a510469f929873fe8bfc521641057c89a0c544e1e4ea503011d
Opcode Fuzzy Hash: 053cd3c933414abb3c704b6895f96ea6d548d6dcbb6ba7daca10a53c8b4ea0d8
Instruction Fuzzy Hash: D321A471500200AFEB31DF55DD85F5AFBE4EF08324F04886AED858BA52D375A509CB71

Uniqueness

Uniqueness Score: -1.00%

Function 009FA710 Relevance: 1.6, APIs: 1, Instructions: 66COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 009FA780

Memory Dump Source

Source File: 00000001.00000002.4153788955.00000000009FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 009FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9fa000_WindowsServices.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 2cb8b658df26c6e9304e9d24c1afffe472a31aef4d367a44bf0da3551f279b8a
Instruction ID: e1553265fac45e1b180e23f51baaaf7238adc286e5654e250f80b29a2feb9a0b
Opcode Fuzzy Hash: 2cb8b658df26c6e9304e9d24c1afffe472a31aef4d367a44bf0da3551f279b8a
Instruction Fuzzy Hash: 3521D2B59043809FD711CF15DD85B52BFB8EF02324F0984ABED458B653D335A905DB62

Uniqueness

Uniqueness Score: -1.00%

Function 009FA9CE Relevance: 1.6, APIs: 1, Instructions: 66windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutA.USER32(?,00000E24), ref: 009FAA49

Memory Dump Source

Source File: 00000001.00000002.4153788955.00000000009FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 009FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9fa000_WindowsServices.jbxd

Similarity

API ID: MessageSendTimeout
String ID:
API String ID: 1599653421-0
Opcode ID: 4be6b093fcafd2ebcb96d3053d90a551c14d242f5fbc8061d02b3a489f3a5801
Instruction ID: 64adaff78aa392bdcd6faed8dc66bee2689247551982ab4da6ebe5bd0d54da1b
Opcode Fuzzy Hash: 4be6b093fcafd2ebcb96d3053d90a551c14d242f5fbc8061d02b3a489f3a5801
Instruction Fuzzy Hash: BE21E471500304AFEB318F54CD41FB6FBA8EF04714F14886AEE458AA91D379E519CB72

Uniqueness

Uniqueness Score: -1.00%

Function 009FBD78 Relevance: 1.6, APIs: 1, Instructions: 66COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 009FBDEE

Memory Dump Source

Source File: 00000001.00000002.4153788955.00000000009FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 009FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9fa000_WindowsServices.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 804cf9b025e855c5afdcdab8d4d8d10597fdb9ab59c75ead420eb50500e45c5f
Instruction ID: 00e5f539500616dbd41c534de504461b1637041287478b222c03109ba16cc67c
Opcode Fuzzy Hash: 804cf9b025e855c5afdcdab8d4d8d10597fdb9ab59c75ead420eb50500e45c5f
Instruction Fuzzy Hash: AA21A171409380AFDB228F51DC44A62FFF4EF4A310F0988DAEE858B563D275A919DB61

Uniqueness

Uniqueness Score: -1.00%

Function 01052022 Relevance: 1.6, APIs: 1, Instructions: 66libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,00000E24), ref: 010520AB

Memory Dump Source

Source File: 00000001.00000002.4155681187.0000000001050000.00000040.00000800.00020000.00000000.sdmp, Offset: 01050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1050000_WindowsServices.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 4cd64de13c1006f1258eabcb7d93c2ed25345768d7aa62438b3ec83b03081fdd
Instruction ID: baed94a650d7fbffc2b73f443bcdf1ff6941b2ef6c5d9eb5affb886fa9fee0b1
Opcode Fuzzy Hash: 4cd64de13c1006f1258eabcb7d93c2ed25345768d7aa62438b3ec83b03081fdd
Instruction Fuzzy Hash: 8611E471405340AFE721CB15CC85FA6FBB8DF06720F04849AFD449B692D275A948CB61

Uniqueness

Uniqueness Score: -1.00%

Function 009FA486 Relevance: 1.6, APIs: 1, Instructions: 65registryCOMMON

Download Yara Rule

APIs

RegSetValueExW.KERNELBASE(?,00000E24,60660510,00000000,00000000,00000000,00000000), ref: 009FA4F8

Memory Dump Source

Source File: 00000001.00000002.4153788955.00000000009FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 009FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9fa000_WindowsServices.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 13fd88db79d7122096bc6c30720ec8bf0c472df4ef2d9e2880787532e7567d12
Instruction ID: 52af6f5915e855d5a0c9edea781c4e0244b7fd3308fdab0f0eab33f2155bea55
Opcode Fuzzy Hash: 13fd88db79d7122096bc6c30720ec8bf0c472df4ef2d9e2880787532e7567d12
Instruction Fuzzy Hash: 3411B1B6500304AFE7318E15CD45FABBBECEF04714F04886AEE498AA51D774E9088B72

Uniqueness

Uniqueness Score: -1.00%

Function 01050E2A Relevance: 1.6, APIs: 1, Instructions: 65registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,60660510,00000000,00000000,00000000,00000000), ref: 01050E9C

Memory Dump Source

Source File: 00000001.00000002.4155681187.0000000001050000.00000040.00000800.00020000.00000000.sdmp, Offset: 01050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1050000_WindowsServices.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 8b2abb3f4ee5f3383fd2d4b2a5548a5b6cb8e49598db294caa16aabbc9c55d78
Instruction ID: c0b08c1ba647aa8be85264bda58127c378062473763b5c52eb51bc21d4d607e2
Opcode Fuzzy Hash: 8b2abb3f4ee5f3383fd2d4b2a5548a5b6cb8e49598db294caa16aabbc9c55d78
Instruction Fuzzy Hash: 7511A272500604AFE771CE19CD44FABB7E8EF04710F1488AAED458A652D774E509CA71

Uniqueness

Uniqueness Score: -1.00%

Function 009FAE00 Relevance: 1.6, APIs: 1, Instructions: 64fileCOMMON

Download Yara Rule

APIs

CopyFileW.KERNELBASE(?,?,?), ref: 009FAE6A

Memory Dump Source

Source File: 00000001.00000002.4153788955.00000000009FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 009FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9fa000_WindowsServices.jbxd

Similarity

API ID: CopyFile
String ID:
API String ID: 1304948518-0
Opcode ID: 5c72cd1d8325b39556e75de665148cd2ff4c617fc0d70f50038cecd521c43c74
Instruction ID: 5f3213e8f455f95a78943bc14fc4395e11afb69045549df4bcb6973a0cd548a1
Opcode Fuzzy Hash: 5c72cd1d8325b39556e75de665148cd2ff4c617fc0d70f50038cecd521c43c74
Instruction Fuzzy Hash: 201184B16053845FD721CF25DC85B63BFE8EF55220F0984AAED49CB652D274E804CB62

Uniqueness

Uniqueness Score: -1.00%

Function 0105153A Relevance: 1.6, APIs: 1, Instructions: 64timeCOMMON

Download Yara Rule

APIs

GetProcessTimes.KERNELBASE(?,00000E24,60660510,00000000,00000000,00000000,00000000), ref: 01051599

Memory Dump Source

Source File: 00000001.00000002.4155681187.0000000001050000.00000040.00000800.00020000.00000000.sdmp, Offset: 01050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1050000_WindowsServices.jbxd

Similarity

API ID: ProcessTimes
String ID:
API String ID: 1995159646-0
Opcode ID: f78a564fd7a33634db3cb87af29b322f1822b3a035a10b4b22dc7fd8db45cd33
Instruction ID: 051be3213c3079011e95d4cc2173aa2e569d503df69668412dc1f24b42de88f9
Opcode Fuzzy Hash: f78a564fd7a33634db3cb87af29b322f1822b3a035a10b4b22dc7fd8db45cd33
Instruction Fuzzy Hash: EE11D372500200AFEB718F55DD44BABB7E8EF04614F08887AED468AA51D774A5098BB1

Uniqueness

Uniqueness Score: -1.00%

Function 0105320A Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

SetProcessWorkingSetSize.KERNEL32(?,00000E24,60660510,00000000,00000000,00000000,00000000), ref: 01053263

Memory Dump Source

Source File: 00000001.00000002.4155681187.0000000001050000.00000040.00000800.00020000.00000000.sdmp, Offset: 01050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1050000_WindowsServices.jbxd

Similarity

API ID: ProcessSizeWorking
String ID:
API String ID: 3584180929-0
Opcode ID: ef6227be6dbd4c3f365dba506596fd5a6b284879c02daa0bbf5e1fa49ab6a71c
Instruction ID: 5796c18853031c8906eb0cc513fe74a89a1f0a70dd64acb9166824efb7773602
Opcode Fuzzy Hash: ef6227be6dbd4c3f365dba506596fd5a6b284879c02daa0bbf5e1fa49ab6a71c
Instruction Fuzzy Hash: C011E271500200AFEB218F59CD44BABB7E8EF44364F04C86AED45CFA41D678A508CAB1

Uniqueness

Uniqueness Score: -1.00%

Function 01053126 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

GetProcessWorkingSetSize.KERNEL32(?,00000E24,60660510,00000000,00000000,00000000,00000000), ref: 0105317F

Memory Dump Source

Source File: 00000001.00000002.4155681187.0000000001050000.00000040.00000800.00020000.00000000.sdmp, Offset: 01050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1050000_WindowsServices.jbxd

Similarity

API ID: ProcessSizeWorking
String ID:
API String ID: 3584180929-0
Opcode ID: ef6227be6dbd4c3f365dba506596fd5a6b284879c02daa0bbf5e1fa49ab6a71c
Instruction ID: bf63c84c352d092ace8c250c3ccad5eccd8e281dd584dd0bb7c6a7b7482c64b3
Opcode Fuzzy Hash: ef6227be6dbd4c3f365dba506596fd5a6b284879c02daa0bbf5e1fa49ab6a71c
Instruction Fuzzy Hash: 1F11E2715002049FEB21CF29CD44BABB7E8EF04324F08C87AED45CB641D774A9088AB5

Uniqueness

Uniqueness Score: -1.00%

Function 0105016B Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

MkParseDisplayName.OLE32(?,00000E24,?,?), ref: 010501EE

Memory Dump Source

Source File: 00000001.00000002.4155681187.0000000001050000.00000040.00000800.00020000.00000000.sdmp, Offset: 01050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1050000_WindowsServices.jbxd

