Loading ...

Play interactive tourEdit tour

Analysis Report 62badb64_by_Libranalysis

Overview

General Information

Sample Name:62badb64_by_Libranalysis (renamed file extension from none to dll)
Analysis ID:413034
MD5:62badb649ed684be7a82c9cf87aab9dc
SHA1:486b84cd66962163d9b31cbecacd42db86b2fa3c
SHA256:498f35df7426e81d967a16f09501c89aed449f1a12c29acd7f28004afce116a5
Infos:

Most interesting Screenshot:

Detection

Dridex
Score:72
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Found malware configuration
Multi AV Scanner detection for submitted file
Yara detected Dridex unpacked file
C2 URLs / IPs found in malware configuration
Machine Learning detection for sample
Checks if the current process is being debugged
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to query locales information (e.g. system language)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
One or more processes crash
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

Startup

  • System is w10x64
  • loaddll32.exe (PID: 1488 cmdline: loaddll32.exe 'C:\Users\user\Desktop\62badb64_by_Libranalysis.dll' MD5: 542795ADF7CC08EFCF675D65310596E8)
    • cmd.exe (PID: 5900 cmdline: cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\62badb64_by_Libranalysis.dll',#1 MD5: F3BDBE3BB6F734E357235F4D5898582D)
      • rundll32.exe (PID: 1872 cmdline: rundll32.exe 'C:\Users\user\Desktop\62badb64_by_Libranalysis.dll',#1 MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)
        • WerFault.exe (PID: 2432 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 1872 -s 764 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)
  • cleanup

Malware Configuration

Threatname: Dridex

{"Version": 22201, "C2 list": ["43.229.206.212:443", "82.209.17.209:8172", "162.241.209.225:4125"], "RC4 keys": ["16dkGStOzdHgjuCciXGdSX7UrHWfYSUG8wEUtKNgzHrWMfTGafJbC", "39t3NdDhurvpltFNCpvA5goSylkxjIBtIwWPTv1DPbNEcuIekQC7O"]}

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000002.00000002.288254682.0000000010001000.00000020.00020000.sdmpJoeSecurity_Dridex_1Yara detected Dridex unpacked fileJoe Security

    Unpacked PEs

    SourceRuleDescriptionAuthorStrings
    2.2.rundll32.exe.10000000.3.unpackJoeSecurity_Dridex_1Yara detected Dridex unpacked fileJoe Security

      Sigma Overview

      No Sigma rule has matched

      Signature Overview

      Click to jump to signature section

      Show All Signature Results

      AV Detection:

      barindex
      Found malware configurationShow sources
      Source: 2.2.rundll32.exe.10000000.3.unpackMalware Configuration Extractor: Dridex {"Version": 22201, "C2 list": ["43.229.206.212:443", "82.209.17.209:8172", "162.241.209.225:4125"], "RC4 keys": ["16dkGStOzdHgjuCciXGdSX7UrHWfYSUG8wEUtKNgzHrWMfTGafJbC", "39t3NdDhurvpltFNCpvA5goSylkxjIBtIwWPTv1DPbNEcuIekQC7O"]}
      Multi AV Scanner detection for submitted fileShow sources
      Source: 62badb64_by_Libranalysis.dllReversingLabs: Detection: 31%
      Machine Learning detection for sampleShow sources
      Source: 62badb64_by_Libranalysis.dllJoe Sandbox ML: detected
      Source: 62badb64_by_Libranalysis.dllStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL
      Source: 62badb64_by_Libranalysis.dllStatic PE information: DYNAMIC_BASE, NX_COMPAT
      Source: Binary string: fpmvppp.pdb source: loaddll32.exe, 00000000.00000002.214765443.0000000010025000.00000002.00020000.sdmp, 62badb64_by_Libranalysis.dll

      Networking:

      barindex
      C2 URLs / IPs found in malware configurationShow sources
      Source: Malware configuration extractorIPs: 43.229.206.212:443
      Source: Malware configuration extractorIPs: 82.209.17.209:8172
      Source: Malware configuration extractorIPs: 162.241.209.225:4125
      Source: Joe Sandbox ViewIP Address: 82.209.17.209 82.209.17.209
      Source: Joe Sandbox ViewIP Address: 162.241.209.225 162.241.209.225
      Source: Joe Sandbox ViewIP Address: 43.229.206.212 43.229.206.212
      Source: Joe Sandbox ViewASN Name: PODA-ASCZ PODA-ASCZ
      Source: Joe Sandbox ViewASN Name: UNIFIEDLAYER-AS-1US UNIFIEDLAYER-AS-1US
      Source: Joe Sandbox ViewASN Name: INET-AS-IDPTInetGlobalIndoID INET-AS-IDPTInetGlobalIndoID

      E-Banking Fraud:

      barindex
      Yara detected Dridex unpacked fileShow sources
      Source: Yara matchFile source: 00000002.00000002.288254682.0000000010001000.00000020.00020000.sdmp, type: MEMORY
      Source: Yara matchFile source: 2.2.rundll32.exe.10000000.3.unpack, type: UNPACKEDPE
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_100220F00_2_100220F0
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 2_2_100114602_2_10011460
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 2_2_1000846C2_2_1000846C
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 2_2_100014942_2_10001494
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 2_2_1000A52C2_2_1000A52C
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 2_2_10011D582_2_10011D58
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 2_2_100193482_2_10019348
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 2_2_100107542_2_10010754
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 2_2_100090CC2_2_100090CC
      Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1872 -s 764
      Source: 62badb64_by_Libranalysis.dllBinary or memory string: OriginalFilenamex2otfb.dllN vs 62badb64_by_Libranalysis.dll
      Source: 62badb64_by_Libranalysis.dllStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL
      Source: 62badb64_by_Libranalysis.dllStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
      Source: classification engineClassification label: mal72.troj.winDLL@6/4@0/3
      Source: C:\Windows\SysWOW64\WerFault.exeMutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess1872
      Source: C:\Windows\SysWOW64\WerFault.exeFile created: C:\ProgramData\Microsoft\Windows\WER\Temp\WERF849.tmpJump to behavior
      Source: 62badb64_by_Libranalysis.dllStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
      Source: C:\Windows\System32\loaddll32.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\62badb64_by_Libranalysis.dll',#1
      Source: 62badb64_by_Libranalysis.dllReversingLabs: Detection: 31%
      Source: unknownProcess created: C:\Windows\System32\loaddll32.exe loaddll32.exe 'C:\Users\user\Desktop\62badb64_by_Libranalysis.dll'
      Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\62badb64_by_Libranalysis.dll',#1
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\62badb64_by_Libranalysis.dll',#1
      Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1872 -s 764
      Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\62badb64_by_Libranalysis.dll',#1Jump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\62badb64_by_Libranalysis.dll',#1Jump to behavior
      Source: 62badb64_by_Libranalysis.dllStatic PE information: DYNAMIC_BASE, NX_COMPAT
      Source: 62badb64_by_Libranalysis.dllStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
      Source: Binary string: fpmvppp.pdb source: loaddll32.exe, 00000000.00000002.214765443.0000000010025000.00000002.00020000.sdmp, 62badb64_by_Libranalysis.dll
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_10006207 push ebx; ret 0_2_10006208
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_10004E0F push 822377FAh; iretd 0_2_10004E14
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_10005813 push eax; ret 0_2_1000590D
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_10006830 push 82235DBAh; iretd 0_2_10006855
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_1000585A push eax; ret 0_2_1000590D
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_10005A7B push cs; iretd 0_2_10005B7E
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_10006A80 push ebx; iretd 0_2_10006A85
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_1000388E push 8223930Ah; iretd 0_2_10003893
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_100048AF push 8223A1AEh; iretd 0_2_100048B4
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_100066D0 push 8223737Ah; iretd 0_2_100066D5
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_100054EF push 822385B2h; iretd 0_2_100054F4
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_1000530F push 82230D7Eh; iretd 0_2_10005314
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_10002D4A push 0E950FD0h; iretd 0_2_10002D7C
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_1000574F push 82238352h; iretd 0_2_10005754
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_100037A2 push cs; retf 0_2_100037DC
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_100039C3 push edi; retf 0_2_100039C4
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_10005FD6 push 0E950020h; retf 0_2_10005FDE
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_10002DF3 push cs; iretd 0_2_10002E7C
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_100037F5 push cs; retf 0_2_100037DC
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 2_2_1000F6CC push esi; mov dword ptr [esp], 00000000h2_2_1000F6CD
      Source: initial sampleStatic PE information: section name: .text entropy: 7.53078515147
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\loaddll32.exeProcess queried: DebugPortJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 2_2_10006D50 GetUserNameW,MessageBoxW,GetLastError,CreateFileA,DebugBreak,FlushFileBuffers,FreeEnvironmentStringsA,GetConsoleOutputCP,GetEnvironmentStrings,GetLocaleInfoA,GetStartupInfoA,GetStringTypeA,HeapValidate,IsBadReadPtr,LCMapStringA,LoadLibraryA,OutputDebugStringA,2_2_10006D50
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\62badb64_by_Libranalysis.dll',#1Jump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: GetUserNameW,MessageBoxW,GetLastError,CreateFileA,DebugBreak,FlushFileBuffers,FreeEnvironmentStringsA,GetConsoleOutputCP,GetEnvironmentStrings,GetLocaleInfoA,GetStartupInfoA,GetStringTypeA,HeapValidate,IsBadReadPtr,LCMapStringA,LoadLibraryA,OutputDebugStringA,2_2_10006D50
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 2_2_10006D50 GetUserNameW,MessageBoxW,GetLastError,CreateFileA,DebugBreak,FlushFileBuffers,FreeEnvironmentStringsA,GetConsoleOutputCP,GetEnvironmentStrings,GetLocaleInfoA,GetStartupInfoA,GetStringTypeA,HeapValidate,IsBadReadPtr,LCMapStringA,LoadLibraryA,OutputDebugStringA,2_2_10006D50