Similarity

API ID: DisplayNameParse
String ID:
API String ID: 3580041360-0
Opcode ID: ce52b0438405beb0a5facf16db875a57572ce435c7dfd2335ab19f7964d82703
Instruction ID: d01fbb64f003fa4cb4fa374a861e7ae46b1032c3d7bd01e39c7bb9170f1cf849
Opcode Fuzzy Hash: ce52b0438405beb0a5facf16db875a57572ce435c7dfd2335ab19f7964d82703
Instruction Fuzzy Hash: 5A11E6715057806FD3118B16DC41F73BFB8EF86620F0985AAEC488BA42D225B919CBB2

Uniqueness

Uniqueness Score: -1.00%

Function 009FBAEA Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetExitCodeProcess.KERNELBASE(?,00000E24,60660510,00000000,00000000,00000000,00000000), ref: 009FBB40

Memory Dump Source

Source File: 00000001.00000002.4153788955.00000000009FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 009FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9fa000_WindowsServices.jbxd

Similarity

API ID: CodeExitProcess
String ID:
API String ID: 3861947596-0
Opcode ID: c0e4c33d8707665ce7dc5931e7c5a84098502d76628fa88842f37b4d72f1056e
Instruction ID: ad0416944c818ecb825d28498cc70e6769b3742936582f5669a0edcd26692765
Opcode Fuzzy Hash: c0e4c33d8707665ce7dc5931e7c5a84098502d76628fa88842f37b4d72f1056e
Instruction Fuzzy Hash: 7611E371500204AFEB208F15DD45BAAB7ACDF04724F18C87AED05CBA45D778E9098BB1

Uniqueness

Uniqueness Score: -1.00%

Function 01051A60 Relevance: 1.6, APIs: 1, Instructions: 60COMMON

Download Yara Rule

APIs

K32EnumProcesses.KERNEL32(?,?,?,60660510,00000000,?,?,?,?,?,?,?,?,6C883C58), ref: 01051AC2

Memory Dump Source

Source File: 00000001.00000002.4155681187.0000000001050000.00000040.00000800.00020000.00000000.sdmp, Offset: 01050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1050000_WindowsServices.jbxd

Similarity

API ID: EnumProcesses
String ID:
API String ID: 84517404-0
Opcode ID: b44aee905472dde649c38a58fff9c548abe2504d5eafa97f01d288f64b623c62
Instruction ID: b7e4530481dc0419d078129bb9dfc1450b3898ceac4c8498f0b12af6057d2e25
Opcode Fuzzy Hash: b44aee905472dde649c38a58fff9c548abe2504d5eafa97f01d288f64b623c62
Instruction Fuzzy Hash: B611A2715053809FD751CF65DC84B53BFE8EF05210F0884EAED85CB652D274A818CB61

Uniqueness

Uniqueness Score: -1.00%

Function 01050882 Relevance: 1.6, APIs: 1, Instructions: 60fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,00000E24,60660510,00000000,00000000,00000000,00000000), ref: 010508E1

Memory Dump Source

Source File: 00000001.00000002.4155681187.0000000001050000.00000040.00000800.00020000.00000000.sdmp, Offset: 01050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1050000_WindowsServices.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 16d9439779b3997d6f82efc19979b037393925e53687ef9f4a788dc4f14978eb
Instruction ID: d450ab6dd7e1d7104cfb83e3923cf08b4b74b94d872ad56572f8967caab244bc
Opcode Fuzzy Hash: 16d9439779b3997d6f82efc19979b037393925e53687ef9f4a788dc4f14978eb
Instruction Fuzzy Hash: 1C11E272500300AFEB218F55CD44FABFBE8EF04714F04886AED859BA45C374A508CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 01052F76 Relevance: 1.6, APIs: 1, Instructions: 58COMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32(?,00000E24,60660510,00000000,00000000,00000000,00000000), ref: 01052FCF

Memory Dump Source

Source File: 00000001.00000002.4155681187.0000000001050000.00000040.00000800.00020000.00000000.sdmp, Offset: 01050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1050000_WindowsServices.jbxd

Similarity

API ID: ioctlsocket
String ID:
API String ID: 3577187118-0
Opcode ID: 8fabba888e6d9d188346ec0c9c7bee7b4f9ee7ab27e02a8d4d2c786dc3c6a6ae
Instruction ID: b2d91509b665168736bec6dc3dd6a5c8242319692c6c7483f72621247c1f9edf
Opcode Fuzzy Hash: 8fabba888e6d9d188346ec0c9c7bee7b4f9ee7ab27e02a8d4d2c786dc3c6a6ae
Instruction Fuzzy Hash: 9511C171500304AFE761CF55DD84BABBBE8EF04724F04C8AAED459B641D778A5098BB1

Uniqueness

Uniqueness Score: -1.00%

Function 009FAC8D Relevance: 1.6, APIs: 1, Instructions: 57comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(?), ref: 009FACEC

Memory Dump Source

Source File: 00000001.00000002.4153788955.00000000009FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 009FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9fa000_WindowsServices.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 199c076c7ce23e4b3ae5887df12afb95136b033ff53802fa9c4b288c6956be28
Instruction ID: 924ea80e7a8672bd165b43e335ac827c9d81f3941a1941cdc2b2b21643f0fab0
Opcode Fuzzy Hash: 199c076c7ce23e4b3ae5887df12afb95136b033ff53802fa9c4b288c6956be28
Instruction Fuzzy Hash: 8B1160715093C45FDB128B25DC44692BFB4EF46220F0984DBDD888F653D275A948CB62

Uniqueness

Uniqueness Score: -1.00%

Function 0105136A Relevance: 1.6, APIs: 1, Instructions: 57COMMON

Download Yara Rule

APIs

shutdown.WS2_32(?,00000E24,60660510,00000000,00000000,00000000,00000000), ref: 010513C0

Memory Dump Source

Source File: 00000001.00000002.4155681187.0000000001050000.00000040.00000800.00020000.00000000.sdmp, Offset: 01050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1050000_WindowsServices.jbxd

Similarity

API ID: shutdown
String ID:
API String ID: 2510479042-0
Opcode ID: b123a3d3bdc9887dff87542dafd546c75ff4582cb7adcb31bbcc870c8120aa96
Instruction ID: 59ce8aa89f285626ce053d7f7a2f20094b16c0d4987374696ef27480665b6e0b
Opcode Fuzzy Hash: b123a3d3bdc9887dff87542dafd546c75ff4582cb7adcb31bbcc870c8120aa96
Instruction Fuzzy Hash: 15112971500200AFEB21CF19DD44BABF7E8DF04724F04C8A6ED448FA42D778A5098AB1

Uniqueness

Uniqueness Score: -1.00%

Function 009FA2D2 Relevance: 1.6, APIs: 1, Instructions: 56COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(?), ref: 009FA330

Memory Dump Source

Source File: 00000001.00000002.4153788955.00000000009FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 009FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9fa000_WindowsServices.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: e51480aa078d218a1da6250c7630ce0defc8d0093833abce61ed3fad83fc701d
Instruction ID: 95d45469edb54b12db1d0d524e17fc1d6f126a6f28ed949c443d1508150730d3
Opcode Fuzzy Hash: e51480aa078d218a1da6250c7630ce0defc8d0093833abce61ed3fad83fc701d
Instruction Fuzzy Hash: 1711BFB14093C46FDB128B25DC44662BFB4DF07220F0980CBED848B263C2656808DB62

Uniqueness

Uniqueness Score: -1.00%

Function 01052042 Relevance: 1.6, APIs: 1, Instructions: 56libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,00000E24), ref: 010520AB

Memory Dump Source

Source File: 00000001.00000002.4155681187.0000000001050000.00000040.00000800.00020000.00000000.sdmp, Offset: 01050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1050000_WindowsServices.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 1da4c0ae9af2064a135d259f511e6960120eb82aee6121c879debc698d1c70a3
Instruction ID: 9ee4dec653893cab917832faa5a52bf2301f437eadc34f41fc08b87b91f3a50d
Opcode Fuzzy Hash: 1da4c0ae9af2064a135d259f511e6960120eb82aee6121c879debc698d1c70a3
Instruction Fuzzy Hash: 35112571501300AEE7308B19CD41BAAFBA8DF04724F04C4AAFD444BB82D3B9A948CA62

Uniqueness

Uniqueness Score: -1.00%

Function 01053052 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

select.WS2_32(?,?,?,?,?), ref: 010530A8

Memory Dump Source

Source File: 00000001.00000002.4155681187.0000000001050000.00000040.00000800.00020000.00000000.sdmp, Offset: 01050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1050000_WindowsServices.jbxd

Similarity

API ID: select
String ID:
API String ID: 1274211008-0
Opcode ID: 408f30abcef86edf440db298a88c454ed20a7f4407a96e5bdecba2ecc294b345
Instruction ID: fdeeebe89aa34ab1b7214dde6f8553b715f224e503cc732b95edb31a26053620
Opcode Fuzzy Hash: 408f30abcef86edf440db298a88c454ed20a7f4407a96e5bdecba2ecc294b345
Instruction Fuzzy Hash: F6115E716003048FEBA0CF59D984B56FBE8EF04750F0884AAED89CF652D775E548CB62

Uniqueness

Uniqueness Score: -1.00%

Function 009FA078 Relevance: 1.6, APIs: 1, Instructions: 54networkCOMMON

Download Yara Rule

APIs

send.WS2_32(?,?,?,?), ref: 009FA0D5

Memory Dump Source

Source File: 00000001.00000002.4153788955.00000000009FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 009FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9fa000_WindowsServices.jbxd

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: 3f0678b228abebc91c33b57429d466eb9933c9678a819ffbdc53caa5cc4b9ce7
Instruction ID: 2d4a1f75c40bd85897a511742097e8e05d5da4a15e26838d8a11c40419a7e02d
Opcode Fuzzy Hash: 3f0678b228abebc91c33b57429d466eb9933c9678a819ffbdc53caa5cc4b9ce7
Instruction Fuzzy Hash: DE11C4715093809FDB22CF11DC44B52FFB4EF45314F09C8DAED848B552C275A918CB62

Uniqueness

Uniqueness Score: -1.00%

Function 009FAE22 Relevance: 1.6, APIs: 1, Instructions: 53fileCOMMON

Download Yara Rule

APIs

CopyFileW.KERNELBASE(?,?,?), ref: 009FAE6A

Memory Dump Source

Source File: 00000001.00000002.4153788955.00000000009FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 009FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9fa000_WindowsServices.jbxd