      Mitre Att&ck Matrix

      Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
      Valid AccountsWindows Management InstrumentationPath InterceptionProcess Injection11Virtualization/Sandbox Evasion1OS Credential DumpingSecurity Software Discovery2Remote ServicesArchive Collected Data1Exfiltration Over Other Network MediumEncrypted Channel1Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
      Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRundll321LSASS MemoryVirtualization/Sandbox Evasion1Remote Desktop ProtocolData from Removable MediaExfiltration Over BluetoothApplication Layer Protocol1Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
      Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Software Packing2Security Account ManagerAccount Discovery1SMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationSteganographyExploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
      Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Process Injection11NTDSSystem Owner/User Discovery1Distributed Component Object ModelInput CaptureScheduled TransferProtocol ImpersonationSIM Card SwapCarrier Billing Fraud
      Cloud AccountsCronNetwork Logon ScriptNetwork Logon ScriptObfuscated Files or Information2LSA SecretsSystem Information Discovery11SSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
      Replication Through Removable MediaLaunchdRc.commonRc.commonSteganographyCached Domain CredentialsRemote System Discovery1VNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features

      Behavior Graph

      Hide Legend

      Legend:

      • Process
      • Signature
      • Created File
      • DNS/IP Info
      • Is Dropped
      • Is Windows Process
      • Number of created Registry Values
      • Number of created Files
      • Visual Basic
      • Delphi
      • Java
      • .Net C# or VB.NET
      • C, C++ or other language
      • Is malicious
      • Internet
      behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 413034 Sample: 62badb64_by_Libranalysis Startdate: 13/05/2021 Architecture: WINDOWS Score: 72 17 162.241.209.225 UNIFIEDLAYER-AS-1US United States 2->17 19 82.209.17.209 PODA-ASCZ Czech Republic 2->19 21 43.229.206.212 INET-AS-IDPTInetGlobalIndoID Indonesia 2->21 23 Found malware configuration 2->23 25 Multi AV Scanner detection for submitted file 2->25 27 Yara detected Dridex unpacked file 2->27 29 2 other signatures 2->29 9 loaddll32.exe 1 2->9         started        signatures3 process4 process5 11 cmd.exe 1 9->11         started        process6 13 rundll32.exe 11->13         started        process7 15 WerFault.exe 23 9 13->15         started       

      Screenshots

      Thumbnails

      This section contains all screenshots as thumbnails, including those not shown in the slideshow.

      windows-stand

      Antivirus, Machine Learning and Genetic Malware Detection

      Initial Sample

      SourceDetectionScannerLabelLink
      62badb64_by_Libranalysis.dll32%ReversingLabsWin32.Trojan.Convagent
      62badb64_by_Libranalysis.dll100%Joe Sandbox ML

      Dropped Files

      No Antivirus matches

      Unpacked PE Files

      SourceDetectionScannerLabelLinkDownload
      2.2.rundll32.exe.29c0000.2.unpack100%AviraTR/Crypt.XPACK.GenDownload File

      Domains

      No Antivirus matches

      URLs

      No Antivirus matches

      Domains and IPs

      Contacted Domains

      No contacted domains info

      Contacted IPs

      • No. of IPs < 25%
      • 25% < No. of IPs < 50%
      • 50% < No. of IPs < 75%
      • 75% < No. of IPs

      Public

      IPDomainCountryFlagASNASN NameMalicious
      82.209.17.209
      unknownCzech Republic
      30764PODA-ASCZtrue
      162.241.209.225
      unknownUnited States
      46606UNIFIEDLAYER-AS-1UStrue
      43.229.206.212
      unknownIndonesia
      24532INET-AS-IDPTInetGlobalIndoIDtrue

      General Information

      Joe Sandbox Version:32.0.0 Black Diamond
      Analysis ID:413034
      Start date:13.05.2021
      Start time:06:39:40
      Joe Sandbox Product:CloudBasic
      Overall analysis duration:0h 6m 13s
      Hypervisor based Inspection enabled:false
      Report type:full
      Sample file name:62badb64_by_Libranalysis (renamed file extension from none to dll)
      Cookbook file name:default.jbs
      Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
      Number of analysed new started processes analysed:29
      Number of new started drivers analysed:0
      Number of existing processes analysed:0
      Number of existing drivers analysed:0
      Number of injected processes analysed:0
      Technologies:
      • HCA enabled
      • EGA enabled
      • HDC enabled
      • AMSI enabled
      Analysis Mode:default
      Analysis stop reason:Timeout
      Detection:MAL
      Classification:mal72.troj.winDLL@6/4@0/3
      EGA Information:Failed
      HDC Information:
      • Successful, ratio: 57% (good quality ratio 49.4%)
      • Quality average: 67.4%
      • Quality standard deviation: 35.6%
      HCA Information:
      • Successful, ratio: 100%
      • Number of executed functions: 2
      • Number of non-executed functions: 3
      Cookbook Comments:
      • Adjust boot time
      • Enable AMSI

      Simulations

      Behavior and APIs

      TimeTypeDescription
      06:41:44API Interceptor1x Sleep call for process: WerFault.exe modified

      Joe Sandbox View / Context

      IPs

      MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
      82.209.17.2090ee1d71e_by_Libranalysis.dllGet hashmaliciousBrowse
        ce9a5575_by_Libranalysis.dllGet hashmaliciousBrowse
          1bbde683_by_Libranalysis.dllGet hashmaliciousBrowse
            514b5b51_by_Libranalysis.dllGet hashmaliciousBrowse
              a13bac07_by_Libranalysis.dllGet hashmaliciousBrowse
                d310ebba_by_Libranalysis.dllGet hashmaliciousBrowse
                  634459e1_by_Libranalysis.dllGet hashmaliciousBrowse
                    7af9a7b0_by_Libranalysis.dllGet hashmaliciousBrowse
                      1bbde683_by_Libranalysis.dllGet hashmaliciousBrowse
                        ce9a5575_by_Libranalysis.dllGet hashmaliciousBrowse
                          514b5b51_by_Libranalysis.dllGet hashmaliciousBrowse
                            512d531a_by_Libranalysis.dllGet hashmaliciousBrowse
                              7c4e952c_by_Libranalysis.dllGet hashmaliciousBrowse
                                7af9a7b0_by_Libranalysis.dllGet hashmaliciousBrowse
                                  d310ebba_by_Libranalysis.dllGet hashmaliciousBrowse
                                    512d531a_by_Libranalysis.dllGet hashmaliciousBrowse
                                      7c4e952c_by_Libranalysis.dllGet hashmaliciousBrowse
                                        SecuriteInfo.com.Trojan.Win32.Save.a.22467.dllGet hashmaliciousBrowse
                                          94fca788_by_Libranalysis.dllGet hashmaliciousBrowse
                                            e97b5e6f_by_Libranalysis.dllGet hashmaliciousBrowse
                                              162.241.209.2250ee1d71e_by_Libranalysis.dllGet hashmaliciousBrowse
                                                ce9a5575_by_Libranalysis.dllGet hashmaliciousBrowse
                                                  1bbde683_by_Libranalysis.dllGet hashmaliciousBrowse
                                                    514b5b51_by_Libranalysis.dllGet hashmaliciousBrowse
                                                      a13bac07_by_Libranalysis.dllGet hashmaliciousBrowse
                                                        d310ebba_by_Libranalysis.dllGet hashmaliciousBrowse
                                                          634459e1_by_Libranalysis.dllGet hashmaliciousBrowse
                                                            7af9a7b0_by_Libranalysis.dllGet hashmaliciousBrowse
                                                              1bbde683_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                ce9a5575_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                  514b5b51_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                    512d531a_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                      7c4e952c_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                        7af9a7b0_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                          d310ebba_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                            512d531a_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                              7c4e952c_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                SecuriteInfo.com.Trojan.Win32.Save.a.22467.dllGet hashmaliciousBrowse
                                                                                  94fca788_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                    e97b5e6f_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                      43.229.206.2120ee1d71e_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                        ce9a5575_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                          1bbde683_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                            514b5b51_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                              a13bac07_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                d310ebba_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                  634459e1_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                    7af9a7b0_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                      1bbde683_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                        ce9a5575_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                          514b5b51_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                            512d531a_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                              7c4e952c_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                7af9a7b0_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                  d310ebba_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                    512d531a_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                      7c4e952c_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                        SecuriteInfo.com.Trojan.Win32.Save.a.22467.dllGet hashmaliciousBrowse
                                                                                                                          94fca788_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                            e97b5e6f_by_Libranalysis.dllGet hashmaliciousBrowse