Similarity

API ID: CopyFile
String ID:
API String ID: 1304948518-0
Opcode ID: fc55a7ffa1c892d3b4f181a02411bc37293b0c329abfff3bdc866af16c70819b
Instruction ID: bd178409892be883101a72f22cf896f89e9116c62c2cbb3025f6b70af4f8c3e5
Opcode Fuzzy Hash: fc55a7ffa1c892d3b4f181a02411bc37293b0c329abfff3bdc866af16c70819b
Instruction Fuzzy Hash: BA1152B5A002048FEB20DF29DD45766FBE8EF54720F08C86ADD49CB751D679E814CB62

Uniqueness

Uniqueness Score: -1.00%

Function 009FB65A Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(?,?,?), ref: 009FB6A2

Memory Dump Source

Source File: 00000001.00000002.4153788955.00000000009FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 009FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9fa000_WindowsServices.jbxd

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: fc55a7ffa1c892d3b4f181a02411bc37293b0c329abfff3bdc866af16c70819b
Instruction ID: e9453316ad8a522b66868f288b5905fae6107210d366290f1a58d033f3e68f9a
Opcode Fuzzy Hash: fc55a7ffa1c892d3b4f181a02411bc37293b0c329abfff3bdc866af16c70819b
Instruction Fuzzy Hash: 6E1152716002449FDB20DF29D985766FBE8EF14724F08C86ADD49CB641D775E814CB62

Uniqueness

Uniqueness Score: -1.00%

Function 009FB002 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE(?,00000E24,60660510,00000000,00000000,00000000,00000000), ref: 009FB055

Memory Dump Source

Source File: 00000001.00000002.4153788955.00000000009FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 009FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9fa000_WindowsServices.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 31919799857641fa58762fcc50c9a861c5bdd9c88048054016b2163c919b2b95
Instruction ID: 26d2ef21ccf946273ca3f2e9b0f1c04b1619fa75df0e3718faffad2d835ca11a
Opcode Fuzzy Hash: 31919799857641fa58762fcc50c9a861c5bdd9c88048054016b2163c919b2b95
Instruction Fuzzy Hash: E101C471500304AEE7209F15DD45BB7B7A8DF04724F18C4A6EE158B645D778E9088AA5

Uniqueness

Uniqueness Score: -1.00%

Function 0105170A Relevance: 1.5, APIs: 1, Instructions: 49networkCOMMON

Download Yara Rule

APIs

WSAConnect.WS2_32(?,?,?,?,?,?,?), ref: 01051756

Memory Dump Source

Source File: 00000001.00000002.4155681187.0000000001050000.00000040.00000800.00020000.00000000.sdmp, Offset: 01050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1050000_WindowsServices.jbxd

Similarity

API ID: Connect
String ID:
API String ID: 3144859779-0
Opcode ID: e592830b08162477121cc80da5dc90f12350a18b438f291be31d0a5e328d4c6c
Instruction ID: 41d604f530bc56eb94b77ba3f058893bbe6084fab3c2d4c9e747a879443df919
Opcode Fuzzy Hash: e592830b08162477121cc80da5dc90f12350a18b438f291be31d0a5e328d4c6c
Instruction Fuzzy Hash: D7117C315002049FEB61CF59D944B66FBF4FF08210F0888AADD858BA62D375E418DF61

Uniqueness

Uniqueness Score: -1.00%

Function 01051A82 Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

K32EnumProcesses.KERNEL32(?,?,?,60660510,00000000,?,?,?,?,?,?,?,?,6C883C58), ref: 01051AC2

Memory Dump Source

Source File: 00000001.00000002.4155681187.0000000001050000.00000040.00000800.00020000.00000000.sdmp, Offset: 01050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1050000_WindowsServices.jbxd

Similarity

API ID: EnumProcesses
String ID:
API String ID: 84517404-0
Opcode ID: 3f8271492466bedc7759ca7ad6faebb410de1c0eaaabab257cbf88ed4d9b541a
Instruction ID: a6e4648cfed8732bf67c6c1afc4ceeac7517a926d22bb1b5dc64b5a10c12cd1d
Opcode Fuzzy Hash: 3f8271492466bedc7759ca7ad6faebb410de1c0eaaabab257cbf88ed4d9b541a
Instruction Fuzzy Hash: B011A1756042408FEB61CF69D984B56FBE4EF04220F08C4AADD49CBA52D675E454CB61

Uniqueness

Uniqueness Score: -1.00%

Function 009FA172 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

EnumWindows.USER32(?,00000E24,?,?), ref: 009FA1BD

Memory Dump Source

Source File: 00000001.00000002.4153788955.00000000009FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 009FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9fa000_WindowsServices.jbxd

Similarity

API ID: EnumWindows
String ID:
API String ID: 1129996299-0
Opcode ID: a8705d4be55acfe39cf282ab26fb5745dde5daa9fbc066328f603c979e84c40e
Instruction ID: 7225b1b5d04a0de2ea4ac5419737f1475ab08ebcd4f3e4cc269bb05282dfdc05
Opcode Fuzzy Hash: a8705d4be55acfe39cf282ab26fb5745dde5daa9fbc066328f603c979e84c40e
Instruction Fuzzy Hash: 2C017171600200ABD310DF16DD46B66FBE8EB88A20F14856AED089BB41D775F915CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 01051DB6 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetVolumeInformationA.KERNELBASE(?,00000E24,?,?), ref: 01051E06

Memory Dump Source

Source File: 00000001.00000002.4155681187.0000000001050000.00000040.00000800.00020000.00000000.sdmp, Offset: 01050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1050000_WindowsServices.jbxd

Similarity

API ID: InformationVolume
String ID:
API String ID: 2039140958-0
Opcode ID: 3f2b91d9c851a8f80d8b38c848f79e4cc919e129953d6b9e397762b330e774df
Instruction ID: 37d1fd507419e85b999ad4f0a80a4decbf5efb2acc5a593f8dae57e76a84c76a
Opcode Fuzzy Hash: 3f2b91d9c851a8f80d8b38c848f79e4cc919e129953d6b9e397762b330e774df
Instruction Fuzzy Hash: 8201B171600200ABD310DF16CD46B66FBE8EB88A20F14856AEC089BB41D731F915CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 009FBDAA Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 009FBDEE

Memory Dump Source

Source File: 00000001.00000002.4153788955.00000000009FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 009FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9fa000_WindowsServices.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 35de0ef897a299262812b43f975ad5655d33479951f37891e15a368249bf24eb
Instruction ID: 4cc737e129688b5bccfac9e4f15ca1d42041472b3e33ffb7e6ec88ae7006be22
Opcode Fuzzy Hash: 35de0ef897a299262812b43f975ad5655d33479951f37891e15a368249bf24eb
Instruction Fuzzy Hash: 330184329007049FDB218F55D944B66FBE4EF48710F08C8AADE454AA52D376E414DFA2

Uniqueness

Uniqueness Score: -1.00%

Function 009FA74E Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 009FA780

Memory Dump Source

Source File: 00000001.00000002.4153788955.00000000009FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 009FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9fa000_WindowsServices.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: c485e158c233c70ff6aa1d1b50a04422c6a6e7a46e2909d6ffa3a9274654b6ed
Instruction ID: 3f888029233e184473bcc1cb78c650626e244bdc9971cd85571552b59f8738b0
Opcode Fuzzy Hash: c485e158c233c70ff6aa1d1b50a04422c6a6e7a46e2909d6ffa3a9274654b6ed
Instruction Fuzzy Hash: 100184B59002448FEB109F15D985B66FBE4DF04720F08C8BBDD498BB56D679E904CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 009FB946 Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 009FB978

Memory Dump Source

Source File: 00000001.00000002.4153788955.00000000009FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 009FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9fa000_WindowsServices.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 2dcf754a557f8eec7a6574b25659e76eb660d79b3be545ab7cc03aee26140b65
Instruction ID: 1feb30cd27ae858a082cd857506ed2d02ac4e23255b5be53ef600fed04557442
Opcode Fuzzy Hash: 2dcf754a557f8eec7a6574b25659e76eb660d79b3be545ab7cc03aee26140b65
Instruction Fuzzy Hash: 9301B1715042048FDB20CF19D984766BBE4DF04324F08C4AADE498BB42D7B9E548CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 01050A4E Relevance: 1.5, APIs: 1, Instructions: 43registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,?,?), ref: 01050A9E

Memory Dump Source

Source File: 00000001.00000002.4155681187.0000000001050000.00000040.00000800.00020000.00000000.sdmp, Offset: 01050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1050000_WindowsServices.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 5b7bc31d4d73009439347995dab4ac348901bf9235b16ffb50619e70550643db
Instruction ID: cda5d9d9846f7c037249efabf444c4178aaec698ff0fe969dae6506010702fac
Opcode Fuzzy Hash: 5b7bc31d4d73009439347995dab4ac348901bf9235b16ffb50619e70550643db
Instruction Fuzzy Hash: A401DB715002006BD310DF16CD46B66FBE8FB88B20F14815ADC0857741D771F515CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 0105019E Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

MkParseDisplayName.OLE32(?,00000E24,?,?), ref: 010501EE

Memory Dump Source

Source File: 00000001.00000002.4155681187.0000000001050000.00000040.00000800.00020000.00000000.sdmp, Offset: 01050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1050000_WindowsServices.jbxd

Similarity

API ID: DisplayNameParse
String ID:
API String ID: 3580041360-0
Opcode ID: 02d96320034a41b363851ecc185e5b522c436e1e8c6fb720561f410ea0bcae98
Instruction ID: 83569572782e13c219a42f4f1a8499be45eecd0804361f06aab7bfc3bade5fd3
Opcode Fuzzy Hash: 02d96320034a41b363851ecc185e5b522c436e1e8c6fb720561f410ea0bcae98
Instruction Fuzzy Hash: F001DB715002006BD310DF16CD46B66FBE8FB88B20F14815ADC0857741D771F515CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 010533EE Relevance: 1.5, APIs: 1, Instructions: 43registryCOMMON

Download Yara Rule

APIs

RegEnumValueW.KERNELBASE(?,00000E24,?,?), ref: 0105343E

Memory Dump Source

Source File: 00000001.00000002.4155681187.0000000001050000.00000040.00000800.00020000.00000000.sdmp, Offset: 01050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1050000_WindowsServices.jbxd

Similarity

API ID: EnumValue
String ID:
API String ID: 2814608202-0
Opcode ID: 9a8c8ffbaa4ed4e5afabc99569b2cb2db3d0689b003268367ea4ac828d68d2b7
Instruction ID: 5019e1b7b768937bc28483d70ceb77c8e43a72494d6fdc9f97dc74936869fbc4
Opcode Fuzzy Hash: 9a8c8ffbaa4ed4e5afabc99569b2cb2db3d0689b003268367ea4ac828d68d2b7
Instruction Fuzzy Hash: E601DB715002006BD310DF16CD46B66FBE8FB88B20F14815ADC0857741D771F515CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 009FA09A Relevance: 1.5, APIs: 1, Instructions: 42networkCOMMON