                                                                                                                              Domains

                                                                                                                              No context

                                                                                                                              ASN

                                                                                                                              MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                                                                              PODA-ASCZ0ee1d71e_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 82.209.17.209
                                                                                                                              ce9a5575_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 82.209.17.209
                                                                                                                              1bbde683_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 82.209.17.209
                                                                                                                              514b5b51_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 82.209.17.209
                                                                                                                              a13bac07_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 82.209.17.209
                                                                                                                              d310ebba_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 82.209.17.209
                                                                                                                              634459e1_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 82.209.17.209
                                                                                                                              7af9a7b0_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 82.209.17.209
                                                                                                                              1bbde683_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 82.209.17.209
                                                                                                                              ce9a5575_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 82.209.17.209
                                                                                                                              514b5b51_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 82.209.17.209
                                                                                                                              512d531a_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 82.209.17.209
                                                                                                                              7c4e952c_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 82.209.17.209
                                                                                                                              7af9a7b0_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 82.209.17.209
                                                                                                                              d310ebba_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 82.209.17.209
                                                                                                                              512d531a_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 82.209.17.209
                                                                                                                              7c4e952c_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 82.209.17.209
                                                                                                                              SecuriteInfo.com.Trojan.Win32.Save.a.22467.dllGet hashmaliciousBrowse
                                                                                                                              • 82.209.17.209
                                                                                                                              94fca788_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 82.209.17.209
                                                                                                                              e97b5e6f_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 82.209.17.209
                                                                                                                              INET-AS-IDPTInetGlobalIndoID0ee1d71e_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 43.229.206.212
                                                                                                                              ce9a5575_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 43.229.206.212
                                                                                                                              1bbde683_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 43.229.206.212
                                                                                                                              514b5b51_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 43.229.206.212
                                                                                                                              a13bac07_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 43.229.206.212
                                                                                                                              d310ebba_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 43.229.206.212
                                                                                                                              634459e1_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 43.229.206.212
                                                                                                                              7af9a7b0_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 43.229.206.212
                                                                                                                              1bbde683_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 43.229.206.212
                                                                                                                              ce9a5575_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 43.229.206.212
                                                                                                                              514b5b51_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 43.229.206.212
                                                                                                                              512d531a_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 43.229.206.212
                                                                                                                              7c4e952c_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 43.229.206.212
                                                                                                                              7af9a7b0_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 43.229.206.212
                                                                                                                              d310ebba_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 43.229.206.212
                                                                                                                              512d531a_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 43.229.206.212
                                                                                                                              7c4e952c_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 43.229.206.212
                                                                                                                              SecuriteInfo.com.Trojan.Win32.Save.a.22467.dllGet hashmaliciousBrowse
                                                                                                                              • 43.229.206.212
                                                                                                                              94fca788_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 43.229.206.212
                                                                                                                              e97b5e6f_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 43.229.206.212
                                                                                                                              UNIFIEDLAYER-AS-1US0ee1d71e_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 162.241.209.225
                                                                                                                              ce9a5575_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 162.241.209.225
                                                                                                                              1bbde683_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 162.241.209.225
                                                                                                                              514b5b51_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 162.241.209.225
                                                                                                                              a13bac07_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 162.241.209.225
                                                                                                                              d310ebba_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 162.241.209.225
                                                                                                                              634459e1_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 162.241.209.225
                                                                                                                              7af9a7b0_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 162.241.209.225
                                                                                                                              1bbde683_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 162.241.209.225
                                                                                                                              ce9a5575_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 162.241.209.225
                                                                                                                              514b5b51_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 162.241.209.225
                                                                                                                              512d531a_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 162.241.209.225
                                                                                                                              7c4e952c_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 162.241.209.225
                                                                                                                              7af9a7b0_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 162.241.209.225
                                                                                                                              d310ebba_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 162.241.209.225
                                                                                                                              512d531a_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 162.241.209.225
                                                                                                                              7c4e952c_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 162.241.209.225
                                                                                                                              SecuriteInfo.com.Trojan.Win32.Save.a.22467.dllGet hashmaliciousBrowse
                                                                                                                              • 162.241.209.225
                                                                                                                              94fca788_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 162.241.209.225
                                                                                                                              e97b5e6f_by_Libranalysis.dllGet hashmaliciousBrowse
                                                                                                                              • 162.241.209.225

                                                                                                                              JA3 Fingerprints

                                                                                                                              No context

                                                                                                                              Dropped Files

                                                                                                                              No context

                                                                                                                              Created / dropped Files

                                                                                                                              C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_rundll32.exe_6fa04aa0311062c3c9ad5e11db16fd58ac29a022_82810a17_09e403d2\Report.wer
                                                                                                                              Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                              File Type:Little-endian UTF-16 Unicode text, with CRLF line terminators
                                                                                                                              Category:dropped
                                                                                                                              Size (bytes):12478
                                                                                                                              Entropy (8bit):3.766244984044595
                                                                                                                              Encrypted:false
                                                                                                                              SSDEEP:192:3+ziM0oXBcHBUZMX4jed+UG/u7sFS274ItWcZ:3aiKXSBUZMX4jeY/u7sFX4ItWcZ
                                                                                                                              MD5:F16B3C0D86AE4D9AAEDA3DA6167FBEEB
                                                                                                                              SHA1:E0AEBE9BB723C0541B6C59A69202B51A886EF5F5
                                                                                                                              SHA-256:30D1C5197958E205C53D09E9002C3D7F2FA6B31F1620939617D8E1823492134C
                                                                                                                              SHA-512:213F6774C06E3E6CBD8F5E5D67F21CA71055843528D5B116F659887BECAA217525718AE5C9B4443D97B62178959DAABD782F0CB84F218DC7402DEEF09CB421C1
                                                                                                                              Malicious:false
                                                                                                                              Reputation:low
                                                                                                                              Preview: ..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.2.6.5.3.8.6.9.0.1.1.8.3.6.8.0.9.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.2.6.5.3.8.6.9.0.2.3.2.4.2.9.2.4.....R.e.p.o.r.t.S.t.a.t.u.s.=.2.6.8.4.3.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.b.e.a.c.6.f.7.-.6.3.0.2.-.4.a.8.e.-.8.b.f.4.-.8.c.6.2.b.5.0.3.5.5.1.7.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.2.5.f.a.0.e.7.-.f.d.1.6.-.4.1.b.3.-.8.3.0.a.-.0.7.7.c.6.7.3.d.8.8.4.3.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.7.5.0.-.0.0.0.1.-.0.0.1.7.-.c.0.e.8.-.a.1.a.2.f.d.4.7.d.7.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.b.c.c.5.d.c.3.2.2.2.0.3.4.d.3.f.2.5.7.f.1.f.d.3.5.8.8.9.e.5.b.e.9.0.
                                                                                                                              C:\ProgramData\Microsoft\Windows\WER\Temp\WERF849.tmp.dmp
                                                                                                                              Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                              File Type:Mini DuMP crash report, 14 streams, Thu May 13 13:41:41 2021, 0x1205a4 type
                                                                                                                              Category:dropped
                                                                                                                              Size (bytes):58714
                                                                                                                              Entropy (8bit):1.9540722402056436
                                                                                                                              Encrypted:false
                                                                                                                              SSDEEP:192:GxlIdCXEfVwM7EuzuM/nOyqT48i5/jSjdlti9HerobKCqUqOnH:GioEfShaVfZ0x+ejdf65GCqFuH
                                                                                                                              MD5:0A061DBD97299485B44180211BD7D69E
                                                                                                                              SHA1:FCF396DE66508D940A25E5B5D266C2E284914012
                                                                                                                              SHA-256:A843D30B4490BCCAD47F4252A04EB279C5DBDBFE056EA24CC7E920AAD54AD162
                                                                                                                              SHA-512:8EE7F5C964D6BF50FE44B41F68D1294D4296830A21EE39E990B4D30F0B112A17F1FF0A35BE2FCFDABD11536C7C88090E7DFD3CB7B35AE170B3ADDA2663BCBFE2
                                                                                                                              Malicious:false
                                                                                                                              Reputation:low
                                                                                                                              Preview: MDMP....... ........,.`...................U...........B....... ......GenuineIntelW...........T.......P...w,.`.............................0..=...............P.a.c.i.f.i.c. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................P.a.c.i.f.i.c. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.............................................................................................................................................................................................................................................................................................................................................................................................................................................................d.b.g.c.o.r.e...i.3.8.6.,.1.0...0...1.7.1.3.4...1.........................................................................................................
                                                                                                                              C:\ProgramData\Microsoft\Windows\WER\Temp\WERFB38.tmp.WERInternalMetadata.xml
                                                                                                                              Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                              File Type:XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
                                                                                                                              Category:dropped
                                                                                                                              Size (bytes):8292
                                                                                                                              Entropy (8bit):3.6940950594802526
                                                                                                                              Encrypted:false
                                                                                                                              SSDEEP:192:Rrl7r3GLNixb6D6YBJF564igmfTxVSUCprh89b9jsf/fm:RrlsNi96D6YBt64igmfTzSS9IfG
                                                                                                                              MD5:341E844C89A108745933EFEF87EBFEAB
                                                                                                                              SHA1:FB134A4DD6EDD9038077BA416E4D6D6C6891B73B
                                                                                                                              SHA-256:9BF245624135945BE0E207248E4E31475A91E4F63692DBD4D268898E879CE07A
                                                                                                                              SHA-512:28A044BE4FBA15420A3DD850EFC3CC98736C28D5FF7B33D9860704F0D1B6CB617A39BB5A4EB6B256CE9AA7D39FC5E9CA02C7AA119790BF151232AD6088B11590
                                                                                                                              Malicious:false
                                                                                                                              Reputation:low
                                                                                                                              Preview: ..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.1.8.7.2.<./.P.i.d.>.......
                                                                                                                              C:\ProgramData\Microsoft\Windows\WER\Temp\WERFC04.tmp.xml
                                                                                                                              Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                              File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                              Category:dropped
                                                                                                                              Size (bytes):4663
                                                                                                                              Entropy (8bit):4.473377653076033
                                                                                                                              Encrypted:false
                                                                                                                              SSDEEP:48:cvIwSD8zsUNJgtWI9JiSWSC8BS8fm8M4JCdstNrFKA+q8/sNFi4SrS0d:uITfSWizSNxJrNHbN4DW0d
                                                                                                                              MD5:0E8A31E19AABE562DB5CE6155AFAB8B4
                                                                                                                              SHA1:89982E70889EF147CDA9EC55C22F1D48FAD6A3A7
                                                                                                                              SHA-256:C13711961D4DF93CAF2AC839AF398EC66AD5C38975CE802B27E8534CB65A2759
                                                                                                                              SHA-512:97D25F7408CD0146E2E0AD952DC5DAE901B37FAF33A7554DCAFE3D9C85387E7D1F8AF6D7649A7E7E25E27367A2E9FEC36762535E3835C7D2F79589165002FBE0
                                                                                                                              Malicious:false
                                                                                                                              Reputation:low
                                                                                                                              Preview: <?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="987772" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