Download Yara Rule

APIs

send.WS2_32(?,?,?,?), ref: 009FA0D5

Memory Dump Source

Source File: 00000001.00000002.4153788955.00000000009FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 009FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9fa000_WindowsServices.jbxd

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: a78901ec1e06a109d1eca4541bfc7d61d6da72fa08fc3cf0a43fe6f4a67f30a0
Instruction ID: ea47d55bd6d6ca27454c466e86e17cf1f86c3cc4761a6a1eb4f2cc7247f0d098
Opcode Fuzzy Hash: a78901ec1e06a109d1eca4541bfc7d61d6da72fa08fc3cf0a43fe6f4a67f30a0
Instruction Fuzzy Hash: 4F01D4715042449FDB20CF55D944B62FBE4EF04324F08C8AADE498BA52D779E418CF72

Uniqueness

Uniqueness Score: -1.00%

Function 009FACBA Relevance: 1.5, APIs: 1, Instructions: 39comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(?), ref: 009FACEC

Memory Dump Source

Source File: 00000001.00000002.4153788955.00000000009FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 009FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9fa000_WindowsServices.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: c575fd9dc685b640e16352a8360d4b1984fcdc190a54ad32451f179b0de79b4e
Instruction ID: 71d541fdada3c41d3ad9325c52ae4d5ad13bc5fc49664abd671d258f27890228
Opcode Fuzzy Hash: c575fd9dc685b640e16352a8360d4b1984fcdc190a54ad32451f179b0de79b4e
Instruction Fuzzy Hash: D801D6B19042448FEB20CF15D984766FBE4EF04321F18C8AADD498FB46D279A504CF62

Uniqueness

Uniqueness Score: -1.00%

Function 009FA2FE Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(?), ref: 009FA330

Memory Dump Source

Source File: 00000001.00000002.4153788955.00000000009FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 009FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9fa000_WindowsServices.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 0eba1c1fda012c7551392e0dc2d8ec61915c4b7b608952f24ccac63480069987
Instruction ID: f1b921de2cfce3cab7370bfeb80f7b72de1bd24dfc9fa8d5f47e6b98029fafb3
Opcode Fuzzy Hash: 0eba1c1fda012c7551392e0dc2d8ec61915c4b7b608952f24ccac63480069987
Instruction Fuzzy Hash: B6F0A475904244CFDB208F09D984761FBE4EF04724F08C4AADE494B752D2B9A408CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 00E313E7 Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 00E3141F

Memory Dump Source

Source File: 00000001.00000002.4155482918.0000000000E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e30000_WindowsServices.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 832e2b90ea030c24be8e237b9607650cfc395022194f0c6de6e534764f986a43
Instruction ID: da336cbbe50d2bb218fa5bd3cfb57542b63a6f649da208e233e22fd2a8861ded
Opcode Fuzzy Hash: 832e2b90ea030c24be8e237b9607650cfc395022194f0c6de6e534764f986a43
Instruction Fuzzy Hash: 80F0AF30E042458ECF61EF79898949EBFF6AB89300B1486AAC405EB611EB348906CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 00E313F8 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 00E3141F

Memory Dump Source

Source File: 00000001.00000002.4155482918.0000000000E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e30000_WindowsServices.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: af36d55dc11870720f061e8ddc35eb1a05b448f41724cf1f269ba68dadafe77f
Instruction ID: 41a68a375b34f73e6d2df41846bd5045d279f0ce6f4a947198716e04cbcfef1a
Opcode Fuzzy Hash: af36d55dc11870720f061e8ddc35eb1a05b448f41724cf1f269ba68dadafe77f
Instruction Fuzzy Hash: 98F01270E002099FCF54EF79C94959EFFF6AB88340B10853AD409E3714EB349A05CB91

Uniqueness

Uniqueness Score: -1.00%

Function 010608CB Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4155717453.0000000001060000.00000040.00000020.00020000.00000000.sdmp, Offset: 01060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1060000_WindowsServices.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 301299577e4a55f5a00d3a9c661dec28d283ab4b3bf537eab6512314fdab739d
Instruction ID: e1cc4cdb704c3ed9069dcb5d2e1dd3781ea92ba3368ae44d68eb5bc809b7ddae
Opcode Fuzzy Hash: 301299577e4a55f5a00d3a9c661dec28d283ab4b3bf537eab6512314fdab739d
Instruction Fuzzy Hash: 3D21D3341493C0DFD713CB14C950B11BFF5AB46308F1985EEE8844BA63C77A9806CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 053327C8 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4158902676.0000000005330000.00000040.00000800.00020000.00000000.sdmp, Offset: 05330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5330000_WindowsServices.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6ed0cb4b4641fe5d91e454c240f6b239cc53c980664aac6379121e78e137ce7
Instruction ID: 6673cef4e7e593b7406fdcff936105527c1f92adb3aa41472ed737d10c212409
Opcode Fuzzy Hash: e6ed0cb4b4641fe5d91e454c240f6b239cc53c980664aac6379121e78e137ce7
Instruction Fuzzy Hash: 9511EAB5908341AFD350CF19D840A5BFBE4FB88664F04896EF998D7311D231E9148FA2

Uniqueness

Uniqueness Score: -1.00%

Function 01060904 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4155717453.0000000001060000.00000040.00000020.00020000.00000000.sdmp, Offset: 01060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1060000_WindowsServices.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 189898c8faae87859b195b1f66a9f5b803bf2f31cc94ceb7db5fbed20d08b831
Instruction ID: 4b586cc5e7c2558da528e6807b477f551bb766d4c6007cdbb9560ea02453d911
Opcode Fuzzy Hash: 189898c8faae87859b195b1f66a9f5b803bf2f31cc94ceb7db5fbed20d08b831
Instruction Fuzzy Hash: F411E4302842849FE715CB14D540B26FBEAAB8970CF24C9ACF5891BB47C77BD803CA61

Uniqueness

Uniqueness Score: -1.00%

Function 00A0B940 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4153940785.0000000000A0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A0A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a0a000_WindowsServices.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c26d3a39f79a8c342c501818c5b4fc3733dd67d10677f26d5cea0eb6cafc770
Instruction ID: 9afe66ec74cccd5db2e7dc006262f11aca1e0c9b70c1b0f7d8dbc82aeb58770a
Opcode Fuzzy Hash: 0c26d3a39f79a8c342c501818c5b4fc3733dd67d10677f26d5cea0eb6cafc770
Instruction Fuzzy Hash: 9E11FAB5908301AFD350CF09DD40E57FBE8EB98660F048D2EF95997711D271E9188FA2

Uniqueness

Uniqueness Score: -1.00%

Function 010605E0 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4155717453.0000000001060000.00000040.00000020.00020000.00000000.sdmp, Offset: 01060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1060000_WindowsServices.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a933ba6eb060931c736b640a548c2cc51072c051999f626fda474d749292e9c4
Instruction ID: a2d36232d155c1aaa1d9533bd171b2ae1b1caec9cfcf32db8f779e72e7861861
Opcode Fuzzy Hash: a933ba6eb060931c736b640a548c2cc51072c051999f626fda474d749292e9c4
Instruction Fuzzy Hash: F501D6754097846FD7118B16AC40863FFF8DF86220709C4EFEC498BA12D225A809CB72

Uniqueness

Uniqueness Score: -1.00%

Function 010609C0 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4155717453.0000000001060000.00000040.00000020.00020000.00000000.sdmp, Offset: 01060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1060000_WindowsServices.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74b9f174851936b42c91253ba0377f3a0e724fe011995a5d7daf0febe73ee2ff
Instruction ID: e62317526a1f96e6bbae726bbf74047ec6ff05f41e3fb0bf7a35149d1531ee40
Opcode Fuzzy Hash: 74b9f174851936b42c91253ba0377f3a0e724fe011995a5d7daf0febe73ee2ff
Instruction Fuzzy Hash: 58F0FB35144644DFC206CB04D540B15FBE6EB89718F24CAADE98907756C737D812DA91

Uniqueness

Uniqueness Score: -1.00%

Function 01060606 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4155717453.0000000001060000.00000040.00000020.00020000.00000000.sdmp, Offset: 01060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1060000_WindowsServices.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e87aaed5d8d179cb853c49ede2e00b07b0b3d8460d69e95f0b99455831b6662
Instruction ID: c79238417057f4a9d783450363f806e10c10f2e8c723ff4926be1f1ef802b993
Opcode Fuzzy Hash: 6e87aaed5d8d179cb853c49ede2e00b07b0b3d8460d69e95f0b99455831b6662
Instruction Fuzzy Hash: CCE092B66006044B9650CF0BED41452F7D8EB88630B08C47FDC0D8B711E276B518CEA6

Uniqueness

Uniqueness Score: -1.00%

Function 05332833 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4158902676.0000000005330000.00000040.00000800.00020000.00000000.sdmp, Offset: 05330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5330000_WindowsServices.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6245ca5bb8220c5acf99aa9b34ca67b65266399713457795e0267375cba4a6c
Instruction ID: 07a5aa6b68e3688fa686ea8f578337a8ba5d2076b0e8c7d5b505dbd42c984af7
Opcode Fuzzy Hash: f6245ca5bb8220c5acf99aa9b34ca67b65266399713457795e0267375cba4a6c
Instruction Fuzzy Hash: B9E0D8B254120467D2108E0A9C45F53FB9CDB54931F04C46BED081B742E172B51489E5

Uniqueness

Uniqueness Score: -1.00%

Function 053320DF Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4158902676.0000000005330000.00000040.00000800.00020000.00000000.sdmp, Offset: 05330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5330000_WindowsServices.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6a876ebb59a32bd654e671f03eaa740c1c39d3afc5a9a2765bedb6a1ec4f6b9
Instruction ID: 39c6a73bc3ad1f398df912a32dd09ce49e41978efe7ad9f1700dfdc504dc5e9c
Opcode Fuzzy Hash: f6a876ebb59a32bd654e671f03eaa740c1c39d3afc5a9a2765bedb6a1ec4f6b9
Instruction Fuzzy Hash: 05E0D8B250020467D2109E0AAC45F53FB98DB50930F08C467EE091B702E172B514CDE5