                                                                                                                              Static File Info

                                                                                                                              General

                                                                                                                              File type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                              Entropy (8bit):7.513883723327805
                                                                                                                              TrID:
                                                                                                                              • Win32 Dynamic Link Library (generic) (1002004/3) 99.60%
                                                                                                                              • Generic Win/DOS Executable (2004/3) 0.20%
                                                                                                                              • DOS Executable Generic (2002/1) 0.20%
                                                                                                                              • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                                                              File name:62badb64_by_Libranalysis.dll
                                                                                                                              File size:167424
                                                                                                                              MD5:62badb649ed684be7a82c9cf87aab9dc
                                                                                                                              SHA1:486b84cd66962163d9b31cbecacd42db86b2fa3c
                                                                                                                              SHA256:498f35df7426e81d967a16f09501c89aed449f1a12c29acd7f28004afce116a5
                                                                                                                              SHA512:c8fd8def0a09b4900e20913ed8204bc1893ef1ee99879940e10d128c0589bc83e972cc1261bf6ade3e62a2dadb5db2f31186f36a3673c49ec791c72ab3d91037
                                                                                                                              SSDEEP:3072:h9F/oNrQb4xVubbXP/NTccbsFvCeLmXH57V30e8Pj:h9F6rQXvFczvYpQP
                                                                                                                              File Content Preview:MZ......................@...................................\...........!..L.!This program cannot be run in DOS mode....$.......Xm.o...<...<...<.U!<...<..B<r..<...<...<rQ!<...<;..<...<;..<3..<au.<...<szt<"..<Rich...<.......................................

                                                                                                                              File Icon

                                                                                                                              Icon Hash:74f0e4ecccdce0e4

                                                                                                                              Static PE Info

                                                                                                                              General

                                                                                                                              Entrypoint:0x10024cc0
                                                                                                                              Entrypoint Section:.text
                                                                                                                              Digitally signed:false
                                                                                                                              Imagebase:0x10000000
                                                                                                                              Subsystem:windows gui
                                                                                                                              Image File Characteristics:32BIT_MACHINE, EXECUTABLE_IMAGE, DLL
                                                                                                                              DLL Characteristics:DYNAMIC_BASE, NX_COMPAT
                                                                                                                              Time Stamp:0x609C7F8B [Thu May 13 01:23:23 2021 UTC]
                                                                                                                              TLS Callbacks:
                                                                                                                              CLR (.Net) Version:
                                                                                                                              OS Version Major:5
                                                                                                                              OS Version Minor:0
                                                                                                                              File Version Major:5
                                                                                                                              File Version Minor:0
                                                                                                                              Subsystem Version Major:5
                                                                                                                              Subsystem Version Minor:0
                                                                                                                              Import Hash:88962f6760ea005847fb88b87e8ce1fd

                                                                                                                              Entrypoint Preview

                                                                                                                              Instruction
                                                                                                                              mov eax, 00000000h
                                                                                                                              cmpss xmm1, xmm2, 03h
                                                                                                                              mov edx, 00000000h
                                                                                                                              mov edx, 00000000h
                                                                                                                              mov edx, 00000000h
                                                                                                                              mov edx, 00000000h
                                                                                                                              mov edx, 00000000h
                                                                                                                              mov edx, 00000000h
                                                                                                                              mov edx, 00000000h
                                                                                                                              cmpss xmm1, xmm2, 03h
                                                                                                                              cmp eax, 02h
                                                                                                                              mov eax, ebp
                                                                                                                              mov dword ptr [10029734h], eax
                                                                                                                              mov eax, ebx
                                                                                                                              mov dword ptr [10029730h], eax
                                                                                                                              mov eax, esi
                                                                                                                              mov dword ptr [10029728h], eax
                                                                                                                              jne 00007F0C1CB62116h
                                                                                                                              mov eax, 00000000h
                                                                                                                              mov eax, 00000000h
                                                                                                                              mov eax, 00000000h
                                                                                                                              mov eax, 00000000h
                                                                                                                              mov eax, 00000000h
                                                                                                                              mov eax, 00000000h
                                                                                                                              mov eax, 00000000h
                                                                                                                              mov eax, 00000000h
                                                                                                                              mov eax, 00000000h
                                                                                                                              mov eax, 00000000h
                                                                                                                              mov eax, 00000000h
                                                                                                                              mov eax, 00000000h
                                                                                                                              mov eax, 00000000h
                                                                                                                              mov eax, 00000000h
                                                                                                                              mov eax, 00000000h
                                                                                                                              mov eax, 00000000h
                                                                                                                              mov eax, 00000000h
                                                                                                                              mov eax, 00000000h
                                                                                                                              mov eax, 00000000h
                                                                                                                              mov eax, 00000000h
                                                                                                                              mov eax, 00000000h
                                                                                                                              mov eax, 00000000h
                                                                                                                              mov eax, 00000000h
                                                                                                                              mov eax, 00000000h

                                                                                                                              Rich Headers

                                                                                                                              Programming Language:
                                                                                                                              • [RES] VS2015 build 23026
                                                                                                                              • [IMP] VS2013 UPD4 build 31101
                                                                                                                              • [ C ] VS2010 build 30319
                                                                                                                              • [RES] VS2015 UPD2 build 23918
                                                                                                                              • [C++] VS2005 build 50727
                                                                                                                              • [IMP] VS2010 SP1 build 40219
                                                                                                                              • [RES] VS2012 build 50727

                                                                                                                              Data Directories

                                                                                                                              NameVirtual AddressVirtual Size Is in Section
                                                                                                                              IMAGE_DIRECTORY_ENTRY_EXPORT0x2770a0x5b.rdata
                                                                                                                              IMAGE_DIRECTORY_ENTRY_IMPORT0x277d80x59.rdata
                                                                                                                              IMAGE_DIRECTORY_ENTRY_RESOURCE0x2c0000x3a0.rsrc
                                                                                                                              IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                                                              IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                                                              IMAGE_DIRECTORY_ENTRY_BASERELOC0x2d0000x1220
                                                                                                                              IMAGE_DIRECTORY_ENTRY_DEBUG0x100180x38.text
                                                                                                                              IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                              IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                              IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                                                              IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                                                              IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                              IMAGE_DIRECTORY_ENTRY_IAT0x250000x4c.rdata
                                                                                                                              IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                                              IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                                              IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                              Sections

                                                                                                                              NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                              .text0x10000x23dfe0x23e00False0.756362968206data7.53078515147IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                                                                                                                              .rdata0x250000x2be20x2c00False0.753728693182data7.42331753213IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                              .crt0x280000x38040x1800False0.79052734375MMDF mailbox7.46423038313IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
                                                                                                                              .rsrc0x2c0000x3a00x400False0.4248046875data3.06187161643IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                              .reloc0x2d0000x26c0x400False0.548828125data4.2946697642IMAGE_SCN_TYPE_NOLOAD, IMAGE_SCN_TYPE_DSECT, IMAGE_SCN_TYPE_NO_PAD, IMAGE_SCN_TYPE_GROUP, IMAGE_SCN_TYPE_COPY, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                                                                                              Resources

                                                                                                                              NameRVASizeTypeLanguageCountry
                                                                                                                              RT_VERSION0x2c0600x33cdata

                                                                                                                              Imports

                                                                                                                              DLLImport
                                                                                                                              KERNEL32.dllGetProfileSectionW, CloseHandle, OpenSemaphoreW, LoadLibraryW, OutputDebugStringA, CreateFileW, GetProfileSectionA
                                                                                                                              USER32.dllTranslateMessage
                                                                                                                              CLUSAPI.dllClusterEnum
                                                                                                                              ADVAPI32.dllRegOverridePredefKey
                                                                                                                              RASAPI32.dllRasGetConnectionStatistics
                                                                                                                              ole32.dllCreatePointerMoniker, CreateStreamOnHGlobal