Uniqueness

Uniqueness Score: -1.00%

Function 00A0B98F Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4153940785.0000000000A0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A0A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a0a000_WindowsServices.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5c37b146dd0f8cf744a2c4411daa4b5c152ecff59c62c5846876a8fba627fe0
Instruction ID: ff5420e88ea08d5bb2e8bd2a855dfef5cb023197a05ccbada66491bd11ded211
Opcode Fuzzy Hash: b5c37b146dd0f8cf744a2c4411daa4b5c152ecff59c62c5846876a8fba627fe0
Instruction Fuzzy Hash: 44E020B254020467D2108F079D45F53F79CDB50931F04C567EE091B702E172B514CDF6

Uniqueness

Uniqueness Score: -1.00%

Function 009F23F4 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4153770720.00000000009F2000.00000040.00000800.00020000.00000000.sdmp, Offset: 009F2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9f2000_WindowsServices.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01d278d3428de0228fae0a8a7fb9d6d08d2d33197362cac0b5c9ab538aeb215e
Instruction ID: 122989b8a4623e4b6a0e9cef47735067dc8c65bf82ed7b6cfa9387d8470ea47b
Opcode Fuzzy Hash: 01d278d3428de0228fae0a8a7fb9d6d08d2d33197362cac0b5c9ab538aeb215e
Instruction Fuzzy Hash: D4D05E79209AD54FD3279B1CC6A4BA537D8AB51714F4A44FAA800CB773C7A8D981D610

Uniqueness

Uniqueness Score: -1.00%

Function 009F23BC Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4153770720.00000000009F2000.00000040.00000800.00020000.00000000.sdmp, Offset: 009F2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9f2000_WindowsServices.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72f9cbefc1087d96efd2e8b29d47b998b60d9f4b5a7a5486528bad1df5b69333
Instruction ID: e62f96d106523c84b07ea66df26bf369f50ab22a2b95e1d79cbe8bc3dc676bb3
Opcode Fuzzy Hash: 72f9cbefc1087d96efd2e8b29d47b998b60d9f4b5a7a5486528bad1df5b69333
Instruction Fuzzy Hash: 77D05E742006854BC725DB0CC2D4F6977D8AB40B14F0644E8AC108B762C7B8D8C4DA00

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: WindowsServices.exePID: 7884, Parent PID: 2580COMMON

Execution Graph

Execution Coverage:	15.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	12
Total number of Limit Nodes:	0

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 04A20278 Relevance: 2.0, Strings: 1, Instructions: 758
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

ax, xrefs: 04A20584

Memory Dump Source

Source File: 00000007.00000002.1985721211.0000000004A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4a20000_WindowsServices.jbxd

Similarity

API ID:
String ID: ax
API String ID: 0-3322492788
Opcode ID: db87d8bb0e27d45868fe51296f391a9528bcf98fca051552d9c5c185d30cc007
Instruction ID: f5ca233c1051808510d71ff88545514435031cba9fa6d22a81f5c0d2a9dded17
Opcode Fuzzy Hash: db87d8bb0e27d45868fe51296f391a9528bcf98fca051552d9c5c185d30cc007
Instruction Fuzzy Hash: 1EA16D70A01228CFDB24EF78D954BADB7B2AF44304F1084E9D509AB391DB39AE85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0077A612 Relevance: 1.6, APIs: 1, Instructions: 89
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexW.KERNELBASE(?,?), ref: 0077A6B9

Memory Dump Source

Source File: 00000007.00000002.1985057732.000000000077A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0077A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_77a000_WindowsServices.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: 4bb004944014b44eb696cb9124e3bf01f760814242737eae16bbe90fe6e30ea4
Instruction ID: 6dca62f3289f6f73e8b4b76ae319adab1f835e456de13f80eff405ed649f4b35
Opcode Fuzzy Hash: 4bb004944014b44eb696cb9124e3bf01f760814242737eae16bbe90fe6e30ea4
Instruction Fuzzy Hash: E03195755093806FE721CB25DC45B96BFF8EF06314F08849AE984CF692D375E909C762

Uniqueness

Uniqueness Score: -1.00%

Function 0077A361 Relevance: 1.6, APIs: 1, Instructions: 85
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,1E518A44,00000000,00000000,00000000,00000000), ref: 0077A40C

Memory Dump Source

Source File: 00000007.00000002.1985057732.000000000077A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0077A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_77a000_WindowsServices.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: cbbe1b40550da19b979348b163eef2e2c784d95f8a1377fde166259e1443586a
Instruction ID: 20cef001121963d139ba193b6e5f00ee4965b3b7005dfa5db130690e60113b36
Opcode Fuzzy Hash: cbbe1b40550da19b979348b163eef2e2c784d95f8a1377fde166259e1443586a
Instruction Fuzzy Hash: C331B4715053806FE721CF15CC84F96BBF8EF45750F08849AE945CB652D324ED09CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0077A462 Relevance: 1.6, APIs: 1, Instructions: 77
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegSetValueExW.KERNELBASE(?,00000E24,1E518A44,00000000,00000000,00000000,00000000), ref: 0077A4F8

Memory Dump Source

Source File: 00000007.00000002.1985057732.000000000077A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0077A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_77a000_WindowsServices.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 36ef7a29fdba2140c2dd336b8ef22309133432fc66b59863070f57b937ea5dbc
Instruction ID: d51373822363d9b83ef23a1f181b9475821de623d86e3720f2a3cb3cd9c5babd
Opcode Fuzzy Hash: 36ef7a29fdba2140c2dd336b8ef22309133432fc66b59863070f57b937ea5dbc
Instruction Fuzzy Hash: 772192B25053806FEB228F15DC44FA7BFB8DF46714F08849AE945CB692D264E909C771

Uniqueness

Uniqueness Score: -1.00%

Function 0077A646 Relevance: 1.6, APIs: 1, Instructions: 72
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexW.KERNELBASE(?,?), ref: 0077A6B9

Memory Dump Source

Source File: 00000007.00000002.1985057732.000000000077A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0077A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_77a000_WindowsServices.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: 88ced599ed460e4cfa4ef893e5134e427aa86c6c1a5525538f69d26062017106
Instruction ID: fd9e39bb975b35d6d416ba264292d55c3b5d8b2293119b6b448d3738a4a2ea35
Opcode Fuzzy Hash: 88ced599ed460e4cfa4ef893e5134e427aa86c6c1a5525538f69d26062017106
Instruction Fuzzy Hash: DC21B371601200AFFB20CB25DD45BA6F7E8EF44354F08C869E948CB741D779E905CA72

Uniqueness

Uniqueness Score: -1.00%

Function 0077A392 Relevance: 1.6, APIs: 1, Instructions: 69
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,1E518A44,00000000,00000000,00000000,00000000), ref: 0077A40C

Memory Dump Source

Source File: 00000007.00000002.1985057732.000000000077A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0077A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_77a000_WindowsServices.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 806f80e6432d3e1cc6b086902528a24124a3695f7c568ab282356f6bd3e61452
Instruction ID: 152ea310b4cf3e5a304f4813479a433ab76b466125d16a379a7d33958db1197c
Opcode Fuzzy Hash: 806f80e6432d3e1cc6b086902528a24124a3695f7c568ab282356f6bd3e61452
Instruction Fuzzy Hash: 2A216D75600204AFEB30CF19CD84FAAB7E8EF44754F08C46AE9498B651D778E909CA72

Uniqueness

Uniqueness Score: -1.00%

Function 0077A486 Relevance: 1.6, APIs: 1, Instructions: 65
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegSetValueExW.KERNELBASE(?,00000E24,1E518A44,00000000,00000000,00000000,00000000), ref: 0077A4F8

Memory Dump Source

Source File: 00000007.00000002.1985057732.000000000077A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0077A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_77a000_WindowsServices.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 67d5326005ea370b5b7af08293c2a7c932169bb0eefc4f12a653b29f05bb54e1
Instruction ID: 0f12866d55e4905c3afaa5c928a8e6a1f1b0343ca4204da4fa6cf0e085072a06
Opcode Fuzzy Hash: 67d5326005ea370b5b7af08293c2a7c932169bb0eefc4f12a653b29f05bb54e1
Instruction Fuzzy Hash: EB11A271500300AFEB318E15CD45BABBBE8EF44754F04C46AE9498AA41D778E8088A72

Uniqueness

Uniqueness Score: -1.00%

Function 04A20268 Relevance: 1.4, Strings: 1, Instructions: 191
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

ax, xrefs: 04A20584

Memory Dump Source

Source File: 00000007.00000002.1985721211.0000000004A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4a20000_WindowsServices.jbxd

Similarity

API ID:
String ID: ax
API String ID: 0-3322492788
Opcode ID: 68b049a06f6aa6ed0ea7112ff9b15ea36f9147330c6938c0bbf30730292b59e2
Instruction ID: df43a6f5c254fbdac6987fcc06c977b5d01df83db05e57ca7b8f7d0d46944ef2
Opcode Fuzzy Hash: 68b049a06f6aa6ed0ea7112ff9b15ea36f9147330c6938c0bbf30730292b59e2
Instruction Fuzzy Hash: D3818D70A01228CFDB24EF79D944BADB7B2AF45304F1084E9D009AB395DB399E85CF61

Uniqueness

Uniqueness Score: -1.00%

Function 04A20080 Relevance: .1, Instructions: 98
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000007.00000002.1985721211.0000000004A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4a20000_WindowsServices.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5febe70eca6b7bf9ad53028233ef3efd2fe42ab708207221ca5d5b5967395c96
Instruction ID: fff03d9a1be2fa4f3bbfcced838fccc54cc0a07de7da476372f2f79b1ac0f59b
Opcode Fuzzy Hash: 5febe70eca6b7bf9ad53028233ef3efd2fe42ab708207221ca5d5b5967395c96
Instruction Fuzzy Hash: 63412F30216A42CFC724FF3DE58598977B3AF9024870098FDD0448B66FEB385949CB92

Uniqueness

Uniqueness Score: -1.00%

Function 04A20007 Relevance: .0, Instructions: 46
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000007.00000002.1985721211.0000000004A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4a20000_WindowsServices.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16f7481bd0e66b65b87bd000af9edbcbe86f85f040b3af8e48004f4598862d31
Instruction ID: fd2075aabf0639c1f2ce5624ce460b42712760d85315a36eee453682c93cab6e
Opcode Fuzzy Hash: 16f7481bd0e66b65b87bd000af9edbcbe86f85f040b3af8e48004f4598862d31
Instruction Fuzzy Hash: FE01459288E7D25FE71793786D68590BF305E6320471E41DBC1C1CF0E7E109194AE763

Uniqueness

Uniqueness Score: -1.00%

Function 007A05E0 Relevance: .0, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000007.00000002.1985132797.00000000007A0000.00000040.00000020.00020000.00000000.sdmp, Offset: 007A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7a0000_WindowsServices.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0c832fe52f0daa90896a4cb0226522b324890c35341609fedc7a853c06ac185
Instruction ID: 508ac0c7a2ad505b7246264859f85b3742ab43dba73a66fc167cdfd8a0fdc967
Opcode Fuzzy Hash: f0c832fe52f0daa90896a4cb0226522b324890c35341609fedc7a853c06ac185
Instruction Fuzzy Hash: 0CF0A9B65093805FD7118B069C40862FFE8EF86630709C4AFEC498B752D225AD08C7B1

Uniqueness

Uniqueness Score: -1.00%

Function 007A0606 Relevance: .0, Instructions: 27
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000007.00000002.1985132797.00000000007A0000.00000040.00000020.00020000.00000000.sdmp, Offset: 007A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7a0000_WindowsServices.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8834157be76b63b3a59840924e28185c6c31f4099c60ad89d6968e49833b78f7
Instruction ID: be2817081d3b338be6cc4992640b57931a329d22f7664675f4749357a5bb7e8e
Opcode Fuzzy Hash: 8834157be76b63b3a59840924e28185c6c31f4099c60ad89d6968e49833b78f7
Instruction Fuzzy Hash: 6EE092B66016004B9650CF0AEC81452F7D8EB88630B08C47FDC0D8B711D235B908CAA5

Uniqueness

Uniqueness Score: -1.00%

Function 007723F4 Relevance: .0, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000007.00000002.1985042393.0000000000772000.00000040.00000800.00020000.00000000.sdmp, Offset: 00772000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_772000_WindowsServices.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b64c5752112e1acae121709183c4fd73bd5cb0735312c4f465484c83e2bf3b36
Instruction ID: f72a670f6cb35aa2a40e4f84a0129b48695c664820f92450a85d13d34d6f8a05
Opcode Fuzzy Hash: b64c5752112e1acae121709183c4fd73bd5cb0735312c4f465484c83e2bf3b36
Instruction Fuzzy Hash: 2CD02E7A300AC08FD7228A0CC2A4B8537D4AB40704F0A88F9A800CB763C72CDD82C200

Uniqueness

Uniqueness Score: -1.00%

Function 007723BC Relevance: .0, Instructions: 14
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000007.00000002.1985042393.0000000000772000.00000040.00000800.00020000.00000000.sdmp, Offset: 00772000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_772000_WindowsServices.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3407b877634b8f91746a4dfb54b895d5acddd0b11c0920fae7fee579a04b8478
Instruction ID: dc93c4714e61aaa212765f0a085f794c8b6756012ae624c95b49399dc163ab66
Opcode Fuzzy Hash: 3407b877634b8f91746a4dfb54b895d5acddd0b11c0920fae7fee579a04b8478
Instruction Fuzzy Hash: 15D05E342006814BCB25DA0CC2D4F5977D4AB40714F0684ECAC208B763C7BCD8C1DA00

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: WindowsServices.exePID: 8004, Parent PID: 2580COMMON

Execution Graph

Execution Coverage:	11%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	19
Total number of Limit Nodes:	1

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 055F0278 Relevance: 4.5, Strings: 3, Instructions: 758
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

%\#k^, xrefs: 055F068D, 055F0692
E\#k^, xrefs: 055F0530, 055F0535
5\#k^, xrefs: 055F05C1, 055F05C6

Memory Dump Source

Source File: 00000008.00000002.2077895062.00000000055F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_55f0000_WindowsServices.jbxd

Similarity

API ID:
String ID: %\#k^$5\#k^$E\#k^
API String ID: 0-2580760940
Opcode ID: 5f4ef81fb7f075cd95333c36edba427839a395fb7258cfbb79c0e01d24597455
Instruction ID: 06b1541aeb0d167daf8d821599b3cd4d8bdcd362a7d24a290d494f93323d18c3
Opcode Fuzzy Hash: 5f4ef81fb7f075cd95333c36edba427839a395fb7258cfbb79c0e01d24597455
Instruction Fuzzy Hash: 15A14A74A01228CFDB24DF75C854BADBBB2BF45304F1084A9E50AAB3A1DB399D85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 055F0268 Relevance: 3.9, Strings: 3, Instructions: 192
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

%\#k^, xrefs: 055F068D, 055F0692
E\#k^, xrefs: 055F0530, 055F0535
5\#k^, xrefs: 055F05C1, 055F05C6

Memory Dump Source

Source File: 00000008.00000002.2077895062.00000000055F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_55f0000_WindowsServices.jbxd

Similarity

API ID:
String ID: %\#k^$5\#k^$E\#k^
API String ID: 0-2580760940
Opcode ID: fc314142d22144490550e33533b06524a3b3ce56b93bffa927cfad8e5e1ea22d
Instruction ID: 40a9ea99c635d0f9d738a72361b16fd06d0c237531fd3be3eca1e9725f7eae5c
Opcode Fuzzy Hash: fc314142d22144490550e33533b06524a3b3ce56b93bffa927cfad8e5e1ea22d
Instruction Fuzzy Hash: 21815970A01228CFDB24DF75C844BADBBB2BF45304F1084A9E50AAB3A1DB399D95CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0162A612 Relevance: 1.6, APIs: 1, Instructions: 89
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexW.KERNELBASE(?,?), ref: 0162A6B9

Memory Dump Source

Source File: 00000008.00000002.2077374156.000000000162A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0162A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_162a000_WindowsServices.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: 688ffbac1eff694d5103cc1565bfa56090c1c1848a28e79f204996e045ecee52
Instruction ID: 3399ce402678a4383c9dc6671ceb8dfec9fb4192f483d72cbb7138730841797c
Opcode Fuzzy Hash: 688ffbac1eff694d5103cc1565bfa56090c1c1848a28e79f204996e045ecee52
Instruction Fuzzy Hash: D931D3755097805FE722CB65CC85B96BFF8EF06210F08849AE984CF693D375E909CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0162A361 Relevance: 1.6, APIs: 1, Instructions: 85
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,788B9063,00000000,00000000,00000000,00000000), ref: 0162A40C

Memory Dump Source

Source File: 00000008.00000002.2077374156.000000000162A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0162A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_162a000_WindowsServices.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: b80f3694279f63247ae2abd248a64607b8d3845a5b6d4a66bddde37be8010753
Instruction ID: 7ae0487c4031c71f3605914f95bc849e6930c4fde624bd947fd6495ab2e2c72e
Opcode Fuzzy Hash: b80f3694279f63247ae2abd248a64607b8d3845a5b6d4a66bddde37be8010753
Instruction Fuzzy Hash: AB317175505780AFE722CF55CC84F96BFF8EF06610F08849AE985CB692D364E909CB71

Uniqueness

Uniqueness Score: -1.00%

Function 0162A462 Relevance: 1.6, APIs: 1, Instructions: 77
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegSetValueExW.KERNELBASE(?,00000E24,788B9063,00000000,00000000,00000000,00000000), ref: 0162A4F8

Memory Dump Source

Source File: 00000008.00000002.2077374156.000000000162A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0162A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_162a000_WindowsServices.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 21113ed0ddbe139cd383339025ced310eeb050ad1f6deb887cd58f11de35898e
Instruction ID: f102c3a8e22bd12394a38a8b8131b6524e4b792e0c708d535aa1386c746f5387
Opcode Fuzzy Hash: 21113ed0ddbe139cd383339025ced310eeb050ad1f6deb887cd58f11de35898e
Instruction Fuzzy Hash: B421E0721047806FE7228F54CC44FA7BFB8EF06210F08849AE985CBA92C364E809CB71

Uniqueness

Uniqueness Score: -1.00%

Function 0162A646 Relevance: 1.6, APIs: 1, Instructions: 72
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexW.KERNELBASE(?,?), ref: 0162A6B9

Memory Dump Source

Source File: 00000008.00000002.2077374156.000000000162A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0162A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_162a000_WindowsServices.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: 61b3232458ed0d5973f222869c59760349d7656688c12675ba668a4119317ead
Instruction ID: e9c1e8eae84dd469aab0dbee61d0b1d5bc6ddcc326cd37bfb020cc37c3fb34d2
Opcode Fuzzy Hash: 61b3232458ed0d5973f222869c59760349d7656688c12675ba668a4119317ead
Instruction Fuzzy Hash: E621C2756006109FE720CF69DD85BA6FBE8EF04214F04C869E9458BB42D7B5E509CEB1

Uniqueness

Uniqueness Score: -1.00%

Function 0162A392 Relevance: 1.6, APIs: 1, Instructions: 69
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,788B9063,00000000,00000000,00000000,00000000), ref: 0162A40C

Memory Dump Source

Source File: 00000008.00000002.2077374156.000000000162A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0162A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_162a000_WindowsServices.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 4b7b435fe76d1675ce98024ca7a062f7e53e1dd016e30792bb8ff5ac7f6375e7
Instruction ID: 937cfd2675f9759f364ec346811eac2b5f700389fe0a60ed13323afd80269d1e
Opcode Fuzzy Hash: 4b7b435fe76d1675ce98024ca7a062f7e53e1dd016e30792bb8ff5ac7f6375e7
Instruction Fuzzy Hash: 64216D756006049FE731CE59CD84FA6FBECEF04610F04846AE945CBB51D7A4E909CA71

Uniqueness

Uniqueness Score: -1.00%

Function 0162A710 Relevance: 1.6, APIs: 1, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 0162A780

Memory Dump Source

Source File: 00000008.00000002.2077374156.000000000162A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0162A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_162a000_WindowsServices.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: add871f3e4a2634f30ec1d8506fc219af1b6a3fee4beefdb476ad12c93339034
Instruction ID: 538938b5945dbaefaf6422473b5b1503b2d279794d3fa82e23016f4a6076fc16
Opcode Fuzzy Hash: add871f3e4a2634f30ec1d8506fc219af1b6a3fee4beefdb476ad12c93339034
Instruction Fuzzy Hash: 3A21D1B55083809FD7128F15DC85752BFB8EF02324F0984DBDC858F693D2759905CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0162A486 Relevance: 1.6, APIs: 1, Instructions: 65
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegSetValueExW.KERNELBASE(?,00000E24,788B9063,00000000,00000000,00000000,00000000), ref: 0162A4F8