                                                                                                                              Version Infos

                                                                                                                              DescriptionData
                                                                                                                              LegalCopyrightCopyright 2018
                                                                                                                              InternalNamex2otfb
                                                                                                                              FileVersion7.2.5422.00
                                                                                                                              Full Version7.2.5_000-b00
                                                                                                                              CompanyNameOracle Corporation
                                                                                                                              ProductNameXhot(BM) Ltloehey YO 8
                                                                                                                              ProductVersion7.2.5422.00
                                                                                                                              FileDescriptionJava(TM) Platform SE binary
                                                                                                                              OriginalFilenamex2otfb.dll
                                                                                                                              Translation0x0000 0x04b0

                                                                                                                              Network Behavior

                                                                                                                              Network Port Distribution

                                                                                                                              UDP Packets

                                                                                                                              TimestampSource PortDest PortSource IPDest IP
                                                                                                                              May 13, 2021 06:41:03.652812958 CEST5062053192.168.2.38.8.8.8
                                                                                                                              May 13, 2021 06:41:03.714344025 CEST53506208.8.8.8192.168.2.3
                                                                                                                              May 13, 2021 06:41:04.430651903 CEST6493853192.168.2.38.8.8.8
                                                                                                                              May 13, 2021 06:41:04.483844995 CEST53649388.8.8.8192.168.2.3
                                                                                                                              May 13, 2021 06:41:05.674524069 CEST6015253192.168.2.38.8.8.8
                                                                                                                              May 13, 2021 06:41:05.726274014 CEST53601528.8.8.8192.168.2.3
                                                                                                                              May 13, 2021 06:41:06.728713989 CEST5754453192.168.2.38.8.8.8
                                                                                                                              May 13, 2021 06:41:06.780311108 CEST53575448.8.8.8192.168.2.3
                                                                                                                              May 13, 2021 06:41:08.173418999 CEST5598453192.168.2.38.8.8.8
                                                                                                                              May 13, 2021 06:41:08.225106001 CEST53559848.8.8.8192.168.2.3
                                                                                                                              May 13, 2021 06:41:09.860260010 CEST6418553192.168.2.38.8.8.8
                                                                                                                              May 13, 2021 06:41:09.909071922 CEST53641858.8.8.8192.168.2.3
                                                                                                                              May 13, 2021 06:41:10.959237099 CEST6511053192.168.2.38.8.8.8
                                                                                                                              May 13, 2021 06:41:11.008196115 CEST53651108.8.8.8192.168.2.3
                                                                                                                              May 13, 2021 06:41:12.192686081 CEST5836153192.168.2.38.8.8.8
                                                                                                                              May 13, 2021 06:41:12.242049932 CEST53583618.8.8.8192.168.2.3
                                                                                                                              May 13, 2021 06:41:13.425529003 CEST6349253192.168.2.38.8.8.8
                                                                                                                              May 13, 2021 06:41:13.474169016 CEST53634928.8.8.8192.168.2.3
                                                                                                                              May 13, 2021 06:41:14.527354956 CEST6083153192.168.2.38.8.8.8
                                                                                                                              May 13, 2021 06:41:14.576049089 CEST53608318.8.8.8192.168.2.3
                                                                                                                              May 13, 2021 06:41:15.659015894 CEST6010053192.168.2.38.8.8.8
                                                                                                                              May 13, 2021 06:41:15.709292889 CEST53601008.8.8.8192.168.2.3
                                                                                                                              May 13, 2021 06:41:17.223618031 CEST5319553192.168.2.38.8.8.8
                                                                                                                              May 13, 2021 06:41:17.277695894 CEST53531958.8.8.8192.168.2.3
                                                                                                                              May 13, 2021 06:41:18.627093077 CEST5014153192.168.2.38.8.8.8
                                                                                                                              May 13, 2021 06:41:18.675721884 CEST53501418.8.8.8192.168.2.3
                                                                                                                              May 13, 2021 06:41:19.848098993 CEST5302353192.168.2.38.8.8.8
                                                                                                                              May 13, 2021 06:41:19.896800995 CEST53530238.8.8.8192.168.2.3
                                                                                                                              May 13, 2021 06:41:22.015274048 CEST4956353192.168.2.38.8.8.8
                                                                                                                              May 13, 2021 06:41:22.065217972 CEST53495638.8.8.8192.168.2.3
                                                                                                                              May 13, 2021 06:41:23.318886042 CEST5135253192.168.2.38.8.8.8
                                                                                                                              May 13, 2021 06:41:23.367736101 CEST53513528.8.8.8192.168.2.3
                                                                                                                              May 13, 2021 06:41:24.504224062 CEST5934953192.168.2.38.8.8.8
                                                                                                                              May 13, 2021 06:41:24.555073023 CEST53593498.8.8.8192.168.2.3
                                                                                                                              May 13, 2021 06:41:29.428563118 CEST5708453192.168.2.38.8.8.8
                                                                                                                              May 13, 2021 06:41:29.478100061 CEST53570848.8.8.8192.168.2.3
                                                                                                                              May 13, 2021 06:41:30.629561901 CEST5882353192.168.2.38.8.8.8
                                                                                                                              May 13, 2021 06:41:30.678240061 CEST53588238.8.8.8192.168.2.3
                                                                                                                              May 13, 2021 06:41:35.276113033 CEST5756853192.168.2.38.8.8.8
                                                                                                                              May 13, 2021 06:41:35.336813927 CEST53575688.8.8.8192.168.2.3
                                                                                                                              May 13, 2021 06:41:43.356128931 CEST5054053192.168.2.38.8.8.8
                                                                                                                              May 13, 2021 06:41:43.407286882 CEST53505408.8.8.8192.168.2.3
                                                                                                                              May 13, 2021 06:41:50.977519035 CEST5436653192.168.2.38.8.8.8
                                                                                                                              May 13, 2021 06:41:51.034691095 CEST53543668.8.8.8192.168.2.3
                                                                                                                              May 13, 2021 06:41:58.061698914 CEST5303453192.168.2.38.8.8.8
                                                                                                                              May 13, 2021 06:41:58.121874094 CEST53530348.8.8.8192.168.2.3
                                                                                                                              May 13, 2021 06:42:17.091839075 CEST5776253192.168.2.38.8.8.8
                                                                                                                              May 13, 2021 06:42:17.164448023 CEST53577628.8.8.8192.168.2.3
                                                                                                                              May 13, 2021 06:42:26.770354033 CEST5543553192.168.2.38.8.8.8
                                                                                                                              May 13, 2021 06:42:26.835436106 CEST53554358.8.8.8192.168.2.3
                                                                                                                              May 13, 2021 06:42:32.794495106 CEST5071353192.168.2.38.8.8.8
                                                                                                                              May 13, 2021 06:42:32.851567030 CEST53507138.8.8.8192.168.2.3
                                                                                                                              May 13, 2021 06:43:02.615999937 CEST5613253192.168.2.38.8.8.8
                                                                                                                              May 13, 2021 06:43:02.674024105 CEST53561328.8.8.8192.168.2.3
                                                                                                                              May 13, 2021 06:43:04.068234921 CEST5898753192.168.2.38.8.8.8
                                                                                                                              May 13, 2021 06:43:04.127860069 CEST53589878.8.8.8192.168.2.3

                                                                                                                              Code Manipulations

                                                                                                                              Statistics

                                                                                                                              CPU Usage

                                                                                                                              Click to jump to process

                                                                                                                              Memory Usage

                                                                                                                              Click to jump to process

                                                                                                                              High Level Behavior Distribution

                                                                                                                              Click to dive into process behavior distribution

                                                                                                                              Behavior

                                                                                                                              Click to jump to process

                                                                                                                              System Behavior

                                                                                                                              General

                                                                                                                              Start time:06:41:10
                                                                                                                              Start date:13/05/2021
                                                                                                                              Path:C:\Windows\System32\loaddll32.exe
                                                                                                                              Wow64 process (32bit):true
                                                                                                                              Commandline:loaddll32.exe 'C:\Users\user\Desktop\62badb64_by_Libranalysis.dll'
                                                                                                                              Imagebase:0xa50000
                                                                                                                              File size:116736 bytes
                                                                                                                              MD5 hash:542795ADF7CC08EFCF675D65310596E8
                                                                                                                              Has elevated privileges:true
                                                                                                                              Has administrator privileges:true
                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                              Reputation:high

                                                                                                                              General

                                                                                                                              Start time:06:41:10
                                                                                                                              Start date:13/05/2021
                                                                                                                              Path:C:\Windows\SysWOW64\cmd.exe
                                                                                                                              Wow64 process (32bit):true
                                                                                                                              Commandline:cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\62badb64_by_Libranalysis.dll',#1
                                                                                                                              Imagebase:0xbd0000
                                                                                                                              File size:232960 bytes
                                                                                                                              MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                                                                                                                              Has elevated privileges:true
                                                                                                                              Has administrator privileges:true
                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                              Reputation:high