Memory Dump Source

Source File: 00000008.00000002.2077374156.000000000162A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0162A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_162a000_WindowsServices.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: ecf1046ea612a8f5a3e3e959573b490b949497b9a4ceb9c476bf4387dff2094e
Instruction ID: 836e709e17d5aad3f4b3638fb9b62aeb448af429edb862f8dfe05caa0614f611
Opcode Fuzzy Hash: ecf1046ea612a8f5a3e3e959573b490b949497b9a4ceb9c476bf4387dff2094e
Instruction Fuzzy Hash: 8711AF72500600AFE7318E59DD45BA7BBECEF04614F04846AED459BB41D7B4E509CAB1

Uniqueness

Uniqueness Score: -1.00%

Function 0162A74E Relevance: 1.5, APIs: 1, Instructions: 43
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 0162A780

Memory Dump Source

Source File: 00000008.00000002.2077374156.000000000162A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0162A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_162a000_WindowsServices.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 4e4f2e0e1db73bde378ba9f43a94d879516455bf328d6bcb71a22c9aa14930fa
Instruction ID: 3d2756b3805e9aadd0d03e78cc47be0d6c49f0918d7e6966050d700ba55554b8
Opcode Fuzzy Hash: 4e4f2e0e1db73bde378ba9f43a94d879516455bf328d6bcb71a22c9aa14930fa
Instruction Fuzzy Hash: F901BC75A006008FEB208F59DD84766FBA4DF04220F08C4AADC4A8FB42D7B8A408CEA1

Uniqueness

Uniqueness Score: -1.00%

Function 055F0080 Relevance: .1, Instructions: 99
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.2077895062.00000000055F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_55f0000_WindowsServices.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a3fdd0653dbbb45da61484ee7078daed5dd1b27412df3cceffb31b57cd83733
Instruction ID: 66ddcbfc9f6e827139ca8759bcda2eb2b9d794ff921f4d4005d3529ee5ab02a2
Opcode Fuzzy Hash: 5a3fdd0653dbbb45da61484ee7078daed5dd1b27412df3cceffb31b57cd83733
Instruction Fuzzy Hash: 74414534A062828FD724DF38E55498A7FF2FF95248740887DE1044B76AEB7C5C69DB81

Uniqueness

Uniqueness Score: -1.00%

Function 016305E0 Relevance: .1, Instructions: 79
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.2077393574.0000000001630000.00000040.00000020.00020000.00000000.sdmp, Offset: 01630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1630000_WindowsServices.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76a2836eb1468a556deebec5cac633c29558d1d2bf19398b296c8314aaf2a042
Instruction ID: 49cf45260b6d9b1ecb11fa70f62a268b9f0281d1de53ddd46ec37a37695a81d1
Opcode Fuzzy Hash: 76a2836eb1468a556deebec5cac633c29558d1d2bf19398b296c8314aaf2a042
Instruction Fuzzy Hash: 8F0196B150D3806FC7138B25DD51862BFB8DE8726070984EBE849CF663E225A909C7B2

Uniqueness

Uniqueness Score: -1.00%

Function 055F0006 Relevance: .0, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.2077895062.00000000055F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_55f0000_WindowsServices.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcb3a799e4a3ecf9a152d6609ee9bd76af2ead41cb623ed9612a424e227a7ef4
Instruction ID: 724b60a0e16ef250771d1ba7f3cf07ec3aa719e141a004c4b680709f6854e8e1
Opcode Fuzzy Hash: bcb3a799e4a3ecf9a152d6609ee9bd76af2ead41cb623ed9612a424e227a7ef4
Instruction Fuzzy Hash: D3015F6654E3D08FD3034B68DCA16883FB0AF57224B4E05E7C0C0CB6A3D25C595AD722

Uniqueness

Uniqueness Score: -1.00%

Function 01630606 Relevance: .0, Instructions: 27
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.2077393574.0000000001630000.00000040.00000020.00020000.00000000.sdmp, Offset: 01630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1630000_WindowsServices.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d079cdfc57294d9d7a588b497b4ab308ce1e43fe029b30a4455a63ee35a92ad1
Instruction ID: 4ff23f724e6b72151e998833ee51dc2e93323a139077933cbf1ec6e8576d0ea0
Opcode Fuzzy Hash: d079cdfc57294d9d7a588b497b4ab308ce1e43fe029b30a4455a63ee35a92ad1
Instruction Fuzzy Hash: 91E092B66006004B9660CF0AFC81452F7D8EB88630708C47FDC0D8B711E239B509CAE5

Uniqueness

Uniqueness Score: -1.00%

Function 016223F4 Relevance: .0, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.2077356344.0000000001622000.00000040.00000800.00020000.00000000.sdmp, Offset: 01622000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1622000_WindowsServices.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0fc5db715550f352a6b4ce5a8ac7abba2da755b2f693d75144275363fe829e8
Instruction ID: 410bca324fc19905c29cf192807dc71d6d50f705a02b1b24a91937a3a5bf2dd6
Opcode Fuzzy Hash: d0fc5db715550f352a6b4ce5a8ac7abba2da755b2f693d75144275363fe829e8
Instruction Fuzzy Hash: 67D05E79206AE14FE3269A1CCAA4B953BE4AB51714F4A44FEEC00CB763C768D5D1DA10

Uniqueness

Uniqueness Score: -1.00%

Function 016223BC Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2077356344.0000000001622000.00000040.00000800.00020000.00000000.sdmp, Offset: 01622000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1622000_WindowsServices.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ceb5305a9e34f6d34f54a1a1153aca3e4baf286757cd9e335dee6b30b54140b
Instruction ID: 910ebf214cbd2111439c494d744b76213b946ce6e86a6144372e83e8fe24195a
Opcode Fuzzy Hash: 5ceb5305a9e34f6d34f54a1a1153aca3e4baf286757cd9e335dee6b30b54140b
Instruction Fuzzy Hash: 43D05E342006814BD729DA0CC6E4F597BD4AF40714F0644ECAC108B762C7B4D8C0DE00

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: WindowsServices.exePID: 8064, Parent PID: 2580COMMON

Execution Graph

Execution Coverage:	14%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	19
Total number of Limit Nodes:	1

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 014B0278 Relevance: 4.5, Strings: 3, Instructions: 758
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

5\|k^, xrefs: 014B05C1, 014B05C6
%\|k^, xrefs: 014B068D, 014B0692
E\|k^, xrefs: 014B0530, 014B0535

Memory Dump Source

Source File: 00000009.00000002.2159544847.00000000014B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_14b0000_WindowsServices.jbxd

Similarity

API ID:
String ID: %\|k^$5\|k^$E\|k^
API String ID: 0-1137456559
Opcode ID: c43443446de1ae85e65b015aa2814522eff527c2658f2e6162eb81a6d3884a2e
Instruction ID: a6769d22cf4588ade34e2db1eebb95b3468a186f1397f43fc0f3b5e352a7da4d
Opcode Fuzzy Hash: c43443446de1ae85e65b015aa2814522eff527c2658f2e6162eb81a6d3884a2e
Instruction Fuzzy Hash: D5A14B70A01218CFDB24DF79C894BEEB7B2AF45305F1084A9E449AB361DB399D85CF60

Uniqueness

Uniqueness Score: -1.00%

Function 014B0268 Relevance: 3.9, Strings: 3, Instructions: 190
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

5\|k^, xrefs: 014B05C1, 014B05C6
%\|k^, xrefs: 014B068D, 014B0692
E\|k^, xrefs: 014B0530, 014B0535

Memory Dump Source

Source File: 00000009.00000002.2159544847.00000000014B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_14b0000_WindowsServices.jbxd

Similarity

API ID:
String ID: %\|k^$5\|k^$E\|k^
API String ID: 0-1137456559
Opcode ID: df37a068edd6668ae9b5e360c1e1fa5642530052fa4921a9b8ba2abf73a92221
Instruction ID: 9108f7cdb638eb36e48a556417ae7b15a762d2395ecd532b475598bb2e4573e9
Opcode Fuzzy Hash: df37a068edd6668ae9b5e360c1e1fa5642530052fa4921a9b8ba2abf73a92221
Instruction Fuzzy Hash: FE814B70A01218CFDB24DF75C994BEDB7B2AF45305F1084A9E449AB3A0DB399D89CF61

Uniqueness

Uniqueness Score: -1.00%

Function 010AA612 Relevance: 1.6, APIs: 1, Instructions: 89
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexW.KERNELBASE(?,?), ref: 010AA6B9

Memory Dump Source

Source File: 00000009.00000002.2159058495.00000000010AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 010AA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10aa000_WindowsServices.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: ecc590a40d5add680ae338028ffe0dbcfe7683fb5ffb773b0c421ebf4c78d6e2
Instruction ID: ad939d1a9a0d9e099a7613c9fa83ea29ee98c2a4fe07069bd01d99648db43403
Opcode Fuzzy Hash: ecc590a40d5add680ae338028ffe0dbcfe7683fb5ffb773b0c421ebf4c78d6e2
Instruction Fuzzy Hash: 623195715093805FE712CB65DC45B56BFF8EF06214F08849AE984CB693D375A909C761

Uniqueness

Uniqueness Score: -1.00%

Function 010AA361 Relevance: 1.6, APIs: 1, Instructions: 85
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,98A9372A,00000000,00000000,00000000,00000000), ref: 010AA40C

Memory Dump Source

Source File: 00000009.00000002.2159058495.00000000010AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 010AA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10aa000_WindowsServices.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: f9bb0c18178c7763a18e91096aa994ea1649b54a1f3fd466ca24196182e9d095
Instruction ID: 23007792572c68442009fbfa890043484226e4b351f00be67b17a1cec0f84818
Opcode Fuzzy Hash: f9bb0c18178c7763a18e91096aa994ea1649b54a1f3fd466ca24196182e9d095
Instruction Fuzzy Hash: 16318075505740AFE722CF55CC84F96BBF8EF06610F08849AE9858B692D364E909CB61

Uniqueness

Uniqueness Score: -1.00%

Function 010AA462 Relevance: 1.6, APIs: 1, Instructions: 77
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegSetValueExW.KERNELBASE(?,00000E24,98A9372A,00000000,00000000,00000000,00000000), ref: 010AA4F8

Memory Dump Source

Source File: 00000009.00000002.2159058495.00000000010AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 010AA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10aa000_WindowsServices.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 8e7d3ea789f06cfe738c832115d3eaec4d51bb1ab4e028c290e90016bf10ecbf
Instruction ID: 220d30d236c44751af05cea9f27b1468e1c354761b9d3674a9e502a26620abcb
Opcode Fuzzy Hash: 8e7d3ea789f06cfe738c832115d3eaec4d51bb1ab4e028c290e90016bf10ecbf
Instruction Fuzzy Hash: 8D21B2B2504380AFD7228F55CC44FA7BFF8EF46610F08849AE985CB692D364E909C771