                                                                                                                              General

                                                                                                                              Start time:06:41:11
                                                                                                                              Start date:13/05/2021
                                                                                                                              Path:C:\Windows\SysWOW64\rundll32.exe
                                                                                                                              Wow64 process (32bit):true
                                                                                                                              Commandline:rundll32.exe 'C:\Users\user\Desktop\62badb64_by_Libranalysis.dll',#1
                                                                                                                              Imagebase:0x180000
                                                                                                                              File size:61952 bytes
                                                                                                                              MD5 hash:D7CA562B0DB4F4DD0F03A89A1FDAD63D
                                                                                                                              Has elevated privileges:true
                                                                                                                              Has administrator privileges:true
                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                              Yara matches:
                                                                                                                              • Rule: JoeSecurity_Dridex_1, Description: Yara detected Dridex unpacked file, Source: 00000002.00000002.288254682.0000000010001000.00000020.00020000.sdmp, Author: Joe Security
                                                                                                                              Reputation:high

                                                                                                                              General

                                                                                                                              Start time:06:41:40
                                                                                                                              Start date:13/05/2021
                                                                                                                              Path:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                              Wow64 process (32bit):true
                                                                                                                              Commandline:C:\Windows\SysWOW64\WerFault.exe -u -p 1872 -s 764
                                                                                                                              Imagebase:0xda0000
                                                                                                                              File size:434592 bytes
                                                                                                                              MD5 hash:9E2B8ACAD48ECCA55C0230D63623661B
                                                                                                                              Has elevated privileges:true
                                                                                                                              Has administrator privileges:true
                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                              Reputation:high

                                                                                                                              Disassembly

                                                                                                                              Code Analysis

                                                                                                                              Reset < >

                                                                                                                                Executed Functions

                                                                                                                                Non-executed Functions

                                                                                                                                Strings
                                                                                                                                Memory Dump Source
                                                                                                                                • Source File: 00000000.00000002.214761274.0000000010021000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                • Associated: 00000000.00000002.214742089.0000000010000000.00000002.00020000.sdmp Download File
                                                                                                                                • Associated: 00000000.00000002.214745412.0000000010001000.00000020.00020000.sdmp Download File
                                                                                                                                • Associated: 00000000.00000002.214765443.0000000010025000.00000002.00020000.sdmp Download File
                                                                                                                                • Associated: 00000000.00000002.214769728.0000000010028000.00000008.00020000.sdmp Download File
                                                                                                                                • Associated: 00000000.00000002.214773225.000000001002C000.00000002.00020000.sdmp Download File
                                                                                                                                Similarity
                                                                                                                                • API ID:
                                                                                                                                • String ID: D$a$c$i$l$l$o$t$u
                                                                                                                                • API String ID: 0-1871623029
                                                                                                                                • Opcode ID: 39defe97fc93470a7b804fd6dc8be910f88b852905747cfc221465a6754b1396
                                                                                                                                • Instruction ID: 0084815472b1379f451f328db7bdd48fedf0434f01950e1a6ab525a79fee850b
                                                                                                                                • Opcode Fuzzy Hash: 39defe97fc93470a7b804fd6dc8be910f88b852905747cfc221465a6754b1396
                                                                                                                                • Instruction Fuzzy Hash: 6142A774608780CFD374CF28C894BDABBE1ABD9354F54892EE48D8B391E731A845CB56
                                                                                                                                Uniqueness

                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                Executed Functions

                                                                                                                                C-Code - Quality: 42%
                                                                                                                                			E029C23D4(long __ebx, void* __edi, long __esi, intOrPtr* _a4) {
                                                                                                                                				char _v20;
                                                                                                                                				intOrPtr _v24;
                                                                                                                                				intOrPtr _v28;
                                                                                                                                				intOrPtr _v32;
                                                                                                                                				intOrPtr _v36;
                                                                                                                                				intOrPtr _v40;
                                                                                                                                				char _v44;
                                                                                                                                				intOrPtr _v48;
                                                                                                                                				intOrPtr _v52;
                                                                                                                                				intOrPtr _v56;
                                                                                                                                				intOrPtr _v60;
                                                                                                                                				intOrPtr _v64;
                                                                                                                                				void* _v68;
                                                                                                                                				char* _v72;
                                                                                                                                				int _v76;
                                                                                                                                				long _v80;
                                                                                                                                				long _v84;
                                                                                                                                				DWORD* _v88;
                                                                                                                                				intOrPtr _v92;
                                                                                                                                				int _v96;
                                                                                                                                				intOrPtr* _v100;
                                                                                                                                				intOrPtr _v104;
                                                                                                                                				intOrPtr _v108;
                                                                                                                                				intOrPtr _v112;
                                                                                                                                				void* _v116;
                                                                                                                                				intOrPtr _v120;
                                                                                                                                				intOrPtr _v124;
                                                                                                                                				intOrPtr _v128;
                                                                                                                                				intOrPtr _v132;
                                                                                                                                				intOrPtr _v136;
                                                                                                                                				char* _v140;
                                                                                                                                				intOrPtr _v144;
                                                                                                                                				intOrPtr _v148;
                                                                                                                                				intOrPtr _v152;
                                                                                                                                				intOrPtr _v156;
                                                                                                                                				unsigned int _v160;
                                                                                                                                				signed int _v164;
                                                                                                                                				signed int _v168;
                                                                                                                                				signed int _v172;
                                                                                                                                				intOrPtr _v176;
                                                                                                                                				int _v180;
                                                                                                                                				char* _v184;
                                                                                                                                				intOrPtr _v188;
                                                                                                                                				intOrPtr _v192;
                                                                                                                                				char _v196;
                                                                                                                                				intOrPtr* _t142;
                                                                                                                                				int _t148;
                                                                                                                                				int _t156;
                                                                                                                                				int _t160;
                                                                                                                                				unsigned int _t180;
                                                                                                                                				int _t196;
                                                                                                                                				intOrPtr _t230;
                                                                                                                                				intOrPtr _t232;
                                                                                                                                				void* _t237;
                                                                                                                                				intOrPtr _t240;
                                                                                                                                				void* _t247;
                                                                                                                                				intOrPtr _t251;
                                                                                                                                				intOrPtr _t258;
                                                                                                                                				DWORD* _t271;
                                                                                                                                				void* _t275;
                                                                                                                                				intOrPtr* _t278;
                                                                                                                                				intOrPtr* _t279;
                                                                                                                                
                                                                                                                                				_t142 = _a4;
                                                                                                                                				_v20 = 0;
                                                                                                                                				_t247 =  *_t142;
                                                                                                                                				 *0x29c4418 = 1;
                                                                                                                                				asm("movaps xmm0, [0x29c3010]");
                                                                                                                                				asm("movups [0x29c4428], xmm0");
                                                                                                                                				_v48 = _t142;
                                                                                                                                				_v52 =  *((intOrPtr*)(_t142 + 0x48));
                                                                                                                                				_v56 =  *((intOrPtr*)(_v48 + 0x6c));
                                                                                                                                				_v196 = _t247;
                                                                                                                                				_v192 =  *((intOrPtr*)(_v48 + 0x24));
                                                                                                                                				_v188 = 4;
                                                                                                                                				_v184 =  &_v20;
                                                                                                                                				_v60 =  *((intOrPtr*)(_t142 + 0x1c));
                                                                                                                                				_v64 = 4;
                                                                                                                                				_v68 = _t247;
                                                                                                                                				_v72 =  &_v20;
                                                                                                                                				_t148 = VirtualProtect(__edi, __esi, __ebx, _t271); // executed
                                                                                                                                				_v76 = _t148;
                                                                                                                                				_v196 = _v68;
                                                                                                                                				_v192 = 0;
                                                                                                                                				_v188 =  *((intOrPtr*)(_v48 + 0x24));
                                                                                                                                				_v80 = 0x400;
                                                                                                                                				_v84 = 2;
                                                                                                                                				_v88 =  &_v20;
                                                                                                                                				_v92 = 0;
                                                                                                                                				E029C1E7B();
                                                                                                                                				E029C1094(_v68,  *((intOrPtr*)(_v48 + 0x44)), _v56);
                                                                                                                                				E029C1E7B( *((intOrPtr*)(_v48 + 0x44)), 0, _v56);
                                                                                                                                				_t156 = VirtualProtect(_v68, 0x400, 2, _v88); // executed
                                                                                                                                				_t278 = _t275 - 0x94;
                                                                                                                                				_t237 = _v68;
                                                                                                                                				_t258 =  *((intOrPtr*)(_t237 + 0x3c));
                                                                                                                                				_v96 = _t156;
                                                                                                                                				_v100 = _v68 + 0x3c;
                                                                                                                                				_v104 = _t237;
                                                                                                                                				_v108 = _t258;
                                                                                                                                				if(_t258 != 0) {
                                                                                                                                					_v104 = _v68 + (_v108 + 0x0000ffff & 0x0000ffff) + 1;
                                                                                                                                				}
                                                                                                                                				_v120 = _v104;
                                                                                                                                				if(_v52 != 0) {
                                                                                                                                					_v144 = _v120 + 0x18 + ( *(_v120 + 0x14) & 0x0000ffff);
                                                                                                                                					_v148 = 0;
                                                                                                                                					while(1) {
                                                                                                                                						_t230 = _v144;
                                                                                                                                						_v156 = _v148;
                                                                                                                                						_t180 =  *(_t230 + 0x24);
                                                                                                                                						_v160 = _t180;
                                                                                                                                						_v164 = _t180 >> 0x1e;
                                                                                                                                						_v168 = _v160 >> 0x1f;
                                                                                                                                						_v172 = _v160 >> 0x0000001d & 0x00000001;
                                                                                                                                						_v196 = _v68 +  *((intOrPtr*)(_t230 + 0xc));
                                                                                                                                						_v192 =  *((intOrPtr*)(_t230 + 8));
                                                                                                                                						_v188 =  *((intOrPtr*)(0x29c4418 + ((_v164 & 0x00000001) << 4) + (_v168 << 3) + (_v172 << 2)));
                                                                                                                                						_v184 =  &_v20;
                                                                                                                                						_v176 = _t230;
                                                                                                                                						_t196 = VirtualProtect(??, ??, ??, ??); // executed
                                                                                                                                						_t278 = _t278 - 0x10;
                                                                                                                                						_t232 = _v156 + 1;
                                                                                                                                						_v180 = _t196;
                                                                                                                                						_v144 = _v176 + 0x28;
                                                                                                                                						_v148 = _t232;
                                                                                                                                						if(_t232 == _v52) {
                                                                                                                                							goto L11;
                                                                                                                                						}
                                                                                                                                					}
                                                                                                                                				}
                                                                                                                                				L11:
                                                                                                                                				 *_t278 = _v68;
                                                                                                                                				_v124 = _v68 +  *((intOrPtr*)(_v48 + 0x10));
                                                                                                                                				_t160 = DisableThreadLibraryCalls(??);
                                                                                                                                				_t279 = _t278 - 4;
                                                                                                                                				_t240 =  *_v100;
                                                                                                                                				_v152 = _t160;
                                                                                                                                				_v112 = _t240;
                                                                                                                                				_v116 = _v68;
                                                                                                                                				if(_t240 == 0) {
                                                                                                                                					L7:
                                                                                                                                					_t251 = _v48;
                                                                                                                                					_v44 =  *((intOrPtr*)(_t251 + 0x40));
                                                                                                                                					_v40 =  *((intOrPtr*)(_t251 + 0x4c));
                                                                                                                                					_v36 =  *((intOrPtr*)(_t251 + 0x20));
                                                                                                                                					_v32 =  *((intOrPtr*)(_t251 + 0x54));
                                                                                                                                					_v28 =  *((intOrPtr*)(_t251 + 0x58));
                                                                                                                                					_v24 = _v124;
                                                                                                                                					 *_t279 = _t251;
                                                                                                                                					_v196 = 0;
                                                                                                                                					_v192 = 0x74;
                                                                                                                                					_v128 =  *((intOrPtr*)(_v116 + 0x28));
                                                                                                                                					_v132 = 0;
                                                                                                                                					_v136 = 0x74;
                                                                                                                                					_v140 =  &_v44;
                                                                                                                                					E029C1E7B();
                                                                                                                                					if(_v128 != 0) {
                                                                                                                                						_t278 =  *((intOrPtr*)( &_v44 + 0x10));
                                                                                                                                						goto __eax;
                                                                                                                                					}
                                                                                                                                					return 1;
                                                                                                                                				} else {
                                                                                                                                					_v116 = _v68 + (_v112 + 0x0000ffff & 0x0000ffff) + 1;
                                                                                                                                					goto L7;
                                                                                                                                				}
                                                                                                                                			}

































































                                                                                                                                0x029c23e0
                                                                                                                                0x029c23ee
                                                                                                                                0x029c23f5
                                                                                                                                0x029c23f7
                                                                                                                                0x029c2401
                                                                                                                                0x029c2408
                                                                                                                                0x029c2412
                                                                                                                                0x029c2418
                                                                                                                                0x029c2421
                                                                                                                                0x029c242a
                                                                                                                                0x029c242d
                                                                                                                                0x029c2431
                                                                                                                                0x029c2439
                                                                                                                                0x029c243d
                                                                                                                                0x029c2440
                                                                                                                                0x029c2443
                                                                                                                                0x029c2446
                                                                                                                                0x029c2449
                                                                                                                                0x029c2463
                                                                                                                                0x029c2469
                                                                                                                                0x029c246c
                                                                                                                                0x029c2474
                                                                                                                                0x029c2478
                                                                                                                                0x029c247b
                                                                                                                                0x029c247e
                                                                                                                                0x029c2481
                                                                                                                                0x029c2484
                                                                                                                                0x029c24a0
                                                                                                                                0x029c24bd
                                                                                                                                0x029c24e2
                                                                                                                                0x029c24e4
                                                                                                                                0x029c24ed
                                                                                                                                0x029c24f0
                                                                                                                                0x029c24fa
                                                                                                                                0x029c24fd
                                                                                                                                0x029c2500
                                                                                                                                0x029c2503
                                                                                                                                0x029c2506
                                                                                                                                0x029c255a
                                                                                                                                0x029c255a
                                                                                                                                0x029c2566
                                                                                                                                0x029c2569
                                                                                                                                0x029c25ed
                                                                                                                                0x029c25f3
                                                                                                                                0x029c265e
                                                                                                                                0x029c2664
                                                                                                                                0x029c2679
                                                                                                                                0x029c267f
                                                                                                                                0x029c2682
                                                                                                                                0x029c268b
                                                                                                                                0x029c269a
                                                                                                                                0x029c26ac
                                                                                                                                0x029c26dd
                                                                                                                                0x029c26e0
                                                                                                                                0x029c26e4
                                                                                                                                0x029c26e8
                                                                                                                                0x029c26ef
                                                                                                                                0x029c26f5
                                                                                                                                0x029c26f7
                                                                                                                                0x029c2700
                                                                                                                                0x029c2711
                                                                                                                                0x029c2717
                                                                                                                                0x029c271d
                                                                                                                                0x029c2723
                                                                                                                                0x00000000
                                                                                                                                0x00000000
                                                                                                                                0x029c2729
                                                                                                                                0x029c265e
                                                                                                                                0x029c261a
                                                                                                                                0x029c2628
                                                                                                                                0x029c2630
                                                                                                                                0x029c2633
                                                                                                                                0x029c2635
                                                                                                                                0x029c263b
                                                                                                                                0x029c2647
                                                                                                                                0x029c264d
                                                                                                                                0x029c2650
                                                                                                                                0x029c2653
                                                                                                                                0x029c2571
                                                                                                                                0x029c2581
                                                                                                                                0x029c2587
                                                                                                                                0x029c258d
                                                                                                                                0x029c2593
                                                                                                                                0x029c2599
                                                                                                                                0x029c259f
                                                                                                                                0x029c25a5
                                                                                                                                0x029c25a8
                                                                                                                                0x029c25ab
                                                                                                                                0x029c25b3
                                                                                                                                0x029c25bb
                                                                                                                                0x029c25be
                                                                                                                                0x029c25c1
                                                                                                                                0x029c25c7
                                                                                                                                0x029c25cd
                                                                                                                                0x029c25d8
                                                                                                                                0x029c2532
                                                                                                                                0x029c2538
                                                                                                                                0x029c2538
                                                                                                                                0x029c2614
                                                                                                                                0x029c2659
                                                                                                                                0x029c251f
                                                                                                                                0x00000000
                                                                                                                                0x029c251f

                                                                                                                                APIs
                                                                                                                                Strings
                                                                                                                                Memory Dump Source
                                                                                                                                • Source File: 00000002.00000002.286882912.00000000029C0000.00000040.00000001.sdmp, Offset: 029C0000, based on PE: true
                                                                                                                                Similarity
                                                                                                                                • API ID: ProtectVirtual
                                                                                                                                • String ID: t
                                                                                                                                • API String ID: 544645111-2238339752
                                                                                                                                • Opcode ID: 74e49c4f744e68365eb41ab5eb7a475d827c2a524dd53346079142cf4739219b
                                                                                                                                • Instruction ID: d6678bf4f5b630c7c321c25bd316824aa8344f8b8258c7e9e341bed3d0ccdc61
                                                                                                                                • Opcode Fuzzy Hash: 74e49c4f744e68365eb41ab5eb7a475d827c2a524dd53346079142cf4739219b
                                                                                                                                • Instruction Fuzzy Hash: E0B19DB4D04218CFDB14CF68C990A9DFBF1BF48304F2585AAE949AB351D731A981CF91
                                                                                                                                Uniqueness

                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                APIs
                                                                                                                                Memory Dump Source
                                                                                                                                • Source File: 00000002.00000002.286882912.00000000029C0000.00000040.00000001.sdmp, Offset: 029C0000, based on PE: true
                                                                                                                                Similarity
                                                                                                                                • API ID: AllocVirtual
                                                                                                                                • String ID:
                                                                                                                                • API String ID: 4275171209-0
                                                                                                                                • Opcode ID: 033d263155ffc3d0b6236b8629689c658cf4e2d9a96ebed7f8aabdbc96411034
                                                                                                                                • Instruction ID: 477edd600a8edab9da3ef121a55407e0e92ca7837d19f453e7413fd5b7037c57
                                                                                                                                • Opcode Fuzzy Hash: 033d263155ffc3d0b6236b8629689c658cf4e2d9a96ebed7f8aabdbc96411034
                                                                                                                                • Instruction Fuzzy Hash: D641D5B5D052199FDB04DFA8D4906AEBBF1FF88314F15852DE948AB340D375A841CF85
                                                                                                                                Uniqueness