Uniqueness

Uniqueness Score: -1.00%

Function 010AA646 Relevance: 1.6, APIs: 1, Instructions: 72
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexW.KERNELBASE(?,?), ref: 010AA6B9

Memory Dump Source

Source File: 00000009.00000002.2159058495.00000000010AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 010AA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10aa000_WindowsServices.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: a4db2de55269504ed4e5700f11678ded23e39b77070bc046ee3be8583aa39a1b
Instruction ID: af2eb4f5b5495c95f991e60a173273777017e1a1420f6a3da3ce142a9609c389
Opcode Fuzzy Hash: a4db2de55269504ed4e5700f11678ded23e39b77070bc046ee3be8583aa39a1b
Instruction Fuzzy Hash: EE21A4716042009FE721DF69DD45BA6FBE8EF08214F04C8A9E985CBB81D775E909CA71

Uniqueness

Uniqueness Score: -1.00%

Function 010AA392 Relevance: 1.6, APIs: 1, Instructions: 69
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,98A9372A,00000000,00000000,00000000,00000000), ref: 010AA40C

Memory Dump Source

Source File: 00000009.00000002.2159058495.00000000010AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 010AA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10aa000_WindowsServices.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 69bc908d529a291025577c2699a8b36ae1bddc07060068d3ff69ef064986c17f
Instruction ID: c97b534d31e06586d16dc91b57cb3cdab9b0d993e9dcee3bea895405c71ee11b
Opcode Fuzzy Hash: 69bc908d529a291025577c2699a8b36ae1bddc07060068d3ff69ef064986c17f
Instruction Fuzzy Hash: 95218E76600204AFE731CE59CD84FA6F7ECEF44614F04C4AAE9858B691D774E909CA71

Uniqueness

Uniqueness Score: -1.00%

Function 010AA710 Relevance: 1.6, APIs: 1, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 010AA780

Memory Dump Source

Source File: 00000009.00000002.2159058495.00000000010AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 010AA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10aa000_WindowsServices.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 34efe1a02ae28b56a0d9a684403490d42dc4543710b061b904e3b9857c1904a4
Instruction ID: bcc0e6b264895eaa379ce6f7063b6f1f04994a2792b10e773d7c8d44b02053e0
Opcode Fuzzy Hash: 34efe1a02ae28b56a0d9a684403490d42dc4543710b061b904e3b9857c1904a4
Instruction Fuzzy Hash: BB21F0B55083809FD7028F25DC85752BFB8EF02224F0984EBDC858F6A3D235A909CB62

Uniqueness

Uniqueness Score: -1.00%

Function 010AA486 Relevance: 1.6, APIs: 1, Instructions: 65
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegSetValueExW.KERNELBASE(?,00000E24,98A9372A,00000000,00000000,00000000,00000000), ref: 010AA4F8

Memory Dump Source

Source File: 00000009.00000002.2159058495.00000000010AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 010AA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10aa000_WindowsServices.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 0ef8f614e6b0bf2a67ecd440c8f585b0236fa71f73fa4e4a102d197676d45322
Instruction ID: f474b7de40651992f0ab77a4a3a910e7b45ae0ac7971722cf3a920115dfc09c4
Opcode Fuzzy Hash: 0ef8f614e6b0bf2a67ecd440c8f585b0236fa71f73fa4e4a102d197676d45322
Instruction Fuzzy Hash: 5111B1B2600300AFE7318E59CD45FABBBECEF04614F04846AED858BA81D774E508CA71

Uniqueness

Uniqueness Score: -1.00%

Function 010AA74E Relevance: 1.5, APIs: 1, Instructions: 43
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 010AA780

Memory Dump Source

Source File: 00000009.00000002.2159058495.00000000010AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 010AA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10aa000_WindowsServices.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: efd42c1958abebab00f939ecca999130a74b0e8861509c8b49e0cd3a85d615c0
Instruction ID: 96ecdc82b134e07a1b120807ce567789d710f596bfb6aef57c1137a6d1a0cfb2
Opcode Fuzzy Hash: efd42c1958abebab00f939ecca999130a74b0e8861509c8b49e0cd3a85d615c0
Instruction Fuzzy Hash: 3901D471600200CFDB50CF59DD8476AFBE4EF04220F08C4BBDC468BB82D679E504CAA1

Uniqueness

Uniqueness Score: -1.00%

Function 014B0080 Relevance: .1, Instructions: 99
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000009.00000002.2159544847.00000000014B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_14b0000_WindowsServices.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 247030f0fd216f0ef12b8589e5b7936d5d03d9041c3e6ae8b6d0a2702a14e57b
Instruction ID: dfbe0f656b4dd2760be513611fd90a9a378cd1c7fd5bf061c871211917b680ee
Opcode Fuzzy Hash: 247030f0fd216f0ef12b8589e5b7936d5d03d9041c3e6ae8b6d0a2702a14e57b
Instruction Fuzzy Hash: 4A412031216242DFC724DF3AE591D8A77E2FF952087408879E4448B66AEB3D5C8FCB91

Uniqueness

Uniqueness Score: -1.00%

Function 014B0006 Relevance: .1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000009.00000002.2159544847.00000000014B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_14b0000_WindowsServices.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35a8fbfdc8ec2a8b90e24c650f4d825c0e6e5e33ea2303a1a0f0c93a52d1de7b
Instruction ID: f3578f36bef69ba408e3ce036e78ce86008420aadda15caeddf5a9aca6737e66
Opcode Fuzzy Hash: 35a8fbfdc8ec2a8b90e24c650f4d825c0e6e5e33ea2303a1a0f0c93a52d1de7b
Instruction Fuzzy Hash: A011533008E7C08FC7478B7488A19907FB0AE0726030A46CBC880CF1B7C26D684ADB32

Uniqueness

Uniqueness Score: -1.00%

Function 017905E0 Relevance: .0, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000009.00000002.2159660771.0000000001790000.00000040.00000020.00020000.00000000.sdmp, Offset: 01790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1790000_WindowsServices.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8a0b427ec05c45b166ab060aca8933592bf6356490d42639c4085f982a22d27
Instruction ID: e44961dd07b2168b44a091eb4c8a001623f642cec8ca257d6f43214f547a564c
Opcode Fuzzy Hash: b8a0b427ec05c45b166ab060aca8933592bf6356490d42639c4085f982a22d27
Instruction Fuzzy Hash: F70186B650D7C06FD7118F159C41862FFF8EF86620709C4EFEC498BA52D225A909CB72

Uniqueness

Uniqueness Score: -1.00%

Function 01790606 Relevance: .0, Instructions: 27
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000009.00000002.2159660771.0000000001790000.00000040.00000020.00020000.00000000.sdmp, Offset: 01790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1790000_WindowsServices.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab2b920421bb2c64182e3f0b662e355b41191791fa0f7f0b64c790e23fe65011
Instruction ID: cb0074680e2af41e903c4d5e46b4f126fb34189be16a71548d8b4e475f4ad8bd
Opcode Fuzzy Hash: ab2b920421bb2c64182e3f0b662e355b41191791fa0f7f0b64c790e23fe65011
Instruction Fuzzy Hash: 0FE092B66046004B9650CF0AEC81452F7E8EB88630708C47FDC0D8BB11E636B508CAA6

Uniqueness

Uniqueness Score: -1.00%

Function 010A23F4 Relevance: .0, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000009.00000002.2159041079.00000000010A2000.00000040.00000800.00020000.00000000.sdmp, Offset: 010A2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10a2000_WindowsServices.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 765874a40b336e5ca5cbb355bfb096c1978ad1be14fb23d06a2cecf140bd16fe
Instruction ID: dc700605a0586359b4287be506eba735f529c12bd821b91710f5c71bb1bcee28
Opcode Fuzzy Hash: 765874a40b336e5ca5cbb355bfb096c1978ad1be14fb23d06a2cecf140bd16fe
Instruction Fuzzy Hash: 3AD05E79205BD14FE3269A1CC6A4B953BE4AB51714F8A44F9A840CB763CB68D5D1D600

Uniqueness

Uniqueness Score: -1.00%

Function 010A23BC Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2159041079.00000000010A2000.00000040.00000800.00020000.00000000.sdmp, Offset: 010A2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10a2000_WindowsServices.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e2215744fc9447589612ccf9c44969496d7af39e6751250d30660a1e4451909
Instruction ID: 39e98e757d59c57df09ee593b26ae0d0acc3c4dd0ec1b025347f2f93a399a114
Opcode Fuzzy Hash: 9e2215744fc9447589612ccf9c44969496d7af39e6751250d30660a1e4451909
Instruction Fuzzy Hash: 43D05E352002814BDB25DA0DC2D4F597BD4AB41714F0688F8AC508B762C7B8D8C0DA00

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report YKTNuK117e.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Njrat

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

Operating System Destruction

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\WindowsServices.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\YKTNuK117e.exe.log

C:\Users\user\AppData\Local\Temp\WindowsServices.exe

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\19447a578b6a3b2cdbc5a3dc3e7f5251.exe

\Device\ConDrv

Static File Info

General

File Icon

Static PE Info

Windows Analysis Report
YKTNuK117e.exe

Function 00EFA94F Relevance: 1.6, APIs: 1, Instructions: 98
fileCOMMON

Function 00EFA612 Relevance: 1.6, APIs: 1, Instructions: 89
synchronizationCOMMON

Function 00EFA361 Relevance: 1.6, APIs: 1, Instructions: 85
registryCOMMON

Function 00EFA462 Relevance: 1.6, APIs: 1, Instructions: 77
registryCOMMON

Function 00EFA986 Relevance: 1.6, APIs: 1, Instructions: 76
fileCOMMON

Function 00EFAA5C Relevance: 1.6, APIs: 1, Instructions: 75
COMMON

Function 00EFA646 Relevance: 1.6, APIs: 1, Instructions: 72
synchronizationCOMMON

Function 00EFAC0E Relevance: 1.6, APIs: 1, Instructions: 70
fileCOMMON

Function 00EFA392 Relevance: 1.6, APIs: 1, Instructions: 69
registryCOMMON

Function 00EFA710 Relevance: 1.6, APIs: 1, Instructions: 68
COMMON

Function 00EFA486 Relevance: 1.6, APIs: 1, Instructions: 65
registryCOMMON

Function 00EFA2D2 Relevance: 1.6, APIs: 1, Instructions: 61
COMMON

Function 00EFAC2E Relevance: 1.6, APIs: 1, Instructions: 60
fileCOMMON

Function 00EFAE30 Relevance: 1.6, APIs: 1, Instructions: 60
COMMON