                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                Non-executed Functions

                                                                                                                                C-Code - Quality: 100%
                                                                                                                                			E10006D50() {
                                                                                                                                
                                                                                                                                				 *0x1001d280 = GetUserNameW;
                                                                                                                                				 *0x1001D284 = MessageBoxW;
                                                                                                                                				 *0x1001D288 = GetLastError;
                                                                                                                                				 *0x1001D28C = CreateFileA;
                                                                                                                                				 *0x1001D290 = DebugBreak;
                                                                                                                                				 *0x1001D294 = FlushFileBuffers;
                                                                                                                                				 *0x1001D298 = FreeEnvironmentStringsA;
                                                                                                                                				 *0x1001D29C = GetConsoleOutputCP;
                                                                                                                                				 *0x1001D2A0 = GetEnvironmentStrings;
                                                                                                                                				 *0x1001D2A4 = GetLocaleInfoA;
                                                                                                                                				 *0x1001D2A8 = GetStartupInfoA;
                                                                                                                                				 *0x1001D2AC = GetStringTypeA;
                                                                                                                                				 *0x1001D2B0 = HeapValidate;
                                                                                                                                				 *0x1001D2B4 = IsBadReadPtr;
                                                                                                                                				 *0x1001D2B8 = LCMapStringA;
                                                                                                                                				 *0x1001D2BC = LoadLibraryA;
                                                                                                                                				 *0x1001D2C0 = OutputDebugStringA;
                                                                                                                                				return 0x1001d280;
                                                                                                                                			}



                                                                                                                                0x10006d61
                                                                                                                                0x10006d69
                                                                                                                                0x10006d6c
                                                                                                                                0x10006d7b
                                                                                                                                0x10006d7e
                                                                                                                                0x10006d8d
                                                                                                                                0x10006d90
                                                                                                                                0x10006d9f
                                                                                                                                0x10006da2
                                                                                                                                0x10006db1
                                                                                                                                0x10006db4
                                                                                                                                0x10006dc3
                                                                                                                                0x10006dc6
                                                                                                                                0x10006dd5
                                                                                                                                0x10006dd8
                                                                                                                                0x10006de7
                                                                                                                                0x10006dea
                                                                                                                                0x10006ded

                                                                                                                                Memory Dump Source
                                                                                                                                • Source File: 00000002.00000002.288254682.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                • Associated: 00000002.00000002.288248549.0000000010000000.00000002.00020000.sdmp Download File
                                                                                                                                • Associated: 00000002.00000002.288719164.000000001001A000.00000002.00020000.sdmp Download File
                                                                                                                                • Associated: 00000002.00000002.288739674.000000001001D000.00000004.00020000.sdmp Download File
                                                                                                                                • Associated: 00000002.00000002.288800928.000000001001F000.00000002.00020000.sdmp Download File
                                                                                                                                Yara matches
                                                                                                                                Similarity
                                                                                                                                • API ID:
                                                                                                                                • String ID:
                                                                                                                                • API String ID:
                                                                                                                                • Opcode ID: 80f6e1a276fef8b33378afc9592b3d211071bdeb012eb600a46219d4b0432dd1
                                                                                                                                • Instruction ID: 9a9f90be372116ce35b3bf57ca6adafecb814b37ff7dc50591bd4b03753dcc6b
                                                                                                                                • Opcode Fuzzy Hash: 80f6e1a276fef8b33378afc9592b3d211071bdeb012eb600a46219d4b0432dd1
                                                                                                                                • Instruction Fuzzy Hash: 99110FB8A05620CFD34ACF09D5D49117BF2BB8E360312C19AD8098B376D734D985CF54
                                                                                                                                Uniqueness

                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                C-Code - Quality: 83%
                                                                                                                                			E1000C218(void* __ecx, void* __edx) {
                                                                                                                                				char _v28;
                                                                                                                                				char _v33;
                                                                                                                                				char _v38;
                                                                                                                                				char _v43;
                                                                                                                                				void* _t24;
                                                                                                                                				char* _t25;
                                                                                                                                				char _t32;
                                                                                                                                				void* _t33;
                                                                                                                                				void* _t34;
                                                                                                                                				signed int _t38;
                                                                                                                                				char* _t40;
                                                                                                                                
                                                                                                                                				_t40 = (_t38 & 0xfffffff0) - 0x2c;
                                                                                                                                				asm("movq xmm0, [edx]");
                                                                                                                                				_t32 = 0;
                                                                                                                                				 *_t40 = 0x7b;
                                                                                                                                				asm("movq [esp+0x1], xmm0");
                                                                                                                                				_v43 = 0x2d;
                                                                                                                                				do {
                                                                                                                                					 *((char*)(_t40 + _t32 + 0xa)) =  *((intOrPtr*)(_t32 + __edx + 8));
                                                                                                                                					_t32 = _t32 + 1;
                                                                                                                                				} while (_t32 < 4);
                                                                                                                                				_v38 = 0x2d;
                                                                                                                                				_t33 = 0;
                                                                                                                                				do {
                                                                                                                                					 *((char*)(_t40 + _t33 + 0xf)) =  *((intOrPtr*)(_t33 + __edx + 0xc));
                                                                                                                                					_t33 = _t33 + 1;
                                                                                                                                				} while (_t33 < 4);
                                                                                                                                				_v33 = 0x2d;
                                                                                                                                				_t34 = 0;
                                                                                                                                				do {
                                                                                                                                					 *((char*)(_t40 + _t34 + 0x14)) =  *((intOrPtr*)(_t34 + __edx + 0x10));
                                                                                                                                					_t34 = _t34 + 1;
                                                                                                                                				} while (_t34 < 4);
                                                                                                                                				_v28 = 0x2d;
                                                                                                                                				_t24 = 0;
                                                                                                                                				do {
                                                                                                                                					asm("movd xmm0, dword [eax+edx+0x14]");
                                                                                                                                					asm("movd [esp+eax+0x19], xmm0");
                                                                                                                                					_t24 = _t24 + 4;
                                                                                                                                				} while (_t24 < 0xc);
                                                                                                                                				_t25 = _t40;
                                                                                                                                				 *((char*)(_t25 + 0x25)) = 0x7d;
                                                                                                                                				 *((char*)(_t25 + 0x26)) = 0;
                                                                                                                                				E1000DFBC(__ecx, _t25, 0);
                                                                                                                                				return __ecx;
                                                                                                                                			}














                                                                                                                                0x1000c21f
                                                                                                                                0x1000c224
                                                                                                                                0x1000c228
                                                                                                                                0x1000c22a
                                                                                                                                0x1000c22e
                                                                                                                                0x1000c234
                                                                                                                                0x1000c239
                                                                                                                                0x1000c23d
                                                                                                                                0x1000c241
                                                                                                                                0x1000c242
                                                                                                                                0x1000c249
                                                                                                                                0x1000c24e
                                                                                                                                0x1000c250
                                                                                                                                0x1000c254
                                                                                                                                0x1000c258
                                                                                                                                0x1000c259
                                                                                                                                0x1000c260
                                                                                                                                0x1000c265
                                                                                                                                0x1000c267
                                                                                                                                0x1000c26b
                                                                                                                                0x1000c26f
                                                                                                                                0x1000c270
                                                                                                                                0x1000c275
                                                                                                                                0x1000c27a
                                                                                                                                0x1000c27c
                                                                                                                                0x1000c27c
                                                                                                                                0x1000c282
                                                                                                                                0x1000c288
                                                                                                                                0x1000c28b
                                                                                                                                0x1000c292
                                                                                                                                0x1000c295
                                                                                                                                0x1000c29b
                                                                                                                                0x1000c2a0
                                                                                                                                0x1000c2ae

                                                                                                                                Strings
                                                                                                                                Memory Dump Source
                                                                                                                                • Source File: 00000002.00000002.288254682.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                • Associated: 00000002.00000002.288248549.0000000010000000.00000002.00020000.sdmp Download File
                                                                                                                                • Associated: 00000002.00000002.288719164.000000001001A000.00000002.00020000.sdmp Download File
                                                                                                                                • Associated: 00000002.00000002.288739674.000000001001D000.00000004.00020000.sdmp Download File
                                                                                                                                • Associated: 00000002.00000002.288800928.000000001001F000.00000002.00020000.sdmp Download File
                                                                                                                                Yara matches
                                                                                                                                Similarity
                                                                                                                                • API ID:
                                                                                                                                • String ID: -$-$-$-
                                                                                                                                • API String ID: 0-1033403326
                                                                                                                                • Opcode ID: 1d36367edc1a87d387ea343f4f2a29612f5303ddecac01934eed59726700fcc9
                                                                                                                                • Instruction ID: 6420cdf91b2b9fc5655fa5f82b4c53aa5eb92ddd4154ae73ebf41adf494228f8
                                                                                                                                • Opcode Fuzzy Hash: 1d36367edc1a87d387ea343f4f2a29612f5303ddecac01934eed59726700fcc9
                                                                                                                                • Instruction Fuzzy Hash: C811252091C3C04CE749DB7C548462BFFD08F9A208F1886BEE4DA86B53E525D49683B7
                                                                                                                                Uniqueness

                                                                                                                                Uniqueness Score: -1.00%